IEEE Systems, Man and Cybernetics Magazine - April 2021 - 48

IEEE 9-bus power system. Figure 11 details a deception
attack on such a network [164]. Note that sensors measure
various variables, such as the amplitude and phase of voltage in buses. These measurements are used to estimate
variables. A KF is applied to approximate state variables,
and an |2 detector is utilized to compute the difference
between sensor measurements and their projected values. If this difference is larger than a threshold, an attack
is detected. Moreover, a Euclidean detector is implemented to build a signal from estimated variables. It computes
observed data deviations from estimated information.
Comparisons with sensor measurements are made using

Estimator
Attacker

1
Sensor
4
5
6

Figure 11. A deception attack on an IEEE 9-bus

Signals

system [164].

4
2
0
-2
0

Input Signal
Estimated Value

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.4

0.5

0.6

0.7

0.4

0.5

0.6

0.7

χ 2 Detector

(a)
3
2
1
0
0

g(t)
Threshold
0.1

0.2

0.3

Euclidean
Detector

(b)
3
2
1
0
0

Euclidean Distance
Threshold
0.1

0.2

0.3
(c)

Figure 12. (a) Signals, (b) an | 2 detector, and (c) a

Euclidean detector during a deception attack [164].

IEEE SYSTEMS, MAN, & CYBERNETICS MAGAZINE Apri l 2021

a Euclidean distance to detect an attack. Figure 12 compares
the performance of the Euclidean detector and the |2
detector during a deception attack [164]. The figure shows
that the Euclidean detector identifies the deception attack
and that the |2 detector does not. However, the Euclidean
detector requires more computations to calculate the signal than the |2 detector does.
A secure hybrid dynamic SE is introduced in [165] to
detect deception attacks in power distribution systems. A
UIO [166] is developed to estimate initial state values, and
a dynamic attack model is obtained from the approximations. UIO and attack models are augmented, and a KF is
utilized to detect and identify deception attacks. Several
simulations are carried out on IEEE 14- and 57-bus power
systems, indicating that the root-mean-square error is
bounded to 0.29% and 0.34%, respectively. Furthermore,
several software-in-the-loop tests are performed, and the
results show the method's feasibility. Recently, there have
been reports of new application subareas in power systems, such as oscillation monitoring, economic dispatching, and microgrid control. These have been prone to
cyberattacks, as well [167]-[174].
Oscillation Monitoring and Detection
Oscillation detection is important in smart girds. Various
devices, such as PMUs, are installed in control centers to
monitor interconnected grids' oscillation damping. The
resulting oscillation damping ratios are often unknown
due to system complexity and the large number of measurements. Therefore, oscillation monitoring is a cyberattack target. By injecting false data into measurements,
estimated states become undetectable to monitoring systems and converge to incorrect values. This could result in
improper control strategies and lead to performance degradation and even blackouts [175], [176].
Khalid and Peng [176] develop an oscillation detection
method using a Bayesian-based approximated filter (BAF).
The idea is to design distributed BAFs for nodes to monitor oscillations in the presence of deception attacks. Test
results using manipulated and simulated PMU measurements on Oman and New Zealand grids indicate that the
method successfully extracts and detects grids' oscillation
parameters during deception attacks. A distributed estimation method via synchrophasors is developed in [177]
for power system oscillation modes. Local estimation
using a Prony algorithm is obtained for each control center. Local estimators exchange information with other
nodes to achieve global solutions based on the alternating
direction method of multipliers. Simulations on IEEE 145and 68-bus systems are conducted, and the scheme's performance is discussed with respect to security. A resilient
oscillation monitoring approach is developed in [178] for
grids. Various cyberattacks are investigated using PMU
data. Attacks often ruin grid oscillation damping ratio estimates. A principal component pursuit is utilized to recover
a low-rank matrix by solving a convex optimization

IEEE Systems, Man and Cybernetics Magazine - April 2021

Table of Contents for the Digital Edition of IEEE Systems, Man and Cybernetics Magazine - April 2021