PaperlayerView exact revision on arXiv

Source-linked AI summary

Cyber-Physical Attacks in Power Networks: Models, Fundamental Limitations and Monitor Design

Fabio Pasqualetti, Florian Dörfler, Francesco Bullo

arXiv:1103.2795v1math.OCeess.SY

TL;DR

Cyber-physical attacks and failures challenge reliable power-grid operation, while static monitoring cannot exploit measurements’ temporal relationships. The paper models these threats with descriptor-system dynamics and designs provably correct monitors, showing dynamic procedures outperform static ones and may require fewer measurements.

  • Problem

    Cyber-physical attacks and physical failures challenge reliable smart-grid operation, motivating detection and identification methods beyond static measurement checks.

  • Method

    The paper uses a unified linear time-invariant descriptor-system model with unknown inputs and geometric-control tools to design dynamic residual-based detection and identification procedures.

  • Results

    Dynamic detection and identification exploit network dynamics, outperform static procedures, possibly require fewer measurements, and are illustrated on IEEE 14-bus cyber-physical attacks.

  • Takeaways & Limitations

    The analysis establishes dynamic monitoring as more capable than static monitoring for detecting and identifying cyber-physical attacks in modeled power networks.

  • Takeaways & Limitations

    Static detection cannot detect state attacks, whereas dynamic undetectability requires injected signals to remain consistent with network dynamics at every instant.

Abstract

from arXiv · show

Future power networks will be characterized by safe and reliable functionality against physical malfunctions and cyber attacks. This paper proposes a unified framework and advanced monitoring procedures to detect and identify network components malfunction or measurements corruption caused by an omniscient adversary. We model a power system under cyber-physical attack as a linear time-invariant descriptor system with unknown inputs. Our attack model generalizes the prototypical stealth, (dynamic) false-data injection and replay attacks. We characterize the fundamental limitations of both static and dynamic procedures for attack detection and identification. Additionally, we design provably-correct (dynamic) detection and identification procedures based on tools from geometric control theory. Finally, we illustrate the effectiveness of our method through a comparison with existing (static) detection algorithms, and through a numerical study.

I. INTRODUCTION · II. CYBER-PHYSICAL ATTACKS ON POWER NETWORKS · A. Structure-preserving power network model with cyber and physical attacks

The paper develops a unified framework for cyber-physical attacks in power networks, motivated by reliability limitations under failures and malicious actions. It uses a linearized structure-preserving descriptor model with unknown disturbances to support dynamic attack detection and identification.

  • I. INTRODUCTION: Cyber-physical security is a fundamental obstacle to reliable smart-grid operation because both physical infrastructure and communication layers are vulnerable.The paper motivates its framework with network failures, malignant actions, and cyber attacks on the smart grid’s communication layer.
  • I. INTRODUCTION: The paper addresses limitations of static monitoring by exploiting power-network dynamics for security assessment against omniscient attackers.Existing approaches mainly estimate voltage angles and magnitudes statically, while intentionally caused malfunctions expose limitations of such techniques.
  • I. INTRODUCTION: The contributions define attack detectability and identifiability, characterize static and dynamic monitoring limitations, and design geometric-control-based detection and identification filters.The framework unifies dynamic cyber-physical attack modeling with the deterministic static detection problem and provides analytical monitoring procedures.
  • I. INTRODUCTION: For the IEEE 14 bus system, attacks undetectable by static monitoring when four measurements are compromised become dynamically detectable if one bus or generator rotor angle is measured exactly.The dynamic procedure is guaranteed to detect such attacks under the stated exact-measurement condition.
  • A. Structure-preserving power network model with cyber and physical attacks: The network model is the linear small-signal structure-preserving descriptor system combining the linearized swing equation with the algebraic DC power flow equation.Its state comprises generator rotor angles, generator frequencies, and bus voltage angles, while initial conditions must satisfy the algebraic constraint.
  • A. Structure-preserving power network model with cyber and physical attacks: Unknown disturbances represent either state attacks integrated through network dynamics or output attacks appearing directly in the measurements.The model continuously measures a combination of descriptor-system state variables and allows unknown disturbances to capture component failures or cyber-physical attacks.
  • A. Structure-preserving power network model with cyber and physical attacks: The attack formulation permits k ∈ N0, k ≤ 2n + m + p, independently compromised state and output variables through identity attack channels.An attacker set K selects exactly k nonzero entries in the vector attack mode, and the corresponding input signatures are determined by indexed columns of the system matrices.
  • A. Structure-preserving power network model with cyber and physical attacks: The general model captures concurrent contingencies including generator or load-power changes, transmission-line outages, and sensor failures or measurement corruption.These events are represented through distinct attack signatures and nonzero attack modes, covering both physical malfunctions and external attacks.

B. Notions of detectability and identifiability for attack sets

This section defines when attack sets cannot be detected or distinguished from measurements, and frames the goal of designing procedures for attack detection and identification.

  • Detectability: An attack set is undetectable when some attacked trajectory produces the same outputs as a zero-input trajectory for all t ∈T.This equivalence is allowed to use distinct initial conditions x1 and x2 and an attack mode uK(t).
  • Identifiability: An attack set is unidentifiable when its measurements can be reproduced by a distinct attack set R satisfying |R| ≤|K| and R ≠ K.The definition permits distinct initial conditions and attack modes for K and R, with equality of outputs for all t ∈T.
  • Relationship between notions: Undetectable attacks are also unidentifiable because they cannot be distinguished from the zero input, but the converse does not hold.Thus, identifiability is a more general concern than detection: it asks whether measurements distinguish between two distinct attacks.
  • Problem formulation: The section formulates the problem of designing an attack detection and identification procedure for the linear descriptor system (3).The definitions apply to arbitrary control systems subject to external attacks and motivate analyzing static and dynamic procedures before proposing a solution.

III. LIMITATIONS OF STATIC AND DYNAMIC PROCEDURES FOR DETECTION AND IDENTIFICATION

This section examines fundamental limitations of static detection procedures and shows how exploiting network dynamics can overcome some of them. It introduces a reduced state-space model for illustration and analysis.

  • The section investigates fundamental limitations of static detection procedures.
  • Exploiting network dynamics can overcome some limitations of static detection procedures.
  • A reduced state-space model of a power network is derived for illustration and analysis.

A. Kron-reduced representation of a power network

Eliminating algebraic bus-angle variables from the index-one descriptor model yields a Kron-reduced state-space system. This reduction preserves the input/initial-state-to-output behavior and attack detectability and identifiability.

  • A. Kron-reduced representation of a power network: Eliminating the algebraic variables θ(t) produces the Kron-reduced state-space system.The descriptor system is of index one.
  • A. Kron-reduced representation of a power network: Each attack signature (B_K, D_K) maps to a corresponding signature (B̃_K, D̃_K) in the Kron-reduced system.The mapping follows the transformations for matrices B and D.
  • A. Kron-reduced representation of a power network: A bus state attack F_θf(t) directly affects the output, while a single-bus attack affects the entire connected network.The latter follows from the fully populated Laplacian lower block and positive inverse-related matrices.
  • A. Kron-reduced representation of a power network: The descriptor and Kron-reduced systems have identical input-and-initial-state-to-output maps under the descriptor constraint.This correspondence applies to trajectories of the associated systems.
  • A. Kron-reduced representation of a power network: Attack set K is identifiable or detectable in the descriptor system if and only if it is identifiable or detectable in the Kron-reduced system.This equivalence is stated in Lemma 3.1 and motivates analyzing the reduced model.

B. Fundamental limitations of a Static Detector

Static detectors cannot exploit temporal relationships, so detectability depends on whether attacked measurements can be explained by the system’s measurement map at each observation time. The same structural limitation extends to static identification, including indistinguishable attack sets and undetectable state or output attacks.

  • Static detectability: A Static Detector checks measurements at predefined instants independently, and an attack is undetectable when y(t) = ˜Cξ(t) for every t in T.The detector does not exploit relationships between measurements taken at different time instants.
  • Static detectability: An attack set K is statically undetectable exactly when an attack mode exists whose attacked measurements lie in Im(˜C), equivalently when ˜DuK(t) ∈ Im(˜C).The theorem also characterizes existence through ˜Cx + ˜D_Kg = 0 for some x and g.
  • Static detectability: No state attack can be detected statically, while an undetectable output attack exists exactly when Im(D_K) ∩ Im(C) ≠ {0}.The condition must hold through the output attack mode’s membership in Im(C) at all times.
  • Static identification: Attack set K is statically unidentifiable exactly when a distinct attack set R with |R| ≤ |K| can produce equivalent measurements under suitable attack modes.The equivalence follows from comparing the resulting outputs under attack sets K and R.
  • Static identification: Static unidentifiability exists exactly when some attack set ¯K with |¯K| ≤ 2|K| is statically undetectable, so state attacks cannot be identified.For output attacks, the corresponding condition is Im(D_¯K) ∩ Im(C) ≠ {0}.

C. Fundamental limitations of a Dynamic Detector

Dynamic detectors assess attacks continuously over time, so undetectability requires an attack signal consistent with network dynamics at every instant. Theorems characterize dynamic detection and identification limitations through input-zero behavior, invariant zeros, and indistinguishable attack sets.

  • Dynamic detectability: A dynamic detector is misled exactly when some initial state makes the measured output match the attack-free trajectory for all t ∈ R≥0.Unlike a static detector, it checks for attacks at every instant using continuous-time measurements y(t).
  • Dynamic detectability: An attack set is dynamically undetectable if and only if an attack mode exists that produces zero output for some initial condition.Equivalently, the attack mode is an input-zero for some initial condition.
  • Dynamic detectability: An undetectable attack exists if and only if there are s ∈ C, g ∈ R^|K|, and nonzero x ∈ R^2n satisfying (sI − Ã)x − B̃_Kg = 0 and C̃x + D̃_Kg = 0.These conditions identify an invariant-zero configuration for the attacked descriptor system.
  • Dynamic identifiability: Dynamic identification fails exactly when a distinct attack set R, with |R| ≤ |K|, can generate the same output as K for every t ∈ R≥0.An unidentifiable attack set of cardinality k is equivalent to an unidentifiable set K̄ with |K̄| ≤ 2k.
  • Verification limitations: Verification can be combinatorially difficult because it requires ruling out invariant zeros for all possible distinct pairs of |K|-dimensional attack sets.A graph-theoretic condition for a given topology and generic system parameters partially addresses this complexity.

IV. DESIGN OF DYNAMIC DETECTION AND IDENTIFICATION PROCEDURES · A. Detection of attacks

The paper designs a residual filter for detecting cyber-physical attacks in a power-network descriptor system. Under attack-set detectability and known initial state, the filter detects every nonzero attack exactly through a nonzero residual.

  • A. Detection of attacks: The proposed residual filter addresses the attack-detection problem whose solvability condition is established in Theorem 3.4.It is formulated for the power-network descriptor system and its associated Kron-reduced system.
  • A. Detection of attacks: Theorem 4.1 assumes a detectable attack set and known initial state x(0), then constructs the dynamic detection filter.The filter initializes its state with w(0) = x(0).
  • A. Detection of attacks: The filter gain G is selected so that ˜A + G ˜C is Hurwitz, ensuring stable filter-error dynamics.The associated error is defined as the difference between the filter state and the Kron-reduced system state.
  • A. Detection of attacks: r(t) = 0 for all t ∈R≥0 if and only if u(t) = 0 for all t ∈R≥0.Thus, a nonzero attack produces a nonzero residual, while zero attack input produces an identically zero residual.
  • A. Detection of attacks: The proof reduces detection to the absence of invariant zeros in the filter’s error system.With e(0) = 0, no invariant zeros make zero residual equivalent to zero attack input.
  • A. Detection of attacks: The detectability assumption excludes zero dynamics in the Kron-reduced system and therefore in the filter’s error system.This establishes the equivalence required by the detection theorem.
  • A. Detection of attacks: The residual-filter implementation guarantees detection of any detectable attack set.This is the section’s summarized correctness guarantee for the proposed dynamic procedure.

B. Identification of attacks

Attack identification requires testing candidate attack sets combinatorially with residual filters. Under known initial state and identifiability, the proposed filter has an identically zero residual exactly for the true attack set, while unknown initial states can make performance only asymptotic.

  • Identification procedure: Identification requires a combinatorial procedure because the attack set is initially one of the possible attack sets.The procedure tests candidate sets using residual filters.
  • Identification filter: For an identifiable attack set with known initial state, rK(t) = 0 for all t ≥ 0 if and only if K equals the attack set.The filter requires GK such that AK + GKMK is Hurwitz.
  • Identification filter: The residual remains identically zero when K is the true attack set even if the attack input is nonzero.The residual filter is therefore designed to identify the attack set rather than merely detect nonzero attack signals.
  • Residual properties: The residual system has no invariant zeros, so every nonzero signal from an alternative attack set is detectable from the residual.This establishes the equivalence between an identically zero residual and the candidate being the true attack set.
  • Identification procedure: With only an upper bound k known, the procedure runs filters for every candidate subset of cardinality k and identifies K as the intersection of sets with identically zero residuals.If the initial state is unknown, arbitrary filter initialization makes performance asymptotic, and some attacks may remain undetected or unidentified.

V. A NUMERICAL STUDY

The numerical study demonstrates the theoretical developments on the IEEE 14 bus power network modeled as a descriptor system. With the specified measurements, static detection is fundamentally limited because attacks compromising at least four measurements can remain undetected.

  • IEEE 14 bus setup: The study evaluates the proposed theoretical developments on the IEEE 14 bus power network represented as a descriptor model.The network matrix A follows the model reported in.
  • IEEE 14 bus setup: Measurements comprise real power injections at all buses, real power flows on all branches, and one rotor or bus angle.The measurement matrix C follows the configuration in.
  • Static detection limitation: k ≥4 measurements suffice for an undetectable attack against a Static Detector because four fixed nonzero attack entries can produce outputs in Im(C).The attack set remains undetected through the corresponding attack mode u_K(t).

VI. CONCLUSION

The paper analyzes fundamental limitations of static and dynamic attack detection and identification in descriptor-system power networks, and shows that dynamic methods can outperform static ones with possibly fewer measurements.

  • Conclusion: The study characterizes fundamental limitations of static and dynamic attack detection and identification procedures for power networks modeled as linear time-invariant descriptor systems.The framework addresses attack detection and identification within the descriptor-system model.
  • Conclusion: Dynamic detection and identification exploit network dynamics, outperform static counterparts, and may require fewer measurements.The conclusion reports this as a rigorous finding comparing dynamic and static procedures.
  • Conclusion: The paper also describes a provably correct attack detection and identification procedure based on dynamic res.The supplied passage truncates the procedure description after “dynamic res.”
Loading 1103.2795v1…