Cyber security in power systems has become increasingly critical with the rise of network attacks such as Denial-of-Service (DoS) attacks and False Data Injection (FDI) attacks. These threats can severely compromise the integrity and reliability of state estimation, which are fundamental to the operation and control of power systems. In this manuscript, an estimation algorithm based on the fusion of information from multiple estimators is proposed to ensure that state estimation at critical buses can function properly in case of attacks. Our approach leverages a network of estimators that can dynamically adjust to maintain system stability and accuracy. Furthermore, a new detector is adopted based on Kullback-Leibler divergence to detect linear FDI attacks. To address stealthy attacks that may evade detection, we propose a novel weighting scheme that reduces the impact of attacks on estimation results. Numerical experiments demonstrate the effectiveness and accuracy of our proposed estimation algorithm under cyber attacks.
state estimationsmart griddata fusionKullback-Leibler divergencecyber attackIntroduction
State estimation, as an important backbone of smart grid, providing critical data essential for the operation and surveillance of power systems. Yet, with the proliferation of intelligent devices and communication networks, the risk of cyber threats has correspondingly increased. Attackers can employ diverse cyber-attack methods to disrupt the functioning of state estimation, thereby impacting the stable operation of the system. The two most prevalent forms of cyber attacks are DoS attacks and FDI attacks. DoS attacks aim to disrupt the communication channels, preventing the transmission of data between sensors and estimators. FDI attackers replace the measurements with designed false data, resulting in incorrect state estimations. Both types of attack have the potential to result in significant consequences [2, 3, 4, 5, 6].
Recently, numerous studies have been conducted on cyber attacks within power systems. Traditional state estimation methods are based on static estimation using the least squares approach. To detect cyber attacks in the system under static estimation, researchers in [7] have explored how to enhance the robustness of power system state estimation against stealthy FDI attacks. The authors proposed a method that combines data preprocessing with post-processing of state estimates to reduce the likelihood of successful attacks by adversaries. An optimization-based approach was presented in [8] to maximize the impact of attacks, and the manuscript discussed how to mitigate these attacks by adjusting system parameters. A probabilistic approach is employed in [9] to analyze and defend against FDI attacks. The researchers introduced a detection algorithm based on a probabilistic model, aimed at enhancing the power system's resilience against such attacks. Moving target denfence (MTD) has emerged as an effective strategy for detecting FDI attacks within the static state estimation of power systems. Defenders increase the error introduced by the attack vector by altering the system's topology. Comprehensive analyses have been conducted in [10, 11, 12, 13, 14], defining both complete and incomplete MTD and designing robust denfence algorithms. Reference [15] takes economic factors into account, and an optimal defense strategy is presented by integrating game-theoretic methods. Additionally, detection methods based on machine learning have recently gained widespread research attention, playing a significant role in attack detection [16, 17].
With the continuous development of smart grids, the static estimation, which is computationally simple and updates at a slower frequency, no longer meets the demands of modern power systems. Dynamic estimation based on the Kalman filter is gradually becoming the mainstream in state estimation [18]. Dynamic state estimation in power systems, augmented by high-sampling and high-precision measurements from Phasor Measurement Units (PMUs), effectively enhances the detection of cyber attacks within the system. Reference [19] introduces an Extended Kalman Particle Filter-based approach for dynamic state estimation in power systems. By constructing the importance sampling density function within the particle filter using the Extended Kalman Filter, it effectively addresses the particle degeneracy issue, achieving high-precision state estimation. References [20] and [21] further refine the Kalman filter within the context of dynamic estimation, significantly improving the system's robustness. The authors derive and calculate the range of attack vectors for three types of attacks that can successfully destabilize the system, and determine the range of failure for the chi-squared detector against FDI attacks in [22].
The methods described above are capable of detecting cyber attacks within a system and initiating alarms, with the resumption of normal state estimation operations contingent upon the resolution of detected anomalies. However, the operation of power systems is critically important, and even brief periods of maintenance can lead to substantial economic losses. Furthermore, as the capabilities of attackers advance, there has been a surge in research on stealth FDI attacks [23, 24]. These meticulously designed attack vectors can evade detection while inflicting the maximum possible damage on the system. Consequently, there is an urgent requirement for estimation algorithms that can sustain the normal functioning of power systems under attacks and significantly reduce the impact of such attacks. It is evident that traditional estimation methods, which rely on a single estimator, are inadequate for achieving this objective. In this manuscript, we introduce an innovative approach by combining information-fusion-based distributed algorithms with dynamic power system estimation to address the current challenges. Information fusion, a cutting-edge technology, is particularly effective in mitigating the effects of data loss and the introduction of false data [25, 26, 27]. We introduce a novel multi-estimator-based distributed estimation methodology, which is designed to effectively diminish the repercussions of data loss and the infiltration of false data. Furthermore, we have developed a weighting strategy grounded in KL-divergence principles, which has proven to be instrumental in diminishing the effects of covert attacks.
The main contributions of our research are as follows:
We have designed a state estimation algorithm that ensures the normal operation of state estimation at critical buses under cyber attacks. Additionally, by incorporating KL-divergence detectors on each estimator to detect linear FDI attacks, the integrity of state estimation is effectively safeguarded.
In response to stealthy attacks that can evade detection, we propose a novel weighting strategy. This strategy assigns lower weights to estimation results that are significantly affected by noise and attacks, while higher weights are given to those less affected, thereby effectively reducing the interference of noise and stealthy attacks and enhancing the accuracy of estimation.
We demonstrate that the proposed algorithm is superior in accuracy and robustness compared to traditional algorithms when subjected to DoS attacks and FDI attacks by numerical experiments.
The structure of this manuscript is organized as follow: Section 2 provides a concise introduce about the system model and related theories. Section 3 presents the model and estimation algorithm proposed in this manuscript. Section 4 consists of numerical experiments and analysis of the results. Section 5 presents the conclusion of this manuscript.
System ModelState-space model
Power system state estimation can be categorized into two primary methods: DC (Direct Current) estimation and AC (Alternating Current) estimation.The state variables in AC estimation encompass both the phase angle and the voltage magnitude, providing a comprehensive representation of the system's state.In contrast, DC estimation, a simplified version, includes only the voltage magnitude, omitting the phase angle.In this manuscript, we focus primarily on the more prevalent AC estimation approach due to its comprehensiveness and applicability in practical scenarios.Similar to the work presented in [18], the state signal obtained in real-time by sensors can be considered as a discrete-time function concerning the voltage amplitude Av and the phase angle (θ+ϕ), denoted as :
V(t)=Avcos(ωt+ϕ)
By expanding the trigonometric function in Eq.1, we can derive the following equation:
V(t)=Avcos(ωt+ϕ)−Avsin(ωt+ϕ)
Assuming that the voltage frequency ω of the system's buses remains constant over time, and considering only the voltage amplitude and phase angle as variables in the state space, we define the system's state as x1=Avcos(ωt) and x2=Avsin(ωt). The state signal V(t) acquired by the sensor can be expressed as:
V(t)=x1cos(ωt)−x2sin(ωt)
Assuming there are no additional delays in the system and taking into account the process noise and measurement noise in the calculation, the state equation and measurement equation for the system's buses are:
x(t+1)=Ax(t)+w0(t)y(t)=Cx(t)+wi(t)
where the state vector x(t)=[x1(t)x2(t)]T, the system matrix A=[1001] , and the measurement matrix C=[cos(ωt)−sin(ωt)]. w0(t) and wi(t) represent the system's process noise and measurement noise, respectively. In power systems, the process noise w0(t) is small enough and can be neglected during estimation. The measurement noise wi(t) is assumed to be zero-mean, independently and identically distributed Gaussian noise with a standard deviation of σ and independent of the initial conditions of the system and the process noise.
Based on the state and measurement equations presented, the control center can perform optimal estimation of the system state using the Kalman filter. The estimation process of the Kalman filter follows the formula shown below:
where x(t) represents the estimated state vector x(t) at time t, and P(t) denotes the covariance matrix of the estimated state at time t.K(t) represents the Kalman gain and z(t)=(y(t)−CAx(t−1)) is defined as the innovation of the system. Through the iterative updates, we can obtain the state prediction value at time t with the information at time (t−1), which contains the voltage amplitude and phase angle of the buses.
Attack model
In this section, we would like to model prevalent cyber threats within power system networks. We mainly focuses on DoS attacks, linear FDI attacks targeting single estimator systems, and stochastic stealth attacks targeting multi-estimaor systems. We begin our analysis with the most fundamental form of DoS attack. The DoS attack, which is an aggressive maneuver designed to impede the control center's ability to retrieve data from sensors. This disruption is orchestrated by adversaries who either sever communication channels or inundate the network with an excessive deluge of data packets, consequently compromising bandwidth and thwarting the transmission of essential data[3, 4]. In this manuscript, the DoS attack on estimator i is modeled as a Bernoulli variable γi∼ℬ(1,p), implying that the occurrence of an attack is a stochastic event that can be described by a Bernoulli distribution. The Bernoulli distribution is a discrete probability distribution with only two possible outcomes: γi=0 (the attack occurs) and γi=1 (the attack does not occur).In the context of DoS attacks, the probability of fail attack is denoted by p, and the probability of successful attack is 1−p.
γi(t)={0if an attack occurs at time t1if no attack occurs at time t
We assume that the attacker's assault is exerted during the process where the sensor transmits the innovation z to the estimator. Assuming that the ith sensor is under attack, all subsequent subscripts i in the following text refer to estimator i. Consequently, the innovation received by the estimator can be represented as:
z^i(t)=γi(t)∗zi(t)
When the attack is successful, γi(t)=0, indicating that the estimator is unable to receive the innovation transmitted from the sensor. Conversely, when the attack fails, the innovation transmitted to the estimator remains unaffected. So that we have completed the modeling of the DoS attack.
Next, we consider linear FDI attacks targeting single-estimator systems. Similar to the mathematical model used in man-in-the-middle attacks [5, 6], we assume that the attacker has complete knowledge of the system's physical model and possesses the capability to access and alter measurements. Specifically, the attacker can arbitrarily modify the innovation zi obtained by the estimator. Consequently, the attack strategy against estimator i can be defined as:
z~i(t)=fk(zi(t))
Regarding the non-linear function fk, it is challenging to analyze its statistical properties, which complicates the determination of system performance and the effectiveness of attacks. Additionally, linear transformations of data do not alter the type of statistical distribution of the data, which enables attackers to deceive detectors that rely on distribution properties. Furthermore, in real-world power systems, random linear attacks may be more feasible and cost-effective to implement. Therefore, we only focus on FDI attacks under the assumption of linear functions [24].
z^i(t)=Ti⋅zi(t)+bi
where Ti is an arbitrary attack matrix and bi is a constant independent of zi.
In light of the preceding discussion, we now turn our attention to stochastic stealth attacks targeting multiple estimators. The linear FDI attacks strategy mentioned earlier impose demanding requirements on the attackers, necessitating capabilities that are not feasible to replicate across multiple estimators simultaneously. Additionally, the multi-estimator system significantly increases the complexity of information, which renders the attack methods applied to single estimators ineffective or less potent. To maximize the impact of attacks within a system equipped with multiple estimators, a stochastic stealthy attack strategy based on maximum attack probability has been proposed in [25]:
z^i(t)=zi(t)+ciζi(t)
where ci represents if there is an attack present in the communication channel of estimator i.P(ci=1)=p, representing the attack being applied to estimator i and P(ci=0)=1−p, indicating that estimator i is not under attack. The attack signal ζi∼𝒩(0,σζ) is a Gaussian distribution that is independent of zi. With the modeling of the three attack methodologies now complete, it is important to note that the strategies discussed are among the simpler to implement, offer effective attack outcomes, and possess a high degree of stealth. In the realm of power systems, there also exist FDI attacks constructed through data-driven approaches and physical-model based methods. However, these alternatives present various challenges: some are not suitable for dynamic estimation, others demand extensive datasets, and some could be too demanding for attackers. Furthermore, certain methods can disrupt the statistical properties of data, making them more susceptible to detection by common detectors, such as those based on KL-divergence. For these reasons, they are not within the scope of the present discussion.
Detection model
We now proceed to discuss the detection model within the system. The extensive wireless sensor networks in smart grids offer ample opportunities for attackers to launch attacks. Consequently, it is imperative to have a detector at the controller end to scrutinize the acquired data for any anomalies or signs of compromise. In the realm of dynamic estimation within smart grids, detectors based on the Kullback-Leibler (KL) divergence have demonstrated remarkable efficacy in detecting cyber attacks. KL-divergence is a crucial concept used to quantify the differences between two probability distributions, which can measure the degree of difference between an actual distribution and another expected distribution. Its definition follows:
where fγ~k and fγk are the probability density function of random sequences γk~ and γk.It can be observed that D(γ~k∥γk)=0 if and only if fγ~k=fγk, and the K-L divergence is generally not symmetric, ie., D(γ~k∥γk)≠D(γk∥γ~k)[28]. When D(γ~k∥γk)≤δ , no anomalies are detected by the sensors, and the data acquired by the estimator is considered normal.When D(γ~k∥γk)>δ, the sensors trigger an alarm, indicating that the data requires inspection. It is necessary to troubleshoot and mitigate any faults or stop any ongoing attacks before resuming normal operation.
<bold>.</bold>
Considering the persistent operational nature of power systems, which are vast and complex, the acquisition of extensive data required for analysis is readily achievable. Based on historical data, we can derive the probability density function of the real innovation.
Main ResultMulti-estimator based estimation
In this section, we present our main results, beginning with the distribution approach based on multi-estimator information fusion. When anomalies occur within the system, state estimation relying on single estimator must be stopped to address the issues before resuming operations. However, the measurement data from certain critical buses are essential for the whole system, and even brief interruptions can lead to significant losses. Therefore, this manuscript is dedicated to devising a novel estimation strategy that ensures the system's continuous operation despite the presence of faults or under attack. It is evident that a single estimator is inadequate for the task of state estimation mentioned above. Therefore, we contemplate employing an approach that integrates information from multiple estimators to achieve this objective. Dynamic estimation based on the fusion of information from multiple estimators has become a widely applied method for interference-resistant estimation in recent years. Since the estimators are independent of each other and the attacker's capabilities are limited, an attack on a single estimator cannot affect the entire state estimation process. Utilizing an estimation approach that fuses information at critical buses can effectively ensure that the system continues to operate normally even when attacks are detected.
Schematic of multi-estimator based state estimation.
First, we need to select key buses based on economic considerations and the degree of information redundancy[29], and deploy multiple estimators at these critical buses. The structure of the estimator network at the key buses is shown in Figure 1. Each estimator includes a PMU for independently collecting data, a Kalman filter for estimating the state, and communication equipment for transmitting data. Each estimator operates independently, processing data and generating results that are subsequently subjected to a verification procedure. If the results are deemed normal, they are incorporated into subsequent computational steps. However, if any anomalies are detected, the communication of the respective estimator is immediately severed, and an alarm is triggered to alert system operators. By combining the estimation results from neighbor estimators, the estimated state vector x^i(t) at time t and estimated covariance matrix P^i(t) by estimator ei can be obtained as follows:
where Ni represents the set of estimators that can exchange information with estimator ei, including ei itself. The variable λij(t) denotes the detection outcome of the detector in estimator ej at time t. If the detection is normal at that moment, λij(t)=1; if estimator ej is abnormal at that moment, its communication network is severed by the detector, and λij will remain 0 until the anomaly is resolved. The notation x^ij(t) and P^ij(t) represent respectively the estimation result and covariance matrixz received by estimator ei from estimator ej.The convergence of this distributed method has been demonstrated in [30].The weight wij(t) indicates the influence of the results obtained by estimator ej within estimator ei; For the time being, all estimation results are assigned equal weight.
wij=1∑λij(t)
A multitude of strategies have been proposed to counteract FDI attacks in sensor networks such as the correntropy-based method [31] and partial consensus method [32] . However, with the constraints on computational resources and bandwidth at buses within power systems, the feasibility of implementing highly sophisticated methods is limited. Consequently, we have adopted a more straightforward weighted approach, which is better suited to the operational realities of power system environments. We will make improvements based on arithmetic and bandwidth constraints in next subsection.
Subsequent numerical experiments have demonstrated that our methodology is capable of sustaining the regular functioning of crucial buses within the system, even in the scene of DoS and FDI attacks."
<bold>.</bold>
Despite the robustness against interference and the high estimation precision of state estimation methods that leverage multiple estimators, the prohibitive costs associated with PMUs and the constraints on computational resources preclude their universal application across all buses in power systems.Additionally, the number of estimators installed at each bus should not be excessive; ideally, the best choice based on practical considerations is to install 3-4 sets. In [29], an installation strategy for PMUs is proposed that takes into account the correlation of measurements, enabling the strategic placement of PMUs at critical buses to utilize the methodologies proposed in this manuscript.
KL-divergence based weighting strategy
In the event of cyber attacks, the multi-estimator based data fusion approach is adept at sustaining the system's normalcy even amidst anomalous conditions.Nevertheless, with the advancement in attackers' capabilities, the stealthiness and destructive potential of these attacks have escalated.As delineated in [23] and [24] two stealthy FDI attack models are presented, which not only evade detection by KL-divergence detectors but also inflict substantial damage on the system. When confronted with such stealth attacks, the aforementioned method falls short in reducing the influence imposed by these threats.
Prior to implementing the novel weighting strategy, it is essential to determine the differences between the actual innovation probability distribution under cyber attacks and the prior probability distribution of the innovation.
<bold>.</bold>
Considering the complex information within power systems and the capabilities of potential attackers. In this manuscript assumes that no more than one type of cyber attack will occur simultaneously within the system., which means an attacker can only execute a single type of attack on the system at any given time.
DoS attack
We begin by analyzing the KL-divergence between z^i(t) and zi(t) under the conditions of DoS attack. As previously mentioned, zi(t) is a Gaussian variable with mean 0 and standard deviation σ, its probability density function can be expressed as:
fzi(x)=12πσ2e−x22σ2
where z^i(t) is the product of Bernoulli distribution γi(t) and zi(t) with the probability density function:
fz^i(x)=(1−p)⋅δ(x)+p⋅12πσ2e−x22σ2
where δ(x) is a Dirac delta function representing the probability of z^i=0. Based on the probability density functions we can obtain:
Since z^i is a mixture distribution, Eq.5 takes into account the contributions from both the Dirac delta function and the Gaussian distribution. However, the integral involves the logarithm of the Dirac delta function, which is undefined at zero, necessitating an alternative approach to analyze the divergence between fz^i(x) and fzi(x). By analyzing the composition of zi^ we notice that the difference arises mainly from the uncertainty of γi. Hence, the information entropy of γi serves as a pertinent indicator to quantify the degree of influence on the innovation. The information entropy of a random variable P can be obtained through the following formula:
H(P)=−∑i=1npilogpi
where γi is a Bernoulli random variable with probability p, its information entropy can be expressed as:
H(ζi)=−plogp−(1−p)log(1−p)
According to the preceding discussion, it becomes evident that the divergence in probability distributions between z^i(t) and zi(t) under DoS attacks is solely contingent upon the capabilities of the attacker. When there exist an attack, each estimator is subjected to an attack that makes (1−p) maximal, rendering the KL-divergence-based weighted approach equivalent to one with equal weighting. Therefore, in subsequent experimental results, we will focus exclusively on the distinction between estimates derived from multi-estimator data fusion and those from single estimator.
Linear FDI attack against single estimator
Next, we consider a linear attack targeting single estimator, where the attacker constructs an attack vector by performing linear operations on Estimator i. Since linear operations on a Gaussian distribution do not alter its probability distribution, zi^ remains a Gaussian distribution with mean b and variance T2σ2. According to [33, 34], we can define b and T2σ2 as μz^i and σz^i, the KL-divergence between z^i and zi as:
The above equation indicates that as long as we obtain the parameters of the Gaussian distributions, we can obtain the required KL-divergence. However, although we can easily obtain the probability distribution of zi, we still cannot directly obtain the distribution of zi^. To obtain the KL-divergence, we need sufficient data to analyze its probability distribution. Therefore, before employing the new weighting strategy, we require a period of data collection to gather information, and state estimation can only proceed once the results are stable.
Stochastic Stealth FDI Attacks Against Multiple Estimators
Finally, let us consider the stochastic stealth attack targeting multiple estimators. From the perspective of attackers, we must consider a multi-estimator system as a complex network where information exchange is pervasive. Each estimator's covariance matrix and state updates are influenced by the data obtained from neighboring estimators, which means that an attack on one estimator can have indirect effects on others through the information sharing network.
When analyzing attacks on multiple estimators, it is crucial to account for the interconnectedness and the potential for compounded impacts of an attack across the system. The challenge for the attacker is to craft an attack strategy that exploits the system's inherent dependencies and information exchange mechanisms to remain undetected while still achieving the attack objectives.
However, as the defender, we cannot obtain the opponents' attack strategy and can only determine whether there is an attack on the corresponding estimator through the detector. Since the design process of the attack vector involves linear operations on the Gaussian distribution, the innovation zi^ after being attacked still conforms to the Gaussian distribution with mean 0 and variance σ2+σζ2, and its KL-divergence with zi can still be calculated using Equation 8.
In conclusion, we can derive the following insights: Under DoS attacks, the detection and weighting methods based on KL-divergence are not particularly effective, with estimation results closely resembling those of the Multi-estimators based method.Additionally, the innovation zi^ in both types of FDI attacks conforms to a Gaussian distribution, and their KL-divergence with zi can be obtained through Equation 8.
KL-divergence based weighting strategy
In this manuscript, we introduce a novel weighting strategy based on KL-divergence. Since KL-divergence is adept at characterizing the degree of difference between two probability distributions, it is highly suitable for assessing the extent to which an estimator is compromised by an attack. Consequently, we can apply varying weights to the estimation results based on the level of attack, thereby mitigating the impact of the attack.
Specifically, we computed the KL divergence between the actual innovation probability distribution and the prior innovation probability distribution for each estimator to analyze the extent to which the estimation results were affected by attacks. Results with larger KL divergences were assigned higher weights, while those with lower divergences received lower weights.
In equation 9, αij(t) represents the detection result of the K-L divergence detector on estimator ej.If the detector passes the test, αij(t) is 1; otherwise, it is 0. Dij(t) denotes the K-L divergence between the actual noise and the normal noise on estimator ej. When both λij(t) and αij(t) are 1, there is no anomaly on estimator ej. [30] demands that f(x) is a continuous non-negative and strictly decreasing function, which in this manuscript is defined as 1/x. The obtained result x^ij(t) and the K-L divergence can be transmitted to the estimators with which it can communicate, and information can be obtained from these estimators. Then, using this information, the weights for each state estimation value are calculated, which in turn are used to compute the final estimation result.
Numerical Experiments
In this section, we conducted numerical experiments using Matlab to evaluate the dynamic estimation based on Kalman Filtering, multi-estimator based estimation and the novel algorithm with KL-divergence based weighting strategy (Abbreviated as KL-divergence based estimation in the subsequent text). Initially, we provide the following clarifications regarding the data used in the experiments:
In this manuscript, the primary objective of the proposed method is to safeguard critical buses within the power grid, mitigate the interference from noise and cyber attacks, and ensure the normal operation of the power system, with data from these key buses being acquired exclusively by PMUs. According to [16], we have established the following provisions for all PMUs: it is assumed that all PMUs installed in the system are of the same model with identical preset sampling frequencies and cycle periods. The amplitude Av of the voltage signal in the power system is set to 1, the phase angle ϕ is 0, and the sampling frequency is 60Hz, and the sampling period is 1800Hz, which means the signal is sampled 1800 times per second, with 30 sampling points existing within each signal period. Sampling time is set to 0.1s.Furthermore, in accordance with the guidelines in [35, 36], independent and identically distributed Gaussian noise with a Signal-to-Noise Ratio (SNR) of 70 dB is applied to each PMU. When employing the multi-estimator based algorithm, considering the redundancy of information and economic factors, we have installed three estimators at each critical bus. Each estimator comprises a PMU, a Kalman filter, and a KL-divergence detector.
Kalman Filter
First we conducted a test on the Kalman Filter(KF) estimation. The system's initial parameters are set as follows: x1(0)=0, x2(0)=0, and the covariance matrix P is set to the identity matrix (these initial conditions were maintained consistent throughout the subsequent experiments). Matlab function randn() is used to produce normally distributed noise. We define the sinusoidal voltage signal with noise as the input and the resulting signal from the state estimation is taken as the output. The experimental results are presented in Figure 2. The red curve denotes the input signal, while the blue one indicates the output. It can be seen that the output curve from the state estimation closely matches the input signal, which sufficiently meets the typical requirements of the power system.
Kalman Filter estimation when there is no attack.
Estimation under DoS attack
Subsequently, we consider the state estimation under DoS attack. The attacker applies the attack in a manner that maximizes their attacking capability, which means that each estimator is subject to an attack with equal probability. As mentioned before, the difference between the probability distributions only related to the probability of each estimator being attacked. Consequently, in such circumstances, there is no distinction between two different weighting methods. Therefore we only focus on the discrepancies between KF estimation and multi-estimator based estimation.
Kalman filter estimation under DoS attack.
When an attacker is unable to target all estimators within a system, multi-estimator based estimation invariably outperforms KF estimation. The advantage is apparent because there are estimators within the system that remain unaffected by the attacks, which can offer data compensation for those estimators that are under attack during the estimation process, thereby reducing the attack's influence. Consequently, in our experiments, we assume that all estimators are subjected to the attacker's assault with an equal probability of 1−p. Referring to [16], we select 1−p=0.6 as the probability of a successful attack. Upon a successful attack, the communication channels transmitting data will be severed, rendering estimators incapable of receiving measurements from the sensors.
The results obtained from the KF estimator are depicted in Figure 3. The experimental outcomes reveal that the KF estimation exhibits noticeable errors, demonstrating the impact of data loss on state estimation. The results of the Multi-estimators estimation are presented in Figure 4. Even when all estimators are under attack, the output signal from the state estimation closely resembles the input signal, which is significantly superior to the KF estimation. The Multi-estimator based estimation has a probability of only (1−p)3 for complete data loss, whereas the single estimator has a probability of p, thus being more markedly affected by DoS attack.
Experiments have demonstrated that in the presence of DoS attacks within the system, Multi-estimator based estimation exhibits superior robustness, yielding more precise estimation results .In next subsection we will consider the performance of different estimation methods when confronted with FDI attacks.
Multi-estimators based estimation under DoS attack.
Estimation under Linear FDI attack
In this subsection we simulate the linear FDI attack targeting single estimator. Initially, we test an attack that triggers the detector alarm, which means the FDI attack does not possess stealthiness. When the detection result exceeds the threshold, the detector status turns to abnormal, and the communication channel transmitting information from the corresponding estimator is severed. The estimated state of the bus will be provided by other estimators. Furthermore, obtaining the KL-divergence requires sufficient data to determine the probability distribution, which is easily obtainable in power systems. We reset the sampling time to 1s, with the first 0.9 s dedicated to data collection, and estimation of the state commences from 0.9 second. We apply an attack on Estimator 1, and according to Equation 8, we set Ti to 1.7 and the constant bi to 0.08. Under this simple attack, the detector will trigger an alarm, while the other estimators will not be affected by the attack's influence. The state of the detector at 0.9s is abnormal. The results from three different estimators are presented in Figure 5.
Comparison of three estimation methods under linear FDI attack.
The experimental outcomes clearly demonstrate that the KF estimator exhibits the least favorable performance. This deficiency stems from the absence of extra estimators within its system to counteract the effects of the attack on single estimator. Multi-estimator based method yields estimation results that markedly outperform those of the KF estimator. This enhancement is attributed to the presence of two estimators within the system that are impervious to the attack. Despite equal weighting of the estimation states from all three estimators, the two uncompromisable estimators contribute precise data, thereby substantially diminishing the detrimental effects of the FDI attack.
The estimation method based on KL-divergence yields the best results, which is quite understandable. At the beginning of state estimation, the attacked estimator is marked as abnormal, its communication channel is severed, and the results it yields no longer impact the entire system; the remaining state estimation is accomplished solely by the unaffected estimators. In other words, the detector can effectively block FDI attacks that do not possess stealthiness, and the system will remain unaffected by such attacks. This experiment only serves to demonstrate the effectiveness of the KL-divergence detector, but it does not indicate the advantages of the weighted strategy. We will proceed to illustrate the superiority of the new estimation method through stealthy attacks.
Comparison of three estimation methods under stealth linear FDI attack.
Next we take the stealth FDI attack into consideration. According to [24], we can obtain the attack parameters that yield the most effective results without being detected. We reset parameter Ti to 1.3 and bi to 0.06, which will have the greatest impact on the estimator while maintaining stealth. The attack is still applied to Estimator 1.The experimental results are shown in Figure 6.
The estimation performance of the KF estimator remains the poorest, with its output signal being affected to a similar extent as the one in Figure 5, which indicates that the modified FDI attack not only has stealth characteristics but also achieves significant disruptive effects. The Multi-estimator based method yields better results than the KF estimator but falls short compared to the KL-divergence based method. However, due to the stealthiness of the attack in this experiment, the detector fails to trigger an alarm and sever the communication channel of Estimator 1.Consequently, the KL divergence based method cannot produce a signal entirely unaffected by the attack as seen in Figure 5.It can only rely on the weighted strategy to assign a lower weight to the more severely affected estimation results, thereby reducing the estimation error.
To better demonstrate the advantages of the new weighting strategy, we compare the absolute errors between the results obtained from the KL-divergence based method and the Multi-estimator based method with the input signal. The errors |ei| can be obtained by: |ei|=|zi^−zi|.The comparison results are presented in Figure 7.
Comparison of estimation errors under linear FDI attacks with different weighting strategy.
In Figure 8, the horizontal axis represents time, and the vertical axis represents the absolute value of the estimation error. Blue curve represents the error of the Multi-estimators based method, and the red one represents the error of the KL-divergence based method. It is evident that for the majority of the time, the blue curve is above the red curve, indicating that the method employing the new weighting strategy yields better estimation results.
The outcomes illustrated in Figures 5 and 6 indicate that in the presence of undetectable stealthy attacks within the system, the novel weighting strategy effectively enhances the estimation's robustness and precision. Despite the detector's inability to trigger an alarm or sever the communication channels, this strategy mitigates the influence of the attacked estimation results by apportioning varying weights. Consequently, it elevates the significance of the unaffected estimation outcomes, bolstering the system's resilience against such stealth attack.
Estimation under Stochastic Stealth FDI attack
Finally, we will test the system's estimation performance under Stochastic Stealth FDI attack. According to Equation 9, we set the intensity of ζi to three times the level of the system noise. Referring to reference [23], we set p to 0.6, which that the probability of each estimator under attack is p=0.6 . When an estimator is attacked, a stronger Gaussian noise is superimposed on the innovation zi.The output signals estimated by three different methods are displayed in Figure 8:
Comparison of three estimation methods under stochastic stealthy FDI attack.
Unlike the previous experimental results, in this experiment, the estimation effect of the KF estimator is not significantly worse than that of the Multi-estimators based method. Upon reviewing the experimental data, we analyzed the cause of this outcome: when attacking all estimators with a probability of 0.6, two estimators in the Multi-estimators based method were attacked. With two estimators simultaneously under attack, the single normal estimation result could not offset the influence of the two abnormal results, leading to an estimation accuracy similar to that of the KF estimation. In contrast to these two methods, the results obtained by the KL-divergence based method were largely unaffected by the attacks, as the abnormal results were assigned a sufficiently small weight, while the normal results had a higher weight, which dominated in the final outcome. Therefore, as long as there are estimators in the system that are not under attack, the estimation method employing the new weighting strategy will maintain a high level of estimation accuracy. As mentioned earlier, the attacker's capabilities are greatly limited, and it is essentially impossible to launch simultaneous attacks on all estimators in the system (usually 3 to 4).Thus, the methods proposed in this manuscript essentially meet the needs of state estimation in power systems.
Comparison of estimation errors under stochastic stealth FDI attacks with different weighting strategy.
Similar to the previous subsection, in this experiment, we again compared the estimation errors of two methods. The results are displayed in Figure 9, where blue still represents the Multi-estimators based method and red one represents the KL-divergence based method. It is evident that the blue curve is significantly higher than the red one, which indicates that the new weighting strategy yields a smaller estimation error and higher precision.
It is noticed that the Figure 9 reveals a representative phenomenon: when the estimation errors of both methods are relatively small, the difference in height between the two curves is not significant. However, when the blue curve rises prominently, the difference in height between the curves becomes markedly evident. The explanation for this phenomenon is that the noise added to the estimators follows a normal distribution with a mean of zero so that the intensity of the attack on the innovation zi varies at different time. Although the new weighting strategy assigns higher weights to the correct results, it does not fully demonstrate its advantage when the attack is weak, leading to minimal differences between the two curves. In contrast, when the attack is strong, the new method reduces the weight of the abnormal results sufficiently, effectively mitigating the impact of the attack, which results in a significant difference between the two curves.
Comparison of estimation errors under different mitigation attack algorithms.
Furthermore, to demonstrate the superiority of the approach outlined in our manuscript, we have conducted comparative experiments between the algorithm presented in our work and the method described in [30]. The results of these experiments are depicted in Figure 10, where the red line corresponds to the KL divergence-based method. The experimental findings indicate that, in the vast majority of instances, our method provides more precise estimation outcomes. This is readily understandable, as a meticulously crafted attack vector does not significantly alter the covariance but substantially affects the KL divergence of the innovation. Consequently, our method outperforms in such scenarios.
Through the experiments conducted in the four subsections above, we have demonstrated that our method can effectively maintain the normal operation of state estimation under no attack, DoS attacks, regular FDI attacks, and stealthy FDI attacks.Additionally, we have proven the superiority of the new weighting strategy in terms of robustness and estimation accuracy when facing attacks.
Conclusion
This manuscripts introduces an estimation algorithm based on the fusion of data from estimators to address the state estimation problem at critical buses in power systems. By deploying multiple estimators at key buses and incorporating a KL divergence-based detector, the proposed algorithm can effectively detect linear FDI attacks and maintain the normal operation of power systems under both DoS and FDI attacks. Furthermore, to mitigate the impact of undetectable stealthy attacks, a novel weighting strategy is employed to reduce the influence of noise and attacks on the estimation results. The robustness and superiority of the proposed algorithm are demonstrated through numerical experiments.
Acknowledgments
This work was supported in part by the National Key R&D Program of China under Grant 2023YFF1204805; in part by the National Natural Science Foundation of China under Grant 62336005 and Grant 62122026; in part by the Projects Sponsored by the Programme of Introducing Talents of Discipline to Universities (the 111 Project) under Grant B17017; and in part by the Shuguang Program supported by Shanghai Education Development Foundation and Shanghai Municipal Education Commission.
Conflict of interest
The authors declare no conflicts of interest.
References Abdelkader, S., Amissah, J., Kinga, S., Mugerwa, G., Emmanuel, E., Mansour, D. E. A., … & Prokop, L. (2024). Securing modern power systems: Implementing comprehensive strategies to enhance resilience and reliability against cyber-attacks. Results in engineering, 102647. [https://doi.org/10.1016/j.rineng.2024.102647] Li, F., Yan, X., Xie, Y., Sang, Z., & Yuan, X. (2019, October). A review of cyber-attack methods in cyber-physical power system. In 2019 IEEE 8th International Conference on Advanced Power System Automation and Protection (APAP) (pp. 1335-1339). IEEE. [https://doi.org/10.1109/APAP47170.2019.9225126] Irfan, M., Sadighian, A., Tanveer, A., Al-Naimi, S. J., & Oligeri, G. (2023). False data injection attacks in smart grids: State of the art and way forward. arXiv preprint arXiv:2308.10268. [https://doi.org/10.48550/arXiv.2308.10268] Reda, H. T., Anwar, A., & Mahmood, A. (2022). Comprehensive survey and taxonomies of false data injection attacks in smart grids: attack models, targets, and impacts. Renewable and Sustainable Energy Reviews, 163, 112423. [https://doi.org/10.1016/j.rser.2022.112423] Musleh, A. S., Chen, G., & Dong, Z. Y. (2019). A survey on the detection algorithms for false data injection attacks in smart grids. IEEE Transactions on Smart Grid, 11(3), 2218-2234. [https://doi.org/10.1109/TSG.2019.2949998] Husnoo, M. A., Anwar, A., Hosseinzadeh, N., Islam, S. N., Mahmood, A. N., & Doss, R. (2023). False data injection threats in active distribution systems: A comprehensive survey. Future Generation Computer Systems, 140, 344-364. [https://doi.org/10.1016/j.future.2022.10.021] Salehghaffari, H., & Khorrami, F. (2018, February). Resilient power grid state estimation under false data injection attacks. In 2018 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT) (pp. 1-5). IEEE. [https://doi.org/10.1109/ISGT.2018.8403396] Jafari, M., Rahman, M. A., & Paudyal, S. (2022). Optimal false data injection attacks against power system frequency stability. IEEE Transactions on Smart Grid, 14(2), 1276-1288. [https://doi.org/10.1109/TSG.2022.3206717] Tian, M., Dong, Z., & Wang, X. (2021). Analysis of false data injection attacks in power systems: A dynamic Bayesian game-theoretic approach. ISA transactions, 115, 108-123. [https://doi.org/10.1016/j.isatra.2021.01.011] Zhang, Z., Deng, R., Cheng, P., & Chow, M. Y. (2021). Strategic protection against FDI attacks with moving target defense in power grids. IEEE Transactions on Control of Network Systems, 9(1), 245-256. [https://doi.org/10.1109/TCNS.2021.3100411] Liu, B., & Wu, H. (2020). Optimal D-FACTS placement in moving target defense against false data injection attacks. IEEE Transactions on Smart Grid, 11(5), 4345-4357. [https://doi.org/10.1109/TSG.2020.2977207] Xu, W., Jaimoukha, I. M., & Teng, F. (2022). Robust moving target defence against false data injection attacks in power grids. IEEE Transactions on Information Forensics and Security, 18, 29-40. [https://doi.org/10.1109/TIFS.2022.3210864] Liu, M., Zhao, C., Zhang, Z., & Deng, R. (2022). Explicit analysis on effectiveness and hiddenness of moving target defense in AC power systems. IEEE Transactions on Power Systems, 37(6), 4732-4746. [https://doi.org/10.1109/TPWRS.2022.3152801] Lakshminarayana, S., Belmega, E. V., & Poor, H. V. (2021). Moving-target defense against cyber-physical attacks in power grids via game theory. IEEE Transactions on Smart Grid, 12(6), 5244-5257. [https://doi.org/10.1109/TSG.2021.3095083] Shafei, H., Farhangi, M., Aguilera, R. P., & Alhelou, H. H. (2024). A Novel Cyber-Attack Detection and Mitigation for Coupled Power and Information Networks in Microgrids Using Distributed Sliding Mode Unknown Input Observer. IEEE Transactions on Smart Grid. [https://doi.org/10.1109/TSG.2024.3475468] Garza, L., & Mandal, P. (2023, October). Detection and Classification of False Data Injection Attacks in Power Grids Using Machine Learning and Hyperparameter Optimization Methods. In 2023 IEEE Industry Applications Society Annual Meeting (IAS) (pp. 1-8). IEEE. [https://doi.org/10.1109/IAS54024.2023.10406838] Kumar, A., Saxena, N., & Choi, B. J. (2021, January). Machine learning algorithm for detection of false data injection attack in power system. In 2021 International Conference on Information Networking (ICOIN) (pp. 385-390). IEEE. [https://doi.org/10.1109/ICOIN50884.2021.9333913] Tebianian, H., & Jeyasurya, B. (2013, August). Dynamic state estimation in power systems using Kalman filters. In 2013 IEEE electrical power & energy conference (pp. 1-5). IEEE. [https://doi.org/10.1109/EPEC.2013.6802979] Li, C., & Zhang, J. (2023, October). Dynamic State Estimation of Power Systems Based on Extended Kalman Particle Filter. In 2023 3rd International Conference on Intelligent Power and Systems (ICIPS) (pp. 638-644). IEEE. [https://doi.org/10.1109/ICIPS59254.2023.10405341] Zhu, M., Liu, H., & Bi, T. (2021, July). Dynamic State Estimation of Power System Based on a Robust H-infinity Cubature Kalman Filter. In 2021 IEEE Power & Energy Society General Meeting (PESGM) (pp. 1-5). IEEE. [https://doi.org/10.1109/PESGM46819.2021.9638185] Zhao, J., & Mili, L. (2017). Robust unscented Kalman filter for power system dynamic state estimation with unknown noise statistics. IEEE Transactions on Smart Grid, 10(2), 1215-1224. [https://doi.org/10.1109/TSG.2017.2761452] Zhang, Z., & Feng, X. (2023, July). Performance Analysis of Chi-square Detection for False Data Injection Attack. In 2023 3rd International Conference on Electrical Engineering and Mechatronics Technology (ICEEMT) (pp. 560-564). IEEE. [https://doi.org/10.1109/ICEEMT59522.2023.10263144] Ye, D., & Wang, J. (2019, May). False data injection attack design in multi-sensor systems based on KL divergence theory. In 2019 IEEE 8th Data Driven Control and Learning Systems Conference (DDCLS) (pp. 333-337). IEEE. [https://doi.org/10.1109/DDCLS.2019.8908983] Guo, Z., Shi, D., Johansson, K. H., & Shi, L. (2018). Worst-case stealthy innovation-based linear attack on remote state estimation. Automatica, 89, 117-124. [https://doi.org/10.1016/j.automatica.2017.11.018] Hu, K., Li, L., Tao, X., Velásquez, J. D., & Delaney, P. (2023). Information fusion in crime event analysis: A decade survey on data, features and models. Information Fusion, 100, 101904. [https://doi.org/10.1016/j.inffus.2023.101904] Li, T., Liang, H., Xiao, B., Pan, Q., & He, Y. (2023). Finite mixture modeling in time series: A survey of Bayesian filters and fusion approaches. Information Fusion, 98, 101827. [https://doi.org/10.1016/j.inffus.2023.101827] Hu, L., Zhang, J., Zhang, J., Cheng, S., Wang, Y., Zhang, W., & Yu, N. (2025). Security analysis and adaptive false data injection against multi-sensor fusion localization for autonomous driving. Information Fusion, 117, 102822. [https://doi.org/10.1016/j.inffus.2024.102822] Bhalla, V., & Prajapat, G. P. (2024, June). Proficiency Analysis of Unscented Kalman Filter for Bad Data Detection During State Estimation. In 2024 IEEE 3rd International Conference on Electrical Power and Energy Systems (ICEPES) (pp. 1-5). IEEE. [https://doi.org/10.1109/ICEPES60647.2024.10653527] Yang, Q., Min, R., An, D., Yu, W., & Yang, X. (2016, March). Towards optimal pmu placement against data integrity attacks in smart grid. In 2016 Annual Conference on Information Science and Systems (CISS) (pp. 54-58). IEEE. [https://doi.org/10.1109/CISS.2016.7460476] Hao, J., & Zhang, Y. (2020, December). Consensus Kalman filtering for sensor networks based on FDI attack detection. In 2020 16th International Conference on Control, Automation, Robotics and Vision (ICARCV) (pp. 160-165). IEEE. [https://doi.org/10.1109/ICARCV50220.2020.9305496.] Li, T., Song, Y., Song, E., & Fan, H. (2024). Arithmetic average density fusion-Part I: Some statistic and information-theoretic results. Information Fusion, 104, 102199. [https://doi.org/10.1016/j.inffus.2023.102199] Wang, G., Zhu, Z., Yang, C., Ma, L., Dai, W., & Chen, X. (2024). Distributed Multi-Kernel Maximum Correntropy State-Constrained Kalman Filter Under Deception Attacks. IEEE Transactions on Network Science and Engineering. [https://doi.org/10.1109/TNSE.2024.3506553] Li, T., Corchado, J. M., & Sun, S. (2018). Partial consensus and conservative fusion of Gaussian mixtures for distributed PHD fusion. IEEE Transactions on Aerospace and Electronic Systems, 55(5), 2150-2163. [https://doi.org/10.1109/TAES.2018.2882960] Yang, H., Li, T., Yan, J., & Elvira, V. (2024). Hierarchical Average Fusion With GM-PHD Filters Against FDI and DoS Attacks. IEEE Signal Processing Letters. [https://doi.org/10.1109/LSP.2024.3356823.] Bi, T., Liu, H., Zhang, D., & Yang, Q. (2012, July). The PMU dynamic performance evaluation and the comparison of PMU standards. In 2012 IEEE Power and Energy Society General Meeting (pp. 1-5). IEEE. [https://doi.org/10.1109/PESGM.2012.6345328] IEEE. (2013). IEEE guide for synchronization, calibration, testing, and installation of phasor measurement units (PMUs) for power system protection and control (IEEE Std C37.242-2013, pp. 1–107). [https://doi.org/10.1109/IEEESTD.2013.6475134]