IEEE Electrification - December 2020 - 103

Network Layer

Attack Mitigation

The attack detection mechanisms deployed in the network layer can be divided into pattern detection, anomaly
detection, and third-party detection. Pattern detection
monitors the communication network with a database
that stores the signatures of known attacks. The obvious
drawback is that it cannot detect new attacks. The anomaly detection method periodically compares the system
performance with a predefined model under normal conditions. The model can be a fixed standard model or a
well-trained, time-varying model. The third-party detection approach, such as authentication, watermarking,
encryption methods, and key management methods,
relies on an external message that can provide characterizations to the secure signals by a variety of protocols or
low-cost hardware. The data without the related characterizations are deemed as malicious attacks. However, the
cost of this approach is delay performance because it
requires encoding and decoding the external message
before and after data communication. The longer and
more complicated the message, the more secure the
authentication scheme is but the worse the delay performance. Therefore, there is a tradeoff between communication security and computational efficiency.

Attack mitigation of the MG plays a key role in securing
the system. It aims at maintaining stability and providing acceptable performance to the grids under malicious attacks, especially in some cases where it is not
possible to shut down a system (e.g., at hospitals and
large power plants).

Physical Layer
In the physical layer, the detection is mainly achieved by
well-designed controllers of the MG and converters. For such
detection schemes, all kinds of attacks can be treated as the
modification of operations and measurements, which is an
FDI attack. Generally speaking, the studies on attack detection can be classified into two categories: model-based and
data-based schemes. The model-based scheme, such as
state estimation, is observer based, and the statistical methods rely heavily on the system model. Thus, the appropriate
model-based detection scheme should have a high model
fidelity to handle the parameter uncertainties and unknown
disturbances. On the other hand, data-based approaches
rely on machine learning or statistical mechanism techniques to infer a model for the system under inspection
from both the historical data and online measured signals.
However, these methods usually face a heavy computational
burden to train a fully connected network.
Although remarkable progress has been made in
detecting attacks during the past decade, most of the
studies mainly focus on centralized architectures. These
approaches are becoming increasingly unpractical to
deal with attacks as a result of the complexity induced
by large-scale distributed MG systems. Therefore, distributed attack detection schemes should be further investigated in terms of different ways to deal with the
relationships among interconnected subsystems. Model
decomposition methods and disturbance decoupling
methods can be addressed to deal with distributed
attack detection problems for small- and large-scale MG
systems, respectively.

Network Layer
The principle of attack mitigation in the network layer is
to reduce the impact of the attack on the communication
links. Rate limiting is one approach that imposes a rate
limit on the packets, such that it can prevent DoS attacks.
Furthermore, the packets can be dropped if their source
addresses come from a blacklist. Another way to mitigate
the attack is to add more communication channels or
topologies. An attacker can delay, alter, drop, or inject new
packets in the communication link. Thus, once having
detected an attack on a specific channel, the system can
isolate the channel and move to another predefined channel, thus isolating the attack sources or machines.

Physical Layer
The essence of attack mitigation in the physical layer is
the discussion of different ways to recover the system
states and achieve secure control. In terms of a DoS attack
or an FDI attack, respectively, a variety of attack mitigation
strategies can be designed.
According to the impact of DoS attacks on the system,
they can be defined as either weak attack scenarios or
strong attack scenarios. Weak attack scenarios are relatively moderate, meaning that they are cases where only
additional time delays and packet losses are introduced
into the system. Thus, a simple secure control strategy can
be obtained by considering the network under attack as a
time delay system. In other cases, where the induced
packet loss has compromised some of the communication
links, model prediction or state prediction can be adopted
to compensate the data dropouts and thus lead to secure
control. Strong attack scenarios are situations where the
communication networks between controllers and plants
are almost completely congested. In such cases, secure
control can be obtained by considering the networks as
switching systems between normal conditions and
attacked conditions.
FDI attacks can generate more intense effects on the
system than DoS attacks, thus making it unreliable to
model the system as either a time delay system or a
switching system. To provide secure control, secure state
estimation, which aims to estimate the states from corrupted measurements, has attracted considerable attention. The secure state estimation problems can be
categorized into the attack space search method, the convex relaxation method, and the attack estimation method.
It is worth pointing out that the output signals are guaranteed to be reconstructible only if a particular upper bound

IEEE Elec trific ation Magazine / D EC EM BE R 2 0 2 0

103

IEEE Electrification - December 2020

Table of Contents for the Digital Edition of IEEE Electrification - December 2020