Stochastic defense against complex grid attacks

Abstract: We describe defense mechanisms designed to detect sophisticated grid attacks involving both physical actions (including load modification) and sensor output alteration, with the latter performed in a sparse manner and also so as to take into account grid response mechanisms (secondary response). The attacks aim to be both undetectable even under a full AC power flow model, and to hide equipment overload. We demonstrate that such attacks, while perhaps difficult to implement, nevertheless are easily computed even on systems with a large number of installed sensors, and can, in a static setting, successfuly hide large line overloads. Furthermore an attacker that understands the ongoing stochastic nature of sensor signals can extend the attack so as to remain effective for a nontrivial time period. To counteract such "ideal" or "perfect" attacks, we demonstrate a set of data-driven stochastic techniques to thwart the attacker and detect that an attack has taken place.