Electrical power grids are vulnerable to cyber attacks, as seen in Ukraine in 2015, 2016, and 2022. These cyber attacks are classified as Advanced Persistent Threats (APTs) with potential disastrous consequences such as a total blackout. However, state-of-the-art intrusion detection systems are inadequate for APT detection owing to their stealthy nature and long-lasting persistence. Furthermore, they are ineffective as they focus on individual anomaly instances and overlook the correlation between attack instances. Therefore, this research proposes a novel method for spatio-temporal APT detection and correlation for cyber-physical power systems. It provides online situational awareness for power system operators to pinpoint system-wide anomaly locations in near real-time and preemptively mitigate APTs at an early stage before causing adverse impacts. We propose an Enhanced Graph Convolutional Long Short-Term Memory (EGC-LSTM) by using sequential and neural network filters to improve APT detection, correlation, and prediction. Control center and substation communication traffic is used to determine cyber anomalies using semi-supervised deep packet inspection and software-defined networking. Power grid circuit breaker status is used to determine physical anomalies. Cyber-physical anomalies are correlated in cyber-physical system integration matrix and EGC-LSTM. The EGC-LSTM outperforms existing state-of-the-art spatio-temporal deep learning models, achieving the lowest mean square error.@en

Cyber actors can target the unsecured IEC 61850 protocols in digital substations to open circuit breakers and affect the power system operation. Thus, system operators must detect cyber-physical anomalies and differentiate in real-time between power system faults and cyber attacks on digital substations for effective incident response. In this work, we propose a novel image encoding method for event correlation using cyber-physical time-series data, i.e., Phasor Measurement Units (PMUs) and Operational Technology (OT) network traffic. More specifically, we propose a dynamic variation of the Gramian Angular Field method, which generates image streams capturing in real-time the spatial-temporal features in PMU measurements and IEC 61850 GOOSE traffic throughput. The proposed method for cyber-physical event correlation uses an image fusion technique. The method is tested using the benchmark IEEE 9-bus system. It successfully distinguishes between three-phase faults and GOOSE cyber attacks, demonstrating its usefulness for power system cyber security analytics.

@en

The increasing risk of cyber-physical attacks (CPAs) on power infrastructure has led to need for reliable detection technologies. As the landscape of cyber threats evolves, it becomes imperative to continually update and enhance attack detection techniques. This research investigates the formulation of detection algorithm, via combination of State Partition Particle Filter (SP-PF) theories for power system security. The proposed approach applies intelligent partitioning of the state space so as to be accurately represented with fewer particles. This reduction in computational demand enhances the algorithm’s efficiency, making it more practical for real-time applications. The detection algorithm based on SP-PF is tested against switching attacks (SAs) launched on the governor and excitation systems associated with the generator. The RTDS platform is utilized for conducting real-time simulations of IEEE 9-bus power network in order to demonstrate the efficacy of proposed SP-PF based detection SA in real-time.@en

Power grid digitalization introduces new vulnerabilities and cyber security threats. The impact of cyber attacks on power system stability is a topic of growing concern, which is yet to be comprehensively analyzed. Traditional power system stability analysis is based on the impact of non-malicious small, and large physical disturbances. However, cyber attacks introduce a new dimension to power system stability, in which malicious cyber actors can selectively target critical systems and applications and cause severe stability issues. Hence, in this work, the traditional disturbances considered in power system stability classification are expanded from physical to cyber-physical disturbances caused by cyber attacks. Based on a thorough state-of-the-art, an analysis of how cyber attacks can translate into physical disturbances affecting the traditional power system stability categories is performed. The system stability analysis is expanded by mapping the power system stability categories with the defined cyber-physical attack types. The findings of this work showcase the importance of cyber security for power system stability.@en

The virtual integration of geographically distributed RI for joint experiments in the domain of power and energy systems poses numerous challenges, particularly in terms of tool compatibility and user-friendliness. To address some of these challenges, this work presents the development and implementation of a laboratory-based middleware and data exchange service as part of the H2020 ERIGrid 2.0 project. The middleware comprises a suite of shared software tools and services designed to seamlessly integrate RIs including transport protocols as well as interface semantics. Specifically, this work details the development of a simplified and standardised interface known as the UAPI. It eliminates the need for users to grapple with the diverse intricacies of each individual RI, offering instead a tool-agnostic and standardised interface for conducting joint experiments. The work also presents and discusses the results of a real-world case study of a geographically distributed, sector-coupling experiment conducted between laboratories in Denmark, Greece, Italy, Netherlands, and Norway utilising the developed middleware.@en

Cyber security risks are emerging in Cyber-Physical power Systems (CPS) due to the increasing integration of cyber and physical infrastructures. Critical component identification is a crucial task for the mitigation and prevention of catastrophic blackouts. In this paper, we propose a novel method using graph data mining for critical CPS components identification named GraphCCI. First, it defines two categories of component correlations to reveal the cascading features of CPS. GraphCCI maps cascading failure datasets under time-varying operational states into weighted cascading graphs and constructs a graph database for graph data mining. By adopting graph data mining techniques, frequent subgraphs are identified to construct the Cascading Characteristics Graph (CC-Graph). Finally, the Node Criticality Index (NC-Index) is proposed to quantify the criticality of each CPS component. The experimental results on the IEEE 39-bus system verify the effectiveness of the proposed method and present an in-depth analysis of the CPS cascading features.@en

This article implements and validates the performance of a virtual intelligent electronic device (vIED) framework for digital substations using a real-time (RT) simulation environment. The work looks toward the future design of protection, automation, and control systems, an evolution of the digital substation design based on IEC 61850 and virtualization technology. An RT simulation setup was developed to speed up and enhance the deployment and maintenance of vIEDs with a novel well-defined test methodology. Several scenarios were tested by varying the number of vIEDs and relevant (communication, scalability, and functionality) configuration criteria. In addition, we assessed the efficiency of a software-defined communication network for the vIED framework and its adaptability to dynamic scaling of the network under transient data traffic loads. The tests demonstrated the efficient performance of vIEDs across various system configurations, particularly for requirements on the response time and network transfer latency. The findings showcase the significance of proper design and testing methodology that can be benchmarked against other virtualization platforms for substation systems.@en

Today's critical infrastructure systems are more interconnected and dependent on the electric power grid. This interdependence means that disruptions in one system can have far-reaching consequences across many others. This is particularly evident when a cyberattack in the power grid leads to widespread outages and disrupts essential societal services. To prevent such disasters, it is crucial that proactive actions are taken to secure our power grid control centers and digital substations. This is where digital twins (DTs) play an important role: By creating virtual replicas of cyberphysical assets and processes, DTs allow system operators to anticipate and address potential vulnerabilities in our cybersecurity defenses before they can be exploited. As such, a DT can be considered as a key contributor to safeguard the power system against cyberattacks. This article examines the potential future benefits of DTs in enabling a cybersecure and resilient power grid, explores multiple use cases, and proposes a path forward.@en

Cascading failures in power systems are extremely rare occurrences caused by a combination of multiple, low probability events. The looming threat of cyberattacks on power grids, however, may result in unprecedented large-scale cascading failures, leading to a blackout. Therefore, new analysis methods are needed to study such cyber induced phenomena. In this article, we propose a data-driven method for dynamical analysis of power system cascading failures caused by cyberattacks. We provide experimental proof on how attacks may accelerate the cascading failure mechanism, in comparison to historically observed blackouts. Using a dynamic power grid model, consisting of multiple, coordinated protection schemes, we define and analyze the point of no return in a cascading failure sequence by applying the Hilbert-Huang transform for time-frequency analysis. Numerical results indicate, cyberattacks may accelerate cascading failures at least by a factor of 3x. This is due to the excitation and non-damping of multiple frequency modes greater than 1 Hz in a short time span. The proposed method is tested using time domain simulations conducted through a modified IEEE 39-bus test system, which can simulate cascading outages using coordinated protection schemes.

@en

Synthetic networks aim to generate realistic projections of real-world networks while concealing the actual system information. Researchers have mainly explored methods to create synthetic power systems. However, with the rapid power grid digitalization, new methods are needed for synthetic communication networks of cyber–physical power systems (CPPS). In this article, we propose a two-stage generative model for generating synthetic communication topologies of large-scale CPPS based on the existing power grids. It reproduces the existing communication network design process and is capable of generating statistically realistic networks. The proposed method is implemented to create a realistic, large-scale synthetic CPPS for the interconnected power grids in continental Europe. The method is validated by comparing the generated communication network with 18 realistic communication network topologies with different system sizes. The experimental results validate the scalability and effectiveness of the generative model.@en

Cyber-physical power systems are susceptible to cyber threats and attacks that can lead to cascading failures and widespread power outages. Therefore, mitigating the impact of such attacks requires the timely implementation of operational strategies to prevent cascading blackouts. One Such strategy is the controlled islanding of the affected power grid, serving as a last resort against the propagation of the cascading outages. In this context, this paper introduces a novel detection-informed operational mitigation strategy, i.e., controlled islanding, against cyberattack-induced cascading failures, addressing 'when' and 'where' to implement controlled islanding. The proposed strategy leverages dynamic cascading failure modeling to quantify the impact of ongoing cyberattacks on power grids, using quantitative metrics such as demand-not-served (DNS). For effective operational mitigation, the strategy initiates controlled islanding when any attack, including fabricated protection trip commands and measurements' replay attacks, are detected, and any operating limits, such as line loading, are violated. It then proceeds to the implementation of controlled islanding, where identified cyberattack-affected elements are effectively surrounded by stable and self-sufficient islanded areas, while minimizing the system DNS. Numerical results on the IEEE 39-bus system demonstrate the effectiveness of the proposed strategy, reducing the DNS value by up to 47% when the controlled islanding strategy is implemented.

@en

The amount of power electronic interfaced generation (PEIG) is significantly proliferating in modern cyber-physical energy systems (CPESs). The limited capabilities (e.g. inertia, over-current) of PEIG, together with their location and technology-specific designed control systems, alter the dynamic properties of different types of stability phenomena, e.g. sub-synchronous oscillations (SSOs). A poorly damped SSO can emerge, within a sub-second time scale, through conflicting inter-actions between the controls of PEIG and the dynamic response of the surrounding electrical network. This paper focuses on the modelling and assessment of such interactions, with emphasis on the integration of large-size full converter (a.k.a. type-4) based wind power plants (WPPs). By combining different analysis tools, the implemented model supports sensitivity assessment of the occurrence and observability of a poorly damped SSO. State-space model based eigenanalysis is iteratively used to ascertain damping variability of a dominant SSO, excited by inappropriate controller settings of the WPP. Power spectral density (PSD) analysis is used to qualitatively estimate the degree of observability of the poorly damped SSO across different buses of a CEPS. Numerical tests are performed on a modified version of the IEEE-39 bus system by using DIgSILENT PowerFactory 2022 SP1. Suggestions are provided for the deployment of data generated from phasor measurement units (PMUs) in the monitoring and wide-area damping control of critical SSOs.@en

This paper presents a methodology to distinguish between three-phase faults and GOOSE cyber attacks, aimed at opening the circuit breakers in the power grid. We propose a scheme that utilizes Phasor Measurement Unit (PMU)-enabled monitoring of power grid states, and communication network packet logs in the substation. In this scheme, by leveraging both cyber and physical data correlations and applying a Seasonal Autoregressive Moving Average (SARMA) model, we successfully distinguish between 3-phase faults and cyber attacks. The proposed scheme is tested using the benchmark IEEE 9-bus system, and can distinguish cyber attacks from faults in less than 0.2s. This demonstrates the usefulness of the proposed scheme for power system cyber security analytics.@en

Synthetic networks aim at generating realistic projections of real-world networks while concealing the actual system information. This paper proposes a scalable and effective approach based on graph neural networks (GNN) to generate synthetic topologies of Cyber-Physical power Systems (CPS) with realistic network feature distribution. In order to comprehensively capture the characteristics of real CPS networks, we propose a generative model, namely Graph-CPS, based on graph variational autoencoder and graph recurrent neural networks. The method hides the sensitive topological information while maintaining the similar feature distribution of the real networks. We used multiple power and communication networks to prove and assess the effectiveness of the proposed method with experimental results.@en

The solar industry in residential areas has been witnessing an astonishing growth worldwide. At the heart of this transformation, affecting the edge of the electricity grid, reside smart inverters (SIs). These IoT-enabled devices aim to introduce a certain degree of intelligence to conventional inverters by integrating various grid support capabilities (e.g., voltage and frequency control). However, with the remarkable automation of these devices come enormous security risks. Thus, rising rates of vulnerabilities have increased the necessity for designing resilient, auditable, and secure SIs' firmware over the air (FOTA) amendment schemes suitable for this heterogeneous SIs-based ecosystem. In this regard, we propose leveraging blockchain as an innovative technology to guarantee these cybersecurity requirements. In this article, we present the design of a distributed FOTA scheme, namely, RASSIFAB, governing the process of amending SIs' firmware within residential areas in an immutable and scalable manner. The scheme was implemented on a blockchain test network to assess its functionalities and performance. We also carried out a security evaluation to determine whether RASSIFAB is resistant to various identified threats. The obtained results confirm that the scheme is efficient and sound. They also indicate that RASSIFAB ensures reliable and authentic firmware amendments even with malicious insiders, differentiating our framework from the existing ones.

@en

As power system's operational technology converges with innovative information and communication technologies, the need for extensive resilience testing for scenarios covering the electrical grid, networking bottlenecks, as well as cyber security threats, become a necessity. This paper proposes a comprehensive, multi-disciplinary simulation framework to test virtualized intelligent electronic devices (vIEDs), considering 1) functional requirements, 2) performance and quality of service of the underlying communication network using software-defined networking, and 3) cyber security intrusion detection schemes. This work serves as a reference for researchers interested in the grid modernization of information and communication infrastructure for future power systems. Six different cyber security attack surfaces have been identified within the framework scope. It was observed that migration of vIEDs due to device maintenance or external anomalies is interesting from an operational perspective yet still poses significant security threats. Therefore, both host-based and network-based intrusion detection schemes were analyzed. Also, the setup has been mapped to an offshore wind case study demonstrating its potential and possible scenarios to simulate.@en

Electrical power grids are vulnerable to cyber attacks, as seen in Ukraine in 2015 and 2016. However, existing attack detection methods are limited. Most of them are based on power system measurement anomalies that occur when an attack is successfully executed at the later stages of the cyber kill chain. In contrast, the attacks on the Ukrainian power grid show the importance of system-wide, early-stage attack detection through communication-based anomalies. Therefore, in this paper, we propose a novel method for online cyber attack situational awareness that enhances the power grid resilience. It supports power system operators in the identification and localization of active attack locations in Operational Technology (OT) networks in near real-time. The proposed method employs a hybrid deep learning model of Graph Convolutional Long Short-Term Memory (GC-LSTM) and a deep convolutional network for time series classification-based anomaly detection. It is implemented as a combination of software defined networking, anomaly detection in communication throughput, and a novel attack graph model. Results indicate that the proposed method can identify active attack locations, e.g., within substations, control center, and wide area network, with an accuracy above 96%. Hence, it outperforms existing state-of-the-art deep learning-based time series classification methods.@en

The cyber attacks in Ukraine in 2015 and 2016 demonstrated the vulnerability of electrical power grids to cyber threats. They highlighted the significance of Operational Technology (OT) communication-based anomaly detection. Many anomaly detection methods are based on real-time traffic monitoring, i.e., Intrusion Detection Systems (IDS) that may produce false positives and degrade the OT communication performance. Security Operations Center (SOC) needs intelligent tools to conduct forensic analysis on generated IDS alarms and identify the attack locations. Therefore, in this paper, we propose a novel, graph-based forensic analysis method for anomaly detection in power systems using OT communication network traffic throughput. It employs a hybrid deep learning model involving Graph Convolutional Long Short-Term Memory and a Convolutional Neural Network. The proposed method aids SOC with continuous OT security monitoring and post-mortem investigations. Results indicate that the proposed method is able to pinpoint the locations of cyber attacks on power grid OT networks with an AUC score above 75%.@en

Cascading effects in the power grid involve an uncontrolled, successive failure of elements. The root cause of such failures is the combined occurrence of multiple, statistically rare events that may result in a blackout. With increasing digitalisation, power systems are vulnerable to emergent cyber threats. Furthermore, such threats are not statistically limited and can simultaneously occur at multiple locations. In the absence of real-world attack information, however, it is imperative to investigate if and how cyber attacks can cause power system cascading failures. Hence, in this work we present a fundamental analysis of the connection between the cascading failure mechanism and cyber security. We hypothesise and demonstrate how cyber attacks on power grids may cause cascading failures and a blackout. To do so, we perform a systematic survey of major historic blackouts caused by physical disturbances, and examine the cascading failure mechanism. Subsequently, we identify critical cyber-physical factors that can activate and influence it. We then infer and discuss how cyber attack vectors can enable these factors to cause and accelerate cascading failures. A synthetic case-study and software-based simulation results prove our hypothesis. This analysis enables future research into cyber resilience of power grids.

@en

Power electronic interfaced generation (PEIG) has become significantly dominant in the electrical power grid. This development is leading to a decrease in systemic inertia and damping against electrical oscillations. This causes the introduction of new and faster dynamic phenomena. One of these phenomena is sub-synchronous control interaction (SSCI), occurring as sub-synchronous oscillations (SSOs) in the system. Several real-world events reported so far have been related with large wind power plants (WPPs) and the improper tuning of the grid side converter (GSC) of (type-4) fully rated converter (FR C) wind turbines. As other PEl G have similar topologies and control systems, it is a very relevant topic. Weak grid conditions often contribute to the risks of SSO events. This paper proposes supplementary wide-area damping (WAD) to the control system of the GSC, focused on damping excursions of the phase locked loop (PLL). Signals measured by a remote phasor measurement unit (PMU) are communicated to the control system, which uses it for dynamic damping control. The effects of the WAD are tested by comparing the results of linearization-based eigenvalue analysis with and without the addition of WAD. Supplementary analysis conducted by using time-domain simulations and Prony analysis confirm the positive effect of WAD. Numerical tests are performed in DlgSILENT PowerFactory 2023 SP2 on a modified IEEE-39 bus test system.@en