CPMTD: Cyber-physical moving target defense for hardening the security of power system against false data injected attack. Issue 111 (December 2021)

• Record Type: Journal Article
• Authors: Hu, Yifan; Zhu, Peidong; Xun, Peng; Liu, Bo; Kang, Wenjie; Xiong, Yinqiao; Shi, Weiheng
• Is Part Of: Computers & security. Issue 111(2021)
• Publication Date: 2021-12
• Subjects: Cyber-physical system -- Moving target defense -- Attack prevetion and detection -- Bi-level framework -- False data injection attack; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102465
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Cyber-physical system (CPS) like smart grids deeply integrated with communication networks are often subjected to sophisticated cyber-attacks, such as false data injection attack (FDIA) with a strong capability of strategic reconnaissance required to learn the environment, where the static characteristics of the system enable an easier profiling of the critical infrastructure resources by the adversary. In this paper, we propose a cyber-physical moving target defense (CPMTD) technique that focuses on both attack prevention and detection to mitigate such static vulnerabilities and provide a combination of defense strategies for power system. For attack prevention, we design the Cyber-MTD strategy to mislead and disrupt attack preparation by randomizing the data acquisition with controlled change across multiple system dimensions based on the network programmability of protocol oblivious forwarding (POF). For attack detection, we design the Physical-MTD strategy to improve the detection probability of FDIA by periodically changing the measurement matrix of state estimation based on the D-FACTS devices' capability of perturbing the transmission line susceptance. Simulations on IEEE 14 bus and 57 bus systems demonstrate the effectiveness of CPMTD against FDIA with small overhead. The probability of cyber-attacks in two cases can be reduced by more than 90%; FDIA introduces little operation cost as most of them are detected. Network throughput barely changes and network latency increases by less than 9%.