Defending Mechanisms for Protecting Power Systems against Intelligent Attacks

Transcription

1 efendng Mechanm for Protectng Power Sytem agant Intellgent ttack Longfe We, mr Haan Moghada, dtya Sundararaan and rf I. Sarwat epartment of Electrcal and Computer Engneerng Florda Internatonal Unverty Mam, Florda and btract - The power ytem form the backbone of a modern ocety, and t ecurty of paramount mportance to naton economy. However, the power ytem vulnerable to ntellgent attack by attacker who have enough knowledge of how the power ytem operated, montored and controlled. Th paper propoe a game theoretc approach to explore and evaluate tratege for the defender to protect the power ytem agant uch ntellgent attack. Frt, a rk aement preented to quantfy the phycal mpact nflcted by attack. Baed upon the reult of the rk aement, th paper repreent the nteracton between the attacker and the defender by extendng the current zero-um game model to more generalzed game model for dvere aumpton concernng the attacker motvaton. The attacker and defender equlbrum tratege are attaned by olvng thee game model. In addton, a numercal llutraton demontrated to warrant the theoretcal outcome. Keyword: Power ytem ecurty, ntellgent attack, rk aement, game theory. I. INTROUCTION HE power ytem one of the crucal nfratructure that Tnfluence any naton economy and progre, and t ha alway been a hgh prorty target for phycal antagont attack. If the attacker ha enough experte n the workng behavor of the power ytem operaton, montorng and control, the attack could deny large part of the vctmzed country helplely acce to bulk ytem power for not ut week but even month. For ntance, the Calforna electrcal power ubtaton attack [] n prl 203 by undentfed gunmen dd not lead to power outage, but undercored the vulnerablty of the power ytem. Buldng upon the clafcaton of cyber-attack on the power ytem documented n [2], attack on power ytem can be clafed nto the Intellgent ttack and the Brute-Force ttack accordng to the attacker avalable reource ncludng manpower, technology, fund, etc. n ntellgent attacker, typcally a corporate adverary or a natonal opponent, ha hgh a kllet and experte on the power ytem operaton, montorng and control, and poee enough reource ncludng manpower, technology, and fund to take acton. Thu, h detroy target generally the vtal node or component of the ytem, and t could trgger a cataclymc phycal damage, whch ometme too expenve to repar. On the contrary, n Brute-Force ttack cenaro, the attacker uually not qute famlar wth the entre power ytem, or ha no ample reource to take an effectve attack acton. Owng to th, the phycal damage caued by a brute-force attacker wll not be the ame a that of an ntellgent one. Th paper am to nvetgate further on the Intellgent ttack due to t hgh level mpact over the Brute-Force ttack. Rk ement form the frt tep of an attack-defene problem. It defned a the proce of dentfyng the rk to power ytem and determnng the lkelhood of occurrence, the reultng mpact, and the addtonal afeguard that mtgate th mpact [3]. However, mot of the recent rk aement tandard uch a S/NZS ISO 3000:2009 [4] nclude general prncple and gudelne, but lttle about the mathematcal repreentaton of the probablty of a ucceful attack and the reultng phycal damage. Th paper propoe a mathematcal rk aement model that nvolve the mulaton of the unerved load due to a ucceful attack, and the computaton of the probablty of that ucceful attack conderng lmted avalablty of reource to both the attacker and the defender. Takng the calculated rk a an nput parameter, game theory provde an analytcal method to model the nteracton between the attacker and the defender, ntead of ut conderng the decon-makng proce of the defender. The two-player zero-um game model wa frt preented by Holmgren et al. [5] to compute Nah equlbrum tratege for the defender to protect the phycal nfratructure of the power ytem agant attack. In order to protect the power ytem communcaton network, a Nah equlbrum obtaned from the two-player zero-um tatc game model between an ntentonal attacker and a fuon-baed defender wa ntroduced and tuded by Chen et al. [6], the reult of whch were employed to evaluate the performance of defene mechanm. In thee paper, the attacker expected gan aumed a to be equal to the defender expected lo. However, n realty, wth dfferent aumpton about the nature of the attacker and h avalable reource, the attacker motvaton and gan can be much dfferent. Thu, th paper conder dfferent attacker /5/$ IEEE 2

2 motvaton, and preent a generalzed gen-um game model. The extng method and algorthm for fndng the Nah equlbrum of the propoed game model can be dvded nto two categore: () algorthm that determne all Nah equlbrum, uch a the Support Enumeraton algorthm [7] - [9]; (2) algorthm that fnd a ample Nah equlbrum, for ntance, the Lemke-Howon algorthm [], [2], Mxed- Integer Programmng [3] - [5]. The followng content of the paper are tructured a follow. Secton II propoe a rk aement technology and the generalzed two-player game model. Whle Secton III exemplfe the mulaton tudy of a numercal cae tudy, Secton IV draw the concluon of th paper. II. GME MOEL BETWEEN TTCKER N EFENER power ytem can be abtracted a a graph G: = ( V, E) a hown n Fg.. The vertex et V repreent N V = V node n the graph G, for example, generaton plant, tranformer, ubtaton devce, and cutomer. The edge et E contan N E = E edge correpondng to tranmon lne. Thu, the total number of element (vertce and edge) of the power ytem needed to be protected agant attack NS = NV + N. E Preventon, mtgaton, repone, recovery and learnng compre the dfferent phae n the protecton cheme of power ytem agant attack [6]. The cope of th paper lmted to the preventve acton undertaken by the ytem admntrator, takng nto conderaton h lmted upply of reource to execute h ntended acton that nclude manpower, technologe, fund, etc. Thee preventve acton can be defned a the reource allocaton on N S element of the power ytem to reduce the lkelhood of an attack or avod an attack. On the contrary, the attacker attend to detroy the power ytem through launchng an attack on a combnaton of element of the power ytem. The attacker target vared wth dfferent ze accordng to h avalable reource. brute-force attacker can only break one tranmon lne or ome ngnfcant element of the power ytem, whle an ntellgent one can dable everal prme element, whch lead to a huge unerved load for the cutomer of the ytem. The attacker and defender tratege about the lmted reource dtrbuton are ntroduced through mathematcal model n followng part.. ttacker Stratege ume that the power ytem compoed of N S element, and that the attacker ha lmted reource, denoted by S, whch contan manpower, technologe, fund, etc. Thu, the attacker ha a et of tratege, defned a of N element, and each trategy a, =,, N ndcate one way of allocatng h lmted reource on N S element to attack the power ytem: Fg.. Example of power ytem graph. a = {,...,,..., } (),,, N S NS, = S = (2) where 0 S,, =,..., N S, repreent the quantty of the reource that the attacker trategy a nvet on attackng the element of the power ytem. Th paper exhbt a conderaton of vewng the attacker choce a a mxed trategy but not a pure one. Hence, t can be defned a a probablty dtrbuton on the trategy et : T p = [Pr{ a = a},..., Pr{ a = a},...,pr{ a = a }] (3) N = N Pr{ a = a} = (4) where 0 Pr{ a = a }, =,..., N, denote the probablty that the attacker chooe the trategy a. B. efender Stratege The defender, ut lke the attacker, left wth a lmted upply of reource defned by S, to protect N S element of the power ytem agant attack. The defender trategy et contan N tratege, and each trategy d, =,, N condton one method to dtrbute h lmted reource for protectng N S element of the power ytem: d = {,...,,..., } (5),,, N S NS = S, (6) = where 0 S,, =,..., N S, tand for the amount of the reource that the defender trategy d nvet on protectng the element of the power ytem. Th paper regard the defender trategy a a mxed one too, defned by a probablty dtrbuton on : T p = [Pr{ d = d },...,Pr{ d = d },...,Pr{ d = d }] (7) N 3

3 N Pr{ d = d} = (8) = where 0 Pr{ d = d }, =,..., N, denote the probablty that the defender adopt the trategy d. C. ttacker and efender Reward In the fght between the attacker and the defender, both of them acheve reward. In order to quantfy ther reward, th paper propoe a rk aement technology that nclude: () the probablty of a ucceful attack, and (2) the reultng power ytem mpact etmated by load unerved a a conequence of a ucceful attack. The probablty of a ucceful attack on the element, =,..., NS of the power ytem, denoted by p = f(, ), depend on the reource dtrbuton tratege of both the attacker and defender. Th probablty ncreae wth an ncrement n the attacker reource nveted on the element, but nverely related to the defender reource nveted. Th paper adopt the probablty n [7] defned a follow: p = (9) c+ c2 + where c and c2 are potve contant and vared wth dfferent mportance of the element. If the attacker target of the trategy a a combnaton of element of the power ytem, denoted by T, and the defender chooe the trategy d, the probablty of a ucceful attack on all target element of the power ytem obtaned by: Pad, = p ( p) (0) T T Th paper etmate the phycal mpact after a ucceful attack of dablng all target element by the load unerved P lo for the cutomer of the power ytem. The power ytem ued a a model to run optmal load heddng mulaton [8] to determne the load unerved P lo under dfferent attack cenaro. Thu, the defender reward the negatve of the cot of the expected total load unerved due to the attack, a hown below: R ( ad, ) = EP { ( ad, )} = P P () lo a, d lo fferent from the defender, an attacker motvaton mght not alway be to maxmze the negatve conequence of the event. Intead, the obectve of the attack can be to trke a ymbolc demontraton, or to root a problem not too catatrophc but hazardou enough to acheve a pychologcal effect on the vctm, lke the pread of fear and anxety. Baed on the precedng dcuon, th paper adopt two type of the attacker-reward functon baed on the paper [2]: the frt the Wort Cae Reward defned by: R ( ad, ) = EP { lo ( ad, )} (2) whch denote the attacker obectve to make the mot of the expected total load unerved due to an attack trategy a and defene trategy d ; and the econd the Probablty- Baed Reward, defned a: R ( ad, ) = PE { {P lo ( ad, )} > P0 } (3) whch gnfe the attacker attemptng to maxmze the probablty that the load unerved P lo over a certan magntude P 0.. Game Model and Equlbrum Statege Baed upon the etablhment of the attacker and the defender tratege and reward, th paper formulate the nteracton between the attacker and the defender n the power ytem ecurty problem a a two-player game model Γ= : (, R,, R ), where = { a,..., a N } repreent the attacker trategy pace, = { d,..., d N } degnate the defender trategy pace, R = [ R ( a, d )] N N ymbolze the attacker reward functon correpondng to the attack trategy a and defenve trategy d, and R = [ R ( a, d )] N N denote the defender reward functon conformng to the attack trategy a and the defenve trategy d. Th propoton tructured upon the etablhment of the tratege dentfed prevouly for both the attacker and the defender. ume that both the attacker and the defender are unclear about each other tratege, and the defender trategy mplemented before the attacker acton. Thu, correpondng to attacker dfferent motvaton, th paper clafe the game model Γ nto two varete: ) Zero-Sum Game Model In th model, the attacker take the Wort-Cae Reward functon. Thu, R + R = E{ P ( a, d)} + E{ P ( a, d)} (4) lo The condton where the attacker attempt to maxmze the total expected damage whle the defender tre to mnmze the ame can be tranlated nto the followng optmzaton problem: lo max{mn{ EP { ( ad, )}}} (5) lo p p Thu, the optmal attack and defene tratege can be obtaned by olvng the optmzaton problem. 2) Gen-Sum Game Model Bearng n mnd the attacker probablty-baed reward functon, the game model between the attacker and the defender develop nto a fnte, two-player gen-um noncooperatve game, hortly known a a Bmatrx Game. The 4

4 Lemke-Howon algorthm [] epoued here to fnd a Nah equlbrum of the Bmatrx Game for the defender to afeguard the power ytem. Let p* and p * be the mxed tratege of the attacker and defender repectvely. Thu, the mxed trategy par ( p*, p * ) a Nah equlbrum of game Γ (R, R ) f and only f: N, p > 0 ( R p ) = max( R p ) (6) where * * * k k * * * k k N, p > 0 ( R p ) = max( R p ) (7) ( p ) denote the lkelhood of the attacker (defender) p * * to take a trategy ( ). Nah [0] proved that, n above mxed tratege, any game wth a fnte et of player and a fnte et of tratege ha a Nah equlbrum. Thu, the zero-um game model ha an unque Nah equlbrum, whle the gen-um game model ha at leat one Nah equlbrum. III. SIMULTION STUY The mulaton tudy dvded nto three tep. The frt tep nvolve the electon of the attacker and the defender reource dtrbuton tratege. To keep the mulaton tudy numercally mple, th paper defne only four attacker tratege and four defender tratege, but the propoed game model applcable to any fnte tratege tuaton. Secondly, buldng upon thee tratege, th paper mulate the phycal load unerved due to ucceful attack through the optmal load heddng technology on the power ytem, calculate the probablty of each ucceful attack, and quantfe the rk faced by the power ytem. The thrd and ultmate tep deal wth takng thee quantfed rk a nput nto the oluton algorthm n order to acqure optmal attack and defene tratege. mall cale power grd wth three generator and x tranmon lne ha been ntroduced, repreented by Fg. 2, ued a the tet model to run optmal load heddng mulaton that conclude the load unerved after ucceful attack. In addton, the coeffcent of the power ytem are gven n Table I.. Stratege of the ttacker and efender ue to the lmted phycal mpact nflcted by attack on one ngle element, th paper focue on a ere of attack tratege targetng at two element, a clearly hown n Table II whch alo lt the load unerved when the attack ucceed. ccordng to the clafcaton n Secton I, attack 3-6 are called a Intellgent ttack, whch have evere phycal mpact on the power ytem, whle attack and 2 are clafed nto Brute-Force ttack, whch hardly have mpact on the ytem. Th paper only conder four Intellgent ttack contanng attack 3 to 6. In th paper, defender and attacker reource, whch nclude manpower, technology, and fund, are meaured by unt. Fg. 2. Sx-bu ytem wth three generator and x tranmon lne. TBLE I. COEFFIECIENTS OF THE SIX-BUS TEST SYSTEM PRMETERS OF THE TEST SYSTEM VLUE Generator G Capacty (MW) 0~00 Generator G2 Capacty (MW) 0~50 Generator G3 Capacty (MW) Tranmon Lne Thermal Capacty Lmt(MW) TBLE II. LO UNSERVE UE TO TTCKS 0~50 00 TTCK NO. TTCK STRTEGY LO UNSERVE (MW) G and Lne 0 2 Lne 2 and Lne G3 and Lne Lne 5 and Lne G and G2 G2 and G ume that attacker ha 6 unt reource, and defender ha 9 unt reource. In order to enure that Nah Equlbrum ext, the dtrbuton of reource dcrete, and the mallet nvetment unt. ttack tratege are choen a follow: ttack trategy : 3 unt reource for detroyng G; 3 unt reource for damagng Lne 2. ttack trategy 2: 3 unt reource for detroyng Lne 5; 3 unt reource for damagng Lne 6. ttack trategy 3: 3 unt reource for detroyng G; 3 unt reource for damagng G2. ttack trategy 4: 3 unt reource for detroyng G; 3 unt reource for damagng G3. efene tratege can be elected n four way, predomnantly all-element-focued, generator-focued, and two other type of tranmon lne-focued. efene trategy : unt reource for defendng each of 9 element of the power ytem. efene trategy 2: 3 unt reource for defendng each of 3 generator of the power ytem. 5

5 efene trategy 3: 2 unt reource for defendng lne -3; unt reource for defendng lne 4-6. efene trategy 4: 2 unt reource for defendng lne 4-6; unt reource for defendng lne -2. B. Rk ement In the mulaton, the probablty of a ucceful attack on the tranmon lne, where =,..6, of the power ytem, gven by: p = + + where denote the reource that the attacker devoted to the lne, denote the reource that the defender nveted on the ame lne. However, the probablty of a ucceful attack on the generator, =,..3, of the power ytem, defned a: 2 p = where denote the reource captalzed by the attacker on the generator, and denote the reource deployed by the defender on the ame generator. Founded on the dcuon overhead, Table III provde the probablty of a ucceful attack under the varou nteracton between the attacker and the defender. Table IV preent the correpondng calculated rk that defned by the product of the probablty of a ucceful attack and the unerved load. C. Equlbrum Stratege The quantfed rk form a the nput parameter to th algorthm. Fg. 3(a) how the equlbrum mxed tratege of the zero-um game model for the cae when the attacker target aume a wort-cae cenaro whch maxmze the expected unerved load. Fg. 3(b) depct the equlbrum mxed tratege of the gen-um game model for the cae where the attacker obectve baed on probablty that am to maxmze the probablty of the expected unerved load beyond a threhold. For th example, the threhold ha been et to 0MW. Fg. 3 ndcate that the defender equlbrum trategy vare wth dfferent game model, and the defender mut adapt h tratege to the type of attack he want to focu on. For four dfferent threhold that are MW, 20MW, 40MW and 60MW, the Fg. 4(a)-(d) preent the equlbrum mxed tratege for the attacker and the defender for the cae of the attacker mxed probablty-baed target. Fg. 4 eentally draw a fne lne on the threhold that govern the attacker and the defender electon of the avalable tratege. TBLE III. PROBBILITY OF SUCCESSFUL TTCK STRTEGY EFENER % 8.00% 5.00% 22.50% % 56.25% 4.06% 6.25% % 5.76% 36.00% 36.00% % 5.76% 36.00% 36.00% ttacker TBLE IV. RISK SSESSMENT STRTEGY EFENER ttacker (a) (b) Fg. 3. ttacker and efender optmal tratege accrodng to dfferent game model. (a) (c) (d) Fg. 4. ttacker and efender optmal tratege coorepondng to dfferent threhold n the attacker probablty-baed target. (b) 6

6 IV. CONCLUSION Intellgent attack hoted by an attacker famlar wth the operaton, montorng and control of the power ytem are the maor focu of th paper. ucceful ntellgent attack would caue an enormou phycal damage to the power ytem. In order to quantfy the damage, a rk aement technology brefly explaned. Th technology dffer from the rk management tandard uch a S/NZS ISO 3000:2009 [4] n the manner that t employ mathematc method to quantfy the rk baed on the probablty of a ucceful attack and the expected unerved load. To effectvely analyze the nteracton between the attacker and the defender, two game model baed on the rk aement have been propoed. ample tet power grd ha been ued to llutrate the gnfcance of the propoed game theoretc framework whch can be ued to explore and evaluate the tratege to defend the power ytem agant ntellgent attack. The numercal example how that, conderng attacker wth dfferent purpoe, defender hould take correpondng defene tratege. CKNOWLEGMENT The preent tudy wa upported by the Natonal Scence Foundaton enttled Toward Secure Networked Cyber- Phycal Sytem: Theoretc Framework wth Bounded Ratonalty under Grant No REFERENCES [] R.. Serrano and E. Halper, Sophtcated but low-tech power grd attack baffle authorte, Lo ngele Tme, Feb [2] S. Sddharth, M. Govndarau and C. C. Lu, Rk naly of Coordnated Cyber ttack on Power Grd, Control and Optmzaton Method for Electrcal Smart Grd. Power Electronc and Power Sytem, vol. 3, pp , 202. [3] NIST, Gloary of Key Informaton Securty Term, Feb. 20. [4] M. Letch, ISO 3000:2009 The new nternatonal tandard on rk management, Rk nal., vol. 30, no. 6, pp , 200. [5]. J. Holmgren, E. Jenelu, and J. Wetn, Evaluatng Stratege for defendng electrcal power networkd agant antagontc attack, IEEE Tranacton on Power Sytem, vol. 22, no., Feb [6] P. -Y. Chen, S. M. Cheng, and K. -C. Chen, Smart ttack n Smart Grd Communcaton Network, IEEE Commun. Mag., vol. 50, no. 8, pp , 202. [7] R. B. Myeron, Game Theory: naly of Conflct, Harvard Unverty Pre, Cambrdge, M, 99. [8] Y. Shoham and K. Leyton-Brown, Multagent Sytem: lgorthmc, Game-Theoretc, and Logcal Foundaton, Cambrdge, U.K.: Cambrdge Unv. Pre, [9] B. von Stengel, Equlbrum computaton for two-player game n trategc and extenve form, lgorthmc Game Theory, Cambrdge Unverty Pre, pp , [0] J. F. Nah, Non-cooperatve game, nnal of Math, vol. 54, pp , 95. [] C. E. Lemke and J. T. Howon, Equlbrum pont of bmatrx game, Socety for Indutral and ppled Mathematc, vol. 2, no. 4, pp , 964. [2] V. ggarwal, On the generaton of all equlbrum pont for bmatrx game through the Lemke-Howon algorthm, Mathematcal Programmng, vol. 4, pp , 973. [3] N. Nan, T. Roughgarden, E. Tardo, and V.V. Vazran, lgorthmc game theory, Cambrge Unverty Pre, [4]. M. Colman, Game theory and t applcaton: n the ocal and bologcal cence, Pychology Pre, 203. [5] T. Sandholm,. Glpn, and V. Contzer, Mxed-ntegerprogrammng method for fndng nah equlbra, In Proceedng of the 20th Natonal Conference on rtfcal Intellgence, pp , Jul [6] C.-W. Ten, C.-C. Lu, and G. Manmaran, Vulnerablty aement of cyberecurty for SC ytem, IEEE Tran. Power Syt., vol. 23, no. 4, pp , Nov [7] Z. Jan, L. Sh, L. Yao, and B. Maoud, Electrcal Grd Vulnerablty ement under ttack-efene Scenaro Baed on Game Theroy, In Power and Energy Engneerng Conference (PPEEC), pp. -5, 203. [8]. Pnar, J. Meza, V. onde, and B. Leeutre, Optmzaton Stratege for the Vulnerablty naly of the Electrc Power Grd, n SIM J. Optm, vol. 20, no. 4, pp ,