PaperlayerView exact revision on arXiv

Source-linked AI summary

An Online Detection Framework for Cyber Attacks on Automatic Generation Control

Tong Huang, Bharadwaj Satchidanandan, P. R. Kumar, Le Xie

arXiv:1712.06417v2eess.SYcs.SY

TL;DR

AGC depends on distributed sensor measurements that attackers can manipulate, potentially disrupting power-system operation. The paper uses dynamic watermarking to detect tampering, reports validation in two systems, and describes a framework requiring no generator hardware updates.

  • Problem

    Distributed AGC measurements can be manipulated, creating a cyber-attack risk to power-system frequency and stability.

    Source: §I · p. 1, D. Cyber Attack Models and Their Impacts · p. 3

  • Method

    The framework adds a private random signal to AGC control inputs and uses dynamic-watermarking tests to detect tampered measurements.

    Source: §I · p. 2

  • Results

    The proposed framework’s efficacy is demonstrated in a four-area synthetic power system and a 140-bus power system.

    Source: §V · p. 10

  • Takeaways & Limitations

    The framework needs no hardware update on generation units and is designed to detect attacks even when adversaries know physical and statistical system models.

    Source: §I · p. 2, §V · p. 10

    Evaluation is demonstrated in a four-area synthetic system and a 140-bus system; scaling to larger systems remains future work.

    Source: §V · p. 10

Abstract

from arXiv · show

We propose an online framework to detect cyber attacks on Automatic Generation Control (AGC). A cyber at- tack detection algorithm is designed based on the approach of Dynamic Watermarking. The detection algorithm provides a theoretical guarantee of detection of cyber attacks launched by sophisticated attackers possessing extensive knowledge of the physical and statistical models of targeted power systems. The proposed framework is practically implementable, as it needs no hardware update on generation units. The efficacy of the proposed framework is validated in both four-area system and 140-bus system.

I. INTRODUCTION

AGC relies on distributed measurements to maintain frequency and balance load, making those measurements a cyber-attack surface. The paper develops an online detection framework and formulates the multi-area system it targets.

I. INTRODUCTION

  • Attacks on distributed AGC measurements can disrupt system frequency and stability, while existing detectors lack a theoretical guarantee against arbitrary attacks.Prior approaches may also be bypassed by attackers who know physical or statistical system models.Source: §I · pp. 1–2
  • The framework is motivated by measurement-layer vulnerabilities and the need for online defense, although the paper notes that no AGC-targeting real-world attack had yet been reported.Incidents affecting industrial control systems support the concern that measurement-layer attacks are more than theoretical possibilities.Source: §I · p. 1
  • Dynamic watermarking detects manipulated AGC measurements, including attacks by model-informed adversaries, when controlled generators execute AGC commands honestly.The framework requires no hardware updates on generation units.Source: §I · p. 2

A. The Model of a Multi-area Power System without AGC

  • The paper formulates a multi-area power system using states, inputs, and measurements, with area-wise measurements and inputs grouped across control areas.The model includes tie-line flow and frequency deviations in measurements, and generator setpoints and load fluctuations in inputs.Source: A. The Model of a Multi-area Power… · p. 2

B. The Model of a Multi-area System Regulated by AGC

AGC is modeled as decentralized area-wise feedback that uses local tie-line and frequency measurements to compute generator commands. The hybrid system is discretized to support analysis of each area’s open-loop behavior.

B. The Model of a Multi-area System Regulated by AGC

  • Each balancing authority actuates local generators, enabling the multi-area AGC control policy to be represented area by area.The control law operates on telemetered measurements and produces commands for local generation units.Source: B. The Model of a Multi-area System… · p. 2
  • AGC calculates ACE from sampled tie-line flows and frequency, smooths it, then computes and sends generator commands every two to four seconds.The ACE bias factor is adjustable, and command magnitudes reflect coefficients updated by economic dispatch.Source: B. The Model of a Multi-area System… · pp. 2–3

C. Discretization of the Hybrid AGC Model

  • The continuous hybrid model is discretized at a common sampling interval, assuming each area’s command period is an integer multiple of that interval.For an area-specific open-loop model, its AGC loop is opened while other areas’ loops remain connected; the resulting model is assumed stabilizable.Source: C. Discretization of the Hybrid AGC… · p. 3

D. Cyber Attack Models and Their Impacts

The paper frames the detection problem as identifying deliberate inconsistencies between actual measurements and values reported by potentially compromised sensors.

D. Cyber Attack Models and Their Impacts

  • The assumed attacker can manipulate distributed frequency and tie-line flow sensors, reporting values different from the actual measurements.These inconsistencies are the target of detection before the paper presents three attack templates.Source: D. Cyber Attack Models and Their Impacts · p. 3

1) Replay Attack:

The paper considers replay, noise-injection, and destabilization attacks on AGC measurements. Its dynamic-watermarking defense injects a private signal into control inputs and tests reported measurements for expected statistical properties.

1) Replay Attack:

  • Replay attacks replace current sensor measurements with values recorded during normal operation.The adversary records measurements before the attack and reports those recordings during it.Source: 1) Replay Attack · pp. 3–4

2) Noise-injection Attack:

3) Destabilization Attack:

  • Destabilization attacks use a sensor-side filter to transform actual measurements into a sequence that makes the original system unstable.The paper notes that a filter can be tuned without system-model information and that attacks need not follow the listed templates.Source: 3) Destabilization Attack · p. 4

III. DYNAMIC WATERMARKING-BASED DEFENSE

  • Dynamic watermarking adds a small random private excitation to control inputs; honest measurements exhibit expected statistics related to it, unlike excessively distorted malicious reports.The signal distribution is public, but each generator’s realized signal is private.Source: §III · p. 4

A. Two Indicators of Dynamic Watermarking

  • The framework applies two tests to reported measurements after private signals are added to AGC commands, and stops sending commands when an area’s attack is detected.The state estimate used in the test is formed from input and measurement sequences using a Kalman filter.Source: §III · p. 4, A. Two Indicators of Dynamic… · p. 4

1) Test 1:

The two tests use windowed indicators to identify distortions between reported and actual measurements. The online algorithm evaluates those indicators against thresholds and halts AGC commands when either threshold is crossed.

1) Test 1:

  • Test 1 forms a windowed indicator matrix W; under normal reporting, both tests pass when reported measurements equal actual measurements throughout the window.Source: 1) Test 1 · p. 5, 2) Test 2 · p. 5

2) Test 2:

B. Online Algorithm for Detection of Cyber Attacks

  • The online algorithm computes indicators from reported measurements, private injections, load fluctuations, and AGC commands, then compares them with thresholds trained under normal operation.The training procedure uses a large window T∞ set to 1800 in this paper; thresholds can also be determined using the Neyman-Pearson criterion.Source: B. Online Algorithm for Detection of… · p. 5
  • An alarm is raised when either indicator reaches its threshold, and the balancing authority stops sending commands to the generators.Source: B. Online Algorithm for Detection of… · p. 5
  • After detection, AGC is deactivated while malicious sensors are investigated and corrected; primary frequency control is described as maintaining an acceptable range during the temporary outage.The cited acceptable range is 59.96–60.04 Hz.Source: B. Online Algorithm for Detection of… · pp. 5–6

IV. NUMERICAL EXAMPLES

The numerical evaluation applies the online defense algorithm to a four-area power system and the NPCC 140-bus system. The authors report timely detection of the tested attacks without sacrificing system performance.

  • The evaluation covers a four-area power system and the Northeastern Power Coordinating Council 140-bus power system.Source: §IV · p. 6
  • Attacks on the synthetic system are launched according to the templates presented in Section II-D.Source: §IV · p. 6
  • The authors report that the proposed approach detects these attacks in a timely manner without sacrificing system performance.Source: §IV · p. 6

1) Four-area System Description:

The four-area study evaluates dynamic-watermarking detection of a replay attack under specified system and algorithm settings. The replay is flagged shortly after it begins, while the reported normal-operation variance changes are small.

1) Four-area System Description:

  • The synthetic test system has four areas and ten generators, with local PI controllers using tie-line flows and frequency and updating every 2 seconds.Source: 1) Four-area System Description · p. 6
  • Load deviations are modeled as zero-mean i.i.d. Gaussian white noise; the chosen variance keeps frequency within 60 ± 0.03 Hz with high probability.Source: 1) Four-area System Description · p. 6

2) Parameter Setting of the Proposed Algorithm:

3) Detection of Replay Attack:

  • The replay evaded frequency-constraint alarms, but Area 1’s indicator exceeded its threshold after 31 minutes, locating attack onset between minutes 30 and 31.Source: 3) Detection of Replay Attack · p. 7

4) Detection of Noise-injection Attack:

The proposed approach detects noise-injection and destabilization attacks in their tested scenarios, including before an operator would notice the destabilization attack. The NPCC 140-bus subsection describes the system and settings used for evaluation.

4) Detection of Noise-injection Attack:

5) Detection of Destabilization Attack:

  • The approach detects the tie-line-flow destabilization attack between minutes 10 and 11, before the operator might notice it around minute 16.The passage also notes that sophisticated destabilization attacks may not make the ACE exhibit instability.Source: Figure 10 · p. 8, 5) Detection of Destabilization Attack · p. 8

1) NPCC 140-bus System Description and Parameter Setting of the Proposed Algorithm:

2) Detection of Three Types of Cyber Attack:

The simulations test detection of replay, noise-injection, destabilization, and regression-evasive attacks, then assess robustness to non-responsive generators. The proposed indicator detects the tested attacks, including one that the regression-based comparison misses, and remains effective in the reported robustness sweep.

2) Detection of Three Types of Cyber Attack:

  • Replay and noise-injection attacks on frequency measurements are both identified between minutes 30 and 31 in the NPCC 140-bus system.Fig. 13 shows the indicator evolutions for the two attacks.Source: 2) Detection of Three Types of Cyber… · p. 9, Figure 13 · p. 9
  • After the Line 78–81 flow attack begins at minute 5, consecutive indicator spikes exceed the threshold after minute 6, placing detection between minutes 5 and 6.The attack produces a growing frequency deviation; Fig. 14 shows the frequency measurements and indicator evolution.Source: Figure 14 · p. 9, 2) Detection of Three Types of Cyber… · p. 9
  • The regression comparator estimates frequency from current and past load fluctuations and alarms on measurement-estimate discrepancies, but a model-informed attacker can approximate its threshold and evade its criterion.The paper notes that this regression-based approach is not guaranteed to detect arbitrary attacks.Source: 2) Detection of Three Types of Cyber… · pp. 9–10
  • After the attack defined in (21) begins at minute 30, the proposed indicator crosses its threshold consecutively, while the regression-based |γ(t)| stays at or below η′.Fig. 15 presents |γ(t)| and the proposed indicator; the regression-based approach is described as a screening tool, not a guaranteed detector.Source: Figure 15 · p. 10, 2) Detection of Three Types of Cyber… · p. 10

D. Robustness Test

  • The robustness test varies the number of non-responsive generators from zero to five and uses θ to compare attack and normal-condition indicator levels.The paper states that θ > 1 means the two levels can be linearly separated by a threshold.Source: D. Robustness Test · p. 10
  • Both replay and noise-injection attacks remain detectable across the tested non-responsive-generator scenarios, with θR and θI greater than 1 in every scenario.Table I reports the performance-indicator scope for the generator-count sweep.Source: D. Robustness Test · p. 10, Table I · p. 10

V. CONCLUSION

The conclusion presents dynamic watermarking as the basis for online AGC cyber-attack detection, including against attackers with extensive physical and statistical system knowledge. It reports validation in two power-system models and identifies scaling to larger systems as future work.

V. CONCLUSION

  • The proposed online AGC framework uses dynamic watermarking to detect attacks by adversaries with extensive or complete physical and statistical system-model knowledge.The framework requires no hardware update on generation units.Source: §V · p. 10
  • The framework’s efficacy is demonstrated in a four-area synthetic power system and a 140-bus power system.Source: §V · p. 10
  • Scaling the proposed method to larger-scale power systems is left for future work.Source: §V · p. 10

NEYMAN-PEARSON CRITERION

The appendix describes a Neyman–Pearson threshold procedure and frames attack detection as quickest change detection on the innovations process. In that framing, an attack marks a change in process statistics, and detection delay and false-alarm rate are competing objectives.

NEYMAN-PEARSON CRITERION

  • The Neyman–Pearson procedure determines detection thresholds using the maximum tolerable false-alarm rate θ0.It selects γ0 based on θ0, derives an optimal threshold γ*, and uses it to determine η1 and η2.Source: NEYMAN-PEARSON CRITERION · pp. 10–11
  • Under the no-attack hypothesis, the test-statistic distribution is formed by convolving T copies of the weighted chi-squared sum distribution and translating the result to have mean zero.The weighted sum uses n independent chi-squared variables with one degree of freedom, scaled by covariance eigenvalues.Source: NEYMAN-PEARSON CRITERION · p. 10
  • The paper maps detection to quickest change detection on the innovations process, with attack initiation marking the statistical change; detection delay and false-alarm rate are competing objectives.The authors state that watermarking makes significant distortion cause a statistical change regardless of the attack strategy.Source: NEYMAN-PEARSON CRITERION · p. 11
Loading 1712.06417v2…