Attenuating the Impact of Integrity Attacks
on Real-Time Pricing in Smart Grids

The objective of the power grid is to generate and then deliver enough electric power to match the demand of consumers. Unlike other critical infrastructures like water or gas distribution networks that can accommodate a variation in demand by storing their resource, the power grid cannot store electricity, and thus, electricity must be generated in the exact moment that it is consumed. If the supply of power is greater than the demand, this excess power is stored in the form of kinetic energy in the electricity generators, which produces an acceleration of the generator resulting in higher rotation frequency; on the other hand, if the supply of power is not enough to match the demand, generators will have to provide more current to the system, and the magnetic field associated with this increased current will slow down the generator–resulting in lower rotation frequency. All the equipment in the power grid is meant to operate at a specific frequency (e.g., 60Hz) and changes in the frequency of electricity will result in poor power quality and ultimately risk of physical equipment damage and if the frequency deviation is large enough it may trip circuit breakers and disconnect regions of the grid causing blackouts.

To maintain a balance between optimizing the use of resources and the real-time control requirements for keeping the frequency and voltage of the power grid at their design levels, the power grid uses a daily and hourly scheduling of generation units to match the forecast electricity load via wholesale market transactions. A scheduling coordinator solicits generation through some form of auction where lowest bidders generate electricity and this in turn creates an economically optimal schedule of generators. In contrast to these traditional wholesale markets (e.g., between generation utilities and distribution utilities), many retail markets (e.g., between a distribution utility and an industry consumer of electricity) have traditionally adopted static pricing schemes such as fixed and time-of-use tariffs, under which consumers have limited incentives to adapt their electricity consumption to market conditions. This lack of incentives results in high peak demands that strain infrastructure capacities and unnecessarily increase operational costs [1]. This approach is inefficient, since the system infrastructure used to guarantee supply under peak hours is not completely used most of the time. According to the The US Department of Energy, 10% of the whole generating capacity and 25% of distribution capacity is used less than the 5% of the time.

In an effort to increase the efficiency of the power grid, many retail-markets are expanding the use of demand-response programs. In their basic form, demand-response programs are a control problem where the control signal are the incentives (e.g., real-time pricing), or direct-load control (e.g., the utility directly controlling the set-points of air conditioning systems in specific cases) for consumers to reduce electricity consumption during peak hours and to shift this load to off-peak hours (Figure 1). Currently most of the electricity consumers leveraging demand-response programs are large commercial consumers, but the market is expanding more and more to smaller industries and even residential consumers. As the number of smart devices necessary to manage this market expands, the potential attack surface of the market also increases, and therefore we need to begin considering the potential impact of attackers that compromise devices and communication channels used in this market.

The security of demand response algorithms with real-time electricity pricing was recently explored by Tan et al. [1]. In their work, they consider an attacker that has compromised a portion of the communication channels used to send price information to consumers, and then study the effects to the power system from scaling and delay attacks, where the prices advertised to smart meters are compromised by a scaling factor (so consumers use the wrong prices) and by corrupted timing information (so consumers use old prices). While this previous work is an important step for initiating the discussion on how to analyze the impact of attacks on real-time pricing, this research has limitations on the way it modeled the adversary by limiting attacks to scaling and delays. In addition this previous work did not discuss any security countermeasures against attacks.

In this paper we extend the work of Tan et al. [1] in several directions:

• •

  Parametric adversary models (e.g., scaling or delay attacks) are a common assumption to keep a mathematical analysis of the problem tractable, but constraining the adversary this way is a deficiency in modeling realistic attackers which will not be subject to these constraints. We model a more realistic attacker that can inject an arbitrary modification to the price received by the consumer, and is not constrained to scaling or delay attacks.

• •

  Real-time pricing forms a closed-loop control system, and small modifications to the signals in the closed loop made by the adversary can be iteratively amplified by the feedback. We use sensitivity analysis to identify the attack signals that will be amplified and the ones that will be attenuated by the control loop, and thus, we find the worst-possible attacks for any given bound on the maximum price deviation introduced by an attacker at any time instant.

• •

  In addition to modeling and analyzing the impact of attacks that compromise the price signals, we also model the effect of attacks that compromise sensor signals (smart meter electricity consumption reports).

• •

  We propose countermeasures based on changing the parameter of the original controller by Tan et al. In addition, we propose an estimator and a new robust-control design that estimates the perturbation and computes a new price to attenuate the error between supply and demand caused by the attacker. We also introduce a low-pass filter as a solution to attenuate any high-frequency component of an attack, thus guaranteeing that our robust controller will minimize the difference between power generated and power consumed with, or without attack.

• •

  Finally, while the robust controller will minimize the impact of any attack, it will still be beneficial to notify the operator of the power grid of any potential indicator of an attack. Thus we propose an attack-detection algorithm and evaluate its effectiveness in a preliminary experiment to identify the properties of the detector for different controller parameters, and different attack frequencies.

Our work falls within the scope of integrity attacks (or false-data injection attacks) to the sensor or control signals of a cyber-physical system. Integrity attacks have been proposed as a way to analyze the vulnerability of cyber-physical systems in general and the power grid in particular. Injecting false data to state estimation algorithms used in bulk of the power grid was first proposed by Liu et al. [2], and similar integrity attacks were proposed for compromised smart meters trying to defraud the electric utility [3].

The work on integrity attacks against bad data detectors for state estimation in the power grid has generated a significant body of follow up work; for example Dán and Sandberg [4], consider a defender that can secure individual sensor measurements by, for example, replacing an existing meter with another meter with better security mechanisms such as tamper resistance or hardware security support. Kosut et al. [5] also extend the basic false data injection attack to consider attackers trying to maximize the error introduced in the estimate, and defenders with a new detection algorithm that attempts to detect false data injection attacks. Similar false-data injection attacks have been considered for specific devices in the power grid, such as integrity attacks against the Flexible Alternate Current Transmission System (FACTS) [6, 7], and Automatic Generator Control (AGC) [8, 9, 10]. All this related work has targeted operational data of the power grid, and is not related to electricity markets.

Negrete-Pincetic et al. [11] were one of the first to study how false control signals can affect the social welfare of the electricity market. Related work by Xie et al. [12] studied how false data injection attacks can be used to defraud bulk electricity markets by modifying Locational Marginal Prices (LMPs), and work by Jia et al.[13] studied how false meter data in the bulk of the power grid can be used to cause the largest errors in LMP estimation. These integrity attacks have been studied in the bulk electricity market and specifically, the estimation problem alone; most previous work does not consider how the control algorithm can be designed to minimize the impact of integrity attacks, or studied the feedback control loop behavior of the system under attack.

In contrast to one-shot attacks, where the attacker provides false information only once [16, 2], in this work we consider that an attacker compromises a device or a communication channel, and has the capability to add false information at any moment and—more importantly—repeatedly over a long period of time.

For example, most of the work on false data injection in state estimation finds a value $d$ to insert at an arbitrary point in time [2], however, this previous work does not consider the evolution of the system dynamics over time. In this context, the question we would like to pose from an adversarial point of view is the following:

• •

  What is the worst attack time series $d_{k}$ that can affect the system while keeping some bounds (prices will be bound by some maximum and minimum values: $\forall k~~~d_{k}\in[d_{min},d_{max}]$.

Tan et al. [1] proposed an adversary model where one attacker compromised the pricing communication channel between the ISO and a percentage $\rho$ of consumers. They considered delay attacks and scaling attacks.

In a delay attack, the compromised price is an old version of the price, i.e., $\hat{\lambda}_{k}=\lambda_{k-\tau}$, and in a scaling attack, the compromised price is a scaled version of the true price, i.e., $\hat{\lambda}_{k}=\gamma\lambda_{k}$.

While the attacks defined above can be easily analyzed from a theoretical point of view, it is not clear why an attacker who has compromised a communications channel will select to launch these attacks when she has the flexibility of sending any arbitrary time series $\hat{\lambda}_{k}$ she wants, even one that bears no resemblance to the original time series $\lambda_{k}$.

Furthermore, scaling attacks and delay attacks are not strategic, and do not seek to maximize any objective function from the adversary. In this work we follow the generic and more powerful adversary model introduced by the false data injection paper [2], and we expand it to consider a time series. In particular, we model a compromised communication channel as $\hat{\lambda}_{k}=\lambda_{k}+d^{a}_{K}$, where $\hat{lambda}_{k}$ is the price information received by the victim, and $d^{a}_{k}$ is an arbitrary time signal that can take any value. It is clear now that scaling attacks and delay attacks are simple subsets of this new attack because for every scaling or delay attack possible producing a false price information $\hat{\lambda}_{k}$, there exists an arbitrary time signal $d_{k}^{a}$ that will produce the same price $\hat{\lambda}_{k}$ received by the victim.

The question we now face is how to determine a strategic attack time series $d_{k}^{a}$ that will try to cause as much damage as possible (i.e., that will try to maximize the mismatch between power generated and power consumed). One of our key insights into tackling this problem is the fact that for every time series, there is a one-to-one correspondence of the time series and its frequency (Fourier transform) representation. Therefore, instead of attempting to analyze the worst time series $d_{k}^{a}$ in time, we identify the worst-possible attacks in frequency space.

In order to provide a mathematical tool that enables us to quantify the impact of the attack, we use sensitivity analysis. Sensitivity functions have been widely used to analyze the impact of external disturbances or parameter changes on the output of a feedback system. In systems and control theory, it is well known that feedback can attenuate or amplify disturbances; therefore, using the frequency representation of the system (the transfer function), it is possible to obtain the sensitivity function and observe the response of the system to a perturbation of a specific frequency $\omega$. [17].

In this work we focus our attention on two types of additive attacks: i) additive attack in the price information, and ii) additive attack in the sensor information. Each type of attack produces different consequences to the system.

In the next section we give the formal incorporation of the attacks against pricing signal, and in the section after that we use sensitivity analysis to identify the impact of the attacks.

The sensitivity function models how one input to the system (in our case the attack) affects another signal in the system (we are mostly interested to see how the attack affects the error in power generated minus the demand, and to also see the impact on the prices).

We start by looking at the impact that a disturbance $d^{a}(z)$ (in the frequency space) can have on the error $\mathcal{E}(z)$. In particular, the sensitivity function for these two time series (denoted as $S_{\mathcal{E},d}$) is the ratio $\mathcal{E}(z)/d^{a}(z)$:

As stated before, our interest is to analyze the effects of an additive attack in the frequency domain. We denote the angular frequency as $\omega$. We then replace $z=e^{j\omega T}$ for $T$ being the sampling period (the time interval between updating the sensor measurements and the prices). It is important to notice that the maximum frequency that an attacker can generate is limited by the sampling period, such that $\omega_{max}=\pi/T$. For instance, if the sampling period is $T=0.5$ hours, then $\omega_{max}=2\pi$.

In order to observe the effects an attack time-series with different frequency components in the output error $\mathcal{E}(z)$, we obtain the expression $|S_{\mathcal{E},d}(e^{j\omega})|$ for $\omega$, the disturbance frequency:

From this equation we can see that the percentage of compromised channels $\rho$ has a scaling effect on the sensitivity of the system. Moreover, the selection of the control parameter $\eta$ proposed by Tan et al. is fundamental for attenuating the effects of the attack. The left side of Figure 3 shows how the attack can be amplified (or attenuated) as a function of the frequency of the attack signal. Clearly, the impact the supply-demand mismatch $\mathcal{E}$ is severe for most frequencies; however, we can also see how the control parameter $\eta$ can be selected to attenuate the impact of high-frequency signals: smaller values of $\eta$ will minimize the impact of high-frequency components of the attack time-series—this comes at the cost of a slower control action (as seen in Figure 4) which might not be a bad idea, as changes in prices will remain small, giving consumers more predictability in their electricity consumption habits.

Recall that if the output $\mathcal{E}$ is different from zero, then there is over demand or over production of electricity, which can affect considerably the system (resulting in large frequency changes). Even if the price variations are small, the output amplifies the disturbance. There is a trade off between the $\eta$, $\rho$, and the frequency of the disturbance. An attacker can easily take advantage of this fact, and introduce intelligently false data to a portion of the users. This information can be of small amplitude, and hardly detected; however, the effects on the output can be catastrophic.

We can also obtain the sensitivity function with respect to the price. This function reveals how the attack modifies the real price calculated by the ISO. The function is described by

and looking at the magnitude of the frequency components we obtain:

The left side of Figure 3 shows the sensitivity function with respect to the price for different values of $\eta$, and $\rho=0.5$. With this selection of $\rho$, the real price changes produced by the attack are attenuated for all $\eta$.

Previous work has only considered integrity attacks to the price signals, but the sensors (or smart meters) can also be compromised and can be used to send false electricity consumption reports to the controller. This new attack model requires a new mathematical analysis of the attacks.

Now we assume that the attack occurs in the information that each consumer sends to the ISO, where $N$ sensors are compromised (Figure 8). We can observe that the main difference between attacking price signals (i.e., control commands) and sensor signals, is the fact that sensor signals are going to be aggregated in this case, and therefore we do not need to model two different transfer functions for compromised consumers, and uncompromised consumers (as we had to do when the price signal was attacked).

We define $n^{a}_{k}$ as the attack over one sensor, and study the sensitivity for one attack, and due to the linearity of the model and the assumption of homogeneous attacks, we scale the analysis by a factor $N\in\mathbb{Z}_{+}$, which is the number of compromised sensors.

The sensitivity function that relates the output $\mathcal{E}(z)$ with respect to the sensor additive attack $n^{a}$ is given by

Evaluating $z=e^{j\omega}$, we obtain the frequency response of the sensitivity function as

Similarly, we evaluate the effects of the price variations provoked by the false sensor information:

Figure 9 shows the graphical representation of both sensitivity functions. Clearly, the sensitivity functions with respect to the sensor attack are scaled versions of the sensitivity with additive attack in the price. Therefore, if the additive attack in the price occurs with $\rho=1$, for a total number of consumers $N_{T}>>|\dot{(}\lambda_{o})|$, the effects of the same attack in all the sensors ($N=N_{T}$) will produce a larger impact.

In order to illustrate the different impacts for both types of attacks (control signals vs. sensor signals) we assume a total number of consumers $N_{T}=1000000$. We analyze two different cases: i) an attack in the price information with $d_{k}^{a}=0.25\sin(\pi k/2)\$/MW$, ii) an attack on the sensor measurements with $n^{a}_{k}=0.2\sin(\pi k/2)kW/h$.

Figure 10 shows the maximum value of the output $\mathcal{E}$ when a disturbance of the form $d_{k}=0.25\sin(\pi k/2)$ is introduced to the price value and to the sensors, for different values of $\eta$, and for different amount of compromised consumers (for both types of attacks). We can see that for the same number of communication channels compromised, the attacks can be actually much worse if the attacker decides to compromised sensors vs. compromising the control signals.

Previous work only studied the effects of the attack, but did not propose new control mechanisms to mitigate possible attacks. We know discuss how we can start designing attack-resilient controllers.

In order to design an attack-resilient controller, we can leverage the fact that the ISO has historical data showing the behavior of the system which can be used for learning the dynamics (parameters) of the system. Whenever the controller commands do not have the expected effect, or when the sensor signals to not reflect the normal evolution of the system we can try to identify these problems and design a controller that minimizes the impact of price or sensor attacks.

As the attack are unknown inputs into the system, we can use a type of disturbance estimators. Disturbance observers have been studied in literature but we focus our attention in the one introduced by Kim et al. [18] for discrete-time systems.

We assume that the ISO possesses the information about the supply-demand error $\mathcal{E}_{k-1}$ and we try to detect an attack using the observer (an observer is another name for a “state estimator”).

We first present the attack-resilient controller for a general discrete-time system, and in the next section we show how to apply it to our real-time pricing model.

Let us consider a generic linear discrete-time system for a sampling period $T>0$ of the form

where $x_{k}\in\mathbb{R}^{n}$, $u_{k}\in\mathbb{R}^{m}$, $d_{k}\in\mathbb{R}^{q}$, and $y_{k}\in\mathbb{R}^{l}$ are the state variable, the control input, the disturbance, and the measurement output, respectively. The matrices $A,B,\Gamma,C$ are of adequate dimension.

For $d_{k}=(d_{k}^{1},\ldots d_{k}^{q})$, the disturbance is slowly time-varying, such that $d_{k+1}^{i}-d_{k}^{i}<T\mu_{i}$, $\forall i=1,\ldots,q$. Given a $K\in{\mathbb{R}^{q\times n}}$ and $C=I_{n}$, the observer is described as follows

Under the assumption that $\Gamma$ is invertible, we can choose $K=(I_{q}-\Phi)\Gamma^{-1}$ for $\Phi=[\phi_{1},\ldots,\phi_{q}]^{\top}$, and $\phi_{i}\in(-1,1)$. The estimation error is then bounded by

for $\phi\in(0,1)$, and $\mu_{i}>0$.

However, as the ISO possesses only past information about the state (i.e., $x_{k-1}=\mathcal{E}_{k-1}$) the estimator has to be slightly modified in order to estimate the disturbance using only $x_{k-1}$. As a consequence, the estimation is always a delayed version of the real disturbance. Therefore, the modified estimator is given by

We have designed a new real time pricing algorithm that not only assures stability, but also minimizes the impact of attacks. However, in practice, while we have attenuated the attack, it would still be desirable to know if we are under attack or not, so we can remove compromised devices from our system.

The ISO calculates a clearing price each time period, but even in the presence of an attack, the price changes are small (see Figures 6 and 7). However, the state estimator used in our robust controller can give information about the presence of an attacker, by analyzing the statistical behavior of the state estimator over long periods of time.

The detection mechanism that we propose is based on the accumulation of the rate of change of the estimated signal $\hat{d}_{k}$. This is known as the non-parametric CUSUM change detection statistic, and it is defined as:

where $S_{k}$ is the accumulated impact of the disturbance, and $\alpha_{k}$ is the rate of change of $S_{k}$ under normal conditions (without attacks). The use of the the error $\hat{\Gamma}\hat{d}_{k}$ is due to the fact that the ISO does not have knowledge about $\Gamma$. An attack is detected when $S_{k}>\delta$. $\delta$ has to be selected such that the number of false alarms is low. As it is based on the rate of change, then high frequency attacks are detected faster.

In this work we used the theory from sensitivity analysis to understand how previously proposed attacks could be generalized and evaluated in a formal setting. In particular we showed how to find better attacks than previously proposed, and how to design robust control systems that can mitigate a large number of attacks.

We also found that the design of the price adjustment mechanism is fundamental in the resiliency of the system. In particular, low values of $\eta$ reduce the effect of the attacks on both the prices and sensors.

Another of our contributions was the model to sensor attacks, and how they can have potentially more damaging effects than attacks on the pricing signal.

We also proposed an attack-resilient controller and several mitigation mechanisms, such as the use of low-pass filters to prevent high-frequency signals, and attack detection mechanisms. We believe we are one of the few research papers focusing on the important aspect of designing robust control algorithms against false data injection, as much of the previous work tends to focus on state estimation but does not consider the control actions of the system under attack, and how to design an controller that mitigates these attacks.

Our results show principled ways to use control theory in the design of attack-resilient cyber-physical systems. In general we believe that a well-designed defense-in-depth mechanism for cyber-physical systems will have to leverage not only information security expertise, but control theory to detect, respond, and reconfigure systems that can survive partial compromises.

Successfully compromising computers and embedded systems participating in controlling the power grid is only the first step to a successful attack. To have a predictable physical modification to the power grid (e.g., strategically manipulating voltages, or loads), the attacker needs to understand how control systems operate.

Defenders that leverage only information security mechanisms in their protection strategy will have limited success against these sophisticated attackers. To develop a defense-in-depth security strategy, defenders need to incorporate control models of the power grid to understand the vulnerabilities and fragility of the system they are trying to protect (e.g., not all compromised devices can drive a system to an unsafe state), and to design attack-resilient control algorithms that can survive a partial compromise of the system. Our work shows a direction of how to pursue this goal further and in general we hope these formalisms can help mitigate attacks not only against the power-grid but against other cyber-physical systems.

One interesting area of future research that we did not address in this paper are the possible attack strategies that can be achieved by combining attacks to both: sensors and control signals. All our models assumed the attacker compromised either the price signals, or the sensor signals, but not both. It is clear that if the attacker controls all control signals and all sensor signals then there is nothing we can do, but if the attacker has partial compromise of controllers and sensors, then the defender might still be able to design a robust algorithm that attenuates the attacks. We plan to look into this area in future work.