[Paper Review] Statistical Structure Learning, Towards a Robust Smart Grid

Hanie Sedghi, Edmond Jonckheere|arXiv (Cornell University)|Mar 7, 2014

Smart Grid Security and Resilience15 references3 citations

TL;DR

This paper proposes a decentralized, hardware-free detection scheme for stealthy false data injection attacks in smart grids using statistical structure learning of bus voltage angles via the Conditional Covariance Test (CCT). It detects attacks by identifying discrepancies between the expected grid topology and the learned Markov graph of phase angles, successfully pinpointing attacked nodes with 100% detection rate and a false alarm rate of 3.82×10⁻⁵.

ABSTRACT

Robust control and maintenance of the grid relies on accurate data. Both PMUs and state estimators are prone to false data injection attacks. Thus, it is crucial to have a mechanism for fast and accurate detection of an agent maliciously tampering with the data---for both preventing attacks that may lead to blackouts, and for routine monitoring and control tasks of current and future grids. We propose a decentralized false data injection detection scheme based on Markov graph of the bus phase angles. We utilize the Conditional Covariance Test (CCT) to learn the structure of the grid. Using the DC power flow model, we show that under normal circumstances, and because of walk-summability of the grid graph, the Markov graph of the voltage angles can be determined by the power grid graph. Therefore, a discrepancy between calculated Markov graph and learned structure should trigger the alarm. Local grid topology is available online from the protection system and we exploit it to check for mismatch. Should a mismatch be detected, we use correlation anomaly score to detect the set of attacked nodes. Our method can detect the most recent stealthy deception attack on the power grid that assumes knowledge of bus-branch model of the system and is capable of deceiving the state estimator, damaging power network observatory, control, monitoring, demand response and pricing schemes. Specifically, under the stealthy deception attack, the Markov graph of phase angles changes. In addition to detect a state of attack, our method can detect the set of attacked nodes. To the best of our knowledge, our remedy is the first to comprehensively detect this sophisticated attack and it does not need additional hardware. Moreover, our detection scheme is successful no matter the size of the attacked subset. Simulation of various power networks confirms our claims.

Motivation & Objective

• Address the critical need for real-time detection of stealthy false data injection attacks that can evade traditional state estimators in power systems.
• Develop a mechanism that detects attacks without relying on additional PMUs or centralized data collection, ensuring scalability and privacy.
• Enable both detection of attack presence and identification of the specific set of compromised nodes in the grid.
• Overcome limitations of prior methods that fail under multi-node attacks or require high computational complexity.
• Ensure robustness against attacks manipulating both active and reactive power measurements, including those that could trigger voltage collapse.

Proposed method

• Utilizes the DC power flow model to establish that the Markov graph of bus phase angles should align with the physical grid topology under normal conditions.
• Employs the Conditional Covariance Test (CCT) to learn the statistical structure (Markov graph) of bus voltage angles from PMU or state estimator measurements.
• Compares the learned Markov structure with the known physical grid topology to detect discrepancies indicating potential attack.
• Uses local sub-network topology (available from protection systems) to enable decentralized, real-time detection at each grid region.
• Applies a correlation anomaly score metric to identify the specific set of attacked buses when a structural mismatch is detected.
• Leverages the walk-summability property of the grid graph to ensure theoretical validity of the Markov graph's structure under normal operation.

Experimental results

Research questions

• RQ1 Can a decentralized, hardware-free method detect stealthy false data injection attacks that evade conventional state estimators?
• RQ2 How can the statistical structure of bus voltage angles be used to detect anomalies in grid operation without relying on additional sensors?
• RQ3 To what extent can the method identify the exact set of attacked buses, even when multiple nodes are compromised?
• RQ4 How does the method perform under varying attack sizes, particularly small attacks that may not trigger conventional alarms?
• RQ5 Can the method detect attacks that manipulate reactive power measurements, which may lead to voltage instability or collapse?

Key findings

• The method achieves 100% detection rate for stealthy deception attacks on the IEEE 14-bus system, even at low attack sizes (e.g., 0.3), with a very low false alarm rate of 3.82×10⁻⁵.
• The anomaly score metric successfully distinguishes attacked nodes (e.g., buses 4, 5, 6) from normal ones, with increasing separation as attack size increases.
• The approach is robust to attacks on any number of nodes, with computational complexity that remains polynomial and scalable to large systems like IEEE-118 and IEEE-300.
• The method detects attacks that manipulate both active and reactive power measurements, including those that could induce voltage collapse.
• The use of the Markov graph structure based on the grid topology enables decentralized operation, reducing communication overhead and improving real-time performance.
• The technique is the first to comprehensively detect sophisticated stealthy attacks that assume knowledge of the bus-branch model and can deceive standard state estimators.