Targeted False Data Injection Attack against DC State Estimation without Line Parameters
aa r X i v : . [ ee ss . S Y ] F e b Targeted False Data Injection Attack against DCState Estimation without Line Parameters
Mingqiu Du,
Student Member, IEEE , Georgia Pierrou,
Student Member, IEEE , Xiaozhe Wang,
Senior Member, IEEE
Abstract —A novel false data injection attack (FDIA) modelagainst DC state estimation is proposed, which requires no net-work parameters and exploits only limited phasor measurementunit (PMU) data. The proposed FDIA model can target specificstates and launch large deviation attacks using estimated lineparameters. Sufficient conditions for the proposed method arealso presented. Different attack vectors are studied in the IEEE39-bus system, showing that the proposed FDIA method cansuccessfully bypass the bad data detection (BDD) with highsuccess rates of up to 95.3%.
Index Terms —DC state estimation, false data injection attacks,stochastic process, phasor measurement unit
I. I
NTRODUCTION
The state estimator, a core component at the control roomfor monitoring and control, is subject to cyber attacks asmeasurement units are widely dispersed and communicationnetworks transmitting measurements are vulnerable. It hasbeen shown in [1] that an adversary can stealthily distort thestate estimation results without being detected by the bad datadetection (BDD), if the adversary has the full knowledge ofsystem topological information including line admittance.Inspired by [1], many subsequent works were devoted tostudying the false data injection attack (FDIA) models againststate estimation [2]–[10]. Particularly, in contrast to AC stateestimation that is iterative and computationally harder to solve[11], DC state estimation model is commonly used owingto its simplicity and linearity. In [2], the authors proposedtwo different FDIAs targeted at pre-specified state variable ormeter, respectively. In [3], a method to transform FDIA intoa load distribution attack based on DC model is proposed. AnFDIA method that selects the meters to manipulate aimingto cause the maximum damage can be found in [4]. Theauthors of [5] exploited the concept of attacking region todesign an FDIA model that requires only the line admittanceand topology inside the attacking region. An efficient strategyto determine the optimal attacking region was later discussedin [6]. In [7], the authors showed that an adversary canlaunch FDIA on a bus or superbus only if the susceptanceof every transmission line connected to that bus or superbusis known. Despite important advancement towards relaxing
The authors are with the Department of Electrical and ComputerEngineering, McGill University, Montreal, QC H3A 0G4, Canada.(e-mail: [email protected], [email protected], [email protected]).This work is supported by Fonds de recherche du Qu´ebec–Nature et tech-nologies (FRQNT) under Grant FRQ-NT PR-253686 and Natural Sciencesand Engineering Research Council (NSERC) Discovery Grant RGPIN-2016-04570. the pre-knowledge of network information, these methods stillrequire partial information of a transmission network, whichmay still be unobtainable as the system model is criticallyprotected by utilities.Recently, the authors of [8] proposed an FDIA modelrequiring no line parameters, yet the method enforces anassumption that the target bus has only one line connectedto the outside, which may be rare, limiting its applications inpractice. The independent component analysis (ICA) and theprincipal component analysis (PCA) have been applied in [9],[10] to design FDIA against DC state estimation purely frommeasurements, without any grid topology and line parameters.However, these data-driven FDIA may not target specific statessince the exact Jacobian matrix cannot be obtained.In this paper, we propose a novel FDIA model againstDC state estimation that can target specific states withoutknowing any line parameters. Compared to network topol-ogy information critically protected and rarely transmitted,phasor measurement unit (PMU) measurements are easier toacquire through communication networks or software supplychain attack between PMU vendors and customers (e.g., theSolarWinds attack [12]). Hence, we, from the viewpoint of anadversary, exploit only PMU data collected at the buses insidethe attacking region to estimate the line parameters of interestand design a stealthy FDIA. In contrast to previous works thatrequire measurements from remote terminal units (RTUs), theproposed attack model requires only PMU measurements fordesigning the FDIA and can target specific states without anypre-knowledge on line parameters.II. DC S
TATE E STIMATION AND A TTACKING R EGION
The power system state vector x to be estimated consistsof voltage phasors of all buses, while the measurement vector z consists of power injections and line flows. The relationshipbetween z and x can be formulated in a DC model: z = H x + e (1) where e denotes the vector of measurement error, which istypically assumed to be an independent Gaussian randomvector; H represents the measurement Jacobian matrix.To get the estimated state vector ˆ x , the weighted leastsquares estimation problem is formulated and solved as: ˆ x = ( H T W H ) − H T W z (2) where W is a weight matrix.For the detection of bad data, the residual-based BDD istypically used [1]. The residual between the measurement andthe estimated state vector is defined as r = k z − H ˆ x k ∞ . Onlyf r is smaller then a threshold value γ , the measurement z isregarded as normal without bad data or malicious data.Assuming an FDIA attack is launched by an adversary, themeasurement vector after manipulation is z bad = z + a , where a is termed as the attack vector. Let ˆ x bad = ˆ x + c be theestimated states from the z bad . It has been shown in [5] thatif a = H c , then the residual after the attack remains thesame as that before the attack: r bad = k z bad − H ˆ x bad k ∞ = k z + a − H ( ˆ x + c ) k ∞ = k z − H ˆ x + a − H c k ∞ = r , in-dicating that the attack can stealthily bypass the BDD withoutbeing detected. However, it is obvious that the adversary needsto know H , i.e., the entire network information (topologyinformation and line parameters) of the power system, whichis practically infeasible. Thus, many efforts (e.g., [5], [7]) havebeen made to propose FDIA models using only partial networkinformation or manipulating partial measurements.One effective method is to divide the system into the nonattacking region and the attacking region. If the adversaryknows the topology information inside the attacking region andcan manipulate line flow and power injection measurements,then the adversary can launch successful FDIA without beingdetected by the BDD [1]. Network information or metermeasurements outside the attacking region are not required.In this paper, we also utilize the concept of attacking regionto design the PMU-based FDIA. Nevertheless, the proposedFDIA requires no line parameters, irrespective of whether theline is located inside or outside the attacking region.III. C ONSTRUCTING THE
FDIA M
ODEL W ITHOUT L INE P ARAMETER I NFORMATION
To construct the FDIA, we follow the common assumptionthat generator measurements cannot be attacked as they arewell protected, while the measurements of line flow and powerinjection at load buses can be attacked because of the widedeployment of load meters and variation of load powers [6].Assuming the adversary intends to attack a load bus t thatis termed as the target bus, then the attacking region defined inthis paper consists of the following: the target bus, all busesthat have direct connection to the target bus as well as thetransmission lines between these buses (see Fig. 1). Information needed in the attacking region:
The adver-sary needs to know: 1. which buses are connected to thetarget bus to determine the attacking region. Nevertheless,the topology information of other buses inside the attackingregion (e.g., the line between bus 1 and bus 2 in Fig.1) is not needed. 2. similar to [1], [7], voltage angles δ i , ∀ i ∈ Ω A where Ω A = { , , ..., t, ..., k } denotes the setof bus numbers inside the attacking region. 3. the currentFig. 1: The definition of attacking region phasor measurement I t ∠ θ t flowing from the target bus to thedynamic load, whereas any other line current measurements(e.g., I t ∠ θ t , I t ∠ θ t , ..., I kt ∠ θ kt ) are not needed by theadversary. Note that in contrast to previous works [1], [3],[5], no RTU measurements containing power injections andline flows are needed by the adversary. Measurements to be manipulated in the attacking re-gion:
To bypass the BDD of DC state estimation [5], theadversary needs to manipulate all active bus power injec-tions (e.g., P i , ∀ i ∈ Ω A ) and all active line flows (e.g., P tj , ∀ j ∈ Ω A , j = t ). Buses directly connected to thegenerator buses cannot be attacked, because of the assumptionthat the adversary cannot manipulate generator measurements. A. Designing the Attack Vector
As discussed in Section II, in order to launch a stealthyFDIA to bypass the BDD, the attack vector a needs to satisfy a = H c . More specifically, if the adversary wants the poweroperators to believe that the angle of the target node is ˜ δ t ratherthan the true value δ t , the adversary needs to manipulate theline flows and bus injections as follows: • substituting P tj by the fake ˜ P tj for ∀ j ∈ Ω A , j = t : ˜ P tj = B tj (˜ δ t − δ j ) (3) • substituting P t , P j by the fake ˜ P t , ˜ P j : ˜ P t = X j = tj ∈ Ω A ˜ P tj (4) ˜ P j = P j + ˜ P jt − P jt (5) In other words, if the designed deviation c = [˜ δ t − δ t ] T , thenthe attack vector a = [ ˜ P tj − P tj , ˜ P i − P i ] T , ∀ j ∈ Ω A , j = t, ∀ i ∈ Ω A . Obviously, the adversary needs to know accuratevalues of B tj according to (3). Nevertheless, line parametersare critically protected and cannot be easily acquired. In thenext sections, we will draw upon intrinsic load dynamicsand the regression theorem of the Ornstein-Uhlenbeck (OU)process to estimate the line parameters B tj connected to thetarget bus t and exploit the estimation result to design theattack vector. B. The Load Dynamics Inside the Attacking Region
Inside an attacking region, the system can be representedby differential-algebraic equations: ˙ x = f ( x, z ) (6) z = H x (7) where (6) represents the load dynamics and (7) represents therelationship between the states and power injections as wellas power flow relationship. It should be noted that only (7)is considered in former FDIA works, whereas the dynamicsdescribed by (6) are neglected by assuming that the systemis in normal operating state. Nevertheless, we will showthat the adversary can acquire essential information aboutphysical systems, such as line parameters, by exploiting theload dynamics described by (6). For any bus i inside theattacking region Ω A , the stochastic dynamic load model withDC power flow assumption can be represented as: ˙ δ i = 1 τ p i ( P si (1 + σ pi ξ pi ) − P i ) (8) P i = X j ∈ Ω i B ij ( δ i − δ j ) (9) where δ i is the voltage angle of bus i ; P i is the active powerinjection of bus i ; P si is the static active power injection ofus i ; Ω i is the set of buses connected to bus i ; B ij is thesusceptance between bus i and j ; τ p i is the active power timeconstant of bus i ; ξ pi is a standard Gaussian random variable; σ pi describes the noise intensity of load variations.This dynamic model can represent various loads includingthermostatically controlled loads, induction motors, loads con-trolled by load tap changers, static loads, etc. in ambient con-ditions [13]. The difference among various loads is reflectedby time constants, i.e., the relaxation rates of loads, whichmay range from 0.1s to 300s [14], [15]. Dynamic load modelssimilar to (8)-(9) have also been proposed and used in previousworks [13], [16], [17] for stability analysis. In addition, sinceload powers are constantly varying in practice, we make thecommon assumption [13], [17], [18] that static load powers areperturbed by independent Gaussian noises, i.e., P si (1 + σ pi ξ pi ) .Around steady state, (8) can be linearized. By looking at (8)and (9), one can easily observe that the Jacobian matrix J P δ = ∂ P ∂ δ required for linearization carries crucial information of lineparameters, as ∂P i ∂δ i = P j ∈ Ω i B ij and ∂P i ∂δ j = − B ij , for i = j .Therefore, the linearized load dynamics inside the attackingregion can be described in a matrix form as follows: ˙ δ ... ˙ δ k = − τp ... ...
00 0 − τpk P j ∈ Ω i B j ... − B k ... ... ... − B k ... P j ∈ Ω i B kj | {z } A δ ...δ k + τp ... ...
00 0 τpk P s ... ... ... P sk σ p ... ... ... σ pk | {z } S ξ p ...ξ pk (10) Equation (10) can be written in the following compact form: ˙ δ = A δ + S ξ p (11) from which it can be observed that δ is a multi-dimensionalOU process [19] that is Markovian and Gaussian. In addition,as seen from (10), the system state matrix A contains importantinformation of the time constants and the Jacobian matrix,from which the line parameters can be extracted. In the nextsections, a method to estimate matrix A purely from PMUmeasurements will be introduced. Particularly, the methodenables the adversary to estimate the line parameters B tj connected to the target bus t and build the attack vector forlaunching FDIA without requiring any other information otherthan the available PMU data within the attacking region. C. The Regression Theorem for the OU Process
Considering the multi-dimensional OU process in (11), ifthe system state matrix A is stable, which is satisfied in normaloperating state, it can be shown that the τ -lag correlationmatrix of δ satisfies a differential equation [19]: ddτ [ C ( τ )] = AC ( τ ) (12) which is termed as the regression theorem of the multi-dimensional OU process. Particularly, the τ -lag correlationmatrix of δ is defined as: C ( τ ) = E [( δ t + τ − E [ δ t ])( δ t − E [ δ t ]) T ] (13) where E [ . ] denotes the expectation operator. We can therefore estimate A from the τ -lag correlationmatrix of δ by solving (12): A = 1 τ ln[ C ( τ ) C (0) − ] (14) Equation (14) provides an ingenious way of estimating thesystem state matrix A that carries significant physical systeminformation purely from the statistical properties of PMUmeasurements. In practical applications, the τ -lag correlationmatrix C ( τ ) can be estimated by the sample correlation matrixobtained from a finite amount of PMU data as below: ˆ µ δ = 1 N N X i =1 δ ( i ) (15) ˆ C (0) = 1 N − N X i =1 [( δ ( i ) − ˆ µ δ )( δ ( i ) − ˆ µ δ ) T ] (16) ˆ C (∆ t ) = 1 N − M − N X i =1+ M [( δ ( i ) − ˆ µ δ )( δ ( i − M ) − ˆ µ δ ) T ] (17) where N is the sample size of voltage angles, M is the numberof samples that corresponds to the selected time lag ∆ t , δ ( i ) =[ δ ( i )1 , ..., δ ( i ) t , ..., δ ( i ) k ] T represents the i th measurement of allvoltage angles in the attacking region. Thus, the adversarycan obtain the estimated matrix ˆ A as follows: ˆ A = 1∆ t ln[ ˆ C (∆ t ) ˆ C (0) − ] (18) D. Estimation of Time Constants and Line Parameters
Once ˆ A is calculated from the collected PMU data through(18), the adversary can apply the least-squares estimation(LSE) optimization formulation to estimate the time constant τ p t and finally extract the desired line parameters for the attackvector. To this end, (8) can be re-written in its discrete form: t ( δ (2) t − δ (1) t ) ... t ( δ ( n ) t − δ ( n − t ) | {z } Y = ˆ µ P t − P (1) t ... ˆ µ P t − P ( n − t | {z } X (cid:20) τ p t (cid:21) (19) where n is the sample size, P ( i ) t is the i th observation of activepower of the target bus t , i = 1 , ..., n ; ˆ µ P t denotes the samplemean of P ( i ) t ; δ ( i ) t represents the i th observation of voltageangle of bus t . Therefore, the time constant can be estimatedas / ˆ τ p t = ( X T X ) − X T Y by the LSE method. Note thatthe real power injection at bus t can be computed from thePMU measurements of voltage and current phasors at bus t .Once ˆ τ p t is obtained, the adversary can use the resulttogether with the estimated ˆ A from (18) to estimate theline parameters ˆ B tj . The proposed FDIA model against DCstate estimation without pre-knowledge of line parameters issummarized in Algorithm 1 below.
Remarks: • In this paper, s emulated PMU measurements with asampling rate of Hz are used for Step 2, while only a fewmilliseconds e.g., 0.0041s, are needed for Steps 3-6. • The proposed FDIA against DC state estimation needs onlya small number of PMU measurements inside the attackingregion, whereas no additional measurements (i.e., line flowsand line parameters) are required to carry out the attack. • The adversary is aware of the network connectivity, whichis a reasonable assumption in many works [5], [7], [8], [20].Yet, the exact line parameters that may vary in practice are notrequired, highlighting the superiority of the proposed methodcompared to topology dependent methods. lgorithm 1
The proposed FDIA model against DC stateestimation without line parameters . Choose one target bus t and determine attacking region Ω A . . Collect N voltage measurements for k buses inside attack-ing region and n current phasor measurements only for bus t from PMUs; Calculate the real power injections at bus t . . Calculate the estimated matrix ˆ A through (15)-(18). . Estimate the time constants ˆ τ p t through (19). . Estimate the line admittance ˆ B tj from ˆ A and ˆ τ p t . . Given the target malicious phasor ˜ δ t , design the attackvector a through (3)-(5). E. Analysis on the Performance of the Proposed FDIA Model
In this section, sufficient conditions for
Algorithm 1 arepresented as the theoretical basis for the proposed FDIA.
Theorem 1 : If the number of independent measurements isequal to the number of states to be estimated, then theproposed algorithm is perfect, i.e., the residual remains thesame before and after the attack.
Proof: the Jacobian matrix estimated by the adversary can berepresented by ˆ H = H + ∆ H due to the estimation error in B tj . Then the attack vector designed by the adversary takesthe form a = ˆ Hc = ( H + ∆ H ) c , where c is the deviationintended to be injected to bus t . The measurement to bemanipulated is z bad = z + a = z + ( H + ∆ H ) c . At the poweroperators’ side, if DC state estimation is exploited, the resultof (2) is ˆ x bad = ˆ x + c +( H T W H ) − H T W ∆ H c . Consequently,the residual after the FDIA is r bad = k z bad − H ˆ x bad k ∞ = (cid:13)(cid:13)(cid:13) r + ( I − H ( H T W H ) − H T W )∆ H c (cid:13)(cid:13)(cid:13) ∞ . It can be observedthat if the number of independent measurements is the sameas that of states to be estimated, i.e., H is a square matrixwith full rank, then the FDIA is perfect as r bad = r .However in real-life applications, the number of measure-ments is typically larger than that of states. If the matrix H isfull rank but not a square matrix, the residual after the attackmay not remain the same and depends on ∆ H c .It will be demonstrated in Section IV that the proposedFDIA can launch targeted large deviation attacks with a highsuccess rate owing to the good estimation accuracy of ˆ H .IV. C ASE S TUDIES
In this section, the proposed FDIA model is tested on amodified IEEE 39-bus 10-generator system. We consider theworst situation for the adversary, i.e, the power system is fullymeasured by RTUs for state estimation purposes at the controlroom, while the adversary can only collect limited PMU datawithin the attacking region. In this study, there are totally 85RTU measurements containing 39 bus injections and 46 lineflows used by the system operator for state estimation. All 85measurements contain independent Gaussian noises describedby ∀ e i ∈ e , e i ∼ N (0 , . ) in (1). Note that these RTUmeasurements are not used by the adversary. A. Constructing the Proposed FDIA without Line Parameters
Assuming the adversary intends to manipulate the voltageangle of bus 15, then the attacking region includes bus 15 as well as buses 14 and 16 that are directly connected tobus 15, as defined in Section III and shown in Fig. 2. Thetime constants of the loads inside the attacking region areset arbitrarily as [ τ p , τ p , τ p ] = [0 . , . , . ; theprocess noise intensities σ pi , i ∈ { , , } in (8) describingpower variations are set to be 1. As the proposed FDIA ispurely measurement-based, its robustness against measure-ment noise should be tested. Following the approach in [21],PMU measurement noises with a standard deviation of 10%of the largest state changes between discrete time steps areadded to the PMU data of voltages and currents utilized bythe adversary. It will be shown that through the proposedFDIA method, the adversary can stealthily bypass BDD tomanipulate the angle of bus 15.By Algorithm 1 , the adversary collects s, 60 Hz PMUdata of voltage angle measurements for all the buses inside theattacking region (i.e., bus 14, 15, and 16) as well as currentphasor measurements of the target bus 15, i.e., N = 18000 in (15) and n = 10 in (19), then the matrix A and the timeconstants /τ p can be estimated by (18)-(19). With theseestimations, the estimated line admittances ˆ B − , ˆ B − can be extracted. Table I presents the estimation results forthe time constants and line admittances, showing relativelygood estimation accuracy.Once the line admittances are estimated, the adversary candesign the attack vector according to (3)-(5). Assuming theadversary launches an attack such that ˜ δ = 10 ◦ , TableII presents a comparison between the estimated state valuesinside the attacking region through the DC state estimationbefore and after the attack, which validates the effectivenessof the proposed FDIA method.Fig. 2: The attacking region for bus 15.TABLE I: T RUE AND E STIMATED V ALUES OF L INE P ARAMETERS AND T IME C ONSTANTS
Time constant True value (s) Estimated value (s) τ p Line Parameter True value (pu) Estimated value (pu) B − -45.786 -39.634 B − -105.42 -101.64 TABLE II: DC S
TATE E STIMATION R ESULTS B EFORE AND A FTER THE A TTACK ˜ δ = 10 ◦ State Variables Before attack (degree) After attack (degree) δ . ◦ . ◦ δ . ◦ . ◦ δ . ◦ . ◦ . Different Attack Vectors under DC State Estimation As shown in (3), the estimation error of the line admittance B tj may affect the residual after the attack. To test theperformance of the FDIA model under the estimation errorof line parameters, different attacks are tested. Various MonteCarlo simulations using 1000 samples have been carried out.Fig. 3 presents the probabilities of the FDIAs to bypassthe BDD for different attacks. If we choose 95%-quantileof the residual before the attacks, i.e, γ = 0 . to bethe BDD threshold, the probabilities to bypass the BDD for ˜ δ = 0 ◦ , ˜ δ = 10 ◦ , ˜ δ = 20 ◦ , ˜ δ = 26 ◦ are 94.7%, 95.3%,94.2% and 93.5%, respectively, showing that the adversary cansuccessfully bypass the BDD even for big deviation attacks. C. Different Attack Vectors under AC State Estimation
Although the proposed FDIA is based on DC model, we alsotest its performance if AC state estimation is implemented inthe control room. As seen in Table III, the attack ˜ δ = 10 ◦ can still be launched successfully. Meanwhile, the states ofother buses inside the attacking region are almost unaffected.Nevertheless, if the designed deviation c becomes larger,the proposed FDIA method may fail as the adversary does notmanipulate reactive power in the system due to the assumptionof DC model. As presented in Fig. 4, the probabilities to by-pass the BDD in AC state estimation for ˜ δ = 0 ◦ , ˜ δ = 10 ◦ , ˜ δ = 15 ◦ , ˜ δ = 20 ◦ are 95.5%, 93.6%, 0% and 0%, respec-tively, if the 95-quantile of the residual in AC state estimationbefore the attacks, i.e., γ = 0 . , is used. These resultsshow that, if the adversary intends to launch large deviationattacks with higher success rates, future efforts on designingtargeted FDIA attacks against AC state estimation are needed.V. C ONCLUSION
In this paper, a novel FDIA model against DC state esti-mation using PMU data has been proposed, which can targetspecific states without any pre-knowledge of line parameters.Sufficient conditions for the proposed FDIA model are alsoprovided. Numerical results showed that the proposed modelcan launch targeted large deviation attacks with high proba-bilities, if DC model is exploited. Future works on designingFDIA against AC state estimation are needed for large attacks. (a) (b)
Fig. 3: (a). Probability to pass the BDD for different attacks ifDC state estimation is applied; (b). Zoomed-in picture of (a).TABLE III: AC
STATE ESTIMATION RESULTS BEFORE ANDAFTER ATTACK WITH ˜ δ = 10 ◦ State Variables Before attack After attack V ∠ δ . ∠ . ◦ . ∠ . ◦ V ∠ δ . ∠ . ◦ . ∠ . ◦ V ∠ δ . ∠ . ◦ . ∠ . ◦ (a) (b) Fig. 4: (a). Probability to pass the BDD for different attacks ifAC state estimation is applied; (b). Zoomed-in picture of (a).R
EFERENCES[1] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks againststate estimation in electric power grids,”
Proc. ACM Conf. Comput.Commun. Security , pp. 21–32, 2009.[2] G. Liang et al. , “False Data Injection Attacks Targeting DC Model-Based State Estimation,”
IEEE PES General Meeting , Chicago, IL, USA,2017.[3] Y. Yuan et al. , “Modeling load redistribution attacks in power systems,”
IEEE Trans. Smart Grid. , vol. 2, no. 2, pp. 382–390, 2011.[4] Yang et al. , Qingyu, “On false data-injection attacks against powersystem state estimation: Modeling and countermeasures,”
IEEE Trans.on Paral. and Distrib. Syst. , vol. 25, no. 3, pp. 717–729, 2014.[5] M. A. Rahman and H. Mohsenian-Rad, “False data injection attackswith incomplete information against smart power grids,”
Proc. IEEEGLOBECOM Conf. , pp. 3153–3158, 2012.[6] X. Liu et al. , “Modeling of Local False Data Injection Attacks WithReduced Network Information,”
IEEE Trans. Smart Grid , vol. 6, no. 4,pp. 1686–1696, 2015.[7] R. Deng and H. Liang, “False Data Injection Attacks with LimitedSusceptance Information and New Countermeasures in Smart Grid,”
IEEE Trans. Ind. Informat. , vol. 15, no. 3, pp. 1619–1628, 2019.[8] Z. Zhang et al. , “Zero-Parameter-Information FDI Attacks AgainstPower System State Estimation,”
Proc. American Control Conf. , vol.2020-July, pp. 2987–2992, 2020, 2020.[9] M. Esmalifalak et al. , “Stealth false data injection using independentcomponent analysis in smart grid,”
IEEE SmartGridComm , pp. 244–248, 2011.[10] Z. H. Yu and W. L. Chin, “Blind False Data Injection Attack UsingPCA Approximation Method in Smart Grid,”
IEEE Trans. Smart Grid ,vol. 6, no. 3, pp. 1219–1226, 2015.[11] G. Liang et al. , “The 2015 Ukraine Blackout: Implications for False DataInjection Attacks,”
IEEE Trans. Power Syst. , vol. 32, no. 4, pp. 3317–3318, 2017.[12] B, Sobczak, “Major hack hits energy companies, U.S. agencies,” E & ENews , 2020.[13] C. A. Ca˜nizares, “On bifurcations, voltage collapse and load modeling,”
IEEE Trans. Power Syst. , vol. 10, no. 1, pp. 512–522, 1995.[14] D. Karlsson and D. J. Hill, “Modelling and identification of nonlineardynamic loads in power systems,”
IEEE Trans. Power Syst. , vol. 9, no. 1,pp. 157–166, 1994.[15] X. Wang, “Estimating dynamic load parameters from ambient PMUmeasurements,”
IEEE PES General Meeting , Portland, USA, 2018.[16] G. Pierrou and X. Wang, “Analytical Study of the Impacts of StochasticLoad Fluctuation on the Dynamic Voltage Stability Margin UsingBifurcation Theory,”
IEEE Trans. Circ. and Syst. I , vol. 67, no. 4, pp.1286–1295, 2020.[17] H. Mohammed and C. O. Nwankpa, “Stochastic analysis and simulationof grid-connected wind energy conversion system,”
IEEE Trans. EnergyConv. , vol. 15, no. 1, pp. 85–90, 2000.[18] G. Pierrou and X. Wang, “Online PMU-Based Method for EstimatingDynamic Load Parameters in Ambient Conditions,”
IEEE PES GeneralMeeting , Montreal, Canada, 2020.[19] C. Gardiner, “Stochastic Methods: A Handbook for the Natural andSocial Sciences,” 2009.[20] X, Liu and Z, Li, “Local load redistribution attacks in power systemswith incomplete network information,”
IEEE Trans. Smart Grid , vol. 5,no. 4, pp. 1665–1676, 2014.[21] N. Zhou, D. Meng, and S. Lu, “Estimation of the dynamic states ofsynchronous machines using an extended particle filter,”