Importance-driven denial-of-service attack strategy design against remote state estimation in multi-agent intelligent power systems

1. INTRODUCTION

The power system is the backbone of society, directly impacting people's lives and a nation's economy ^[1]. However, as digitalization advances, interconnected power systems present more opportunities for attackers ^[2]. Among the various types of attacks, denial of service (DoS) attacks and deception attacks are predominant ^[3]. Unlike deception attacks, DoS attacks aim to exhaust network resources, cause congestion, and disrupt user access by flooding the system with a large volume of meaningless packets ^[4]. Despite the apparent simplicity of DoS attacks, their destructive potential poses a significant threat to the stability of the power system, warranting heightened attention ^[5,6].

In the field of power system security literature, there are generally two main perspectives: the defender's perspective and the attacker's perspective. The defender's perspective focuses on developing various methods to counter increasingly severe cyber attacks, including techniques such as proportional-integral observers ^[7], consensus control ^[8], bandwidth-conscious event-based control ^[9], and collision-free multi-platoon control ^[10]. In contrast, the attacker's perspective predominantly explores more destructive attack strategies or seeks to enhance stealthiness. For instance, ^[11] optimizes attack scheduling to maximize destructive impact and proposes that continuous attacks can significantly amplify the potency of DoS attacks. Building upon this, ^[12] addresses attack scheduling under energy constraints. To counteract remote estimators, studies such as ^[13–15] respectively delve into stochastic DoS attack allocation, adaptive dynamic programming approach, and attack energy management. Furthermore, studies such as ^[16–18] explore the complexity of attack scheduling, encompassing aspects such as sensors, communication protocols, and cooperation strategies.

In this context, most DoS attacks are typically indiscriminate, meaning the attacker lacks specific knowledge about the target system and employs random or preset patterns of attack ^[11]. On the other hand, deception attacks are based on the attacker having an in-depth understanding of the system ^[19], including detailed knowledge of its structure, parameters, controller gains, and estimator gains. These two types of attackers represent two extremes: one is completely unaware of the system and relies on random or preset attack strategies, while the other is well-informed about the system and can leverage detailed information to execute precise attacks. Typically, certain information about power systems, such as topology and system output, is relatively easy for attackers to obtain, while other critical details, such as estimator gains, are harder to access. Therefore, from the attacker's perspective, devising an attack strategy based on readily accessible system information is crucial, which is a key motivation for this paper.

Although the aforementioned literature endeavors to increase the destructiveness of attacks, two critical issues deserve attention. Firstly, most current DoS attack strategies indiscriminately target the entire system in a predetermined sequence. However, in real-world power systems, certain agents hold greater significance, such as those serving airports, hospitals, financial centers, and control centers ^[20]. Designing a DoS attack strategy to inflict greater damage on specific agents is one of the primary motivations of this paper. Secondly, certain information in power systems is easily accessible to attackers, such as packet importance ^[21], system topology, and rated parameters. Effectively leveraging this information to amplify the destructiveness of DoS attacks serves as another motivation for this paper.

To tackle the challenges outlined above, this paper first proposes a method for calculating the sensitivity of target agent voltages. Secondly, we utilize these sensitivities to develop a novel importance-driven DoS (IDoS) attack strategy, which integrates agent voltage sensitivity with packet importance. To achieve these objectives, we pose two questions:

(1) How to design a method to calculate voltage sensitivity using limited information?

(2) How to design the IDoS attack strategy by integrating sensitivity information with packet importance?

The primary focus of this paper is to address these two inquiries. The key innovations of this paper are summarized as follows:

(1) A new method for computing voltage sensitivity is proposed. Unlike existing sensitivity calculation approaches ^[22–24], this method reduces reliance on system information, including current state values and their respective rates of change, thereby enabling attackers to implement attacks more practically.

(2) A novel IDoS attack strategy is designed, which integrates both voltage sensitivity and packet importance. Unlike most DoS attack strategies that target indiscriminately ^[11,12], our approach allocates more attack energy to important packets on sensitive agents, thus resulting in a greater potential for disruption on the target agent compared to other attack strategies.

The structure of the subsequent sections of this paper is as follows: Section 2 discusses the calculation of voltage sensitivity. Section 3 presents the design process of the IDoS attack strategy. Section 4 conducts simulations to assess the destructive capability of the attack strategy. Finally, Section 5 provides a summary of the study.

Notation Let the superscript $$ \Re $$ indicate the real part of a parameter, the superscript $$ \Im $$ denote the imaginary part, and the superscript $$ T $$ represent the transpose of a matrix. The notation $$ \|\cdot\| $$ denotes the Euclidean norm, $$ \Delta $$ signifies a change in a parameter, and $$ \exp(\cdot) $$ refers to the exponential function with base $$ e $$.

2. SYSTEM AND STATE ESTIMATION

In a multi-agent power system with $$ n $$ agents, the measured values obtained from devices such as phasor measurement units (PMUs) can be represented as $$ z(k)=[z_1(k)\, \cdots\, z_n(k)]^T $$, where $$ k $$ indicates the discrete time step, $$ z_i(k)=V_i(k) $$ and $$ V_i $$ is the voltage of the $$ i(i=1, \cdots, \, n) $$th agent. The system state can be denoted as $$ x(k)=[x_1(k)\, \cdots\, x_n(k)]^T $$, where $$ x_i(k)=[V_i(k)\ I_i(k)\ \theta_i(k)]^T $$, in which $$ I_i $$ signifies the injected current at the $$ i $$th agent and $$ \theta_i $$ is the phase angle. Therefore, the system model can be expressed as:

where $$ \epsilon(k) $$ denotes the measurement noise.

Various methods are proposed to estimate the system's state, with weighted least squares (WLS) being widely favored, defined as follows:

where $$ Y $$ denotes the covariance matrix of measurement errors.

After completing the state estimation process, the detection of faulty data is typically performed to identify potential measurement errors. Among various methods for detection, the maximum normalized residual test is the most commonly used. In this method, the residual is defined as:

The parameter $$ \gamma(k) $$ serves as a crucial metric for assessing estimation quality. A lower $$ \gamma(k) $$ value indicates superior estimation performance. Therefore, our study focuses on designing a DoS attack strategy from the attacker's perspective to maximize $$ \gamma(k) $$.

3. IDOS ATTACK STRATEGY DESIGN

In this section, a novel IDoS attack strategy from the attacker's perspective is introduced. This strategy leverages the voltage sensitivity of agents and the importance of packets. By allocating more attack energy to the critical data packets of highly sensitive agents, it maximizes the estimation error of the remote estimator. The design comprises two main steps: firstly, analyzing the voltage-current relationships of all agents in the system to determine the voltage sensitivity of the target agent to each agent; secondly, allocating more attack energy to important packets on highly sensitive agents, thereby inflicting more severe damage on the target agent.

3.2 IDoS attack strategy design

By leveraging the sensitivity of each agent obtained previously, this section proposes a novel IDoS attack that allocates more attack energy to the important packets transmitted by highly sensitive agents, potentially causing greater disruption.

An experienced attacker targets the network channels between PMUs and control centers [Figure 1]; we can make the following assumptions about the capabilities of the attacker:

Figure 1. IDoS attack scheme. IDos: Importance-driven denial of service.

Assumption 1 (1) The attacker can access the topology of the power system to calculate the voltage sensitivity of the $$ \xi $$th agent to each agent, forming a subset $$ \mathcal{S} =\{\varepsilon _{\xi_1}, \, \cdots, \, \varepsilon _{\xi_\eta} \} $$, where $$ \varepsilon _{\xi_1} > \, \cdots > \varepsilon _{\xi_\eta} $$ and $$ 1\leq\eta\leq n $$. It is evident that the $$ \xi $$th agent exhibits the highest sensitivity to the $$ \xi_1 $$th agent; (2) The attacker can eavesdrop on output packets and retain the latest non-attack packets.

Remark 1 In contrast to ^[27–29], the attack strategy proposed in this paper does not require attackers to obtain hard-to-access information, such as real-time state values or control gains. This enhances the feasibility of Assumption 1.

Based on the aforementioned assumptions, attackers operate according to the following attack mechanism:

(16) $$ \varsigma_i(k)=\begin{cases} 1,& \text{ if } \vartheta_i(k)>0;\\ 0,& \text{ otherwise}, \end{cases} $$

where

(17) $$ \vartheta_i(k) =\left \|z_i(k_\iota)-z_i(k) \right \|^2-\frac{\rho}{\varepsilon_{\xi_i}} \left \| z_i(k_\iota) \right \|^2,\ \varepsilon_{\xi_i}\in \mathcal{S}, $$

in which $$ \rho > 0 $$ represents the attack parameter, determined by the attacker to adjust the attack frequency. $$ z_i(k) $$ stands for the output data of the $$ i $$th agent, and $$ z_i(k_\iota) $$ denotes the most recently received non-attack packet.

When $$ \varsigma_i(k)=1 $$, it indicates that the attacker initiates an attack on the $$ i $$th agent at time $$ k $$. As a result, the packet $$ z_i(k) $$ is attacked, rendering it inaccessible to the estimator. Conversely, when $$ \varsigma_i(k)=0 $$, it signifies the absence of attacks, leading to the update of the most recent non-attack packet as $$ z_i(k_\iota)=z_i(k) $$.

Remark 2 The IDoS attack model Equation (16) distinctly illustrates the correlation between attack behavior and the output packets $$ z_i(k) $$, $$ z_i(k_\iota) $$, voltage sensitivity $$ \varepsilon_{\xi_i} $$, and attack parameter $$ \rho $$. However, the variables $$ z_i(k) $$, $$ z_i(k_\iota) $$, and $$ \varepsilon_{\xi_i} $$ are beyond the attacker's control. The attacker can adjust the attack frequency by manipulating the attack parameter $$ \rho $$. When faced with energy constraints, increasing the attack parameter $$ \rho $$ enables the attacker to reduce attack instances, thus lowering energy consumption. Fundamentally, the proposed IDoS attack model effectively integrates voltage sensitivity, packet importance, and energy constraints.

Remark 3 The proposed IDoS attack strategy is inspired by the event-triggered mechanism, where only significant data packets are transmitted. Similarly, the attack model Equation (16) targets only important data packets. A higher value of $$ \vartheta_i(k) $$ indicates that the data packet $$ z_i(k) $$ is more important, and attacking this packet can cause greater harm. Despite these similarities, there are notable differences between the two. The widely used event-triggered mechanism ^[30] is defined as:

$$ \begin{equation*} \bar{\vartheta} (\cdot) = (z(k_\iota) - z(k))^T \Psi (y(k_z) - y(k)) - \bar{\rho} z^T(k)\Psi z(k), \end{equation*} $$

where $$ \bar{\rho} $$ is the trigger threshold parameter, and $$ \Psi $$ is the weighting matrix to be designed. In contrast, the IDoS attack model Equation (16) only requires the attacker to determine the attack parameter $$ \rho $$.

Remark 4 In reality, power systems typically encompass numerous agents. When attack energy remains constant, evenly distributing it across each agent leads to energy dispersion, thereby diminishing the attack's impact. Hence, the attack strategy proposed in this paper concentrates the attack energy on the most sensitive subset of agents, denoted as $$ \mathcal{S} $$. The size of this subset, denoted by $$ \eta \ (1 < \eta < n) $$, is determined by the attacker based on their attack resources and technical proficiency. Specifically, when $$ \eta=1 $$, the attacker targets important packets solely on the most sensitive agent, whereas with $$ \eta=n $$, the attacker simultaneously targets important packets across all agents.

4. EXPERIMENTAL SIMULATION RESULTS

To validate the disruptive potential of the proposed IDoS attack strategy, this section conducts simulation experiments on the IEEE 39-Bus system [Figure 2]. Firstly, the experiment explores the relationship between the attack parameter $$ \rho $$ and the number of attacks, enabling attackers to set appropriate attack parameters based on the available attack energy. Secondly, the proposed IDoS attack strategy is compared with two traditional DoS attack strategies and DoS attack strategies that consider only partial importance information, thereby verifying the effectiveness of the proposed IDoS attack.

Figure 2. IEEE 39-Bus system.

Without loss of generality, Bus 16 is designated as the target agent. Using Equation (14), we obtain the voltage sensitivity of each agent as shown in Table 1. Setting $$ \eta=4 $$, $$ \epsilon(k)=3\exp (-k)\sin(k) $$, the four agents with the highest sensitivity are Bus 16, Bus 19, Bus 21, and Bus 17, i.e., $$ \mathcal{S} =\left\{0.4432, \, 0.1413, \, 0.1248, \, 0.1179 \right\} $$. To better reflect the destructiveness of the attack, we define the cumulative error as $$ J=\sum_{k}\gamma(k) $$.

According to the attack model Equation (16), the relationship between the attack parameter $$ \rho $$ and the number of attacks on each sensitive agent can be observed as depicted in Figure 3. It can be inferred that as $$ \rho $$ increases, the number of attacks on each sensitive agent decreases. Thus, attackers can adjust $$ \rho $$ based on the allowable attack times determined by attack energy. Additionally, agents with higher sensitivity are allocated more attack energy/times. For the sake of generality, in this experiment, $$ \rho $$ is set to 0.8. Within the sampling time period $$ [0, \, 40] $$, the attack instances and intervals for these four agents are illustrated in Figure 4. From this, the total number of attacks is calculated to be 95.

Figure 3. The relationship between $$ \rho $$ and attack times.

Figure 4. IDoS attack instants and attack intervals. IDoS: Importance-driven denial of service.

To ensure the effectiveness of the comparative experiments, we maintain an equal total number of attacks launched by different attack models within the same time frame. The attack models being compared are as follows:

(1) Model 1: The attacker launches IDoS attacks, with the timing of the attacks determined by the proposed model Equation (16).

(2) Model 2: The attacker employs IDoS attacks without considering voltage sensitivity, with the timing determined by the proposed model Equation (16), where $$ \varepsilon_{\xi_1}=\varepsilon_{\xi_2}=\varepsilon_{\xi_3}=\varepsilon_{\xi_4}=0.25 $$.

(3) Model 3: The attacker executes IDoS attacks without considering packet importance. The attack probabilities for Bus 16, Bus 19, Bus 21, and Bus 17 are set to 0.875, 0.625, 0.45, and 0.425, respectively.

(4) Model 4: The attacker initiates Bernoulli distributed DoS attacks ^[21], with the timing of attacks adhering to the Bernoulli parameter. The attack probability within the time range $$ [0, \, 40] $$ is set to 0.5938.

(5) Model 5: The attacker employs uniformly distributed DoS attacks ^[11], with the timing of attacks evenly distributed.

Due to the stochastic nature of the aforementioned attack models, this study conducts 500 experiments for each model. The average results from these experiments serve as the evaluation standard, ensuring that the conclusions drawn are statistically significant and reliable.

Under different attack models, the cumulative error of Bus 16 is illustrated in Figure 5. Upon observation, several trends become apparent: Firstly, the first three IDoS models noticeably outperform the others. This indicates that even without the full sophistication of considering both voltage sensitivity and packet importance, IDoS models are more effective at disrupting the system than traditional DoS attacks. Secondly, IDoS attacks that simultaneously consider voltage sensitivity and packet importance are markedly superior to those that neglect either voltage sensitivity or packet importance. This superior performance can be attributed to its comprehensive approach; this dual consideration allows the attacker to maximize the impact by focusing on the most critical points in the system, thereby causing more substantial disruptions. In contrast, Model 2, which uses IDoS attacks but disregards voltage sensitivity, and Model 3, which considers voltage sensitivity but neglects packet importance, both show lower cumulative errors compared to Model 1. This indicates that while considering voltage sensitivity or packet importance individually can improve attack effectiveness, combining both importance yields the most significant impact. Based on Figure 5, we can conclude that the proposed IDoS attacks comprehensively consider voltage sensitivity and packet importance, allocating more attack energy to important packets on sensitive agents, thus causing greater disruption.

Figure 5. Cumulative error under various attack models.

5. CONCLUSION

The paper has first introduced a new method for calculating voltage sensitivity, which only requires attackers to have access to the power system's topology and relevant parameters, thereby enhancing its feasibility. Secondly, a novel IDoS attack strategy has been proposed, which simultaneously considers the voltage sensitivity of the target agent to each agent and the importance of packets. This strategy allocates more attack energy to critical packets on sensitive agents. Finally, simulation results have validated that the proposed IDoS attack strategy is more destructive to the target agent compared to other DoS attack strategies.

It should be noted that traditional estimators are no longer effective in providing accurate estimates against the IDoS attack strategy proposed in this paper. Therefore, designing specialized estimators or controllers that can effectively address IDoS attacks will be a key focus of our future research. Additionally, for defenders, attack isolation is an effective method to prevent the spread of disruptions, and this will also be a major area of our future investigation.

DECLARATIONS