Cyber Attack Detection Scheme for a Load Frequency Control System Based on Dual-Source Data of Compromised Variables

Abstract

Cyber attacks bring key challenges to the system reliability of load frequency control (LFC) systems. Attackers can compromise the measured data of critical variables of the LFC system, making the data received by the defender unreliable and resulting in system frequency fluctuation or even collapse. In this paper, to detect potential attacks on measured data, we propose a novel attack detection scheme using the dual-source data (DSD) of compromised variables. First, we study the characteristics of the compromised LFC system considering potentially vulnerable variables and different types of attack templates. Second, by designing a variable observer, the relationship between the known security variables and the variables which are at risk of being compromised in the LFC system is established. The features of the data obtained by the observer can reflect those of the true data. Third, a Siamese network (SN) is designed to quantify the distance between the characteristics of measured data and that of observed data. Finally, an attack detection scheme is designed by analyzing the similarity of the DSD. Simulation results verify the feasibility of the detection scheme studied in this paper.

1. Introduction

Power systems with high integration of information technologies are being challenged by increasing cyberhacking activities [1]. In December 2015, the Ukraine Electric Grid Hack caused almost 225,000 customers to lose power for at least 6 h [2]. During the incident, varieties of critical data of power systems were compromised by cyber attacks. As an essential component of the power system, the LFC system needs to utilize varieties of measured data to maintain the stability of system frequency. Sophisticated attackers can compromise the measured data by launching cyber attacks to force the load frequency controller to issue incorrect instructions, which can lead to unpredictable frequency fluctuation. Therefore, it is necessary to detect the compromised data as a first step to mitigate cyber attacks.

The two main types of cyber attacks against power systems are false data injection (FDI) attacks and denial of service (DoS) attacks [3]. In [4], Liu first studied false data injection attacks targeting static state estimation (SE). It is proved that the compromised data meeting certain rules can bypass bad data detection. It is difficult for defenders to judge whether the measured data are reliable. To protect power systems from FDI attacks, the defense strategies are studied from many aspects including impact of cyber attacks, detection schemes, and mitigation strategies. In [5], attack and defense mechanisms are discussed using the method of bad data detection. Detection method and mitigation strategy of cyber attacks on substation automation systems are studied in [6]. The impacts of cyber attacks on supervisory control and data acquisition (SCADA) systems are studied by considering different attack scenarios [7]. In [8], a dynamic state dynamics is introduced to achieve risk mitigation against FDI attacks. In [9], the isolation of FDI attacks for smart grids using state observer is studied. In [2], known-secured phasor measurement unit (PMU) measurement is used to detect malicious attacks on power grids. As for DoS attacks, the existing literature shows that the opening of communication channels can be used to achieve attacked targets [10,11,12]. DoS attacks can disrupt the data exchange in multi-area power systems and lead to packet losses directly. Compared with FDI attacks, DoS attacks can achieve the attacked target without maintaining concealment, which makes it important to study the mitigation strategies for DoS attacks. The strategies to suppress DoS attacks have been extensively studied. Adopting appropriate communication protocol and event-triggered control scheme can effectively mitigate the impacts of DoS attacks [13,14]. Compared to DoS attacks, FDI attacks could easily manipulate the normal actions of a control center by compromising the data of vulnerable variables.

Analysis of cyber attacks on a LFC system is different from that on other systems in power systems [15]. A LFC system, which depends on the dynamic evolution rather than general SE, is designed to maintain the active power balance of power system. As is discussed in [15], unlike static state estimation, which estimate the state of power systems once every five minutes based on the ISO/RTO standard, the control center of LFC system should generate command data once every five seconds. As a result, it is difficult for a detection scheme of cyber attacks on a LFC system to benefit from current SE-based attack detection schemes. Ref. [15] proposes FDI attack templates matching the features of load frequency control system and evaluates the attack impact from aspects in frequency fluctuation and financial settlement. In [16], the model of optimal FDI attacks on the sensors of a LFC system is proposed to guide the defense of sensor data. In [17], authors introduce a priori knowledge of FDI attacks for studying more targeted detection methods, by analyzing four attack strategies targeting frequency collapse. Considering the concealment of the FDI attack and the accuracy of the attack detection, an optimal defense strategy is studied using game theory model [18]. Ref. [3] proposes an event-triggering control strategy to mitigate the impacts of cyber attacks on a LFC. Ref. [19] proposes the resilient load frequency control considering cyber attacks and communication delay.

Detection methods of cyber attacks against LFC systems should focus on dynamic features in vulnerable variables. In current literature, designing observers and using machine learning algorithms are two important methods to extract the dynamic features of variables [20,21,22]. In [23], the disturbance of active power is tracked using a second-order sliding mode in an LFC system. In [24], the fault signals in the LFC system are observed using the sliding mode observer.

The existing methods for detecting FDI attacks on LFC systems have the following defects:

(1) The current data-driven methods are not sufficient to detect attacks in specific conditions. The features of historical operation data are exploited based on data in multiple operating conditions. Attackers can inject false data with the features of historical data in the LFC system. For example, in one operating condition, attackers can use historical data to generate attack signals that satisfy the features of the variables in other conditions.

(2) Due to the communication delay and noise, there exists a difference between the observed data and the true data. Defenders cannot set the reasonable threshold of the difference. Improper setting of threshold will lead to misjudgment.

Considering that the attacker is compromising the relationship between measured data and true data, we propose a detection scheme for FDI attacks on a load frequency control system based on dual-source data of compromised variables. Different from the methods of learning the features of historical data, we measure the relationship between observed data and measured data. The relationship between the two includes the difference caused by communication delay and noise.

The main contributions of the paper are three fold:

(1) The attack detection scheme using dual-source data of compromised variables in an LFC system is proposed. Dual-source data can be used as a basis for defenders to detect false data injection attacks.

(2) Based on known-secure variables in an LFC system, an observer of tie-line power is designed considering uncertainties parameters in the LFC system. With this observer, defenders can obtain dual-source data (the observed data and the measured data) to assess whether the system is compromised.

(3) Considering the communication delay and noise of the dual-source data in the process of transmission to the defense center, the Siamese network is used to quantify the similarity of the dual-source data.

The remainder of this paper is organized as follows: in Section 2, the dynamic modeling of a compromised load frequency control system is studied. In Section 3, we design an observer for detecting tie-line power considering uncertainties in an LFC system. The FDI attack detection for the LFC system is designed in Section 4. In Section 5, simulation and analysis are carried out. Finally, Section 6 states conclusions.

2. Modeling of Compromised LFC System and False Data Injection Attacks

2.1. Basics of a Compromised LFC System

The diagram of a typical multi-area LFC system is depicted in Figure 1. The system consists of n areas. The attacker randomly selects one area (Area i ) to launch cyber attacks. Other normal areas are represented by area ($j(j=1,\dots ,i-1,i+1,\dots ,n)$). The attack target is the remote terminal unit (RTU) of the compromised area. RTU is used to collect tie-line power data. Since RTU is compromised, tie-line data cannot be correctly transmitted to the control center, so that area control error (ACE) cannot be correctly calculated. Through the proportion integral differential (PID) controller, the wrong ACE signals produce the wrong control command. Based on the relationships between control command and active power (the relationships are represented by the transfer functions in Figure 1), incorrect control command could lead to power imbalance. Then, power imbalance leads to the fluctuation of system frequency, which endangers the stability of the power system.

The dynamic model of the compromised system is:

$$\begin{array}{cc}\hfill \dot{x_i}\left(t\right)=& (A_i+\Delta A_i\left(t\right))x_i\left(t\right)+(B_i+\Delta B_i\left(t\right))u_i\left(t\right)\hfill \\ \hfill & +E_{ij}\Delta f_j\left(t\right)+F_i\Delta P_i^d\hfill \\ \hfill y_i\left(t\right)=& C_i{x}_i\left(t\right)+G_i{\omega }_i\left(t\right)\hfill \end{array}$$

(1)

where

$$\begin{array}{cc}\hfill & x_i={[\Delta P_i^g\Delta P_i^m\Delta f_i\Delta P_i^t]}^T\hfill \end{array}$$

$$\begin{array}{cc}\hfill & y_i=\Delta p_i^f\hfill \end{array}$$

with

$$A_i=\left[\begin{array}{ccccc}-{\displaystyle \frac{1}{T_i^g}}& 0& -{\displaystyle \frac{1}{R_i{T}_i^g}}& 0& \\ {\displaystyle \frac{1}{T_i^t}}& -{\displaystyle \frac{1}{T_i^t}}& 0& 0& \\ 0& {\displaystyle \frac{1}{M_i}}& -{\displaystyle \frac{D_i}{M_i}}& -{\displaystyle \frac{1}{M_i}}& \\ 0& 0& 2\pi \sum _{j=1,j\ne i}^n{T}_{ij}& 0& \end{array}\right]$$

$$B_i=\left[\begin{array}{c}-{\displaystyle \frac{1}{T_i^g}}\\ 0\\ 0\\ 0\end{array}\right],E_{ij}=\left[\begin{array}{c}0\\ 0\\ 0\\ -2\pi \sum _{j=1,j\ne i}^n{T}_{ij}\end{array}\right],F_i=\left[\begin{array}{c}0\\ 0\\ -{\displaystyle \frac{1}{M_i}}\\ 0\end{array}\right]$$

$$C_i=\left[\begin{array}{c}00{\beta }_{i}0\end{array}\right]$$

where $\Delta P_i^g$ and $\Delta P_i^m$ represent the deviation of the governor valve position and the generator output power, respectively; ${\beta }_i$ represents the frequency bias coefficient; $\Delta f_i$ represents the deviation of frequency. $\Delta P_i^t$ and $\Delta P_i^d$ represent the deviation of the tie-line power and the load fluctuation, respectively; $D_i$, $R_i$, and $M_i$ represent the generator unit damping coefficient, the speed drop, and the inertia of the synchronous machine, respectively; $T_{ij}$ is the synchronizing coefficient between area i and area j; $T_i^t$ and $T_i^g$ represent the time constants of the turbine and the governor, respectively; $G_i$ is a constant known matrix representing the distribution matrix of the bounded measurement noise ${\omega }_i\left(t\right)$. Notice that the generating units are transformed into an equivalent unit in order to reduce the model complexity. A model fitting method can be used to transform the multi-unit into an equivalent unit. The details of the model fitting are given in [25] and omitted here due to space limitations. The time-varying uncertainties of $A_i$ and $B_i$ satisfy

$$\Delta A_i\left(t\right)=\mathsf{\Phi }\sigma \left(t\right){\Psi }_a$$

(2)

$$\Delta B_i\left(t\right)=\mathsf{\Phi }\sigma \left(t\right){\Psi }_b$$

(3)

$$\sigma {\left(t\right)}^T\sigma \left(t\right)\le I$$

(4)

where $\mathsf{\Phi }$, ${\Psi }_a$, and ${\Psi }_b$ are the distribution matrix of the variation vector $\sigma \left(t\right)$. In this paper, we only focus on the situations in which $(A_i+\Delta A_i\left(t\right))$ is asymptotically stable.

Based on the area control error (ACE), the commands of the Area i of the LFC system are generated using the following equation:

$$u_i=-K_{Pi}AC{E}_i-K_{Ii}\int AC{E}_i$$

(5)

$$AC{E}_i=\Delta p_i^f+\Delta P_i^{tm}$$

(6)

where $K_{Pi}$ and $K_{Ii}$ are the proportional and integral gains of the controller, respectively; $\Delta P_i^{tm}$ represents the measured data uploaded by the RTU of tie-line power; and $\Delta p_i^f$ represents the data of the equivalent active power deviation caused by $f_i$. Attackers can mislead the controller by compromising the input data of the ACE. Considering the fact that the compromised $\Delta p_i^f$ can be rapidly detected by cross-checking the data with other normal ones, we only focus on FDI attacks on $\Delta P_i^{tm}$ in this paper.

2.2. Attack Templates of FDI Attacks on LFC

In this subsection, we discuss different types of false data injection attack on an LFC system. The typical fixed FDI attacks can be categorized into two types: [17]:

• Exogenous attack:

  $$\Delta P_i^{tm}=\Delta P_i^t+D_p$$

  (7)

  where $D_p$ represents the value of the data injection added to the measurements of tie-line power.
• Scaling attack:

  $$\Delta P_i^{tm}=K_p\Delta P_i^t$$

  (8)

  where $K_p$ is the scaling attack parameter.

Due to the fixed parameters of typical FDI attacks, the features of compromised data can be exploited. Based on the classifier, defenders can distinguish the compromised data from the normal ones. In fact, sophisticated attackers can adjust injection parameters flexibly to achieve attack targets. In this paper, we further study flexible FDI attacks on $\Delta P_i^{tm}$, which can be written as:

$$\Delta P_i^{tm}=k_p\left(t\right)\Delta P_i^t+d_p\left(t\right)$$

(9)

where $k_p\left(t\right)$ and $d_p\left(t\right)$ are time-varying variables. By launching the proposed FDI attacks, the attacker can tamper the data of $\Delta P_i^{tm}$ in the current operating condition into the false data with characteristics of real data in other operating situations. Thus, the controller can be misled to issue control commands that are not applicable to the current operating situation. It is necessary to relate the true data of tie-line power to accessible known-secured variables under the current operating situation.

3. Design of an Observer for Detecting Tie-Line Power Considering Uncertainties

In this section, an observer is designed to detect tie-line power based on accessible known-secured variables. Since system frequency is a global variable, the frequency of each position in the area is the same. When the attackers compromise the frequency measurement device in one place, the defender can cross verify the frequency measurement value in other places. Therefore, we utilize the system frequency as a known-secured variable and establish the following observer:

$$\left\{\begin{array}{c}{\dot{z}}_i=W_i{z}_i+T_i{B}_i{u}_i+T_i{E}_{ij}\Delta f_j+Y_i{y}_i\hfill \\ {\widehat{x}}_i=z_i+N_i{y}_i\hfill \end{array}\right.$$

(10)

where z represents the state vector of the dynamic system (10); $\widehat{x_i}$ represents the observation of $x_i$; and $W_i$, $T_i$, $Y_i$ and $N_i$ are the gain matrices with appropriate dimensions.

Let $e=x_i-\widehat{x_i}$, and using the output equation in (10), we have

$$\begin{array}{cc}\hfill e& =x_i-{\widehat{x}}_i\hfill \\ \hfill & =x_i-z_i-N_i{C}_i{x}_i-N_i{G}_i{\omega }_i\hfill \\ \hfill & =(I_n-N_i{C}_i)x_i-z_i-N_i{G}_i{\omega }_i\hfill \end{array}$$

(11)

Using (1), (10), and (11), we can derive

$$\begin{array}{cc}\hfill \dot{e}=& (I_n-N_i{C}_i){\dot{x}}_i-{\dot{z}}_i-N_i{G}_i{\dot{\omega }}_i\hfill \\ \hfill =& (I_n-N_i{C}_i)(A_i{x}_i+B_i{u}_i+E_{ij}\Delta f_j+F_i\Delta P_i^d)+(I_n-N_i{C}_i)\left(\Delta A_i{x}_i+\Delta B_i{u}_i\right)\hfill \\ \hfill & -\left(W_i{z}_i+T_i{B}_i{u}_i+T_i{E}_{ij}\Delta f_j+(Y_{i1}+Y_{i2})y_i\right)-N_i{G}_i{\dot{\omega }}_i\hfill \\ \hfill =& (A_i-N_i{C}_i{A}_i)x_i-Y_{i1}{C}_i{x}_i-W_i{z}_i-Y_{i2}{y}_i+\left[(I_n-N_i{C}_i)B_i-T_i{B}_i\right]u_i\hfill \\ \hfill & +\left[(I_n-N_i{C}_i)E_{ij}-T_i{E}_{ij}\right]\Delta f_j+(I_n-N_i{C}_i)F_i\Delta P_i^d\hfill \\ \hfill & -Y_{i1}{G}_i{\omega }_i-N_i{G}_i{\dot{\omega }}_i+(I_n-N_i{C}_i)\left(\Delta A_i{x}_i+\Delta B_i{u}_i\right)\hfill \end{array}$$

(12)

where $Y_i=Y_{i1}+Y_{i2}$; $I_n$ is an n-dimensional identity matrix.

Considering that $x_i=e+{\widehat{x}}_i=e+z_i+N_i{y}_i$, (12) can be expressed as

$$\begin{array}{cc}\hfill \dot{e}=& (A_i-N_i{C}_i{A}_i-Y_{i1}{C}_i)e_{}+(A_i-N_i{C}_i{A}_i-Y_{i1}{C}_i-W_i)z_i\hfill \\ \hfill & +[(A_i-N_i{C}_i{A}_i-Y_{i1}{C}_i)N_i-Y_{i2}]y_i+[(I_n-N_i{C}_i)B_i-T_i{B}_i]u_i\hfill \\ \hfill & +[(I_n-N_i{C}_i)E_{ij}-T_i{E}_{ij}]\Delta f_j+(I_n-N_i{C}_i)F_i\Delta P_i^d\hfill \\ \hfill & -Y_{i1}{G}_i{\omega }_i-N_i{G}_i{\dot{\omega }}_i+(I_n-N_i{C}_i)\left(\Delta A_i{x}_i+\Delta B_i{u}_i\right)\hfill \end{array}$$

(13)

If the following relationships can be held:

$${\Xi }_i=(I_n-N_i{C}_i)$$

(14)

$$W_i=\left(I_n-N_i{C}_i\right)A_i-Y_{i1}{C}_i$$

(15)

$$(I_n-N_i{C}_i)F_i=0$$

(16)

$$(I_n-N_i{C}_i)=T_i$$

(17)

$$Y_{i2}=((I_n-N_i{C}_i)A_i-Y_{i1}{C}_i)N_i$$

(18)

we can derive the following observation error:

$$\begin{array}{cc}\hfill \dot{e}=& \left(\left(I_n-N_i{C}_i\right)A_i-Y_{i1}{C}_i\right)e+0·z_i+0·y_i+0·B_i{u}_i+0·E_{ij}\Delta f_j\hfill \\ \hfill & +0·\Delta P_i^d-Y_{i1}{G}_i{\omega }_i-N_i{G}_i{\dot{\omega }}_i+(I_n-N_i{C}_i)\left(\Delta A_i{x}_i+\Delta B_i{u}_i\right)\hfill \\ \hfill =& ({\Xi }_i{A}_i-Y_{i1}{C}_i)e-Y_{i1}{G}_i{\omega }_i-N{G}_i{\dot{\omega }}_i+{\Xi }_i\Delta A_{i}x+{\Xi }_i\Delta B_i{u}_i\hfill \end{array}$$

(19)

Based on the theory proposed in [26], the necessary and sufficient conditions for the existence of the observer are as follows: (1) rank ($C_i{F}_i$) = rank($F_i$). The special solution is $N_i^s=F_i{[{\left(C_i{F}_i\right)}^T\left(C_i{F}_i\right)]}^{-1}{\left(C_i{F}_i\right)}^T.$ (2) ($C_i,{\Xi }_i{A}_i$) is a detectable pair.

Theorem 1.

There exists a sub-optimal robust observer for the LFC system discussed in this paper when the following two conditions are satisfied:

(1) There exists $\gamma >0$ such that

$$\underset{\alpha \ne 0}{sup}\frac{\parallel e\parallel }{\parallel \alpha \parallel }<\gamma$$

(20)

where $\alpha ={[u_i^T{\omega }_i^T{\dot{\omega }}_i^T\Delta f_j\Delta P_i^d]}^T$.

(2) There exists a positive definite matrix P and Q, such that

$$\left[\begin{array}{ccccccc}{\Gamma }_{11}& 0& {\Gamma }_{13}& 0& 0& {\Gamma }_{16}& {\Gamma }_{17}\\ \ast & {\Gamma }_{22}& 0& {\Gamma }_{24}& {\Gamma }_{25}& 0& 0\\ \ast & \ast & {\Gamma }_{33}& 0& 0& 0& 0\\ \ast & \ast & \ast & {\Gamma }_{44}& 0& 0& 0\\ \ast & \ast & \ast & \ast & {\Gamma }_{55}& 0& 0\\ \ast & \ast & \ast & \ast & \ast & {\Gamma }_{66}& 0\\ \ast & \ast & \ast & \ast & \ast & \ast & {\Gamma }_{77}\end{array}\right]<0$$

(21)

where

$$\begin{array}{cc}\hfill {\Gamma }_{11}=& P{A}_i+A_i^{T}P+2{\delta }_a{\Psi }_a^T{\Psi }_a+{\delta }_a^{-1}P\mathsf{\Phi }{\mathsf{\Phi }}^{T}P\hfill \\ \hfill & +{\delta }_b^{-1}P\mathsf{\Phi }{\mathsf{\Phi }}^{T}P\hfill \end{array}$$

$$\begin{array}{cc}\hfill {\Gamma }_{22}=& Q({\Xi }_i{A}_i-Y_{i1}{C}_i)+{({\Xi }_i{A}_i-Y_{i1}{C}_i)}^{T}Q+I\hfill \\ \hfill & +{\delta }_a^{-1}Q\left({\Xi }_i\mathsf{\Phi }\right){\left({\Xi }_i\mathsf{\Phi }\right)}^{T}Q+{\delta }_b^{-1}Q\left({\Xi }_i\mathsf{\Phi }\right){\left({\Xi }_i\mathsf{\Phi }\right)}^{T}Q\hfill \end{array}$$

$${\Gamma }_{33}=-{\gamma }^{2}I+2{\delta }_b{\Psi }_b^T{\Psi }_b$$

$${\Gamma }_{44}={\Gamma }_{55}={\Gamma }_{66}={\Gamma }_{77}=-{\gamma }^{2}I$$

$${\Gamma }_{13}=P{B}_i,{\Gamma }_{16}=P{E}_{ij},{\Gamma }_{17}=P{F}_i$$

$${\Gamma }_{24}=Q{Y}_{i1}{G}_i,{\Gamma }_{25}=Q{N}_i{G}_i,{\delta }_a>0,{\delta }_b>0$$

Proof. 

Taking the following Lyapunov function:

$$V\left(t\right)=x_i^T\left(t\right)P{x}_i\left(t\right)+e^T\left(t\right)Qe\left(t\right)$$

(22)

Using (1)–(4), (19) and (22), we can derive

$$\begin{array}{cc}\hfill \dot{V}=& x_i^T(P{A}_i+A_i^{T}P)x_i+2x_i^{T}P{B}_i{u}_i\hfill \\ \hfill & +2x_i^{T}P{E}_{ij}\Delta f_j+2x_i^{T}P{F}_i\Delta P_i^d-2e^{T}Q{Y}_{i1}{G}_i{\omega }_i\hfill \\ \hfill & -2e^{T}Q{N}_i{G}_i{\dot{\omega }}_i+e^T(Q({\Xi }_i{A}_i-Y_{i1}{C}_i)\hfill \\ \hfill & +{({\Xi }_i{A}_i-Y_{i1}{C}_i)}^{T}Q)e+2x_i^{T}P\mathsf{\Phi }\sigma {\Psi }_a{u}_i\hfill \\ \hfill & +2x_i^{T}P\mathsf{\Phi }\sigma {\Psi }_b{u}_i+2e^{T}Q{\Xi }_i\mathsf{\Phi }\sigma {\Psi }_a{x}_i\hfill \\ \hfill & +2e^{T}Q{\Xi }_i\mathsf{\Phi }\sigma {\Psi }_b{u}_i\hfill \\ \hfill \le & x_i^T(P{A}_i+A_i^{T}P)x_i+2x_i^{T}P{B}_i{u}_i\hfill \\ \hfill & +2x_i^{T}P{E}_{ij}\Delta f_j+2x_i^{T}P{F}_i\Delta P_i^d-2e^{T}Q{Y}_{i1}{G}_i{\omega }_i\hfill \\ \hfill & -2e^{T}Q{N}_i{G}_i{\dot{\omega }}_i+e^T(Q({\Xi }_i{A}_i-Y_{i1}{C}_i)\hfill \\ \hfill & +{({\Xi }_i{A}_i-Y_{i1}{C}_i)}^{T}Q)e+{\delta }_a^{-1}{x}_i^{T}P\mathsf{\Phi }{\mathsf{\Phi }}^{T}P{x}_i\hfill \\ \hfill & +{\delta }_a^{-1}{x}_i^T{\Psi }_a^T{\Psi }_a{x}_i+{\delta }_b^{-1}{x}_i^{T}P\mathsf{\Phi }{\mathsf{\Phi }}^{T}P{x}_i\hfill \\ \hfill & +{\delta }_b^{-1}{u}_i^T{\Psi }_b^T{\Psi }_b{u}_i+{\delta }_a^{-1}{e}^{T}Q(\Xi \mathsf{\Phi }){(\Xi \mathsf{\Phi })}^{T}Qe\hfill \\ \hfill & +{\delta }_a^{-1}{x}_i^T{\Psi }_a^T{\Psi }_a{x}_i+{\delta }_b^{-1}{e}^{T}Q(\Xi \mathsf{\Phi }){(\Xi \mathsf{\Phi })}^{T}Qe\hfill \\ \hfill & +{\delta }_b^{-1}{u}_i^T{\Psi }_b^T{\Psi }_b{u}_i\hfill \end{array}$$

(23)

where ${\delta }_a$ and ${\delta }_b$ are positive scalars.

Letting $\beta ={\left[x_{i}e{\alpha }^T\right]}^T$, we can derive:

$$\dot{V}\le {\beta }^T\Gamma \beta +{\gamma }^2{\alpha }^T\alpha -e^{T}e$$

(24)

where

$$\Gamma =\left[\begin{array}{ccccccc}{\Gamma }_{11}& 0& {\Gamma }_{13}& 0& 0& {\Gamma }_{16}& {\Gamma }_{17}\\ \ast & {\Gamma }_{22}& 0& {\Gamma }_{24}& {\Gamma }_{25}& 0& 0\\ \ast & \ast & {\Gamma }_{33}& 0& 0& 0& 0\\ \ast & \ast & \ast & {\Gamma }_{44}& 0& 0& 0\\ \ast & \ast & \ast & \ast & {\Gamma }_{55}& 0& 0\\ \ast & \ast & \ast & \ast & \ast & {\Gamma }_{66}& 0\\ \ast & \ast & \ast & \ast & \ast & \ast & {\Gamma }_{77}\end{array}\right]$$

(25)

If the aforementioned two requirements are satisfied, the system satisfies the Lyapunov stability criteria. The proof is completed. □

Based on the proposed observer, we can derive the observation value $\Delta p_i^{to}$ of the tie-line power $\Delta P_i^t$. Considering uncertain communication delay and noise in the process of transmission to the defense center, there is deviation between the measured data and the observed data received by the defender, which can be written as

$$\begin{array}{cc}\hfill diff\left(t\right)=& \Delta P_i^{tm}\left(t\right)-\Delta P_i^{td}\left(t\right)\hfill \\ \hfill =& \Delta P_i^{tm}\left(t\right)-(\Delta P_i^{to}(t-\tau )+N_d(t-\tau ))\hfill \end{array}$$

(26)

where $diff\left(t\right)$ represents the deviation between the measured data and the observed data; $\Delta P_i^{td}\left(t\right)$ is the observed data received by defender; $\tau$ is the communication delay; and $N_d\left(t\right)$ is the communication noise. This deviation also exists when the system is not compromised. Defenders cannot judge if this deviation is caused by the observer or the FDI attacks. Therefore, the similarity between the observed and real data should be further considered before applying the observed data for attack detection. In the next section, the similarity is studied.

4. Siamese-Network-Based Attack Detection for FDI Attacks on LFC

Considering the communication delay and noise, the proposed attack detection scheme is realized by comparing the signal similarity between the observed data and the measured data. In this section, a Siamese network is adopted to extract features for the similarity between measured data and observed data.

4.1. Network Structure

The structure of the proposed Siamese network for attack detection is depicted in Figure 2.

The Siamese network consists of two symmetrical branches that share equal weights (EW). Sharing equal weights can effectively reduce the training parameters in the training process. The structure of each branch consists of four full connect (FC) layers and rectified linear units (ReLUs). The function of FC layers is to map the original data to the hidden layer feature space. The output produced by the FC layer is the hidden feature of the sample data. We use many neurons to fit the features of the input data. Generally, single-layer FC does not have the ability of nonlinear expression. Therefore, we increase the number of layers of FC to enhance its nonlinear expression ability. In each FC layer, the number of elements is equal to the dimension of sample data. The ReLUs, which can alleviate the over fitting problem of the Siamese network, are defined as

$$f\left(a\right)=max(0,a)$$

(27)

After that, the input data (measured data and observed data) are transformed into two sets of feature vectors. Then, the two sets of vectors are transmitted to the loss layer to quantify the distance.

We input the observed data and the true data into the Siamese network as the input pair. When it is a positive sample, the calculated distance of the input pair should be smaller than that of the negative input pair. Due to the equal weights and ReLUs, the features caused by communication delay and noise can be mitigated during the training process.

4.2. Cluster-Based Loss Function

The loss function in the loss layer is designed to calculate the distance between the features of the observed data and that of the measured data. The distance can be further output as positive label or negative label through binary constraints. The distance with a positive label represents the similarity of the positive pairs (observed data and normal data). The distance with negative label represents the similarity of the negative pairs (observed data and compromised data). The distance between observed data and normal data should be less than that between observed data and compromised data, which can be written as:

$$d(a^o,a^n)\le d(a^o,a^c)$$

(28)

where $a^o$ is the observed data; $a^n$ is the normal data; and $a^c$ is the compromised data. Therefore, differences lie in the positive pairs and the negative pairs should be fully exploited in the loss function.

Therefore, differences lie in the positive pairs (observed data and normal data) and the negative pairs (observed data and compromised data) should be fully exploited in the loss function. Notice that the observed data and normal data are usually highly correlated when the load disturbance occurs, which makes it possible to cluster the positive pairs. In this paper, we focus on the cluster of positive pairs when designing the loss function. The proposed cluster-based loss function aims to encourage the features in positive pairs to be close and push the ones in negative pairs far away. The cluster center of the positive data can be defined as:

$$C_c=\frac{1}{M}\sum _{m=1}^{M}f\left(a_m^n\right)$$

(29)

where M is the number of the normal samples; $f\left(a_m^n\right)$ is the vector output from the FC layers.

Considering that the parameters of the injection data are flexible, it is difficult for the input samples to cover the characteristics of all types of injection data. In the proposed cluster-based loss function, a concentric-circles model is used to improve the ability to detect the unknown type of injection data. Two margins between positive pairs and negative pairs are used: ${\xi }_{min}$ is used to increase the distance between different types of pairs, and ${\xi }_{max}$ is used to make positive pairs more compact. The loss function can be defined as:

$$L=\sum _{m=1}^M(L_1+L_2)$$

(30)

where

$$L_1=\frac{1}{2}max\{0,\parallel f\left(a_F^n\right)-C_c{\parallel }_2^2-\parallel f\left(a_m^c\right)-C_c{\parallel }_2^2+{\xi }_{max}\}$$

(31)

$$L_2=\frac{1}{2}max\{0,\parallel f\left(a_m^n\right)-C_c{\parallel }_2^2-{\xi }_{min}\}$$

(32)

where $f\left(a_F^n\right)$ represents the farthest normal data of tie-line power. It can be learned that $L_1$ is used to measure the distance of negative pairs and positive pairs. If $L_1\le 0$, the distance of negative pairs is far enough to positive pairs. $L_2$ is used to measure the distance of positive pairs and the cluster center. If $L_2\le 0$, the distance of positive pairs is close enough to the cluster center. When $L_1\le 0,L_2\le 0$, negative pairs can be effectively separated from positive pairs.

Intuitively, $L_1>0$ or $L_2>0$ means that the function (28) is not satisfied and a positive loss value is generated. Then, the following gradient equations are used to guide the training direction in the process of training. That is to say, these equations are used to guide $L_1,L_2$ from $(L_1>0or{L}_2>0)$ to $(L_1\le 0,L_2\le 0)$. The gradient of the positive pairs $G^n$ can be expressed as

$$G^n=\frac{\partial L_2}{\partial f\left(a_m^n\right)}=f\left(a_m^n\right)-C_c$$

(33)

The gradient of the positive pairs $G^c$ can be expressed as

$$G^c=\frac{\partial L_1}{\partial f\left(a_m^c\right)}=C_c-f\left(a_F^n\right)$$

(34)

The gradient of the positive pairs $G^F$ can be expressed as

$$G^F=\frac{\partial L_1}{\partial f\left(a_F^n\right)}=f\left(a_F^n\right)-C_c$$

(35)

4.3. Attack Detection Scheme for FDI Attacks on LFC

The procedures of the attack detection scheme are as follows:

• Step 1: Generate the training data set. Load the historical tie-line power data under different operating conditions as the normal data. Based on (7)–(9), the data set of compromised tie-line power data can be generated using the method proposed in Section 3.
• Step 2: Transfer the training data in the form of data pairs to the Siamese network for training.
• Step 3: Using the high dimensional features obtained by FC layers to calculate the similarity between observed data and measured data. Loss function is used to make positive pairs compact and negative pairs far away from the positive pairs.
• Step 4: Sample the incoming data pair, which could be compromised potentially or normal load disturbance. By checking the high dimensional features of the data pairs, the status of the RTU for tie-line power can be identified.

5. Simulations and Analysis

In this section, simulations are implemented to illustrate the feasibility of the proposed detection scheme on the LFC system. As is shown in Figure 3, an IEEE 39-bus 10-unit power system is used as the tested system. The data of the system can be found in [27,28]. The red block represents the compromised area (Area i).

Based on the Formulas (2)–(4), it is assumed that the uncertainties of the system studied in this simulation environment are as follows:

$$\Delta A_i\left(t\right)=\left[\begin{array}{cccc}-0.065& 0& -0.065& 0\\ 0.043& -0.043& 0& 0\\ 0& 0.012& -0.012& -0.012\\ 0& 0& 0.0025& 0\end{array}\right]·sin\left(t\right)$$

$$\Delta B_i\left(t\right)={\left[\begin{array}{c}-0.065000\end{array}\right]}^T·sin\left(t\right),$$

5.1. Performance of the Observer for the Compromised LFC System

Based on the method studied in Section 3 and the parameters of the system, the observer gains for the tie-line power of the compromised area i can be calculated as follows:

$$W_i=\left[\begin{array}{cccc}-6.6667& 0& 0.0031& 0\\ 3.2258& -3.2258& 0.0003& 0\\ 0& 0& -9.053& 0\\ 0& 0& 0.0001& 0\end{array}\right],N_i=\left[\begin{array}{c}0\\ 0\\ 1\\ 0\end{array}\right]$$

$$Y_i={\left[\begin{array}{c}-6.6635-0.00039.0530.1884\end{array}\right]}^T$$

In this case, we make $\tau =1$ s. The signal-to-noise ratio (SNR) of the white Gaussian noise is chosen as 30 dB. Systems compromised of different attack templates are simulated, and the simulation results are shown in Figure 4, Figure 5 and Figure 6.

It can be learned that the dynamic features of real data can be reflected by that of observed data when the system is compromised by the aforementioned types of FDI attacks. The defender can detect attacks based on the dynamic feature similarity between the observed data and the true data. Although the characteristics of the observation error are different when the system is under different attacks, the observation error tends to be small in the long-term range, which means that the observed data are closer to the true data in the case of a long sample time.

5.2. Performance of the Proposed Attack Detection Scheme

In this subsection, we evaluate the performance of the Siamese network used to detect FDI attacks. The batch size of the Siamese network is chosen as 20. Let ${\xi }_{max}=2$ and ${\xi }_{min}=1$. Training samples contain 900 historical normal sample data and 300 compromised data. As for the compromised data, we set the value templates of the exogeneous attacks from 0.01 p.u. to 5 p.u. and set the value templates of the scaling attacks from 0.01 to 5. Each sample contains 60 s of tie-line power data. In addition, 3000 observed sample data including 1500 samples of the aforementioned three types of FDI attack templates are generated as test samples.

To illustrate the advantages of the FDI attack detection scheme studied in this paper, we choose the following five methods for comparison: (1) The proposed attack detection scheme using a cluster-based loss function (Method-A); (2) the proposed attack detection scheme using triplet loss function (Method-B) [29]; (3) the detection method using multilayer perception (Method-C) [17]; (4) the detection method using clustering-particle swarm optimization (clustering-PSO) (Method-D) [30]; and (5) the ACE forecasting method (Method-E) [15].

True positive rate (TPR) and true negative rate (TNR) are utilized to evaluate the performance of these five methods:

$$TPR=\frac{TP}{TP+FP}$$

(36)

$$TNR=\frac{TN}{TN+FN}$$

(37)

where $TP$, $FP$, $TN$, and $FN$ are the correctly detected positive samples, incorrectly detected positive samples, correctly detected negative samples, and incorrectly detected negative samples, respectively.

The simulation results considering different types of FDI attacks are shown in Figure 7 and Figure 8.

From Figure 7 and Figure 8, it can be learned that the proposed attack detection scheme achieves higher $TP$ rate and $TN$ rate than the detection method using multilayer perception and that using clustering-PSO. In particular, when the system is compromised by flexible attacks, the proposed detection scheme has more prominent advantages than these two methods. This is because the proposed scheme is trained based on the relationship between observed data and true data. The detection method using multilayer perception and that using clustering-PSO are trained based on features of true data, which can be easily imitated by flexible attack. The lower $TP$ rate of the ACE-forecasting method stems from the prediction errors.

5.3. Reliability of the Proposed Attack Detection Scheme

In this subsection, we evaluate the reliability of the proposed attack detection scheme by considering four safe factors: safe SNR, safe delay, safe number of training samples, and safe margin difference. To quantify reasonable safe levels which could guarantee certain detection performance, we establish the relationship between the minimum of the safe factors and threshold for detection performance. $S_r$ is used to represent the threshold for detection performance, which can be expressed as:

$$S_r=min\{TP,TN\}$$

(38)

Safe SNR considering different $S_r$ and different attack templates are In

Table 1. Safe SNR considering different $S_r$ and different attack templates.

	${\mathit{S}}_{\mathit{r}}=80\%$	${\mathit{S}}_{\mathit{r}}=85\%$	${\mathit{S}}_{\mathit{r}}=90\%$
Exogenous attack	9.3 dB	10.9 dB	13.1 dB
Scaling attack	9.5 dB	11.2 dB	13.1 dB
Flexible attack	9.8 dB	11.2 dB	13.1 dB

. It can be learned that the safe SNR increases with the increase of $S_r$. The impact of attack type on safe SNR is less than that of $S_r$. When $S_r$ is at a high level, the safe SNR is basically the same. When $S_r$ is at a low level, the safe SNR under different attacks begin to differ.

Safe delay considering different $S_r$ and different attack templates are In

Table 2. Safe delay considering different $S_r$ and different attack templates.

	${\mathit{S}}_{\mathit{r}}=80\%$	${\mathit{S}}_{\mathit{r}}=85\%$	${\mathit{S}}_{\mathit{r}}=90\%$
Exogenous attack	6.7 s	5.1 s	3.2 s
Scaling attack	7.0 s	4.9 s	3.2 s
Flexible attack	6.9 s	5.0 s	3.1 s

. Different attack types perform almost the same under different $S_r$. This is because, when the time span of the data sample is long, the short time delay is difficult to change the main characteristics of the data.

A safe number of training samples considering different $S_r$ and different attack templates are in

Table 3. Safe number of training samples considering different $S_r$ and different attack templates.

	${\mathit{S}}_{\mathit{r}}=80\%$	${\mathit{S}}_{\mathit{r}}=85\%$	${\mathit{S}}_{\mathit{r}}=90\%$
Exogenous attack	45	55	70
Scaling attack	45	55	70
Flexible attack	60	65	75

. It can be seen that the proposed detection scheme does not require a high number of data samples considering the scale of historical data of power systems. Among them, the proposed flexible attack requires a little higher data size. This is because it is more diverse, and a small number of samples can not effectively cover all cases.

A safe margin difference considering different $S_r$ and different attack templates is in

Table 4. Safe margin difference considering different $S_r$ and different attack templates.

	${\mathit{S}}_{\mathit{r}}=80\%$	${\mathit{S}}_{\mathit{r}}=85\%$	${\mathit{S}}_{\mathit{r}}=90\%$
Exogenous attack	0.6	0.8	0.9
Scaling attack	0.6	0.8	0.9
Flexible attack	0.6	0.8	0.9

. As the margin difference increases, $S_r$ increases. The marginal benefit of the method of increasing $S_r$ by increasing the margin difference is reduced. This is because the test data outside the margin are limited. Different attack types perform almost the same under different $S_r$. This is because the probability of testing data outside the margin is almost the same for different attack types.

6. Conclusions

A novel detection scheme of cyber attacks on a load frequency control system is studied in this paper. We design an observer of the tie-line power based on known-secured variables to track the dynamic features of the tie-line power. The designed observer can achieve the observation tie-line power when the system is under different types of FDI attacks. The observed data and the measured data of tie-line power are combined into the input pairs of the Siamese network to achieve attack detection. The simulation results illustrate that the proposed attack detection scheme is feasible under mid or little SNRs.