Power system state estimation (PSSE) is the foundation of energy management system applications. Hence, operators impose stringent requirements on PSSE data integrity. False data injection attacks (FDIAs) can cause risks to PSSE data-driven operations and demand mitigation. In this article, we present a two-step FDIA detector design. In step one, we study a novel stealthy attack policy by simultaneously considering the attacker’s cost reduction and damage production. In step two, with the aid of a deep autoencoding Gaussian mixture model (DAGMM), we design an unsupervised detection scheme to detect the stealthy attack. The DAGMM-based detector can meet the requirement of rapidity, unsupervisedness, and data imbalance tolerance. Eventually, we simulate and validate the stealthy attack policy and the corresponding detector using the benchmark IEEE 39-bus and 118-bus systems.

The safety and security of load frequency control (LFC) system are menaced by cyber attacks and physical attacks. Sophisticated attackers can launch cyber-physical attacks (CPAs), in which cyber attacks are used to increase the impacts of physical attacks by sending wrong instructions to the LFC controller. Considering that parameters of cyber attacks in CPAs may be either fixed or variable, a novel detection scheme is designed against two potential CPAs on an LFC system, namely fixed cyber-physical attacks (FCPAs) and variable cyber-physical attacks (VCPAs), respectively. As for FCPAs, dynamic characteristics of Area Control Error (ACE) are utilized to detect the compromised data. Compared with FCPAs, VCPAs are more deceptive. A relation-based (RB) feature extraction method is introduced to distinguish the signals compromised by VCPAs from the normal ones. A detection model that does not require compromised samples is developed with the aid of support vector domain description. In the end, a comprehensive detection scheme is designed to detect both FCPAs and VCPAs on the LFC system.

Studying cyber attack-defense interaction over load frequency control (LFC) had become critical for guaranteeing the frequency quality and safety operation of power systems. It was revealed that both the attacker and the defender have multiple alternatives from strategy pools, which results in optimal strategy selection in pursuit of optimal payoff. In this paper, game theory model is introduced to analyze optimal strategy of attack-defense interaction over LFC. As to payoff calculation, we consider the comprehensive evaluating metric containing both the application effect and implementation cost of specific strategies, and propose a fuzzy logic-based calculation method. Considering the incomplete information in the attack-defense interaction game, we propose a mixed strategy method to obtain the optimal strategy. The simulation results show the effectiveness of the proposed optimal strategies.

The vital importance of the relay protection system makes it difficult for attackers to attack it directly. This article points out an innovative indirect coordinated attack (ICA) against the relay, which is initiated by manipulating load-side power electronics to generate false signals, to induce relays to malfunction and thus override trip. First, this article analyzes the vulnerability of the load-side power electronic and the potential for manipulating it to cause relay to malfunction. Next, this article investigates the principles and consequences of two indirect attacks, resulting in the blocking or tripping of the directional overcurrent relay (DOCR), respectively. Notably, if these two indirect attacks are combined into the ICA, it can penetrate through multiple DOCRs, posing a considerable threat to the security of the power system. To cope with it, a defense strategy is proposed, which is to implement a blocking reasons identification technology (BRIT) as a built-in function in DOCRs. BRIT employs the recursive feature elimination method to select optimal features and then identifies the actual overcurrent signal based on bidirectional LSTMto defend against the faulty blocking caused by the ICA. Consequently, it prevents the tripping signal from causing more extensive damage. The performance of the ICA process and the defense strategy is validated using the CIGRE low-voltage microgrid example system.

Wind farm industrial control systems (ICSs) play an important role in the operation of wind turbines (WTs). To increase revenues, a corrupt wind power producer tends to compromise the ICSs of the opponents’ wind farms by launching false data injection (FDI) attacks. In this article, we investigate a novel profit-oriented FDI (POFDI) attack against wind farms and study corresponding attack detection schemes. Specifically, we proposed a potential FDI attack model against ICSs of wind farms considering the power distribution of wind farms. Based on the characteristics of the proposed attack model, a profit-oriented attack strategy is discussed as a composition of attack detection. Considering the characteristics of the compromised data and those of normal data, we develop countermeasures to detect the POFDI attack, through the relationship between the characteristics of WTs in wind farms. A relation-based detection network is used to evaluate the similarity between the data to be tested and the historical data. Simulation results show the impact of the proposed attack strategy and the effectiveness of the attack detection scheme.

Cyber attacks bring key challenges to the system reliability of load frequency control (LFC) systems. Attackers can compromise the measured data of critical variables of the LFC system, making the data received by the defender unreliable and resulting in system frequency fluctuation or even collapse. In this paper, to detect potential attacks on measured data, we propose a novel attack detection scheme using the dual-source data (DSD) of compromised variables. First, we study the characteristics of the compromised LFC system considering potentially vulnerable variables and different types of attack templates. Second, by designing a variable observer, the relationship between the known security variables and the variables which are at risk of being compromised in the LFC system is established. The features of the data obtained by the observer can reflect those of the true data. Third, a Siamese network (SN) is designed to quantify the distance between the characteristics of measured data and that of observed data. Finally, an attack detection scheme is designed by analyzing the similarity of the DSD. Simulation results verify the feasibility of the detection scheme studied in this paper.