Detection of Malicious Attacks in Autonomous Cyber-Physical Inverter-Based Microgrids

Abstract

The distributed generation capabilities of microgrids (MGs) arise as essential assets in enhancing grid resilience. The integration of distributed energy sources (DERs), controllable loads, and prosumers necessitates the deployment of potent control and communication synergies. While those synergies transform MGs into cyber-physical systems through information technologies able to sense, control, and actuate local resources and loads, they inadvertently expose MGs to cyber-attack threats. Increasing the security of critical communication and control systems against 'black swan' events, i.e., high-impact lowprobability cyber-physical incidents, is a major priority for MGs operations. Such incidents, if left unabated, can intensify and elicit system dynamics instability, eventually causing outages and system failures. In this paper, we develop an integrated approach for multi-agent MG systems able to perform the detection of malicious cyber-physical attacks based on subspace methods. We employ the small signal model of an autonomous/islanded MG and consider different attack models targeting the MG's secondary frequency control. The attack detector is constructed via identifying the stable kernel representation of the autonomous cyber-physical MG in the attack-free case. We illustrate the impact of the attack models as well as the feasibility of the developed detection method in simulation models of the Canadian urban benchmark distribution system.

Mitigation of Cyberattacks through Battery Storage for Stable Microgrid Operation

“…It is interfaced with the MG feeder similarly to the DG nodes, i.e., via a 12.5kV/208V step-down transformer. More details on the Canadian urban benchmark model can be found in [4].…”

“…The MSC monitors and supervises the nominal operation of the system by issuing control commands to the DG agents, enforcing the economic operation, managing the BESS resources (at the PCC), and providing remediation actions in case of adverse events. For instance, after the detection of a misbehaving agent [4], the leader will issue a disconnect command to the circuit breaker (CB) of that agent and at the same time instruct the remaining DG agents to remove the node from their consensus set. Recovery of the compromised agent will then be initiated with coordination between the affected node and the MSC.…”

“…Physics-informed methodologies considering the dynamics of power system assets, and their response (in attack-free cases and/or during different perturbations) have been explored in literature for the attack detection [4], [18]. In this work, we utilize a threshold-based approach where the cyber-physical properties of the system, i.e., state information x t in Eq.…”

“…To harden CPES against adversaries, compound security and intrusion-tolerant mechanisms, that can detect anomalous behavior and proactively perform remediation actions, leveraging system resources need to be automated. For example, in [4], the authors propose the use of matrix subspace methods for the detection of cyberattacks targeting autonomously operating MGs and present the potential impact of such attacks if not immediately identified. The importance of system resources, such as BESS, in supporting ancillary services of the grid is discussed in [5].…”

Behind Closed Doors: Process-Level Rootkit Attacks in Cyber-Physical Microgrid Systems

“…Rootkits can achieve persistence by masking their presence. Our future work will focus on developing detection and mitigation mechanisms, e.g., moving target defences, stable kernel represenations [22], etc. thwarting the adversarial learning behavior of rootkits.…”