Power system operation considering an increasingly complex cyber infrastructure may be one of the key factors of the next generation power systems. The effective operation of a power system in a massively deployed cyber network environment will be affected by cyber network reliability. Therefore, it is vital not only to understand the operation of a cyber network and its reliability, but also it is critical to integrate the interdependency of cyber and power systems into power system planning and operations. This requires a three-layer approach to reliability modeling and evaluation. The cyber and power layers are interconnected by the information layer. The objective of this paper is to define the three-layer model and report a generalized framework for combined reliability modeling.@en

As a critical infrastructure, the electric power grid is vulnerable with respect to malicious physical and cyber attacks. Indeed, the importance of physical and cyber security for smart grids has been highlighted by recent intrusion incidents worldwide. Various types of sensors, instrumentation, information and communications technology (ICT), computational methodologies, and security controls have been developed to enhance the physical and cyber security of the smart grid. In this paper, critical vulnerabilities of a smart grid that can be exploited for physical and cyber intrusions are discussed. A comprehensive survey is conducted on the state-of-the-art research to enhance the physical and cyber security in a smart grid environment. Furthermore, the interdependency of physical and cyber security is illustrated with an intrusion scenario. The emphasis is on the physical and cyber security of power substations. Computer simulation results for a case study are presented.@en

Smart grid is an important application area for artificial intelligence (AI) and computational intelligence (CI), as solutions to complex problems in power system engineering and electric energy markets depend on logic reasoning, heuristic search, perception, and the abilities to handle uncertainties. AI is concerned with decision‐making capabilities such as knowledge representation, search methods, inference techniques, heuristic reasoning, and machine learning. CI techniques include expert systems, fuzzy logic, genetic algorithms (GAs), and artificial neural networks (ANNs). CI can further involve adaptive mechanisms for intelligent behaviors in complex environments, such as the ability to adapt, generalize, abstract, discover, and associate. AI and CI have been applied to address the challenges that arise from the increasing complexity and highly nonlinear nature of electric power systems. AI and CI techniques provide effective solutions to the design of nonlinear, adaptive, and optimal controllers for generator excitation systems, High‐Voltage Direct Current (HVDC), and Flexible Alternating Current Transmission System (FACTS) devices.@en

Existing system restoration strategies are primarily based on operators’ experience with no specific decision support tools. Restoration of interconnected grids in Europe is decentralised; restoration planning is limited to within the area of control for each national transmission system operator (TSO). Although coordination of restorative actions between TSOs is encouraged, few agreements exist. This study proposes a decision support methodology for system operators and restoration planners for restoration of interconnected grids. Solutions to optimal and coordinated utilisation of tie lines (TLs) are proposed. The proposed tool facilitates collaboration between TSOs affected by wide area blackouts. The decision support tool allows to adaptively develop restoration strategies based on system conditions, available resources and operating constraints. Optimisation algorithms are proposed to determine the optimal utilisation of TLs and/or black-start (BS) units to crank non-BS units. Optimal power flow problems are formulated for utilisation of TLs. They offer solutions for neighbouring TSOs to determine the extent to which TLs can be used without violating constraints. The proposed decision support tool is tested with IEEE 39-bus system.@en

The Supervisory Control And Data Acquisition (SCADA) system is the primary infrastructure for on-line monitoring and control of power grids. SCADA systems have evolved from isolated structures into open and networked environments. The new communication systems for modern power grids present cyber security vulnerabilities. Cyber security studies for the SCADA systems can be conducted effectively on an integrated cyber-power environment. The Information and Communication Technologies (ICTs) supporting SCADA are coupled with the electric grids. Together, they form a cyber-physical system. Computer simulations on cyber attacks and impact analysis of the power grid help identify the vulnerable points of the SCADA system with a high impact on the grid’s operation. The power and cyber systems must be modeled and integrated in a co-simulation environment. Tools are required to study simultaneously the dynamics of the electric grid and its data delivery infrastructure. This chapter is a tutorial for the development of a co-simulation model that integrates the cyber and power systems. The coupling techniques for software simulators for cyber systems and physical power systems are reviewed. The existing power system simulation tools and communication network simulators are presented. An example of the real-time coupling technique for industrial grade simulation environments and SCADA software is provided. The chapter continues with a brief overview of power system models and their integration with the ICT model of SCADA for data exchange. The emphasis is on modeling of the information and communication system for power grids and the grid control hierarchy. Queuing theory is used for the ICT models. The integrated cyber-physical system model is validated with the IEEE 39-bus system.@en

On top of the power infrastructure reside information and communication technology (ICT) layers for monitoring and control of the grid. The cyber and power systems together form a complex structure, which is referred to as a cyber–physical system (CPS). If the power system's observability and controllability are compromised due to communication and cyber security problems, the grid can be exposed to catastrophic events. As a result, there is a great need to model the interactions between ICT and power grids. This paper proposes a new model and simulation platform for the supervisory control and data acquisition (SCADA) system of an integrated CPS. SCADA performance is assessed based on communication time delays. Methods to model cyber intrusions and assess the CPS security are proposed. The success rates for unauthorized access and control of power devices are computed. The impact on the grid is evaluated and the attack with the highest efficiency is identified. The proposed method is tested with the IEEE 39-bus system on a SCADA testbed. @en

Electric power grids have been identified as critical infrastructures. They are increasingly dependent on Information and Communication Technologies (ICTs) for the operation and control of physical facilities. It can be envisioned that on top of the power infrastructure reside ICT layers that are coupled with the electric grids. As the ICT connectivity increases, so does the potential for cyber intrusions. This paper describes the importance of cyber security for power systems. A testbed architecture provides an accurate and powerful tool for identification of cyber-physical system vulnerabilities, security enhancement, impact analysis, and mitigation of cyber attacks. Simulation scenarios of cyber intrusions and attacks on the power grid, using the testbed, are discussed. The impact analysis’ simulation results capture the dynamic behavior of IEEE 39-bus system as a response to cyber attacks which may evolve into a partial or complete blackout. The problem of fast restoration from blackout after cyber attacks is identified.@en

Cybersecurity issues have raised concerns as potential loopholes exist in the Supervisory Control And Data Acquisition (SCADA) system when the system architecture moved from a proprietary to an open system. As a result of the interdependency between the power grids and SCADA communication networks, it is important to further strengthen the defense of cyber networks against malicious intrusions. The focus of this research is to model and evaluate a novel cybersecurity protection scheme using network firewall technology operated at the application layer to enhance the information protection in SCADA networks. A quantitative analysis is performed based on the attack and defense simulations on the SCADA cybersecurity testbed available at UCD. The preliminary test results elucidate the effectiveness of the proposed scheme and demonstrate the feasibility of the proposed scheme for enhancing information security of the substations.@en

New technologies including microprocessor-based Intelligent Electronic Devices (IEDs) and standardized protocol and TCP/IP over wide area networks (WAN) are well-adopted in the substations. Remote access to IEDs or user interfaces in a substation for maintenance purposes is a common practice. However, there are potential cyber-physical system vulnerabilities in a substation, e.g., unsecured standard protocols, remote controllable IEDs, and unauthorized remote access to substation IEDs. In addition, some substation IEDs and user interfaces have a web server and hence it may provide a remote configuration change and control with default passwords. Even if firewalls and cryptography schemes are used for cyber security, weak security key management cryptography and mis-configured firewalls are still exposed to intruders. From IT point of view, cyber security issues are well known and new security technologies are available. However, security research on the integration of IT and physical power systems for critical infrastructures is still an emerging area. Intruders behaviors will generate logs across all substation-level networks, e.g., IEDs, firewalls and user interfaces. For instance, the steps of Stuxnet attack are based on: (1) intrusion attempts, (2) change of the file system, (3) change of target systems setting, and (4) change of target systems status. Therefore, anomaly detection is performed based on logs of intruders foot prints. Temporal anomaly can be determined from discrepancies between event logs from two different time periods. In the proposed anomaly index, a value of 0 implies no difference, whereas 1 indicates the maximal discrepancy [1]. In order to identify the impact of substation cyber intrusion to the power grid, cyber intrusion scenarios have been conducted on the substation IT network using a SCADA testbed at University College Dublin (UCD). The first intrusion scenario involves compromised substation gateway. A false signal is generated and - n open circuit breaker (CB) command is sent to substation CBs. The second scenario is to generate forged CB status at the gateway. As a result of this attack, control center operators will observe fake data about the CB status. However, the actual substation CBs status has not changed. The third scenario is to generate fabricated analogue values to a control center using a man-in-the-middle attack. Once an intruder successfully compromises the substation LAN, (s)he is able to monitor and capture all measured data which comes from power grids. If attackers send fabricated data to the control center and the data travel through the state estimation filter, control center operators will observe an operational emergency. As a result, the operators may take emergency control actions such as reducing the generation voltage or reactive power while the power system is actually in a normal condition. There is a possibility these (logical) actions based on fabricated data will drive the system into a sequence of cascading events, leading to a power outage. Mitigation actions are conducted on substation IT and power grid. For IT mitigation, intrusion detection system (IDS) which uses anomaly detection algorithm based on temporal event construction has been used in a substation network. An Optimal Power Flow (OPF) algorithm with an objective function that minimizes load shedding in the grid is used for power system mitigation. The proposed collaboration scheme between IDS and the firewall is able to disconnect intruders in the substation network. Emergency control actions are taken to mitigate the effects of cyber intrusions as an attempt to restore a system back to a normal condition.@en

A cyber-physical system is a large and complex infrastructure. Due to the increasing connectivity, the power and cyber systems become more interdependent. Models of the interactions are needed between the power devices and information and communication technology (ICT). A broad range of cyber attacks has become a serious concern. Cyber attacks must be simulated to analyze the consequences on the power grid. Thus, the cyber system must be modeled explicitly and integrated with the power grid model. This paper describes the development and simulation of a novel co-simulation framework that integrates both the cyber and power systems. The objective is to implement the ICT model for real-time interactions with both the power grid and transmission operator. Different industrial grade environments have been developed to simulate the cyber-power interactions. ICT events that may affect the stability of the grid, e.g., cyber attacks, are simulated at the cyber system layer, and their impact analysis is conducted at the power system layer. The proposed co-simulation framework is validated with the IEEE 39-bus system.@en

Smart grid heavily relies on Information and Communications Technology (ICT) to manage the energy usage. The concept of smart grid implies the use of “smart” devices, such as smart meters or Remote Terminal Units (RTUs), that require extensive information to optimize the power grid. As the communication network is based on TCP/IP and Ethernet technology, new cyber vulnerabilities are introduced that can be exploited by malicious attackers. Cyber security has become a serious concern due to various intrusion incidents. Cyber attacks can make a significant impact on the grid, which will involve not only steady-state but also dynamic behaviors. A cyber-power system approach has been established that explicitly models the interaction between ICT and the power system. New technologies are under development to enhance the ICT vulnerability assessment and evaluate the impact of cyber attacks on system operation. This paper presents the cyber security issues in a smart grid environment and cyber attack/mitigation scenarios using a testbed at University College Dublin (UCD).@en

The proposed testbed of the cyber‐power system consists of power system simulation, substation automation, and the SCADA system. Scenarios for substation cyber security intrusions and anomaly detection concepts have been proposed. An attack tree method can be used to identify vulnerable substations and intrusions through remote access points. Specific substation vulnerability scenarios have been tested. Temporal anomaly is determined by data and information acquired at different time points. This is a metric to determine the anomaly between two snapshots. In a distributed intrusion detection algorithm, distributed agents are trained with a large number of scenarios and intended for real‐time applications. In a distributed environment, if an anomaly is detected by one agent, it is able to distribute critical information to other agents in the network.@en

A power grid is a critical infrastructure that relies on supervisory control and data acquisition (SCADA) systems for monitoring, control, and operation. On top of the power infrastructure reside layers of information and communications technology (ICT) that are interconnected with electric grids. The cyber and power infrastructures together constitute a large, complex cyberphysical system. ICTs on the power grids have evolved from isolated structures into open and networked environments based on TCP/IP and Ethernet. The technology is known to be vulnerable with respect to cyberintrusions. As ICTs of the power infrastructure have evolved into highly connected network environments, the use of firewalls has become a widely adopted access control method against intruders. Firewalls do not guarantee cybersecurity, however. The misconfiguration of company firewalls has been reported. Even if the configuration of a firewall is correct, it is still vulnerable because firewalls are not able to detect insider attacks and connections from the trusted side. Hence, solutions based solely on firewalls can be inadequate.@en