Cyber-physical systems are ubiquitous in power systems, transportation networks, industrial control processes, and critical infrastructures. These systems need to operate reliably in the face of unforeseen failures and external malicious attacks. In this paper: (i) we propose a mathematical framework for cyber-physical systems, attacks, and monitors; (ii) we characterize fundamental monitoring limitations from system-theoretic and graph-theoretic perspectives; and (ii) we design centralized and distributed attack detection and identification monitors. Finally, we validate our findings through compelling examples.

/pdf/attack-detection-and-identification-in-cyber-physical-3fy6vyw4zt.pdf

Attack Detection and Identification in Cyber-Physical Systems

Cyber-physical systems integrate computation, communication, and physical capabilities to interact with the physical world and humans. Besides failures of components, cyber-physical systems are prone to malignant attacks, and specific analysis tools as well as monitoring mechanisms need to be developed to enforce system security and reliability. This paper proposes a unified framework to analyze the resilience of cyber-physical systems against attacks cast by an omniscient adversary. We model cyber-physical systems as linear descriptor systems, and attacks as exogenous unknown inputs. Despite its simplicity, our model captures various real-world cyber-physical systems, and it includes and generalizes many prototypical attacks, including stealth, (dynamic) false-data injection and replay attacks. First, we characterize fundamental limitations of static, dynamic, and active monitors for attack detection and identification. Second, we provide constructive algebraic conditions to cast undetectable and unidentifiable attacks. Third, by using the system interconnection structure, we describe graph-theoretic conditions for the existence of undetectable and unidentifiable attacks. Finally, we validate our findings through some illustrative examples with different cyber-physical systems, such as a municipal water supply network and two electrical power grids.

Attack Detection and Identification in Cyber-Physical Systems -- Part I: Models and Fundamental Limitations

The emergence of synchronization in a network of coupled oscillators is a fascinating topic in various scientific disciplines. A widely adopted model of a coupled oscillator network is characterized by a population of heterogeneous phase oscillators, a graph describing the interaction among them, and diffusive and sinusoidal coupling. It is known that a strongly coupled and sufficiently homogeneous network synchronizes, but the exact threshold from incoherence to synchrony is unknown. Here, we present a unique, concise, and closed-form condition for synchronization of the fully nonlinear, nonequilibrium, and dynamic network. Our synchronization condition can be stated elegantly in terms of the network topology and parameters or equivalently in terms of an intuitive, linear, and static auxiliary system. Our results significantly improve upon the existing conditions advocated thus far, they are provably exact for various interesting network topologies and parameters; they are statistically correct for almost all networks; and they can be applied equally to synchronization phenomena arising in physics and biology as well as in engineered oscillator networks, such as electrical power networks. We illustrate the validity, the accuracy, and the practical applicability of our results in complex network scenarios and in smart grid applications.

/pdf/synchronization-in-complex-oscillator-networks-and-smart-1arg370cmc.pdf

Synchronization in complex oscillator networks and smart grids

We apply new bilevel and trilevel optimization models to make critical infrastructure more resilient against terrorist attacks. Each model features an intelligent attacker (terrorists) and a defender (us), information transparency, and sequential actions by attacker and defender. We illustrate with examples of the US Strategic Petroleum Reserve, the US Border Patrol at Yuma, Arizona, and an electrical transmission system. We conclude by reporting insights gained from the modeling experience and many “red-team” exercises. Each exercise gathers open-source data on a real-world infrastructure system, develops an appropriate bilevel or trilevel model, and uses these to identify vulnerabilities in the system or to plan an optimal defense.

/pdf/defending-critical-infrastructure-96d9t34vw8.pdf

Defending Critical Infrastructure

Spinning reserve (SR) allows system operators to compensate for unpredictable imbalances between load and generation caused by sudden outages of generating units, errors in load forecasting or unexpected deviations by generating units from their production schedules. As the proportion of power produced by wind farms increases, it becomes more difficult to predict accurately the total amount of power injected by all generators into the power system. This added uncertainty must be taken into account when setting the requirement for SR. This paper proposes a technique to calculate the optimal amount of SR that the system operator should provide to be able to respond not only to generation outages but also to errors in the forecasts for load and wind power production. Using a Monte Carlo simulation, the proposed technique for setting the SR requirements is then compared with the traditional deterministic criterion (i.e., the capacity of the largest online infeed), an approach to cope with wind imbalances and an approach that combines the traditional criterion with the approach to cope with wind imbalances. The results show that, contrary to what is commonly believed, an increased wind power penetration does not necessarily require larger amounts of SR.

Estimating the Spinning Reserve Requirements in Systems With Significant Wind Power Generation Penetration

This report describes an enhanced test system (RTS-96) for use in bulk power system reliability evaluation studies. The value of the test system is that it will permit comparative and benchmark studies to be performed on new and existing reliability evaluation techniques. The test system was developed by modifying and updating the original IEEE RTS (referred to as RTS-79 hereafter) to reflect changes in evaluation methodologies and to overcome perceived deficiencies.

The IEEE Reliability Test System-1996. A report prepared by the Reliability Test System Task Force of the Application of Probability Methods Subcommittee

Methods and indices are presented for measuring the actual bulk power system reliability of individual utilities. Categories of unreliability events are identified for measurement, and locations in the bulk system where measurements can be made are suggested. Data requirements and indices calculations are discussed. The proposed measurement system uses data available from utility operating reports, so that the cost of implementation is expected to be modest. >

Bulk system reliability-measurement and indices

Bulk system reliability ― measurement and indices (a report to IEEE working group on measurement indices)

An analytical tool is described for evaluating the reliability of subtransmission/distribution systems which have local hydraulic generation The local generation is normally used for peaking purposes It has energy and capacity limitations, so that it may only be able to partially alleviate transmission overhead The model includes outage phenomena such as generation scheduled outages, transmission individual forced outages, and transmission scheduled outages The overload relief operations include hydraulic generation dispatch and load transfer Daily variation of power flow is also modeled >

Reliability evaluation of sub-transmission networks with capacity and energy-limited hydraulic generation

Methods are presented for modeling the failure and repair of transmission equipment and their impact on subtransmission system reliability. The methods account for arbitrary load variation and nonexponential downtime distribution for components. The effects of single independent outages common-mode outages and independent overlapping outages are studied. The results are used to identify conditions when nonexponentially distributed downtimes can lead to significant errors if the method of analysis does not take this factor into account. >

C. C. Fong

Papers

The IEEE Reliability Test System-1996. A report prepared by the Reliability Test System Task Force of the Application of Probability Methods Subcommittee

Bulk system reliability-measurement and indices

Bulk system reliability ― measurement and indices (a report to IEEE working group on measurement indices)

Reliability evaluation of sub-transmission networks with capacity and energy-limited hydraulic generation

Transmission outage models for sub-transmission network reliability evaluation