Detection of false data injection attacks using unscented Kalman filter

Abstract

It has recently been shown that state estimation (SE), which is the most important real-time function in modern energy management systems (EMSs), is vulnerable to false data injection attacks, due to the undetectability of those attacks using standard bad data detection techniques, which are typically based on normalized measurement residuals. Therefore, it is of the utmost importance to develop novel and efficient methods that are capable of detecting such malicious attacks. In this paper, we propose using the unscented Kalman filter (UKF) in conjunction with a weighted least square (WLS) based SE algorithm in real-time, to detect discrepancies between SV estimates and, as a consequence, to identify false data attacks. After an attack is detected and an appropriate alarm is raised, an operator can take actions to prevent or minimize the potential consequences. The proposed algorithm was successfully tested on benchmark IEEE 14-bus and 300-bus test systems, making it suitable for implementation in commercial EMS software.

Cyber-attack Detection Strategy Based on Distribution System State Estimation

“…Thus, the three-phase linear DSSE model is expressed as (6), where x is the vector set of state variables which represents the complex bus voltage. The three-phase linear DSSE can be further simplified as (7).…”

“…Based on the characteristics of different cyber-attack types, the corresponding cyber-attack defense strategies are proposed: ① physical security: applying appropriate protection for measurement devices or replacing them with more accurate phase measurement units [3]; ② communication security: using various cryptography technologies to prevent cyber-attacks [4]; ③ information security: utilizing state estimation to track the actual power system under various malicious cyber-attacks [5], [6]. This paper focuses on the information cyber-attack defense strategy based on state estimation.…”

“…The traditional bad data detection and identification (BDDI) algorithm can effectively detect simple FIDAs. If the attacker obtains the power system topology, an FIDA based on the state estimation can elude the BDDI and increase the successful attack rate [6] - [10]. In [8], a cyber-attack was implemented to falsify the voltage measurement in the distribution system connected with photovoltaic systems.…”

Defensive Resource Allocation Method for Improving Survivability of Communication and Information System in CPPS Against Cyber-attacks

“…In recent years, many researches on the decision making of real-time defense strategy against cyber-attacks have been reported. The behavior and purpose of cyber-attacks are analyzed in [6], [7], and a corresponding detection and identification method for cyber-attacks is proposed in [8]. The forms and the propagation processes of cyber-attacks are studied in [9], [10].…”

Secure Market Operation in Presence of Critical Model Parameters in State Estimation

“…In view of this trend, a large volume of work has been dedicated to studying the potential attack paths and strategies, and possible defense measures to enhance the security of power systems as cyberphysical systems. Among them, a number of publications have focused on the so-called false data injection (FDI) attacks [4] - [9]. There have also been studies on how FDI attacks can be utilized to manipulate the outcomes of real-time electricity markets [10] - [12].…”