Protecting State Estimation in Smart Grids

1. Attack and Defense Mechanisms for State Estimation in Smart Grid Mohammad Esmalifalak Supervisor: Dr. Zhu Han ECE Department

2. Overview • Introduction to Smart Grid • Power System Model • Bad Data Injection - Independent Component Analysis - False Data in Electricity Market • Bad Data Injection Detection - Anomaly Detection and Support Vector Machine - Gaming Between Attacker and Defender • Future Work Mohammad Esmalifalak – PhD Thesis Defense

3. Smart Power Grid • Smart way of generation, transmission, and consumption of electricity • Benefits both utilities, consumers, & environment: • Reduce supply capacity while fitting demand. • Improve reliability and efficiency of grid. • Integration of green energy, reduction of CO2, etc. • More than 3.4 billion from US federal stimulus bill is targeted. • One of hottest topic in research community Let’s view how everything is connected graphically! Mohammad Esmalifalak – PhD Thesis Defense

4. Smart Grid Illustration Renewable Energies Communication Channels Control Center Bulk Storage (PEV, etc.) Conceptual diagram in smart grid, “ITERES SMART GRID” Mohammad Esmalifalak – PhD Thesis Defense

5. Power System Monitoring • State Estimation (SE): Estimation of states over the power grid using redundant measurements. • How does control center conduct SE? • Supervisory Control and Data Acquisition (SCADA) system Communication (DNP3) Measurements Control Center Remote Terminal Unit Mohammad Esmalifalak – PhD Thesis Defense

6. State Estimation (SE) • SE is vulnerable to cyber attack Communication  could be wireless (e.g., radio, and pager) or wired (e.g., Dial-up telephone, RS-485 multi-drop, 3G, and Ethernet). These communication links are vulnerable to cyber attack. Maroochy waste water utility Olympic pipeline company Unauthorized access to the control system via an insecure wireless network. A system administrator was doing development on live SCADA Mohammad Esmalifalak – PhD Thesis Defense

7. Overview • Introduction to Smart Grid • Power System Model • Bad Data Injection - Independent Component Analysis - False Data in Electricity Market • Bad Data Injection Detection - Anomaly Detection and Support Vector Machine - Gaming Between Attacker and Defender • Future Work Mohammad Esmalifalak – PhD Thesis Defense

8. Linear State Estimation Model • Transmitted active power from bus i to bus j Suseptance • Linear approximation for small variance: H: Jacobean Matrix (m×n) x: State variable (n×1) z: Measurements (m×1) e: Noise vector (m×1) (m measurements for n buses and, m>>n) Mohammad Esmalifalak – PhD Thesis Defense

9. Bad Data Detection • Conventional bad data detection using largest residue: • Residual vector where Conventional BDD: without bad data: with bad data: • Stealth (unobservable) attack • Hypothesis test would fail in detecting the attacker, since the control center believes that true state is Mohammad Esmalifalak – PhD Thesis Defense

10. Independent Component Analysis (ICA) If attacker doesn’t have access to Matrix H? A statistical technique for decomposing a complex signal into independent sub-parts. Given (k<n) Mohammad Esmalifalak – PhD Thesis Defense

11. How ICA works? One of the independent components of y q should have only one non-zero component If b wants to be one of independent components of the y If q has more than one non-zero component, y will be more Gaussian (Central Limit Theory) Find the best W, which maximizes the non-Gaussianity of kurtosis or the fourth-order cumulant, Negentropy A. Hyvärinen and E.Oja, “Independent Component Analysis: Algorithms and Applications.”

12. Simulation Results MSE of ICA inference (z - Gy) vs. SNR. Probabilities of detection for Different Schemes Detection of stealth attack with conventional BDD is impossible When SNR is high (40dB) the MSE is as low as 10e-4 Mohammad Esmalifalak – PhD Thesis Defense

13. Overview • Introduction to Smart Grid • Power System Model • Bad Data Injection - Independent Component Analysis - False Data in Electricity Market • Bad Data Injection Detection - Anomaly Detection and Support Vector Machine - Gaming Between Attacker and Defender • Future Work Mohammad Esmalifalak – PhD Thesis Defense

14. Electricity Market Overview Optimal Power Flow (OPF) Bid’s from Generators and loads, Structure of network, etc Electricity Prices, Schedule for generators DCOPF for Day-Ahead Electricity Market Predicted values for power network Day-Ahead Market: Real-time Market: DCOPF for Real-Time Electricity Market Direct Measurements in power network State Estimation Mohammad Esmalifalak – PhD Thesis Defense

15. Electricity Markets in US Federal Energy Regulatory Commission (FERC) Mohammad Esmalifalak – PhD Thesis Defense

16. Day-AheadElectricityMarket 1-Day Ahead Market: Market that computes optimal points for generation and consumption (usually a day before real time) Min : St: Generation Cost Power Balance Generation & Transmission Limits Mohammad Esmalifalak – PhD Thesis Defense

17. Real-Time ElectricityMarket 2-Real Time Market: Market that recalculate optimal points for generation and consumption based on real-time data Min : St: Generation Cost Power Balance Generation & Transmission Limits Mohammad Esmalifalak – Thesis Defense

18. Changing Congestion Sundance 200MW Brighton 600MW B5 B4 Z3 Z1 Increase or decrease Estimated transmitted power 35$ 10$ Z5 Z2 300MW Z9 Alta 100MW Z4 B1 Solitude 520MW B3 14$ Stealth attack also is limited (Expert engineers) B2 Z6 30$ 15$ Z8 Z10 Z7 Z11 Park City 110MW 300MW 300MW Put higher cost for secure measurements Mohammad Esmalifalak – PhD Thesis Defense

19. Decreasing Congestion Inserting false data will release the congestion in Line 29 Releasing congestion will change the prices Virtual trade in Day ahead Release congestion in ex-post real time market Making profit in Real time market Mohammad Esmalifalak – PhD Thesis Defense

20. Overview • Introduction to Smart Grid • Power System Model • Bad Data Injection - Independent Component Analysis - False Data in Electricity Market • Bad Data Injection Detection - Anomaly Detection and Support Vector Machine - Gaming Between Attacker and Defender • Future Work Mohammad Esmalifalak – PhD Thesis Defense

21. Principle Component Analysis a 1st sample mth sample b PCA c Mohammad Esmalifalak – PhD Thesis Defense

22. Visualizing the Operational Points Power system measurements are correlated and can be compressed efficiently. 1st sample mth sample Transmitted active power Injected active power Mohammad Esmalifalak – PhD Thesis Defense

23. IEEE 118 Bus Test System Attacked Points Normal Operating Points Mohammad Esmalifalak – PhD Thesis Defense

24. Anomaly Detection In data mining, the data sets considerably different from the remainder of data are called outliers or anomalies. Probability density function of feature i Statistical characteristics of the historical data ? Mohammad Esmalifalak – PhD Thesis Defense

25. Anomaly Detection Best threshold Larger threshold Smaller threshold Misses some anomaly operating points Uses training data set to learn the best possible threshold Alarms anomaly even for some normal operating points Semi-supervised learning: Although choosing the threshold without training set is possible, for best results in the test sets, we can use training set to learn best threshold. Mohammad Esmalifalak – PhD Thesis Defense

26. Clustering Methods Line outage Attacked Points Normal Operating Points Generator outage Clustering methods like, Support Vector Machine (SVM) Mohammad Esmalifalak – PhD Thesis Defense

27. Support Vector Machine 1 -1 1 -1 Mohammad Esmalifalak – PhD Thesis Defense

28. Clustering Methods Precision Recall With almost 390 training samples, SVM can learn this clustering problem. Mohammad Esmalifalak – PhD Thesis Defense

29. Overview • Introduction to Smart Grid • Power System Model • Bad Data Injection - Independent Component Analysis - False Data in Electricity Market • Bad Data Injection Detection - Anomaly Detection and Support Vector Machine - Gaming Between Attacker and Defender • Future Work Mohammad Esmalifalak – PhD Thesis Defense

30. Attacker and Defender Gaming Game Attacker/Defender cannot attack/defend all measurements Defender Attacker Game table for attacker and defender Mohammad Esmalifalak – PhD Thesis Defense

31. Two–Person Zero–Sum Proportion of times that attacker/defender, attack/defend to/from measurements, respectively Mohammad Esmalifalak – PhD Thesis Defense

32. Conclusion • Application of cyber technologies improves the quality of monitoring and decision making in smart grid but increases the cyber attack vulnerability.  • Vulnerabilities: • Having access to measurements’ data reveals the structure • of network [4]. • Attacker has financial benefit from attacking measurements [3]. • Protection: • Learning Normal operating region of Power Network by machine learning techniques (such as anomaly detection and SVM) [2]. • Analyzing the behavior of attacker and defender using game theory [1]. Mohammad Esmalifalak – PhD Thesis Defense

33. Future Work • Analyzing new types of attack (Economical and technical effects). • Developing new defend mechanisms (Using signal processing or machine learning methods). • Using data mining to extract information from the smart meters’ large data set and transform it into an understandable structure for control center • Protection against the new types of malware that are recently being introduced ( for e.g. Stuxnet, Zeus, etc).  • Privacy of the data. Public acceptance of the smart meters of the smart meters needs solid security investigations. • Affordable global communication infrastructure and embedded systems make it now relatively easy to give incentives to the loads and change • their behaviors (demand side management). Mohammad Esmalifalak – PhD Thesis Defense

34. Publication List Journal/Magazine Papers  [1] M. Esmalifalak, H. Nguyen, R. Zheng, L. Xie, L. Song, and Z. Han, “Stealthy Attack Against Electricity Market Using Independent Component Analysis” Submitted to IEEE Journal on Selected Areas in Communication (J-SAC) [2] M. Esmalifalak, N. Nguyen, R. Zheng, and Z. Han, “Detecting Stealthy False Data Injection Using Machine Learning in Smart Grid” Submitted to IEEE Transactions on Smart Grid. [3] L. Liu, M. Esmalifalak, and Z. Han “Protection Against False Data Injection Attacks in Power Grids via Sparsity and Low Rank”, Submitted to, IEEE Transaction on Smart Grid. [4] Y. Huang, M. Esmalifalak, Y. Cheng, H. Li, K. A. Campbell, and Z. Han, Adaptive Quickest Estimation Algorithm for Smart Grid Network Topology Error," to appear, IEEE Systems Journal, Special Issue on Smart Grid Communications Systems. [5] M. Esmalifalak, G. Shi, Z. Han, and L. Song “Bad Data Injection Attack and Defense in Electricity Market using Game Theory Study” to appear IEEE Transactions on Smart Grid, Special Issue on Cyber, Physical, and System Security for Smart Grid. [6] N. Forouzandehmehr, M. Esmalifalak, A. Mohsenian, and Z. Han,  “A Dynamic Game for Demand Side Management of Smart Building with Renewable Energy Resource” Submitted to,  IEEE Transaction on Smart Grid. [7] Y. Huang, M. Esmalifalak, H. Nguyen, R. Zheng and Z. Han, “Bad Data Injection in Smart Grid: Attack and Defense Mechanisms” to appear, IEEE Communication Magazine (COMMAG-11-00367). Mohammad Esmalifalak – PhD Thesis Defense

35. Publication List Conference Papers [1] M. Esmalifalak, N. Nguyen, R. Zheng, and Z. Han, “Detecting Stealthy False Data Injection Using Machine Learning in Smart Grid” submitted to GLOBCOM 2013, Atlanta, GA, 2013. [2] L. Liu, M. Esmalifalak, and Z. Han “Detection of False Data Injection in Power Grid Exploiting Low Rank and Sparsity”, IEEE International Conference on ommunications, Budapest, Hungary, June 2013 [3] M. Esmalifalak, G. Shi, Z. Han, and L. Song “Attack Against Electricity Market–Attacker and Defender Gaming”, IEEE Global Communications Conference Exhibition Industry Forum (Globecom 2012), Anaheim, USA, Dec. 2012. [4] M. Esmalifalak, Z. Han, and L. Song “Effect of Stealthy Bad Data Injection on Network Congestion in Market Based Power System” IEEE Wireless Communications and Networking Conference , Paris, France, Apr. 2012. (Best Paper Award) [5] M. Esmalifalak, H. Nguyen, R. Zheng and, Z. Han, “Stealth False Data Injection using Independent Component Analysis in Smart Grid,” Second IEEE Conference on Smart Grid Communications (IEEE SmartGrid Comm), Brussels, Belgium, Oct. 2011. Mohammad Esmalifalak – PhD Thesis Defense

36. Thanks for Your Attention Mohammad Esmalifalak – PhD Thesis Defense