PaperlayerView exact revision on arXiv

Source-linked AI summary

Security Assessment and Impact Analysis of Cyberattacks in Integrated T&D Power Systems

Ioannis Zografopoulos, Charalambos Konstantinou, Nektarios Georgios Tsoutsos, Dan Zhu, Robert Broadwater

arXiv:2102.03215v3eess.SYcs.CRcs.SY

TL;DR

The paper examines cyberattack impacts in integrated T&D grids, where interactions between distribution and transmission systems matter. It applies OCTAVE Allegro risk assessment and attack simulations, identifying vulnerable components and showing that breaker #2 can produce 603 violations while timed switching challenges monitoring.

Abstract

from arXiv · show

In this paper, we examine the impact of cyberattacks in an integrated transmission and distribution (T&D) power grid model with distributed energy resource (DER) integration. We adopt the OCTAVE Allegro methodology to identify critical system assets, enumerate potential threats, analyze, and prioritize risks for threat scenarios. Based on the analysis, attack strategies and exploitation scenarios are identified which could lead to system compromise. Specifically, we investigate the impact of data integrity attacks in inverted-based solar PV controllers, control signal blocking attacks in protective switches and breakers, and coordinated monitoring and switching time-delay attacks.

I. INTRODUCTION

DERs and ICT make transmission–distribution interactions important to understanding grid behavior and cyberattack effects. The paper applies OCTAVE Allegro risk assessment and studies three attack categories using an integrated T&D model.

I. INTRODUCTION

  • DERs, including rooftop solar and battery storage, can enable local generation and consumption, lower delivery costs, and increase resilience through generation redundancy.Grid modernization also uses ICT to improve generation and dispatch.Source: §I · p. 1
  • Integrated T&D models capture grid synergies and support holistic study of how anomalous distribution operation and cyberattacks affect transmission systems.Earlier studies modeled the two systems independently.Source: §I · p. 1
  • The paper uses OCTAVE Allegro to identify critical assets and threats, prioritize scenario risks, and analyze three attack categories on an actual integrated T&D model and dataset.The categories include data integrity, blocking, and interruption attacks.Source: §I · p. 1

II. THREAT MODELING AND RISK ASSESSMENT

Smart-grid devices and communication systems expand the power grid’s cyberattack exposure. The section frames critical assets, possible consequences, and the role and limits of security standards and assessments.

II. THREAT MODELING AND RISK ASSESSMENT

  • Smart inverters, IEDs, and smart meters support control and situational awareness, but their inclusion increases the grid’s threat surface.Vulnerabilities in these units can carry over to the power grid, and insecure control networks and protocols add risk.Source: §II · p. 1
  • The paper calls mission-critical assets whose compromise can jeopardize grid operations crownjewels, including inverters, communication channels, breakers, and controllers.Compromise can enable energy manipulation, switch disconnections, false trips, overloads, and voltage-frequency violations.Source: §II · p. 2
  • Security standards offer power-system protections, but their recommendations have limited enforcement capability, so complementary security assessments are also needed.The section describes assessments as a way to review assets and interconnections against security specifications and identify vulnerable or outdated components.Source: §II · p. 2

A. Security Assessment with OCTAVE Allegro

The paper uses OCTAVE Allegro to identify and prioritize risks to critical grid assets through a staged assessment and explicit threat scenarios.

A. Security Assessment with OCTAVE Allegro

  • OCTAVE Allegro identifies critical assets, security requirements, and threats; evaluates impact criteria and relative risk; then defines risk-management strategies.The assessment comprises three steps.Source: A. Security Assessment with OCTAVE… · p. 2
  • Threat scenarios specify how an actor with a motive and access can cause an undesirable outcome to a target asset, making existing risks articulable.Each threat is analyzed by actor, affected asset, outcome, motive, and access.Source: A. Security Assessment with OCTAVE… · p. 2
  • The assessment assumes a malicious actor with deliberate motives and technical access, without physical access.The accompanying tables are titled for critical-asset threat scenarios and risk-assessment impact-area priorities.Source: A. Security Assessment with OCTAVE… · p. 3, Table I · p. 3, Table II · p. 3

B. Security Assessment Methodology

The methodology qualitatively rates threat likelihood and impact, combines prioritized impact areas into severity, and uses risk scores to compare affected assets.

B. Security Assessment Methodology

  • Threat probability is qualitatively rated Low, Medium, or High based on plausibility, including asset location and cyberphysical security perimeter.The analysis considers DER and inverter control, SCADA-controlled devices, and monitor points.Source: B. Security Assessment Methodology · p. 3
  • Severity reflects effects on grid operation and weights five impact areas, prioritized by asset objective, with qualitative impact scores of Low, Medium, or High.The selected areas are safety and health, financial, productivity, reputation, and fines and legal penalties; severity is calculated using Eq. (1).Source: B. Security Assessment Methodology · p. 3
  • The comprehensive risk score is calculated for each affected asset and supports one-to-one comparisons to prioritize assets with higher relative risk.The score is calculated using Eq. (2).Source: B. Security Assessment Methodology · p. 3
  • The solar-inverter scenario receives a Medium probability score of 2, severity of 27, and comprehensive risk score of 54.The probability is not rated High because power-system mitigation and redundancy mechanisms help maintain stability and impede cascading failures or blackouts.Source: B. Security Assessment Methodology · p. 3

III. ATTACK CLASSES

The paper groups cyberattacks into data modification, blocking commands during critical operations, and delaying commands or data despite legitimate operator issuance.

  • The three attack directions are data modification, command blocking during critical operations, and interruption through delayed commands or data.The directions are depicted as power-grid cyberattack scenarios in Fig. 2.Source: §III · p. 3, Figure 2 · p. 4

A. Modification of data: DER integrity attacks

The DER integrity attacks target operator-controlled inverter functions by modifying commands or issuing forged ones, with potential effects on voltage regulation, power injection, and voltage levels.

A. Modification of data: DER integrity attacks

B. Loss/blocking during system-critical operations: switch and breaker control attacks

The section describes attacks on switching devices and coordinated time delays that can disrupt grid operations, with sparse monitoring potentially allowing transient events to go undetected.

B. Loss/blocking during system-critical operations: switch and breaker control attacks

  • Falsified breaker signals can change network topology, violate voltage limits, and overload lines, potentially initiating cascading outages.The stated attack objective is to open or close breakers, with possible consequences including blackouts, equipment failures, and uneconomical operation.Source: B. Loss/blocking during… · p. 4

C. Interruption of system-critical operations: coordinated monitoring and switching attacks

IV. SIMULATION SETUP AND RESULTS

The impact evaluation uses an integrated T&D simulation and counts system violations before and after compromise to assess attack effects.

IV. SIMULATION SETUP AND RESULTS

  • The study uses the number of violations before and after compromise as an indicator of cyberattack impact in the integrated T&D model.Source: §IV · p. 5
  • A violation is component behavior exceeding nominal operational limits and potentially compromising stable operation.For a 120 V nominal bus with a 5% allowed deviation, the stated voltage thresholds are above 126 V or below 114 V.Source: §IV · p. 5
  • The simulation uses Distributed Engineering Workstation software and a model with 1,834 T&D load points, 218 solar PV inverters, and 3,000 sectionalizing devices.Source: §IV · p. 5

A. Modification of data: DER integrity attacks

The section examines inverter setpoint compromise and switch/breaker manipulation, finding breaker #2 especially vulnerable in the case study.

A. Modification of data: DER integrity attacks

  • Compromised PV inverters set to purely active mode with reduced generation limits produce more violations during peak working hours than at night.The paper notes that night-time setpoint alterations would cause minimal disturbance, making them a sub-optimal tactic.Source: A. Modification of data: DER integrity… · p. 5

B. Loss/blocking during system-critical operations: switch and breaker control attacks

  • The switch-and-breaker analysis focuses on two distribution subcircuits, while actual grid topology and other sensitive system details are withheld.The disclosed model is not the actual grid topology; capacities, load counts, microgrid characteristics, and power flows are also not provided.Source: B. Loss/blocking during… · pp. 5–6, Figure 4 · p. 6
  • Circuit breaker #2 is the most vulnerable device, followed by reclosers #1 and #3; violations correlate with proximity to generation and affect successive devices on the same path.Breaker #1 and #2 are at similar distances from their gensets, yet #2 has significantly more violations, suggesting it supports more loads.Source: B. Loss/blocking during… · p. 6, Figure 5 · p. 6

C. Interruption of system-critical operations: coordinated monitoring and switching attacks

The section studies delayed switch commands against periodic monitoring and shows that a carefully timed breaker event can be hard to detect. It frames simulation-aided risk assessment as a tool for evaluating operations and informing resilience measures.

C. Interruption of system-critical operations: coordinated monitoring and switching attacks

  • The scenario delays switch commands because system operation and monitor-point updates are unsynchronized.Monitor points provide regular updates that support operator awareness of system states.Source: C. Interruption of system-critical… · p. 6
  • A disconnect of breaker #2 can cause 603 violations yet remain unreported when timed between monitor-point updates, typically 10–15 minutes apart.Reported values remain unchanged when the switching event occurs between sampling points.Source: C. Interruption of system-critical… · p. 6, Figure 6 · p. 7
  • Simulation-aided risk assessment can evaluate operations, examine mitigation strategies, and inform redundancy measures; the meaning of a violation depends on the analysis.For switch and breaker attacks, violations may represent compromised or offline devices, shed loads, overloaded lines, or sectionalized equipment.Source: C. Interruption of system-critical… · pp. 6–7

V. CONCLUSIONS

The conclusion presents a cybersecurity risk and impact assessment for DER-enabled power grids using integrated T&D simulations and OCTAVE Allegro.

V. CONCLUSIONS

  • The paper uses OCTAVE Allegro for risk assessment and an integrated T&D model to simulate and evaluate data-integrity, blocking, and interruption attacks on critical grid functions.The authors argue that simulation-aware risk assessment can identify vulnerable components whose security enhancement could contribute to more resilient power systems.Source: §V · p. 7
Loading 2102.03215v3…