Cyber-Security Analysis of State Estimators in Power Systems

Size: px

Start display at page:

Download "Cyber-Security Analysis of State Estimators in Power Systems"

Marshall Blair
8 years ago
Views:

1 Cyber-Security Analysis of State Estimators in Electric Power Systems André Teixeira 1, Saurabh Amin 2, Henrik Sandberg 1, Karl H. Johansson 1, and Shankar Sastry 2 ACCESS Linnaeus Centre, KTH-Royal Institute of Technology 1 TRUST Center, UC Berkeley 2 Conference on Decision and Control December 17th, 2010

Johansson 1, and Shankar Sastry 2 ACCESS Linnaeus Centre, KTH-Royal

2 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

3 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

4 Power Systems Failure Consequences Normal failures have huge impact - US-Canada 2003 Blackout What about intentional failures?

5 Problem Formulation Deception Attacks on the SE Attacker a Control Center z = h(x) + State Estimator ˆx r = z ẑ Bad Data Detection Alarm! ˆx Power Grid Contingency Analysis Optimal Power Flow u Operator u Most of the theory developed from the 70 s to the 90 s assumes the data corruption comes from nature noise A framework to analyze this system under malicious data corruption is lacking!

ˆx Power Grid Contingency Analysis Optimal Power Flow u Operator u Most of the theory developed

6 Problem Formulation Relevant Questions/Objectives Questions Can malicious attackers generate stealthy deception attacks, with perfect model knowledge? [Liu et al. 2009] Can malicious attackers generate stealthy deception attacks, without perfect model knowledge? [This paper] How to reasonably model the attacker? [This paper] How hard is it to perform stealthy deception attacks? [Sandberg et al. 2010, Dán et al. 2010] How to deploy protective resources? [Bobba et al. 2010, Dán et al. 2010] Objectives Provide a (comprehensive) framework to analyze control systems under malicious data corruption.

[This paper] How to reasonably model the attacker? [This paper] How hard is it to perform stealthy deception attacks? [Sandberg et al.

7 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

8 Background State Estimation Steady-State Model: z = h(x) + ɛ Ex.: P 14 = V 1 V 4 b 14 sin(θ 1 θ 4 ) measurements: z R m state: x R n nonlinear model: h(x) Gaussian noise: ɛ N (0, R) Nonlinear Weighted Least-Squares: ˆx = arg min x R n 2 r(x) R 1 r(x), where r(x) = z h(x) is the measurement residual Local Linear Approximation around origin (z = Hx + ɛ): ˆx = [ H R 1 H ] 1 H R 1 z H = h x (ˆx 0 ) - the Jacobian matrix (tall and sparse)

(0, R) Nonlinear Weighted Least-Squares: 1 2 3 4 5 6 1 ˆx = arg min x R n 2 r(x) R 1 r(x), where r(x) = z h(x)

9 Background Normalization Normalization: z = R 1/2 z ɛ = R 1/2 ɛ H = R 1/2 H ˆx = H z ẑ = H H z = K z r = (I K) z = S( Hx + ɛ) = S ɛ ɛ N (0, I ) Main useful concepts: K is the orthogonal projector onto Im( H), since K K = K = K S = (I K) is the orthogonal projector onto Ker( H ) Im( H) Ker( H ) Sa = 0 a Im( H) [Clements et al. 81, Liu et al. 09]

the orthogonal projector onto Im( H), since K K = K = K S = (I K) is the orthogonal

10 Background Bad Data Detection Hypothesis test: H 0 : No bad data is present (null hypothesis) H 1 : Bad data is present (alternative hypothesis) Performance index test: J(ˆx) = ɛ S ɛ χ 2 m n: accept H 0 if r 2 τ χ (α) Largest normalized residual test: r(ˆx) N (0, S), D = diag( S): accept H 0 if D 1/2 r τ N (α) α [0, 1] is the false alarm rate, i.e. P(H 1 H 0 ). General expression: Wr(ˆx) p < τ, for suitable W, p and τ.

τ χ (α) Largest normalized residual test: r(ˆx) N (0, S), D = diag( S): accept H 0 if D 1/2 r τ N (α) α

11 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

12 Stealthy Deception Attacks Attacker Model Corrupted measurements: z a = z + a Attacker Goals Convergence of the estimator (trivial for the linear case); Stealthiness: Wr(ˆx a ) p < τ; Induce a desired bias on a subset of measurements Minimum Effort Attack Synthesis min a p a s.t. a G, a U G - set of goals U - class of stealthy attacks Different metrics for effort p = 0: cardinality of a (# of measurements to be corrupted) - not convex p = 1: may be used as a convex approximation of p = 0 p = 2: is related to measurement redundancy in the system All quantify how hard it is to attack the estimator, for a given set of goals [Sandberg et al. 10]

class of stealthy attacks Different metrics for effort p = 0: cardinality of a (# of measurements to be corrupted) - not convex p = 1: may be used as a convex

13 Stealthy Deception Attacks Class of Stealthy Attacks Stealthy attacks with Perfect Model Knowledge a Im( H) a U [Clements et al. 81, Liu et al. 09] a Im( H) c : a = Hc Guaranteed that r( z a ) = S( z + a) = S z = r( z) P(H 1 H 1 ) = P(H 1 H 0 )

14 Stealthy Deception Attacks Class of Stealthy Attacks Stealthy attacks with Perturbed Model Knowledge Known model is H = H + H Let the same policy be used: a = Hc, for some c. r( z a ) = S ɛ + Sa Sa 0 P(H 1 H 1 ) P(H 1 H 0 ): No perfect stealthiness Relaxation - Allow for a maximum detection risk tolerated by the attacker, δ : P(H 1 H 1 ) P(H 1 H 0 ) + δ. Depends on the detection scheme! What is the class of attacks satisfying such condition? Solution steps: Given a detection scheme, α, and δ, obtain λ : Sa p λ P(H 1 H 1 ) P(H 1 H 0 ) + δ Given λ, obtain β : a p β Sa p λ Then a p β a U

r( z a ) = S ɛ + Sa Sa 0 P(H 1 H 1 ) P(H 1 H 0 ): No perfect stealthiness Relaxation - Allow for a maximum detection risk tolerated by the

15 Stealthy Deception Attacks Perturbed Model Knowledge - Performance Index Test Performance index test Under attack, J a (ˆx) χ 2 m n(λ) where λ = Sa 2 2 (noncentrality parameter). r a = Sa corresponds to the residual bias due to the attack (recall r( z a ) = S ɛ + Sa) An attack is δ-stealthy if P(H 1 H 1 ) = P(J a > τ χ (α)) P(H 1 H 0 ) + δ: τ χ(α) g λ (u)du α + δ. (1)

r a = Sa corresponds to the residual bias due to the attack (recall r( z a ) = S ɛ + Sa) An

16 Stealthy Deception Attacks Perturbed Model Knowledge - Performance Index Test Assumption P(H 1 H 1 ) increases monotonically with λ. Proposition Given α and δ, an attack is δ-stealthy regarding the performance index test if the following holds r a 2 2 = Sa 2 2 λ(α, δ) where λ(α, δ) is the maximum value of λ for which (1) is satisfied.

Proposition Given α and δ, an attack is δ-stealthy regarding the performance index

17 Stealthy Deception Attacks Perturbed Model Knowledge - Residual Bounds Known results [Galántai 06]: Definition Let M 1 and M 2 be subspaces of C m. The smallest principal angle γ 1 [0, π/2] between M 1 and M 2 is defined by cos(γ 1 ) = max u M 1 max v M 2 u H v subject to u = v = 1 Lemma Let P 1, P 2 R m m be orthogonal projectors of M 1 and M 2, respectively. Then the following holds P 1 P 2 2 = cos(γ 1 )

The smallest principal angle γ 1 [0, π/2] between M 1 and M 2 is defined by cos(γ 1 ) = max u M 1 max

18 Stealthy Deception Attacks Perturbed Model Knowledge - Residual Bounds Applying the previous results we have: Proposition Let γ 1 be the smallest principal angle between Ker( H ) and Im( H). The residual increment due to a deception attack, r a, following the policy a = Hc satisfies r a 2 cos γ 1 a 2. Proof. Recall r( z a ) = S z a = S z + Sa = r + r a. a = Hc a Im( H) a = Ka. r a = S Ka r a 2 S K 2 a 2.

The residual increment due to a deception attack, r a, following the policy a = Hc satisfies r a 2

19 Stealthy Deception Attacks Performance Index Test - Class of Stealthy Attacks Theorem Given the perturbed model H, the false-alarm probability α and the maximum admissible risk δ, an attack following the policy a = Hc is stealthy regarding the performance index test if a 2 β(α, δ), where β(α, δ) = λ(α, δ) cos γ 1.

maximum admissible risk δ, an attack following the policy a = Hc is stealthy

20 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

21 Simulation Example Worst-Case Uncertainty Consider the 6 bus system with the following branch parameters: The attacker s model H has the correct topology and a ±20% error in the parameters. The parameter errors were numerically computed so that S K 2 = cos γ 1 is maximized. Objective: induce a unit bias in z b1, i.e. have a b1 = 1, without being detected.

22 Simulation Example Worst-Case Uncertainty 9 χ 2 8 LNR a* β(0.05,δ) δ (Risk Increase) Upper bound on the attack vector as a function of the detection risk. The solid line represents the 2-norm of the optimal attack vector a constrained by a b1 = 1 The curves denoted as χ 2 and LNR represent the value of β(0.05, δ) for the performance index test and largest normalized residual test.

23 Outline 1 Introduction Motivation Problem Formulation 2 Background 3 Stealthy Deception Attacks 4 Simulation Example 5 Final Remarks

24 Final Remarks The proposed framework can also be applied to other structured uncertain models such as models with missing rows/measurements; with missing columns; obtained from data analysis. The optimization framework for attack synthesis enables the embedding of constraints such as encrypted measurements; pseudo-measurements; finite resources; The proposed framework has been applied to a real SCADA/EMS software - submitted to the IFAC World Congress 2011

Deception Attacks on the State Estimator

: Deception Attacks on the State Estimator, György Dán, Henrik Sandberg, Karl H. Johansson ACCESS Linnaeus Centre, KTH Royal Institute of Technology IFAC World Congress 2011 September 1st, 2011 The story