Vulnerability assessment is a requirement of NERC's cybersecurity standards for electric power systems. The purpose is to study the impact of a cyber attack on supervisory control and data acquisition (SCADA) systems. Compliance of the requirement to meet the standard has become increasingly challenging as the system becomes more dispersed in wide areas. Interdependencies between computer communication system and the physical infrastructure also become more complex as information technologies are further integrated into devices and networks. This paper proposes a vulnerability assessment framework to systematically evaluate the vulnerabilities of SCADA systems at three levels: system, scenarios, and access points. The proposed method is based on cyber systems embedded with the firewall and password models, the primary mode of protection in the power industry today. The impact of a potential electronic intrusion is evaluated by its potential loss of load in the power system. This capability is enabled by integration of a logic-based simulation method and a module for the power flow computation. The IEEE 30-bus system is used to evaluate the impact of attacks launched from outside or from within the substation networks. Countermeasures are identified for improvement of the cybersecurity.

Vulnerability Assessment of Cybersecurity for SCADA Systems

Throughout the history of power system protection, researchers have strived to increase sensitivity and speed of apparatus protection systems without compromising security. With the significant technological advances in wide-area measurement systems, for transmission system protection, current differential protection scheme outscores alternatives like overcurrent and distance protection schemes. Therefore, in this paper, we address this challenge by proposing a methodology for adaptive control of the restraining region in a current differential plane. First an error analysis of conventional phasor approach for current differential protection is provided using the concept of dynamic phasor. Subsequently, we extend the methodology for protection of series compensated transmission lines. Finally, we also evaluate the speed versus accuracy conflict using phasorlets. Electromagnetic Transient Program simulations are used to substantiate the claims. The results demonstrate the utility of the proposed approach.

Adaptive Current Differential Protection Schemes for Transmission-Line Protection

This paper presents a risk assessment method for evaluating the cyber security of power systems considering the role of protection systems. This paper considers the impact of bus and transmission line protection systems located in substations on the cyber-physical performance of power systems. The proposed method simulates the physical response of power systems to malicious attacks on protection system settings and parameters. The relationship among settings of protection devices, protection logics, and circuit breaker logics is analyzed. The expected load curtailment (ELC) index is used in this paper to quantify potential system losses due to cyber attacks. The Monte Carlo simulation is applied to calculate ELC for assessing attackers’ capabilities as bus arrangements are altered. The effectiveness of the proposed risk assessment method is demonstrated using a 9-bus system and the IEEE 68-bus system.

Power System Risk Assessment in Cyber Attacks Considering the Role of Protection Systems

As a result of small fault current, high level of noise and a large penetration of distributed generators (DG), in the neutral non-effectively grounded medium-voltage (MV) distribution networks, it is quite difficult to locate the faulted line section for single phase to ground faults. In this paper, using a technique based on synchronized measurements in distribution networks, a fault location method based on the analysis of the energy of the transient zero-sequence current in the selected frequency band (SFB) is proposed. The equivalent impedance of the distribution network with lateral branches is studied with an equivalent network, and the phase-frequency characteristics of the equivalent impedance are analyzed. The SFB, within which the transient energy of the faulty line section is larger than that of the healthy line sections is determined. A combined fault-section location criterion is proposed and the implementation scheme is illustrated with the distribution level phasor measurement units. Numerical simulations of the IEEE 34 node system and the field experiments of a 10kV distribution network validate the feasibility and effectiveness of the proposed method.

/pdf/location-of-single-phase-to-ground-faults-in-distribution-25w22vsce9.pdf

Location of Single Phase to Ground Faults in Distribution Networks Based on Synchronous Transients Energy Analysis

This paper presents an anomaly-based methodology for reliable detection of integrity attacks in cyber-physical critical infrastructures. Such malicious events compromise the smooth operation of the infrastructure while the attacker is able to exploit the respective resources according to his/her purposes. Even though the operator may not understand the attack, since the overall system appears to remain in a steady state, the consequences may be of catastrophic nature with a huge negative impact. Here, we apply a computational intelligent technique which incorporates the merits of two of the heterogeneous modeling approaches (linear time-invariant and neural networks), while considering both temporal and functional dependencies existing among the elements of an infrastructure. The experimental platform includes a power grid simulator of the IEEE 30 bus model and a cyber network emulator. Subsequently, we implemented a wide range of integrity attacks (replay, ramp, pulse, scaling, and random) with different intensity levels. A thorough evaluation procedure is carried out while the results demonstrate the ability of the proposed method to produce a desired result in terms of false positive rate, false negative rate, and detection delay.

Detection of Integrity Attacks in Cyber-Physical Critical Infrastructures Using Ensemble Modeling

This paper proposes a multiagent-based adaptive wide-area current differential protection system. A power grid is divided into primary and backup protection zones dynamically online with the help of a developed expert system, and the relay agents of these zones cooperate to perform a differential relaying function. Predictive self-healing strategies have been proposed to prevent misoperation of the relay agent, and the communication system has been simulated. The performance of the proposed adaptive wide-area current differential protection system based on computer simulation is presented in this paper.

Adaptive Agent-Based Wide-Area Current Differential Protection System

Many mine power systems operate with a floating neutral or are high-resistance grounded, and earth fault current is no more than a few tens of amperes. Traditional earth-fault-detection methods based on zero-sequence current have poor sensitivity in this case. For improvement, a fault-detection scheme with fault-current and fault-resistance measurement is presented in this paper, which is capable of detecting high-impedance ground faults. The scheme has been verified by electromagnetic-transient-program simulation, and a fault-detection prototype has been developed and tested in the laboratory. Results show that the scheme has high sensitivity and robustness.

Ground-Fault Feeder Detection With Fault-Current and Fault-Resistance Measurement in Mine Power Systems

Summary form only given. With the development of substation automation system, it is now feasible for the intelligent electronic devices (lEDs) based protection system to collect its measurements from electronic instrument transformers through communication network such as Ethernet based LAN. Application of wide area broadband network in power utilities introduces underlying danger for protection system to mal-operate when receiving fake data packages from intruder. This paper proposes to identify vicious fault using context information such as voltage and current of the same substation. When protection system detects fault based on measurements transmitted through network, it collects all measurements of the substation and feed these data to a Probabilistic Neural Network (PNN). Thereafter, the fault caused by fake data that differs from the known fault pattern can be identified and blocked.

Xiangjun Zeng

Papers

Adaptive Agent-Based Wide-Area Current Differential Protection System

Ground-Fault Feeder Detection With Fault-Current and Fault-Resistance Measurement in Mine Power Systems

Context Information based Cyber Security Defense of Protection System