Analysis of cascading failures of power cyber-physical systems considering false data injection attacks

0 Introduction

With the development of smart grids, the modern power system is evolving into a power cyber-physical system (CPS).The deep integration of a cyber system and physical system can allow for more accurate and efficient monitoring of the physical system, but also brings new vulnerabilities [1]-[2].Furthermore, the uncertainty and complexity of the multi-equipment and heterogeneous networks multiply the challenges to the stability and reliability of the power system [3]-[5].In recent years, investigations of blackouts [6]-[8] have indicated that attacks on cyber networks are an important cause of the occurrence or exacerbation of cascading failures in power networks.Therefore, for the reliable and safe operation of power system, it is significant to study the interaction mechanism(s) between the cyber network and physical network, and to analyze the influences of a network attack on the cascading failure of a power network.

At present, research on the cascading failures in power CPSs is mainly conducted from two perspectives: the network topology, and the power grid dynamic characteristics [9].The related theories for complex network systems have provided new perspectives for power system cascading failure modeling [10]-[12].In [13], based on a percolation theory, a cascading failure analysis model was provided, and the impact of dual network coupling on cascading failures was studied from the perspective of the network topology.The influences of different coupling relationships on cascading failures were researched in [14], and the results showed that selecting the appropriate coupling relationship could improve the robustness of the network.Other studies ([15]-[17]) focused on evaluating important nodes and studying the impacts of different attack methods on cascading failures; a node importance index was defined, and a defense strategy for protecting key nodes was proposed.In addition, some studies have investigated cascading failures from the perspective of power grid dynamic characteristics.In [18], a dynamic routing strategy was proposed for improving the accuracy of safety control during failures and reducing the risk of cascading failures.Based on different power flow models, the cascading failures under the interactions of dual networks were researched in [19]-[21].However, the above studies only considered the dynamic characteristics of a single network.In [22], the influences of a cyber network delay and power flow transfer on cascading failures were considered.Moreover, a power CPS model considering multi-layer coupling characteristics was established and a corresponding key branch was identified in [23].[24] showed that damage to a cyber network weakens the cyber network’s ability to suppress the spread of cascading failures.

1 System modeling

A power CPS is mainly composed of a power grid and cyber network.The power grid includes generators, transformers, loads, transmission lines, and circuit breakers for providing the production, transmission, and distribution of electric energy.The cyber network mainly comprises a wide area measurement system, data acquisition and control system, energy management system, and information transmission network for providing monitoring and control of the power grid.A simplified diagram of a power CPS is shown in Fig.1.The cyber network collects the state operation information and network structure information of the power grid through sensors in the remote terminal unit (RTU) of the power grid.After an optimization decision, control instructions are transmitted to the actuators in the RTU, and the power grid executes the control instructions and enters a new operation state.This section describes the establishment of an integrated model for a power CPS, based on considering the power flow characteristics of the power grid and the monitoring and control functions of cyber network.

Fig.1 Simplified diagram of power cyber-physical system (CPS)

1.1 Power network model

In the power CPS, all buses and transmission lines of the power grid are equipped with sensors and actuators, which can provide communication with cyber network nodes, and can be used by the cyber network to monitor the power flow information of all buses and transmission lines.To reflect the dynamic characteristics of an actual power system, the power flow information of each bus and transmission line is considered to represent the physical network.The effective voltage value, phase Angle, balance bus power, and line transmission power of each bus can be obtained by solving an AC power flow equation.In this study, the Newton-Raphson method is adopted to solve the power flow equation of the power grid.The balance bus power and transmission line power are shown in Equation (1).

In the above, s is the number of balance nodes, Ysi represents the admittance matrix between the balance bus and each bus, Usi denotes the node voltage obtained in the last iteration, and yi0 and yii are the self-admittance and admittance between buses, respectively.

Considering that a cyber network mostly uses power information to complete the scheduling and control, the active power flow information is selected to represent the power grid, as follows:

Here, P represents the active power transmitted between branches, and L is the injected power of bus i.The nondiagonal elements of P represent the branch flow, and the diagonal elements represent the injected power of the bus (if its active power Pi ＞0, then i is the generator bus; if Pi=0, then i is the contact bus; if Pi ＜0, then i is the load bus).

In addition, an adjacency matrix A R∈ n n× is defined to represent the topological connection relations of the power grid, and the non-diagonal element of the matrix A represents the connection relation between buses i and j, which satisfies Aij ∈{0,1}.Ifthen the circuit is connected between i and j; if the circuit is disconnected between i and j, Finally, is defined as the data receiving matrix of the power network. is a diagonal matrix, and its diagonal elements represent the adjustment instructions regarding the node power received by the power network; uii ＞0 means that the generator needs to increase the output (or the load node needs to reduce the load); otherwise, uii ＜0 can be similarly defined.Meanwhile, is used to store the control commands received by the power network regarding the opening and closing status of the transmission line; uij =1 means the line is connected, and uij =0 means the line is disconnected.

1.2 Cyber network model

The cyber network monitors the operation status of the power network by collecting the power flow information of each station and plant, and generates various operating instructions according to certain control criteria to control the power network.Thus, considering the balance between supply and demand and the economic operation of power system, optimal economic dispatching is selected as the control model for the cyber network.The specific model is as follows.

The objective function is defined as follows:

The constraint conditions are defined as follows:

In the above, PGi and PDj are the active power output of the generator and load demand on the bus, respectively; Ei(PGi) denotes the cost of the power generated by generator i; and N and M are the number of generators and buses, respectively.are the upper and lower limits of the generator capacity, respectively.

As the cyber network is laid according to the location of the primary equipment of the power grid, an adjacency matrix Q ∈ Rn× n is defined to represent the topological connection relationships of the cyber network.Moreover, in view of the monitoring function of the cyber network, is definedas the data receiving matrix of the cyber network.and are used to store the power flow information and grid structure information of the power grid, respectively.is defined as the control command sending matrix.is a diagonal matrix, and its diagonal elements represent the power control commands to the grid node; denotes a generator increase output command (or node load shedding command); otherwise, can be similarly defined.Analogously, the elements in are used to control the opening of the branch of the power network, i.e., means the line is connected, and means the line is disconnected.

1.3 Interaction between power network and cyber network

In the power CPS, the power network transmits information to the cyber network via an uplink communication channel.Then, the cyber network collects the status information of the power network as each node shares the information.Meanwhile, according to the scheduling optimization algorithm, an optimized adjustment command is generated and transmitted to the power network through the downlink communication channel.Finally, the power network is adjusted into a new operating state.The specific processes can be described as follows.

(1) The power network transmits the operating state information and structure information to the cyber network through the uplink communication channel, as follows:

(2) The cyber nodes share the information of their neighbors to achieve information consistency.Then, this information is analyzed to determine whether to start the optimization adjustment.If adjustment is needed, a power adjustment command and overload line breaker opening command are generated based on the optimal economic dispatch model, and are transmitted to the power grid via the downlink communication channel, as follows:

(3) The control commands for the bus power and transmission line status are received by the power network, as follows:

(4) The power grid executes adjustment commands to adjust the output power of each generator.Then, the admittance matrix is updated, and the new operation state is entered, as follows:

2 Cascading failure analysis considering false data injection attacks

In the power CPS, false data injection (FDI) attacks will affect the monitoring and control functions of the cyber network.Thus, the propagation process of cascading failures is affected, and the scale of the cascading failures is expanded.In this section, the impacts of a FDI attack on the uplink/downlink communication channel in the system is theoretically analyzed.Then, the cascading failure analysis process under the influence of the attack is described, and the cascading failure vulnerability index is defined.

2.1 Influence of false data injection attack on the system

A FDI attack on a power CPS mainly refers to exploiting vulnerabilities in the equipment and imperfect confidentiality in the mechanisms to gain access to the communication system.Then, according to the acquired system functions, parameters are configured and topology information is acquired so as to inject false data [25].If the false data attack is injected into the uplink communication process, then the data information collected by the cyber network does not match the actual operating state of the power network, affecting the cyber network's decisionmaking.In contrast, when the false data attack is injected into the downlink communication process, incorrect control commands are received, and the operation state of the power network is affected.

To study the impacts that attacks injected into the uplink communication process have on cascading failures, is defined as the power flow information FDI attack matrix. is the tamper information for the node power of the power grid, and represent the tampering information of the transmission; and Meanwhile, is defined as the grid structure information FDI attack matrix.The diagonal elements of are 0, and Here, α ∈R denotes the FDI power flow attack factor, which represents the attacker’s change in the node injection power and line transmission power; β ∈(0,1) is the topological attack factor, where β=0 means that the attacker tampered with the transmission line i j,to disconnect, and β=1 means the attacker tampered with the transmission line i j,to connect.Therefore, when the uplink communication channel is attacked by the FDI, the power flow information and network structure information collected by the cyber network can be represented as follows:

Similarly, is defined as the control command attack matrix.The diagonal element represents the tamper information for the node power adjustment, and the non-diagonal elements are zero.is defined as the line break control instruction attack matrix, where the non-diagonal elements represent the tampering information on the line status, and In addition, λ ∈R is the FDI node power tampering factor, and represents the amount of change to the node power from the attacker.γ ∈(0,1) denotes the topological attack factor; if γ =0, then the circuit breaker is closed, and if γ =1, then the circuit breaker is opened.Thus, when the downlink communication channel is attacked by the FDI, the control command of the cyber network to the power network becomes as follows:

During the attack, the topological data and power flow data are changed in coordination.When the line connection information is changed to disconnection, the power flow information on the line is simultaneously changed to 0.

2.2 Analysis process of cascading failure

The cascading failure analysis process considering an FDI attacks is shown in Fig 2.The specific analysis process is as follows.

Fig.2 Cascading failure analysis flowchart

a.The power CPS is initialized, i.e., the power network runs stably under the control of the optimal economic dispatch algorithm.The upper and lower limits of the generating capacity of each generator are set, and the maximum transmission capacity of the line is set according to the line transmission power in the initial state.

b.A node of the power grid suddenly fails.

The adjacency matrix and node admittance matrix of the power network are updated, and the power flow distribution of the power network is calculated.Meanwhile, if the uplink communication is normal, the power flow information and grid structure information are uploaded to the cyber network by Equations (6) and (7).However, if the uplink communication channel is subject to FDI attacks, the information follows (14) and (15).

c.The optimization and decision-making are performed in the cyber network.According to Equations (3), (4), and (5), active power adjustment commands and transmission line on-off commands are generated.If the system’s downlink communication is normal, the generated control commands are transmitted to the power grid according to Equations (10) and (11).If the downlink communication channel is attacked by false data, the process will follow Equations (16) and (17).

d.The power grid executes the control instructions and enters a new operating state.

e.If there is a new faulty node or overloaded line, then step C is performed, otherwise, the simulation is ended, and the amount of load loss and number of failed nodes are determined.

During the simulation process, if the AC power flow of the power grid does not converge, the system is considered as completely de-stabilized, and the cascading failure simulation is ended.

2.3 Vulnerability assessment

After a node failure, the degree of damage to the system reflects its vulnerability.If the scale of the cascading failure caused by the failure of node i is the largest, that node is the most vulnerable node.In a power CPS, each node terminal of the cyber network generally has an independent power supply; therefore, damage to a single power network node will not cause a power failure of the entire cyber network.Thus, the vulnerability evaluation index is only given for the power grid in this section.

In the above, Vpn represents the topological integrity of the power grid, and Vpd is the degree of the load loss.NP' and LD are defined as the number of nodes lost and load loss of the power grid after failures, respectively.

The vulnerability assessment is completed by calculating the above indicators, butt is very complicated.However, the power flow betweenness can be used to comprehensively evaluate the vulnerability of nodes from the perspectives of the topology characteristics and operating characteristics.Thus, by comparing the power flow betweenness with the vulnerability index after a cascading failure, the accuracy of the power flow betweenness for the node vulnerability assessment in the cyber-physical environment can be verified, and the vulnerability assessment can be directly completed.The power flow betweenness is calculated using Equation (20).

Here, G and D are the generator node and load node set, respectively.n, y, and z represent the nodes, generator nodes, and load nodes in the transmission path Bm, respectively.Wy denotes the weight of the generator node (active power output value), and Wz is the weight of the load node (active load value).Pm ( n ), y ,z is defined as the active power of the transmission path Bm passing through the node n.

3 Simulation results analysis

In this study, the IEEE 14-bus system is selected for constructing the power CPS, as shown in Fig.3.Based on the method proposed in [26], when the power system is operating stably, the active transmission power of the line is Pij.The line load factor α = 40% at this time, and the line is overloaded when α ≥100%.Thus, when the system is stable, the active transmission power and maximum active transmission power of each transmission line are as shown in Table 1.

Table 1 Active power of each transmission line

Line number Line Pij (MW) |Pij,max|1 1-2 30.05 75.13 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 1-5 2-3 2-4 3-5 4-4 4-5 4-7 5-9 6-6 6-11 6-12 7-13 7-8 9-9 9-10 9-14 10-11 12-13 13-14 6.830 11.60 4.080-0.650-10.57-19.61-31.20 3.640 21.15 11.64 8.280 19.92-72.20 41.00 1.030 6.820-7.980 2.100 8.270 17.08 29.00 10.20 1.630 26.43 49.03 78.00 9.100 52.88 23.28 20.70 49.80 180.0 102.5 2.580 17.05 19.95 5.250 20.68

3.1 Cascading failure deduction analysis under false data injection attack

After the power network node fails, we quantitatively deduce and analyze the cascading failure process when the system communication is normal and the uplink/downlink communication process is attacked by the FDI.It is assumed that a permanent fault occurs on bus 4 in the power grid at time t; this means that the injected power of bus 4 is 0, and that all of the transmission lines directly connected to bus 4 are open.

3.1.1 System communication process under normal conditions

When the system communication process is normal, the information collected by the cyber network is consistent with the operating state of the power network, and the power network can normally receive the optimization decision instruction of the cyber network.The uplink communication process is carried out according to (6) and (7), and the downlink communication process is carried out according to (10) and (11).

Fig.3 IEEE14-node power CPS

(1) At time t + 1, the power flow is redistributed; the transmission power and network topology on each line are shown in Fig.4(a) and (b), respectively.The transmission powers of the lines are P15 =-20.27 MW, P25 =-27.05 MW,P56 =-55.65 MW, P910 =22.32 MW, and P914 =20.38MW.Their absolute value is greater than the maximum value of the respective transmission power for each line.In this case, the above lines are overloaded, and are temporarily disconnected.

(2) At time t + 2, the cyber network redistributes the power generation of each generator according to the optimal economic scheduling, i.e., Equations (3), (4), and (5).Then, the scheduling results are P11 =36.58 MW, P22=6.30 MW, P33=57.42 MW, P66 =57.42 MW, and P88=57.42 MW, and the overloaded circuits are reconnected at this time.

(3) At time t + 3, i.e., after adjusting the generator output, the transmission power and network topology of each line in the power network are shown in Fig.5(a) and (b), respectively, where P23=37.43 MW, P25 =-15.52 MW,and P910=13.28 MW.The absolute values are greater than the maximum values of the transmission powers of the respective lines.This means that L2 3- , L2 5- and L9-10 are overloaded; thus, they are temporarily disconnected at this moment.

Fig.4 Line transmission power and topology diagram at t + 1 when the system communication is normal

(4) At time t + 4, the active power output of each generator meets the requirements for economic operation, and the overloaded lines can only be removed without starting the economic dispatch.After the overloaded lines are removed, bus 3 fails; accordingly, the output of each generator is adjusted, and the scheduling results are P11=33.20 MW, P22 =5.71 MW , P33=0 MW , P66=42.86 MW , and P88=42.86 MW.Meanwhile, the overload lines are reconnected.

(5) At time t + 5, bus 3 exits operation, there is no overloaded line, and the power network enters a new steady state.The transmission power and network topology of each line of the power network are shown in Fig.6 (a) and (b), respectively.

3.1.2 False data injection attack on uplink communication process

Fig.5 Line transmission power and topology diagram at t+3 when the system communication is normal

When the system’s uplink communication process is attacked by false data, the information collected by the cyber network is inconsistent with the operating state of the power network, which will affect the optimization decisions for the cyber network.The uplink communication process is conducted according to Equations (14) and (15).

(1) At time t + 1, the upstream communication channel/sensor of the overloaded line are attacked by an FDI.The attack commands are =-27.05 0.65, =-55.65 21.15, =-23.32+1.03, and The intent of the attack is to tamper with the power flow information of the overloaded line (i.e., to change it to the normal state), and to tamper with the onoff state information of the line to the normal connection.

(2) At time t + 2, the cyber network senses the change in bus power, and adjusts the generator output.As the overload information and disconnection instructions of the transmission line are not collected, the reconnection instruction will not be generated for the overloaded line.

At time t + 3, the power network adjusts the generator output, the overloaded transmission lines remain disconnected, and the AC power flow of the power network does not converge.Thus, the system stops working.

Fig.6 Line transmission power and topology diagram at t + 5 when the system communication is normal

3.1.3 False data injection attack on downlink communication process

When the system downlink communication process is attacked by false data, the power network receives the wrong optimization control instruction, affecting the optimization result.The downlink communication process is conducted according to Equations (16) and (17).

At time t + 1, the power flow is redistributed, and the transmission power and network topology of each line are shown in Fig.4(a) and (b), respectively.The transmission powers of the lines are P15 =-20.27 MW, P25 =-27.05 MW, P56 =-55.65 MW, P910 =22.32 MW, and P914 =20.38 MW.The absolute value is greater than the maximum transmission power for each line; thus, the above lines are overloaded, and are temporarily disconnected.

At time t + 2, the cyber network redistributes the power generation of each generator according to the optimal economic scheduling algorithms, i.e., Equations (3), (4), and (5).Then, the scheduling results are P11=36.58 MW, P22 =6.30 MW, P33=57.42 MW, P66=57.42 MW, a n d P88=57.42 MW, and the overloaded circuits are reconnected at this time.

(3) At time t + 3, the overloaded lines and downstream communication channels/executors of the generators are attacked by the FDI.The attack commands are given as The intent of the attack is to prevent the generator from adjusting its active power, and the above lines from being reconnected.

(4) At time t + 4, the adjustment command is not received, and the AC power flow does not converge.

According to the analysis method for node 4, the remaining nodes are simulated, and the influences of FDI attacks on cascading failures are further studied by comparing the system load losses and number of failed nodes after the cascading failure.However, through the analysis of node 4, it can be seen that whatever the FDI attack is injected into the uplink communication process or the downlink communication process, the result is that the power network does not execute the adjustment instructions for the cyber network.Thus, only the number of failed nodes and load loss when the system communication process is normal and when the downlink communication process is attacked by the FDI are calculated.In addition, when the system is completely disassembled, the number of failed nodes and amount of load loss comprise all nodes and all loads in the system.

A comparison of the number of failed nodes and load loss are shown in the line chart and histogram of Fig.7.In general, compared with normal communication, the number of failed nodes and load loss are increased when the system is attacked by the FDI.When the FDI attack is injected into the system, the ability of the cyber network to suppress the cascading failures is reduced, and the scale of the cascading failures is expanded.

Fig.7 Comparison chart of system losses under the two modes

3.2 Vulnerability assessment

The evaluation of vulnerable nodes is completed by calculating a vulnerability evaluation index after a cascading failure.In addition, the power flow distribution of the power network is used to characterize the power network.In the process of calculating the power flow, a balance node needs to be selected to ensure the convergence of the power flow; thus, the vulnerability of the balance node is not evaluated.

After the cascading failure, the vulnerability evaluation index for each node is calculated according to Equations (18) and (19).The calculation results are shown in Fig.8.By comparing Vpn and Vpd, it can be seen that the number of failed nodes and load loss of the system are basically positively correlated after a node failure.In addition, a small number of node failures cause large-scale cascading failures, and node 4, node 7 and node 8 are the vulnerable nodes in the system.Furthermore, the power flow betweenness is calculated using Equation (20), and a comparison t with Vpn is shown in Fig.9.Under the influence of the monitoring and control functions of the cyber network, the vulnerability of the power network nodes with high flow betweenness remains very high, and the identification of the vulnerable nodes can be completed.

4 Conclusion

In this study, by considering the monitoring function of a cyber network and the operating characteristics of a power grid, a CPS model is constructed.Then, the impacts of false data attacks on cascading failures are researched, e.g., when the system has node failures.The key nodes are identified by calculating the vulnerability index.The simulation results show that when a node fails, the FDI attack expands the scale of cascading failures, and that the power flow betweenness can be used as an indicator for evaluating the vulnerable nodes.

Fig.8 Vulnerability assessment results for each node

Fig.9 Comparison chart between Bf(n) and Vpn

Acknowledgements

This work is supported by the National Natural Science Foundation of China (61873057) and the Education Department of Jilin Province (JJKH20200118KJ).

Declaration of Competing Interest

We declare that we have no conflict of interest.