Identification of destabilizing attacks in power systems

In a destabilizing attack against a power system, the adversary hacks into generators or load control mechanisms to insert positive feedback into the power system dynamics. The implementation of destabilizing attacks, both on the generation and load sides, have recently been studied. There are also recent advances on how to detect, i.e., realize the presence of, destabilizing attacks in power systems. However, identifying the location(s) of the compromised buses is still an open problem. This is particularly challenging if, as in practice, one does not even know the number of compromised buses. Another challenge is to keep the computational complexity low to allow fast attack identification with high accuracy. To address these various issues, we observe in this paper that destabilizing attacks can be modeled as a reparameterization of the power system's dynamical model. Therefore, we propose an attack detection method that uses the unscented Kalman filter to jointly estimate both the system states and parameters of the attack. We also propose a low-rank modification to the Kalman filter that improves computational efficiency while maintaining the detection accuracy. We show empirically that this method successfully identifies complex attacks involving many buses.