False data injection attacks (FDIAs) represent a major class of attacks that aim to break the integrity of measurements by injecting false data into the smart metering devices in power grids. To the best of authors’ knowledge, no study has attempted to design a detector that automatically models the underlying graph topology and spatially correlated measurement data of the smart grids to better detect cyber attacks. The contributions of this article to detect and mitigate FDIAs are twofold. First, we present a generic, localized, and stealth (unobservable) attack generation methodology and publicly accessible datasets for researchers to develop and test their algorithms. Second, we propose a graph neural network (GNN) based, scalable and real-time detector of FDIAs that efficiently combines model-driven and data-driven approaches by incorporating the inherent physical connections of modern ac power grids and exploiting the spatial correlations of the measurement. It is experimentally verified by comparing the proposed GNN-based detector with the currently available FDIA detectors in the literature that our algorithm outperforms the best available solutions by 3.14%, 4.25%, and 4.41% in $F$ 1 score for standard IEEE testbeds with 14, 118, and 300 buses, respectively.

Man‐in‐The‐Middle (MiTM) attacks present numerous threats to a smart grid. In a MiTM attack, an intruder embeds itself within a conversation between two devices to either eavesdrop or impersonate one of the devices, making it appear to be a normal exchange of information. Thus, the intruder can perform false data injection (FDI) and false command injection (FCI) attacks that can compromise power system operations, such as state estimation, economic dispatch, and automatic generation control (AGC). Very few researchers have focused on MiTM methods that are difficult to detect within a smart grid. To address this, we are designing and implementing multi‐stage MiTM intrusions in an emulation‐based cyber‐physical power system testbed against a large‐scale synthetic grid model to demonstrate how such attacks can cause physical contingencies such as misguided operation and false measurements. MiTM intrusions create FCI, FDI, and replay attacks in this synthetic power grid. This work enables stakeholders to defend against these stealthy attacks, and we present detection mechanisms that are developed using multiple alerts from intrusion detection systems and network monitoring tools. Our contribution will enable other smart grid security researchers and industry to develop further detection mechanisms for inconspicuous MiTM attacks.

Modern power systems equipped with advanced communication infrastructure are cyber-physical in nature. The traditional approach of leveraging physical measurements for detecting cyber-induced physical contingencies is insufficient to reflect the accurate cyber-physical states. Moreover, deploying conventional rule-based and anomaly-based intrusion detection systems for cyberattack detection results in higher false positives. Hence, independent usage of detection tools of cyberattacks in cyber and physical sides has a limited capability. In this work, a mechanism to fuse real-time data from cyber and physical domains, to improve situational awareness of the whole system is developed. It is demonstrated how improved situational awareness can help reduce false positives in intrusion detection. This cyber and physical data fusion results in cyber-physical state space explosion which is addressed using different feature transformation and selection techniques. Our fusion engine is further integrated into a cyber-physical power system testbed as an application that collects cyber and power system telemetry from multiple sensors emulating real-world data sources found in a utility. These are synthesized into features for algorithms to detect cyber intrusions. Results are presented using the proposed data fusion application to infer False Data and Command Injection (FDI and FCI)-based Man-in-The-Middle attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features. This is followed by pre-processing such as imputation, categorical encoding, and feature reduction, before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the intrusion detection system. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, it is observed that the semi-supervised co-training technique performs at par with supervised learning methods with the proposed feature vector. The approach and toolset, as well as the dataset that is generated can be utilized to prevent threats such as false data or command injection attacks from being carried out by identifying cyber intrusions accurately.

A power system is a complex cyber‐physical system whose security is critical to its function. A major challenge is to model, analyse and visualise the communication backbone of the power systems concerning cyber threats. To achieve this, the design and evaluation of a cyber‐physical power system (CPPS) testbed called Resilient Energy Systems Lab (RESLab) are presented to capture realistic cyber, physical, and protection system features. RESLab is architected to be a fundamental platform for studying and improving the resilience of complex CPPS to cyber threats. The cyber network is emulated using Common Open Research Emulator (CORE), which acts as a gateway for the physical and protection devices to communicate. The physical grid is simulated in the dynamic time frame using Power World Dynamic Studio (PWDS). The protection components are modelled with both PWDS and physical devices including the SEL Real‐Time Automation Controller (RTAC). Distributed Network Protocol 3 (DNP3) is used to monitor and control the grid. Then, the design is exemplified and the tools are validated. This work presents four case studies on cyberattack and defence using RESLab, where we demonstrate false data and command injection using Man‐in‐the‐Middle and Denial of Service attacks and validate them on a large‐scale synthetic electric grid.

Identifying the multiple critical components in power systems whose absence together has severe impact on system performance is a crucial problem for power systems known as $(N-x)$ contingency analysis. However, the inherent combinatorial feature of the $N-x$ contingency analysis problem incurs by the increase of $x$ in the $(N-x)$ term, making the problem intractable for even relatively small test systems. We present a new framework for identifying the $N-x$ contingencies that captures both topology and physics of the network. Graph theory provides many ways to measure power grid graphs, i.e., buses as nodes and lines as edges, allowing researchers to characterize system structure and optimize algorithms. This article proposes a scalable approach based on the group betweenness centrality concept that measures the impact of multiple components in the electric power grid as well as line outage distribution factors that find the lines whose loss has the highest impact on the power flow in the network. The proposed approach is a quick and efficient solution for identifying the most critical lines in power networks. The proposed approach is validated using various test cases, and results show that the proposed approach is able to quickly identify multiple contingencies that result in violations.

There is a crucial need to enhance the reliability and resilience of our nation’s critical energy infrastructure. Electric power systems are cyber-physical critical infrastructure with distinct, interacting networks comprising electrical, communications, and interdependency layers. Resilience requires modeling and monitoring all layers for prevention, early detection, and proactive threat assessment. This paper presents the research and design of a novel energy management system (EMS) called Cyber-Physical Resilient Energy Systems (CYPRES) to accomplish this goal. The CYPRES EMS architecture and methods are all cyber-physical to cohesively model and analyze the power system as a cyber-physical system (CPS). Results are illustrated for this proof-of-concept solution utilizing a 2000-bus cyber-physical synthetic electric grid.