Stochastic defense against complex grid attacks

TL;DR

This paper introduces stochastic defense mechanisms to detect and counter sophisticated grid attacks that involve physical load modifications and sparse sensor output alterations, even when attackers attempt to hide overloads and remain undetectable.

Contribution

The paper presents novel data-driven stochastic techniques to detect and thwart complex, undetectable grid attacks that consider grid response mechanisms and attack persistence.

Findings

Attacks can be computed efficiently even on large sensor systems.

Attacks can successfully hide large overloads in static settings.

Proposed stochastic methods effectively detect and counteract sophisticated attacks.

Abstract

We describe defense mechanisms designed to detect sophisticated grid attacks involving both physical actions (including load modification) and sensor output alteration, with the latter performed in a sparse manner and also so as to take into account grid response mechanisms (secondary response). The attacks aim to be both undetectable even under a full AC power flow model, and to hide equipment overload. We demonstrate that such attacks, while perhaps difficult to implement, nevertheless are easily computed even on systems with a large number of installed sensors, and can, in a static setting, successfuly hide large line overloads. Furthermore an attacker that understands the ongoing stochastic nature of sensor signals can extend the attack so as to remain effective for a nontrivial time period. To counteract such "ideal" or "perfect" attacks, we demonstrate a set of data-driven stochastic techniques to thwart the attacker and detect that an attack has taken place.