System-state-free false data injection attack for nonlinear state estimation in smart grid

Transcription

1 Internatonal Journal of Smart Grd and Clean Energy System-state-free false data njecton attac for nonlnear state estmaton n smart grd Jngxuan Wang, Lucas C. K. Hu, S. M. Yu * Department of Computer Scence, The Unversty of Hong Kong, Hong Kong Abstract Cyber-physcal securty of smart grd under attacs s a serous ssue today. The technque of state estmaton has been employed n such a large-scale system to ensure the relablty. Successful attacs on tamperng these readngs were shown for lnear state estmaton. For the more realstc nonlnear state estmaton are used n real systems, the attac that requres the nowledge of system states (whch are dffcult to obtan, even for nsders) was proposed. Up to our best nowledge, there are no research results that are able to gve an attac to any buses wthout the nowledge of system states. Ths research paper provdes such an attac. Demonstratons on IEEE test system show that the smart grd can be exploted by launchng such attacs even wthout system state nformaton. The strategy to generate such an attac s smple and easy to mplement. Thus, the results n ths paper show that a more realstc threat to the smart grd system. Hopefully the communty could revst the tampered readng detecton algorthms to come up wth a more sophstcated soluton to avod ths vulnerablty. Keywords: False data njecton attac, state estmaton, cyber-physcal system, smart grd, nformaton securty 1. Introducton Cyber Physcal System (CPS) s an ntegrated system n whch computatonal elements collaborate to control physcal enttes. CPS was regarded as a top-prorty research area snce 27 [1]. Beng a crtcal nfrastructure, smart grd s a typcal example of CPS (e.g. wth the sensors and smart meters as the physcal enttes, the SCADA (Supervsory Control and Data Acquston) control system as one of the computatonal elements). The current trend of smart grd s to provde on-demand power supply accordng to real-tme user requrements [2]. One of the major securty concerns of a smart grd system s on the communcatons of the cyber components (.e. software n the SCADA system) and the physcal components (.e. sensors/meters). Several attacs ndcate that the physcal components, such as smart meters, can be compromsed n order to msuse prvate customer data or manpulate meter readngs [3]. To ensure the relablty of such a system, the followng system montorng procedure s beng used. Meters (sensors) are placed at dfferent (crtcal) ponts of the system and the status of the system can be computed/predcted to mae sure that the system s n a secure state. Example readngs from these meters nclude bus voltages, bus power njectons, and branch power flows [4]. The readngs are transmtted from the meters to the SCADA system and the state of the system wll be estmated (ths process s called "state estmaton"). In the computaton of the state estmaton, the electrcty flows n the smart grd are needed to be modeled. There are two approaches: Alternatng Current (AC) model and Drect Current (DC) model. The AC model s more realstc and the flow s usually modeled by a set of nonlnear equatons whle the DC model s a smplfed model to approxmate the AC model. The DC model s not as accurate as the AC model and the flow s only modeled by lnear equatons. The state of the system (.e., the output of the state estmaton) s usually represented by a vector of state varables (e.g. voltage * Manuscrpt receved March 3, 215; revsed August 21, 215. Correspondng author. Tel.: ; E-mal address: jxwang@cs.hu.h. do: /sgce

2 17 Internatonal Journal of Smart Grd and Clean Energy, vol. 4, no. 3, July 215 magntudes and angles for dfferent buses). The values of these state varables are used to control or adjust the smart grd components. The bad news s that exstng hacng technques are able to compromse meters wth malcous attacs. In vew of ths, there exst methods to detect whether the readngs have been tampered (or are ncorrect due to other reasons). These methods are referred as "bad data detecton methods (algorthms)" [5]. Most, f not all, of these methods rely on the same prncple: f the readngs (measurements sent bac from the meters) are bad (e.g. beng tampered), the dfference between these observed readngs and the computed readngs based on the estmated state varables. Ths dfference s called "resdual" and ths observaton s referred as the "resdual prncple". Recently, a new class of man-n-the-mddle attacs, namely false data njecton attacs (FDIAs) was frst proposed n [6]. They successfully showed that FDIAs could bypass exstng bad data detecton algorthms for the DC power flow model. Such an attac, f successful, would mean a bg loss to the system [7]. For example, [7] llustrated that for the IEEE 14-bus system, f the output of the generator on one bus was modfed and ths attac lasted for one wee, t would brng more than 4.7 mllon dollars benefts to the generaton company. Whle FDIAs were wdely explored n DC model [6], the proposed adversary models could not be appled to AC power flow model [8]. Paper wors towards constructng FDIAs n AC power flow model were very few [9]-[11]. [9], [1] concentrated on how many and whch measurement should be tampered n the AC model wth the nowledge of system states. These system states were usually stored n the secure part of the SCADA system and were dffcult to access (even for nsders). [11] followed the wor n [9] and proposed a feasble approach to obtan those system states. Ther analyss can only cover some of the buses whch they called "njecton-bus", but not all. So up to our best nowledge, there are no research results that are able to gve an attac to any buses. Ths research paper provdes such an attac. The dffculty for constructng stealthy errors n AC model led on the complexty of the set of nonlnear equatons. It s not easy to construct a set of tampered readngs to satsfy the equatons so that t can bypass the bad data detecton algorthm. Also, for AC model, the number of measurements s also more than that of DC model, whch ncreases the dffculty of the problem. The man contrbuton of ths paper s to present a smple strategy to launch FDIA aganst nonlnear state estmaton from the attacer's perspectve. Ths strategy can be appled to any types of buses wthout the nowledge of system states. One theorem s ntroduced to show that t s lely to fnd such an attac vector when satsfyng a smple rule. Two realstc attac goals are consdered: random false data njecton attacs, n whch the attacer wants to nject any attac vectors as long as leadng some wrong state varables n AC power flow model and specfc false data njecton attacs, n whch the attacer wants to nject specfc error nto state varables n AC power flow model. Ths paper then proposes a procedure to generate such attac and llustrates that t s possble to construct attac vectors aganst nonlnear systems through smulatons on several IEEE test systems (IEEE 14-bus, 3-bus, and 118-bus). The rest of ths paper s organzed as follows. Some prelmnares of nonlnear state estmaton n a smart grd system are gven n Secton 2. In Secton 3, models of launchng FDIAs n nonlnear system are ntroduced. Secton 4 presents the evaluatons on the proposed attacs and Secton 5 concludes the paper. 2. Nonlnear State Estmaton Consder a set of measurements gven by the vector z h( x) e, where x s state vector, hx ( ) s a functon vector relatng z to x and e [ e1, e2,..., e ] T m s the vector of measurement errors. In an AC power flow model, there are 2l 1 elements n a state vector, whch can be represented as x 2 3 l 1 2 l [,,...,,V,V,...,V ] T (1)

3 Jngxuan Wang et al.: System-state-free false data njecton attac for nonlnear state estmaton n smart grd 171 where,v s voltage angle and voltage magntude at bus.wthout loss of generalty, bus 1 s chosen as the reference ( 1 ). Furthermore, measurements nclude real/reactve power njectons and real/reactve power flows. More detals about measurements can be found n [4]. When gven measurement vector z, state varables are often estmated by weghted least-square crteron (WLS), maxmum lelhood crteron and mnmum varance crteron. These crterons are the most popular methods when dealng wth state estmaton problem, thus are used n ths paper. The WLS estmator s used to mnmze the followng objectve functon: m 2 T 1 ( ) (z h (x)) [z h(x)] [z h(x)] 1 J x R R (2) where: (1) Ee [ ],where 1,2,..., m; (2) Measurement errors are ndependent (.e. E[ e e ] ); T (3) 11 22, R E[ e e ] dag{r,r...,r nn} and R s the varance of the error n measurement Bad data detecton(bdd) State varables n control center wll be re-estmated when the system s njected by ether mnor physcal errors or malcous attacs. Most BDD programs use "resdual prncples" to detect the presence of bad measurements. Upon detecton of bad data n smart meters, the dentfcaton can be accomplshed by further processng resduals. Measurement resduals (dfferences between observed measurements and estmated measurements) can be represented as, j r z h(x) ˆ (3) Mostly, 2 ( m n),(1 ) 2 Test s used to test whether there exsts bad measurements, denotes the value n freedom v m n. 3. False Data Injecton Attacs n AC Model J( x) m n 2 ( ),(1 ), where 2 dstrbuton table wth a sgnfcance level and the degree of Snce ntrudng the control center s qute dffcult, system states ( x) cannot be easly obtaned n realty, the assumptons n the smart grd envronment are summarzed as follows: Control center cannot be read or falsfed by anyone, ncludng system operators; Attacer needs to now the topology of the system; Attacer only has resources to ntrude (read/modfy) at most f meters among all meters (nowledge about complete measurement nformaton s not necessary). It needs to be ponted out that n prevous wors [9], [1], whch constructng FDIAs n nonlnear systems, do pose strong requrements for the attacers. They requre the attacers to now the topology of the targeted system. Moreover, the attacers need to get the nowledge of the system states, whch s n general not easy to obtan, even for nsders. Notwthstandng, t s mportant for securty researchers to derve one nd of attac wthout the nowledge of system states, whch can nject errors on any buses n nonlnear system. The rest of ths secton frst gves basc prncples on adversary models n nonlnear systems. Then two nds of attacs are addressed: random false data njecton attacs and specfc false data njecton attacs. Both attacs are under the realstc attac scenaros that the attacer s lmted to modfy any f meters. The frst attac s to generate an attac vector wthout consderng the mpacts on estmated state varables (system states) n the control center. The whole system may be dsordered when

4 172 Internatonal Journal of Smart Grd and Clean Energy, vol. 4, no. 3, July 215 launchng ths nd of attac. The second nd of attac s more focused and t tres to generate specfc errors on targeted state varables. In ths case, the attacer does not need to concern f hs attac mpacts other state varables when attacng the chosen one(s) Basc prncple It s noted that there are m measurements (z 1,z 2,...z ) T m and n state varables ( x1, x2,..., x ) T n n a smart grd system. The relatonshp characterzed between z and x s the functon h ( x ), as s dscussed n Secton 2. Let za z a be the measurements after attacs, where z s the current measurements and a s referred as the stealthy attacs [12]. The L2 norm of the measurement resdual after an attac, can be represented by r z h(x ˆ ) z a h(x ˆ ) (4) a a bad bad where h(x ˆ bad ) s denoted as the vector of estmated state varables obtaned from z a. As dscussed above, BDD computes the dfference between za and h (x ˆ bad ). Theorem 1 shows a smple crteron that maes z a bypass BDD based on resdual prncple when all measurement nformaton can be collected by the attacer. In detals, the attac vector a can be computed as a a r, where a s an arbtrary vector and r s ts resdual. In other words, there exsts a way of calculatng an attac vector that can bypass the detecton qute easly. Theorem 1: Assume that the meter errors are very small (n the parameters gven by IEEE test 4 systems, t s about1 ), there always exsts a stealthy attac a that can bypass the bad data detecton scheme wthout detected when there exsts a vector a, whch can mae the nonlnear system observable. Proof: When there exsts a malcous vector a that can lead to an estmaton of state estmaton n the nonlnear system, t s easy to compute the system resdual r by Equatons (3). Based on the assumpton that the meter errors are very small, we can have z a r h(x ˆ ) (5) where h(x ˆ ) s the state varables estmated by z a r. Consderng f an attac a a r, the measurement resdual r a (after attac a ) can be descrbed as, r z a r h(x ˆ ) (6) a Snce observablty s defned as the ablty to unquely estmate the system states usng the gven measurements [13], a wll have a unque vector of state varables (denoted as ˆx ). That s, ra. The attac a a rcan bypass the bad data detecton scheme. Therefore, the proof s complete Random false data njecton attac In a random FDIA, the attacer ntends to fnd any attac vector a as long as t can result n a wrong estmaton of state varables [6]. As dscussed earler, the attacer can get the nowledge of system topology h(). When consderng the networ parameters are tme nvarant, t s feasble to perform the process of constructng random FDIAs based on THEOREM 1. Assume that the attacer can read/modfy at most any f meters n a smart grd system. Let z ( z,...,z ) 1 f T and z count ( za z) denotes the number of meters need to be modfed n set S p, where ( z,...,z ) T a a1 af. And let S p s the meter set

5 Jngxuan Wang et al.: System-state-free false data njecton attac for nonlnear state estmaton n smart grd 173 ncludes all crtcal meters [14] and at least one meter exsts n every crtcal -tuple wthn the system. Algorthm 1 s the pseudocode of constructng random false data njecton attacs on behalf of an attacer. The nput of ths algorthm s the topology nformaton (.e. admttance matrxes). The output of ths algorthm s to return an attac vector ( a ). Step 3-18, t tests whether there exsts a soluton x based on z and h(), where s the teraton ndex. The teraton ndex s closely based on a snce z s fxed. When consderng Step 16, f count ( a) f, the attac vector does exst. Specfcally, n each teraton, the measurement functon hx ( ) and measurement Jacoban H x x are calculated based on equatons of dfferent measurement types [4]. Furthermore, gan matrx Gx ( ) can be computed as: G( x ) H H (7) 1 R x x x x Algorthm 1 Random FDIA of Nonlnear SE Input: Admttance matrxes h() ; A set of current measurements {z }; Number of meters that can be read/modfed, f. Output: Random false data njecton attac z a. 1: Intalze a random nonzero attac vector (a ) m 1; 1 2: Intalze x (,,...,1,1,...,1) T ; 3: for 1:1 do T 1 4: Compute g (x ) based on g( x) J ( x) x [ h( x) x] R [z h( x)] ; 5: Compute G(x ) g(x) x ; 6: f G(x ) s postve defnte && 1 then T 1 7: Compute x by G( x) x [ h( x) x] R [z h( x)] ; 8: f x then T 1 1 T 1 9: a h((h R H ) H R (z a )) z ; 1: Go to Step 16; 11: end f 12: else 13: Go to Step 1; 14: end f 15: end for 16: f count ( a) f ; then 17: return a ; 18: end f Measurements can be modfed by ntrudng the smart meters. By launchng such attacs, arbtrary or specfc errors () c can be successfully njected on state varables (n control center) Specfc false data njecton attac The specfc FDIAs are the attacs that can generate specfc errors on state varables wthout beng x x

6 174 Internatonal Journal of Smart Grd and Clean Energy, vol. 4, no. 3, July 215 detected. As s dscussed earler n ths paper, the attacer does not need to consder the mpacts on other state varables when attacng the targeted ones. To construct an attac vector wth specfc errors on x, the attacer needs to fnd a p-sparse vector T 1 T 1 ( H R H ) x H R ( z a ) x x, whch satsfes (8) Noted that z s the current measurement vector and a s a non-zero random selected attac vector. Equaton (8) can be reformulated as a NP-Complete problem [15]: The computaton of non-zero elements of ( xˆ xˆ ) satsfyng Ax b are at most q. Note that attacer cannot obtan state varables by accessng the control center. Ths paper gves a heurstc method to construct a set of attac vectors wth ther correspondng estmated state varables. The attacer can then pc up deal attacs by usng the least smart meters (when njectng specfc errors c onto state varables). If there are multple attacs that can fulfll the requrements above, the attacer can select a vector a wth the smallest number of modfed meters. Ths enables the attacer to nject an attac wth meters as few as possble. 4. Expermental Results In ths secton, the proposed FDIAs are valdated through experments based on IEEE test systems, ncludng 14-bus, 3-bus and 118-bus systems. The dataset used n ths secton can be found n [16]. Ths paper prmarly focuses on the feasblty of generatng FDIAs aganst AC power flow model as well as the efforts needed for a successful attac. The nformaton of state varables and measurements wthn varous IEEE test systems s gven n Table 1 and s set to be 2.. Table 1. Number of state varables and measurements n the IEEE test systems 4.1. Tme and probablty IEEE Bus System 14-bus 3-bus 118-bus No. of voltage measurements No. of real power nject measurements No. of reactve power nject measurements No. of real power flow measurements No. of reactve power flow measurements No. of total measurements No. of state varables The performance of probablty of constructng random FDIAs s frst evaluated when f s not fxed. The experments are performed as follows. Let the parameter f vares from 1 to maxmum number of meters n each system. For each f, randomly choose f meters to attempt an attac vector constructon. Repeat ths process 1 tmes and estmate the success probablty p f = # successful trals/1. Fg. 1(a) shows the relatonshp between the probablty of fndng proposed attacs and the percentage of modfed meters. It can be seen that the probablty ncreases as the number of modfed measurements ncreases. Attac can be constructed wth the probablty close to 1% when f s large. For example, probablty s 1% when f s set to 59.38%, 76.92%, 8.26% of the whole measurements for IEEE 14- bus, 3-bus and 118-bus respectvely. For example, the attacer can always fnd a random FDIA n IEEE 14-bus system, when he can modfy at least 19 smart meters. As s shown n Fg. 1(b), constructng specfc FDIA s more challengng for the attacer. The am of specfc FDIAs s to nject specfc errors on state varables. Monte Carlo method s used to perform the experments. These experment results demonstrate that FDIAs n nonlnear systems can be systematcally constructed by algorthms proposed n ths paper. Also the results show that t s possble and practcal to

7 Jngxuan Wang et al.: System-state-free false data njecton attac for nonlnear state estmaton n smart grd 175 launch FDIAs n nonlnear system wth the nowledge of system's topology but wthout the nowledge of system states. (a) Fg. 1. Probablty of fndng an attac: (a) random FDIAs and (b) specfc FDIAs. (b) Table 2. Tme and Probablty on Random FDIAs IEEE Bus System Tmng Cost(s) Probablty 14-bus % 3-bus % 118-bus % When f s set to be f.3 (# of meters), based on evaluaton objectves, two ndces are analyzed: tmng cost that constructs an attac vector and probablty that the attac can be successfully constructed among 1 trals for each test system, whch s shown n Table 2. When the attac s feasble, the speed for generatng such an attac s farly quc. Moreover, the tme s manly spent on Cholesy factorzaton. Despte the fact that the topology of nonlnear system s more complex, the executon tme of our method ( ms) s comparable to that of [8] ( ms) Impacts on state varables The mpacts after random FDIAs are analyzed. A good attac s defned as successful njectng large errors on x. (a) Fg. 2. State varables (voltage magntudes and angles) range after attacs n IEEE 3-bus system. Fg. 2. shows the maxmum and mnmum values of voltage magntudes and angles of all buses among 1 tmes attaced by random FDIA n IEEE-3 bus system. From analyzng our results, FDIA can nject errors at most 5 tmes larger than orgnal estmated magntudes (for example, the range of voltage magntude at bus 11 s [.5411,5.4699] and the orgnal estmated voltage magntude at bus 11 s 1.82 ), and can nject errors that change the angle to nearly 18. Snce these results are based on 1 (b)

8 176 Internatonal Journal of Smart Grd and Clean Energy, vol. 4, no. 3, July 215 trals, renforce these conclusons are very convncng. 5. Concluson Ths paper proposes a false data njecton attac aganst nonlnear state estmaton n a cyberadversaral system (.e. smart grd). The nnovatve dea of ths algorthm s that t does not need the nowledge of system state and can nject errors nto an AC power flow system wthout beng detected. Ths paper strengthens the attacs to cyber-adversaral systems, and therefore research on protectons n wth cyber-adversaral systems wll be n a greater need n near future. Furthermore, ths wor focuses on the smart grd envronment, the general applcaton and nfrastructure wor can be extended to other domans, such as avaton cyber-physcal systems or smart mcro-grds. Acnowledgements The wor descrbed n ths paper was partally supported by the HKU Seed Fundng s for Appled Research , and HKU Seed Fundng s for Basc Res and References [1] Bush PGW. Leadershp Under Chal-lenge: Informaton Technology R & D n a Compettve World, August 27. [2] Srdhar S, Hahn A, Govndarasu M. Cyber physcal system securty for the electrc power grd. Proceedngs of the IEEE, 212; 1(1): [3] Wdl E, Palensy P, Sano P, Rehtanz C. Guest edtoral: modelng, smulaton, and applcaton of cyber-physcal energy systems. IEEE Transactons on Industral Informatcs, 214; 1(4): [4] Abur A, Gomez Exposto A. Power System State Estmaton: Theory and Implementaton. CRC Press; 24. [5] Chen J, Abur A. Placement of pmus to enable bad data detecton n state estmaton. IEEE Transactons on Power Systems, 26; 21(4): [6] Lu Y, Nng P, Reter MK. False data njecton attacs aganst state estmaton n electrc power grds. ACM Transactons on Informaton and System Securty, 211; 14(1):13. [7] Lu T, Gu Y, Wang D, Gu YH, Guan XH. A novel method to detect bad data njecton attac n smart grd. In: Proc. Proceedngs IEEE INFOCOM, 213: [8] Ja LY, Thomas RJ, Tong L. On the nonlnearty effects on malcous data attac on power system. In: Proc. IEEE Power and Energy Socety General Meetng, 212:1 8. [9] Hug G, Gampapa JA. Vulnerablty assessment of ac state estmaton wth respect to false data njecton cyber-attacs. IEEE Transactons on Smart Grd, 212; 3(3): [1] Rahman M, Mohsenan-Rad H, et al. False data njecton attacs aganst nonlnear state estmaton n smart power grds. In: Proc. Power and Energy Socety General Meetng, 213:1 5. [11] Lang JW, Kosut O, Sanar L. Cyber attacs on ac state estmaton: unobservablty and phys-cal consequences. In: Proc. PES General Meetng Conference & Exposton, 214:1 5. [12] Wang S, Ren W. Stealthy false data njecton attacs aganst state estmaton n power systems: swtchng networ topologes. In: Proc. Amercan Control Conference, 214: [13] Expsto AG, Abur A. Generalzed observablty analyss and measurement classfcaton. In: Proc. 2th Internatonal Conference on Power Industry Computer Applcatons, 1997: [14] Clements KA, Davs PW. Multple bad data detectablty and dentfablty: a geometrc approach. IEEE Transactons on Power Delvery, 1986; 1(3): [15] Mchael RG, Davd SJ. Computers and Intractablty: A Gude to the Theory of NP-Completeness. San Francsco: WH Freeman & Co.; [16] Chrste RD. Power systems test case archve. Electrcal Engneerng dept., Unversty of Washngton; 2.