Distributed Quickest Detection of Cyber-Attacks in Smart Grid

Transcription

1 1 Disribued Quickes Deecion of Cyber-Acks in Smr Grid Mehme Necip Kur, Ysin Yılmz, Member, IEEE, nd Xiodong Wng, Fellow, IEEE Absrc In his pper, online deecion of flse d injecion FDI) cks nd denil of service DoS) cks in he smr grid is sudied. The sysem is modelled s discree-ime liner dynmic sysem nd se esimion is performed using he Klmn filer. The generlized CUSUM lgorihm is employed for quickes deecion of he cyber-cks. Deecors re proposed in boh cenrlized nd disribued seings. The proposed deecors re robus o ime-vrying ses, cks, nd se of cked meers. Online esimes of he unknown ck vribles re provided, h cn be crucil for quick sysem recovery. In he disribued seing, due o bndwidh consrins, locl ceners cn only rnsmi qunized messges o he globl cener, nd novel even-bsed smpling scheme clled level-crossing smpling wih hyseresis LCSH) is proposed h is shown o exhibi significn dvnges compred wih he convenionl uniform-in-ime smpling US) scheme. Moreover, disribued dynmic se esimor is proposed bsed on informion filers. Numericl exmples illusre he fs nd ccure response of he proposed deecors in deecing boh srucured nd rndom cks nd heir dvnges over he exising mehods. Index Terms Smr grid, Klmn filer, flse d injecion ck, denil of service ck, quickes deecion, generlized CUSUM, disribued lgorihm, level-crossing smpling. I. INTRODUCTION Wih he recen dvncemens in monioring, sensing, signl processing, conrol, nd communicion, dvnced echnologies re being inegred ino he nex-generion power sysems, i.e., he smr grid. Due o such feures, he smr grid depends on criicl cyber infrsrucure which mkes i vulnerble o hosile cyber hres [1]. This rises sfey nd securiy concerns bou he smr grid since ny ouges or filures in his sysem my led o wide-re power blckous nd significn finncil losses. Among mny ypes of cybercks, we py specil enion o flse d injecion FDI) nd denil of service DoS) cks in his sudy. The im of FDI cks is o compromise meer mesuremens wih ddiive mlicious d nd he im of DoS cks is o block sysem funcionliy or inervene norml sysem operion o some exen. A. Lierure Survey on Cyber-Acks nd Couner-Mesures in Smr Grid In prcice, FDI nd DoS cks cn be performed by mnipuling/jmming he nework communicion chnnels, This work ws suppored in pr by he U.S. Nionl Science Foundion NSF) under grn ECCS , nd in pr by he U.S. Office of Nvl Reserch ONR) under grn N Y. Yilmz s work ws suppored in pr by NSF under grn CNS nd in pr by he SCEEE grn. M. N. Kur nd X. Wng re wih he Deprmen of Elecricl Engineering, Columbi Universiy, New York, NY 1007, USA e-mil: m.n.kur@columbi.edu; wngx@ee.columbi.edu). Y. Yılmz is wih he Deprmen of Elecricl Engineering, Universiy of Souh Florid, Tmp, FL 3360, USA e-mil: ysiny@usf.edu). meer meer meer Locl Conrol Cener Locl Conrol Cener meer meer meer A A4 Acker A5 A1 A3 Globl Conrol Cener meer meer meer meer meer Locl Conrol Cener Locl Conrol Cener meer Fig. 1: An illusrion of he vulnerbiliies of smr grid. The solid lines illusre he nework communicion chnnels nd he dshed lines illusre he possible cyber-cks. The cker cn i) hck smr grid componen o block or mnipule is operion A1, A3, A5), ii) mnipule, jm or block he communicion chnnels A, A4). hcking physiclly or hrough cyber infrsrucure) he smr grid componens smr meer, conrol cener, ec.) or ccessing nd mnipuling he dbse of conrol cener [1] [4]. The DoS ck cn lso be performed by repeedly sending huge mouns of pckes o he nework communicion chnnels o preven he useful sysem messge pckes from being received by he legiime receivers flooding) [5]. For n illusrion of how n cker cn perform cyber-cks in smr grid, we presen Fig. 1. Cyber cks in he smr grid minly rge gins se esimion. Since he power sysem is reguled bsed on esimed ses, ny deviion from he cul se esimes leds o wrong decisions in energy mngemen sysem, mnipuled elecriciy mrke prices [6], nd oher unpredicble derimenl consequences. Trdiionlly, se esimion in power sysems is bsed on he les squres LS) mehods. Bd d deecion mehods bsed on he LS esimors re successful in idenifying bd d due o rndom noise nd fuls bu unble o idenify srucured clled selh in he lierure) FDI cks [7]. Moreover, i is inconvenien o use LS esimors for rel-ime monioring of power sysem h is highly dynmic due o chnges in lod, power generion, nd sysem opology over ime [8]. Clssicl mehods for bd d deecion checks eiher he l -norm of mesuremen residul or he lrges normlized

2 residue nd if hese vlues re bove cerin hreshold, n ck or ful is deeced. I hs been firs shown in [7] h i is possible o injec flse d wihou chnging he mesuremen residul if he cker knows he sysem opology. Moreover, in [9], i is shown h even if he cker hs incomplee knowledge of he grid opology, i cn sill crry ou selh FDI cks if he sysem prmeers vry in smll dynmic rnge. This vulnerbiliy of he LS esimorbsed deecors hs opened up new reserch direcions. For insnce, in [10], he cker is consrined such h i cn compromise only limied number of meers nd hen n lgorihm for meer selecion is proposed. In [11], he problem of consrucing selh ck by minimizing he number of cked meers is invesiged. In some sudies, i is ssumed h he cker hs incomplee knowledge bou he sysem nd i is shown h he cker cn esime he opology by collecing online nd offline d [1] or by exploiing elecriciy mrke d [13]. Furhermore, in [14], i is shown h if n cker knows he opology of only locl region in power sysem, i cn successfully perform selh FDI cks o he locl meers. In response o FDI cks, some echniques for defending he grid hve been proposed. In [10], i is shown h if cerin number of meers re proeced, hen FDI cks cn lwys be deeced nd in [15], n lgorihm o specify such meers is proposed. Meers cn be proeced by using Phsor Mesuremen Unis PMUs). PMUs re dvnced devices h mke use of he Globl Posiioning Sysem GPS) nd provide highly precise phsor mesuremens synchronized over he whole grid [16]. They re expensive devices, hence he number of PMUs nd heir locions should be opimized. In his direcion, PMU plcemen lgorihms re proposed in [17] nd [18]. I is shown in [19], however, if he GPS receiver is spoofed, he dvnges of PMUs will dispper. In such cse, coordinion beween differen prs of he power grid is los nd he whole power sysem migh even collpse. For imely nd relible response, deecing cyber cks s quickly s possible nd wih n ccepble level of flse lrm re hs criicl impornce in rel-ime operion of he smr grid. Hence, he frmework of sequenil chnge deecion, lso known s quickes deecion, is very suible for his seup. In his frmework, d is sequenilly observed nd fer ech observion ime, decision is ken: i eiher sops nd chnge is declred or coninues o observe more d. Moreover, here exiss rdeoff beween he deecion speed nd he deecion ccurcy. As he desired deecion ccurcy increses, he deecion dely lso increses, or equivlenly he deecion speed decreses. There re severl sudies exploiing his frmework for deecion of FDI cks [0], [1]. The deecor in [0] ouperforms he so-clled dpive CUSUM es [1] nd hs quick nd ccure response if he cker hs n incomplee informion bou he sysem opology. However, i cnno deec he selh FDI cks. The LS mehods for se esimion depend only on he presen mesuremens. Adoping se-spce model enbles dynmic se esimor h combines presen nd ps mesuremens so h he sysem se cn be inferred in more ccure nd robus wy. If he noise hs Gussin disribuion, he Klmn filer is he opiml liner esimor h minimizes he men squred error []. Moreover, he Klmn filer provides prediced mesuremens which cn be exploied o improve ck deecion performnce. Some simple bd d deecors bsed on he Klmn filer hve been proposed in he lierure. In priculr, he Eucliden deecor [3], cosine similriy meric bsed deecor [4], nd chi-squre deecor [5] re he exising echniques h check he difference beween cul mesuremens nd he prediced mesuremens. However, such deecors re essenilly oulier deecion mehods mking smple-by-smple decisions, i.e., hey declre smple mesuremen s eiher norml or nomlous. On he oher hnd, in sequenil chnge deecion, negive/posiive evidence for chnge e.g., n ck or filure) in he sysem re ccumuled over ime nd chnge is declred only if he evidence supporing chnge is relibly high. Hence, ck/nomly deecors bsed on he sequenil chnge deecion heory re more relible compred o oulier deecion echniques. Furhermore, deecion-only schemes such s he deecors presened in [3] [5] do no provide ny esimes for he mgniude of he injeced mlicious d or he se of compromised meers, which my be criicl o know for n effecive ck miigion nd sysem recovery, e.g., o recover he ck-free ses or o isole he compromised meers during he recovery process. On he oher hnd, in deecion schemes including n esimion mechnism, esimion errors my worsen he deecion performnce. Due o limied communicion resources, e.g., energy nd bndwidh, collecion of mesuremens in single node my no be prciclly fesible. Moreover, in lrge power sysem, processing huge moun of d in single node is infesible nd suscepible o single node filure. Therefore, resourceeffecive disribued implemenion is required in prcice. In such sysem, he compuion is disribued over he whole nework nd he communicion overhed is reduced s much s possible. The informion filer, which is n lgebric equivlence o he Klmn filer, is convenien for disribued seing due o is simple upde rules [6]. Furhermore, even-bsed smpling echniques re convenien for sequenil chnge deecion, see e.g., [0], [7], [8]. In our cse, he decision sisics re expeced o vry in smll rnge before he ck, hence non-informive rnsmissions during his period cn be elimined wih even-bsed smpling echniques. B. Conribuions In his pper, he smr grid is modeled s discree-ime liner dynmic sysem nd he Klmn filer is employed for se esimion. Se nd mesuremen forecss/predicions provided by he Klmn filer re exploied o improve he ck deecion performnce. We lis our min conribuions s follows: Novel low-complexiy rel-ime deecion schemes re proposed for boh FDI nd DoS cks in smr grid in boh cenrlized nd disribued seings. The proposed schemes re robus o unknown nd ime-vrying ck mgniudes, se of cked meers, nd he sysem se.

3 3 Online esimes of he ck vribles re provided h cn be crucil for quick ck miigion nd sysem recovery. In priculr, simple closed-form mximum likelihood esime MLE) expressions re derived for he ck mgniudes nd he se of cked meers. The selh FDI cks described in [7] cn be deeced wih he proposed FDI deecion mechnisms. A novel fully disribued dynmic se esimor is proposed. Furher, in he disribued seing, o use communicion resources more effecively nd o improve he disribued ck deecion performnce, novel even-riggered smpling scheme clled level-crossing smpling wih hyseresis LCSH) is proposed for smpling nd rnsmission of locl sisics, h is shown o exhibi significn dvnges over he convenionl uniform-in-ime smpling US) scheme. C. Orgnizion The reminder of he pper is orgnized s follows. In Secion II, we presen he sysem model, he ck models under considerion, nd he problem formulions. In Secion III, we presen he cyber-ck deecors in he cenrlized seing, where ll mesuremens in he sysem re colleced nd processed by single node. In Secion IV, we presen he sysem model in he disribued seing, he disribued se esimion echnique, nd he corresponding cyber-ck deecors. We illusre he performnce of he proposed deecors vi exensive simulions in Secion V. Finlly, Secion VI concludes he pper. Throughou he pper, we use boldfce leers for vecors nd mrices. Moreover, o T denoes he rnspose of vecor or mrix o. II. SYSTEM MODEL AND PROBLEM FORMULATIONS Suppose h here re K meers in power sysem consising of N + 1 buses, where usully K N [9]. Sysem se x = [x 1,,..., x N, ] T represens phse ngles of N buses ime where one of he buses is chosen s he reference bus. Mesuremen ken meer k 1,..., K} ime is denoed wih y k, nd he se of mesuremens is denoed wih y = [y 1,,..., y K, ] T. In cenrlized seup, single conroller node observes ll he mesuremens in y. On he oher hnd, in disribued seup, mesuremens in y re disribued over he nework, i.e., ech node in he sysem observes y in pr. In he cul power sysem, relionship beween he mesuremens nd he se vribles is bsed on nonliner funcion [1]. We consider he commonly used pproxime direc curren DC) model, see e.g., [7], [9], [30], nd discree-ime liner dynmic sysem wih he se-spce equions x = Ax 1 + v, 1) y = Hx + w, ) where A R N N is he se rnsiion mrix, H R K N is he mesuremen mrix, v = [v 1,,..., v N, ] T is he process noise, nd w = [w 1,,..., w K, ] T is he mesuremen noise. We ssume h v nd w re independen ddiive whie Gussin rndom processes where v N 0, σ v I N ), w N 0, I K ), nd I K is K K ideniy mrix. Nex, we explin he considered cyber-ck models nd he corresponding problem formulions. Henceforh, we use he superscrips f, d, nd 0 o denoe quniies reled o FDI cks, DoS cks, nd no-ck, respecively. A. FDI Ack We consider h he cker is iniilly incive nd n unknown ime τ, i srs o mnipule he mesuremens by injecing ddiive flse d so h he mesuremen vecor kes he following form: y = Hx + + w, τ 3) where = [ 1,,..., K, ] T is he flse d creed by he cker ime τ. Le h T k RN be he kh row of he mesuremen mrix, i.e., H T = [h 1,..., h K ]. Bsed on 3), in cse of n FDI ck, y k, kes he following form: h T k y k, = x + k, + w k,, if k S f, h T k x + w k,, if k / S f, τ, 4), where S f 1,..., K} is he unknown se of compromised meers ime. Then, he null nd lernive hypoheses cn be wrien s H 0 : y k, N h T k x, ), k 1,,..., K}, 5) H f 1 : y N h T k x, ), k 1,,..., K}, < τ k, N h T k x, ), k / S f N h T k x + k,, ), k S f., τ, where we define he chnge even of ineres s 6) k, γ, k S f, τ, 7) i.e., γ is predefined lower bound for he bsolue vlue of k, h drws securiy enions 1. Since i is hrd o disinguish noise wih low-mgniude flse d, he vlue of γ should be seleced such h he number of flse posiives due o noise is reduced o n ccepble level. Moreover, FDI cks wih smll mgniudes re expeced o ffec he sysem minimlly. Our im is o deec he ck s quickly s possible wih he desired level of flse lrm re. In he sequenil chnge deecion lierure, here re wo min pproches: Byesin nd non-byesin [31]. In he Byesin pproch, he chnge poin τ is considered s rndom vrible wih known prior geomeric) disribuion [3]. However, in prcice lso in our cse), i is difficul o know prior disribuion for τ. Hence, we proceed wih non-byesin pproch where τ is considered s deerminisic unknown quniy. In priculr, we use Lorden s definiion for he wors-cse deecion dely [33] JT f ) = sup τ ess sup [ E τ T f τ) + ] F τ, 8) F τ where T f is he sopping ime of deecion scheme, F τ is he filrion, i.e., ll mesuremens obined unil ime τ, nd ) + = mx, 0). Moreover, E k is he expecion under P k h is defined s he probbiliy mesure when τ = k. In 1 γ is only deecor prmeer. I is no resricion for n cker s sregy.

4 4 8), he essenil supremum, which is concep in mesure heory, is in prcice equivlen o he supremum of se. Noe h JT f ) is clled he wors-cse deecion dely since i is equl o he verge deecion dely clculed under he les fvorble ck ime nd he les fvorble hisory of mesuremens unil he ck ime. The sopping ime is chosen o minimize he deecion dely subjec o flse lrm consrins. The opimizion problem is hen expressed s inf JT f ) subjec o E [T f ] α, 9) T f where E [T f ] is he men ime beween flse lrms in cse of no ck, i.e., τ =, nd α is predeermined lower bound for E [T f ]. Le he probbiliy densiy funcions pdfs) of he mesuremens corresponding o he mesuremen models given in ) nd 3) be denoed wih p 0 y x ) nd p f y x, ), respecively. If hese wo pdfs cn be compleely specified, he opiml soluion of he quickes deecion problem in 9) cn be found using he CUSUM es [34]: T f = inf m N : mx m 1 j m =j log pf y x, ) p 0 y x ) h f }, 10) where h f is he hreshold of he es, which conrols he rdeoff beween minimizing he verge deecion dely nd he flse lrm re. Since i) he sysem se x evolves over ime nd is no observed nd ii) he ck vecor nd he se of meers under ck S f re ime-vrying nd unknown, i is no possible o direcly pply he CUSUM es given in 10). However, we cn follow he generlized likelihood rio mehod [35, Sec. 5.3] nd replce he unknown quniies wih heir esimes [0]. In priculr, since we hve discree-ime liner dynmic sysem, he Klmn filer cn be used o obin he opiml se esimes ˆx []. Moreover, he MLEs of he ck vecor, i.e., â, nd he se of cked meers, i.e., Ŝ f, cn be derived. Then, he generlized CUSUM es cn be used o obin soluion o 9). B. DoS Ack We ssume h in cse of DoS ck, communicion beween some unknown se of meers nd he conrol cener is los so h he conrol cener hs no knowledge bou he mesuremens ken he cked meers. Le S d 1,..., K} be he se of cked meers ime. A n unknown ime τ, he ck srs nd meer mesuremens in cse of DoS ck ke he following form: n k,, if k S d, y k, = h T k x + w k,, if k / S d τ, 11), where n k, N 0, σ n) is he i.i.d. noise observed in cse of DoS ck. The null hypohesis is s given in 5) nd he lernive Boh nd S f re ime-vrying, non-rndom unknown prmeers. Their vlues ech ime depend only on he cker s sregy. hypohesis cn be wrien s N h T k x, ), k 1,,..., K}, < τ H1 d : y k, N h T k x, ), k / S d N 0, σn), k S d., τ. 1) Agin, we use Lorden s definiion for he wors-cse deecion dely [33] JT d ) = sup τ ess sup [ E τ T d τ) + ] F τ, 13) F τ where T d is he sopping ime. The opimizion problem is hen sed s inf JT d ) subjec o E [T d ] α. 14) T d Le he pdfs of he mesuremens corresponding o he mesuremen models given in ) nd 11) be denoed wih p 0 y x ) nd p d y x ), respecively. As before, s soluion o 14), he generlized CUSUM lgorihm cn be used using he MLE of he se of cked meers nd esiming he se vribles using he Klmn filer. Remrk 1: In he lierure, DoS ck is modeled s he lck of vilbiliy of meer mesuremens nd in cse of DoS ck, eiher zero signl or rndom signl is observed [3], [4], [36]. The former is more pproprie if he cker hcks some subse of meers or some conrol ceners) nd prevens he d rnsmission from hese meers o he conrol ceners. On he oher hnd, he ler is more pproprie if he cker jms he nework communicion chnnels. We ddress boh kinds of DoS cks by modeling he signl received from he cked meers s zero-men Gussin noise wih generic vrince σn. For he DoS cks performed by prevening he d rnsmission from smr meers, σn cn be se o very smll vlue close o zero) so h he received signl is lmos he zero signl. On he oher hnd, for he DoS cks performed by jmming he nework communicion chnnels, he cker cn increse he noise vrince o very high level so h he cul messge is los very low signl o noise rio SNR)). In his cse, we consider h he cker jms he communicion chnnel by consnly emiing he Gussin noise since i) i is common model for jmming in he lierure [37], ii) for n ddiive noise chnnel wih Gussin inpu, mong ll disribuions wih given men nd vrince, he Gussin noise mximizes he men squred error MSE) of esiming he inpu given he chnnel oupu [38], [39]. Hence, in order o mximize dmges on he se esimion mechnism, he cker cn rnsmi ddiive whie Gussin noise for jmming. σn cn hen be se o he minimum possible noise vrince such h he cul signl cn be negleced compred o he noise signl SNR close o zero). III. CENTRALIZED ATTACK DETECTORS In he cenrlized seing, cenrl conroller hs ll he sysem-wide informion. In priculr, single node collecs nd processes ll he mesuremens in he sysem. This cn be chieved for power sysem consising of smll number

5 5 of meers nd loced in geogrphiclly smll region. In he following, we presen he generlized CUSUM es srucures, he Klmn filer equions, he MLEs of he unknown ck prmeers, nd he proposed cenrlized deecion lgorihms for FDI nd DoS cks, respecively. A. Cenrlized Deecor for FDI Acks Since he mesuremen models in he null cf. 5)) nd he lernive cf. 6)) hypoheses re differen, se esimes corresponding o differen hypoheses need o be clculed bsed on heir respecive mesuremen models. For his purpose, wo prllel se esimors need o be simulneously employed. The Klmn filer consiss of wo seps ech ierion: he predicion sep nd he mesuremen upde sep. A he predicion sep, he se esimes ime re bsed on ll mesuremens up o 1, nd he mesuremen upde sep, he se esimes ime re bsed on ll mesuremens up o. Le he se esimes ime for he null nd he lernive hypoheses be denoed wih ˆx 0 nd ˆx f, respecively = 1 for predicion nd = for mesuremen upde). The sopping ime bsed on he generlized CUSUM es is hen given in 15) shown he op of he nex pge) where gm f is he decision sisic ime m, nd β is he generlized log-likelihood rio GLLR) clculed ime. Noe h in 15), he se esimes of he predicion sep, i.e., ˆx 0 1 nd ˆxf 1 re used. One of our purposes here is o block he effec of he ck vecor ime on he se esimes ime. In his wy, we im o improve he deecion of he ime-vrying cks nd lso o obin closed-form expressions for he MLEs of he unknown ck vribles. Moreover, he predicion sep of he Klmn filer, in fc, provides se nd mesuremen forecss/predicions, nd he deviion of he cul mesuremens from he prediced ones is n indicion of n unusul even, e.g., ful or n ck. Hence, i is lso exploied o improve he ck deecion performnce. The Klmn filer equions ime re given s follows: Predicion: ˆx 0 1 = Aˆx0 1 1, ˆx f 1 = Aˆxf 1 1, P 1 = AP 1 1 A T + σ v I N, 16) Mesuremen upde: G = P 1 H T HP 1 H T + σ w I K ) 1, ˆx 0 = ˆx0 1 + G y Hˆx 0 1 ), ˆx f = ˆxf 1 + G y Hˆx f 1 â ), P = P 1 G HP 1, 17) where P 1 nd P denoe he esimes of he se covrince mrix bsed on he mesuremens up o 1 nd, respecively. Moreover, G is he Klmn gin mrix nd â is he MLE of cf. 19)). Noe h â is used in he mesuremen upde sep of he Klmn filer for he lernive hypohesis. The following proposiion presens he MLEs of he unknown ck prmeers nd he GLLR ime. Proposiion 1: Le e = [e 1,,..., e K, ] T y Hˆx f 1. Then, e k, = y k, h T f 1. The mos likely se of cked meers ime is given by Ŝ f = k : e k, > γ, k = 1,..., K}, 18) he MLE of he ck vecor, i.e., â = [â 1,,..., â K, ] T, is given by e k,, if e k, γ γ γ, if â k, = < e k, < γ γ, if γ < e k, < γ 0, else, nd he GLLR ime is given by β = 1 K y k, h T 0 1 ) k=1 19) y k, h T f 1 â k,) ). 0) Proof: See Appendix A. Bsed on 15), recursion of he decision sisic g f, N cn be wrien s g f = g f 1 + β ) +, 1) where g f 0 = 0 nd β is s given in 0). Noe h if g f = 0 for ny ime, hen he chnge-poin esime in he generlized) CUSUM lgorihm is upded o ime [35, Sec..]. Since he lernive hypohesis H f 1 ssumes he norml no-ck) mesuremen model up o he chngepoin cf. 6)), he Klmn filer for he lernive hypohesis needs lso o be employed bsed on he norml mesuremen model up o he chnge-poin. Hence, whenever he chngepoin esime is upded, he Klmn filer esimes for he lernive hypohesis re upded by seing ˆx f ˆx0. We summrize he proposed cenrlized ck deecor in Algorihm 1 nd presen grphicl represenion of he lgorihm in Fig.. A ech ime, we firs employ he Klmn filers o esime he ses hrough he predicion sep. We hen clcule he MLE of he ck vecor nd specify he mos likely se of cked meers. Using he MLEs, we hen implemen he mesuremen upde sep of he Klmn filer. Then, we clcule he decision sisic. If he decision sisic crosses he predefined hreshold, we declre n ck, oherwise we coninue o collec mesuremens in he nex ime cycle. Noe h we del wih he flse lrms due o ouliers e.g., high noise) hrough selecing γ nd h f sufficienly lrge. Since we gher ck sisics boh in spce nd ime, sufficienly high hresholds ensure smll flse lrm res, equivlenly high flse lrm periods. On he oher hnd, higher hresholds will cuse lrger deecion delys. Hence, here is rdeoff in selecing γ nd h f. B. Cenrlized Deecor for DoS Acks Le he se esimes under he null cf. 5)) nd he lernive cf. 1)) hypoheses be denoed wih ˆx 0 nd ˆx d,

6 6 T f = inf m N : mx m sup log sup k, γ, k S p f y f ˆx f 1, } ) p 0 y ˆx 0 1 ) h f }} } β } gm f 1 j m =j S f 15) Algorihm 1 The cenrlized ck deecor 1: Iniilizion: 0, g f 0 0 : while < T f do 3: + 1 4: Implemen he predicion sep of he Klmn filer using 16). 5: Compue â, β, nd g f using 19), 0), nd 1), respecively. 6: Implemen he mesuremen upde sep of he Klmn filer using 17). 7: if g f = 0 hen 8: ˆx f ˆx0 9: else if g f h f hen 10: T f 11: end if 1: end while 13: Declre he ck nd sop he procedure. respecively. The generlized CUSUM es is given by m T d = inf m N : mx sup log pd y ˆx d 1 ) p 0 y ˆx 0 1 ) h }, d 1 j m =j S d } } } ρ } gm d ) where g d m is he decision sisic ime m, ρ is he GLLR clculed ime, nd h d is he es hreshold. The noise levels in he mesuremen models given in ) nd 11) re differen. Hence, in ddiion o he se esimes, esimes of he se covrince mrices re lso differen for differen hypoheses. Le P 0 nd P d be such esimes for he null nd lernive hypoheses, respecively. The Klmn filer equions ime re hen given s follows: Predicion: ˆx 0 1 = Aˆx0 1 1, ˆx d 1 = Aˆxd 1 1, P 0 1 = AP0 1 1 AT + σ v I N, P d 1 = APd 1 1 AT + σ v I N, 3) Mesuremen upde: G 0 = P 0 1 HT HP 0 1 HT + σ w I K ) 1, G d = P d 1 HT HP d 1 HT + Λ ) 1, Obin he mesuremen vecor y Predecion sep of he Klmn filer Compue he MLEs of he ck prmeers Compue he GLLR β Mesuremen upde sep of he Klmn filer Upde he decision sisic: g f g f 1 + β)+ ˆx f ˆx0 g f = 0 0 < g f < h f + 1 g f h f Declre n ck Fig. : A grphicl descripion of Algorihm 1. ˆx 0 = ˆx0 1 + G0 y Hˆx 0 1 ), ˆx d = ˆxd 1 + Gd y u ), P 0 = P0 1 G0 HP 0 1, P d = Pd 1 Gd HP d 1, 4) where Λ = digλ 1,,..., λ K, ) is digonl mrix wih he following digonl erms: σ λ k, = n, if k Ŝd, 5) if k / Ŝd. Furhermore, u = [u 1,,..., u K, ] T cn be deermined s 0, if k Ŝ d u k, = h T d 1, if k / 6) Ŝd. Noe h he mesuremen upde sep of he Klmn filer for he lernive hypohesis is performed bsed on he MLE of he se of cked meers. The following proposiion presens he MLE of S d nd he GLLR ime. Proposiion : The mos likely se of cked meers cn be deermined s Ŝ d 1 = k : σn yk, 1 y k, h T d 1 ) ) } σ < log w, k = 1,..., K, 7) σ n

7 7 nd he GLLR cn be compued s follows: ρ = 1 K logσ w) + 1 K y k, h T 0 1 ) k=1 logσn) + 1 σn yk, k / Ŝd k Ŝd log) + 1 y k, h T d 1 ). ) 8) Proof: See Appendix B. Bsed on ), recursion of he decision sisic g d, N cn be wrien s g d = g d 1 + ρ ) +, 9) where g0 d = 0 nd ρ is s given in 8). As before, if g d = 0 for ny N, hen he chnge-poin esime is upded nd consequenly he Klmn filer esimes for he lernive hypohesis re upded s ˆx d ˆx 0 nd P d P0, respecively. We summrize he cenrlized DoS ck deecor in Algorihm 1 fer few chnges. Priculrly, we replce T f wih T d, g f wih g d, nd h f wih h d. Moreover, we replce lines 4-6, nd 8 of Algorihm 1 wih he following lines. 4: Implemen he predicion sep of he Klmn filer using 3). 5: Compue Ŝd, Λ, u, ρ, nd g d bsed on 7), 5), 6), 8), nd 9), respecively. 6: Implemen he mesuremen upde sep of he Klmn filer using 4). 8: ˆx d ˆx 0, P d P 0 IV. DISTRIBUTED ATTACK DETECTORS In prcice, he inerconneced power grid is composed of severl geogrphiclly sepred subregions nd ech subregion conins differen se of meers. Thus, ghering nd processing mesuremens obined by ll meers single plce is infesible, especilly in lrge grids. Hence, disribued implemenion is needed. In he disribued seing, we consider hierrchicl srucure where here re severl locl conrol) ceners nd globl conrol) cener cf. Fig. 4). In priculr, ech subregion is supervised by locl cener h collecs he mesuremens in is subregion, performs some compuionl sks, nd communices wih he neighboring locl ceners nd wih he globl cener hrough idel errorfree) communicion chnnels. We ssume h i) here is n mple bndwidh beween ny wo neighboring locl ceners, ii) locl cener hs knowledge of only is mesuremens nd he configurion of he whole power grid. The globl cener is responsible for deecing n ck nd i needs o compue decision sisics bsed on ll mesuremens, s discussed in Secion III. We ssume h here re prllel communicion chnnels beween locl ceners nd he globl cener nd he resources, e.g., bndwidh, for communicion re scrce. Hence, we propose h ech locl cener clcules locl sisic bsed on he mesuremens colleced in is subregion, hen rnsmis qunized version of i o he globl cener. The globl cener hen deecs nd declres n ck if ny) bsed on he received messges from he locl ceners. Furhermore, he globl cener sends feedbck signls o he locl ceners when necessry. Noe h for rnsmission of locl sisics from he locl ceners o he globl cener nd for he feedbck signls received from he globl cener, we ssume insnneous communicion. In he following, we firsly describe he sysem model in he disribued seing, hen explin he disribued se esimion procedure, nd finlly presen he disribued deecion lgorihms for FDI cks nd DoS cks, respecively. A. Sysem Model in he Disribued Seup Suppose h here exis L subregions in he power grid nd le R l denoe he se of meers inside he lh subregion, l = 1,,..., L. We ssume h meer repors is mesuremens o only one locl cener. Hence, if he number of meers in he lh subregion is denoed wih K l R l, hen L l=1 Kl = K. The mesuremen vecor y is hen decoupled ino L subvecors where y, l consising of he se of mesuremens y k, k R l }, denoes he mesuremens colleced in he lh subregion ime. We nex need o deermine he se vecor of locl cener. Bsed on he mesuremen model given in ), y k,, k 1,..., K} cn be wrien s y k, = h T k x + w k,, where h T k = [h k,1,..., h k,n ] is he kh row of he mesuremen mrix H, s defined before. Then, y k, depends on, equivlenly bers informion bou, he se vribles corresponding o he nonzero enries of h k. Le he se of such se vribles be denoed wih X yk x n n 1,,..., N}, h k,n 0}. The se vecor of he lh locl cener, which is denoed wih x l ime, includes he se vribles in X yk for ll k R l. In fc, x l my include furher se vribles due o dependencies beween se vribles over ime. In priculr, due o he se rnsiion mrix A, evoluion of se vrible over ime depends on se of se vribles. Le T n = [ n,1,..., n,n ] be he nh row A, i.e., A T = [ 1,..., N ]. Bsed on he se upde equion given in 1), x n,, n 1,..., N} cn be wrien s follows: x n, = T n x 1 + v n,. Thus, x n, depends direcly over one-ime period) on he se vribles in he se x i i 1,,..., N}, n,i 0}. Since he se vribles belonging o his se my depend on severl oher se vribles hrough 1), x n, my indirecly over muliple ime periods) depend on lrger se of se vribles. Including ll direc nd indirec dependencies, we finlly obin se of se vribles X n h do no depend on ny se vrible ouside he se X n. Hence, he evoluion of x n in ime depends only on X n. The se vecor of he lh locl cener hen consiss of he se vribles in he se: X y l } } xn } X n. k R l x n X yk

8 8 Le N l X y l, hen x l R N l. Noe h L l=1 N l N. As simple nd illusrive exmple, consider sysem wih he se vecor x = [x 1,, x,, x 3,, x 4, ] T. Suppose h he sysem mrix nd he mesuremen mrix re given s A = [ ] nd H = [ respecively. Moreover, le he sysem be composed of wo subregions nd he mesuremens obined he firs nd he second locl ceners ime be y 1 = [y 1,, y, ] T nd y = [y 3,, y 4,, y 5, ] T, respecively. Then, X y1 = x 1 }, X y = x 1, x }, X y3 = x, x 3, x 4 }, X y4 = x 3, x 4 }, nd X y5 = x 4 }. Furhermore, X 1 = x 1, x, x 3 }, X = x }, X 3 = x, x 3 }, nd X 4 = x 4 }. Therefore, X y 1 = x 1, x, x 3 } nd X y = x, x 3, x 4 }. Then, he locl se vecors re obined s x 1 = [x 1,, x,, x 3, ] T nd x = [x,, x 3,, x 4, ] T. For he lh locl cener, he se upde equion nd he norml mesuremen model re hen given by x l = A l x l 1 + v l, 30) y l = H l x l + w l, 31) where A l R N l N l is he locl sysem mrix, v, l subvecor of v, is he locl process noise vecor corresponding o x l, H l R Kl N l is he locl mesuremen mrix, nd w l N 0, I K l) is he locl mesuremen noise vecor. Noe h A l nd H l cn be simply obined from A nd H, respecively. Recll h for ny wo subregions l nd j, y l nd y j do no overlp bu x l nd x j my overlp. B. Disribued Se Esimion Assuming Null Hypohesis The informion filer, or he inverse covrince filer, is n lgebric equivlence o he Klmn filer nd is upde rules re simpler nd more convenien for disribued seup [6], [40]. Hence, we use informion filers for se esimion in he disribued seing. In priculr, we employ wo informion filers one for he null hypohesis nd one for he lernive hypohesis) ech locl cener. Wih he exchnge of necessry informion beween locl ceners, se esimion is performed in fully disribued mnner. In his secion, we explin he proposed disribued se esimion procedure for one of he locl ceners, sy he lh one, in cse of no ck null hypohesis). Noe h he procedure is he sme for ll locl ceners. Among ll mesuremens ken sysem-wide, he se esimor of he lh locl cener needs o exploi he mesuremens h ber informion bou les one of he se vribles in x l. Clerly, y l re mong such mesuremens. Noe h due o he ie-lines beween neighboring subregions, some se vribles cn be shred beween neighboring locl ceners. Moreover, due o he dependencies beween se vribles over ime, some neighboring or non-neighboring) locl ceners my hve common se vribles wih he lh locl cener. Hence, i is possible h some mesuremens colleced he oher locl ceners ber informion bou nonempy subse of x l. Anoher chllenge is h such mesuremens my be prilly reled o x l. Le he se of locl ceners h shre les one se ], vrible wih he lh locl cener be denoed wih C l, i.e., C l = i i 1,,..., L}, X y i X y l }, where is n empy se. Suppose h j C l. Then, le X y l,j be he se of shred se vribles beween he lh nd he jh locl ceners, i.e., X y l,j X y l X y j, nd le he se of se vribles included in he jh locl cener bu no included in he lh locl cener be X y l,j X y j \X y l. Furhermore, le he subse of mesuremens of he jh locl cener ime h ber informion bou X y l,j be denoed wih y l,j, which is given, wih n buse of noion, by y l,j y k, k R j, X yk X y l }. If X y l,j is nonempy se, hen y l,j my lso depend on some se vribles h re no included in X y l. Since our im is o use y l,j in he esimion of x l, he non-included se vribles cnno be considered s unknown from he perspecive of he se esimor of he lh locl cener. Hence, he corresponding mesuremens should be djused by subrcing he pr bou he non-included ses. To h end, he non-included ses cn be replced wih heir esimes. Noe h he non-included ses need o be replced wih differen se esimes under differen hypoheses. Le h j kt k R j } denoe he rows of he locl mesuremen mrix H j nd suppose here exiss mesuremen y k, y l,j. Then, bsed on 31), y k, cn be wrien s follows: y k, = h j T k x j + w k,. 3) be he se vecor consising of he se vribles in X y l,j. We hen decompose he erm h j T k x j in 3) ino wo prs s follows: Le x l,j h j T k x j = h l,j k T T x l + h l,j k x l,j, 33) where he vecors h l,j k nd h l,j k re deermined o sisfy he equliy in 33) for ll. The processed mesuremen, by he jh locl cener for he esimion purposes of he lh locl cener under he null hypohesis, is denoed wih ỹ 0,l,j k, nd given s follows: ỹ 0,l,j k, T = y k, h l,j 0, l,j 1 h l,j T k x l + w k,, 34) where ˆx 0, l,j 1 is he esime of x l,j, clculed under he null hypohesis nd he predicion sep of he informion filer of he jh locl cener ime. Le ỹ 0,l,j, consising of he se of processed mesuremens ỹ 0,l,j k, k R j, y k, y l,j }, denoe he processed mesuremen vecor under he null hypohesis, which kes he following form: ỹ 0,l,j H l,j x l + w l,j, 35) where H l,j nd w l,j re he corresponding mesuremen mrix nd mesuremen noise vecor, respecively. Noe h h l,j k T k R j, y k, y l,j } correspond o he rows of H l,j.

9 9 Considering he sme exmple given in he previous secion, we hve y 1, = [ x, x 3, + x 4,, x 3, x 4, ] T + w 1,, where w 1, = [w 3,, w 4, ] T. Then, ỹ 0,1, = y 1, [ ˆx 0,j 4, 1, ˆx0,j 4, 1 ]T [ x, x 3,, x 3, ] T + w 1, [ ] = x 1, x 0 0 1, + w 1, = H 1, x 1 + w 1,, x 3, where ˆx 0,j 4, 1 is esime of x 4,, clculed he jh locl cener under he null hypohesis. Nex, we presen he informion filer equions nd explin he disribued se esimion procedure under he null hypohesis H 0 ) for he lh locl cener. Le he se esime of he lh locl cener under he null hypohesis ime be denoed wih ˆx 0,l. Moreover, le Z l be he informion mrix of he lh locl cener nd z 0,l = Z l ˆx 0,l be he informion vecor of he lh locl cener under he null hypohesis. The informion filer equions ime he lh locl cener under he null hypohesis re hen given s follows: Predicion: Z l 1 = I N l Fl 1)E l 1, z 0,l 1 = I N l Fl 1)A l T z 0,l 1 1, 36) Mesuremen upde: Z l = Zl H lt H l + σ w z 0,l = z0,l H lt y l + E l = A l T Z l Al 1, H l,j T H l,j }} j C l Υ l,j H l,j T ỹ0,l,j }} j C l υ 0,l,j ), ), F l = E l E l + 1/σ v)i N l) 1, 37) where E l, F l R N l N l re uxiliry mrices ime, Υ l,j H l,j T H l,j, nd υ 0,l,j H l,j T ỹ 0,l,j. Noe h he srucure of he informion filer requires he mrices A l } L l=1 o be inverible. Since he lh locl cener knows he grid opology nd hence he mrices H l,j } j ), i cn esily compue he mrices Υ l,j j C l } defined bove. However, υ 0,l,j is clculed bsed on he mesuremens colleced he jh locl cener. Thus, ech locl cener j C l needs o compue nd repor υ 0,l,j o he lh locl cener. Becuse only neighboring locl ceners re llowed o communice wih ech oher, muliple hops migh be needed o send he required informion eniies. Afer receiving υ 0,l,j j C l }, he lh locl cener performs is mesuremen upde sep. Remrk : The proposed disribued se esimion procedure requires h ll necessry communicions beween locl ceners re done before he nex mesuremen inervl. This cn be chieved in prcice since mesuremens in rel power grid re currenly ken wih 15-minues ime inervls [41]. Hence, he possible communicion delys due o muliple hops re no expeced o ffec he proposed procedure. C. Disribued Deecor for FDI Acks The ck vecor is decomposed ino L sub-vecors where l consiss of k, k R l }. The mesuremen vecor of he lh locl cener in cse of FDI ck is hen given by y l = H l x l + l + w l. Furhermore, le he processed mesuremens he jh locl cener, j C l, under he lernive hypohesis H f 1 ) be denoed wih ỹ f,l,j nd given by ỹ f,l,j = H l,j x l + l,j + w l,j, 38) where ỹ f,l,j consiss of ỹ f,l,j k, k R j, y k, y l,j }, h re obined similr o 34) s follows: where ˆx f, l,j 1 ỹ f,l,j k, T = y k, h l,j f, l,j 1 h l,j T k x l + k, + w k,, 39) is he esime of x l,j, clculed he jh locl is he cener under he lernive hypohesis. Moreover, l,j ck vecor corresponding o y l,j Le he se esime of he lh locl cener under he lernive hypohesis ime be denoed wih ˆx f,j nd le z f,l = Z l ˆx f,l be he corresponding informion vecor ime. Togeher wih 36) nd 37), he following equions form he informion filer equions of lh locl cener ime : Predicion:. z f,l 1 = I N l Fl 1)A l T z f,l 1 1, 40) Mesuremen upde: z f,l = zf,l H lt y l â l ) + H l,j T ỹ f,l,j j C l where â l nd â l,j nd υ f,l,j â l,j ) }} υ f,l,j re he MLEs of l nd l,j ), 41), respecively, H l,j T ỹ f,l,j â l,j ). A he lh locl cener, fer he predicion sep ime, he se esimes re clculed s ˆx 0,l 1 = Zl 1 1 z0,l 1 nd ˆx f,l 1 = Zl 1 1 zf,l 1. Then, âl is clculed bsed on 19) where e k, = y k, h l T f,l 1. Then, he lh locl cener clcules nd rnsmis he informion eniies υ 0,j,l } j nd υ f,j,l } j o he corresponding locl ceners hrough is neighboring locl ceners. Moreover, i performs is mesuremen upde sep fer receiving υ 0,l,j j C l } nd υ f,l,j j C l }. Smpling nd Trnsmission of Locl Sisics Bsed on 0), he locl sisic he lh locl cener is clculed s follows: β l 1 yk, h l T 0,l ) 1 k R l y k, h l T f,l 1 âl k, ) ). 4)

10 10 The locl cener hen sends summry of β l } o he globl cener. Recll h he communicion chnnels beween he locl ceners nd he globl cener re bndlimied nd herefore only qunized versions of he locl sisics cn be rnsmied o he globl cener. We propose wo smpling schemes for he locl ceners: US nd LCSH [4]. If he convenionl smpling is used, he rnge of he possible vlues of he locl sisic nd he qunizion levels re deermined. Then, he locl sisic is smpled ech predeermined smpling ime, qunized ccording o he qunizion levels, nd he corresponding finie bi sequence is rnsmied o he globl cener. In he LCSH scheme, he mpliude xis is uniformly priioned wih spcing level nd he corresponding mpliude levels re deermined priori. A locl cener rnsmis messge o he globl cener only when he locl sisic crosses new mpliude level. If lower/upper level is crossed, sign bi 0/1 is rnsmied. If more hn one level re crossed simulneously, hen 1/0 is rnsmied for ech ddiionl double/single crossings. For insnce, le he mos recenly crossed level is nd he new vlue of he locl sisic is 5.7 locl cener. Then, he bi sequence 110 is rnsmied o he fusion cener, where he firs bi denoes he sign of he firs crossing nd he subsequen bis represen ddiionl 3 crossings. Le he mximum nd minimum possible vlues of he locl sisic be βmx l nd βmin l, respecively. If he convenionl smpling is used, he inervl beween βmin l nd βl mx is divided ino ν qunizion inervls nd ν bis re rnsmied for β l indicing is qunizion inervl. The lengh of qunizion inervl is η l βmx l βmin l )/ν. The rnsmied bi sequence for β l is he binry represenion of β ζ l l βmin l 43) in ν bis. The globl cener, upon receiving he bi sequence from he lh locl cener, convers he bi sequence ino is deciml form nd obin ζ l. Then, i deermines he qunizion level βq, l for he lh locl cener s follows: βq, l 0, if βmin l + ζl η l 0 < βmin l + ζl + 1)η l βmin l + ζl + 0.5)η l, else. 44) Noe h he locl sisics belonging o he qunizion inervl conining zero re mpped o zero s he qunizion level. This is due o he fc h he locl sisics before he ck re expeced o ke vlues round zero cf. 4)). Afer receiving bi sequences from ll locl ceners, he globl cener updes he decision sisic ime bsed on 1) s follows: L + g f = g f 1 + βq,) l. 45) η l l=1 If he LCSH is used s he smpling scheme, he inervl beween βmin l nd βl mx is uniformly priioned ino subinervls wih spcing. Le he mos recenly crossed mpliude level by he locl sisic in erms of be ψ l nd le he mos recen smpling ime be ϱ l i. The nex smpling insn Fig. 3: LCSH scheme he lh locl cener. The pirs of smpling imes nd he corresponding crossed levels re indiced wih red poins. is deermined s ϱ l i+1 = min N > ϱ l i, β l ψ l }. A = ϱ l i+1, he corresponding sign bi is given by π l sgn β l ψ l ), 46) where sgn ) is he sign funcion, he number of level crossings is given by β φ l l ψ l 1, 47) nd he number of rnsmied bis equl o he following: φ ϖ l l ) Furhermore, he mos recenly crossed mpliude level is upded s ψ l ψ l +πφ l l boh he lh locl cener nd he globl cener. LCSH scheme he lh locl cener is illusred in Fig. 3. The globl cener, upon receiving he bi sequences from he locl ceners, updes he globl decision sisic ime bsed on 1) s follows: L ) + g f = g f 1 + ψ l. 49) l=1 In boh smpling schemes, if g f = 0 ny ime, he chnge-poin esime is upded nd hence he Klmn filer for he lernive hypohesis need o be upded. In order o noify he locl se esimors, he globl cener sends feedbck signl o he ll locl ceners such h upon receiving his signl, ech locl cener updes is informion vecor for he lernive hypohesis s being equl o he informion vecor for he null hypohesis. The proposed lgorihms for locl cener nd for he globl cener re summrized in Algorihm nd Algorihm 3, respecively. D. Disribued Deecor for DoS Acks For he lh locl cener, mesuremen model in cse of DoS ck is given by nk,, if k S d,l y k, = T x l + w k,, if k / S d,l 50), h l k

11 11 Algorihm The disribued ck deecor: procedure he lh locl cener 1: Iniilizion: 0, ψ l 0 : while < T f do 3: + 1 4: Implemen he predicion sep of he locl informion filer using 36) nd 40). 5: Compue â l bsed on 19) nd β l s in 4). 6: if he US scheme is used, hen 7: Compue ζ l s in 43) nd rnsmi is binry equivlen in ν bis o he globl cener. 8: else if he LCSH scheme is used, hen 9: if β l ψ l hen 10: Compue π l nd φ l s in 46) nd 47), respecively. 11: Trnsmi π l nd φ l o he globl cener using ϖ l bis. 1: ψ l ψ l + π l φ l. 13: end if 14: end if 15: Clcule nd send υ 0,j,l, υ f,j,l } j o he corresponding locl ceners. 16: Receive υ 0,l,j, υ f,l,j j C l }. 17: Implemen he mesuremen upde sep of he locl informion filer using 37) nd 41). 18: if feedbck signl is received from he globl cener, hen 19: z f,l z0,l 0: end if 1: end while where k R l nd S d,l inside he lh subregion. denoes he se of cked meers Le he vecor of processed mesuremens he jh locl cener, j C l, for he se esimor of he lh locl cener under he lernive hypohesis H1) d be denoed wih ỹ d,l,j, which consiss of ỹ d,l,j k, k R j, y k, y l,j } where nk, ỹ d,l,j, if k k, = Ŝd,j T y k, h l,j d, l,j 1, 51) if k / Ŝd,j, where Ŝd,j ˆx d, l,j is he MLE of S d,j nd given in 55). Moreover, 1 is he esime of x l,j, clculed he jh locl cener under he lernive hypohesis. Le he informion vecor under he lernive hypohesis ime for he lh locl cener be denoed wih z d,l. Moreover, le he corresponding informion mrix be denoed wih Z d,l. Togeher wih 36) nd 37), he following equions form he locl informion filer equions: Predicion: Z d,l 1 = I N l Fd,l 1 )Ed,l 1, z d,l 1 = I N l Fd,l 1 )Al T z d,l 1 1, 5) Algorihm 3 The disribued ck deecor: procedure he globl cener 1: Iniilizion: 0, g f 0 0, ψl 0 : while < T f do 3: + 1 4: if he US scheme is used, hen 5: Compue ζ l, l = 1,..., L} bsed on he received bi sequences nd β l q,, l = 1,..., L} using 44). 6: g f g f 1 + L l=1 βl q, ) + 7: else if he LCSH scheme is used, hen 8: if new bi sequence is received during 1, ] from he lh locl cener, l = 1,..., L hen 9: ψ l ψ l + πφ l l, l = 1,..., L. 10: g f g f 1 + ) + L l=1 ψl 11: end if 1: end if 13: if g f = 0 hen 14: Send feedbck signl o ll he locl ceners. 15: else if g f h f hen 16: T f 17: Declre he ck nd send sop signl indicing he 18: end if 19: end while sopping ime T f o ll he locl ceners. Mesuremen upde: Z d,l = Zd,l 1 + HlT Λ l 1 H l + H l,j T Λ l,j 1 H l,j, j C l z d,l = zd,l 1 + HlT Λ l 1 y l + b l ) + H l,j T Λ l,j 1 ỹ d,l,j + b j ), }} j C l F d,l E d,l = E d,l υ d,l,j = A l T Z d,l Al 1, E d,l + 1/σ v)i N l) 1, 53) where υ d,l,j H l,j T Λ l,j 1 ỹ d,l,j + b j ). Noe h Λ l R Kl K l is digonl mrix wih he digonl elemens λ k,, k R l } obined s in 5) fer replcing Ŝd wih Ŝ d,l. Furhermore, b l is vecor consising of b k,, k R l } nd compued s follows: b k, = h l T d,l 1, if k Ŝd,l 0, if k / Ŝd,l. 54) A he lh locl cener, fer he predicion sep, se esimes re compued s ˆx 0,l 1 = Zl 1 1 z0,l 1 nd ˆxd,l 1 = Z d,l 1 1 zd,l 1, nd he MLE of he cked subse of meers for he lh locl cener is deermined bsed on 7) s follows:

12 1 Ŝ d,l = k : 1 σ n yk, 1 yk, h l T d,l ) 1 } σ < log w ), k R l, 55) Every locl cener j C l needs o compue nd send he informion eniies υ d,l,j o he lh locl cener. Moreover, he informion filer he lh locl cener needs o clcule H l,j T Λ l,j 1 H l,j, j C l } in he mesuremen upde sep. The locl cener lredy knows H l,j, j C l } bu he informion regrding Λ l,j mus be sen from he jh locl cener. Noe h Λ l,j is digonl mrix wih digonl elemens λ k, k R j, y k, y l,j }. Hence, H l,j T Λ l,j 1 H l,j = h l,j T ) k hl,j k /λk,, σ n k: k R j, y k, y l,j where λ k, is equl o σn if k Ŝd,j nd, oherwise. Since he number of possible vlues of λ k, is only wo, his informion cn be sen wih one bi for ech λ k,. Hence, he jh locl cener firs compues Ŝd,j, hen for he mesuremens corresponding o h l,j k vecors, rnsmis 1 if k Ŝd,j nd 0, oherwise. Upon receiving he corresponding bi sequence, he lh locl cener forms Λ l,j mrix. Noe h Λ l } L l=1 nd Λ l,j } l,j re inverible since hey re digonl mrices wih nonzero digonl elemens. Bsed on 8), he locl sisic he lh locl cener ime is deermined s follows: ρ l = 1 K l log) + 1 k R l \Ŝd,l k Ŝd,l logσ w) + 1 σ w k R l logσn) + 1 σn yk, yk, h l T 0,l ) 1 ) yk, h l T d,l ) 1. 56) Then, ech locl cener performs eiher convenionl smpling or level-crossing smpling on ρ l, s described in Secion IV-C for β l ). The globl cener, upon receiving bi sequences from he locl ceners, updes he decision sisic. If he decision sisic crosses he es hreshold, i declres n ck. If he decision sisic ges he vlue of zero fer n upde, i immediely sends feedbck signls o ll he locl ceners. A locl cener, upon receiving his signl, eques is locl informion mrix nd vecor for he lernive hypohesis o he locl informion mrix nd vecor for he null hypohesis, respecively. The proposed procedure for locl cener is summrized in Algorihm fer few chnges. In priculr, T f is chnged wih T d, β l is chnged wih ρ l, nd lines 4-5, 15-17, nd 19 re chnged wih he following lines. Furhermore, he procedure in he globl cener is summrized in Algorihm 3 fer replcing T f wih T d, g f wih g d, nd h f wih h d. V. NUMERICAL RESULTS In his secion, performnce of he proposed cenrlized nd disribued cyber-ck deecors re evlued in simple cse sudies. Throughou he secion, simulions re performed on 4: Implemen he predicion sep of he locl informion filer using 36) nd 5). 5: Compue Ŝd,l, Λ l, b l, nd ρ l bsed on 55), 5), 54), nd 56), respecively. 15: Clcule nd send υ 0,j,l } j, υ d,j,l } j, nd he bi sequence corresponding o λ k, k R l, y k, y j,l, h j,l k 0} j o he corresponding locl ceners. 16: Receive υ 0,l,j, υ d,l,j, nd he bi sequence corresponding o λ k, k R j, y k, y l,j, h l,j k 0} from every j Cl. 17: Implemen he mesuremen upde sep of he locl informion filer using 37) nd 53). 19: z d,l z0,l, Ed,l E 0,l, F d,l F 0,l Fig. 4: IEEE-14 Bus Power Sysem. Four subregions nd he globl conrol cener re shown. Communicion chnnels re illusred wih dshed lines. The circles on he brnches represen he power-flow mesuremens, nd he squres represen he power injecion mesuremens. Bus 6 is chosen s he reference bus. n IEEE-14 bus power sysem consising of four subregions see Fig. 4) nd he mesuremen mrix H is deermined ccordingly. The sysem mrix A is chosen o be n ideniy mrix. In his sysem, K = 3 nd N = 13. The iniil se vribles re obined wih he DC opiml power flow lgorihm for cse-14 in MATPOWER [43]. Noise vrinces re seleced s σ v = 10 4, σ w = 10 4, nd σ n = Moreover, γ is seleced o be The cyber-cks re lunched = 100. We consider wo ypes of flse d: rndomly creed nd crefully designed. If he cker hs incomplee knowledge bou he nework opology, i my rndomly cree he ck d. On he oher hnd, if i perfecly knows he opology, hen i cn perform srucured cks wih flse d lying on he column spce of he mesuremen mrix, lso known s selh FDI ck. Furher, in cse of DoS ck, he cker cn rndomly choose he cked meers. Nex, we presen performnce of he proposed deecors in cse of rndom FDI ck, srucured FDI ck, nd rndom DoS ck,