Attack path reconstruction from adverse consequences on power grids with a focus on Monitoring-Layer attacks

The Monitoring Layer (ML) attacks injects false measurements to manipulate operation decisions. Existing research on ML attacking models have an intrinsic deficiency: an attacker's goal is modeled by erroneous measurements, but not by final consequences on power grids. In this paper, we propose an ML-attack model based on adverse physical consequences. The proposed modeling method is essential to reconstruct attack paths in power system forensics and to future development of defense mechanisms against ML attacks. Examples of attack paths reconstruction are presented, on a sub-transmission system and a low voltage distribution system.