Distributed detection and isolation of bias injection attack in smart energy grid via interval observer

Applied Energy 256 (2019) 113703

Contents lists available at ScienceDirect

Applied Energy journal homepage: www.elsevier.com/locate/apenergy

Distributed detection and isolation of bias injection attack in smart energy grid via interval observer

T

Xiaoyuan Luoa, Xinyu Wanga, , Mingyue Zhangb, Xinping Guanc ⁎

a

School of Electrical Engineering, Yanshan University, Qinhuangdao 066004, China School of Electrical Engineering, Shandong Huayu University of Technology, Dezhou 254034, China c School of Electronic and Electric Engineering, Shanghai Jiaotong University, Shanghai 200240, China b

HIGHLIGHTS

emergency of malicious attack brings risk to the security of smart energy grid. • The detection and isolation scheme for protecting energy management system is introduced. • AThenovel protection scheme is based on the characteristics of interval residual. • The proposed detection standard can address the limitation of the precomputed threshold. • The proposed • effectiveness of the proposed protection scheme is experimentally validated. ARTICLE INFO

ABSTRACT

Keywords: Smart energy grid Bias injection attack Energy management Distributed detection and isolation

With the integration in information and communication technologies, and advanced metering infrastructure, smart energy grid, as one of typical sustainable energy systems, addresses the energy and environment problems. However, the emergency of bias injection attack aiming at destroying the energy management center, brings great security threat to the security of smart energy grid. To address risks in energy-cyber-physical systems, this paper proposes a distributed detection and isolation scheme against the bias injection attack in smart energy grid. Considering the transmitted information of energy management centers in adjacent grid subareas, the proposed distributed detection and isolation scheme includes local and global steps. In the local-step, each local energy management center detects and isolates the possible sensor attack set, based on the constructed local attack signature judgment logic matrix. In the global-step, the subarea attack set is detected and isolated via the established global attack signature judgment logic matrix. Combining the above local and global detection and isolation framework, we can ensure the security of energy management center in smart energy system. This proposed distributed detection and isolation scheme examines some important practical aspects of deploying bias injection attack detection including: the limitation of the precomputed threshold; the detection delay; the accuracy in detecting bias injection attack. Finally, the effectiveness of the developed distributed detection and isolation scheme is demonstrated by using detailed studies on the IEEE 8-bus and IEEE 118-bus smart energy grid system.

1. Introduction 1.1. Background and motivation With the recent integration in advanced metering infrastructure, control and communication technologies, smart energy grid is regarded as the most viable energy management system for replacing the traditional power system [1]. As one of typical energy-cyber-physical

⁎

systems e-CPSs, smart energy grid has improved the efficiency of energy and power systems, and achieves an automatic balancing between the demand side and energy supply [2]. However, the emerging cyberphysical attacks brought new cyber security threats for e-CPSs, especially the smart energy grid [3]. Particularly, these potential cyberphysical threats have led to large-area power grid paralysis. For instance, the explosion at a distribution station of Moscow in 2005 caused 200 million people to lose power [4]. In an another incident, the

Corresponding author. E-mail addresses: [email protected] (X. Luo), [email protected] (X. Wang), [email protected] (X. Guan).

https://doi.org/10.1016/j.apenergy.2019.113703 Received 7 April 2019; Received in revised form 2 August 2019; Accepted 3 August 2019 0306-2619/ © 2019 Elsevier Ltd. All rights reserved.

Applied Energy 256 (2019) 113703

X. Luo, et al.

Blackouts of India in 2012 affects more than 600 million people [5]. The large power outage of Ukraine in 2015 had caused enormous losses, which was induced by malicious cyber-physical attacks [6]. In respond to the cyber-physical attacks in smart energy grid, the United States proposed lots of countermeasures. For instance, in [7], the Department of Energy in United States released the security report on the smart energy grid. An attack simulation on the smart energy grid is done by the North American Energy Reliability Corporation in [8]. In [9], it is shown that smart energy grid is vulnerable to the cyber-physical attacks, especially the false data injection attacks (FDIAs) . For causing cascading attacks in smart energy grid, the form of cyber-physical attack designed by attacker is to mask the physical damage by injecting a bank of false data into energy management center [10]. To address risks in energy management center caused by FDIAs, this paper pays special attention to develop a detection and isolation protection scheme.

attacker can falsify the measurement data collected by energy management center, by injecting a bank of false attack sequence. Recent research shows that the emergency of BIA have caused lots of enormous economic losses including power energy theft and energy information theft [17]. In respond to the FDIAs timely and reliably, various of effective defence and detection techniques have been proposed to protect smart energy grid. For instance, typical protection schemes against the cascade reservoir power energy system including establishing a cascade reservoir-based multi-stage optimization model [18], developing a riskbenefit collaborative evaluating indicator system [19], and constructing an early warning mechanism [20]. In [21], an advanced smart metersbased FDIAs defence strategies was proposed. In [22], Phasor Measurement Units (PMU)-based smart meters protection algorithm was further proposed to defend the FDIAs. However, it is shown that the advantages of above protection strategies would disappear if corresponding PMU receivers were deceived [23]. In [24], how the FDIAs can be injected fraudulently into energy management center of smart energy grid were further investigated. Inspired by these works, some effective detection methods against FDIA were proposed. For instance, in [25], a Kalman Filter (KF) -based Euclidean detector is proposed to detect the FDIAs. A distributed sequential detector-based adaptive sampling technique against the FDIAs was presented in [26]. In [27], a distributed detection method against the FDIAs for smart energy grid was developed. In [28], a Luenberger observer-based detection and isolation was studied. Decentralized unknown input observer-based detection method was proposed in [29]. In [30], observer-based detection methods were proposed. Furthermore, the adaptive threshold is computed to avoid missed detection in [31]. On the basis of attack detection, many prior publications had studied how to isolate the FDIAs in the e-CPSs. For instance, in [32], a prediction-based detection and location scheme against the FDIA was developed. In [33], a real-time detection and location method against the malicious attacks for largescale smart grid was studied. However, the above proposed outlier detection methods depend on the present measurements and are limited to the set of detection threshold. Furthermore, the above detection and isolation methods did not consider the information interaction between

1.2. Related works Recent years, both academic and industrial communities have been paid lots of attention to the security of smart energy grid. For instance, in [11], it is shown that FDIAs have been great threat to energy management systems, especially the smart energy grid. To protect the energy management system, various of protection schemes have been devoted, such as the distributed energy management strategy [12] and decentralized electricity market-based block chain technology [13]. Furthermore, all kinds of attacks are designed, based on the vulnerability of traditional bad data detection methods. Fig. 1 shows the attack pathways and positions for various of attacks, e.g. cyber attack, physical attack and cyber-physical attack. The goal of denial of service attack (DOS) is to disrupt the availability of communication channel resources in the cyber network of smart energy grid [14]. The load alter attack (LAA) aims at changing the running state of generator in the physical network of smart energy grid [15]. Above cyber attack and physical attack, e.g. DOS and LAA can be detected by the traditional bad data detection methods in energy management system. However, the BIA, as one of typical false data injection attacks (FDIAs) , bypass the traditional bad data detection methods [16].As shown in Fig. 1,

Fig. 1. An illustration of the operation for smart energy grid under various of attacks.

2

Applied Energy 256 (2019) 113703

X. Luo, et al.

neighbouring grid subareas. To detect and isolate the BIAs in smart energy grid, the following critical challenges have to be addressed.

system in smart energy grid. The rest of the paper is organized as follows. Section 2 introduces an identified nonlinear dynamic smart energy grid model, the description of bias injection attack and problem formulation. In Section 3, the proposed distributed detection and isolation scheme against cyberphysical attack in smart grids is presented. In Section 4, simulation results are provided to demonstrate the effectiveness of the proposed distributed detection and isolation scheme. Section 5 presents the conclusion.

• The accuracy of state estimation. In [34], it is shown that the devia•

tion from the actual estimation of internally physical state can lead to wrong judgment in the energy management center. As a sequence, the accurate estimation of internally physical state is required in the observer-based detection methods. The computation of detection threshold. It is noted that the detection threshold is precomputed. However, the value of the detection threshold is too large, in generally, there exists missed detection. In contrast, there exists false alarm, if the detection threshold is too small [35].

2. Preliminaries and problem formulation In this section, a nonlinear physical dynamics power model is constructed. Then, the stealthy characteristics of BIA is described. And the detection and isolation against BIA problem is formulated.

1.3. Contribution and organization

2.1. Terminology and notation

To address the above challenges, this paper proposes a distributed detection and isolation (DDI) scheme against the BIA for smart energy grid. We first design the nonlinear interval observer to obtain accurately estimation of internally physical state, by taking the bound of external disturbance into account. The interval residual-based detection method is proposed to address the limitation of precomputed threshold in traditional bad data detection techniques. Furthermore, we further develop a judgment logic matrix-based distributed location decision method, by considering the effect of exchanged information in neighbouring grid energy management centers. As shown in Fig. 2, the proposed e-CPS architecture for the DDI scheme consisting of two steps. In the first-step, we propose the local detection and isolation (LDI) scheme. Based on the characteristics of interval residuals, the local energy management centers (LEMCs) can judge the injected BIAs. To deal with the effects of exchanged information in adjacent grid energy management center, the local attack signature judgment logic matrix is further established to isolate a bank of possible sensor attack set. In the second-step, we propose a global distributed detection and isolation (GDI) scheme against BIAs. The global energy management centers (GEMCs) is further to isolate a set of global subarea attack set, based on the proposed global attack signature judgment logic matrix. The above proposed local and global protection framework is ensure the normal operation of energy management

The following notations are introduced and involved through this paper, as shown in Table 1. 2.2. An identified physical dynamics grid model Consider a large-scale and complex smart energy grid system with N subareas, where each subarea consists m (m 1, , n.) generators interconnected through a transmission network. The nonlinear physical dynamics power model for the ith (i 1, , N .) subarea is described as follows [36]. Mechanical dynamics: i (t ) = wi (t ) Mi wi (t ) = Pmi (t )

Pei (t )

Li wi (t )

(1)

Electrical dynamics and equations: qi (t )

=

qi (t )

=

1 ( fi (t ) Tdo qi (t )

+ (xdi

qi (t ))

xdi ) idi (t )

Fig. 2. Complete cyber-physical architecture for the distributed detection and isolation scheme.

3

(2) (3)

Applied Energy 256 (2019) 113703

X. Luo, et al.

Table 1 Nomenclature. Main notations The The The The The The The

i

wi Pmi Pei Li Mi Tdo x di xdi

List of abbreviations

phase angle of the ith rotor; speed of the ith rotor; mechanical power of the ith rotor; electrical power of the ith rotor; damping coefficient of the ith rotor; inertia coefficient of the ith rotor; direct axis transient time constant;

e-CPS FDIAs BIA DOS LAA PMU LEMC

The direct axis reactance; The direct axis transient reactance;

LDI GEMC

The transient EMF in the quadrature axis;

qi qi

GDI

Qei idi iqi

Remote terminal units;

The reactive power of the ith rotor; The direct axis stator currents; The quadrature axis stator currents;

PD PF EMF

Detection rate; False positive rate; Electromagnetic field;

DDI

The mutual reactance between the excitation coil and the stator coil; The ith row and the jth column element of nodal transient admittance matrix after eliminating all physical busbars; max{ , 0} , and max{ , 0}

iadi Gij + jBij + ,and

qi qj [Bij sin( i (t )

j (t ))

+ Gij cos( i (t )

j (t ))]

(4)

i=1 n

Qei (t ) =

qi qj [Gij sin( i (t )

j (t ))

Bij cos( i (t )

j (t ))]

(5)

j =1

n

idi (t ) =

qi [Gij sin( i (t )

j (t ))

Bij cos( i (t )

j (t ))]

=

iqi (t ) =

qj [Gijsin( i (t )

j (t ))

+ Bij cos( i (t )

j (t ))]

=

qi

yi (t ) = Ci x i (t )

qi

(7) qi (t )

Linearizing (4) and (6) (see [36] for details), the nonlinear dynamics power model is described as n

1 Mi

x i (t ) =

0

1

j = 1, j i n

xdi )

Tdoi

2 qio Gii Mi

Li Mi

qio qjo GSijo

(x di

0

qjo BSijo

1 Tdoi

0

j = 1, j i

0 0

x i (t ) + (x j ) +

1 Tdoi

1 Mi

+

di (t )

qjo BSijo j = 1, j i xdi )

Tdoi

fi

Pmi

0

Bii

i (t ),

wi (t ), 0

( x j )=

1 GSijo Mi qio qjo

, (9)

(x di

xdi )

Tdoi

qjo GSijo

T qi (t )] ,

0 0 0

.

(10)

di (t )

d¯i (t )

(11)

Remark 2. In practical smart energy grid, the external disturbance is affected by practical factors, e.g. the random fluctuation of input mechanical power of generator and random change of distribution side [37]. In other words, the external disturbance exists a fluctuation in practical smart energy grid. Hence, the given Assumption 1 is reasonable and feasible. Under the Assumption 1, this paper proposes a nonlinear interval observer-based distributed detection and isolation methods, by taking the bound of external disturbance into account.

with

x i (t )=[

) , and

where d (t ) and d¯ (t ) denote the lower bound and upper bound of external disturbance, respectively.

0 1 Mi

x;

T

Assumption 1. The external disturbance is unknown but bounded, that is

n

(xdi

max{0, x } and x+

max (

where (x j ) and di (t ) denote the interconnection of neighbouring grid subareas and external disturbance, respectively, Ci denotes the output measurement matrix with appropriate dimension. In addition, the following assumptions are given through this paper.

(8)

= iadi i fi (t )

x+ and x

x i (t ) = Ai x i (t ) + (xj ) + di (t )

Pei (t )

j =1

) )

=

= + ; The largest eigenvalues of matrix ; The smallest eigenvalues of matrix ;

fi

(6) n

min (

Metzler matrix,

In this paper, we only consider the phase angle of generator, then = fio and Pmi = Pmio are constants, respectively. Since there exists the inevitable external disturbance in practical power system, the nonlinear physical dynamics grid model for the ith grid subarea is described as

Qei (t )

j=1

max (

Distributed detection and isolation;

an identified grid model. In [36], it is shown that the grid model can reflect the actual change of internally physical dynamics, by state-space model parameter identification. Based on these practical foundations, we further study a distributed detection and isolation scheme to protect the security of energy management system in the smart energy grid.

n

Pei (t ) =

Global detection and isolation;

RTU

The excitation current of the ith rotor;

i fi

Local detection and isolation; Global energy management center;

The EMF in the quadrature axis;

The equivalent EMF in the excitation coil;

fi

Energy cyber-physical system; False data injection attack; Bias injection attack; Denial of service attack; Load alter attack; Phasor measurement units; Local energy management center;

0 1 BSijo Mi qio qjo (x di

xdi )

Tdoi

2.3. Description of bias injection attack

xj.

GSijo

As one of typical FDIAs, the BIA aims to change the running state of generator by compromising the measurement sensors. Based on Fig. 1, the detailed description of BIA is given as follows. In the first step, the attacker injects the BIA to disrupt the operation of generator. For

where (x j ) denotes the nonlinear term of neighbouring grid subareas. Remark 1. It is noted that the constructed dynamics grid model in (9) is

4

Applied Energy 256 (2019) 113703

X. Luo, et al.

instance, the change in running state of generator can disconnect customer loads or generators via the actuator units, e.g. governor valve and circuit breaker units. In the second step or key step, the attacker needs to bypass the detection in energy management system without triggering an alarm. For instance, the attacker compromises the sensor data in measurement units, e.g. phasor measurement unit (PMU) and remote terminal units (RTU). Let us show the detailed stealthy process of BIA in the key step as follows. Under the residual-based detection relationship in energy management systemin [38], the detection residual RBIA (t ) under BIA is described as

RBIA (t )=zBIA (t ) HxBIA (t ) =z (t ) + b (t ) H (x (t ) + c ) =R (t ) + (t )

data so that the measured values plausibly correspond to the true physical properties of smart energy grid. If there is no feasible solution to the Assumption 2, then the residual change generated by the BIA will exceed the precomputed threshold [40]. Under the worst attack possible, this paper studies a distributed detection and isolation scheme against the BIA to protect the energy management system of smart energy grid. To demonstrate the stealthy attack characteristics, an example on the IEEE 6-bus smart grid system is given as follows. Example 1. Taking the IEEE 6-bus smart grid system shown in Fig. 3 as an example, it is assumed that the attacker injects single BIA on the bus 1 starting at t = 180 s . The corresponding matrix parameters A and C are as the same of that in [28], and the bias injection attack sequence is taken from [19]. Fig. 4(a) illustrates that there exists an obvious change of phase angle on generator bus 1 generated by BIA. While the corresponding detection residual RBIA (t ) has only a small change, it does not exceed the precomputed threshold W (the set of W can be seen in [24]), as shown in Fig. 4(b). Since the injected false attack sequence satisfies the relationship in (13), the BIA can bypass the Chi-square detector-based detection technique. Obviously, it can be seen that the phase angle of generator bus has been falsified, but the control center can not detect the BIA.

(12)

where RBIA (t ), xBIA (t ) and zBIA (t ) denote detection residual, estimation state and measurement output under BIA, respectively, R (t ), x (t ) and z (t ) denote measurement residual, estimation state and measurement output, respectively. W and H represent the precomputed threshold and measurement matrix, respectively. It is shown in [39] that the setting of precomputed threshold W depends on external noise, and measurement matrix H depends on the topology structure of power system, (t ) and c denote the deceptive residual variable and state variable generated by BIA, respectively. Particularly, as one of false data injection attacks, attacker can design the deceptive data to satisfy the following condition [8]

RBIA (t ) = R (t ) + (t ) < W

Remark 4. The above simulation results in Example 1 demonstrate that the attacker only achieves the stealthy characteristics on the sate estimation-based output measurement. However, the corresponding change of internally physical dynamics can reflect the existence of BIA. Therefore, we investigate the detection and isolation problem on the BIA, based on the constructed internally physical dynamics grid model as follows.

(13)

Especially, even (t ) = b (t ) Hc = 0 , that is b (t ) = Hc . Eqs. (12) and (13) imply that BIA can change the internally physical state, but corresponding RBIA (t ) does not exceed the precomputed threshold W in (14) . To achieve a stealthy attack on the energy management system of smart energy grid, the following assumption is given as follows [9].

2.4. Problem formulation For a large-scale smart energy grid consisting of N grid subareas with each subarea equipped sensors, the nonlinear physical dynamics grid model of the qth sensor in the ith subarea under the cyber-physical attack can be denoted by (i, q) , that is

Assumption 2. The attacker has the capability to obtain the topological structure of smart energy grid and compromise the least number of measurement smart sensors.

(i, q) :

Remark 3. The attacker may obtain the topological structure of smart energy grid and compromise the least number of measurement smart sensors, by using the network intrusion technology, e.g. Trojan Horse and Buffer Overflow [31]. Hence, the given Assumption 2 indicates that the attacker can stage a stealth attack.

x (i, q) (t ) = A(i, q) x (i, q) (t ) + (x (j, q) ) + D(i, q) d (i, q) (t ), y(i, q) (t ) = C(i, q) x (i, q) (t ) + f(i, q) (t ), (i

1,

, N ,).

(14)

where A(i, q) and C(i, q) are made up of m (i, q) rows of Ai and Ci , respectively, x (i, q) (t ) and y(i, q) (t ) are made up of m (i, q) rows of x i (t ) and yi (t ) , respectively, f(i, q) (t ) denotes the bias injection attack injected the qth sensor of the ith grid subarea. Based on the nonlinear dynamics grid model in (14), the problem to be solved is presented as follows: Developing a timely and reliable distributed detection and isolation scheme to protect the energy management system of smart energy grid.

Assumption 2 indicates that the attacker can stage a powerful attack policy on the smart energy grid without triggering an alarm. The general rule for the BIA is that the attacker must compromise the sensor

3. Distributed detection and isolation scheme against bias injection attack In this section, an interval observer-based DDI scheme against the BIA is proposed, by which the accuracy of interval state estimation and the limitation of precomputed threshold can be addressed. Based on the proposed proposed local and global attack judgment logic matrices, the DDI protection scheme can effectively protect the energy management system of smart energy grid. 3.1. Nonlinear interval observer design Since the parameter matrix A(i, q) of nonlinear dynamics power model in (14) is not a Metzler matrix, a linear transformation is used as follows 1

Fig. 3. A power network with 3 generators, 3 terminal buses, and 3 load buses.

z (i, q) (t ) = U(i, q) x (i, q) (t ) U(i, q). 5

(15)

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 4. The detection analysis for IEEE 6-bus smart grid system under the bias injection attack.

where U(i, q) is a nonsingular matrix with appropriate dimension. It is noted that the relevant knowledge on nonsingular transformation matrix is given in [41,42]. By using (15), the nonlinear dynamics grid model for the i th grid subarea is rewritten as

z (i, q) (t ) = A (i, q) z (i, q) (t ) +

ensures that there exists a robust nonlinear interval observer for the smart energy grid system. In other words, the design of observer gain K (i, q) ensures the robustness of interval residual. By choosing the value of the observer gain K (i, q) , the proposed detection method can minimize the effect of external disturbance on interval residual. Based on this characteristics, the proposed detection method can obtain accurately interval estimation of internally physical dynamics.

(z (j, q) ) + D(i, q) d (i, q) (t )

y(i, q) (t ) = C(i, q) z (i, q) (t ).

(16)

where 1 1 A(i, q) = U(i, q) A(i,1q) U(i, q), D(i, q) = U(i, q) D(i, q) U(i, q),

To protect the safe operation of energy management system in smart energy grid, an interval observer-based distributed detection and isolation scheme against the BIA is proposed as follows.

(z (j, q) ) = U(i, q) (x (j, q) )

1

and C(i, q) = C(i, q) U(i, q) . For the nonlinear dynamics grid model in (16), the proposed nonlinear interval observer is designed as

3.2. Interval observer-based distributed detection and isolation scheme against bias injection attack

z¯ (i, q) (t ) = A(i, q) z¯ (i, q)(t ) + ¯ (z (j, q) ) + D(i, q) d (i, q) (t ) + K (i, q) (y(i, q) (t ) z (i, q) (t ) = A (i, q) z (i, q) +

C(i, q) z¯(i, q) (t ))

Taking the transmitted information between adjacent grid subareas into account, the proposed distributed detection and isolation scheme consists of the local and global steps as follows.

(z (j, q) ) + D(i, q) d (i, q) (t )

+ K (i, q) (y(i, q) (t )

C(i, q) z (i, q) (t )).

(17)

where K (i, q) denotes the designed interval observer gain. Eq. (17) can be rewritten as (i, q) (t )

= N(i, q)

(i, q ) ( t )

+

(i, q) (t )

+

(i, q) (t )

+

(i, q) (t ),

3.2.1. Local distributed detection and isolation scheme against bias injection attack Local distributed detection against bias injection attack. From the interval state relationship in (19), we can obtain the local interval residual as follows

(18)

with (i, q ) ( t ) =

z¯(i, q) (t ) z (i, q) (t )

,

(i, q) (t )

N(i, q) (t )=diag [A(i, q) (i, q) (t )=

¯ ( z (j , q ) ) (z (j, q) )

=

K (i, q) y(i, q) (t ) K (i, q) y(i, q) (t )

K (i, q) C(i, q) , A(i, q) ,

(i, q ) ( t )

=

,

(i, q) :

K (i, q) C(i, q) ],

D(i, q) d (i, q) (t ) D(i, q) d (i, q) (t )

x (i, q) (t )

x¯ (i, q) (t )

x (i, q) (t )

0

x (i, q) (t )

0

(20)

Based on the interval residual relationship in (20), the following local detection standard is given as

.

Based on the designed nonlinear interval observer in (17), we can obtain interval state relationship as follows

x (i, q) (t )

r¯(i, q) (t ) = x¯ (i, q) (t ) r (i, q) (t ) = x (i, q) (t )

0 [ r (i, q) (t ), r¯(i, q) (t )], i (1, 2,

(19)

, N ), q

(1, 2,

, m).

(21)

where r¯(i, q) (t ) and r (i, q) (t ) denote the upper and lower bound of residual r(i, q) (t ) , respectively. Then, corresponding local logic detection decision under the BIA is characterized by a Boolean function, that is

Remark 5. To ensure the stability of the designed nonlinear interval observer in (17), Theorem 1 is given in the Appendix B. Theorem 1

6

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 5. Interval observer-based local detection framework against the BIAs.

(i, q) (t )=

Algorithm 2. Interval observer-based global DDI algorithm against BIA.

0, if t < t (i, q) ; no cyber attack, 1, if t

t (i, q) =min {t : 0 t

t (i, q) ; cyber attack, [ r (i, q) (t ), r¯(i, q) (t )]}.

Require: Choose a large-scale grid system consisting of N subareas. 1: Establish global attack signature logic matrix dimensions card U × S ; 2: The ith row corresponds to the gth element, denoted as Ui {g } ; 3: The jth column corresponds to the hth element, denoted as Sj {h} ; if

(22)

where t (i, q) denotes the attack detection time of the q th sensor. If (i, q) (t ) = 0 , it implies that no BIA is injected in the qth sensor, or injected BIA is not detected until the detection time t (i, q) . Otherwise, (i, q) (t ) = 1 means that the BIA has been injected in the qth sensor.

Ui {g }

Algorithm 1. Interval observer-based local DDI algorithm against BIA. Require: Choose the ith grid subarea with m sensors, i 1: Establish local attack signature logic matrix

( i)

(1,

, N ), m

(1,

, n) .

dimensions card U (i) × S (i) ;

2: The ith row corresponds to the gth element, denoted as Ui(I ) {g } ; 3: The jth column corresponds to the hth element, denoted as S (j i) {h} ; if

Ui(i) {g }

S (j i) {h}

0,

(i ) i, j

= 1, else

(I ) i, j

= 0;

4: Design a set of nonlinear interval observers in (17) for the rows of (i) ; 5: Obtain the local detection logic decision (i, q) (t ) based on the detection standard in (22); 6: Compute the logic decision of all observed patterns

7: for q = 1

2m + 1

1 do

i (t )

Sj {h}

0,

i, j

= 1, else

i, j

= 0;

4: Design a set of nonlinear interval observers as in (17) for the rows of ; 5: Obtain the global detection logic decision (i) (t ) based on the detection standard in (26). 6: Compute the logic decision of all observed patterns (t ) via (27); N do 7: for I = 1 8: Compare (t ) with the columns of 9: if The one column is matched. then 10: Global subarea sensor attack set is isolated, which may be injected one or multiple grid subareas. 11: else 12: No bias injection attack is injected. 13: end if 14: end for Output: The global subarea attack set.

via (23);

Local distributed isolation against bias injection attack. Considering the ith local control center consisting of m , m (1, , n) sensors, the local attack signature judgment logic matrix (i) is established as follows: The rows of local attack signature judgment logic matrix (i) correspond to all the sensors in the ith grid subarea, denoted as U (i ) . While the columns of (i) correspond to all the combinations of possible cyber-physical attacks injected in m sensors of the grid subarea (i) and adjacent grid subarea (j) , denoted as S (i) . For example, if m = 2, the row U (i ) = [U (i,1) , U (i,2) ], where U (i,1) = {1}, U (i,2) = {2} ; the column {S (i,1) }, {S (i,2) }, {S (i,3) }, S (i ) = , where S (i,1) = f(i,1) = {1}, S (i,2) = {S (i,4) }, {S (i,5) }, {S (i,6) }, {S (i,7) }

8: Compare i (t ) with the columns of (i) , 9: if The one column is matched. then 10: Local possible sensor attack set is isolated, which may be injected the sensors of isolated grid subarea or adjacent subareas. 11: else 12: No bias injection attack is injected. 13: end if 14: end for Output: The local possible sensor attack set.

7

Applied Energy 256 (2019) 113703

X. Luo, et al.

Based on the relationship in (29), the following global interval residual-based detection standard is given as

f(i,2) = {2}, S (i,3) = (f(i,1) , f(i,2) ) = {1, 2}, S (i,4) = f(j, q) = {q}, S (i,5) = f(j, q) f(i,1) = {1} {q}, S (i,6) = f(j, q) f(i,2) = {2} {q}, S (i,6) = f(j, q) (f(i,1) , f(i,2) ) = {1, 2} {q} . It is noted that {·} denotes the corresponding elements of row or column. Furthermore, q denotes the qth neighbouring sensor in the jth grid subarea, and f(j, q) denotes the BIA injected in the qth neighbouring sensor in the jth grid subarea. In the columns of local attack signature judgment logic matrix (i) , we consider the possible attack influences from neighbouring sensors of m , m (1, , n) sensors in the jth grid subarea, such as S (j,4) -S (j,6) . Let Uk(i ) {g } and Sl(i ) {h} denote the gth element in the kth column and the hth element in the lth row, respectively. Then, the elements of attack sig(i ) nature judgment logic matrix are denoted as ( kl )(i ) . If (i ) (i ) ( i ) Uk {g } Sl {h} = 1, ( kl ) = 1, k (1, , m) and l (1, , 2m + 1 1) . Otherwise, ( kl )(i ) = 0 if Uk(i ) {g } Sl(i) {h} = 0 . By designing a bank of nonlinear interval observers in (17) for the rows of (i) , we can obtain a bank of local observed pattern of sensor attack affecting (i) . Then, the local isolation logic decision under the BIA is denoted by (i) (t ) , that is i (t )

=[

(i,1) (t ),

,

(i,2m + 1 1) (t )]

0

(i) (t )=

(25)

(26)

where t (i) denotes the attack detection time of the qth sensor. If (i) (t ) = 0 , Eq. (26) indicates that the relationship of interval residuals (i ) (t ) in (25) is always satisfied. Namely, there does not exist the injected cyber-physical attacks in the ith grid subarea. On the contrary, (i) (t ) = 1 means that the residual relationship (i ) (t ) in (26) is not satisfied. In other words, Eq. (26) implies that one or multiple cyberphysical attacks are injected in the ith grid subarea. Global isolation against bias injection attack. For the global control center consisting of N grid subareas, we establish the global attack signature judgment logic matrix as follows. The rows of global attack signature judgment logic matrix correspond to all grid subareas, denoted as U. While the columns of attack signature judgment logic matrix correspond to all the combinations of possible cyber-physical attacks injected in all grid subareas, denoted as S. For example, if N = 3, the row U = [U1, U 2, U 3], where U1 = {1}, U 2 = {2}, U 2 = {3} ; S = (S (1) , S (2) , S (3) , S (4) , S (5) , S (6) , S (7) ) , the column where S (1) = f(1) = {1}, S (2) = f(2) = {2}, S (3) = f(3) = {3}, S (4) = {f(1) , f(2) } = {1, 2}, S (5) = {f(1) , f(3) } = {1, 3}, S (6) = {f(2) , f(3) } = {2, 3}, S (7) = {f(1) , f(2) , f(3) } = {1, 2, 3} . It is noted that {·} denotes the corresponding elements of row or column. Furthermore, let Uk {g } and Sl {h} denote the gth element in the kth column and the hth element in the lth row, respectively. Then, the elements of attack signature logic judgment matrix are denoted as ( kl) . If Uk {g } Sl {h} = 1, ( kl) = 1, l (1, 2 ,N ), k (1, , 2 N 1) . Otherwise, ( kl) = 0 if Uk {g } Sl {h} = 0 . For the observed pattern of sensor attack affecting (i) , i (1, , N ) , the global isolation logic decision under cyber attack is denoted by (t ) ,

(23)

(t ) = [

(i) (t ),

,

(N ) (t )]

(27)

where the elements of observed pattern (t ) are corresponded to the columns of global attack signature logic judgment matrix . In addition, if (t ) = [0, , 0N ], it means that decision set (t ) is empty. Otherwise, if (t ) = S (i ) , it means that decision set (t ) is consistent with the ith column of global attack signature logic judgment matrix . Then, corresponding global subarea attack set is isolated. As shown in Fig. 6, we propose a global detection and isolation framework against the BIAs as follows. 1. For the attacked grid subarea, we first estimate the interval states of generator, e.g. phase angle and frequency based on the proposed interval observers. 2. According to the global detection criterion in (25), the global energy management center obtain the interval residual of phase angle or frequency in the attacked grid subareas. 3. The global energy management center detects and isolates the injected BIAs, by comparing (t ) with the columns of attack signature logic judgment matrix . If the vector (t ) equals to one column of , the global energy management center send control command to isolate the attacked grid subareas, in which the BIAs may be injected.

Remark 6. Based on the proposed Algorithm 1, the local control center obtains possible local sensor attack set. Since the influences from neighbouring grid subareas are possible in practical, the local sensor attack set includes: (1) one cyber attack injected in (i) ; (2) one or multiple cyber attacks injected adjacent grid subarea (j) . To further isolate the sensor attack set, the following global detection and isolation scheme is proposed. 3.2.2. Global detection and isolation scheme against bias injection attack Global detection against bias injection attack. Similar with the relationship in (20), we can obtain the global interval residual as follows.

0 0

[ r (i) (t ), r¯(i) (t )]}.

t

Under the proposed global detection framework, a detection algorithm against the BIAs for a large-scale grid system is summarized in Algorithm 1. It should be stressed that, traditional bad data detection techniques are based on the comparison between the evaluation function with detection threshold. Since the detection threshold is precomputed, there exists missed detection for the injected FDIAs. In this algorithm, we proposes the interval residual regarding as the timevarying detection threshold to replace the traditional bad data detection techniques.

x (i) (t ) x (i) (t )

, N ).

0, if t < t (i) ; no cyber attack, 1, if t t (i ) ; cyber attack,

t (i) =min {t : 0

1. Based on the constructed physical dynamics grid model in (14), a bank of the designed interval observers in (17) are designed to obtain the interval estimation states, e.g. phase angle or frequency. 2. The local energy management center can obtain the interval residual of phase angle or frequency. According to the local detection criterion in (21), the local energy management center can judge whether there exists injected BIAs affecting (i, q) . 3. If there does not exist abnormal case, the detection process against the BIAs continues. Instead, the local energy management center further isolate the injected BIAs, based on the established local attack signature judgment logic matrix (i) .

r¯(i) (t ) = x¯ (i) (t ) r (i ) (t ) = x (i) (t )

(1, 2,

where r¯(i) (t ) and r (i) (t ) denote the upper and lower bound of residual r(i) (t ) , respectively. Then, corresponding global logic detection decision under cyber-physical attack is characterized by a Boolean function,

where the elements of observed pattern i (t ) correspond to the columns (i ) of attack signature judgment logic matrix . Furthermore, if m + 1 ], it means that local isolation logic decision set ( t ) = [0, , 0 2 1 i (i ) (i) (t ) is empty. Otherwise, if i (t ) = S , it means that local isolation logic decision set i (t ) is consistent with the ith column of attack signature judgment logic matrix (i) . Namely, a bank of possible local sensor attack set is isolated. As shown in Fig. 5, we develop an interval observer-based local detection framework against the BIAs as follows.

(i ) :

[ r (i) (t ), r¯(i) (t )], i

Under the proposed local isolation framework, more specific steps of the isolation algorithm against the BIAs is summarized in Algorithm 2.

(24) 8

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 6. Interval observer-based global detection framework against the BIAs.

Fig. 7. The detection rate and false positive rate against the bias injection attack.

It is noted that, the proposed Algorithm 2 is based on the characteristics of the established global attack signature judgment logic matrix.

addressing problem is investigated. The problem formulation aiming at developing a distributed detection and isolation method to protect the energy management system of smart energy grid:To address the above security threat in smart energy grid, this paper pays special attention to develop a new protection mechanism against the BIA. Taking the stealthy characteristic of attack and distribution characteristic of smart energy grid into account, we propose a distributed detection and isolation scheme against the BIA. The above-mentioned theoretical scheme is based on the constructed identified physical dynamics grid model. It is noted that the grid model has been identified in [36]. Thus, the constructed identified grid model can reflect the practical physical dynamics of in the Ith grid subarea or subsystem, under a small perturbation of measurement signals. Based on the key work in [36], the proposed distributed detection and isolation scheme against the BIA is meaning to protect the security of the energy management system in smart energy grid. The advantage of the proposed distributed detection and isolation

3.3. Discussions of the proposed distributed detection and isolation method in practical smart energy grid. The practical security threat from cyber-physical attacks in e-CPSs, especially the smart energy grid: Thesesecurity incidents in [4–6] have demonstrated that the attacker has a powerful ability to threaten the security of the energy management system in smart energy grid. Under the Assumption 2, the attacker can stage a adversarial attack scheme against the energy management system in smart energy grid. By injecting a bank of false data in energy management system, the attacker can bypass the traditional bad data detection methods. Specially, Example 1 shows that the attacker can change the sunning state of generator, while the detection residual does exceed the precomputed threshold. Responding to this security threat in smart energy grid, the 9

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 8. IEEE 8-bus smart grid system consisting two subareas.

method. Although the attacker can achieve the deception of measurement data, the changes in internally physical state cannot be concealed in [43]. Thus, we design nonlinear interval observer to estimate the internally physical dynamics, by considering the stealthy characteristics of BIA. To evaluate the performance of the traditional bad data detection methods, we use the detection rate PD and false positive rate PF in [44] as matrices, that is

(

PD (W | , p) = 1 PD (W | , p) = 1

W

p

)+ (

PF (W ).

W

p

4.1. Case 1: detection of single bias injection attack In this case, we consider the detection of single BIA by using the proposed detection method, and traditional Chi square-based detection technique in [24]. Based on the comparative simulation results, we analyze the advantage of proposed detection method. Corresponding parameters used in simulation are given as follows: 2.4012, (1,2) = 0.1205, (1,3) = 1.1906, (1,4) = 0.0316, (1,5) (1,1) = = 0.0596, (2,1) = 2.6021, (2,2) = 0.1869, (2,3) = 1.3121, (2,4) = 0.0286, (2,5) = 0.0816, 1 = [0 0.071 sin (x2 )0.068 sin (x3)]T , 2 = [0.058sin (x1 )00.062sin (x3)]T , d1 0.1251, d2 0.1315. It is assumed that the attacker can inject one bias injection attack on the terminal bus of generator 1 at time t = 203 s . Applying the Steps 4–6 in Algorithm 2, a bank of interval observers and KFs are designed to monitor three grid subareas, respectively. As shown in Fig. 6, we can obtain a set of corresponding interval residuals under the BIA. In contrast, a set of detection residuals under the BIA is obtained via the traditional Chi square-based bad data detection technique. Fig. 9 demonstrates the simulation results of internal phase angles state, by using the proposed nonlinear interval observer. Of note, Fig. 9(b) indicates that the proposed detection method can obtain the interval estimation accurately, by dealing with the effect of external disturbance effectively. In other words, the proposed detection method is robust to the external disturbance. Furthermore, Fig. 9(a) implies that the proposed detection method is sensitive to the injected BIA. The simulation results indicate that the proposed detection method can effectively deal with the effect of external disturbance. Figs. 10 and 11 demonstrate the detection performance under the BIA via the two detection methods. As shown in Fig. 8(a), the injected BIA is detected by using the proposed detection method at t1 = 205 s . In contrast, the detection residual has a small bias, but does not exceed the precomputed threshold (W = 3d1) under the traditional Chi squarebased bad data detection technique. in Fig. 11(a). Obviously, the proposed distributed detection method can detect the BIA effectively. When W = 2d1, and W = d1, we consider the detection of the BIA under the traditional Chi square-based bad data detection technique, as show in Fig. 10(a). The detection results indicate that the missing detection rate of the BIA under the traditional Chi square-based bad data detection technique is up to the computation of precomputed threshold W. In contrast, the proposed interval residual-based detection standard can address the limitation of the precomputed threshold, since the interval residual can be regarded as the time-varying detection threshold. Furthermore, we further use the general evaluation standard in [32] to analyze the average detection delay of BIA. The evaluation Lorden’s

), (28)

R+ and p R indicate the strength of the injected FDIAs; is where the ratio of the false-alarm and missed-detection costs; It is noted that < 1;W denotes the precomputed threshold, and ( )=

1 2

e

t2 2 dt

(29)

is the Gaussian cumulative distribution function. Of note, a higher PD indicates that the detection method can detect the BIAs more quickly, and lower PF indicates that the detection method can reduce missed detection. Fig. 7 shows the detection performance of the traditional bad data detection methods is limited to the computation of precomputed threshold W. It is noted that the corresponding practical data are taken from [44]. To address this limitation, we propose a interval residualbased detection criterion. Since the interval residual can be regarded as the time-varying detection threshold, the existing detection techniques consisting of residual evaluation functions and detection threshold can be replaced. Taking the transmitted information of adjacent grid energy management centers into account, we further propose attack signature judgment logic matrix-based isolation method. 4. Simulation studies In this section, two case studies are provided to demonstrate the effectiveness of the proposed distributed detection and isolation scheme against BIAs. Compared the traditional bad data detection techniques in [24], Case 1 is to demonstrate the advantage of the proposed detection method on the IEEE 8-bus smart energy system (Fig. 8). Case 2 is to show the effectiveness of the proposed distributed detection and isolation scheme against multiple BIAs on the IEEE 118-bus smart energy system (Fig. 13). It is noted that IEEE 8 -bus smart energy system is a power network with 2 generators, 2 terminal buses, and 6 load buses and IEEE 118-bus smart energy system is a power network with 9 generators, 9 terminal buses, and 109 load buses. 10

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 9. The interval estimation of internal phased angles for two grid subareas under the bias injection attack by the proposed distributed detection method.

Fig. 10. The interval estimation of interval residuals for two grid subareas under the bias injection attack by interval observer-based distributed detection scheme.

definition for the worst average detection delay is given as follow [45]

J (T BIA) = sup ess sup E [(T BIA F

)+|F ]

done by collecting lots of practical measurement data in my future work. In this paper, we only focus on designing a effective detection method to solve the limitation of the set of precomputed threshold, as shown in Case 1.

(30)

where J (T BIA) denotes average detection delay, denotes the attack injection time by attacker, F denotes the filtration, i.e., all observation data obtained until time and (·)+ = max(·,0), T BIA denotes the stopping time of the proposed nonlinear interval observer-based detection algorithm. In Fig. 10, we present the average detection delay curves for the traditional Chi square-based bad data detection technique and our proposed detection method. We observer that compared to [24], the average detection delays are significantly smaller in the proposed detection method. This is due to by using the time-varying detection threshold (interval residual) , the detection performance of BIAs are not limited to the computation of the precomputed threshold. Of note, the related research on the detection performance will be

4.2. Case 2: detection and isolation of multiple bias injection attacks The proposed distributed detection and isolation scheme is implemented based on the local and global energy management centers. As shown in Fig. 14, corresponding IEEE 118-bus grid structure diagram consists of a global control center and three local control center with 9 sensors. It is assumed that the attacker can inject multiple BIAs on the 1st and the 3rd sensors of generator 4 and generator 6 in the 2nd subarea and the 1st sensor and the 2nd sensor of generator 7 and generator 8 in the 3rd subarea, respectively, the simulation studies on the proposed distributed detection and isolation scheme are given as

Fig. 11. The estimation of detection residuals for two grid subareas under the bias injection attack by the traditional bad data detection technique in [24].

11

Applied Energy 256 (2019) 113703

X. Luo, et al.

follows. Corresponding parameters used in simulation are given as 2.5132, (1,2) = 0.1216, (1,3) = 1.2071, (1,4) = follows: (1,1) = 0.03891, (1,5) = 0.0596, (2,1) = 2.6152, (2,2) = 0.1682, (2,3) = 1.3861, (2,4) = 0.0295, (2,5) = 0.0901, (3,1) = 3.2615, (3,2) = 0.2682, (3,3) = 1.7016, (3,4) = 0.0854, (3,5) = 0.0928, 1 = [00.071sin (x2 )0.089 sin (x3)]T , 2 = [0.062 sin (x1 )0 0.085 sin (x3)]T , 3 = [0.031sin (x1 )0.019sin (x2 )0]T , d1 0.1361, d2 0.1416, d3 0.1686 .

{f(2,1) , f(2,2) , f(2,3) } = {1, 2, 3}, S (2,8) = {f(1,3) , f(2,3) }= {3, 3}, S (2,9) = {f(1,3) , f(2,3) } f(2,1) = {3, 3} {1}, S (2,10) = {f(1,3) , f(2,3) } f(2,2) = {3, 3} {2}, S (2,11) = {f(1,3) , f(2,3) } f(2,3) = {3, 3} {3}, S (2,12) = {f(1,3) , f(2,3) } {f(2,1) , f(2,2) } = {3, 3} {1, 2}, S (2,13) = {f(1,3) , f(2,3) } {f(2,1) , f(2,3) } = {3, 3} {1, 3}, S (2,14) = {f(1,3) , f(2,3) } {f(2,2) , f(2,3) } = {3, 3} {2, 3}, S (2,15) = {f(1,3) , f(2,3) } {f(2,1) , f(2,2) , f(2,3) } = {3, 3} {1, 2, 3} , as shown in Table 3. It is noted that f(2, q) denotes the BIA injected in the qth (q = 3) sensor in the 2nd grid subarea, and f(j, q) denotes the BIA injected in the qth neighbouring sensor in the jth grid subarea. Furthermore, {·} denotes the corresponding elements of row or column. (iii) The rows of local attack signature judgment logic matrix (3) correspond to all the sensors in the 3rd grid subarea, denoted as U (3) = [U (3,1) , U (3,2) , U (3,3) ], where U (3,1) = {1}, U (3,2) = {2}, U (3,3) = {3} ; Furthermore, {·} denotes the corresponding elements of row or column. While the columns of (3) correspond to all the combinations of possible cyber-physical attacks injected in m = 4 sensors of the (i) (i = 3) and adjacent grid subareas (j) (j (2, 3)) , m denoted as S (3) = [{S (3,1) }, , {S (3,2 1) }], where S (3,1) = f(3,1) (3,2) (3,3) = {1}, S = f(3,2) = {2}, S = f(3,3) = {3}, S (3,4) = {f(3,1) , f(3,2) } = (3,5) {1, 2}, S = {f(3,1) , f(3,3) } = {1, 3}, S (3,6) = {f(3,2) , f(3,3) } = (3,7) {2, 3}, S = {f(3,1) , f(3,2) , f(3,3) } = {1, 2, 3}, S (3,8) = {f(1,1) , f(2,2) } = (3,9) {1, 2}, S = {f(1,1) , f(2,1) } f(3,1) = {1, 2} {1}, S (3,10) = {f(1,1) , f(2,1) } f(3,2) = {1, 2} {2}, S (3,11) = {f(1,1) , f(2,1) } f(3,3) = {1, 2} {3}, S (3,12) = {f(1,1) , f(2,1) } {f(3,1) , f(3,2) } = {1, 2} {1, 2}, S (3,13) = {f(1,1) , f(2,1) } {f(3,1) , f(3,3) } = {1, 2} {1, 3}, S (3,14) = {f(1,1) , f(2,1) } {f(3,2) , f(3,3) } = {1, 2} {2, 3}, S (3,15) = {f(1,1) , f(2,1) } {f(3,1) , f(3,2) , f(3,3) } = {1, 2} {1, 2, 3} , as shown in Table 4. It is noted that f(3, q) denotes the BIA injected in the qth (q = 3) sensor in the 3rd grid subarea, and f(j, q) denotes the BIA injected in the qth neighbouring sensor in the jth grid subarea. Based on the Steps 4–5 in Algorithm 1, a bank of nonlinear interval observers in (17) are designed to monitor the sensors of generators for each grid subareas, respectively. Then, a set of corresponding interval residuals are obtained, as shown in Figs. 11–13. Figs. 15–17 show the simulated results of the proposed local distributed detection and isolation scheme against multiple BIAs, respectively. According to Step 6 in Algorithm 1, the corresponding local detection logic decision is obtained as: (1) (t ) = {1, 0, 0} for t (i) = 338 s in the 1st grid subarea; (2) (t ) = {1, 0, 1} for t (i) = 338 s in the 2nd grid subarea; (3) (t ) = {1, 1, 0} for t (i) = 338 s in the 3rd grid subarea. Applying the Steps 7–14 in Algorithm 1, we can

4.2.1. Local distributed detection and isolation scheme against bias injection attacks Applying the Steps 1–3 in Algorithm 1, a set of local attack signature judgment logic matrix (1) - (3) for three grid subareas are established as follows, respectively: (i) The rows of local attack signature judgment logic matrix (1) correspond to all the sensors in the 1st grid subarea, denoted as U (1) = [U (1,1) , U (1,2) , U (1,3) ], U (1,1) = {1}, U (1,2) = {2}, where U (1,2) = {3} ; Furthermore, {·} denotes the corresponding elements of row or column. While the columns of (1) correspond to all the combinations of possible cyber-physical attacks injected in m = 4 sensors of the (i) (i = 1) and adjacent grid subareas (j) (j (2, 3)) , denoted as m S (1) = [{S (1,1) }, , {S (1,2 1) }], where S (1,1) = f(1,1) = {1}, S (1,2) = f(1,2) = (1,3) {2}, S = f(1,3) = {3}, S (1,4) = {f(1,1) , f(1,2) } = {1, 2}, S (1,5) = {f(1,1) , f(1,3) } = {1, 3}, S (1,6) = {f(1,2) , f(1,3) } = {2, 3}, S (1,7) = {f(1,1) , f(1,2) , f(1,3) } = {1, 2, 3}, S (1,8) = {f(2,1) , f(3,1) } = {1, 1}, S (1,9) = {f(2,1) , f(3,1) } f(1,1) = {1, 1} {1}, S (1,10) = {f(2,1) , f(3,1) } f(1,2) = {1, 1} {2}, S (1,11) = {f(2,1) , f(3,1) } f(1,3) ={1, 1} {3}, S (1,12) = {f(2,1) , f(3,1) } {f(1,1) , f(1,2) } = {1, 1} {1, 2}, S (1,13) = {f(2,1) , f(3,1) } {f(1,1) , f(1,3) } = {1, 1} {1, 3}, S (1,14) = {f(2,1) , f(3,1) } {f(1,2) , f(1,3) } ={1, 1} {2, 3}, S (1,15) = {f(2,1) , f(3,1) } {f(1,1) , f(1,2) , f(1,3) } = {1, 1} {1, 2, 3} , as shown in Table 2. It is noted that f(1, q) denotes the BIA injected in the qth (q = 3) sensor in the 1st grid subarea, and f(j, q) denotes the BIA injected in the qth neighbouring sensor in the jth grid subarea. (ii) The rows of local attack signature judgment logic matrix (2) correspond to all the sensors in the 2nd grid subarea, denoted as U (2) = [U (2,1) , U (2,2) , U (2,3) ], where U (2,1) = {1}, U (2,2) = {2}, U (2,3) = {3} ; Furthermore, {·} denotes the corresponding elements of row or column. While the columns of (2) correspond to all the combinations of possible cyber-physical attacks injected in m = 4 sensors of the (i) (i = 2) and adjacent grid subareas (j) (j (1, 3)) , denoted as m S (2,1) = f(2,1) = {1}, S (2,2) = S (2) = [{S (2,1) }, , {S (2,2 1) }], where

f(2,2) = {2}, S (2,3) = f(2,3) = {3}, S (2,4) = {f(2,1) , f(2,2) } = {1, 2}, S (2,5) = {f(2,1) , f(2,3) } = {1, 3}, S (2,6) = {f(2,2) , f(2,3) } = {2, 3}, S (2,7) =

Table 2 The local attack signature judgment logic matrix

W (3,1) W (3,2) W (3,3)

S (1,1)

S (1,2)

S (1,3)

S (1,4)

S (1,5)

S (1,6)

S (1,7)

S (1,8)

S (1,9)

S (1,10)

S (1,11)

S (1,12)

S (1,13)

S (1,14)

S (1,15)

1

0

0

1

1

0

1

1

1

1

1

1

1

1

1

0

0

1

0

1

1

1

0

0

0

1

0

1

1

1

0

1

0

1

Table 3 The local attack signature judgment logic matrix

W (3,1) W (3,2) W (3,3)

(1) .

0

1

1

0

0

1

0

1

0

1

1

(2) .

S (2,1)

S (2,2)

S (2,3)

S (2,4)

S (2,5)

S (2,6)

S (2,7)

S (2,8)

S (2,9)

S (2,10)

S (2,11)

S (2,12)

S (2,13)

S (2,14)

S (2,15)

1

0

0

1

1

0

1

0

1

0

0

1

1

0

1

0

0

1

0

1

1

1

1

1

1

1

1

1

1

1

0

1

0

1

0

1

1

0

12

0

1

0

1

0

1

1

Applied Energy 256 (2019) 113703

X. Luo, et al.

Table 4 The local attack signature judgment logic matrix

W (3,1) W (3,2) W (3,3)

(3) .

S (3,1)

S (3,2)

S (3,3)

S (3,4)

S (3,5)

S (3,6)

S (3,7)

S (3,8)

S (3,9)

S (3,10)

S (3,11)

S (3,12)

S (3,13)

S (3,14)

S (3,15)

1

0

0

1

1

0

1

1

1

1

1

1

1

1

1

0

0

1

0

1

1

1

0

0

0

1

0

1

1

1

0

1

0

1

0

1

1

1

1

1

1

1

1

1

1

{f(3,1) , f(3,2) }, {f(1,1) , f(2,2) }, {f(3,1) , f(1,1) , f(2,2) }, {f(3,2) , f(1,1) , f(2,2) }, {f(3,1) , f(3,2) , f(1,1) , f(2,2) } in the 3rd grid subarea. Based on the above simulated results, a bank of possible local sensor attack set are obtained. Taking the effects of transmitted information from neighbouring grid subareas into account, the global distributed detection and isolation scheme is presented to isolate the sensor attack as follows. 4.2.2. Global distributed detection and isolation scheme against bias injection attacks Based on the Steps 1–3 in Algorithm 2, corresponding global attack signature judgment logic matrix is established as: The rows of global attack signature judgment logic matrix correspond to all grid subareas, denoted as U = [U1, U 2, U 3], where U1 = {1}, U 2 = {2}, U 3 = {3} ; While the columns of attack signature judgment logic matrix correspond to all the combinations of possible cyber-physical attacks injected in all grid subareas of smart grid systems, denoted as

Fig. 12. Average detection delay in case of bias injection attack for the proposed distributed detection method and the traditional detection method in [24].

obtain the possible injected BIAs set is (f(1,1) ), {f(2,1) , f(3,1) } , {f(2,1) , f(3,1) , f(1,1) } and in the 1st grid subarea; {f(2,1) , f(2,3) }, {f(2,1) , f(2,3) , f(1,3) , f(3,3) } in the 2nd grid subarea;

Fig. 13. IEEE 118-bus smart grid system consisting three subareas. 13

Applied Energy 256 (2019) 113703

X. Luo, et al.

Fig. 14. The monitor and control structure diagram of corresponding IEEE 118-bus smart grid system.

Fig. 15. The detection and isolation of bias injection attacks for the 1st subarea under the proposed local distributed detection and isolation scheme.

Fig. 16. The detection and isolation of bias injection attacks for the 2nd subarea under the proposed local distributed detection and isolation scheme.

Fig. 17. The detection and isolation of bias injection attacks for the 3rd subarea under the proposed local distributed detection and isolation scheme.

14

Applied Energy 256 (2019) 113703

X. Luo, et al.

Table 5 The global attack signature judgement logic matrix

W1 W2 W3

S (1)

S (2)

S (3)

S (4)

S (5)

S (6)

S (7)

1

0

0

1

1

0

1

0

0

1

0

1

1

1

0

1

0

1

4.2.3. Discussion of the application of the proposed protection scheme in practical smart energy grid As one of typical e-CPSs, smart energy grid consist of cyber system and physical system. It is noted that a energy management system in cyber system is equipped to monitor and control the physical system. In practice, a large-scale smart energy grid consists of four grid subarea or subsystem, such as generation section, transmission section, distribution section and consumption section. By using the proposed the global detection and isolation method, the energy management system in the global control can identify the injected cyber-physical attacks. Due to the integration in smart sensors and digital technologies, each local control center can monitor and control corresponding physical dynamics of generators. By using the proposed the local detection and isolation method, the energy management system in the local control can identify the injected cyber-physical attacks. Based on the combination of the global and local results, the injected cyber-physical attacks can be detected and isolated. Of note, the identified physical dynamics grid model is key step for the implication of the above mentioned detection and isolation method. Therefore, the constructed physical grid model in this paper is cited in [36]. It is noted that state-space model parameter of constructed power model has been identified or validated by experiments in [36]. Thus, the constructed grid model can reflect the practical internal physical dynamics of the Ith grid subarea or subsystem, under a small perturbation of measurement signals. The simulation results have demonstrated that the proposed distributed detection and isolation scheme against BIA can effectively ensure the normal operation of energy management system in smart energy grid.

.

0

1

1

{S (1) }, {S (2) }, {S (3) }, , where S (1) = f(1) = {1}, S (2) = f(2) = {S (4) }, {S (5) }, {S (6) }, {S (7) } {2}, S (3) = f(3) = {3}, S (4) = {f(1) , f(2) } = {1, 2}, S (5) = {f(1) , f(3) } = {1, 3}, S (6) = {f(2) , f(3) } = {2, 3}, S (7) = {f(1) , f(2) , f(3) } = {1, 2, 3} , as shown in Table 5. It is noted that f(i) denotes the BIA injected in the ith grid subarea. Applying the Step 4 in Algorithm 2, we design a bank of nonlinear interval observers to monitor three grid subareas, respectively. And a set of corresponding interval residuals are obtained, as shown in Fig. 14. Fig. 18 illustrates the simulated results of the proposed global distributed detection and isolation scheme against multiple BIAs. According to the Steps 5–6, the global detection and isolation decision set is obtain as (t ) = {0, 1, 1} for t = 338 s . Applying the Steps 7–12 in Algorithm 2, corresponding global attack set is isolated as {f(2) , f(3) } . Based on detection and isolation results, one can judge that there exist BIAs in the 2nd grid subarea and the 3rd grid subarea. It is noted that the effects of adjacent sensor attacks coming from adjacent grid subareas subarea are too low to be undetected, as shown in Fig. 18(a). In other words, Fig. 16(a) indicates that there does not exist bias injection attacks in the 1st grid subarea. Namely, the detection results of Fig. 15(a) comes from the effects of adjacent sensors of the 2nd grid subarea and the 3rd grid subarea. Based on the simulation results in Fig. 16(b) and Fig. 14, we can obtain the isolated attack set is {f(2.1) , f(2.3) } in the 2nd grid subarea. From Fig. 16(c) and Fig. 15, the isolated attack set for the 3rd grid subarea is obtained as {f(3.1) , f(3.2) } . Similarly, for the 1st grid subarea, the isolated attack set is obtained as {f(2.1) , f(3.1) } . Combining the local and global detection and isolation simulated results, the isolated attack set is {f(2.1) , f(2.3) f(3.1) , f(3.2) } . Through the proposed distributed detection and isolation scheme, we can obtain that the BIAs are injected in the 1st and the 3rd sensors of generator 4 and generator 6 in the 2nd subarea and the 1st and the 2nd sensors of generator 7 and generator 8 in the 3rd subarea, respectively. Namely, the results of attack detection and isolation are consistent with the actual attack injection. Case1 and Case2 demonstrate the effectiveness of the proposed distributed detection and isolation scheme against the BIA. In the local distributed detection and isolation scheme, the simulation results in Figs. 10 and 11 demonstrate the detection performance of the proposed interval residual-based detection standard. In addition, the simulation results in Figs. 15–18 demonstrate that the local and global energy management centers can effectively detect and isolate the injected BIAs, even if there exists the attack effects of neighbouring grid subareas. S=

5. Conclusions This paper studies a detection and isolation protection scheme against BIAs to ensure the safe operation of energy management system. The application of energy management system increase the efficiency and security of smart energy system. Meanwhile, the security of energy management faces enormous risk from the emerging cyber-physical attacks. For instance, Example 1 has demonstrated that the stealthy characteristics of BIAs is based on the bias of detection residual. Therefore, we propose nonlinear interval observer-based distributed detection method, by consider the attack characteristics. It is noted that Theorem 1 ensures the interval observer is robust to the external disturbance. Furthermore, an interval residual-based detection standard is proposed to address the limitation of the precomputed threshold. Taking the distributed characteristics of practical smart energy grid into account, the proposed distributed detection method against BIAs consists of the local and global detection and isolation two steps. In the local step, we consider the effects of exchanged information from adjacent local energy management centers. Based on the established local attack signature judgment logic matrix, the local energy management centers can detect and isolate a bank of sensor attack set. Then, the global energy management centers is further to isolate a set of global subarea attack set, based on the proposed global attack signature judgment logic matrix.

Fig. 18. The detection and isolation of bias injection attacks for three grid subareas under the proposed global distributed detection and isolation scheme. 15

Applied Energy 256 (2019) 113703

X. Luo, et al.

The simulation results demonstrate the effectiveness of the proposed distributed detection and isolation scheme against the BIA. Case 1 demonstrate the detection performance of the proposed interval residualbased detection standard including: the limitation of the precomputed threshold; the detection delay; the accuracy in detecting BIA. Case 2 demonstrates that the local and global energy management centers can effectively detect and isolate the injected BIAs, even if there exists the attack effects of neighbouring grid subareas.

will analyze the detection performance of the proposed method, by collecting lots of practical measurement data in smart energy grid; In order to better deal with the impact of external disturbances, we will extend our research work on the robust unknown input interval observer. Through the capacity of this robust unknown input interval observer, the unknown parameters or external disturbance can further handled; Based on the analysis of attack characteristics, we will further study the defence scheme against the cyber-physical attacks in energy cyber-physical systems, especially the smart energy grid.

6. Future work Future work of this paper will includes the following aspects. We Appendix A. The linearization process of power model

Linearzing (4) and (6) in the vicinity of an operating point “o”, we can obtain as follows 1 Mi

Pei (t )=

n qio qjo GSijo

qj (t )

+

1 Mi

qjo BSijo

j (t )

+

2 qio Gii Mi

qi (t )

n qjo BSijo

qi (t ),

(A.1)

j = 1, j i

n

1 Tdoi

idi (t ) =

1 GSijo Mi qio qjo

+

j = 1, j i

1 BSijo Mi qio qjo

+

i (t )

qjo GSijo

i (t )

j (t )

Bii

Tdoi

j = 1, j i

qi (t )

Tdoi

+

GSijo

qj (t )

Tdoi

.

(A.2)

Similarly, we can linearize (1) and (2) as i (t )

= wi (t )

wi (t ) = Pmi (t ) qi (t )

1 ( (t ) Tdo fi

=

Li Mi

Pei (t )

wi (t )

qi (t ))

(A.3)

Taking (A.1), (A.2) and (3) into (A.3), we have i (t )

= wi (t ) Li Mi

wi (t ) = Pmi (t ) 1 Mi

n qjo BSijo

+

Bii

1 (t ) Tdo fi

=

qi (t )

(xdi

Tdoi

1 Tdo

qio qjo GSijo

qj (t )

Tdoi

1 GSijo Mi qio qjo

i (t )

j = 1, j i

(xdi

j (t )

2 qio Gii Mi

qi (t )

qj (t ), n

1 (x Tdo di

qi (t )

GSijo

xdi )

n

1 BSijo Mi qio qjo

qi (t )

j = 1, j i

qi (t )

1 Mi

wi (t ) +

xdi )

qjo BSijo

i (t )

+

j = 1, j i

qjo BSijo

j (t )

Tdoi

(xdi

xdi )

xdi )

(A.4)

Eq. (A.4) can be rewritten as

i (t )

wi (t ) = qi (t )

0

n

1 Mi

j = 1, j i

0 0 1 Tdoi

2 qio Gii Mi

n

xdi )

Tdoi

0

Li Mi

qio qjo GSijo

(x di

+

1

qjo BSijo

1 Tdoi

0

j = 1, j i

0

0 1 Mi

0

fi

Pmi

+

1 GSijo Mi qio qjo (x di

xdi )

Tdoi

1 Mi

qjo GSijo

0 0 0

+

n qjo BSijo

j = 1, j i (xdi

xdi )

Tdoi

Bii

0 1 BSijo Mi qio qjo (xdi

xdi )

Tdoi

GSijo

i (t ) wi (t ) qi (t )

j (t )

wj (t ) , qj (t )

(A.5)

Appendix B. Proof of Theorem Theorem 1. If there exist a positive definite matrix G(i, q) , the nonlinear interval observer gain K (i, q) and decay rates

G(i, q)

A (i, q) K (i, q) C(i, q)

T

+

A(i, q) K (i, q) C(i, q)

G(i, q) < 0,

(i, q )

such that (B.1)

16

Applied Energy 256 (2019) 113703

X. Luo, et al.

0 n

0 0

j=1

0

0

0

0

aij )j × j 0 0

0 0

0

0

0

(ki cj

0

N(Ti, q) (t ) G(i, q) + G(i, q) N(i, q)

(B.2)

3 G(i, q) 2 2 F(i, q)

3 G(Ti, q)

I

2 F(Ti, q)

2

0,

0

0

< 0, I

(B.3)

Then, the state of the ith grid subarea in (18) satisfies the following constraints

x (i, q) (t )

x (i, q) (0)

(i, q)

0.5 (i, q) t

i3 e

+

i1 i 2 i3

(i, q)

(B.4)

(i, q)

with

K (i, q) C(i, q) (t )

F(i, q) =

(i, q ) =

(G(i,1q) )

(G(i,1q) )

(G(i,1q) )+

(i, q) (t ), i2

max (G(i, q) )

i3=

1

(G(i,1q) )+ T (i, q) (t )

i1=

min (G(i, q) )

, kn ]T ,

, K (i, q) = [k1,

K (i, q) C(i, q) (t )

, 2

T (i, q )

=

(t )

(i, q) (t ),

, A(i, q) = (aij )n × n , C = [c1,

, cn].

Proof. Define the dynamics of estimation error as

z¯(i, q) (t )

z (i, q)

=(A (i, q)

K (i, q) C(i, q) )(z¯(i, q)

z (i, q) ) + ¯ (z¯(j, q) )

(z (j, q) )

(B.5)

K (i, q) C(i, q) is a Metzler matrix and ¯ (z¯(j, q) ) ( z (j , q ) ) 0 . with A(i, q) By using the Monotone dynamics system theory in [44], one obtains e¯(i, q) (t ) = z¯(i, q) (t )

z (i, q) (t )

(B.6)

0.

Similarly, we can also obtain

e (i, q) (t ) = z (i, q) (t )

z (i, q ) ( t )

0.

(B.7)

Based on (B.6) and (B.7), one deduces

z (i, q) (t )

z (i, q ) ( t )

z¯(i, q) (t ).

(B.8)

Then, a Lyapunov function candidate is chosen as

V(

(i, q) (t ))

T (i, q)

=

(t ) G(i, q)

(i, q) (t )

(B.9)

The derivation of (B.9) is

V(

(i, q) (t ))

=

T (i, q )

(t ) G(i, q)

=

T (i, q )

(N(Ti, q)

+

T (i, q )

T (i, q )

(N(Ti, q)

(t ) G(i, q)

(i, q) (t )

+

(i, q) (t )

(t ) G(i, q) + G(i, q) N(i, q) ) (i, q) (t )

T (i, q)

+

(t )

(t )

+

(

+

(i , q ) ( t )

+

T (i, q) (t )) G(i, q) (i, q) (t )

+3

T (i, q) G(i, q) G(i, q) (i, q) (t )

+

T (i, q) (t ) (i, q) (t )

(i, q) (t )

+8

T (i, q )

(F(i, q) F(Ti, q) )

(i, q ) ( t )

+

T (i, q) (t )

(i, q ) ( t )

(i, q ) ( t )

(i, q) G(i, q) ) (i, q) (t )

(

(i, q) (t )

(i, q) (t )

3G(2i, q) + 8F(i, q) F(Ti, q)

(i, q ) V

+(

(i, q) (t ))

(i, q) (t )

N(Ti, q) (t ) G(i, q) + G(i, q) N(i, q) +

T (i, q )

(i, q ) ( t )

(i, q) (t )

+ 3G(2i, q)

T (i, q )

T (i, q )

T (i, q)

N(Ti, q) (t ) G(i, q) + G(i, q) N(i, q)

T (i, q )

+

+

(t ) G(i, q) + G(i, q) N(i, q) )

(t ) G(i, q) (

T (i, q) (t )

+

(i, q) (t )

(i, q) (t )) +

i1

+

+

i2

i1

+

+

i2

(i, q ) ( t )

+

+

i1

+

i2

+

i3

i3

i3.

(B.10)

Based on (B.10), one obtains 17

Applied Energy 256 (2019) 113703

X. Luo, et al. T (i, q)

(t ) G(i, q)

(i, q) (t )

+

T (i, q )

(t ) G(i, q)

T (i, q) (i, q)

(i, q ) ( t )

(t ) G(i, q)

(i, q) (t )

+

i1

+

i2

+

i3.

(B.11)

Namely (i, q) (t )

max (G(i, q) )

(i, q) (0)

min (G(i, q) )

e

0.5 (i, q) t

+

i1 i 2

max (G(i, q) )

( i, q )

min (G(i, q) )

.

(B.12)

From (16) and (B.8), we have

(U (i, q))+ z (i, q) (t )

1

(U(i, q) ) z¯(i, q) (t )

1

U(i, q) z (i, q) (t )

1

(U(i, q) )+z¯(i, q) (t )

1

(U(i, q)) z (i, q) (t ).

(B.13)

By using (B.13), one obtains 1

(U(i, q) ) z¯ (i, q) (t )

1

1

(U(i, q)) z (i, q) (t )

x (i, q) (t ) = (U(i, q) )+ z (i, q) (t ) x¯ (i, q) (t ) = (U(i, q))+z¯(i, q) (t )

1

(B.14)

and

x (i, q) (t )

x (i, q) (t )

(B.15)

x¯ (i, q) (t ).

Based on (B.13), (B.14) and (B.15), we have

x (i, q) (t )

(i, q) (i, q) e

0.5 (i, q) t

+

(i, q)

i1 i 2 i3

(B.16)

(i, q)

with (i, q)

= G(+i, q) x (i, q) (0)

G(i, q)x¯ (i, q) (0) + G(+i, q)x¯ (i, q) (0)

G(i, q) x (i, q) (0) .

Inq. (B.16) indicates that the state estimation variables x (i, q) (t ) and x¯ (i, q) (t ) are bounded. Namely, the designed nonlinear interval observer in (18) is stable. □ Appendix C. Supplementary material Supplementary data associated with this article can be found, in the online version, at https://doi.org/10.1016/j.apenergy.2019.113703.

References [18]

[1] Eissa MM. First time real time incentive demand response program in smart grid with “i-Energy” management system with different resources. Appl Energy 2018;212:607–21. [2] Eissa MM. Developing incentive demand response with commercial energy management system (CEMS) based on diffusion model, smart meters and new communication protocol. Appl Energy 2019;236:273–92. [3] Wang Wei, Hong Tianzhen, Li Nan, Wang Ryan Qi, Chen Jiayu. Linking energycyber-physical systems with occupancy prediction and interpretation through WiFi probe-based ensemble classification. Appl Energy 2019;236:55–69. [4] Lu W, Béanger Y, Zama E, Radu D. Blackouts: description, analysis and classification. Proc. 6th WSEAS int. conf. power syst. Lisbon, Port. 2006. p. 429–34. [5] Rampurkar V, Pentayya P, Mangalvedekar HA, et al. Cascading failure analysis for indian power grid. IEEE Trans Smart Grid 2016;7(4):1–10. [6] Liang G, Weller SR, Zhao J, et al. The 2015 Ukraine blackout: implications for false data injection attacks. IEEE Trans Power Syst 2017;32(4):3317–8. [7] Protection CA. Followup on western area power administration’s critical asset protection; 2016. [8] Attacks on the electricity grid_ US vulnerable to physical and cyberthreats n.d. https://www.cnbc.com/2014/01/03/attacks-on-the-electricity-grid-usvulnerableto-physical-and-cyberthreats.html. [9] Ming J, Javad L, Johansson KH. Power grid AC-based state estimation: vulnerability analysis against cyber attacks. IEEE Trans Autom Control 2018:1. https://doi.org/ 10.1109/TAC.2018.2852774. [10] Li Z, Shahidehpour M, Abdulwhab A, et al. Analyzing locally coordinated cyberphysical attacks for undetectable line outages. IEEE Trans Smart Grid 2017;9(1):35–47. [11] Zhang P, Li W, Li S, et al. Reliability assessment of photovoltaic power systems: review of current status and future perspectives. Appl Energy 2013;104:822–33. [12] Kexing L, Illindala MS. A distributed energy management strategy for resilient shipboard power system. Appl Energy 2018;228:821–32. [13] Sikorski JJ, Haughton J, Kraft M. Blockchain technology in the chemical industry: machine-to-machine electricity market. Appl Energy 2017;195:234–46. [14] Yang C, Yang W, Shi H. DoS attack in centralised sensor network against state estimation. IET Control Theory Appl 2018;12(9):1244–53. [15] Mohsenian-Rad AH, Leon-Garcia A. Distributed Internet-based load altering attacks against smart power grids. IEEE Trans Smart Grid 2011;2(4):667–74. [16] Shames I, Sandberg H, Johansson KHA. secure control framework for resourcelimited adversaries. Automatica 2015;51:135–48. [17] Razavi Rouzbeh, Gharipour Amin, Fleury Martin, Akpan Ikpe Justice. A practical

[19] [20] [21] [22] [23] [24] [25] [26] [27] [28] [29] [30] [31]

18

feature-engineering framework for electricity theft detection in smart grids. Appl Energy 2018;238:481–94. Jiang Zhiqiang, Ji Changming, Qin Hui, et al. Multi-stage Progressive Optimality Algorithm and its application in energy storage operation chart optimization of cascade reservoirs. Energy 2018;148:309–23. Li R, Jiang Z, Ji C, et al. An improved risk-benefit collaborative grey target decision model and its application in the decision making of load adjustment schemes. Energy 2018;156:387–400. Jiang Zhiqiang, Li Rongbo, Li Anqiang, et al. Runoff forecast uncertainty considered load adjustment model of cascade hydropower stations and its application. Energy 2018;158:693–708. Bobba RB, Rogers KM, Wang Q, Khurana H, Nahrstedt K, Overbye TJ. Detecting false data injection attacks on dc state estimation. In: Proc. 1st Workshop secure control syst. (CPSWEEK); 2010. p. 1–6. Gong S, Zhang Z, Li H, Dimitrovski AD. Time stamp attack in smart grid: Physical mechanism and damage analysis; 2012. [Online]. Available: https://arxiv.org/abs/ 1201.2578. Liang J, Sankar L, Kosut O. Vulnerability analysis and consequences of false data injection attack on power system state estimation. IEEE Trans Power Syst 2016;31(5):3864–72. Manandhar K, Cao X, Hu F, et al. Detection of faults and attacks including false data injection attack in smart grid using Kalman filter. IEEE Trans Control Netw Syst 2013;1(4):370–9. Zhao J, Mili L, Wang MA. Generalized false data injection attacks against power system nonlinear state estimator and countermeasures. IEEE Trans Power Syst 2018;33(5):4868–77. Li S, Yılmaz Y, Wang X. Quickest detection of false data injection attack in widearea smart grids. IEEE Trans Smart Grid 2017;6(6):2725–35. Guan Y, Ge X. Distributed attack detection and secure estimation of networked cyber-physical systems against false data injection attacks and jamming attacks. IEEE Trans Signal Inform Process Over Netw 2018;4(1):48–59. Wang X, Luo X, Guan X. Unknown cyber attack detection and isolation for power systems via Luenberger observer. International conference on information, cybernetics and computational social systems. 2017. p. 673–8. Varmaziari H, Dehghani M. Cyber-attack detection system of large scale power systems using decentralized unknown input observer. Electr Eng (ICEE) 2017:621–6. Luo XY, Yao Q, Wang XY, Guan XP. Observer-based cyber attack detection and isolation in smart grids. Int J Electr Power Energy Syst 2018;101(1):127–38. Wang X, Luo X, Pan Xueyang, Guan X. Detection and isolation of false data injection attack for smart grids via unknown input observers. IET Gener Transm Distrib 2019. https://doi.org/10.1049/ietgtd.2018.5139.

Applied Energy 256 (2019) 113703

X. Luo, et al. [32] Kurt MN, Yılmaz Y, Wang X. Distributed quickest detection of cyber-attacks in smart grid. IEEE Trans Inform Forensics Secur 2018;13(8):2015–30. [33] Nudell TR, Nabavi S, Chakrabortty A. A real-time attack localization algorithm for large power system networks using graph-theoretic techniques. IEEE Trans Smart Grid 2017;6(5):2551–9. [34] Xie L, Mo Y, Sinopoli B. False data injection attacks in electricity markets. IEEE international conference on smart grid communications. IEEE; 2010. p. 226–31. [35] An N, Weber S. Impact of sample size on false alarm and missed detection rates in PCA-based anomaly detection. In: 2017 51st annual conference on information sciences and systems (CISS). Baltimore, MD, USA: IEEE; March 2017. p. 22–4. [36] Dehghani M, Nikravesh S. State-space model parameter identification in large-scale power systems. IEEE Trans Power Syst 2008;23(3):1449–57. [37] Mi X, Wang J, Wang R. Stochastic small disturbance stability analysis of nonlinear multi-machine system with it? Differential equation. Int J Electr Power Energy Syst 2018;101:439–57. [38] Gu Ming. Anomaly detection based on chi-square statistic technology in computer

information system. Appl Mech Mater 2013;462–463:1046–9. [39] Wang 1X, Luo X, et al. Detection and isolation of false data inject attack in smart grids via nonlinear interval observer. IEEE Internet Things J 2019. https://doi.org/ 10.1109/JIOT. 2019.2916670. [40] Kaczorek T. Polynomial and rational matrices. London: Springer-Verlag; 2009. [41] Kaczorek T. Deterimination of positive stable realizations with system Metzler matrices. International conference on methods and models in automation and robotics. IEEE; 2011. p. 89–94. [42] Liu X, Li Z. False data attack models, impact analyses and defense strategies in the electricity grid. Int J Electr Power Energy Syst 2017;30(4):35–42. [43] Yu W, Griffith D, Ge L, et al. An integrated detection system against false data injection attacks in the Smart Grid. Secur Commun Netw 2015;8(2):91–109. [44] Smith Hal. Monotone dynamical systems: an introduction to the theory of competitive and cooperative systems. Ams Ebooks Program 1995;41(05):174. [45] Lorden G. Procedures for reacting to a change in distribution. Ann Math Stat 1971;42(6):1897–908.

19