![Page 1: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/1.jpg)
Spoofing State Estimation
William Niemira
![Page 2: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/2.jpg)
Overview
• State Estimation• DC Estimator• Bad Data• Malicious Data• Examples• Mitigation Strategies
2
![Page 3: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/3.jpg)
State Estimation
• Finite transmission capacity
• Economic and security aspects must be managed– Contingency analysis– Pricing– Congestion
management
• Accurate state information needed
3
![Page 4: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/4.jpg)
State Estimation
• Networks are large– Thousands or tens of thousands of buses– Large geographical area
• Many measurements to reconcile– Different types– Redundant– Subject to error
4
![Page 5: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/5.jpg)
State Estimation
• State estimation uses measurement redundancy to improve accuracy
• Finds best fit for data
• Differences between measures and estimates can indicate errors
5
![Page 6: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/6.jpg)
DC Estimator
• Overdetermined system of linear equations
• Solved as weighted-least squares problem
• Assumes:– Lossless branches (neglects resistance
and shunt impedances)– Flat voltage profile (same magnitude at
each bus)• Reduces computational burden
6
![Page 7: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/7.jpg)
DC Estimator
• is the vector of n states• is the vector of m measurements• is the m x n Jacobian matrix• is an m vector of random errors
7
![Page 8: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/8.jpg)
DC Estimator
• Residual vector
• Estimated as where • Minimize:
• Where is a diagonal matrix of measurement weights
8
![Page 9: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/9.jpg)
DC Estimator
• Differentiate to obtain
• Where is the state estimate and is the state estimation gain matrix
• Bad data assumed if where is some tolerance
9
![Page 10: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/10.jpg)
1-Bus Example
PG = PGmeas
PL1 = PL1meas
– PL1 – PG = PL2meas
10
![Page 11: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/11.jpg)
1-Bus Example
For variances of 0.004, 0.001, and 0.001 for PG
meas , PL1meas ,
PL2meas respectively
11
![Page 12: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/12.jpg)
1-Bus Example
12
![Page 13: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/13.jpg)
3-Bus Example
– 50 θ2 – 100 θ3 = P1meas
150 θ2 – 100 θ3 = P2meas
– 100 θ2 + 200 θ3 = P3meas
– 100 θ3 = P13meas
13
![Page 14: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/14.jpg)
3-Bus Example
(−50 −100150 −100−100 2000 −100
)(θ 2θ 3)=(P1meas P2meas P3meas P13meas
)14
![Page 15: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/15.jpg)
3-Bus Example
H=(−50 −100150 −100−100 2000 −100
) ,𝑥=(θ2θ3) , 𝑧=(P1meas P2meas P3meas P13meas
)15
![Page 16: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/16.jpg)
Bad Data
• Bad data usually consists of isolated, random errors
• These types of errors tend to increase the residual
• Measurements with large residuals can be omitted to check for better fit
• Works well for non-interacting bad measurements
16
![Page 17: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/17.jpg)
1-Bus Example
Good Data Bad Data
17
![Page 18: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/18.jpg)
Malicious Data
• Malicious data (data manipulated by an adversary) need not be isolated or random
• Adversary may inject multiple coordinated measurement errors
• Errors could interact with each other or other measurements
• Could change without increasing 18
![Page 19: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/19.jpg)
Attack Formation
• Given: • Attacked measurement vector • Attack vector • Estimated states due to attack • Clever adversary chooses
19
![Page 20: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/20.jpg)
1-Bus Example
PG = PGmeas
PL1 = PL1meas
– PL1 – PG = PL2meas
20
![Page 21: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/21.jpg)
1-Bus Example
Unobservable attack vectors:
Any linear combination of
21
![Page 22: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/22.jpg)
1-Bus Example
Unattacked Attacked
22
![Page 23: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/23.jpg)
For Real?
• In practice, state estimators are more complicated than previous examples
• Assumed strong adversary:– Has access to topology information– Has some means to change
measurements• Why would someone do this?
– Simulate congestion—could affect markets
– Reduce awareness of system operator
23
![Page 24: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/24.jpg)
AC Estimator
• AC model accounts for some effects neglected in the DC model
• Attacks as generated earlier will affect residual
• Attack may not have effect intended by adversary
24
![Page 25: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/25.jpg)
AC Estimator
• is the vector of n states• is the vector of m measurements• is nonlinear vector function relating
measurements to states• is an m vector of random errors
25
![Page 26: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/26.jpg)
AC Estimator
• Solved using Gauss Newton method• Gain matrix: • is diagonal matrix of variances• Estimation procedure:
26
![Page 27: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/27.jpg)
AC Estimator
• DC approximation is pretty good
• Harder to detect attack than random error
• Relatively large attacks may escape detection
• Grid state affects quality of DC attack27
![Page 28: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/28.jpg)
Detection
• Focus on quantities neglected by DC model (VARs)
• VARs tend to be localized
• AttackLosses changeVAR flow and generation changes
28
![Page 29: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/29.jpg)
Detection
• Alternative approach is to estimate parameters simultaneously with states
• Augment state vector with known parameters
• Compare known values to parameter estimates to find bad data 29
![Page 30: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/30.jpg)
Detection
• Choose something known to the control center but not an attacker
• Example: TCUL xformer tap position, D-FACTS setting
• Attacks will perturb parameter estimates
30
![Page 31: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/31.jpg)
Conclusions
• State estimators, even nonlinear estimators, are vulnerable to malicious data
• Malicious data is different from conventional bad data
• Nonlinearity effects of the attack may be detectable
• Parameter estimation can verify data31
![Page 32: Spoofing State Estimation William Niemira. Overview State Estimation DC Estimator Bad Data Malicious Data Examples Mitigation Strategies 2](https://reader036.vdocuments.site/reader036/viewer/2022062511/5517833f5503460e6e8b5532/html5/thumbnails/32.jpg)
Questions?
Thank you!
32