PaperlayerView exact revision on arXiv

Source-linked AI summary

Real-Time Detection of Hybrid and Stealthy Cyber-Attacks in Smart Grid

Mehmet Necip Kurt, Yasin Yilmaz, Xiaodong Wang

arXiv:1803.00128v2cs.ITcs.CR

TL;DR

Smart-grid operation requires timely detection that remains effective against diverse and stealthy attacks. The paper develops online detection and estimation for hybrid FDI and jamming attacks, including recovered states and countermeasures for stealthy attacks. Simulations illustrate timely and reliable detection and state-recovery performance.

  • Problem

    Timely detection is critical because smart-grid anomalies can spread across the network, while smarter attackers may evade detection or increase delays.

  • Method

    The paper models the grid with Kalman-filter state estimation and proposes online CUSUM-based detection with closed-form estimates of unknown, time-varying attack parameters and recovered states.

  • Results

    Extensive simulations illustrate timely and reliable detection of hybrid FDI/jamming and stealthy attacks, along with effective state recovery for mitigating attack effects.

  • Takeaways & Limitations

    The proposed mechanisms address a diverse range of hybrid and stealthy cyber-attacks while supporting attack mitigation and system recovery.

  • Takeaways & Limitations

    The hybrid attack model does not cover network topology attacks as a special case.

Abstract

from arXiv · show

For a safe and reliable operation of the smart grid, timely detection of cyber-attacks is of critical importance. Moreover, considering smarter and more capable attackers, robust detection mechanisms are needed against a diverse range of cyber-attacks. With these purposes, we propose a robust online detection algorithm for (possibly combined) false data injection (FDI) and jamming attacks, that also provides online estimates of the unknown and time-varying attack parameters and recovered state estimates. Further, considering smarter attackers that are capable of designing stealthy attacks to prevent the detection or to increase the detection delay of the proposed algorithm, we propose additional countermeasures. Numerical studies illustrate the quick and reliable response of the proposed detection mechanisms against hybrid and stealthy cyber-attacks.

I. INTRODUCTION

Smart-grid cyber-attacks can threaten safe and reliable operation, while existing detectors have limited robustness to diverse, combined, and stealthily changing attacks. The paper proposes online detection, attack-parameter estimation, state recovery, and countermeasures for hybrid FDI and jamming attacks.

  • Motivation: Attackers may monitor power systems undetected, perform diverse attacks, and change attack parameters, making early detection essential.Detection delays are especially consequential because failures can quickly spread across the network.
  • Motivation: Cyber-attacks can manipulate smart-grid components, communications, and control-center databases, causing blackouts, market-price manipulation, and grid destabilization.The 2015 Ukraine attack caused a blackout affecting around 200,000 people for several hours.
  • Existing approaches: Conventional and machine-learning detectors commonly classify measurements as normal or anomalous, often using residual thresholds or learned nominal behavior.Related work also includes CUSUM-based, nonparametric, and window-based detectors for FDI, jamming, and DoS attacks.
  • Existing approaches: Robust extended Kalman-filter schemes bound outlier effects but do not target specific attack types, cannot distinguish attacks from heavy-tailed noise, and may lose state tracking under extreme outliers.These limitations motivate attack-aware mechanisms that support both detection and state estimation.
  • Contributions: The paper proposes a low-complexity online algorithm for possibly combined FDI and jamming attacks with unknown, time-varying attack types, magnitudes, and attacked meters.The method provides online maximum-likelihood estimates, recovered state estimates, and additional countermeasures against stealthy attacks.
  • Contributions: Online estimates of attack type, attacked meters, and attack magnitudes support timely mitigation, meter isolation, and recovery of attack-free states.Different attack types may require different countermeasures, while attacked-meter and magnitude estimates support recovery decisions.

C. Organization

The paper models the smart grid as a discrete-time linear dynamic system with meter measurements and considers FDI, jamming, and combined attacks with time-varying characteristics.

  • Organization: The paper is organized around system modeling, online detection and estimation, stealthy attacks and countermeasures, simulations, and conclusions.The detection schemes are evaluated extensively via simulations.
  • System model: The study uses a discrete-time linear dynamic model based on the commonly employed linear DC power-flow model.The state represents bus phase angles, while the measurement vector collects readings from all meters.
  • System model: Each meter collects λ measurements per time interval, with larger λ improving measurement redundancy and attack-parameter estimation.The collected measurements between t −1 and t are processed at time t.
  • System model: The model can be generalized to linear time-varying systems when the time-varying matrices A_t and H_t are known to the controller.This accommodates topology changes that make the measurement matrix vary over time.
  • Attack models: The attack model assumes an unknown launch time, time-varying attack types, magnitudes, and attacked-meter sets, with parameters constant within each interval.The considered attacks include FDI, jamming, and their combination.
  • Attack models: FDI injects additive malicious data into selected meter measurements, whereas jamming adds AWGN to communication channels affecting selected meters.The FDI and jamming measurement models specify injected data and jamming-noise variance, respectively.

3) Hybrid Attack:

Hybrid attacks combine FDI and jamming in a unified measurement model, while the proposed estimator detects attacks and recovers states using attack-parameter estimates.

  • Hybrid attack model: Hybrid attacks simultaneously launch FDI and jamming, modeled as y_t = Hx_t + a_t + w_t + n_t for t ≥ τ.Under both attacks, affected meters have nonzero FDI terms and positive jamming variances.
  • Hybrid attack model: Under independent AWGN assumptions, hybrid FDI/jamming attacks span all possible data attacks because Gaussian data are characterized by their mean and variance.The hybrid model changes both the measurement mean and variance.
  • Special cases: DoS attacks are treated as special cases of hybrid attacks through false data with opposite sign or jamming with sufficiently high noise variance.Blocked measurements receiving random or zero signals motivate this interpretation.
  • Model boundary: Correlated or non-Gaussian jamming falls outside the considered jamming model and motivates a non-parametric goodness-of-fit countermeasure.The countermeasure is referenced in Sec. IV-C.2.
  • State estimation: Two Kalman filters are used because pre- and post-attack measurement models differ, with the latter requiring estimates of the change time and attack parameters.The change point is estimated by detection, while attack parameters are estimated by maximum likelihood.
  • State estimation: Maximum-likelihood attack-parameter estimates enter the post-attack measurement update to produce recovered state estimates.Errors in ML estimates can propagate into the recovered states.

E. Problem Formulation

The paper formulates online attack detection as a non-Bayesian quickest-change problem with unknown, time-varying distributions, while jointly estimating attack parameters and recovering system states.

  • E. Problem Formulation: The objective is timely and reliable cyber-attack detection using quickest detection theory and a minimax delay criterion.The formulation constrains the average false-alarm period through a prespecified lower bound α.
  • Online detection: The method uses generalized CUSUM with estimated states and attack parameters to detect attacks sequentially.The change-point estimate is updated as measurements arrive, and maximum-likelihood attack estimates are computed online.
  • E. Problem Formulation: The problem is non-Bayesian because no a priori distribution is assumed for the unknown change point τ.The change point is treated as non-random and unknown.
  • E. Problem Formulation: The pre- and post-attack measurement densities are unknown and time-varying because the state is unobserved and attack parameters are attacker-controlled.If both densities were known, CUSUM would solve the formulation optimally; the paper instead uses estimated quantities.
  • State recovery: The proposed system aims to recover attack-free states because pre-attack estimates deviate from the actual state after an attack begins.Recovered estimates are obtained using the estimated change point and attack magnitudes in the post-attack Kalman filter.
  • Stealthy attacks: Lower bounds on attack magnitudes help control false alarms but can be exploited by smarter attackers to design small-magnitude stealthy attacks.The paper therefore analyzes stealthy attacks against the proposed detector.
  • Online detection: The detection statistic is recursively updated as g_t ← max{0, g_{t−1} + β_t}, with β_t the generalized log-likelihood ratio and h the threshold.When g_t reaches zero, the change-point estimate is reset to the current time.
  • Attack estimation: The algorithm classifies meters into no attack, FDI-only, jamming-only, and combined FDI/jamming subsets using estimated attack variables.The classification compares the corresponding likelihood-based quantities for each meter.

IV. STEALTHY ATTACKS AND COUNTERMEASURES

The paper analyzes stealthy attacks against CUSUM-based detectors, including the proposed detector with unknown and time-varying densities, and introduces countermeasures.

  • Stealthy attacks: The paper first studies stealthy attacks against CUSUM when the pre- and post-attack probability densities are known.This provides a basis for analyzing related attacks against CUSUM-based detectors more generally.
  • Proposed detector: It then examines stealthy attacks against the proposed detector, whose pre- and post-attack densities are unknown and time-varying.The analysis extends beyond the known-density setting.
  • Countermeasures: The paper presents countermeasures against the considered stealthy attacks.These countermeasures are part of the paper’s treatment of stealthy attacks against CUSUM-based detection.

A. Stealthy Attacks Against a CUSUM Detector

The CUSUM detector accumulates log-likelihood evidence and can be delayed by intermittent attacks that alternate on and off periods. The attacker selects these periods to keep the decision statistic below the detection threshold on average.

  • CUSUM stops when its accumulated decision statistic g_t reaches threshold h, using the log-likelihood ratio as its increment.The statistic is recursively clipped at zero through g_t = max{0, g_{t−1} + ℓ_t}.
  • An attacker can repeat attack-on and attack-off periods to keep g_t below h and increase detection delay.Because measurements are random, this control applies only on average rather than deterministically.
  • Stealthy intermittent attacks are especially effective when false-alarm constraints require a high CUSUM threshold h.The analysis assumes knowledge of the pre- and post-attack measurement densities.
  • The necessary stealth condition requires an attack-on period no longer than KL(f1, f0) and an off period exceeding h′.These choices maintain E[g_t] ≤ h′ after the attack begins.
  • Using Ton = h′/KL(f1, f0) and Toff = h′/KL(f0, f1) keeps the expected statistic within 0 ≤ ρ_t ≤ h′.The on period must be shortened and/or the off period lengthened to satisfy the bound.
  • A larger margin Δ = h − h′ lowers g_t on average and increases the CUSUM detector’s average detection delay.The average on-period duration has an upper bound independent of h′ and Δ.

2) Persistent attacks:

Persistent stealthy attacks can evade a CUSUM detector by changing the post-attack density so the expected log-likelihood increment is non-positive. In the time-varying smart-grid setting, estimation errors and unknown variables limit direct application of the fixed-density analysis.

  • If an attacker knows the detector’s post-attack density f1, it can design a persistent attack with a different density f′1.The design seeks to keep the decision statistic from increasing on average while remaining close to f1.
  • Proposition 3 gives an attacker strategy whose information-distance condition equalizes KL(f′1, f0) and KL(f′1, f1).The resulting minimum value of KL(f′1, f1) is KL(f′1, f0).
  • In the actual detector, the pre- and post-attack densities are estimated from time-varying states and attack-parameter estimates rather than known fixed densities.The previous fixed-density results therefore do not directly apply.
  • Before the attack, βt is generally non-positive, making g_t ≈ 0 a good approximation.This follows from the relative fit of the estimated pre- and post-attack models and the expected sign of βt.
  • An attacker aims to deviate state estimates while keeping g_t below h, using either on-off attacks or persistent attacks outside the presumed magnitude model.The recovered state estimate is subject to possible maximum-likelihood estimation errors.

1) Non-persistent attacks:

Non-persistent attacks exploit the CUSUM-based detector’s response to attack and recovery periods, while small persistent attacks can remain close to normal operation. Attackers may tune parameters through offline simulation, but the detector can become ineffective for sufficiently small magnitudes.

  • During an on-off attack, βt is typically non-negative during on periods, while g_t can continue increasing at the beginning of an off period.The estimated recovered state may remain a better fit to the measurements even after attack magnitudes become zero.
  • An attacker with system and detector knowledge can instead determine attack parameters through offline simulation.This provides a way to tune the attack despite the difficulty of analytic derivation.
  • Attack magnitudes and on-off periods must be chosen carefully to keep the maximum g_t below h after the attack begins.Analytically deriving these periods and online magnitudes is infeasible for an attacker in general.
  • Algorithm 1 relies on presumed lower bounds γ and σ2, so attacks outside that magnitude model can evade its intended detection behavior.The proposed discussion specifically considers attacks with magnitudes larger than the presumed lower bounds and attacks with small magnitudes.
  • Persistent attacks with significantly small magnitudes can make g_t ≈ 0 because estimation errors can leave the normal model as the better average fit.Such attacks may have minimal short-run effects but remain effective over long periods.
  • Even incomplete knowledge of system and detector parameters can support small-magnitude stealthy attacks, making Algorithm 1 ineffective in that case.The paper notes that these attacks require detection with reasonable delays because their effects can accumulate over time.

C. Countermeasures Against Stealthy Attacks

The paper combines parametric and non-parametric countermeasures against distinct stealth strategies. Shewhart tests target instantaneous attack evidence, while a sliding-window chi-squared test addresses small deviations and attacks outside the presumed model.

  • Algorithm 2 combines Algorithm 1 with countermeasures for non-persistent and persistent stealthy attacks to cover diverse cyber-attacks.The countermeasures are presented separately for on-off attacks and attacks outside the presumed model or magnitudes.
  • Shewhart countermeasure: The Shewhart test repeatedly compares each log-likelihood ratio with a threshold and stops at the first crossing.Its threshold must be sufficiently high to prevent frequent false alarms.
  • Generalized Shewhart countermeasure: When attack densities are unknown and time-varying, the generalized Shewhart test repeatedly thresholds the generalized log-likelihood ratio βt.Its stopping time is T′ = inf{t : βt ≥ φ}.
  • Generalized Shewhart countermeasure: The generalized Shewhart test is expected to detect significant instantaneous GLLR increases during on periods that CUSUM may miss after subsequent off periods.Its scope is therefore strongest for non-persistent attacks with detectable on-period increases.
  • Non-parametric countermeasure: The sliding-window chi-squared test evaluates whether recent innovation statistics fit the known no-attack chi-squared distribution.It partitions the statistic range into M intervals and applies Pearson’s goodness-of-fit test to a window of length L.
  • Non-parametric countermeasure: Increasing the number of intervals M can improve detector accuracy, but the window size L must also increase, causing larger detection delays.The sequential test uses the most recent sliding window rather than making a decision from a single sample.
  • Non-parametric countermeasure: The chi-squared test targets low-magnitude deviations and attacks outside the presumed hybrid model, including non-Gaussian or correlated jamming noise.It evaluates deviations from baseline statistics without assuming an attack model a priori.

3) Proposed final detection scheme:

The proposed final detector simultaneously runs a generalized CUSUM-based detector, generalized Shewhart test, and sliding-window chi-squared test, declaring an attack when any detector triggers. Simulations evaluate this scheme against FDI, jamming, hybrid, stealthy, and network-topology scenarios.

  • Proposed final detection scheme: The final scheme combines Algorithm 1, the generalized Shewhart test, and the sliding-window chi-squared test, stopping at the first alarm.This parallel design targets a wide range of cyber-attacks.
  • Threshold selection: Algorithm 2 uses thresholds h, φ, and ϕ selected to control false alarms across its component detectors.Its overall average false alarm period is lower than the minimum individual period of the component tests.
  • Evaluation scope: Experiments cover random FDI, jamming, hybrid, stealthy non-persistent, small-magnitude persistent, recovered-state, and topology-attack scenarios.The study compares the proposed methods with nonparametric CUSUM, Euclidean, and cosine-similarity detectors.
  • Results: The proposed algorithms outperform benchmark tests, while Algorithm 1 slightly outperforms Algorithm 2 because Algorithm 2 introduces additional countermeasures that increase false alarms.Algorithm 2 nevertheless improves detection for very small injected FDI magnitudes: at θ = 0.009, delays are 48.02 and 39.45 for Algorithms 1 and 2, respectively.

B. Case 2: Jamming Attack

The evaluation examines random jamming and hybrid attacks, then tests countermeasures against stealthy non-persistent and small-magnitude persistent attacks. Algorithm 2 improves detection in difficult stealthy settings, although nonparametric testing can increase detection delay.

  • Random jamming: Under random jamming, the proposed algorithms are evaluated against benchmark tests while jamming affects each meter probabilistically with time-varying noise variance.The jamming-noise variances are drawn from U[2 × 10^-4, 4 × 10^-4].
  • Hybrid attacks: For hybrid attacks, random FDI and jamming subsets may overlap, and the proposed algorithms achieve smaller detection delays than in the separate-attack cases at equal false alarm levels.The FDI and jamming magnitudes are drawn from U[-0.02, 0.02] and U[2 × 10^-4, 4 × 10^-4].
  • Non-persistent stealthy attacks: For non-persistent stealthy attacks, Algorithm 2 has nearly the same missed-detection ratio as Algorithm 1 at small false-alarm periods but a significantly lower ratio at higher periods.The generalized Shewhart test is identified as the component that improves detection during attack on-periods.
  • Trade-off: Nonparametric goodness-of-fit tests detect very small-magnitude stealthy attacks more successfully but generally produce longer detection delays than parametric tests.The parametric tests become ineffective for the very small attack magnitudes considered.

F. Algorithm 1 vs. Countermeasures Against Stealthy Attacks

The countermeasures improve stealthy-attack detection relative to Algorithm 1, while recovered state estimates substantially reduce estimation error during hybrid attacks. The proposed detectors also address topology attacks or faults, although the hybrid model has a stated topology-attack limitation.

  • Stealthy-attack countermeasures: For non-persistent and persistent stealthy attacks, the generalized Shewhart and sliding-window chi-squared tests outperform Algorithm 1, respectively.The comparison uses nearly equal individual average false alarm periods and reports which test detects first with minimum delay.
  • Stealthy-attack countermeasures: The countermeasures improve Algorithm 2’s stealthy-attack detection performance compared with Algorithm 1.This conclusion combines the results for the considered non-persistent and persistent stealthy attacks.
  • Recovered state estimates: Recovered state estimates have significantly lower MSE than non-recovered estimates during the evaluated persistent hybrid FDI/jamming attack.The attack begins at τ = 100, with FDI magnitudes from U[−0.1, 0.1] and jamming magnitudes from U[1, 2].
  • Recovered state estimates: Recovered estimates slightly deviate from the actual state during the attack because attack-variable MLEs and recovered states depend on each other.The reported deviation reflects coupled maximum-likelihood estimation errors.
  • Topology attacks and faults: The proposed detectors can detect topology attacks or faults when they appear as a special case of denial-of-service behavior in the hybrid model.This setting includes unavailable power-flow measurements caused by a broken or attacked network link.
  • Topology attacks and faults: The hybrid attack model does not cover network topology attacks as a special case, motivating future joint estimation of system state and topology.The proposed future direction combines measurements of power flows or injections with network-switch and line-breaker status measurements.

APPENDIX

The appendix derives simplified maximum-likelihood expressions for attack variables and attack-state classifications used by the detection procedure.

  • Appendix derivations: The MLE of a_k,t is obtained from the derived likelihood expressions for each k in {1, 2, . . . , K}.The appendix states that the resulting expressions are simplified in Proposition 1.
  • Appendix derivations: The estimated attack state S^0_k is selected by comparing u_0, u_f, u_j, and u_f,j for each attack component.The four cases correspond to no attack, FDI, jamming, and combined FDI/jamming according to the minimum criterion.
Loading 1803.00128v2…