The dependence of modern societies on electric energy is ever increasing by the emergence of smart cities and electric vehicles. This is while unprecedented number of cyberphysical hazards are threatening the integrity and availability of the power grid on a daily basis. On one hand, physical integrity of power systems is under threat by more frequent natural disasters and intentional attacks. On the other hand, the cyber vulnerability of power grids is on the rise by the emergence of smart grid technologies. This underlines an imminent need for the modeling and examination of power grid vulnerabilities to cyber-physical attacks. This paper examines the vulnerability of the communication-assisted protection schemes like permissive overreaching transfer trip (POTT) to cyberattacks using a co-simulation platform. The simulation results show that the transient angle stability of power systems can be jeopardized by cyberattacks on the communication-assisted protection schemes. To address this vulnerability two physical solutions including the deployment of communication channel redundancy, and a more advanced communicated-assisted protection scheme, i.e. DCUB, are considered and tested. The proposed solutions address the vulnerability of the communication-assisted protection schemes to distributed denial of service attack to some extent. Yet, the simulation results show the vulnerability of the proposed solutions to sophisticated cyberattacks like false data injection attacks. This highlights the need for the development of cyberbased solutions for communication channel monitoring.

The digitalization of power systems over the past decade has made the cybersecurity of substations a top priority for regulatory agencies and utilities. Proprietary communication protocols are being increasingly replaced by standardized and interoperable protocols providing utility operators with remote access and control capabilities at the expense of growing cyberattack risks. In particular, the potential of supply chain cyberattacks is on the rise in industrial control systems. In this environment, there is a pressing need for the development of cyberattack detection systems for substations and in particular protective relays, a critical component of substation operation. This paper presents a deep learning-based cyberattack detection system for transmission line protective relays. The proposed cyberattack detection system is first trained with current and voltage measurements representing various types of faults on the transmission lines. The cyberattack detection system is then employed to detect current and voltage measurements that are maliciously injected by an attacker to trigger the transmission line protective relays. The proposed cyberattack detection system is evaluated under a variety of cyberattack scenarios. The results demonstrate that a universal architecture can be designed for the deep learning-based cyberattack detection systems in substations.

Synchronization systems play a vital role in the day-to-day operation of power systems and their restoration after cascading failures. Hence, their resilience to cyberattacks is imperative. In this paper, we demonstrate that a well-planned false data injection attack against the synchronization system of a generator is capable of causing tripping subsequently leading to instability and blackout. We present an analytical framework behind the design and implementation of the proposed cyberattack. Moreover, we derive and discuss the conditions for which a cyberattack interfering with a synchronizing signal can be successful. Effective physical mitigation strategies are then proposed to improve the cyber-resilience of synchronization systems. The proposed cyberattack model and mitigation strategies are verified for a microgrid test system using an OPAL-RT real-time simulator.

The growing use of information and communication technologies (ICT) in power grid operational environments has been essential for operators to improve the monitoring, maintenance and control of power generation, transmission and distribution, however, at the expense of an increased grid exposure to cyber threats. This paper considers cyberattack scenarios targeting substation protective relays that can form the most critical ingredient for the protection of power systems against abnormal conditions. Disrupting the relays operations may yield major consequences on the overall power grid performance possibly leading to widespread blackouts. We investigate methods for the enhancement of substation cybersecurity by leveraging the potential of machine learning for the detection of transformer differential protective relays anomalous behavior. The proposed method analyses operational technology (OT) data obtained from the substation current transformers (CTs) in order to detect cyberattacks. Power systems simulation using OPAL-RT HYPERSIM is used to generate training data sets, to simulate the cyberattacks and to assess the cybersecurity enhancement capability of the proposed machine learning algorithms.

Coordinated cyber-physical (CCP) attacks have attracted wide attention in power systems because of their potential to cause severe disturbance including cascading failures. However, as realistic power systems operate within the N-1 security criterion, existing CCP attacks may be in part mitigated. As such, this paper analyzes impacts of CCP attacks on the vulnerability of the power systems that employ the N-1 security constrained optimal power flow (SCOPF). Specifically, a tri-level model is proposed to analyze the CCP attack impacts, whereby the adversary coordinates a physical attack with cyber attacks to initiate and propagate post-contingency overload based on N-1 SCOPF. A methodology utilizing semidefinite programming (SDP) relaxation and primal-dual formulation is proposed to transform the tri-level model into a conic optimization, such that the model can be easily solved by SDP solvers. Case studies on the IEEE 14, 57, and 118 bus test systems demonstrate that the CCP attacks in power systems with N-1 security criterion are able to cause N-1-1 contingency and even trigger cascading failures.