2.1 State-space model

Power system state estimation can be categorized into two primary methods: DC (Direct Current) estimation and AC (Alternating Current) estimation.The state variables in AC estimation encompass both the phase angle and the voltage magnitude, providing a comprehensive representation of the system's state.In contrast, DC estimation, a simplified version, includes only the voltage magnitude, omitting the phase angle.In this manuscript, we focus primarily on the more prevalent AC estimation approach due to its comprehensiveness and applicability in practical scenarios.Similar to the work presented in [18], the state signal obtained in real-time by sensors can be considered as a discrete-time function concerning the voltage amplitude $A_v$ and the phase angle $\left(\theta +\varphi \right)$, denoted as :

By expanding the trigonometric function in Eq.1, we can derive the following equation:

Assuming that the voltage frequency $\omega$ of the system's buses remains constant over time, and considering only the voltage amplitude and phase angle as variables in the state space, we define the system's state as $x_1=A_v\cos \left(\omega t\right)$ and $x_2=A_v\sin \left(\omega t\right)$. The state signal $V\left(t\right)$ acquired by the sensor can be expressed as:

Assuming there are no additional delays in the system and taking into account the process noise and measurement noise in the calculation, the state equation and measurement equation for the system's buses are:

Based on the state and measurement equations presented, the control center can perform optimal estimation of the system state using the Kalman filter. The estimation process of the Kalman filter follows the formula shown below:

2.2 Attack model

In this section, we would like to model prevalent cyber threats within power system networks. We mainly focuses on DoS attacks, linear FDI attacks targeting single estimator systems, and stochastic stealth attacks targeting multi-estimaor systems. We begin our analysis with the most fundamental form of DoS attack. The DoS attack, which is an aggressive maneuver designed to impede the control center's ability to retrieve data from sensors. This disruption is orchestrated by adversaries who either sever communication channels or inundate the network with an excessive deluge of data packets, consequently compromising bandwidth and thwarting the transmission of essential data[3, 4]. In this manuscript, the DoS attack on estimator $i$ is modeled as a Bernoulli variable ${\gamma }_i\sim ℬ(1,p)$, implying that the occurrence of an attack is a stochastic event that can be described by a Bernoulli distribution. The Bernoulli distribution is a discrete probability distribution with only two possible outcomes: ${\gamma }_i=0$ (the attack occurs) and ${\gamma }_i=1$ (the attack does not occur).In the context of DoS attacks, the probability of fail attack is denoted by $p$, and the probability of successful attack is $1-p$.

We assume that the attacker's assault is exerted during the process where the sensor transmits the innovation $z$ to the estimator. Assuming that the $i_{th}$ sensor is under attack, all subsequent subscripts $i$ in the following text refer to estimator $i$. Consequently, the innovation received by the estimator can be represented as:

When the attack is successful, ${\gamma }_i\left(t\right)=0$, indicating that the estimator is unable to receive the innovation transmitted from the sensor. Conversely, when the attack fails, the innovation transmitted to the estimator remains unaffected. So that we have completed the modeling of the DoS attack.

Next, we consider linear FDI attacks targeting single-estimator systems. Similar to the mathematical model used in man-in-the-middle attacks [5, 6], we assume that the attacker has complete knowledge of the system's physical model and possesses the capability to access and alter measurements. Specifically, the attacker can arbitrarily modify the innovation $z_i$ obtained by the estimator. Consequently, the attack strategy against estimator $i$ can be defined as:

Regarding the non-linear function $f_k$, it is challenging to analyze its statistical properties, which complicates the determination of system performance and the effectiveness of attacks. Additionally, linear transformations of data do not alter the type of statistical distribution of the data, which enables attackers to deceive detectors that rely on distribution properties. Furthermore, in real-world power systems, random linear attacks may be more feasible and cost-effective to implement. Therefore, we only focus on FDI attacks under the assumption of linear functions [24].

where $T_i$ is an arbitrary attack matrix and $b_i$ is a constant independent of $z_i$.

In light of the preceding discussion, we now turn our attention to stochastic stealth attacks targeting multiple estimators. The linear FDI attacks strategy mentioned earlier impose demanding requirements on the attackers, necessitating capabilities that are not feasible to replicate across multiple estimators simultaneously. Additionally, the multi-estimator system significantly increases the complexity of information, which renders the attack methods applied to single estimators ineffective or less potent. To maximize the impact of attacks within a system equipped with multiple estimators, a stochastic stealthy attack strategy based on maximum attack probability has been proposed in [25]:

where $c_i$ represents if there is an attack present in the communication channel of estimator $i$.$P\left(c_i=1\right)=p$, representing the attack being applied to estimator $i$ and $P\left(c_i=0\right)=1-p$, indicating that estimator $i$ is not under attack. The attack signal ${\zeta }_i\sim 𝒩(0,{\sigma }_{\zeta })$ is a Gaussian distribution that is independent of $z_i$. With the modeling of the three attack methodologies now complete, it is important to note that the strategies discussed are among the simpler to implement, offer effective attack outcomes, and possess a high degree of stealth. In the realm of power systems, there also exist FDI attacks constructed through data-driven approaches and physical-model based methods. However, these alternatives present various challenges: some are not suitable for dynamic estimation, others demand extensive datasets, and some could be too demanding for attackers. Furthermore, certain methods can disrupt the statistical properties of data, making them more susceptible to detection by common detectors, such as those based on KL-divergence. For these reasons, they are not within the scope of the present discussion.

2.3 Detection model

We now proceed to discuss the detection model within the system. The extensive wireless sensor networks in smart grids offer ample opportunities for attackers to launch attacks. Consequently, it is imperative to have a detector at the controller end to scrutinize the acquired data for any anomalies or signs of compromise. In the realm of dynamic estimation within smart grids, detectors based on the Kullback-Leibler (KL) divergence have demonstrated remarkable efficacy in detecting cyber attacks. KL-divergence is a crucial concept used to quantify the differences between two probability distributions, which can measure the degree of difference between an actual distribution and another expected distribution. Its definition follows:

where $f_{{\tilde{\gamma }}_k}$ and $f_{{\gamma }_k}$ are the probability density function of random sequences $\widetilde{{\gamma }_k}$ and ${\gamma }_k$.It can be observed that $D\left({\tilde{\gamma }}_k\parallel {\gamma }_k\right)=0$ if and only if $f_{{\tilde{\gamma }}_k}=f_{{\gamma }_k}$, and the K-L divergence is generally not symmetric, ie., $D\left({\tilde{\gamma }}_k\parallel {\gamma }_k\right)\ne D\left({\gamma }_k\parallel {\tilde{\gamma }}_k\right)$[28]. When $D\left({\tilde{\gamma }}_k\parallel {\gamma }_k\right)\le \delta$ , no anomalies are detected by the sensors, and the data acquired by the estimator is considered normal.When $D\left({\tilde{\gamma }}_k\parallel {\gamma }_k\right)>\delta$, the sensors trigger an alarm, indicating that the data requires inspection. It is necessary to troubleshoot and mitigate any faults or stop any ongoing attacks before resuming normal operation.

3.1 Multi-estimator based estimation

In this section, we present our main results, beginning with the distribution approach based on multi-estimator information fusion. When anomalies occur within the system, state estimation relying on single estimator must be stopped to address the issues before resuming operations. However, the measurement data from certain critical buses are essential for the whole system, and even brief interruptions can lead to significant losses. Therefore, this manuscript is dedicated to devising a novel estimation strategy that ensures the system's continuous operation despite the presence of faults or under attack. It is evident that a single estimator is inadequate for the task of state estimation mentioned above. Therefore, we contemplate employing an approach that integrates information from multiple estimators to achieve this objective. Dynamic estimation based on the fusion of information from multiple estimators has become a widely applied method for interference-resistant estimation in recent years. Since the estimators are independent of each other and the attacker's capabilities are limited, an attack on a single estimator cannot affect the entire state estimation process. Utilizing an estimation approach that fuses information at critical buses can effectively ensure that the system continues to operate normally even when attacks are detected.

Figure 1 Schematic of multi-estimator based state estimation.

First, we need to select key buses based on economic considerations and the degree of information redundancy[29], and deploy multiple estimators at these critical buses. The structure of the estimator network at the key buses is shown in Figure 1. Each estimator includes a PMU for independently collecting data, a Kalman filter for estimating the state, and communication equipment for transmitting data. Each estimator operates independently, processing data and generating results that are subsequently subjected to a verification procedure. If the results are deemed normal, they are incorporated into subsequent computational steps. However, if any anomalies are detected, the communication of the respective estimator is immediately severed, and an alarm is triggered to alert system operators. By combining the estimation results from neighbor estimators, the estimated state vector ${\hat{x}}_i\left(t\right)$ at time $t$ and estimated covariance matrix ${\hat{P}}_i\left(t\right)$ by estimator $e_i$ can be obtained as follows:

where $N_i$ represents the set of estimators that can exchange information with estimator $e_i$, including $e_i$ itself. The variable ${\lambda }_{ij}\left(t\right)$ denotes the detection outcome of the detector in estimator $e_j$ at time $t$. If the detection is normal at that moment, ${\lambda }_{ij}\left(t\right)=1$; if estimator $e_j$ is abnormal at that moment, its communication network is severed by the detector, and ${\lambda }_{ij}$ will remain 0 until the anomaly is resolved. The notation ${\hat{x}}_{ij}\left(t\right)$ and ${\hat{P}}_{ij}\left(t\right)$ represent respectively the estimation result and covariance matrixz received by estimator $e_i$ from estimator $e_j$.The convergence of this distributed method has been demonstrated in [30].The weight $w_{ij}\left(t\right)$ indicates the influence of the results obtained by estimator $e_j$ within estimator $e_i$; For the time being, all estimation results are assigned equal weight.

A multitude of strategies have been proposed to counteract FDI attacks in sensor networks such as the correntropy-based method [31] and partial consensus method [32] . However, with the constraints on computational resources and bandwidth at buses within power systems, the feasibility of implementing highly sophisticated methods is limited. Consequently, we have adopted a more straightforward weighted approach, which is better suited to the operational realities of power system environments. We will make improvements based on arithmetic and bandwidth constraints in next subsection.

Subsequent numerical experiments have demonstrated that our methodology is capable of sustaining the regular functioning of crucial buses within the system, even in the scene of DoS and FDI attacks."

3.2 KL-divergence based weighting strategy

In the event of cyber attacks, the multi-estimator based data fusion approach is adept at sustaining the system's normalcy even amidst anomalous conditions.Nevertheless, with the advancement in attackers' capabilities, the stealthiness and destructive potential of these attacks have escalated.As delineated in [23] and [24] two stealthy FDI attack models are presented, which not only evade detection by KL-divergence detectors but also inflict substantial damage on the system. When confronted with such stealth attacks, the aforementioned method falls short in reducing the influence imposed by these threats.

Prior to implementing the novel weighting strategy, it is essential to determine the differences between the actual innovation probability distribution under cyber attacks and the prior probability distribution of the innovation.

4.1 Kalman Filter

First we conducted a test on the Kalman Filter(KF) estimation. The system's initial parameters are set as follows: $x_1\left(0\right)=0$, $x_2\left(0\right)=0$, and the covariance matrix $P$ is set to the identity matrix (these initial conditions were maintained consistent throughout the subsequent experiments). Matlab function $randn\left(\right)$ is used to produce normally distributed noise. We define the sinusoidal voltage signal with noise as the input and the resulting signal from the state estimation is taken as the output. The experimental results are presented in Figure 2. The red curve denotes the input signal, while the blue one indicates the output. It can be seen that the output curve from the state estimation closely matches the input signal, which sufficiently meets the typical requirements of the power system.

Figure 2 Kalman Filter estimation when there is no attack.

4.2 Estimation under DoS attack

Subsequently, we consider the state estimation under DoS attack. The attacker applies the attack in a manner that maximizes their attacking capability, which means that each estimator is subject to an attack with equal probability. As mentioned before, the difference between the probability distributions only related to the probability of each estimator being attacked. Consequently, in such circumstances, there is no distinction between two different weighting methods. Therefore we only focus on the discrepancies between KF estimation and multi-estimator based estimation.

Figure 3 Kalman filter estimation under DoS attack.

When an attacker is unable to target all estimators within a system, multi-estimator based estimation invariably outperforms KF estimation. The advantage is apparent because there are estimators within the system that remain unaffected by the attacks, which can offer data compensation for those estimators that are under attack during the estimation process, thereby reducing the attack's influence. Consequently, in our experiments, we assume that all estimators are subjected to the attacker's assault with an equal probability of $1-p$. Referring to [16], we select $1-p=0.6$ as the probability of a successful attack. Upon a successful attack, the communication channels transmitting data will be severed, rendering estimators incapable of receiving measurements from the sensors.

The results obtained from the KF estimator are depicted in Figure 3. The experimental outcomes reveal that the KF estimation exhibits noticeable errors, demonstrating the impact of data loss on state estimation. The results of the Multi-estimators estimation are presented in Figure 4. Even when all estimators are under attack, the output signal from the state estimation closely resembles the input signal, which is significantly superior to the KF estimation. The Multi-estimator based estimation has a probability of only ${\left(1-p\right)}^3$ for complete data loss, whereas the single estimator has a probability of $p$, thus being more markedly affected by DoS attack.

Experiments have demonstrated that in the presence of DoS attacks within the system, Multi-estimator based estimation exhibits superior robustness, yielding more precise estimation results .In next subsection we will consider the performance of different estimation methods when confronted with FDI attacks.

Figure 4 Multi-estimators based estimation under DoS attack.

4.3 Estimation under Linear FDI attack

In this subsection we simulate the linear FDI attack targeting single estimator. Initially, we test an attack that triggers the detector alarm, which means the FDI attack does not possess stealthiness. When the detection result exceeds the threshold, the detector status turns to abnormal, and the communication channel transmitting information from the corresponding estimator is severed. The estimated state of the bus will be provided by other estimators. Furthermore, obtaining the KL-divergence requires sufficient data to determine the probability distribution, which is easily obtainable in power systems. We reset the sampling time to 1s, with the first 0.9 s dedicated to data collection, and estimation of the state commences from 0.9 second. We apply an attack on Estimator 1, and according to Equation 8, we set $T_i$ to 1.7 and the constant $b_i$ to 0.08. Under this simple attack, the detector will trigger an alarm, while the other estimators will not be affected by the attack's influence. The state of the detector at 0.9s is abnormal. The results from three different estimators are presented in Figure 5.

Figure 5 Comparison of three estimation methods under linear FDI attack.

The experimental outcomes clearly demonstrate that the KF estimator exhibits the least favorable performance. This deficiency stems from the absence of extra estimators within its system to counteract the effects of the attack on single estimator. Multi-estimator based method yields estimation results that markedly outperform those of the KF estimator. This enhancement is attributed to the presence of two estimators within the system that are impervious to the attack. Despite equal weighting of the estimation states from all three estimators, the two uncompromisable estimators contribute precise data, thereby substantially diminishing the detrimental effects of the FDI attack.

The estimation method based on KL-divergence yields the best results, which is quite understandable. At the beginning of state estimation, the attacked estimator is marked as abnormal, its communication channel is severed, and the results it yields no longer impact the entire system; the remaining state estimation is accomplished solely by the unaffected estimators. In other words, the detector can effectively block FDI attacks that do not possess stealthiness, and the system will remain unaffected by such attacks. This experiment only serves to demonstrate the effectiveness of the KL-divergence detector, but it does not indicate the advantages of the weighted strategy. We will proceed to illustrate the superiority of the new estimation method through stealthy attacks.

Figure 6 Comparison of three estimation methods under stealth linear FDI attack.

Next we take the stealth FDI attack into consideration. According to [24], we can obtain the attack parameters that yield the most effective results without being detected. We reset parameter $T_i$ to 1.3 and $b_i$ to 0.06, which will have the greatest impact on the estimator while maintaining stealth. The attack is still applied to Estimator 1.The experimental results are shown in Figure 6.

The estimation performance of the KF estimator remains the poorest, with its output signal being affected to a similar extent as the one in Figure 5, which indicates that the modified FDI attack not only has stealth characteristics but also achieves significant disruptive effects. The Multi-estimator based method yields better results than the KF estimator but falls short compared to the KL-divergence based method. However, due to the stealthiness of the attack in this experiment, the detector fails to trigger an alarm and sever the communication channel of Estimator 1.Consequently, the KL divergence based method cannot produce a signal entirely unaffected by the attack as seen in Figure 5.It can only rely on the weighted strategy to assign a lower weight to the more severely affected estimation results, thereby reducing the estimation error.

To better demonstrate the advantages of the new weighting strategy, we compare the absolute errors between the results obtained from the KL-divergence based method and the Multi-estimator based method with the input signal. The errors $\left|e_i\right|$ can be obtained by: $\left|e_i\right|=\left|\widehat{z_i}-z_i\right|$.The comparison results are presented in Figure 7.

Figure 7 Comparison of estimation errors under linear FDI attacks with different weighting strategy.

In Figure 8, the horizontal axis represents time, and the vertical axis represents the absolute value of the estimation error. Blue curve represents the error of the Multi-estimators based method, and the red one represents the error of the KL-divergence based method. It is evident that for the majority of the time, the blue curve is above the red curve, indicating that the method employing the new weighting strategy yields better estimation results.

The outcomes illustrated in Figures 5 and 6 indicate that in the presence of undetectable stealthy attacks within the system, the novel weighting strategy effectively enhances the estimation's robustness and precision. Despite the detector's inability to trigger an alarm or sever the communication channels, this strategy mitigates the influence of the attacked estimation results by apportioning varying weights. Consequently, it elevates the significance of the unaffected estimation outcomes, bolstering the system's resilience against such stealth attack.

4.4 Estimation under Stochastic Stealth FDI attack

Finally, we will test the system's estimation performance under Stochastic Stealth FDI attack. According to Equation 9, we set the intensity of ${\zeta }_i$ to three times the level of the system noise. Referring to reference [23], we set $p$ to 0.6, which that the probability of each estimator under attack is $p=0.6$ . When an estimator is attacked, a stronger Gaussian noise is superimposed on the innovation $z_i$.The output signals estimated by three different methods are displayed in Figure 8:

Figure 8 Comparison of three estimation methods under stochastic stealthy FDI attack.

Unlike the previous experimental results, in this experiment, the estimation effect of the KF estimator is not significantly worse than that of the Multi-estimators based method. Upon reviewing the experimental data, we analyzed the cause of this outcome: when attacking all estimators with a probability of 0.6, two estimators in the Multi-estimators based method were attacked. With two estimators simultaneously under attack, the single normal estimation result could not offset the influence of the two abnormal results, leading to an estimation accuracy similar to that of the KF estimation. In contrast to these two methods, the results obtained by the KL-divergence based method were largely unaffected by the attacks, as the abnormal results were assigned a sufficiently small weight, while the normal results had a higher weight, which dominated in the final outcome. Therefore, as long as there are estimators in the system that are not under attack, the estimation method employing the new weighting strategy will maintain a high level of estimation accuracy. As mentioned earlier, the attacker's capabilities are greatly limited, and it is essentially impossible to launch simultaneous attacks on all estimators in the system (usually 3 to 4).Thus, the methods proposed in this manuscript essentially meet the needs of state estimation in power systems.

Figure 9 Comparison of estimation errors under stochastic stealth FDI attacks with different weighting strategy.

Similar to the previous subsection, in this experiment, we again compared the estimation errors of two methods. The results are displayed in Figure 9, where blue still represents the Multi-estimators based method and red one represents the KL-divergence based method. It is evident that the blue curve is significantly higher than the red one, which indicates that the new weighting strategy yields a smaller estimation error and higher precision.

It is noticed that the Figure 9 reveals a representative phenomenon: when the estimation errors of both methods are relatively small, the difference in height between the two curves is not significant. However, when the blue curve rises prominently, the difference in height between the curves becomes markedly evident. The explanation for this phenomenon is that the noise added to the estimators follows a normal distribution with a mean of zero so that the intensity of the attack on the innovation $z_i$ varies at different time. Although the new weighting strategy assigns higher weights to the correct results, it does not fully demonstrate its advantage when the attack is weak, leading to minimal differences between the two curves. In contrast, when the attack is strong, the new method reduces the weight of the abnormal results sufficiently, effectively mitigating the impact of the attack, which results in a significant difference between the two curves.

Figure 10 Comparison of estimation errors under different mitigation attack algorithms.

Furthermore, to demonstrate the superiority of the approach outlined in our manuscript, we have conducted comparative experiments between the algorithm presented in our work and the method described in [30]. The results of these experiments are depicted in Figure 10, where the red line corresponds to the KL divergence-based method. The experimental findings indicate that, in the vast majority of instances, our method provides more precise estimation outcomes. This is readily understandable, as a meticulously crafted attack vector does not significantly alter the covariance but substantially affects the KL divergence of the innovation. Consequently, our method outperforms in such scenarios.

Through the experiments conducted in the four subsections above, we have demonstrated that our method can effectively maintain the normal operation of state estimation under no attack, DoS attacks, regular FDI attacks, and stealthy FDI attacks.Additionally, we have proven the superiority of the new weighting strategy in terms of robustness and estimation accuracy when facing attacks.