Man‐in‐The‐Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart grid. To address this, we are designing and implementing multi‐stage MiTM intrusions in an emulation‐based cyber‐physical power system testbed against a large‐scale synthetic grid model to demonstrate how such attacks can cause physical contingencies such as misguided operation and false measurements. MiTM intrusions create FCI, FDI, and replay attacks in this synthetic power grid. This work enables stakeholders to defend against these stealthy attacks, and we present detection mechanisms that are developed using multiple alerts from intrusion detection systems and network monitoring tools. Our contribution will enable other smart grid security researchers and industry to develop further detection mechanisms for inconspicuous MiTM attacks.

Modern power systems equipped with advanced communication infrastructure are cyber-physical in nature. The traditional approach of leveraging physical measurements for detecting cyber-induced physical contingencies is insufficient to reflect the accurate cyber-physical states. Moreover, deploying conventional rule-based and anomaly-based intrusion detection systems for cyberattack detection results in higher false positives. Hence, independent usage of detection tools of cyberattacks in cyber and physical sides has a limited capability. In this work, a mechanism to fuse real-time data from cyber and physical domains, to improve situational awareness of the whole system is developed. It is demonstrated how improved situational awareness can help reduce false positives in intrusion detection. This cyber and physical data fusion results in cyber-physical state space explosion which is addressed using different feature transformation and selection techniques. Our fusion engine is further integrated into a cyber-physical power system testbed as an application that collects cyber and power system telemetry from multiple sensors emulating real-world data sources found in a utility. These are synthesized into features for algorithms to detect cyber intrusions. Results are presented using the proposed data fusion application to infer False Data and Command Injection (FDI and FCI)-based Man-in-The-Middle attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features. This is followed by pre-processing such as imputation, categorical encoding, and feature reduction, before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the intrusion detection system. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, it is observed that the semi-supervised co-training technique performs at par with supervised learning methods with the proposed feature vector. The approach and toolset, as well as the dataset that is generated can be utilized to prevent threats such as false data or command injection attacks from being carried out by identifying cyber intrusions accurately.

A power system is a complex cyber‐physical system whose security is critical to its function. A major challenge is to model, analyse and visualise the communication backbone of the power systems concerning cyber threats. To achieve this, the design and evaluation of a cyber‐physical power system (CPPS) testbed called Resilient Energy Systems Lab (RESLab) are presented to capture realistic cyber, physical, and protection system features. RESLab is architected to be a fundamental platform for studying and improving the resilience of complex CPPS to cyber threats. The cyber network is emulated using Common Open Research Emulator (CORE), which acts as a gateway for the physical and protection devices to communicate. The physical grid is simulated in the dynamic time frame using Power World Dynamic Studio (PWDS). The protection components are modelled with both PWDS and physical devices including the SEL Real‐Time Automation Controller (RTAC). Distributed Network Protocol 3 (DNP3) is used to monitor and control the grid. Then, the design is exemplified and the tools are validated. This work presents four case studies on cyberattack and defence using RESLab, where we demonstrate false data and command injection using Man‐in‐the‐Middle and Denial of Service attacks and validate them on a large‐scale synthetic electric grid.

Modern power systems are the backbone of our society, supplying electric energy for daily activities. With the integration of communication networks and high penetration of renewable energy sources (RESs), modern power systems have evolved into a cross-domain multilayer complex system of systems with improved efficiency, controllability, and sustainability. However, increasing numbers of unexpected events, including natural disasters, extreme weather, and cyberattacks, are compromising the functionality of modern power systems and causing tremendous societal and economic losses. Resilience, a desirable property, is needed in modern power systems to ensure their capability to withstand all kinds of hazards while maintaining their functions. This article presents a systematic review of recent power system resilience enhancement techniques and proposes new directions for enhancing modern power systems’ resilience considering their cross-domain multilayer features. We first answer the question, “what is power system resilience?” from the perspectives of its definition, constituents, and categorization. It is important to recognize that power system resilience depends on two interdependent factors: network design and system operation. Following that, we present a review of articles published since 2016 that have developed innovative methodologies to improve power system resilience and categorize them into infrastructural resilience enhancement and operational resilience enhancement. We discuss their problem formulations and proposed quantifiable resilience measures, as well as point out their merits and limitations. Finally, we argue that it is paramount to leverage higher order subgraph studies and scientific machine learning (SciML) for modern power systems to capture the interdependence and interactions across heterogeneous networks and data for holistically enhancing their infrastructural and operational resilience.

There is a crucial need to enhance the reliability and resilience of our nation’s critical energy infrastructure. Electric power systems are cyber-physical critical infrastructure with distinct, interacting networks comprising electrical, communications, and interdependency layers. Resilience requires modeling and monitoring all layers for prevention, early detection, and proactive threat assessment. This paper presents the research and design of a novel energy management system (EMS) called Cyber-Physical Resilient Energy Systems (CYPRES) to accomplish this goal. The CYPRES EMS architecture and methods are all cyber-physical to cohesively model and analyze the power system as a cyber-physical system (CPS). Results are illustrated for this proof-of-concept solution utilizing a 2000-bus cyber-physical synthetic electric grid.