PaperlayerView exact revision on arXiv

Source-linked AI summary

Analysis of Moving Target Defense Against False Data Injection Attacks on Power Grid

Zhenyong Zhang, Ruilong Deng, David K. Y. Yau, Peng Cheng, Jiming Chen

arXiv:1912.11372v1eess.SYcs.SY

TL;DR

Stealthy false data injection attacks can evade detection when built using former power-grid information, and the effectiveness limits of moving target defense (MTD) against them have not been fully characterized. The paper analyzes MTD completeness, attack-space reduction, branch selection, and operating cost. It establishes structural conditions for completeness and considers deployment choices to reduce remaining attack opportunities.

  • Problem

    The effectiveness limits of MTD against stealthy attacks built with former system information, including the roles of network structure, branch selection, and perturbation magnitude, had not been fully characterized.

    Source: §I · p. 2

  • Method

    The paper defines the stealthy attack space using the intersection of attack spaces under former and current branch susceptances, then analyzes completeness, branch selection, and operating cost.

    Source: §I · p. 2, 2) Reducing the operation cost · p. 9

  • Results

    Complete MTD requires l ≥ 2n and perturbing more than n branches that cover all buses; a bus connected by only one branch prevents completeness.

    Source: 2) Physical limitations · p. 6

  • Takeaways & Limitations

    When completeness is unavailable, selecting branches can minimize the stealthy attack space and maximize covered buses, while considering the added operating cost.

    Source: §I · p. 2, 2) Reducing the operation cost · p. 9

    A bus connected by a single branch can always have its state variable modified by the attacker, so complete MTD is not achievable in that network structure.

    Source: 2) Physical limitations · p. 6

Abstract

from arXiv · show

Recent studies have considered thwarting false data injection (FDI) attacks against state estimation in power grids by proactively perturbing branch susceptances. This approach is known as moving target defense (MTD). However, despite of the deployment of MTD, it is still possible for the attacker to launch stealthy FDI attacks generated with former branch susceptances. In this paper, we prove that, an MTD has the capability to thwart all FDI attacks constructed with former branch susceptances only if (i) the number of branches $l$ in the power system is not less than twice that of the system states $n$ (i.e., $l \geq 2n$, where $n + 1$ is the number of buses); (ii) the susceptances of more than $n$ branches, which cover all buses, are perturbed. Moreover, we prove that the state variable of a bus that is only connected by a single branch (no matter it is perturbed or not) can always be modified by the attacker. Nevertheless, in order to reduce the attack opportunities of potential attackers, we first exploit the impact of the susceptance perturbation magnitude on the dimension of the \emph{stealthy attack space}, in which the attack vector is constructed with former branch susceptances. Then, we propose that, by perturbing an appropriate set of branches, we can minimize the dimension of the \emph{stealthy attack space} and maximize the number of covered buses. Besides, we consider the increasing operation cost caused by the activation of MTD. Finally, we conduct extensive simulations to illustrate our findings with IEEE standard test power systems.

I. INTRODUCTION

The paper examines how moving target defense (MTD) can counter stealthy false data injection attacks built using outdated grid information. It analyzes when MTD can eliminate such attacks and how system modeling and deployment choices shape that analysis.

I. INTRODUCTION

  • Stealthy false data injection attacks can bypass bad-data detection while changing estimated states, potentially causing prolonged outages or equipment damage.MTD responds by proactively perturbing branch parameters to increase uncertainty for attackers.Source: §I · p. 1
  • Prior work had not established MTD’s effectiveness limits from network structure and perturbed branches or fully examined how perturbation magnitude affects the stealthy attack space.The paper studies completeness, deployment, and additional operating cost for attacks built with old system information.Source: §I · p. 2
  • The paper’s contributions include necessary conditions for complete MTD, analysis of a single-branch bus limitation, a target-branch selection algorithm, and consideration of added operating cost.It also reports extensive simulations using IEEE standard power systems.Source: §I · p. 2

A. System model

  • In the DC model, voltage phase angles are the system states, measurements are active power flows, and the measurement matrix depends on topology and branch susceptances.The paper assumes noiseless measurements for its derivations but states that its main results remain valid with noise and evaluates noise in simulations.Source: A. System model · pp. 2–3
  • The state-estimation setup uses measurements and a weighted least-squares-style estimate, while bad-data detection compares the residual norm with a threshold.The cited passage describes the estimate using a pseudo-inverse of the measurement matrix.Source: A. System model · p. 3

B. Threat model

The paper models stealthy attacks as measurement changes that leave the detector’s residual unchanged, and considers attackers with access to former system information. MTD changes branch susceptances, changing the measurement matrix and defining which old attacks can still evade detection.

B. Threat model

  • An attack of the form a = Hc leaves measurement residues unchanged, so the bad-data alarm is not triggered even though the estimated states are subverted.The attacker is assumed unable to take over the control center or SCADA system.Source: B. Threat model · p. 3

A. Moving target defense by perturbing branch susceptances

  • D-FACTS devices let the defender perturb selected branch susceptances, but physical limits constrain the perturbed values.The devices were introduced for power-flow control and can alter line impedances.Source: A. Moving target defense by perturbing… · p. 4
  • The attacker cannot anticipate MTD commands or immediately learn the new measurement matrix, while the defender assumes protected commands and safeguarded transmission.The attacker may take hours or days to infer the updated matrix from historical measurements.Source: A. Moving target defense by perturbing… · p. 4
  • The stealthy attack space is S(H) ∩ S(H′), the intersection of attack-vector spaces under the former and current measurement matrices.Its dimension is related to the rank of [H H′], defined as the MTD security factor γ.Source: A. Moving target defense by perturbing… · p. 4

B. Problem statement

The paper asks how MTD can eliminate attacks built from former measurement information, or reduce their remaining opportunities when complete protection is not feasible. It analyzes detection conditions and relates the size of the stealthy attack space to the MTD security factor.

B. Problem statement

  • When complete MTD is not achievable, the paper seeks branch selections that reduce the stealthy attack space, cover more buses, and account for operating cost.Different branch choices and perturbation magnitudes can produce different attack-space dimensions, while device limits constrain feasible perturbations.Source: B. Problem statement · pp. 4–5, §IV · p. 5

A. Detecting FDI attacks with MTD

  • MTD can detect an old-matrix attack only if at least one component of cv is nonzero; a smaller stealthy attack space means more state variables cannot be independently modified.The result concerns attacks a = Hc and the columns of H not represented by H′.Source: A. Detecting FDI attacks with MTD · p. 5
  • When γ = n, the spaces coincide; for n < γ < 2n they intersect, and at γ = 2n the stealthy attack space is {0}.The paper states that a smaller space means fewer successful opportunities for attacks built with former system information.Source: A. Detecting FDI attacks with MTD · p. 5
  • In the four-bus, six-branch example, perturbing one branch reduces the attack-space dimension to 2, while perturbing three specified branches makes MTD complete.The complete case has γ = 2n = 6 and a zero-dimensional stealthy attack space.Source: A. Detecting FDI attacks with MTD · p. 5

B. Analysis of MTD’s completeness

Complete MTD requires a maximal security factor and restrictive network and perturbation conditions, and a bus connected by only one branch prevents completeness. Yet an incomplete MTD can still protect all state variables in a particular network.

1) Mathematical analysis:

  • γ = 2n is necessary and sufficient for completeness; then every nonzero attack constructed with former susceptances is detectable, and injected errors can be identified.The full-column-rank combined measurement matrix also permits unique recovery of the attack coefficients.Source: 1) Mathematical analysis · p. 6

2) Physical limitations:

  • Completeness requires l ≥ 2n branches and perturbed branches that cover all buses.Coverage requires at least n perturbed branches; an uncovered bus can retain a stealthy state-modification direction.Source: 2) Physical limitations · p. 6
  • When l < 2n, the stealthy attack space has dimension at least 2n − l.The paper reports that only three of 41 MATPOWER IEEE test cases have more than 2n branches.Source: 2) Physical limitations · p. 6
  • A bus connected by only one branch prevents complete MTD, because its state can be modified arbitrarily by the attacker.In the 4-bus example, bus 3 has this vulnerability through branch {2, 3}.Source: 2) Physical limitations · p. 6

3) Discussion:

  • In the 3-bus example, perturbing branches {1, 2} and {2, 3} protects all state variables even though the network has fewer than 2n branches.This illustrates that complete MTD is not necessary for every protection objective.Source: 3) Discussion · p. 6
  • For a coordinated attack in the 3-bus example to bypass the BDD after MTD, the attacker must know the susceptance perturbations.The paper describes constructing such an attack as almost impossible for the attacker.Source: 3) Discussion · p. 7

C. Impact of the susceptance perturbation magnitude on the dimension of the stealthy attack space

The paper analyzes how susceptance perturbation magnitude affects the stealthy attack space, then proposes branch selection to shrink that space and cover buses. The dimension change is largely insensitive to perturbation magnitude, with a special rank-change condition enabling evaluation at one ratio.

C. Impact of the susceptance perturbation magnitude on the dimension of the stealthy attack space

  • The susceptance perturbation magnitude almost does not affect the change in stealthy attack-space dimension when one more branch is perturbed.When the security factor increases by 1, the result holds regardless of perturbation magnitude.Source: C. Impact of the susceptance… · p. 7
  • Under Cases 2 and 3, the stealthy attack-space dimension increases by 1 only at a specific non-unit perturbation ratio, if such a ratio exists.For these cases, when the rank change is zero at a tested ratio, it almost remains unchanged across perturbation magnitudes.Source: C. Impact of the susceptance… · p. 7
  • When the security factor increases by 1, that rank change holds for any non-unit perturbation ratio, so one tested ratio can determine it.The paper states this condition as an if-and-only-if result.Source: C. Impact of the susceptance… · p. 7

D. Guidance on the construction of an effective MTD

1) Target-perturbation branch selection:

Branch selection prioritizes reducing the stealthy attack space, then uses any remaining D-FACTS devices to cover additional buses. Only perturbable branches are considered, and the algorithm can offer alternative branch sets.

1) Target-perturbation branch selection:

  • The first algorithm selects perturbable branches that increase the security factor, stopping when it is maximized or the available D-FACTS devices are used.Its rank-based search has time complexity O(lmn^2) in the worst case.Source: 1) Target-perturbation branch selection · p. 8
  • The candidate set excludes branches that cannot be perturbed for power-transfer reasons, and the algorithm outputs one alternative target-branch set.Other suitable candidate sets may exist, allowing perturbed branches to be changed dynamically or existing D-FACTS devices to be reused.Source: 1) Target-perturbation branch selection · p. 8
  • If devices remain after maximizing the security factor, the second algorithm selects branches covering two new buses first, then one new bus, before filling remaining slots.It searches among candidate branches not already selected for maximizing the security factor.Source: 1) Target-perturbation branch selection · p. 8

2) Reducing the operation cost:

The paper uses optimal power flow to account for generation-cost changes associated with MTD perturbations. Simulations use IEEE test systems under specified measurement-noise and perturbation settings.

2) Reducing the operation cost:

  • The OPF minimizes generation cost while accounting for branch-flow, generator-output, nodal-balance, and susceptance-perturbation constraints.The susceptance ratios enter the power-balance matrix, making the optimization depend on perturbation magnitude.Source: 2) Reducing the operation cost · p. 9

V. SIMULATION RESULTS

  • Simulations use fully measured IEEE 14-, 30-, 57-, 118-, and 145-bus systems, with perturbation ratios constrained to [0.8, 1.2].When measurement noise is considered, it follows a Normal distribution; the false-alarm rate is 0.05.Source: §V · p. 9

A. Effectiveness of MTD

Simulations show that more branch perturbations can shrink the stealthy attack space, and smaller spaces correspond to higher FDI detection probability. A bus connected by only one branch remains vulnerable even after MTD.

1) The dimension of the stealthy attack space vs. branch perturbations:

  • IEEE 14-bus retains a stealthy attack-space dimension of 6 after all 20 branches are perturbed, while IEEE 145-bus retains dimension 10 after all 453 branches are perturbed.The paper attributes the latter result in part to seven buses connected by only one branch.Source: 1) The dimension of the stealthy… · p. 9

2) MTD’s effectiveness for thwarting FDI attacks:

  • Across the tested systems, smaller stealthy attack spaces correspond to higher FDI detection probability; detection also rises with the number of modified state variables.In the IEEE 14-bus system, detection probability exceeds 90% when the stealthy attack-space dimension is reduced to 0.6.Source: 2) MTD’s effectiveness for thwarting… · p. 10

3) Impact of the bus that is only connected by a single branch:

B. Impact of the susceptance perturbation magnitude on the dimension of the stealthy attack space

The section evaluates perturbation magnitudes, branch-selection algorithms, computational time, and operation cost, then recaps the paper’s MTD findings and IEEE-system simulations.

B. Impact of the susceptance perturbation magnitude on the dimension of the stealthy attack space

  • In the IEEE 14-bus examples, reducing stealthy attack space dimension by 1 held across tested perturbation ratios, but equal ratios on branches k6 and k3 produced a case-3 exception.At a perturbation ratio of 0.88, the dimension increased by 1; the authors advise against assigning the same ratio to branches.Source: B. Impact of the susceptance… · p. 11, Table V · p. 11

1) Target-perturbation branch selection:

  • The algorithm selected branches yielding a stealthy attack space of dimension 6 and 13 covered buses, versus dimension 8 and 8 buses for optional selections.The comparison is for the IEEE 14-bus system with 10 D-FACTS devices.Source: 1) Target-perturbation branch selection · pp. 11–12, Figure 13 · p. 12
  • Different starting branches produced different selections but the same γ = 7 and 13 covered buses, allowing branch changes while maintaining these outcomes.The authors also note that using already deployed D-FACTS devices can reduce infrastructure cost.Source: 1) Target-perturbation branch selection · p. 12

2) Reducing the operation cost:

  • For the IEEE 14-bus system, generation-cost increases differed between perturbing k2 and k4; appropriate branch and magnitude choices can reduce MTD’s operation-cost increase.When susceptance decreased, k4’s cost increase was slightly lower than k2’s; when susceptance increased, k4’s cost was nearly invariant while k2’s increased with the perturbation ratio.Source: 2) Reducing the operation cost · p. 12, Table VI · p. 12

VI. CONCLUSION

  • The conclusion states that complete MTD requires l ≥ 2n branches and perturbing more than n branches covering all buses, and reports demonstrations on IEEE standard test systems.It also notes that a bus connected by only one branch prevents complete MTD.Source: §VI · pp. 12–13

1) Target-perturbation branch selection:

  • With 10 D-FACTS devices, computation time rose from around 30ms on the 14-bus system to over 300ms on the 145-bus system, remaining within 350ms across tested systems.The authors attribute the slightly longer 14-bus runtime than 30-bus runtime to execution of both algorithms on the 14-bus system.Source: 1) Target-perturbation branch selection · p. 12, Figure 15 · p. 13

APPENDIX A

The appendices establish rank-based conditions for complete MTD, show why a singly connected bus prevents completeness, and characterize how branch perturbations change the measurement matrix.

APPENDIX A

  • For Proposition 4.1, an attack formed from one measurement-matrix column space can also lie in the intersection of the pre- and post-MTD spaces, and therefore remain undetected.The proof considers an attack component set to zero and concludes that the resulting attack vector belongs to the stealthy attack space.Source: Appendix A · p. 13

APPENDIX B

  • An MTD is complete exactly when the combined measurement matrix [H H′] has rank 2n, making the stealthy attack space {0}.The proof uses the equivalence between zero dimension of the intersection of the measurement-matrix column spaces and rank 2n.Source: Appendix B · p. 13

APPENDIX C

  • Completeness requires l ≥ 2n and perturbed branches covering all buses; the latter follows because complete MTD requires n covered-bus columns.The proof compares rank under partially and fully measured systems, then relates the required n independent columns to covered buses.Source: Appendix C · p. 13

APPENDIX D

  • If a bus is connected by a single branch, perturbing that branch leaves the measurement-matrix column spaces equal, so complete MTD cannot be achieved.The proof applies to both fully and partially measured cases.Source: Appendix D · p. 13

APPENDIX E

  • Perturbing a branch changes only the two measurement-matrix columns associated with its endpoint buses; the resulting matrix differences are sparse.The proof traces this sparsity through changes to the branch-bus shift factor matrix and the measurement matrix.Source: Appendix E · p. 14

APPENDIX F

The appendix bounds how much the combined measurement-matrix rank can change when one additional branch is perturbed.

APPENDIX F

  • Perturbing one additional branch changes the rank of the combined measurement matrix by at most 1 in either direction.The proof bounds the rank change using the rank-1 perturbation matrix associated with that branch.Source: Appendix F · p. 14

APPENDIX G

The appendix analyzes how perturbation magnitude affects the rank contribution of a branch when its endpoint columns are not among the selected independent columns.

APPENDIX G

  • When the endpoint column id is outside Mq, the proof inserts h′id into C′ without changing its rank.It then uses elementary column operations to examine the perturbed endpoint columns.Source: Appendix G · p. 14
  • The proof separates the perturbed columns from unchanged columns of H′, with the latter collected in Hp.The passage states that Hp contains columns not changed by perturbing branch kd.Source: Appendix G · p. 14
  • For λ > 0 and λ ≠ 1, the column-operation result is independent of λ, so the rank change Δγ does not depend on perturbation magnitude in this case.The proof compares the operation results for two perturbation ratios and extends the conclusion to the endpoint columns.Source: Appendix G · p. 14

APPENDIX H

Appendix H uses determinant tests on selected submatrices to characterize when perturbing a branch can reduce the combined matrix rank. The rank drop occurs only at a particular perturbation value within the allowed range, distinct from the unperturbed value.

APPENDIX H

  • The proof identifies the remaining columns as unchanged after perturbation when relating the rank change to the original combined matrix.The proof also uses the rank relation R([H H′′]) = R([H H′]) − 1.Source: Appendix H · p. 15
  • For selected rows and columns, the submatrix determinant is linear in the perturbation value, and the combined matrix has full column rank at λ = 1.If the linear coefficient is nonzero, the determinant vanishes at a unique value; if it is zero, it does not vanish.Source: Appendix H · p. 15
  • A rank change of −1 occurs only at a perturbation value λ* within [λmin, λmax] and different from 1.The proof relates this condition to the rank of the combined matrix after perturbation.Source: Appendix H · p. 15

APPENDIX I

Appendix I proves that a rank increase of 1 can persist across perturbation magnitudes when its stated rank conditions hold. It also shows that in Case 1, changing the magnitude does not change the security-factor difference.

APPENDIX I

  • In Case 1, changing the susceptance-perturbation magnitude does not change the security-factor difference when Δγ = 1 holds at one value.The proof states that this result remains unchanged for other perturbation magnitudes.Source: Appendix I · p. 15
  • For the sufficiency argument, a column not linearly represented by the unchanged columns supplies the condition for a rank increase of 1.The proof states that at least one perturbed column must also be unrepresentable by those unchanged columns.Source: Appendix I · p. 15
  • When the relevant rank condition holds, the proof establishes Δγ = 1 for any λ > 0 with λ ≠ 1.The argument considers whether a selected submatrix determinant can vanish and uses λ = 1 as the unique solution in the specified case.Source: Appendix I · p. 15
Loading 1912.11372v1…