Source-linked AI summary
A Cyber Security Study of a SCADA Energy Management System: Stealthy Deception Attacks on the State Estimator
André Teixeira, György Dán, Henrik Sandberg, Karl H. Johansson
TL;DR
Bad-data detection in power-network state estimation may not catch intelligent measurement attacks, and prior linear-model guarantees leave real nonlinear estimator behavior uncertain. The paper models stealthy attacks and tests them in SCADA/EMS software, finding large undetected corruptions before convergence fails and identifying sensor protection as a way to make attacks harder.
Problem
State-estimator bad-data detection may miss intelligent measurement attacks, while the behavior of real nonlinear estimators under such attacks is uncertain.
Source: §1 · p. 2Method
The paper frames stealthy measurement corruption as a constrained attack problem and evaluates the framework in state-of-the-art SCADA/EMS software.
Source: §1 · p. 2, §3.1 · p. 6Results
Stealthy attacks triggered no bad-data alarm up to a 150MW bias, exceeding 50% of the targeted tie-line’s 260MW nominal value, before the estimator stopped converging.
Source: §4.3 · pp. 10–11Takeaways & Limitations
Allocating new sensors or securing some existing sensors can make the studied stealthy attacks more difficult to perform.
Source: §1 · p. 2Linear attack policies depend on operating conditions and omit saturation limits, so larger attacks or changed states may not remain stealthy.
Source: §3.3 · p. 6, §3.3.1 · p. 6, §3.3.2 · p. 7
Abstract
from arXiv · showhide
The electrical power network is a critical infrastructure in today's society, so its safe and reliable operation is of major concern. State estimators are commonly used in power networks, for example, to detect faulty equipment and to optimally route power flows. The estimators are often located in control centers, to which large numbers of measurements are sent over unencrypted communication channels. Therefore cyber security for state estimators becomes an important issue. In this paper we analyze the cyber security of state estimators in supervisory control and data acquisition (SCADA) for energy management systems (EMS) operating the power network. Current EMS state estimation algorithms have bad data detection (BDD) schemes to detect outliers in the measurement data. Such schemes are based on high measurement redundancy. Although these methods may detect a set of basic cyber attacks, they may fail in the presence of an intelligent attacker. We explore the latter by considering scenarios where stealthy deception attacks are performed by sending false information to the control center. We begin by presenting a recent framework that characterizes the attack as an optimization problem with the objective specified through a security metric and constraints corresponding to the attack cost. The framework is used to conduct realistic experiments on a state-of-the-art SCADA EMS software for a power network example with 14 substations, 27 buses, and 40 branches. The results indicate how state estimators for power networks can be made more resilient to cyber security attacks.
1 Introduction
Power-network state estimators support monitoring and control, but measurement-based bad-data detection may fail against intelligent attackers. This paper tests stealthy deception attacks in SCADA/EMS software and examines sensor allocation as a way to make them harder.
1 Introduction
- Critical infrastructure networks use SCADA communications to transmit information to control centers, creating cyberattack vulnerabilities in links, RTUs, and control-center systems.The introduction cites reported SCADA attacks and infrastructure vulnerabilities.Source: §1 · pp. 1–2
- State estimators use redundant measurements and a network model to provide EMS with an ongoing state estimate used in applications such as contingency analysis.SCADA relays measurements from remote terminal units to a control-center master station.Source: §1 · p. 1
- Stealthy deception attacks add measurement corruptions that can avoid bad-data alarms, even though existing detection schemes target outliers and may catch basic attacks.An attacker with a network model can search for undetectable corruptions.Source: §1 · p. 2
- Prior undetectability analyses assume an accurate linear grid model, leaving real nonlinear state-estimator responses and convergence limits unclear.Earlier residual-bound analysis had not been tested on an actual system.Source: §1 · p. 2
- The paper tests a state-of-the-art SCADA state estimator and finds that studied attacks can pass undetected for very large corruptions.The authors also report that allocating new sensors or securing some sensors can make attacks more difficult.Source: §1 · p. 2
- The paper proceeds from state-estimation theory to an attack-analysis framework and then to practical SCADA/EMS experiments.The framework section also discusses limitations of linear attack policies.Source: §1 · p. 2
2 Preliminaries
The preliminaries define the network measurements and state, explain weighted-least-squares estimation and its decoupled variant, and describe residual-based bad-data detection.
2 Preliminaries
- The preliminaries introduce power-network models and the theory behind state estimation and bad-data detection.Source: §2 · p. 2
2.1 Measurement model
- The measurement model relates a network state to active and reactive power measurements, voltage magnitudes, and measurement error under an assumed network model.The state has 2N − 1 entries for an N-bus network, while measurements are typically redundant.Source: §2.1 · pp. 2–3
2.2 State Estimator
- The state estimator finds a state minimizing weighted residual error, using Gauss–Newton iterations; constraints can encode saturation limits and physical conditions.The framework assumes unit weights for simplicity, with extension to general covariance described in.Source: §2.2 · pp. 3–4
2.3 Decoupled State Estimation
- Decoupled estimation computes phase-angle and voltage-magnitude corrections independently, and fast decoupled equations omit the cross-coupling submatrices.The active and reactive measurements predominantly affect phase angles and voltage magnitudes, respectively.Source: §2.3 · p. 4
2.4 Bad Data Detection
- Bad-data detection tests weighted measurement residuals, whose sensitivity is determined by the measurement Jacobian and whose distribution is modeled under small Gaussian errors.The residual framework underlies the hypothesis tests used to detect measurements inconsistent with presumed statistical properties.Source: §2.4 · p. 4
2.4.1 Largest normalized residual test
- The largest normalized residual test flags measurements when normalized residuals depart from their zero-mean, unit-variance distribution beyond a threshold set for a false-alarm rate.Source: §2.4.1 · p. 5
3 Stealthy deception attacks
This section formulates stealthy deception as constrained attacks on state-estimator measurements, then analyzes attack cost and the limits of linear attack policies under changing operating conditions and measurement saturation.
3.1 Attacker Model
- A stealthy attacker must target estimated measurements while ensuring SE convergence and avoiding BDD detection, represented as constraints on the attack vector.The attack model also restricts corruption of protected or pseudo-measurements.Source: §3.1 · pp. 5–6
3.2 Security Metric
- For target measurement k, αk is the minimum cost of a valid stealthy attack that increases that measurement by one unit; its cost is the minimum number of sensors corrupted.The metric is based on a linear measurement model and constraints defining valid attacks.Source: §3.2 · p. 6
3.3 Limitations of Linear Policies
- Linear attack policies depend on a Jacobian H for particular operating conditions and do not by themselves account for measurement saturation limits.The paper identifies changing conditions and unmodeled saturation as two limitations of these policies.Source: §3.3 · p. 6
3.3.1 Varying operating conditions
- When operating changes spare compromised power-flow measurements, the same attack remains stealthy and its security metric is unchanged; larger attacks under model mismatch may not pass undetected.The condition applies to line-parameter or state changes that do not affect the relevant uncompromised power-flow measurements.Source: §3.3.1 · pp. 6–7
3.3.2 Saturation limits
- Because the linear model approximates the nonlinear measurement model only near its linearization state, saturation limits should constrain attacked measurements and can reduce valid attacks.The paper notes that saturation limits can be included as inequality constraints.Source: §3.3.2 · p. 7
4 Experiments on the SCADA EMS system
Experiments in a state-of-the-art SCADA EMS tested whether coordinated stealthy attacks could alter state estimates without triggering bad-data detection. The results show substantial attack sensitivity, while indicating that sensor additions or security can make attacks harder.
4.1 Experimental Setup
- The test network had 14 substations, 27 buses, and 40 branches; attacks were simulated by changing measurement data in the EMS database using a simplified DC model.The model omitted operating-state information, reactive measurements, active–voltage coupling, line conductances, and shunt admittances.Source: §4.1 · p. 8
- About one-third of measurements had αk values of 3–4, while others exceeded 20 or were infinite; adding measurements raised security metrics but did not fully protect finite-αk targets.αk is the minimum number of measurements needed for a stealthy attack on target measurement k.Source: Figure 3 · p. 9, §4.1 · p. 9
4.2 Attack Scenario
- To change measurement 33, the attacker coordinated corruption of seven measurements across five substations; because measurements are gathered by RTUs, five RTUs could suffice.The target was active power flow on the TROY–BLOO tie-line, and the attack vector was added to the true measurement vector used by the SE.Source: §4.2 · pp. 9–10
4.3 Experimental Results
- Stealthy attacks remained undetected across the biases shown and without BDD alarms through 150 MW; above 150 MW, the SE no longer converged.Naive attacks were detected above 30 MW, after remaining undetected through 20 MW.Source: Figure 4 · p. 10, §4.3 · p. 10, Table 2 · p. 10
- A 150 MW bias exceeded 50% of the tie-line’s 260 MW nominal value, and CA warnings increased with attack size, though their relation to neglected coupling remains unresolved.The authors note that increased warnings could lead operators to take corrective action.Source: §4.3 · pp. 10–11
- The experiments used a simplified linear model and assumed an attacker with detailed network, measurement, and pseudo-measurement knowledge and access to several RTUs.The authors note that such a resource-rich attacker could potentially mount more devastating attacks than those considered.Source: §4.3 · p. 11
5 Conclusions
Experiments with state-of-the-art SCADA EMS software show that linear-model attacks can corrupt target measurements without triggering BDD alarms. The framework also identifies sensor allocation and data protection as security measures and information about pseudo-measurements and saturation limits as necessary for successful stealthy attacks.
5 Conclusions
- Linear-model attacks successfully corrupt target measurements without triggering any BDD alarms.The experiments also indicate that linear models can be used for large attacks.Source: §5 · p. 11
- The framework combines attacker and attack-cost models, attack-synthesis policies, and system security metrics for studying measurement-corruption attacks on SCADA EMS state estimators.The utility can use the security metric to strengthen system security by allocating new sensors.Source: §5 · p. 11
- Successful stealthy attacks require information about pseudo-measurements and saturation limits in addition to the measurement model.Source: §5 · p. 11
- The study identifies improved BDD schemes and methods to ensure measurement and data protection as desirable.It also briefly discusses limitations of the linear attack policies.Source: §5 · p. 11