Moving-Target Defense for Detecting Coordinated Cyber-Physical Attacks in Power Grids

Abstract

This work proposes a moving target defense (MTD) strategy to detect coordinated cyber-physical attacks (CCPAs) against power grids. A CCPA consists of a physical attack, such as disconnecting a transmission line, followed by a coordinated cyber attack that injects false data into the sensor measurements to mask the effects of the physical attack. Such attacks can lead to undetectable line outages and cause significant damage to the grid. The main idea of the proposed approach is to invalidate the knowledge that the attackers use to mask the effects of the physical attack by actively perturbing the grid's transmission line reactances using distributed flexible AC transmission system (D-FACTS) devices. We identify the MTD design criteria in this context to thwart CCPAs. The proposed MTD design consists of two parts. First, we identify the subset of links for D-FACTS device deployment that enables the defender to detect CCPAs against any link in the system. Then, in order to minimize the defense cost during the system's operational time, we use a game-theoretic approach to identify the best subset of links (within the D-FACTS deployment set) to perturb which will provide adequate protection. Extensive simulations performed using the MATPOWER simulator on IEEE bus systems verify the effectiveness of our approach in detecting CCPAs and reducing the operator's defense cost.

Decentralized Intrusion Prevention (DIP) Against Co-Ordinated Cyberattacks on Distribution Automation Systems

“…Reference [22] proposes to use Flexible AC Transmission System (FACTS) devices to periodically perturb the reactance of certain lines in the network. Thus, an attack constructed with outdated reactances can be detected by the bad data detector (BDD).…”

DecIED: Scalable k-Anonymous Deception for IEC61850-Compliant Smart Grid Systems

“…Moving target defence (MTD) technologies for perturbation of cyber and/or physical topology to confuse attackers are explored, for instance in [40,41,60]. These are effective in preventing attackers from obtaining accurate system information to launch successful attacks, but it is not designed for capturing probing/reconnaissance activities attempted by persistent attackers that are hiding the infrastructure to prepare for a large-scale attack.…”

“…Reference [21] also discussed further concepts such as " -diversity" and " -mutation", and our design can be extended to support them in a straightforward manner. Furthermore, by wisely coordinating status and measurements messages reported by DecIED, we can mislead/lure attackers to mount non-optimal attack or attacks that can be detected or prevented by other security schemes, by incorporating the moving target defence [40]. Such extension is left for our future work.…”

“…We show that, on commodity industrial PCs, we can run as many as 200 deception device instances. We believe DecIED can serve as a crucial building block for advanced deception solutions such as moving target defence (e.g., [40]) as well as other deception strategies discussed in [21].…”

Towards a High-Fidelity Network Emulation of IEC 104 SCADA Systems

“…In the literature, there are different types of cyberattacks for power grids [13]. On one side, some attacks focus on damaging components in the systems, such as damaging generation machines in the Aurora case [22], while others attempt blackouts like the cyberattacks in Ukraine [18].…”