A Replay-Attack-Resilient Power System State Estimation Scheme

Replaying outdated or uncorrelated data can lead to a distorted view of the actual system state, resulting in suboptimal control decisions that potentially compromise grid stability, reliability, and efficiency. Replay Attacks (RA) are a kind of stealthy attacks which can mar one of the very key application of the Energy Management System (EMS), viz., Power System State Estimation (PSSE). This paper, therefore, proposes a novel scheme to make the PSSE resilient against RAs. To this end, first, a Power Transfer Distribution Factor (PTDF)-assisted vulnerability analysis is carried out to identify the critical SCADA measurements which may become a preferred choice of the attacker to launch RAs. Next, an optimal number of secured phasor measurements are exploited to detect and correct any RA in the SCADA measurement set, followed by a simple hybrid estimation scheme to reconstruct the falsified set of measurements. The proposed strategy’s effectiveness is validated through testing on three standard IEEE test systems, namely IEEE 14, New England (NE) 39, and IEEE 118 using simulated data generated from Real-time Digital Simulators (RTDS) and MATPOWER. Finally, the efficacy, feasibility and robustness of the proposed method under different variant of RA scenarios are compared with two existing Kalman Filter-based distributed state estimation methods associated with the three widely used statistical cyber attack detectors. Note to Practitioners—Power System State Estimation (PSSE) is a key application in the EMS, which further caters to many important real-time grid applications. If the SCADA measurements, which are fed to the PSSE program get corrupted with the Replay Attacks (RAs), it can jeopardize the smooth functioning of the power grids. Being motivated by this, this article presents a simple approach to detect and mitigate RAs in PSSE. The proposed scheme exploits a set of limited secured phasor measurements, along with the vulnerable SCADA measurements, in the form of Hybrid State Estimation (HYB-SE) to detect and correct any presence of RAs. The proposal is validated on the IEEE 14, NE 39, and IEEE 18 bus systems, modelled in Real Time Digital Simulator with a maximum detection accuracy of 94.6%, 94.2%, and 84.47% respectively. The superior performance of the proposed detection approach is also validated against two existing distributed state estimation methods accompanied with three statistical cyber attack detectors.

I. Introduction

Over the past few decades, the evolution of enabling technologies such as sensing, computing, communication, and intelligent control has led to a transition from conventional Supervisory Control and Data Acquisition (SCADA) to the modern Smart Grid (SG). While these advancements have enhanced intelligence and adaptability in SGs, they have also introduced new vulnerabilities, increasing the risk of malicious cyber-attacks [1]. Despite of the existing protective measures like data encryption, authentication, firewalls, cryptography, and digital watermarking in the cyber layer of SCADA systems, incidents such as the Stuxnet malware attack on an Iranian nuclear power plant and cyber attacks on the Ukrainian power delivery network have revealed their insufficiency in defending against intrusions on the cyber-physical layers [2]. Commonly studied attacks in SGs fall into three main categories: Denial of Service (DoS) attacks, False Data Injection Attacks (FDIAs), and Replay Attacks (RAs). The first two categories of stealthy attacks has been well researched in the literature, and can be minimized or prevented by using anomaly identification and multi factor based authentication tools, implementing strong firewall, intrusion detection and data loss prevention mechanism and advanced statistical and signal processing based attack detection methods [3]. Further, the stealthy FDIA in AC state estimation necessitates estimation of the system states with some level of confidence, along with the noise covariance matrix information in order to generate a new set of malicious attack vector that basically steers the execution process while maintaining a balance in its stealthiness properties. Compared to the above two, the RAs are although very easy to execute in real practice but difficult to spot due to the statistical similarities of the replayed signal with the original observations and thereby having capability of passing examination of cryptographic keys, resulting interrupting the power delivery and degrade system performances [4]. Additionally, RAs can exploit the time-lag between data capture that further complicates detection efforts. Moreover, in the context of PSSE, RAs on some specific measurements are more detrimental than any random selection of measurement which further intricates the RA detection challenges.