Matching Items (4)
Filtering by
- All Subjects: cyber-physical system
- Creators: Kosut, Oliver
- Member of: Theses and Dissertations
- Member of: Barrett, The Honors College Thesis/Creative Project Collection
- Resource Type: Text
Description
The large distributed electric power system is a hierarchical network involving the
transportation of power from the sources of power generation via an intermediate
densely connected transmission network to a large distribution network of end-users
at the lowest level of the hierarchy. At each level of the hierarchy (generation/ trans-
mission/ distribution), the system is managed and monitored with a combination of
(a) supervisory control and data acquisition (SCADA); and (b) energy management
systems (EMSs) that process the collected data and make control and actuation de-
cisions using the collected data. However, at all levels of the hierarchy, both SCADA
and EMSs are vulnerable to cyber attacks. Furthermore, given the criticality of the
electric power infrastructure, cyber attacks can have severe economic and social con-
sequences.
This thesis focuses on cyber attacks on SCADA and EMS at the transmission
level of the electric power system. The goal is to study the consequences of three
classes of cyber attacks that can change topology data. These classes include: (i)
unobservable state-preserving cyber attacks that only change the topology data; (ii)
unobservable state-and-topology cyber-physical attacks that change both states and
topology data to enable a coordinated physical and cyber attack; and (iii) topology-
targeted man-in-the-middle (MitM) communication attacks that alter topology data
shared during inter-EMS communication. Specically, attack class (i) and (ii) focus on
the unobservable attacks on single regional EMS while class (iii) focuses on the MitM
attacks on communication links between regional EMSs. For each class of attacks,
the theoretical attack model and the implementation of attacks are provided, and the
worst-case attack and its consequences are exhaustively studied. In particularly, for
class (ii), a two-stage optimization problem is introduced to study worst-case attacks
that can cause a physical line over
ow that is unobservable in the cyber layer. The long-term implication and the system anomalies are demonstrated via simulation.
For attack classes (i) and (ii), both mathematical and experimental analyses sug-
gest that these unobservable attacks can be limited or even detected with resiliency
mechanisms including load monitoring, anomalous re-dispatches checking, and his-
torical data comparison. For attack class (iii), countermeasures including anomalous
tie-line interchange verication, anomalous re-dispatch alarms, and external contin-
gency lists sharing are needed to thwart such attacks.
transportation of power from the sources of power generation via an intermediate
densely connected transmission network to a large distribution network of end-users
at the lowest level of the hierarchy. At each level of the hierarchy (generation/ trans-
mission/ distribution), the system is managed and monitored with a combination of
(a) supervisory control and data acquisition (SCADA); and (b) energy management
systems (EMSs) that process the collected data and make control and actuation de-
cisions using the collected data. However, at all levels of the hierarchy, both SCADA
and EMSs are vulnerable to cyber attacks. Furthermore, given the criticality of the
electric power infrastructure, cyber attacks can have severe economic and social con-
sequences.
This thesis focuses on cyber attacks on SCADA and EMS at the transmission
level of the electric power system. The goal is to study the consequences of three
classes of cyber attacks that can change topology data. These classes include: (i)
unobservable state-preserving cyber attacks that only change the topology data; (ii)
unobservable state-and-topology cyber-physical attacks that change both states and
topology data to enable a coordinated physical and cyber attack; and (iii) topology-
targeted man-in-the-middle (MitM) communication attacks that alter topology data
shared during inter-EMS communication. Specically, attack class (i) and (ii) focus on
the unobservable attacks on single regional EMS while class (iii) focuses on the MitM
attacks on communication links between regional EMSs. For each class of attacks,
the theoretical attack model and the implementation of attacks are provided, and the
worst-case attack and its consequences are exhaustively studied. In particularly, for
class (ii), a two-stage optimization problem is introduced to study worst-case attacks
that can cause a physical line over
ow that is unobservable in the cyber layer. The long-term implication and the system anomalies are demonstrated via simulation.
For attack classes (i) and (ii), both mathematical and experimental analyses sug-
gest that these unobservable attacks can be limited or even detected with resiliency
mechanisms including load monitoring, anomalous re-dispatches checking, and his-
torical data comparison. For attack class (iii), countermeasures including anomalous
tie-line interchange verication, anomalous re-dispatch alarms, and external contin-
gency lists sharing are needed to thwart such attacks.
ContributorsZhang, Jiazi (Author) / Sankar, Lalitha (Thesis advisor) / Hedman, Kory (Committee member) / Kosut, Oliver (Committee member) / Arizona State University (Publisher)
Created2015
Description
Our daily life is becoming more and more reliant on services provided by the infrastructures
power, gas , communication networks. Ensuring the security of these
infrastructures is of utmost importance. This task becomes ever more challenging as
the inter-dependence among these infrastructures grows and a security breach in one
infrastructure can spill over to the others. The implication is that the security practices/
analysis recommended for these infrastructures should be done in coordination.
This thesis, focusing on the power grid, explores strategies to secure the system that
look into the coupling of the power grid to the cyber infrastructure, used to manage
and control it, and to the gas grid, that supplies an increasing amount of reserves to
overcome contingencies.
The first part (Part I) of the thesis, including chapters 2 through 4, focuses on
the coupling of the power and the cyber infrastructure that is used for its control and
operations. The goal is to detect malicious attacks gaining information about the
operation of the power grid to later attack the system. In chapter 2, we propose a
hierarchical architecture that correlates the analysis of high resolution Micro-Phasor
Measurement Unit (microPMU) data and traffic analysis on the Supervisory Control
and Data Acquisition (SCADA) packets, to infer the security status of the grid and
detect the presence of possible intruders. An essential part of this architecture is
tied to the analysis on the microPMU data. In chapter 3 we establish a set of anomaly
detection rules on microPMU data that
flag "abnormal behavior". A placement strategy
of microPMU sensors is also proposed to maximize the sensitivity in detecting anomalies.
In chapter 4, we focus on developing rules that can localize the source of an events
using microPMU to further check whether a cyber attack is causing the anomaly, by
correlating SCADA traffic with the microPMU data analysis results. The thread that
unies the data analysis in this chapter is the fact that decision are made without fully estimating the state of the system; on the contrary, decisions are made using
a set of physical measurements that falls short by orders of magnitude to meet the
needs for observability. More specifically, in the first part of this chapter (sections 4.1-
4.2), using microPMU data in the substation, methodologies for online identification of
the source Thevenin parameters are presented. This methodology is used to identify
reconnaissance activity on the normally-open switches in the substation, initiated
by attackers to gauge its controllability over the cyber network. The applications
of this methodology in monitoring the voltage stability of the grid is also discussed.
In the second part of this chapter (sections 4.3-4.5), we investigate the localization
of faults. Since the number of PMU sensors available to carry out the inference
is insufficient to ensure observability, the problem can be viewed as that of under-sampling
a "graph signal"; the analysis leads to a PMU placement strategy that can
achieve the highest resolution in localizing the fault, for a given number of sensors.
In both cases, the results of the analysis are leveraged in the detection of cyber-physical
attacks, where microPMU data and relevant SCADA network traffic information
are compared to determine if a network breach has affected the integrity of the system
information and/or operations.
In second part of this thesis (Part II), the security analysis considers the adequacy
and reliability of schedules for the gas and power network. The motivation for
scheduling jointly supply in gas and power networks is motivated by the increasing
reliance of power grids on natural gas generators (and, indirectly, on gas pipelines)
as providing critical reserves. Chapter 5 focuses on unveiling the challenges and
providing solution to this problem.
power, gas , communication networks. Ensuring the security of these
infrastructures is of utmost importance. This task becomes ever more challenging as
the inter-dependence among these infrastructures grows and a security breach in one
infrastructure can spill over to the others. The implication is that the security practices/
analysis recommended for these infrastructures should be done in coordination.
This thesis, focusing on the power grid, explores strategies to secure the system that
look into the coupling of the power grid to the cyber infrastructure, used to manage
and control it, and to the gas grid, that supplies an increasing amount of reserves to
overcome contingencies.
The first part (Part I) of the thesis, including chapters 2 through 4, focuses on
the coupling of the power and the cyber infrastructure that is used for its control and
operations. The goal is to detect malicious attacks gaining information about the
operation of the power grid to later attack the system. In chapter 2, we propose a
hierarchical architecture that correlates the analysis of high resolution Micro-Phasor
Measurement Unit (microPMU) data and traffic analysis on the Supervisory Control
and Data Acquisition (SCADA) packets, to infer the security status of the grid and
detect the presence of possible intruders. An essential part of this architecture is
tied to the analysis on the microPMU data. In chapter 3 we establish a set of anomaly
detection rules on microPMU data that
flag "abnormal behavior". A placement strategy
of microPMU sensors is also proposed to maximize the sensitivity in detecting anomalies.
In chapter 4, we focus on developing rules that can localize the source of an events
using microPMU to further check whether a cyber attack is causing the anomaly, by
correlating SCADA traffic with the microPMU data analysis results. The thread that
unies the data analysis in this chapter is the fact that decision are made without fully estimating the state of the system; on the contrary, decisions are made using
a set of physical measurements that falls short by orders of magnitude to meet the
needs for observability. More specifically, in the first part of this chapter (sections 4.1-
4.2), using microPMU data in the substation, methodologies for online identification of
the source Thevenin parameters are presented. This methodology is used to identify
reconnaissance activity on the normally-open switches in the substation, initiated
by attackers to gauge its controllability over the cyber network. The applications
of this methodology in monitoring the voltage stability of the grid is also discussed.
In the second part of this chapter (sections 4.3-4.5), we investigate the localization
of faults. Since the number of PMU sensors available to carry out the inference
is insufficient to ensure observability, the problem can be viewed as that of under-sampling
a "graph signal"; the analysis leads to a PMU placement strategy that can
achieve the highest resolution in localizing the fault, for a given number of sensors.
In both cases, the results of the analysis are leveraged in the detection of cyber-physical
attacks, where microPMU data and relevant SCADA network traffic information
are compared to determine if a network breach has affected the integrity of the system
information and/or operations.
In second part of this thesis (Part II), the security analysis considers the adequacy
and reliability of schedules for the gas and power network. The motivation for
scheduling jointly supply in gas and power networks is motivated by the increasing
reliance of power grids on natural gas generators (and, indirectly, on gas pipelines)
as providing critical reserves. Chapter 5 focuses on unveiling the challenges and
providing solution to this problem.
ContributorsJamei, Mahdi (Author) / Scaglioe, Anna (Thesis advisor) / Ayyanar, Raja (Committee member) / Hedman, Kory W (Committee member) / Kosut, Oliver (Committee member) / Arizona State University (Publisher)
Created2018
Description
Multiple-channel detection is considered in the context of a sensor network where data can be exchanged directly between sensor nodes that share a common edge in the network graph. Optimal statistical tests used for signal source detection with multiple noisy sensors, such as the Generalized Coherence (GC) estimate, use pairwise measurements from every pair of sensors in the network and are thus only applicable when the network graph is completely connected, or when data are accumulated at a common fusion center. This thesis presents and exploits a new method that uses maximum-entropy techniques to estimate measurements between pairs of sensors that are not in direct communication, thereby enabling the use of the GC estimate in incompletely connected sensor networks. The research in this thesis culminates in a main conjecture supported by statistical tests regarding the topology of the incomplete network graphs.
ContributorsCrider, Lauren Nicole (Author) / Cochran, Douglas (Thesis director) / Renaut, Rosemary (Committee member) / Kosut, Oliver (Committee member) / Barrett, The Honors College (Contributor) / School of Mathematical and Statistical Sciences (Contributor)
Created2014-05
Description
Lossy compression is a form of compression that slightly degrades a signal in ways that are ideally not detectable to the human ear. This is opposite to lossless compression, in which the sample is not degraded at all. While lossless compression may seem like the best option, lossy compression, which is used in most audio and video, reduces transmission time and results in much smaller file sizes. However, this compression can affect quality if it goes too far. The more compression there is on a waveform, the more degradation there is, and once a file is lossy compressed, this process is not reversible. This project will observe the degradation of an audio signal after the application of Singular Value Decomposition compression, a lossy compression that eliminates singular values from a signal’s matrix.
ContributorsHirte, Amanda (Author) / Kosut, Oliver (Thesis director) / Bliss, Daniel (Committee member) / Electrical Engineering Program (Contributor, Contributor) / Barrett, The Honors College (Contributor)
Created2021-05