Dynamic State Estimation of Generators Under Cyber Attacks
DDynamic State Estimation of Generators under Cyber Attacks
Yang Li , Senior Member, IEEE, Zhi Li , Liang Chen School of Electrical Engineering, Northeast Electric Power University, Jilin 132012, China School of Automation, Nanjing University of Information Science & Technology, Nanjing 210044, China Corresponding author: Yang Li (e-mail: [email protected]).
This work was supported in part by the China Scholarship Council (CSC) under Grant 201608220144, the National Natural Science Foundation of China under Grant No. 51677023.
ABSTRACT
Accurate and reliable estimation of generator's dynamic state vectors in real time are critical to the monitoring and control of power systems. A robust Cubature Kalman Filter (RCKF) based approach is proposed for dynamic state estimation (DSE) of generators under cyber attacks in this paper. First, two types of cyber attacks, namely false data injection and denial of service attacks, are modelled and thereby introduced into DSE of a generator by mixing the attack vectors with the measurement data; Second, under cyber attacks with different degrees of sophistication, the RCKF algorithm and the Cubature Kalman Filter (CKF) algorithm are adopted to the DSE, and then the two algorithms are compared and discussed. The novelty of this study lies primarily in our attempt to introduce cyber attacks into DSE of generators.
The simulation results on the IEEE 9-bus system and the New England 16-machine 68-bus system verify the effectiveness and superiority of the RCKF.
INDEX TERMS
Dynamic state estimation, cyber attacks, false data injection, denial of service, generator, robust cubature Kalman filter, PMU data
I. INTRODUCTION
In the operation of a power system, it is of critical importance to obtain accurate and reliable dynamic state vectors in real time for monitoring and controlling of a generator [1-3]. As a typical cyber-physical system, power systems have emerged and been in operation for more than a hundred years, but the increasing number of cyber attacks, natural disasters, and reliance on communication control has led to new sources of failure and cascading failure. In addition, with the large-scale integration of renewable energy and new power electronics, the uncertainty of power systems has also increased [4-6]. All these changes have brought new challenges to maintaining safe and reliable operation of the system. At the same time, the successful use of phasor measurement units (PMUs) provides new means for power system state estimation, stability assessment, and control [7, 8]. The term “dynamic state estimation” (DSE) dates back to the 1970s [9]. The Kalman filtering method was previously used to estimate the state of power systems. Recently, there have been many studies on state estimation based on electromechanical transients [10-11]. Various nonlinear filtering methods have been utilized for the DSE of generators. For example: Particle Filter (PF) [12-13], extended Kalman filter (EKF) [14-15], unscented Kalman filter (UKF) [16-17], cubature Kalman filter (CKF) [18-19]. In general, UKF is superior to EKF in terms of estimated performance; in fact, the specific results depend on the distribution of sigma points and the state dimension. Today’s power systems are facing increasingly serious cyber threats, among which false data injection (FDI) and denial of service (DoS) attacks are two typical attacks among them.
The FDI attack considers measurement equipment as an attack object in power systems and has the ability to avoid bad data detection, which deviates the actual estimate from the normal value. In the operation and monitor of power systems, FDI attacks worsen online security assessment of power systems. In terms of economic benefits, FDI attacks can affect the normal dispatching plan of power systems, increase the operating cost of the system, and may even cause a large-scale blackout accident due to the wrong scheduling plan resulting from the attacks.
On December 23, 2015, the large-area blackout in Ukraine was a real case of FDI attacking the power system [20].
As another typical cyber attack, the DoS attack aims to continuously transmit the forged data packets on the communication channel of cyber, so that the communication channel connecting the control center and the remote terminal is not working properly. The information can’t be delivered ormally, resulting in the loss of the data packet and erroneous estimation results. Therefore, these cyber attacks pose a significant threat to the normal operation power systems. In recent years, cyber attacks have become a hot topic in power system studies.
In [21], a detection model based on extreme learning machine was proposed to test and identify FDI attacks.
A DSE-based risk mitigation strategy was presented for eliminating threat levels from cyber attacks in [22]. Furthermore, reference [23] developed a hybrid filtering algorithm to deal with the attacks of power systems by considering the influence of PMU.
In [24], from the perspective of the attacker, the FDI attack based on the DC power flow model for state estimation was proposed. The principal component analysis method and the sparseness of the attack matrix were used to study FDI attacks [25, 26].
Moreover, in [27], the influence of Kalman filter based on model uncertainty and malicious cyber attacks on the dynamic estimation of power systems was studied.
Reference [28] showed that the attacker constructs an undetectable attack vector for AC state estimation by studying in a special region of the system.
In terms of detection of the FDI attack, a short-term state prediction method was proposed in [29].
For the DoS attacks, the references of [30-33] are as follows: A special DoS attack mode for the performance of a cyber-physical system was proposed in [30]. The best DoS attack plan and scheme based on the cost function was studied in [31]. Besides, in [32], the remote state estimation of cyber-physical systems under DoS attacks based on signal interference was researched. For the general system, the algorithm about attack power allocation was proposed in [33].
In summary, in the field of state estimations, the existing methods only consider the inclusion of cyber attacks in the power flow model. To the best of authors’ knowledge, until now no study in the literature has reported the DSE of generators under cyber attacks. In this paper, an RCKF-based DSE method is proposed for generators under cyber attacks. First, the FDI and DoS attacks are modelled and thereby introduced into the DSE by mixing the attack vectors with the measurement data; second, the RCKF algorithm and the CKF algorithm are adopted to the DSE under cyber attacks, and then the two algorithms are compared and discussed. The main contributions of this paper are as follows: (1) This work is the first attempt to perform dynamic state estimation of generators under cyber attacks. Two types of cyber attacks, namely FDI and DoS, are modelled and for the first time introduced into DSE of a generator. (2) Under cyber attacks with different degrees of sophistication, the RCKF algorithm and the CKF algorithm are adopted to the DSE of generators, and then the two algorithms are compared and discussed. (3) The simulation results on the IEEE 9-bus system and the New England 16-machine 68-bus system verify the effectiveness and applicability of the RCKF under different attacks. Furthermore, the results also demonstrate that the RCKF performs better than the CKF in the presence of cyber attacks. The rest of this paper is organized as follows: the generator model is described in Section II. Section III introduces the modelling of attack models. Section IV gives the detailed RCKF-based DSE of generators under cyber attacks. Section V demonstrates simulation results on two IEEE test systems, and finally, the conclusions are drawn in section VI.
II. GENERATOR MODEL
Generally, in the process of estimating the state of power systems, the system equations and the measurement equations are concentrated in the following equation [1-3, 22, 27, 31-34]
11 1 1 ( , , )( , , ) k k k kk k k k x f x u vz h x u w (1) where x represents the state vector, u refers to the control vector, and z is the measurement vector; f and h are the state equation and the measurement equation, respectively; v and w are system deviation and measurement deviation respectively, which obey the normal distribution with the mean 0 and the variance matrices k Q and k R . Here, k Q and k R are the system and measurement noise variance matrices, k is the moment. The fourth-order transient model of a generator is shown as follows [1, 2, 22, 27, 34]: ' ' ''0' ' ''0
11 111 ( ) m eJq f q d d ddd d q q qq
T T DTE E E X X iTE E X X iT (2) where 'd E is the d -axis transient voltage of a generator; ' q E is the q -axis transient voltage of a generator; is the rotor speed; J T is the inertia time constant; m T represents the mechanical torque. f E is the field voltage; e T represents the electromagnetic torque; D represents the damping coefficient; is the rotor angle. '0 d T and d i are respectively d -axis transient time constant and d -axis output currents; d X and ' d X are d -axis reactance and d -axis transient reactance; '0 q T and q i are respectively q -axis transient time constant and q -axis output currents, respectively; q X and ' q X are respectively q -axis reactance and q -axis transient reactance. Measurement vectors include , and q X . The measurement equation is listed as follows [1, 3]: ' '' '' ' zzze q dq dd q UP X XU E U EX X (3) where z and z are the measurements of the rotor speed and the rotor angle, respectively. ze P denotes the measurements of the electromagnetic power of a generator. U and are the magnitude and phase angle of the generator terminal voltage [1]. The measurement noise covariance matrix k R is z z ez k P R (4) where z and z are the measurement variance of rotor angle and rotor speed, and ez P is the measurement variance of electromagnetic power.
222 2 2 z e ee U P PP U (5) where U =0.2%, =0.2 o. In the DSE of a generator, the state vector, the measurement vector, and the control vector are specifically shown as [1, 29]: ' ' , , ,, ,, , ,
Tq dTz z ze Tm f x E Ez Pu T E U (6) The mechanical torque and the field voltage can be obtained from the governor model and the exciter model respectively. The governor model is shown below: ref r order P max T s sT c sTsT sTsT m T FIGURE 1.
Governor model where ref is the rated speed of the generator rotor, r is the steady-state gain, max T is the maximum power order, s T is the servo time constant, c T refers to the turbine time constant, T is the transient gain time constant, T is the time constant to set percentage, T is the reheater time constant. The exciter model is shown as follows: r V g V + _ emx V emn V a a KsT g K gmx V e V b V f E FIGURE 2.
Exciter model where r V is the regulator output voltage, a K is the voltage regulator gain, a T is the voltage regulator time constant, b V is the potential circuit voltage output, g K is the feedback constant, f E is the field voltage. III. ATTACK MODELS A. FDI ATTACK
For the DSE of generators, state vectors are uniformly represented as , , ,... Tk x x x x x . The measurement vectors are uniformly expressed as , , ,..., Tl z z z z z . The measurement equation is as follows: ( ) z h x e (7) where ( ) [ ( ,..., ),( ,..., ),...( ,..., )] kk Tl k h x h x xh x xh x x (8) represents the nonlinear relationship between the state vector and the measurement vector, and e denotes the measurement error. Take the function h () as an example, Taylor’s formula is used to extend h (). Since the state vectors of generators can’t change suddenly during the electromechanical transient process, the high-order parts of h () are too small and can be ignored. Therefore, the linearized measurement equation is obtained as follows: ( ,..., )( ,..., ) ( )... ( )( ,..., ) ( )... ( )... k k k kk k k kk k kk z h x x e hh x x x xxh x x ex h hh x x x xx xh hx x ex xh hx x ex x (9) here (0) (0)1 ,..., k x x are initial values of ,..., k x x , and they are close to ,..., k x x ; ,..., k h hx x are the calculation results by introducing (0) (0)1 ,..., k x x into these partial derivatives; e is a constant matrix. Thereby, (7) can be further expressed as follows: z Hx e (10) ......... ... kkl l l lk h h h hx x x xh h h hx x x xH h h h hx x x x (11) where H is the Jacobian matrix, e is regarded as the new measurement error. In this study, by substituting (3) into (11), the matrix H can be obtained as H L L L (12) where ze PL , zeq PL E , zed PL E . Bad data that often occurs with a large terrible impact on the results of state estimation The application of the residual equation can largely eliminate the influence of bad data [29]. The residual between z and its estimated vector is given by the following equation [28]: r z z (13) where ˆ( ) z h x represents the estimated vector of z . According to the definition of the residual, Eq. (13) can be rewritten as follows [20, 21, 24, 25]: ˆ r z Hx (14) If ,..., Tl a a a is used to represent the false data injected by the attacker in the measurement vector, the actual measurement vector is a z z a . ,..., Tk c c c represents the error vector that is brought into by the FDI attack in the state vector, the elements of it are randomly generated by a Gaussian random variable with different variances, and the estimation of state vector becomes ˆ ˆ a x x c [25]. According to (14), the measurement residual is obtained as [15] ˆ ˆ( )ˆ a a r z Hxz a H x cz Hx a Hc (15) Obviously, a Hc is a sufficient condition for (16). ˆ ˆ a a r z Hx z Hx (16) Eq. (16) suggests that the residual values before and after the FDI attack are equal, and then the residual-based bad data detection is unable to identify the false data. Consequently, the FDI attack is successfully applied to the measurement vector when the attack is modelled as a Hc . In this case, the measurement vector under the attack has a larger deviation from the true vector, which will undermine the safe and stable operation of generators [28]. If the errors of attack vectors are taken into account, the residual values before and after the FDI attack are not equal [29]. Then the following formula is obtained: ˆ ˆˆ a a z Hx z Hx a Hcz Hx a Hc (17) However, if the residual value of the measurement data is less than the detection threshold in the detection process, the FDI attacks are still successfully hidden. Furthermore, the detection threshold B J is determined by superimposing a certain redundancy on the normal maximum estimated deviation. The formula of the detection is as follows: ˆ ˆ a a J z Hx z Hx B (18) Thus, if a z satisfies (18), the FDI attacks can be implemented to the DSE of generators. B. DoS ATTACK
The essence of DoS attacks is the process of packet (i.e., measurement data) loss. At present, there are usually two types of modelling for the characteristic of packet loss. The first one is described by the Bernoulli distribution [31], while the second is described by the Markov model [33]. Taking into account the characteristics of the memoryless Bernoulli process in DoS attacks, the first method is here chosen to model DoS attacks. When an attacker initiates d consecutive DoS attacks, it may result in successive loss of packets. For example, while the measurement data at the ( k-d )th moment is successfully transmitted, the attacker launches an attack at the next moment. The period of consecutive attacks is from the ( k-d+ k th moment, and up to d packets are lost during this period. Then, the Bernoulli distribution is used to depict the packet loss characteristics caused by DoS attacks. In order to describe the transmission of the measurement data , ,..., , k k k d k d z z z z . Define the row matrix dk R , the elements in this matrix can be expressed as follows [30-33]:
1( ) 0 k i (19) ( ( ) 1) ( ( ) 0) ( ( ) 1)(1 ) k s k s k var i P i P i (20) where k is the state matrix of measurement vector transmission, ( ) k i denotes the element i in the matrix k (
1, 1 i d ), representing the transmission state of the measurement k i z at the ( k-i +1)th moment. If ( ) 0 k i , the measurement k i z is lost; otherwise, it is successfully transmitted. (0,1) denotes the probability of packet loss. And thereby, the measurement data actually received by the state estimator under DoS attacks can be indicated as: ' (1)(2). . .( 1) k kk kk k k d zzz d z (21) where ' k z denotes the measurement data under the DoS attack. IV. RCKF-BASED DSE OF GENERATORS A. CUBATURE KALMAN FILTER
The spherical cubature and the Gaussian quadrature rules are utilized to estimate the probability density functions of the state space and the measurement space in CKF. Fig. 3 shows the basic structure of the DSE for generators based on the CKF. The specific process includes the following two stages [1]:
Generator model ˆ ˆ ˆ( )ˆˆ ( ) k k kk k k kk k k k x x W z zz H x ˆ k x k z Governor model ˆ k k x ˆ k x , tk tk U mk T Forecasting stage Filtering stage f E FIGURE 3.
DSE based on CKF (1)Forecasting stage At this stage, U and are all available from PMUs. Decouple the generator from the system, and then obtain the predicted values of state vectors at moment k +1 by the state equation and the state vectors of at moment k , which is shown as follows: Tk k k k k k
P S S (22) , ˆ ii k k k k k k X S x (23) *, , , ki k k i k k X f X u (24)
1ˆ 2 nk k i k ki x Xn (25) n T kk k i k k i k k k k k ki P X X x x Qn (26) where k k P denotes the estimation error variance matrix of the state vector at moment k obtained from moment k -1; , i k k X represents the cubature points of the state vectors at moment k ; i n , i =1,2,...2 n , n is the dimension of the state vector. *, i k k X represents the predicted values of the cubature points obtained by the state equation; ˆ k k x is the predicted values of the state vectors; k k P refers to the predicted error variance matrix of the state vectors. (2)Filtering stage The predicted values of the state vectors at the forecasting stage are calculated by the measurement vector k z , and thereafter obtain the estimation of the state vectors at moment k +1. The specific process is as follows: Tk k k k k k
P S S (27) , 1 1 1 ˆ ii k k k k k k X S x (28) , 1 , 1 , ki k k i k k Z h X u (29)
21 , 11
1ˆ 2 nk k i k ki z Zn (30) n T T kzz k k i k k i k k k k k ki P Z Z z z Rn (31)
2, 1 , 1 , 1 1 11 n T Txz k k i k k i k k k k k ki
P X Z x zn (32)
11 , 1 , 1 k xz k k zz k k
W P P (33) ˆ ˆ ˆ k kk k k k k k x x W z z (34) Tk kk k k k zz k k
P P W P W (35) where , 1 i k k X is the cubature points of the predicted values ˆ k k x ; , 1 i k k Z is the cubature points of forecast values of the measurements; ˆ k k z is the forecast values of the measurements obtained by the weighted summation of , 1 i k k Z ; , 1 zz k k P is the measurement error variance matrix; , 1 xz k k P is the cross-error variance matrix; k W is the filter gain; ˆ k k x is the final estimation at moment k +1; k k P is the updated estimation error variance matrix of state vectors at moment k +1. B. ROBUST CUBATURE KALMAN FILTER
Accurate system models and noise statistics are prerequisites for the traditional CKF for obtaining a good estimate. In this paper, the generator model is assumed to be accurate. However, due to environmental factors, bad data inevitably appears in PMU measurement vectors, causing the measurement error variance matrix k R to be inconsistent with the actual error. This leads to that the CKF is unable to complete the accurate correction of the predicted values in the filtering stage. By combining the robust M estimation theory and the CKF, the RCKF has the on-line adjustment capability for measuring noise statistics. By using the RCKF, accurate state estimation results can still be obtained even if the measurements contain bad data. The basic process of the RCKF is generally the same as that of the CKF except for (31) and (32). Specifically speaking, the measurement error variance matrix before correction is replaced by the corrected measurement error variance matrix in (31). k R is the measurement error variance matrix before correction, k R is the corrected measurement error variance matrix according to the following formula: k R P (36) where P is the equivalence weight matrix. In this work, the Huber method is used to calculate the quivalence weight matrix P [1], which is given by ',, ', , m mm m rmm m mm m m m r r Cp C r Cr (37) ' ',, ' '' ', m mm nm n m nm n m n r C r Cp C r C r Cr r (38) where , m m p and , m n p are respectively a diagonal and non-diagonal element of the matrix P . In the matrix k R , , m m and , m n denote a diagonal and non-diagonal element. Since the measurement error variance matrix in the DSE of generators is a diagonal matrix, the non-diagonal elements , m n are taken as zero. r m is the corresponding residual component of measurement vectors m z , while m r is the corresponding standard residual component. m is the mean square error of r m . C is a given constant (ranging from 1.3 to 2.0), and it is here taken as 1.5 through the try-and-error method. These vectors are expressed as [1]: ' / m m rm r r (39) ˆ( ) m k mk k r z z (40) ,, 1 ( ) rm m mzz k k P (41) where , 1 zz k k P is the measurement error variance matrix before correction. In the process of the RCKF-based DSE of generators, ˆ k k x and ˆ k k x are approximately equal before attacks. When attack vectors are implemented into the measurement vectors, ˆ k k x obtained in the filtering stage will change. But at this time, ˆ k k x obtained in the forecasting stage remains unchanged. In this regard, this paper proposes an attack identification strategy, which is as follows: ˆ ˆ ,The attack can be identifiedˆ ˆ , The attack cannot be identified Jk k k k Jk k k k x x Dx x D (42) where J D is ˆ ˆmax k k k k x x during the period of the normal estimation. C. SOLUTION PROCESS
As shown in Fig. 4, the RCKF-based solution process is described as follows: 1) Construction of the state and measurement equations: Based on the estimation vector ˆ k x at moment k , the state equation of a generator is constructed. Assuming that the magnitude and phase angle of the generator terminal voltage ( , ) U are available from PMUs, the measurement equation of a generator is thereby constructed. 2) Modelling of cyber attacks: The Jacobian matrix H is obtained from (14). For the FDI attack, the attack vector is obtained through multiplying the Jacobian matrix by the error vector of state vector obeying Gaussian distributions with different standard deviations. (2) Regarding the DoS attack, the transmission state matrix k obeying the Bernoulli distribution is established.
3) Implementation of cyber attacks: On the basis of the predicted values of state vectors, the FDI attack vectors are implemented to the measurement vectors k z , and then they are detected via the bad data detection. For the DoS attack, the measurement vector under the attack is formed by multiplying the elements of the matrix k by the corresponding elements of the measurement matrix.
4) Estimation results: In the filtering stage of the RCKF, the estimated values at moment k +1 under attacks are obtained according to (27) ~ (35). And thereby, based on the estimated values, the mechanical torque is calculated by the governor. At the same time, the estimation results need to be tested for the attack identification. After that, perform the DSE based on the RCKF until the simulation is finished. StartEstimated values of state vectors at moment k State equation Jacobian matrix Attack vector Bad data detectionPMUs
Estimated values of state vectors at moment k+ Governorerror vector of state vector m T , U No k z YesEnd k FDI attack
DOS attack k =1 k = k +1Predicted values of state vectors at moment k+ FIGURE 4.
Solution process
V. NUMERICAL RESULTS A. SIMULATION SETTINGS ll simulations have been performed under the MATLAB environment on a desktop PC equipped with Intel Core i5-4590 3.3GHz CPU and 8 GB RAM. Note that in this study, PMU data are simulated through detailed numerical simulations via the power system toolbox (PST). The simulation data are listed as follows: 1) The sampling rate is assumed 50 samples/s; 2) The simulation time step is set to 0.02 s; 3) The standard deviations of the rotor angle and the rotor speed are respectively 2° and 0.1%; 4) The standard deviations of the phase angle and amplitude of terminal voltages are 0.1° and 0.1% ;
5) A PMU is equipped at the terminal of each generator [1, 27]. B. EVALUATION INDEX
To compare the estimation results, three different indices are defined as follows [1], [2]:
21 1 ˆ1 ( )
N i iti iz x xN x ( )
212 21 ˆ( )( )
N i itiN iz iti x xx x (44) ˆ( ) N i iti x xN (45) where ˆ i x and it x are respectively the estimated value and the true value, iz x represents the measurement value, N denotes the number of sampling points. The evaluation index can measure the filtering performance of the same state estimation method under different cyber attacks; can evaluate the filtering performances of different state estimation methods under the same cyber attack; can quantitatively evaluate the estimation results for any estimation method under any attack. C. IEEE 9-BUS SYSTEM
This system contains 3 generators, 3 transformers, and 9 buses. The fault settings are as follows: a three-phase short-circuit fault occurs at bus 4 at t =1.2s, then the fault is cleared at t =1.5s. The entire simulation process lasts 20s. For ease of analysis without loss of generality, generator 1 is taken as an example to examine the performances of the RCKF algorithm. Here, the detection threshold of the bad data detection is set to J B through simulations, since all injected false data can just pass the detection while bad data can be detected in this situation. G1 G2G3T1 T2T31 2 3 4 56 78 9Load1Load2 Load3
FIGURE 5.
IEEE 9-bus system
1) SIMULATION RESULTS UNDER FDI ATTACKS
In terms of FDI attacks, according to the error vector of the state vector, three attack scenarios are designed, as shown in Table I [25].
TABLE I SCENARIOS of FDI ATTACKS Attack Scenarios Error Vector of State Vector
FDI-scenario 1 (0, ), 0.0001 c N FDI-scenario 2 (0, ), 0.001 c N FDI-scenario 3 (0, ), 0.01 c N In Table I, FDI-scenarios 1-3 respectively indicate that in three attack scenarios, the error vectors of the state vectors obey the Gaussian distribution with the mean 0 and the standard deviations 0.0001, 0.001 and 0.01. Figs. 6, 8 and 10 show the estimated results of the generator’s rotor angle under three FDI attack scenarios, while
Figs. 7, 9 and 11 illustrate the estimation results of the rotor speed under the scenarios. t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 6.
Rotor angle under FDI-scenario 1 t (s)11.00051.0011.00151.002 r o t o r s p ee d ( p . u . ) CKFTRUERCKF 6 7 81.00061.00081.0011.0012
FIGURE 7.
Rotor speed under FDI-scenario 1 t (s)1.522.533.544.5 r o t o r a ng l e ( ° ) CKFTRUERCKF 8.0 8.2 8.4 8.63.653.73.753.83.85
FIGURE 8.
Rotor angle under FDI-scenario 2 t (s)11.00051.0011.00151.002 r o t o r s p ee d ( p . u . ) CKFTRUERCKF 9.8 9.9 101.001051.00111.001151.0012
FIGURE 9.
Rotor speed under FDI-scenario 2 t (s)1.522.533.544.5 r o t o r a ng l e ( ° ) CKFTRUERCKF 6 7 83.63.73.83.94
FIGURE 10.
Rotor angle under FDI-scenario 3 t (s)11.00051.0011.00151.002 r o t o r s p ee d ( p . u . ) CKFTRUERCKF 6 7 81.00061.00071.00081.00091.001
FIGURE 11.
Rotor speed under FDI-scenario 3
From Figs. 6-11, it can be observed that the estimation results of the RCKF are very close to the true values in the attack period from t =4s to 12s. This result verifies the effectiveness of the RCKF under FDI attacks. Furthermore, the estimated results of the RCKF are closer to the true values than those of the CKF, which suggests that the filtering ability of the RCKF is better than that of the CKF. The estimation indices of generator 1 in the scenarios are shown in Table II.
Table II ESTIMATION INDICES Attack scenario Index Parameter CKF RCKF FDI-scenario 1 Table II gives the state estimation indices of generator 1 based on the CKF and the RCKF under three FDI attack scenarios. From Table II, it can be seen that: (1) For the index , the values based on the RCKF are not much different from each other. (2) As far as index is concerned, under attack scenario 1, the filtering accuracies of the RCKF are respectively 19% and 7.3% higher than those of the CKF for the rotor angle and the rotor speed; under attack scenario 2, the filtering accuracies of the RCKF are increased by 28% and 27% compared with those of the CKF; under attack scenario 3, the filtering accuracies of the RCKF are increased by 91.8% and 84% compared with those of the CKF. (3) Regarding he index , the index values of the RCKF are less than those of the CKF. In general, the effectiveness of the RCKF is verified under different FDI attack scenarios. The superiority of the RCKF under these scenarios compared with the CKF is also confirmed.
2) SIMULATION RESULTS UNDER DOS ATTACKS
According to the packet loss rate of DoS attacks, four attack scenarios are designed, as shown in Table III [31].
Table III SCENARIOS of DoS ATTACKS Attack Scenarios Packet Loss Rate DoS-scenario 1 1.00 DoS-scenario 2 0.95 DoS-scenario 3 0.85 DoS-scenario 4 0.75
In Table III, DoS-scenarios 1-4 respectively indicate that in four attack scenarios, the packet loss rate of the measurement data is 1, 0.95, 0.85 and 0.75. Figs. 12, 14, 16 and 18 show the estimated results of the generator's rotor angle under four DoS attack scenarios.
Figs. 13, 15, 17 and 19 show the estimated results of rotor speed under these DoS attack scenarios. t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 12.
Rotor angle under DoS-scenario 1 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 13.
Rotor speed under DoS-scenario 1 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 14.
Rotor angle under DoS-scenario 2 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 15.
Rotor speed under DoS-scenario 2 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 16.
Rotor angle under DoS-scenario 3 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 17.
Rotor speed under DoS-scenario 3 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 18.
Rotor angle under DoS-scenario 4 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 19.
Rotor speed under DoS-scenario 4
From Figs. 12-19, ones can observe that in the attack period from t =4s to 12s, the attack frequency changes with the decrease of the packet loss rate, and the estimated values of the RCKF are much closer to the true values than those of the CKF. Based on these results, the effectiveness and superiority of the RCKF are verified under DoS attacks. The state estimation indices of generator 1 are shown in Table IV. Table IV ESTIMATION INDICES Attack scenario
Index
Parameter
CKF
RCKF
DoS-scenario 1 Table IV gives the state estimation indices of generator 1 based on the two algorithms under three DoS attack scenarios. From Table IV, it can be seen that: (1) For the RCKF, the values of are almost unchanged in three different attack scenarios. (2) For index , under attack scenario 1, the values of the CKF are respectively 251 and 471 times that of those of the RCKF about the rotor angle and the rotor speed; under attack scenario 2, the values of the CKF are respectively 254 and 446 times that of those of the RCKF; under attack scenario 3, the values of the CKF are respectively 257 and 416 times that of those of the RCKF; under attack scenario 4, the values of the CKF are respectively 265 and 386 times that of those of the RCKF. (3) For the index , the index values of the CKF are greater than those of the RCKF. In short, the effectiveness of the RCKF under DoS attacks is verified and the superiority of the RCKF compared with the CKF under DoS attacks is validated. D. NEW ENGLAND 16 MACHINE 68 BUS SYSTEM
This system consisting of 16 synchronous generators, 68 buses, and 86 lines is a well-known test system in the field of state estimation [1, 27]. Taken as generator 1 as an example, a three-phase short-circuit fault occurs at bus 6 at t =1s and then is removed at t =1.2s. The simulation lasts 10s and the detection threshold is here set to J B using the same approach as that in the previous IEEE 9-bus test system. FIGURE 20.
New England 16-machine-68-bus system
1) SIMULATION RESULTS UNDER FDI ATTACKS
In order to facilitate comparative analysis, the settings of the FDI attack scenarios in this system are shown in Table V:
TABLE V SCENARIOS of FDI ATTACKS Attack Scenarios Error Vector of State Vector
FDI-scenario 1 (0, ), 0.01 c N FDI-scenario 2 (0, ), 0.1 c N FDI-scenario 3 (0, ), 1 c N In Table V, FDI-scenarios 1-3 respectively indicate that in three attack scenarios, the error vectors of the state vectors obey the Gaussian distribution with the mean 0 and the standard deviations 0.01, 0.1 and 1. Figs. 21, 23 and 25 show that estimated results of the rotor angle in three FDI attack scenarios respectively;
Figs. 22, 24 and 26 show that estimated results of the rotor speed under three attack scenarios respectively. t (s)202530354045 r o t o r a ng l e ( ° ) CKFTRUERCKF 6 8 1039.6539.739.7539.8
FIGURE 21.
Rotor angle under FDI-scenario 1 t (s)0.99511.005 r o t o r s p ee d ( p . u . ) CKFTRUERCKF 3.8 4.0 4.211.00021.0004
FIGURE 22.
Rotor speed under FDI-scenario 1 t (s)202530354045 r o t o r a ng l e ( ° ) CKFTRUERCKF 5 6 739.539.639.739.8
FIGURE 23.
Rotor angle under FDI-scenario 2 t (s)0.9960.99811.0021.004 r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 24.
Rotor speed under FDI-scenario 2 t (s)202530354045 r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 25.
Rotor angle under FDI-scenario 3 t (s)0.9940.9960.99811.0021.004 r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 26.
Rotor speed under FDI-scenario 3
From Figs. 21-26, it can be seen that the estimated values of the RCKF are significantly closer to the true values than those of the CKF in the attack period from t =4s to 8s. This verifies the effectiveness and applicability of the RCKF under three FDI attack scenarios for the larger system. And it also proves that the RCKF is better than the CKF in terms of the filtering ability. The estimation indices of generator 1 are shown in Table VI. Table VI ESTIMATION INDICES OF GENERATOR 1 Attack scenario index parameter CKF RCKF FDI-scenario 1 able V gives the state estimation indices of generator 1 based on the CKF and the RCKF under three FDI attack scenarios. From Table V, it can be observed that: (1) In the New England 16-machine 68-bus system, for the index , the values of the rotor angle of the RCKF are respectively only increased by 0.9% and 0.7% with the diversification of attack scenarios, the values of the rotor speed of the RCKF don't change significantly. (2) In terms of the index , the values of the CKF about the rotor angle and the rotor speed are 26.4% and 72.6% higher than those of the RCKF under attack scenario 1; under attack scenario 2, the values of the CKF are increased by 96.4% and 97.5% compared with those of the RCKF; under attack scenario 3, the values are increased by 98.8% and 98.9%. (3) For the index , the values of the RCKF are always less than those of the CKF under three attack scenarios. These phenomena suggest that the filtering performance of the RCKF is still better than that of the CKF in the larger system.
2) SIMULATION RESULTS UNDER DOS ATTACKS
Similar to the FDI attacks, the settings of the DoS attack scenarios in this system are as same as those in the IEEE 9-bus system. Figs. 27, 29, 31 and 33 show the estimated results of the rotor angle under different DoS attack scenarios. Moreover, Figs. 28, 30, 32 and 34 show the estimated results of the rotor speed. t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 27.
Rotor angle under DoS-scenario 1 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 28.
Rotor speed under DoS-scenario 1 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 29.
Rotor angle under DoS-scenario 2 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 30.
Rotor speed under DoS-scenario 2 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 31.
Rotor angle under DoS-scenario 3 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 32.
Rotor speed under DoS-scenario 3 t (s) r o t o r a ng l e ( ° ) CKFTRUERCKF
FIGURE 33.
Rotor angle under DoS-scenario 4 t (s) r o t o r s p ee d ( p . u . ) CKFTRUERCKF
FIGURE 34.
Rotor speed under DoS-scenario 4
From Figs. 27-34, it can be observed that the estimated values of the RCKF are still close to the true values with the different packet loss rates in this system. This verifies the effectiveness and adaptability of the RCKF under DoS attacks in the larger system.
Moreover, it can be seen from these figures that the filtering ability of the RCKF is significantly superior to that of the CKF under DoS attacks. The estimation indices of generator 1 are shown in Table VII.
Table VII ESTIMATION INDICES OF GENERATOR 1
Attack scenario
Index
Parameter
CKF
RCKF
DoS-scenario 1 Table VI gives the state estimation indices of generator 1 based on these two algorithms under three DoS attack scenarios. From Table VI, it can be seen: (1) Regarding index , the index values of the rotor angle and the rotor speed obtained by using the RCKF are basically unchanged under different attack scenarios, which validates the performance of the RCKF for the larger system under DoS attacks. (2) For index , the index values of the rotor angle and the rotor speed obtained by the CKF are respectively 454 times and 13466 times higher than those of the RCKF under scenario 1; under scenario 2, the index values of the CKF are respectively increased by 454 times and 12932 times compared with those of the RCKF; under scenario 3, the index values of the CKF are respectively increased by 448 times and 12043 times compared with those of the RCKF; under scenario 4, the index values of the CKF increased by 456 times and 11622 times compared with those of the RCKF. (3) In terms of index , the index values of the RCKF are always less than those of the CKF under the four scenarios. The results on the above indices and suggest that the RCKF significantly outperforms the CKF under DoS attacks. From the test results on the above two systems, it can be seen that the filtering performance of the RCKF is superior to that of the CKF. The reason for this phenomenon is that the consequence of cyber attacks essentially is to introduce a large number of errors to the measurement data, and the RCKF can eliminate the errors while the CKF does not have this ability. E. COMPARISON OF COMPUTATIONAL EFFICIENCY
In order to reasonably evaluate the computational efficiency of the RCKF under cyber attacks, the calculation times using the CKF and the RCKF are shown in Table VIII.
Table VIII CALCULATION TIME Attack CKF(ms) RCKF(ms) FDI-scenario 1 0.123 0.137 FDI-scenario 2 0.124 0.134 FDI-scenario 3 0.127 0.132 DoS-scenario 1 0.129 0.138 DoS-scenario 2 0.128 0.139 DoS-scenario 3 0.122 0.131 DoS-scenario 4 0.124 0.136
Table VII shows that the RCKF can accurately estimate dynamic states of generators in real time. Since the RCKF uses the M estimation theory to eliminate measurement errors caused by cyber attacks, its calculation time is slightly longer than that of the CKF, but it is still within a reasonable range. Consequently, the computational times demonstrate that RCKF has the otential to perform DSE of generators or even power systems in real-world applications.
VI. CONCLUSION
This paper investigates the dynamic state estimation of generators under cyber attacks. First, attacks are modelled and thereby introduced into the DSE of generators; and then, the RCKF algorithm is adopted to estimate dynamic states of generators under cyber attacks with different degrees of sophistication. To the best of the authors’ knowledge, this is the first study that investigates the DSE of generators under cyber attacks. Based on the test results on two IEEE test systems, the following conclusions can be drawn: (1) The RCKF is capable of effectively performing the DSE of generators in the presence of cyber attacks; (2) Furthermore, the filtering performance of the RCKF is significantly better than that of the CKF. (3) For a DSE algorithm such as the CKF that is not capable of addressing cyber attacks, the estimation performances of the algorithm may be seriously deteriorated under attacks.
In our future work, more types of cyber attacks will be introduced into the DSE of generators. In addition, the adopted method might be extended to address other power system state estimation issues.
References [1]
Y. Li, J. Li, J. Qi, and L. Chen, “Robust cubature Kalman filter for dynamic state estimation of synchronous machines under unknown measurement noise statistics,”
IEEE Access , vol.7, pp. 29139- 29148, Feb. 2019. [2]
A.K. Singh, B.C. Pal, “Decentralized dynamic state estimation in power system using unscented transformation,”
IEEE Transactions on Power Systems. , vol. 29, no. 2, pp. 794-804, Mar. 2014. [3]
N. Zhou, D. Meng, and Z. Y. Huang, “Dynamic state estimation of a synchronous machine using PMU data: A comparative study,”
IEEE Transactions on Smart Grid , vol. 6, no. 1, pp. 450-460, Jan. 2015. [4]
Y. Li, Z. Yang, G. Li, Y. Mu, D. Zhao, C. Chen, B. Shen, “Optimal scheduling of isolated microgrid with an electric vehicle battery swapping station in multi-stakeholder scenarios: A bi-level programming approach via real-time pricing,”
Applied Energy , 232, pp. 54-68, Sep. 2018. [5]
Y. Li, Z. Yang, D. Zhao, H. Lei, B. Cui, S. Li, “Incorporating energy storage and user experience in isolated microgrid dispatch using a multi-objective model,”
IET Renewable Power Generation , vol. 13, no. 6, pp. 973-981, Apr. 2019. [6]
Y. Li, J. Wang, D. Zhao, G. Li, and C. Chen, “A two-stage approach for combined heat and power economic emission dispatch: Combining multi-objective optimization with integrated decision making,”
Energy , vol. 162, pp. 237–254, Nov. 2018. [7]
V. Terzija, G. Valverde, D. Cai, P. Regulski, V. Madani, J. Fitch, et al, “Wide-area monitoring, protection and control of future electric power networks,”
Proceedings of the IEEE , vol. 99, no. 1, pp. 80–93, Jan. 2011. [8]
Y. Li, Z. Yang. “Application of EOS-ELM with binary Jaya-based feature selection to real-time transient stability assessment using PMU data”.
IEEE Access , vol. 5, pp. 23092-23101, Feb. 2017. [9]
A. S. Debs and R. E. Larson, “A dynamic estimation for tracking the state of a power system,”
IEEE Transactions on Power Apparatus and Systems , vol. PAS-89, no. 7, pp. 1670–1678, Sep. 1970. [10]
E. Ghahremani and I. Kamwa, “Local and wide-area PMU-based decentralized dynamic state estimation in multi-machine power systems,”
IEEE Transactions on Power Systems , vol. 31, no. 1, pp. 547–562, Jan. 2016. [11]
E. Ghahremani and I. Kamwa, “Dynamic state estimation in power system by applying the extended Kalman filter with unknown inputs to phasor measurements,”
IEEE Transactions on Power Systems , vol. 26, no. 4, pp. 2556–2566, Nov. 2011. [12]
J. MinPark, C. Ki Ahn and S.Shmaliy, “Improving reliability of particle filter-based localization in wireless sensor networks via hybrid particle/fir filtering,”
IEEE Transactions on Industrial Informatics , vol.11, no. 5, pp. 1089-1098, Oct. 2015. [13]
Y. Li, M. Coates, “Particle filtering with invertible particle flow,”
IEEE Transactions on Signal Processing , vol. 65, no. 15, pp. 4102–4116, Aug 2017. [14]
A. Paul, I. Kamwa, G. Joos, “Centralized dynamic state estimation using a federation of extended Kalman filters with intermittent PMU data from generator terminals,”
IEEE Transactions on Power Systems , vol. 33, no. 6, pp. 6109-6119, Nov. 2018. [15]
C. Wang, Z.J. Qin, and Y.B. Hou, “Multi-area dynamic state estimation with PMU measurements by an equality constrained extended Kalman filter,”
IEEE Transactions on Smart Grid , vol. 9, no. 2, pp. 900-910, May 2017. [16]
G. Anagnostou, B. C. Pal, “Derivative-free Kalman filtering based approaches to dynamic state estimation for power systems with unknown inputs,”
IEEE Transactions on Power Systems , vol. 33, no. 1, pp. 116–130, 2018. [17]
A. Rouhani and A. Abur, “Linear phasor estimator assisted dynamic state estimation,”
IEEE Transactions on Smart Grid , vol. 9, no. 1, pp. 211–219, 2018. [18]
L. Chen, T. Bi, J. Li, “Dynamic state estimator for synchronous machines based on cubature Kalman filter,”
Proceedings of the Chinese Society of Electrical Engineering , vol. 34, no. 16, pp. 2706-2713, Jun. 2014. [19]
A. Sharma, S.C. Srivastava, and S. Chakrabarti, “A Cubature kalman filter based power system dynamic state estimator,”
IEEE Transactions on Instrumentation and Measurement , vol. 66, no. 8, pp. 2036-2045, Aug. 2017. [20]
C. Liu , J. Wu , C. Long, and D. Kundur, “Reactance perturbation for detecting and identifying FDI attacks in power system state estimation,”
IEEE Journal of Selected Topics in Signal Processing , vol.12, no. 4, pp. 763-776, Aug. 2018. [21]
D. Xue, X. Jing, and H. Liu, “Detection of false data injection attacks in smart grid utilizing ELM-based OCON framework,”
IEEE Access , vol.7, pp. 31762-31773, Mar. 2019. [22]
A. F. Taha, J. Qi, J. Wang, and H. J. Panchal, “Risk mitigation for dynamic state estimation against cyber attacks and unknown inputs,”
IEEE Transactions on Smart Grid , vol.9, no. 2, pp. 886-899, Mar. 2018. [23]
L. Hu, Z. Wang, I. Rahman, and X. Liu, “A constrained optimization approach to dynamic state estimation for power systems including PMU and missing measurements,”
IEEE Transactions on Control Systems Technology , vol.24, no. 2, pp. 703-710, Mar. 2016. [24]
Y. Liu, P. Ning, M. K. Reiter, “False data injection attacks against state estimation in electric power grids,”
ACM Transactions on Information and System Security , vol.14, no. 1, pp. 1-33, May. 2011. [25]
Z. H. Yu, W. L. Chin, “Blind false data injection attack using PCA approximation method in smart grid,”
IEEE Transactions on Smart Grid , vol.6, no. 3, pp. 1219-1226, May. 2015. [26]
B. Li, T. Ding, C. Huang, “Detecting false data injection attacks against power system state estimation with fast Go-Decomposition (GoDec) approach,”
IEEE Transactions on Industrial Informatics , DOI: 10.1109/TII.2018.2875529 [27]
J. Qi, A. F. Taha, and J. Wang. “Comparing Kalman filters and observers for power system dynamic state estimation with model uncertainty and malicious cyber attacks,”
IEEE Access , vol.6, pp. 77155-77168, Dec. 2018. [28]
X. Liu, Z. Li. “False data attacks against AC state estimation with incomplete network information,”
IEEE Transactions on Smart Grid , vol.8, no. 5, pp. 2239-2248, Sep. 2017. [29]
J. Zhao, G. Zhang, M. L. Scala, Z Y Dong, and J. Wang, “Short-term state forecasting-aided method for detection of smart grid general false data injection attacks,”
IEEE Transactions on Smart Grid , vol.8, no. 4, pp. 1580-1590, Jul. 2017. [30]
H. Zhang, P. Cheng, L. Shi, and J. Chen, “Optimal denial-of-service attack scheduling with energy constraint,”
IEEE Transactions on Automatic Control , vol.60, no. 11, pp. 3023-3028, Nov. 2015. [31]
H. Zhang, P. Cheng, L. Shi, and J. Chen, “Optimal DoS attack scheduling in wireless networked control system,”
IEEE Transactions on Control Systems Technology , vol.24, no. 3, pp. 843-852, May. 2016. [32]
Y. Li, D. E. Quevedo, S. Dey and L. Shi, “SINR-based DoS attack on remote state estimation: a game-theoretic approach,”
IEEE Transactions on Control of Network Systems , vol.4, no. 3, pp. 632-42, Sep. 2017. [33]
G. K. Befekadu, V. Gupta, P. J. Antsaklis, “Risk-Sensitive control under Markov modulated Denial-of-Service(DoS) attack strategies,”
IEEE Transactions on Automatic Control , vol.60, no. 12, pp. 3299-3304, Dec. 2015. [34]
N. Zhou, D. Meng, and S. Lu, “Estimation of the dynamic states of synchronous machines using an extended particle filter,”