# A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs

^{*}

## Abstract

**:**

## 1. Introduction

- A DER-explicit distribution grid model accounting for dynamic attributes of inverter-based DERs.
- A high-fidelity DER communication layer model with communication latency to facilitate the precise execution of cyber layer attacks.
- A cyberattack risk quantification method based on an attack probability model that accounts for both cyber component vulnerability and criticality.

## 2. Proposed Risk Assessment Framework

#### 2.1. Cyberphysical System Modeling

#### 2.2. Threat Identification

#### 2.3. Impact Quantification

## 3. Cyberphysical System Modeling

#### 3.1. Control Layer

#### 3.1.1. Algorithm 1

#### 3.1.2. Algorithm 2

#### 3.2. Physical System Layer

#### 3.2.1. System Dynamic Model

#### 3.2.2. Steady-State Model

#### 3.3. Communication System Layer

#### 3.3.1. DER Communication Network Overview

#### 3.3.2. Cyber Component Model

#### 3.3.3. Communication Network Model

**F**(t). $\mathbf{P}\left(t\right)$ is determined by the following steps:

- Create a $1\times \mathcal{V}$ null vector representing all the nodes. In this example, the initial ${\mathbf{P}}_{1}^{1}\left(t\right)$ is a $1\times 8$ null vector, as there are two MIMO nodes.
- Trace the transmission paths from the “In-1” to “Out-1”. Then, replace the “In-1” starting node with 1, resulting in ${\mathbf{P}}_{1}^{1}\left(t\right)=\left[1\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\right]$.
- Next, replace the following arrival node with the corresponding path function $P\left(t\right)$. In this case, the next arrival node is node 3 through the “link-1” path, which corresponds to a function of ${F}_{3}^{1}\left(t\right)$. Thus, the path vector becomes ${\mathbf{P}}_{1}^{1}\left(t\right)=\left[1\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}{P}_{1}\left(t\right)\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\right]$, where ${P}_{1}\left(t\right)$ is defined through (11).
- Repeat step 3 until the end node is reached. ${\mathbf{P}}_{1}^{1}\left(t\right)=\left[1\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}{P}_{1}\left(t\right)\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}{P}_{3}\left(t\right)\phantom{\rule{4pt}{0ex}}0\phantom{\rule{4pt}{0ex}}0\right]$ in this example.

- Generate the initial ${\mathbf{S}}_{k}$ as a $2\times 2$ null matrix.
- Columns of ${\mathbf{S}}_{k}$ correspond to inputs. The first and second columns refer to “In-1” and “In-2”, respectively.
- Rows of ${\mathbf{S}}_{k}$ refer to the input starting nodes. The first and two rows outline node 1 and node 2, respectively.
- Replace the exact starting node for each input with 1. Hence, the ${\mathbf{S}}_{k}$ will become

## 4. Cyber Threat Identification

#### 4.1. Cyber Vulnerabilities in CPS

#### 4.2. Cyberattack Models

#### 4.2.1. Jamming Attack

#### 4.2.2. Replay Attack

#### 4.2.3. FDI Attack

## 5. Cyberattack Risk Quantification

#### 5.1. Cyberattack Probability Index ${I}^{p}$

#### 5.1.1. Likelihood of Successful Attacks ${P}^{a}$

- Assume that node i has K vulnerabilities. Let $exploitabilit{y}_{k}$ denote the exploitability score of the kth vulnerability, as defined in the standard vulnerability evaluation system (CVSS). The exploitable probability for the kth vulnerability ${P}_{k}^{exp}$ can be derived by the following equation [37]:$${P}_{k}^{exp}=\frac{exploitabilit{y}_{k}}{3.9}$$
- Let binary variable ${V}_{k}$ indicate whether the kth vulnerability is exploited. Thus, the attack condition, denoted as $\overrightarrow{V}$, can be formed as $[{V}_{1},\dots ,{V}_{k},\dots ,{V}_{K}]$. The likelihood of ith component being compromised under condition $\overrightarrow{V}$ can be expressed as,$$P\left(i|\overrightarrow{V}\right)=1-\prod _{1}^{K}(1-{P}_{k}^{exp}\ast {V}_{k}).$$
- Let $P\left(\overrightarrow{V}\right)$ denote the prior probability of condition $\overrightarrow{V}$. The probability of successful attacks ${P}_{i}^{a}$ is formulated as$${P}_{i}^{a}=\sum _{\left\{\overrightarrow{V}\right\}}P\left(i|\overrightarrow{V}\right)\ast P\left(\overrightarrow{V}\right).$$

#### 5.1.2. Attack Outcome Utility $U\left({O}^{a}\right)$

#### 5.2. Impact Degree

## 6. Case Study

#### 6.1. IEEE 13-Node Test Case

#### 6.1.1. Case 1: Modification of Setpoints in OPF Mode

#### 6.1.2. Case 2: FDI Attack on Local Controllers

#### 6.1.3. Case 3: Modification of Local Controller Parameters

#### 6.1.4. Case 4: Jamming Attack in Load-Sharing Mode

#### 6.2. IEEE 123-Node Test Case

## 7. Conclusions

## Author Contributions

## Funding

## Data Availability Statement

## Conflicts of Interest

## References

- Ratnam, K.S.; Palanisamy, K.; Yang, G. Future low-inertia power systems: Requirements, issues, and solutions—A review. Renew. Sustain. Energy Rev.
**2020**, 124, 109773. [Google Scholar] [CrossRef] - North American Electric Reliability Corporation. Distributed Energy Resources: Connection Modeling and Reliability Considerations; North American Electric Reliability Corporation: Atlanta, GA, USA, 2017. [Google Scholar]
- Ferreira, P.D.; Carvalho, P.M.; Ferreira, L.A.; Ilic, M.D. Distributed energy resources integration challenges in low-voltage networks: Voltage control limitations and risk of cascading. IEEE Trans. Sustain. Energy
**2012**, 4, 82–88. [Google Scholar] [CrossRef] - Kou, G.; Chen, L.; VanSant, P.; Velez-Cedeno, F.; Liu, Y. Fault characteristics of distributed solar generation. IEEE Trans. Power Deliv.
**2019**, 35, 1062–1064. [Google Scholar] [CrossRef] - Yang, Q.; Barria, J.A.; Green, T.C. Communication infrastructures for distributed control of power distribution networks. IEEE Trans. Ind. Inform.
**2011**, 7, 316–327. [Google Scholar] [CrossRef] - Upadhyay, D.; Sampalli, S. SCADA (Supervisory Control and Data Acquisition) systems: Vulnerability assessment and security recommendations. Comput. Secur.
**2020**, 89, 101666. [Google Scholar] [CrossRef] - Qi, J.; Hahn, A.; Lu, X.; Wang, J.; Liu, C.C. Cybersecurity for distributed energy resources and smart inverters. IET Cyber-Phys. Syst. Theory Appl.
**2016**, 1, 28–39. [Google Scholar] [CrossRef] - Rahman, A.; Gao, X.; Xie, J.; Alvarez-Fernandez, I.; Haggi, H.; Sun, W. Challenges and Opportunities in Cyber-Physical Security of Highly DER-Penetrated Power Systems. In Proceedings of the 2022 IEEE Power & Energy Society General Meeting (PESGM), Denver, CO, USA, 17–21 July 2022; pp. 1–5. [Google Scholar] [CrossRef]
- Ali, M.; Gao, X.; Rahman, A.; Hossain, M.M.; Sun, W. Emerging Coordinated Cyber-Physical-Systems Attacks and Adaptive Restoration Strategies. In Proceedings of the 2023 IEEE PES Grid Edge Technologies Conference & Exposition (Grid Edge), San Diego, CA, USA, 10–13 April 2023; pp. 1–5. [Google Scholar]
- Liu, X.; Shahidehpour, M.; Li, Z.; Liu, X.; Cao, Y.; Li, Z. Power System Risk Assessment in Cyber Attacks Considering the Role of Protection Systems. IEEE Trans. Smart Grid
**2017**, 8, 572–580. [Google Scholar] [CrossRef] - Semertzis, I.; Rajkumar, V.S.; Ştefanov, A.; Fransen, F.; Palensky, P. Quantitative Risk Assessment of Cyber Attacks on Cyber-Physical Systems using Attack Graphs. In Proceedings of the 2022 10th Workshop on Modelling and Simulation of Cyber-Physical Energy Systems (MSCPES), Milan, Italy, 3 May 2022; pp. 1–6. [Google Scholar] [CrossRef]
- He, X. Threat Assessment for Multistage Cyber Attacks in Smart Grid Communication Networks. Ph.D. Thesis, Universität Passau, Passau, Germany, 2017. [Google Scholar]
- Lyu, X.; Ding, Y.; Yang, S.H. Bayesian Network Based C2P Risk Assessment for Cyber-Physical Systems. IEEE Access
**2020**, 8, 88506–88517. [Google Scholar] [CrossRef] - Deng, S.; Zhang, J.; Wu, D.; He, Y.; Xie, X.; Wu, X. A Quantitative Risk Assessment Model for Distribution Cyber-Physical System Under Cyberattack. IEEE Trans. Ind. Inform.
**2023**, 19, 2899–2908. [Google Scholar] [CrossRef] - Liu, X.; Ospina, J.; Konstantinou, C. Deep Reinforcement Learning for Cybersecurity Assessment of Wind Integrated Power Systems. IEEE Access
**2020**, 8, 208378–208394. [Google Scholar] [CrossRef] - Lv, Z.; Han, Y.; Singh, A.K.; Manogaran, G.; Lv, H. Trustworthiness in Industrial IoT Systems Based on Artificial Intelligence. IEEE Trans. Ind. Inform.
**2021**, 17, 1496–1504. [Google Scholar] [CrossRef] - IEEE 1547-2018; IEEE standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces. IEEE: Piscataway, NJ, USA, 2018. [CrossRef]
- Xu, L.; Guo, Q.; He, G.; Sun, H. The impact of synchronous distributed control period on inverter-based cyber–physical microgrids stability with time delay. Appl. Energy
**2021**, 301, 117440. [Google Scholar] [CrossRef] - Mo, H.; Sansavini, G. Real-time coordination of distributed energy resources for frequency control in microgrids with unreliable communication. Int. J. Electr. Power Energy Syst.
**2018**, 96, 86–105. [Google Scholar] [CrossRef] - Xin, S.; Guo, Q.; Sun, H.; Chen, C.; Wang, J.; Zhang, B. Information-Energy Flow Computation and Cyber-Physical Sensitivity Analysis for Power Systems. IEEE J. Emerg. Sel. Top. Circuits Syst.
**2017**, 7, 329–341. [Google Scholar] [CrossRef] - Gao, X.; Nejad, R.R.; Sun, W. Decentralized Distribution System Restoration with Grid-Forming/Following Inverter-Based Resources. In Proceedings of the 2022 IEEE Power & Energy Society General Meeting, Denver, CO, USA, 17–21 July 2022; pp. 1–5. [Google Scholar] [CrossRef]
- Meng, W.; Wang, X.; Liu, S. Distributed Load Sharing of an Inverter-Based Microgrid with Reduced Communication. IEEE Trans. Smart Grid
**2018**, 9, 1354–1364. [Google Scholar] [CrossRef] - Ali, M.; Ali, M.H.; Gryazina, E.; Terzija, V. Calculating multiple loadability points in the power flow solution space. Int. J. Electr. Power Energy Syst.
**2023**, 148, 108915. [Google Scholar] [CrossRef] - Awal, M.A.; Yu, H.; Tu, H.; Lukic, S.M.; Husain, I. Hierarchical Control for Virtual Oscillator Based Grid-Connected and Islanded Microgrids. IEEE Trans. Power Electron.
**2020**, 35, 988–1001. [Google Scholar] [CrossRef] - Teng, J.H. A direct approach for distribution system load flow solutions. IEEE Trans. Power Deliv.
**2003**, 18, 882–887. [Google Scholar] [CrossRef] - Ali, M.; Dimitrovski, A.; Qu, Z.; Sun, W. A Voltage Inference Framework for Real-Time Observability in Active Distribution Grids. In Proceedings of the 2023 IEEE Power & Energy Society General Meeting (PESGM), Orlando, FL, USA, 16–20 July 2023; pp. 1–5. [Google Scholar]
- Roofegari Nejad, R.; Sun, W. Distributed Load Restoration in Unbalanced Active Distribution Systems. IEEE Trans. Smart Grid
**2019**, 10, 5759–5769. [Google Scholar] [CrossRef] - Johnson, J.T. PV Cybersecurity for Hawaii; Sandia National Lab.(SNL-NM): Albuquerque, NM, USA, 2019.
- Roy, A.; Pachuau, J.L.; Saha, A.K. An overview of queuing delay and various delay based algorithms in networks. Computing
**2021**, 103, 2361–2399. [Google Scholar] [CrossRef] - Ramaswamy, R.; Weng, N.; Wolf, T. Characterizing network processing delay. In Proceedings of the IEEE Global Telecommunications Conference, 2004. GLOBECOM ’04., Dallas, TX, USA, 29 November–3 December 2004; Volume 3, pp. 1629–1634. [Google Scholar] [CrossRef]
- Amirkhosro, V.; Tamimi, A.; King, A.B.; Majumder, S.; Srivastava, A.K. Cyber–physical vulnerability and resiliency analysis for DER integration: A review, challenges and research needs. Renew. Sustain. Energy Rev.
**2022**, 168, 112794. [Google Scholar] [CrossRef] - Hossain, M.M.; Gao, X.; Ali, M.; Rahman, A.; Sun, W. Coordinated Cyber Attacks in Distribution Grid with Distributed Energy Resources: Attacker Perspective. In Proceedings of the 2023 IEEE Kansas Power and Energy Conference (KPEC), Manhattan, KS, USA, 27–28 April 2023; pp. 1–4. [Google Scholar] [CrossRef]
- Chen, X.; Hu, S.; Li, Y.; Yue, D.; Dou, C.; Ding, L. Co-Estimation of State and FDI Attacks and Attack Compensation Control for Multi-Area Load Frequency Control Systems Under FDI and DoS Attacks. IEEE Trans. Smart Grid
**2022**, 13, 2357–2368. [Google Scholar] [CrossRef] - Liu, X.K.; Wen, C.; Xu, Q.; Wang, Y.W. Resilient Control and Analysis for DC Microgrid System Under DoS and Impulsive FDI Attacks. IEEE Trans. Smart Grid
**2021**, 12, 3742–3754. [Google Scholar] [CrossRef] - Liu, C.; Liang, H.; Chen, T. Network Parameter Coordinated False Data Injection Attacks against Power System AC State Estimation. IEEE Trans. Smart Grid
**2021**, 12, 1626–1639. [Google Scholar] [CrossRef] - Kotenko, I.; Chechulin, A. A Cyber Attack Modeling and Impact Assessment framework. In Proceedings of the 2013 5th International Conference on Cyber Conflict (CYCON 2013), Tallinn, Estonia, 4–7 June 2013; pp. 1–24. [Google Scholar]
- Common Vulnerability Scoring System; Forum of Incident Response and Security Teams. July 2022. Available online: https://www.first.org/cvss/ (accessed on 1 March 2024).
- Gao, X.; Chen, Z. Optimal Restoration Strategy to Enhance the Resilience of Transmission System under Windstorms. In Proceedings of the 2020 IEEE Texas Power and Energy Conference (TPEC), College Station, TX, USA, 6–7 February 2020; pp. 1–6. [Google Scholar] [CrossRef]

**Figure 9.**(

**Top**) (Case 2): FDI attack on local voltage measurement. (

**Bottom**) (Case 3): Modification of local controller parameters.

**Figure 10.**Case 4: Jamming attack on local controller with and without considering communication latency.

Nodes | Links |
---|---|

${v}_{2}=500,{\mu}_{2}^{p}=1\phantom{\rule{3.33333pt}{0ex}}\mathrm{k},{\mu}_{2}^{f}=5\phantom{\rule{3.33333pt}{0ex}}\mathrm{k}$ | ${Distance}_{1}=300$ km |

${v}_{3}=300,{\mu}_{3}^{p}=500,{\mu}_{3}^{f}=5\phantom{\rule{3.33333pt}{0ex}}\mathrm{k}$ | ${Distance}_{2}=200$ km |

${\mu}_{4}=1$ k | ${Distance}_{3}=10$ km |

${\mu}_{5}=2$ k | ${Distance}_{4}=10$ km |

${\mu}_{6}=2$ k | ${Distance}_{5}=15$ km |

Vul. No. | Vul. ID | Description | Exploitability Score | Component | Prior Prob. |
---|---|---|---|---|---|

1 | CVE-2021-22803 | Unrestricted Upload of File, could lead to remote code execution of malicious file. | 3.9 | control center | 0.01 |

2 | CVE-2020-7545 | Improper Access Control vulnerability that could allow for arbitrary code execution. | 1.2 | control center | 0.02 |

3 | CVE-2020-7530 | Improper Authorization vulnerability which allows improper access to executable code folders. | 2.8 | control center | 0.02 |

4 | CVE-2020-7532 | Deserialization of Untrusted Data vulnerability could allow arbitrary code execution. | 1.8 | control center | 0.01 |

5 | CVE-2022-24312 | Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file. | 3.9 | control center | 0.01 |

6 | CVE-2022-24320 | Improper Certificate Validation Vulnerability. | 2.2 | DER client1 | 0.02 |

7 | CVE-2021-22772 | Missing Authentication for Critical Function vulnerability that could cause unauthorized operation when authentication is bypassed. | 3.9 | DER client1,2 | 0.05, 0.1 |

8 | CVE-2020-28212 | Improper Restriction of Excessive Authentication Attempts could cause unauthorized command execution. | 3.9 | local controller | 0.1 |

9 | CVE-2020-28213 | Download of Code Without Integrity Check vulnerability could cause unauthorized command execution. | 2.8 | local controller | 0.2 |

Rank | Node | ${\mathit{P}}_{\mathit{i}}^{\mathit{a}}$ | ${\mathit{O}}_{\mathit{i}}^{\mathit{a}}$ | $\mathit{EU}\left({\mathit{O}}_{\mathit{i}}^{\mathit{a}}\right)$ | ${\mathit{I}}_{\mathit{i}}^{\mathit{p}}$ |
---|---|---|---|---|---|

1 | 6 | 0.23 | 0.0636 | 0.0146 | 1 |

2 | 5 | 0.23 | 0.0636 | 0.0146 | 1 |

3 | 2 | 0.061 | 0.102 | 0.0125 | 0.85 |

4 | 3 | 0.1 | 0.0636 | 0.0064 | 0.44 |

5 | 1 | 0.029 | 0.102 | 0.0059 | 0.4 |

6 | 4 | 0.23 | 0.041 | 0.0019 | 0.13 |

Rank | Node | ${\mathit{P}}_{\mathit{i}}^{\mathit{Lost}}$ (kW) | ${\mathit{D}}_{\mathit{i}}^{\mathit{im}}$ | ${\mathit{Risk}}_{\mathit{i}}$ |
---|---|---|---|---|

1 | 2 | 2037 | 8115.41 | 6898.10 |

2 | 1 | 2037 | 8115.41 | 3246.16 |

3 | 6 | 530 | 2111.52 | 2111.52 |

4 | 3 | 1172 | 4669.25 | 2054.47 |

5 | 5 | 298 | 1187.23 | 1187.23 |

6 | 4 | 748 | 2980.03 | 387.40 |

DER Location | Number of Units | Capacity per Unit (kW) |
---|---|---|

44 | 3 | 500 |

79 | 1 | 400 |

81 | 1 | 400 |

108 | 2 | 250 |

Rank | Node | ${\mathit{P}}_{\mathit{i}}^{\mathit{a}}$ | ${\mathit{O}}_{\mathit{i}}^{\mathit{a}}$ | ${\mathit{I}}_{\mathit{i}}^{\mathit{p}}$ | ${\mathit{D}}_{\mathit{i}}^{\mathit{im}}$ | ${\mathit{Risk}}_{\mathit{i}}$ |
---|---|---|---|---|---|---|

1 | 1 | 0.029 | 0.0706 | 0.1501 | 7928.16 | 1190.13 |

2 | 4 | 0.061 | 0.0769 | 0.3439 | 2290.8 | 787.88 |

3 | 11 | 0.23 | 0.0593 | 1 | 277.78 | 277.78 |

4 | 12 | 0.23 | 0.0593 | 1 | 277.78 | 277.78 |

5 | 5 | 0.0636 | 0.0593 | 0.2765 | 617.52 | 170.76 |

6 | 6 | 0.023 | 0.0228 | 0.0769 | 1494 | 114.88 |

7 | 7 | 0.023 | 0.0228 | 0.0769 | 1494 | 114.88 |

8 | 8 | 0.023 | 0.0228 | 0.0769 | 1494 | 114.88 |

9 | 2 | 0.0636 | 0.0226 | 0.0211 | 2848.56 | 60.04 |

10 | 9 | 0.23 | 0.0257 | 0.0867 | 478.08 | 41.44 |

11 | 10 | 0.23 | 0.0241 | 0.0813 | 478.08 | 38.86 |

12 | 3 | 0.0636 | 0.0257 | 0.024 | 478.08 | 11.46 |

Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. |

© 2024 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Gao, X.; Ali, M.; Sun, W.
A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs. *Energies* **2024**, *17*, 1587.
https://doi.org/10.3390/en17071587

**AMA Style**

Gao X, Ali M, Sun W.
A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs. *Energies*. 2024; 17(7):1587.
https://doi.org/10.3390/en17071587

**Chicago/Turabian Style**

Gao, Xue, Mazhar Ali, and Wei Sun.
2024. "A Risk Assessment Framework for Cyber-Physical Security in Distribution Grids with Grid-Edge DERs" *Energies* 17, no. 7: 1587.
https://doi.org/10.3390/en17071587