An Enhanced Energy Management System Including a Real-Time Load-Redistribution Threat Analysis Tool and Cyber-Physical SCED

In the literature, one of the popular ways to generate cyber-attacks against power systems is to create a false data injection attack (FDIA). In FDIAs, attackers add malicious data to the actual measurements in such a way that they can bypass the existing residual-based bad data detectors and achieve the desired state estimation (SE)’s output [1]. FDIAs could be created based on different goals, such as overloading a transmission asset [2, 3, 4], changing the actual topology of a system [5], changing locational marginal prices (LMPs) [6, 7], increasing the operational cost/loss of a system [8, 9], causing sequential outages [10], and frequency instability [11, 12]. Likewise, there are different ways to implement FDIAs based on the measurements that should be compromised. For instance, the authors in [5] attempted to falsify the transmission lines status’ information and measurements to perform topology-based FDIAs. In [3], the authors falsified the phase shift commands to launch a transmission asset overloading based FDIA. The authors in [11, 12] falsified the automatic generation control (AGC) signals to attack the systems’ stability. The authors in [13, 14, 15, 16] changed the load and power flow measurements to perform load-redistribution (LR) based FDIAs. This paper focuses on LR attacks, which falsify the load measurements to maximize the physical overflow on a target transmission asset.

In LR attacks, the attackers falsify the buses’ injection measurement by changing the load measurement at each bus; they avoid falsifying the generation at each bus and injection measurements at zero injection buses (attempt not to increase the detection risk). In [8, 9], the authors attempted to maximize the operations’ costs by designing bi-level LR attack models. In [4, 2], the authors modeled two different bi-level LR attacks to maximize the power flows of critical transmission assets while penalizing the number of resources that attackers can access. In [13], the authors proposed a bi-level mixed-integer linear programming LR attack model to overload multiple transmission assets. In [14, 15], the authors designed LR attacks with incomplete systems’ information by proposing a model to find the best local attacking region.

Due to the catastrophic consequences that cyber-attacks could have for power systems, the research community has been pushed to seek a solution and develop countermeasures against cyber-attacks. In power systems, the security actions to stand against cyber-attacks are divided as follows:

This paper’s primary goals are 1) developing a systematic tool for flagging LR attacks in real-time and identifying the affected transmission assets (if exist) and 2) designing a corrective action to respond to the identified attacks and provide secured dispatch points.

For the detection part, we use the security index proposed in [31], the number of proper deviations at sensitive buses (NPDSB), to detect LR attacks, and based on that, develop a real-time load-redistribution threat analysis (RTLRTA) tool. However, we suggest a more accurate way to determine the thresholds for different NPDSB indices associated with different target transmission assets. Our proposed detection mechanism is different from other proposed techniques in the literature in various aspects, like:

• •

  As opposed to [25, 26], in which the authors developed dynamic-based detection mechanisms, our detection mechanism is a static-based.

• •

  As opposed to the assumption in [3], our method successfully detects LR attacks assuming that attackers have no limitation for altering state variables. As opposed to the approach in [27], our mechanism does not rely on some secured measurements.

• •

  As opposed to the proposed techniques in [28, 29], our detection mechanism is modeled based on a linear and convex problem.

• •

  As opposed to the proposed method in [30], in which the method’s functionality was not evaluated in the presence of normal noise errors, we investigate our detection mechanism’s functionality in the presence of both Gaussian and non-Gaussian noise errors.

• •

  As opposed to the methods in [32, 33, 34, 35], which were developed based on machine and deep learning, our mechanism perfectly works regardless of the available historical data’s quantity and quality (learning-based methods might be more straightforward and effective, but need a large amount of underlying historical data).

For developing the corrective action, we add a set of physical line flow security constraints (PLFSCs) to the security-constrained economic dispatch (SCED) model and introduce the cyber-physical SCED (CPSCED). The CPSCED model provides secured dispatch points concerning the identified attacks and affected transmission assets from the RTLRTA tool. As opposed to the proposed corrective actions in [36, 37], which were developed based on complicated and time-consuming tri-level optimization problems, our proposed remedial action is swift and straightforward. In brief, our main contributions are:

1. 1.

   Improving the accuracy of the threshold proposed in [31] and introducing a new approach to determine thresholds for NPDSB indices.

2. 2.

   Introducing and developing the fast RTLRTA tool, with minimal disruptions in the existing EMSs, to detect any possible LR attack and identify all affected transmission assets.

3. 3.

   Introducing and designing the straightforward CPSCED model, yet, practically efficient for the real-time operations. The CPSCED does a real-time corrective action that allows operators to remove or mitigate the identified attacks’ physical consequences.

4. 4.

   Because all security actions should be addressed in real-time with minimal changes and disruptions in the existing EMSs’ infrastructure, we develop our detection and corrective schemes highly effective, fast, and applicable to real-world practice.

The rest of this paper is organized as follows. Section II presents a brief background regarding the SCED model and LR attacks. Section III introduces the new enhanced EMS, including the RTLRTA tool and the CPSCED. Sections IV and V illustrate the simulation results and concluding remarks, respectively.

In the real-time operations of power systems, energy is cleared through an economic dispatch model. This section shows a simple base-case SCED model, which considers all the grid’s and units’ physical limitations in the pre-contingency stage (this model does not include reserve requirements and the post-contingency security constraints).

The objective function in (1) minimizes the production cost of the power needed to meet the demand. The procurement of enough energy to meet the demand is imposed in (2). The DC approximation of each transmission asset’s active power flow is formulated using the power transfer distribution factors (PTDFs) in (3). The power injected to each bus and transmission network’s limitations are modeled in (4) and (5), respectively. In (6), the generation units’ physical limitations are modeled.

LR attack is a type of FDIAs, in which changing buses’ injection measurement is the attackers’ procedure to achieve their goals. In this paper, due to the direct communication between the generation units’ control room and system operators, the only way to change the buses’ injection measurement is to change the buses’ load measurement. In brief, an LR attack increases the loads at some buses and decreases other buses’ load subject to the attacker’s limitations. The load deviation at each bus should be neither more nor less than a fixed fraction of the forecasted load at that bus. Moreover, the total load in the system has to remain unchanged.

This paper focuses on the LR attacks that are designed to cause an overflow on a target transmission asset. We use the special structure of LR attacks’ core problem, demonstrated in (7)-(9), as the LR attack model throughout this study.

In this model, ‘$\pm$’ indicates that the load deviations’ directions depend on the target asset’s initial flow direction (might be positive or negative). The deviations’ directions for a target asset with a positive initial flow direction are different from the deviations’ directions associated with a target asset with a negative initial flow direction. The primary decision variable is $\mathbf{H^{\prime}_{i}\Delta\theta}$, which indicates the net injection deviation at bus $i\in N$ (we used $\mathbf{H^{\prime}_{i}\Delta\theta}$ to emphasize that attackers can change bus angles to get appropriate deviations in loads). The load shift factor is shown by $\alpha$, and $D_{i}$ denotes the forecasted load at each bus $i\in N$. The power transfer distribution factor of the target asset $l\in K$, with respect to the injection at bus $i\in N$ and withdrawal from the reference bus $R$, is shown by $PTDF_{l,i}^{R}$.

In this problem, the objective function maximizes the overflow on a target transmission asset. Constraints in (8) limit the attackers from changing the load at each bus more/less than $+$/$-\alpha$ percent of the forecasted load at that bus (they also impose no change at zero injection buses). Constraint (9) ensures that the system’s net load remains unchanged.

The rationale behind using the CPSCED is that after noticing an LR attack in the system, it may still be hard to achieve the actual loads. Therefore, considering the fake load measurements, a fast corrective action should be taken to maintain the system’s operation secure. Subsequently, we modify the SCED model by adding the PLFSCs to create the CPSCED model, which provides secured dispatch points and avoids physical overflows or mitigates significant impacts.

Assume an attacker bypasses all protection-based schemes and changes the buses’ load. As a result, the set of insecure dispatch points from the SCED is $P^{*}_{g}$, which creates physical overflows in the system (considering the actual loads). According to this strategy, we embed two sets of line flow security constraints in the CPSCED. The first one, which already exists in the base-case SCED, imposes the power flows on transmission assets within their ranges (considering the contaminated loads). The second one, the new PLFSC, forces the physical flows on affected transmission assets to be within their boundaries (considering the actual loads). However, because retrieving the actual loads is hard, we propose a method to estimate the actual loads, then we modeled the PLFSC based on this estimation.

To estimate the actual loads, we assume the worst-case LR attack for the affected transmission asset with the largest NPDSB index value and model the actual load at each bus as follow:

where negative ($L_{i}-\mathbf{H^{\prime}_{i}\Delta\theta}$) is used for transmission assets with positive initial flow directions and positive ($L_{i}+\mathbf{H^{\prime}_{i}\Delta\theta}$) is used for transmission assets with negative initial flow directions. Additionally, since the attacker might introduce some random deviations, the actual load at each bus $i\in N$ with $\Delta L_{i}$ more than $\alpha^{startpoint}_{k,min}\times D_{i}$ is modeled as $L_{i}\pm\mathbf{H^{\prime}_{i}\Delta\theta}$; otherwise, it remains $L_{i}$.

After estimating the actual loads, we can model the PLFSC, as shown in (14)-(16). Then, by adding the PLFSC to the SCED model, we can design the CPSCED as follow:

where in (14), the actual physical flow is formulated based on the actual injection to each bus, which is modeled in (15). Constraint (16) forces the physical flow of each affected transmission asset to be within its thermal limits.

The proposed enhanced EMS algorithm is designed and shown in Algorithm 2, and the block diagram of the enhanced EMS is shown in Fig. 1.

At each iteration, the NPDSB indices for all vulnerable assets are calculated. Then, if there are affected assets, the CPSCED is solved with the corresponding activated PLFSCs. Moreover, considering the CPSCED’s dispatch points and the estimated actual loads, other transmission assets’ physical flows are checked. If overloaded transmission assets still exist, the corresponding PLFSCs are activated in CPSCED, and a new set of dispatch points is provided. This process continues until there is no physical overflow in the system.

Here, we determined a threshold for the NPDSB index of transmission line $169$. To do so, we considered the weakest LR attack that could cause an overflow on this line. Since the largest $d$ is important to find the weakest attack with the lowest NPDSB index, we started to force the deviations at the first $d$ sensitive buses out of all sensitive buses to zero. The sensitive buses are sorted based on their PTDF absolute values from smallest to largest. Throughout this experiment, we increased $d$ manually and solved problem (10)-(11) until we reached a $d$ whose associated attack vector could not cause an overflow on line $169$. Table I shows the results of solving problem (10)-(11) for three different $d$s.

As shown in Table I, there is no random LR attack with $\alpha$ at most $10\%$ and $d$ more than $692$ (NPDSB $\leq$ $357$) that could cause an overflow on line $169$. It means that the system operator can use $357$ as NPDSB${}^{169}_{threshold}$. We used $350$ for this line, which is even more conservative than $357$.

Following the same procedure in subsection IV-A, we determined a threshold for the NPDSB index of line $251$.

Table II demonstrates the control room flows, physical flows and NPDSB indices corresponding to three different $d$s for line $251$ with $\alpha$ and $\alpha^{startpoint}_{251,min}$ equal to $10\%$ and $0.0686$, respectively. According to Table II, there is no severe random LR attack for line $251$ with $\alpha\leq 10\%$ and $d\geq 685$ (NPDSB $\leq 374$). Therefore, $370$ is a valid and conservative enough choice for NPDSB${}_{threshold}^{251}$.

In this section, we evaluated the CPSCED’s ability to provide secured dispatch points in the presence of LR attacks. To do so, we created different random LR attacks against transmission lines $169$ and $251$, and for each case, in the RTLRTA, we found the list of assets whose associated PLFSCs have to be activated in the CPSCED. Finally, we compared the operation costs of the SCED and CPSCED in the presence of LR attacks. The proposed CPSCED has one more set of constraints than the SCED, which means that its result could be equal or worse from the economic point of view. In other words, if any of the added PLFSCs binds, the CPSCED results in a higher operating cost than the operation cost of the SCED.

Table IV shows two different attack scenarios ($d=150$ and $d=400$) for each target transmission line ($169$ and $251$). As shown, there were binding PLFSCs for all four scenarios, which justifies that the CPSCED resulted in higher operating costs than the SCED. This is the cost of making the system secure against identified LR attacks. For instance, for case $1$ against line $169$, the PLFSC associated with line $52$ was the binding constraint out of the three activated PLFSCs, and resulted in higher operating cost in the CPSCED ($\$$ $1.83M$) than the SCED ($\$$ $1.79M$). As another example, consider the second case for line $251$, where the generated random attack was not successful in causing an overflow on this line. Still, it was successful on other lines ($52$, $169$, and $264$). The physical flow on line $251$ confirms the RTLRTA tool’s decision, which did not activate this line’s PLFSC in the CPSCED. This attack scenario caused overflows on the other three vulnerable lines ($52$, $169$, and $264$), and the RTLRTA successfully activated those PLFSCs in the CPSCED. Moreover, only two of these activated PLFSCs ($52$ and $264$) were binding in the CPSCED, which resulted in a higher operating cost in the CPSCED ($\$$ $1.82M$) than the SECD ($\$$ $1.78M$).

Considering the SCED’s dispatch points in Table IV, all the target lines’ actual physical flows were more than their thermal ratings (except for the second scenario against line $251$, in which we had other overloaded lines). On the other hand, considering the CPSCED dispatch points, there is no overflow in the system (neither on the target line nor on other vulnerable lines).