[Paper Review] Secure State Estimation for Nonlinear Power Systems under Cyber Attacks

Qie Hu, Dariush Fooladivanda+2 more|arXiv (Cornell University)|Mar 22, 2016

Smart Grid Security and Resilience17 references4 citations

TL;DR

This paper proposes a secure state estimation framework for nonlinear power systems under cyber-physical attacks by transforming nonlinear dynamics into linear equations for classical error correction. It guarantees correction of up to ⌊N/4 + L/2 − 1⌋ corrupted measurements per time step and numerically demonstrates accurate attack signal reconstruction and stable system operation under attack.

ABSTRACT

This paper focuses on securely estimating the state of a nonlinear dynamical system from a set of corrupted measurements. In particular, we consider two broad classes of nonlinear systems, and propose a technique which enables us to perform secure state estimation for such nonlinear systems. We then provide guarantees on the achievable state estimation error against arbitrary corruptions, and analytically characterize the number of errors that can be perfectly corrected by a decoder. To illustrate how the proposed nonlinear estimation approach can be applied to practical systems, we focus on secure estimation for the wide area control of an interconnected power system under cyber-physical attacks and communication failures, and propose a secure estimator for the power system. Finally, we numerically show that the proposed secure estimation algorithm enables us to reconstruct the attack signals accurately.

Motivation & Objective

• Address the lack of secure state estimation methods for nonlinear cyber-physical systems under arbitrary sensor corruptions.
• Overcome limitations of prior linear system approaches that assume fixed attack sets or restrictive attack models.
• Enable secure wide area state estimation in interconnected power systems with dynamic attacks and communication failures.
• Provide analytical guarantees on the number of corruptions that can be perfectly corrected by the estimator.
• Demonstrate practical applicability through secure estimation in a real-world New England 39-bus power system model.

Proposed method

• Transform nonlinear power system dynamics into a set of linear equations using a state transformation technique.
• Apply classical error correction methods (e.g., LDPC or similar) to the equivalent linear system to detect and correct corrupted measurements.
• Model attacks as arbitrary corruptions with bounded cardinality, assuming only the number of corrupted sensors is known.
• Use phasor measurement units (PMUs) to collect synchronized measurements of rotor angles and speeds for state estimation.
• Integrate the secure estimator with wide area control systems (WACS) to reconstruct and feed back corrected measurements to local controllers.
• Leverage the structure of the system to decouple attack signals from state estimates using a decoder that corrects up to ⌊N/4 + L/2 − 1⌋ corruptions per time step.

Experimental results

Research questions

• RQ1 Can secure state estimation be effectively extended to nonlinear power systems under arbitrary cyber-physical attacks?
• RQ2 What is the maximum number of corrupted measurements that can be perfectly corrected in a nonlinear system using linear error correction techniques?
• RQ3 How does the proposed method maintain system stability and prevent loss of synchrony under dynamic attacks?
• RQ4 Can the estimator accurately reconstruct both attack signals and true system states in real time under communication failures?
• RQ5 What are the analytical guarantees on estimation error and correction capability in the presence of time-varying attacks?

Key findings

• The proposed estimator can correct up to ⌊N/4 + L/2 − 1⌋ corrupted measurements per time step, where N is the number of PMUs and L is the number of corrupted measurements per time step.
• The average number of correctable non-zero attack signals per time step is bounded by ⌊N/4 + L/2 − N/(2T)⌋, with T being the simulation length.
• Numerical results show that with secure estimation, generator 1’s phase angle deviates by only 2.9° from equilibrium (from 6.85° to [6.3°, 9.8°]), preventing loss of synchrony.
• Rotor speed remains within [59.95 Hz, 60.07 Hz], indicating minimal deviation from nominal 60 Hz under attack.
• The estimator accurately reconstructs both attack signals and true system states, as shown in Figure 2, with zero estimation error in most time steps.
• Without secure estimation, the phase angle of generator 1 reaches 159° within 7.3 seconds, indicating imminent loss of synchrony.