Variability in power systems:
stochastic defense against ideal grid attacks
Daniel Bienstock, Mauro Escobar, Apurv Shukla
Columbia University

Mopta 2018

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 2018

1 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and PMUs

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and PMUs
PMUs = “phasor measurement units,” relatively expensive but theway of the future

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and PMUs
PMUs = “phasor measurement units,” relatively expensive but theway of the future
Goal: very tight, near-real-time control of power systems

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and PMUs
PMUs = “phasor measurement units,” relatively expensive but theway of the future
Goal: very tight, near-real-time control of power systems
Must be able to learn real-time structure and stochastics

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40Variability in power systems
The next frontier: controlling short-term variability (seconds or less)
Goal: safety and controllability as much as economics, or more
Driven by smart loads, DERs, DPVs, solid state devices, batteries, etc... and PMUs
PMUs = “phasor measurement units,” relatively expensive but theway of the future
Goal: very tight, near-real-time control of power systems
Must be able to learn real-time structure and stochastics
Joint work: Columbia and LANL

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20182 / 40“Cyber-physical” attacks on power grids

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40“Cyber-physical” attacks on power grids
Fact or fiction?
1

An adversary carries out a physical alteration of a grid (example:
disconnecting a power line)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40“Cyber-physical” attacks on power grids
Fact or fiction?
1

An adversary carries out a physical alteration of a grid (example:
disconnecting a power line)2

This is coordinated with a modification of sensor signals – a hack

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40“Cyber-physical” attacks on power grids
Fact or fiction?
1

An adversary carries out a physical alteration of a grid (example:
disconnecting a power line)2

This is coordinated with a modification of sensor signals – a hack3

The goal is to disguise, or keep completely hidden, the nature of theattack and its likely consequences

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40“Cyber-physical” attacks on power grids
Fact or fiction?
1

An adversary carries out a physical alteration of a grid (example:
disconnecting a power line)2

This is coordinated with a modification of sensor signals – a hack3

The goal is to disguise, or keep completely hidden, the nature of theattack and its likely consequences

4Power industry: it will never happen(“we would know what happened”)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40“Cyber-physical” attacks on power grids
Fact or fiction?
1

An adversary carries out a physical alteration of a grid (example:
disconnecting a power line)2

This is coordinated with a modification of sensor signals – a hack3

The goal is to disguise, or keep completely hidden, the nature of theattack and its likely consequences

4Power industry: it will never happen(“we would know what happened”)

5

Really?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20183 / 40Control centers, RTUs, PMUs, state estimation

tie line= sensor

control
centerBienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20184 / 40Control centers, RTUs, PMUs
Control center performs a regulatory and economic role
Sensors report to control center
Control center issues commands to (in particular) smaller generators
Sensors: RTUs (old), PMUs (new – and more expensive)
RTUs report once every four seconds
PMUs reportI
I

30 to 100 times a second
PMUs report (AC) voltage and current (plus more ...)

Anecdotal: PMUs overwhelming human operators
But PMUs are the way of the future
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20185 / 40State estimation (very abridged)
A data-driven procedure to estimate relevant grid parameters
Even with PMUs, data can be “complex”
Statistical procedure: “state estimation” (at control center)
DC power flow equations:Bθ = P g − P d
B = susceptance matrix,θ = phase angles,P g , P d generation and load vectors

Sensors provide information that fit some of the θ, P d , (P g ?)parameters
State estimation: least squares procedure to estimate the rest, plus
more
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20186 / 40Some prior basic research on “cyberphysical” attacks
Intelligent procedures for enriching state estimation so as to detect
and reconstruct attacks
Unavoidable: a model for attacking behavior is essential
Liu Ning Reiter (2009), Kim Poor (2011),
Deka Baldick Vishwanath (2015)
Soltan Yannakakis Zussman (2015 - )Warning: watch out for those assumptions!
Attacks are static

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20187 / 40Some prior basic research on “cyberphysical” attacks
Intelligent procedures for enriching state estimation so as to detect
and reconstruct attacks
Unavoidable: a model for attacking behavior is essential
Liu Ning Reiter (2009), Kim Poor (2011),
Deka Baldick Vishwanath (2015)
Soltan Yannakakis Zussman (2015 - )Warning: watch out for those assumptions!
Attacks are static and defense is passive

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20187 / 40Today: load change, signal hacking – all AC
An attacker causes physical changes in the network:

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20188 / 40Today: load change, signal hacking – all AC
An attacker causes physical changes in the network:
In particular load changes (no generator changes)
Possibly also line disconnections

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20188 / 40Today: load change, signal hacking – all AC
An attacker causes physical changes in the network:
In particular load changes (no generator changes)
Possibly also line disconnections
Attacker also hacks the signal flow: the output of some sensors isalteredGoal of the attacker is twofold:1

Hide the location of the attack and even the fact that an attack
happened2

Cause line overloads that remain hidden

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20188 / 40Today: load change, signal hacking – all AC
An attacker causes physical changes in the network:
In particular load changes (no generator changes)
Possibly also line disconnections
Attacker also hacks the signal flow: the output of some sensors isalteredGoal of the attacker is twofold:1

Hide the location of the attack and even the fact that an attack
happened2

Cause line overloads that remain hidden

Attacker expects full PMU deplyoment. Everything is AC based.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 20188 / 40Basic AC model of a power line in steady state
k

m

Ykm

Line between buses (nodes) k and m.
Ykm : 2 × 2 (complex) admittance matrix (physics of the line)√
Vk = voltage at k = |Vk |e j θk , j = −1, similarly with Vm
Current-voltage relationship:
 
Ikm
Imk

= Ykm



Vk
Vm



Ikm , Imk = (complex) current injected into line at k (resp. m)∗
Skm = (complex) power injected into line at k = Vk Ikm
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 2018

9 / 40What happens when there is a generation/load mismatch
conductor
rotor

steam

statormagneticfieldωenergysourceBienstock, Escobar, Shukla (Columbia)

current, voltage

Variance Analysis

Mopta 201810 / 40

What happens when there is a generation/load mismatch
conductor
rotor

steam

statormagneticfieldωenergysourcecurrent, voltage

Frequency response:

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201810 / 40

What happens when there is a generation/load mismatch
conductor
rotor

steam

statormagneticfieldωenergysourcecurrent, voltage

Frequency response:
mismatch ∆P

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201810 / 40

What happens when there is a generation/load mismatch
conductor
rotor

steam

statormagneticfieldωenergysourcecurrent, voltage

Frequency response:
mismatch ∆P ⇒ frequency change ∆ω ≈ −c ∆P

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201810 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously
Primary response. (very quick) Inertia in generators contributes
electrical energy to the system

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously
Primary response. (very quick) Inertia in generators contributes
electrical energy to the system
Secondary response. (seconds) Suppose estimated generation
shortfall = ∆P. Then:

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously
Primary response. (very quick) Inertia in generators contributes
electrical energy to the system
Secondary response. (seconds) Suppose estimated generation
shortfall = ∆P. Then:
Generator g changes output by αg ∆P

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously
Primary response. (very quick) Inertia in generators contributes
electrical energy to the system
Secondary response. (seconds) Suppose estimated generation
shortfall = ∆P. Then:
Generator g changes output by αg ∆PPg αg = 1, α ≥ 0,

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

AGC, primary and secondary response (simplified!,abridged!)
Suppose generation vs loads balance spontaneously changes(i.e. a net imbalance)?
AC frequency changes proportionally (to first order)
near-instantaneously
Primary response. (very quick) Inertia in generators contributes
electrical energy to the system
Secondary response. (seconds) Suppose estimated generation
shortfall = ∆P. Then:
Generator g changes output by αg ∆PPg αg = 1, α ≥ 0, α > 0 for “participating” generators
Preset participation factors∆ω sensed by control center, which issues generator commands
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201811 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line
Attacker has been in the system long enough to learn the system(data-wise)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line
Attacker has been in the system long enough to learn the system(data-wise)
Attacker chooses, in advance, a non-generator, sparse set A of buses
to attack and in particular a line uv to overload

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line
Attacker has been in the system long enough to learn the system(data-wise)
Attacker chooses, in advance, a non-generator, sparse set A of buses
to attack and in particular a line uv to overload
In near real-time, the attacker learns the current loads, up to small
error

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line
Attacker has been in the system long enough to learn the system(data-wise)
Attacker chooses, in advance, a non-generator, sparse set A of buses
to attack and in particular a line uv to overload
In near real-time, the attacker learns the current loads, up to smallerror
In near real-time, the attacker solves computational problem that
diagrams the attack on A

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Ideal (“perfect”) static attack: setup
PMUs everywhere: at both ends of each line
Attacker has been in the system long enough to learn the system(data-wise)
Attacker chooses, in advance, a non-generator, sparse set A of buses
to attack and in particular a line uv to overload
In near real-time, the attacker learns the current loads, up to smallerror
In near real-time, the attacker solves computational problem that
diagrams the attack on A
This will specify the load changes and the signal distortion
Post-attack, attacker cannot recompute much and only relies on
adding “noise” to the computed distorted signals
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201812 / 40

Undetectable attack: The attacker’s perspective

attacked set

participating generator

boundary
generator

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201813 / 40

Undetectable attack: decisions for the attacker (abridged!)
For every bus in A, a “true” and “reported” complex voltage

attacked

I mk

k

Vk

I km

m

Vm

not attacked

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201814 / 40

Undetectable attack: decisions for the attacker (abridged!)
For every bus in A, a “true” and “reported” complex voltage

attacked

I mk

k

Vk

I km

m

Vm

not attacked

But:



Bienstock, Escobar, Shukla (Columbia)

Ikm
Imk



= Ykm



Vk
Vm



so Vk must be truthful

Variance Analysis

Mopta 201814 / 40

Undetectable attack: tasks for the attacker (abridged!)
For every bus in A, compute a “true” and “reported” complex voltage(magnitude and angle) VkT and VkR
True and reported voltages must agree on the boundary of A !
Compute true and reported currents for lines within A
Compute voltages and currents on all other lines (true and reported are
identical)
Compute two power flow solutions; each must satisfy AC power equations,load changes a variable
On responding generators: compute generation change consistent withsecondary response if loads are modified
Restriction to attacker: attacked zone does not include any generators.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201815 / 40

Undetectable attack: tasks for the attacker (abridged!)
For every bus in A, compute a “true” and “reported” complex voltage(magnitude and angle) VkT and VkR
True and reported voltages must agree on the boundary of A !
Compute true and reported currents for lines within A
Compute voltages and currents on all other lines (true and reported are
identical)
Compute two power flow solutions; each must satisfy AC power equations,load changes a variable
On responding generators: compute generation change consistent withsecondary response if loads are modified
Restriction to attacker: attacked zone does not include any generators.
Why?
Some additional lying

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201815 / 40

Undetectable static attack(load modification, no line tripping, abridged!)
Max

T 2

T 2

(puv ) + (quv )square norm of flow on uv

(1a)

s.t.
C

T

∀k ∈ AR∪ ∂A, Vk = Vk (truthful voltages outside attacked zone)
X
d,R
d,R
R
R
∀k ∈ A, −(Pk+ jQk ) =(pkm + jqkm ), (true power flow balance in attacked zone)

(1b)
(1c)

km∈δ(k)
d,T

− (Pk

d,T

T

T

P̂k − P̂k + j(Q̂k − Q̂k ) =

X

+ jQk

)=

X

(pkm + jqkm ), (reported power flow balance in attacked zone)(1d)km∈δ(k)gC∀k ∈ A \R :

g

d

g

T

T

(pkm + jqkm ) (LHS is data, not variables)(1e)km∈δ(k)ggdg

Pk − P̂k + j(Qk − Q̂k ) =∀k ∈ R :

X

T

T

g

g

(pkm + jqkm ) (Pk , Qk are variables)(1f)km∈δ(k)g

g

Pk − P̂k = αk ∆(AGC response) ∆ is a variable,(1g)

reported data: operational limits on all buses, generators and lines
T

T

T

T

T

(1h)

T

all pkm , qkm related to |Vk |, |Vm |, θk , θm through AC power flow laws

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis(1i)

Mopta 201816 / 40

Undetectable static attack(load modification, no line tripping, abridged!)
Max

T 2

T 2

(puv ) + (quv )square norm of flow on uv

(1a)

s.t.
C

T

∀k ∈ AR∪ ∂A, Vk = Vk (truthful voltages outside attacked zone)
X
d,R
d,R
R
R
∀k ∈ A, −(Pk+ jQk ) =(pkm + jqkm ), (true power flow balance in attacked zone)

(1b)
(1c)

km∈δ(k)
d,T

− (Pk

d,T

T

T

P̂k − P̂k + j(Q̂k − Q̂k ) =

X

+ jQk

)=

X

(pkm + jqkm ), (reported power flow balance in attacked zone)(1d)km∈δ(k)gC∀k ∈ A \R :

g

d

g

T

T

(pkm + jqkm ) (LHS is data, not variables)(1e)km∈δ(k)ggdg

Pk − P̂k + j(Qk − Q̂k ) =∀k ∈ R :

X

T

T

g

g

(pkm + jqkm ) (Pk , Qk are variables)(1f)km∈δ(k)g

g

Pk − P̂k = αk ∆(AGC response) ∆ is a variable,(1g)

reported data: operational limits on all buses, generators and lines
T

T

T

T

T

(1h)

T

all pkm , qkm related to |Vk |, |Vm |, θk , θm through AC power flow laws

(1i)

AC OPF-like problem, local-solvable in seconds
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201816 / 40

A large-scale example: case2746wp(2746 buses, 3514 lines, 520 generators, 25GW total load)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201817 / 40

A large-scale example: case2746wp(2746 buses, 3514 lines, 520 generators, 25GW total load)
attacked zone

1491
1137

1139

1361

1141
1138

1110

85

1625

1844

1512

1287

1252

1295

104

1651

1358

Undetectable attack with strong overloads on branches:(1361, 1141):
kreported flowk = 109, ktrue flowk = 229, limit = 114(1138, 1141):
kreported flowk = 98, ktrue flowk = 209, limit = 114
Net load change: 135 MW (< 0.5%) of total load

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201817 / 40

Non-static attack: follow-up
A blind spot in prior work?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Non-static attack: follow-up
A blind spot in prior work?
“Noisy-data”
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201818 / 40

Defense, 0Defender is likely to know that “something” happened (and quickly).
But sensor data is noisy and “something” may be inconsequential

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201819 / 40

Defense, 0Defender is likely to know that “something” happened (and quickly).
But sensor data is noisy and “something” may be inconsequential
We want a defensive action that is nearly implementable in terms of
today’s grid operation

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201819 / 40

Defense, 0Defender is likely to know that “something” happened (and quickly).
But sensor data is noisy and “something” may be inconsequential
We want a defensive action that is nearly implementable in terms of
today’s grid operation
Should not lead to false positives

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201819 / 40

Defense, 0Defender is likely to know that “something” happened (and quickly).
But sensor data is noisy and “something” may be inconsequential
We want a defensive action that is nearly implementable in terms of
today’s grid operation
Should not lead to false positives
Solution: change the power quantities in a way that the attacker
cannot anticipate, and identify inconsistent signals. How?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201819 / 40

Defense, 0Defender is likely to know that “something” happened (and quickly).
But sensor data is noisy and “something” may be inconsequential
We want a defensive action that is nearly implementable in terms of
today’s grid operation
Should not lead to false positives
Solution: change the power quantities in a way that the attacker
cannot anticipate, and identify inconsistent signals. How?
A solution: change generator output by a random injection thatyields a valid power flow solution (“AGC-lite” plus redispatch)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201819 / 40

Defense, 0’ (optimization problem)
Following attack, and in suspicion of an attack
Defender only has access to reported data, which is accurate in the
non-attacked zone. But the defender does not know the attackedzone.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201820 / 40

Defense, 0’ (optimization problem)
Following attack, and in suspicion of an attack
Defender only has access to reported data, which is accurate in the
non-attacked zone. But the defender does not know the attackedzone.
(repeatedly) Defender chooses a random subset of the
AGC-responding generators, andBienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201820 / 40

Defense, 0’ (optimization problem)
Following attack, and in suspicion of an attack
Defender only has access to reported data, which is accurate in the
non-attacked zone. But the defender does not know the attackedzone.
(repeatedly) Defender chooses a random subset of the
AGC-responding generators, andDefender computes a random power flow solution where the chosen
generators are allowed to change (up or down) their output, within
limits. Other generators can change output by small amounts, within
limits. The power flow solution must satisfy e.g. voltage
constraints.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201820 / 40

Defense, 0’ (optimization problem)
Following attack, and in suspicion of an attack
Defender only has access to reported data, which is accurate in the
non-attacked zone. But the defender does not know the attackedzone.
(repeatedly) Defender chooses a random subset of the
AGC-responding generators, andDefender computes a random power flow solution where the chosen
generators are allowed to change (up or down) their output, within
limits. Other generators can change output by small amounts, within
limits. The power flow solution must satisfy e.g. voltage
constraints.
Defender seeks to make the changes in generation large subject toabove constraints.
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201820 / 40

Defense, 0’ (optimization problem)
Following attack, and in suspicion of an attack
Defender only has access to reported data, which is accurate in the
non-attacked zone. But the defender does not know the attackedzone.
(repeatedly) Defender chooses a random subset of the
AGC-responding generators, andDefender computes a random power flow solution where the chosen
generators are allowed to change (up or down) their output, within
limits. Other generators can change output by small amounts, within
limits. The power flow solution must satisfy e.g. voltage
constraints.
Defender seeks to make the changes in generation large subject toabove constraints. ACOPF-like problem, solvable in seconds
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201820 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known. Therefore:

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known. Therefore:(under noisy-data attack)Reported currents, and implied power flows, will have near-constantvalues within attacked zone
But outside of attacked zone, with high-probability (?) most lines will
see significant changes in current and power flows

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known. Therefore:(under noisy-data attack)Reported currents, and implied power flows, will have near-constantvalues within attacked zone
But outside of attacked zone, with high-probability (?) most lines will
see significant changes in current and power flows
Above example (case2746wp) has over 3500 lines, but in a few iterations
we reduce the number of suspicious lines to < 100.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known. Therefore:(under noisy-data attack)Reported currents, and implied power flows, will have near-constantvalues within attacked zone
But outside of attacked zone, with high-probability (?) most lines will
see significant changes in current and power flows
Above example (case2746wp) has over 3500 lines, but in a few iterations
we reduce the number of suspicious lines to < 100.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 1
But attacker cannot anticipate this random action, even if the defense is
known. Therefore:(under noisy-data attack)Reported currents, and implied power flows, will have near-constantvalues within attacked zone
But outside of attacked zone, with high-probability (?) most lines will
see significant changes in current and power flows
Above example (case2746wp) has over 3500 lines, but in a few iterations
we reduce the number of suspicious lines to < 100.
Good, but not good enough

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201821 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

not attacked

Mopta 201822 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

not attacked

On a line going from boundary to interior of attacked zone

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201822 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

not attacked

On a line going from boundary to interior of attacked zone
reported current will be wrong

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201822 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

not attacked

On a line going from boundary to interior of attacked zone
reported current will be wrong
because voltage at boundary bus is changing with our defense

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201822 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

not attacked

On a line going from boundary to interior of attacked zone
reported current will be wrong
because voltage at boundary bus is changing with our defense
but voltage at interior bus is changing by very small amounts

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201822 / 40

Defense, 2:

 
Ikm
Imk

= Ykm

 
Vk
Vm

boundary of attacked zone
must report near−accurate voltage

within attackedzone
near constant (and false)
reported voltage

not attacked

On a line going from boundary to interior of attacked zone
reported current will be wrong
because voltage at boundary bus is changing with our defense
but voltage at interior bus is changing by very small amounts
In above example, one iteration identifies all boundary lines with no false
positives

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201822 / 40

δ+Pj∈G j−j∈G δjP

Experiment 1

Experiment 2

289.01

964.77174.47256.04

Branch (k = 1137, m = 1139)
1137 inside attack, 1139 on boundary
R (0)|∠θ R (0)|V11371137
R (0)|∠θ R (0)|V11391139
R (t)|∠θ R (t)|V11391139

1.0919∠ − 6.993◦
1.0919∠ − 6.991◦
1.0105∠ − 7.882◦

1.0919∠ − 6.993◦
1.0919∠ − 6.991◦
1.0187∠ − 7.936◦

R
I1137,1139(0)−0.0275 + 0.0281j−0.0275 + 0.0281j

20.967 − 55.978j

21.435 − 49.918j

Y1137,1139

 R

V1137 (0)
R (t)
V1139

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201823 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201824 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201824 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201824 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201824 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus ∈ A − ∂A the attacker reports (ateach time t) a complex voltage valueṼk (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?
→ stochastics of νk (t) should “make sense”

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201824 / 40

PMU funWe have data from an industrial partner:

240 PMUs

2 years of reported data

28 TB

Soon, 500 PMUs and higher detail

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201825 / 40

PMU funBienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201826 / 40

More PMU fun: a voltage phase angle

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201827 / 40

More PMU fun: 3 voltage angles)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201828 / 40

More PMU fun: difference between two voltage angles(10 seconds)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201829 / 40

More PMU fun: frequency at two different buses

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201830 / 40

Noise is not just noise
From real time series, voltage angle deviation histogram

Kolmogorov-Smirnoff gaussianity test strongly rejected, always

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201831 / 40

Noise is not just noise
From real time series, voltage magnitude deviations

Strong and nontrivial correlation structure

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201832 / 40

Covariances matrices of PMU data have low rank!!

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201833 / 40

Covariances matrices of PMU data have low rank!!
Example: 50 PMUs, Voltage Angle, one minuteScaled Eigenvalue
1
2
3
4
5
6
7
8
9
10
Bienstock, Escobar, Shukla (Columbia)

1.000
0.078
0.012
0.009
0.007
0.004
0.003
0.002
0.001
0.001
Variance Analysis

Mopta 201833 / 40

Covariances matrices of PMU data have low rank!!

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201834 / 40

Covariances matrices of PMU data have low rank!!
Example: 100 PMUs, voltage magnitude, five minutes
Scaled Eigenvalue
1
2
3
4
5
6
7
8
9
10
Bienstock, Escobar, Shukla (Columbia)

1.000
0.618
0.061
0.023
0.017
0.010
0.008
0.004
0.004
0.002
Variance Analysis

Mopta 201834 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus k ∈ A − ∂A the attacker reports (ateach time t) a complex voltage value
ṼkR (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201835 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus k ∈ A − ∂A the attacker reports (ateach time t) a complex voltage value
ṼkR (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201835 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus k ∈ A − ∂A the attacker reports (ateach time t) a complex voltage value
ṼkR (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201835 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus k ∈ A − ∂A the attacker reports (ateach time t) a complex voltage value
ṼkR (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201835 / 40

Non-static attack: follow-up“Noisy-data” attack
Following the attack, for any bus k ∈ A − ∂A the attacker reports (ateach time t) a complex voltage value
ṼkR (t) = VkR + νk (t)Here, νk (t) is random, withE(νk (t)) = 0,
(consistent with zero expected load change)
and? what else?
→ covariance of ν(t) should be make sense

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201835 / 40

Learning variances

Theorem. (Co)variance of time series can be learned
In real time
In streaming fashion
Under evolving stochasticity
Shukla, Yun and a fool from Columbia :Non-Stationary Streaming PCA, Proc. 2017 NIPS Time Series Workshop.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201836 / 40

Covariance defense

Under whatever assumptions, the attacker will produce a time series
for e.g. phase angles.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201837 / 40

Covariance defense

Under whatever assumptions, the attacker will produce a time series
for e.g. phase angles.
Assume covariance of phase angles is learned by the defender

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201837 / 40

Covariance defense

Under whatever assumptions, the attacker will produce a time series
for e.g. phase angles.
Assume covariance of phase angles is learned by the defender(Assume of low rank)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201837 / 40

Covariance defense

Under whatever assumptions, the attacker will produce a time series
for e.g. phase angles.
Assume covariance of phase angles is learned by the defender(Assume of low rank)
Defender chooses random generator injections so as tosignificantly change covariance of phase angles

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201837 / 40

Covariance defense

Under whatever assumptions, the attacker will produce a time series
for e.g. phase angles.
Assume covariance of phase angles is learned by the defender(Assume of low rank)
Defender chooses random generator injections so as tosignificantly change covariance of phase angles
Attacker is caught with pants down

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201837 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)
Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r (plus other conditions)

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)
Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r (plus other conditions)
Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)
Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r (plus other conditions)
Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T where λ > 0

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, abridged)
Let Ω = covariance of observed voltage phase angles
Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)
Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r (plus other conditions)
Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T where λ > 0
On case2746wp, ≈ 10 vectors v cover all buses.
(Dense null space vector computation: LP heuristic)
Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201838 / 40

Covariance defense (technical, less abridged)1

Let Ω = covariance of observed voltage phase angles

2

Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201839 / 40

Covariance defense (technical, less abridged)1

Let Ω = covariance of observed voltage phase angles

2

Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)

3

Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r and [Bv ]i = 0 for all non-generator i

4

Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201839 / 40

Covariance defense (technical, less abridged)1

Let Ω = covariance of observed voltage phase angles

2

Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)

3

Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r and [Bv ]i = 0 for all non-generator i

4

Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T where λ > 0

5On case2746wp, there is a single vector v that covers all buses.

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201839 / 40

Covariance defense (technical, less abridged)1

Let Ω = covariance of observed voltage phase angles

2

Let w1 , w2 , . . . , wr = eigenvectors with positive large enougheigenvalues. r  n (number of buses)

3

Defender chooses vector v ∈ Rn with:wiT v = 0 for 1 ≤ i ≤ r and [Bv ]i = 0 for all non-generator i

4

Theorem: there is a random set of power injections (by generators)
that results in covariance of phase angles≈ Ω + λvv T where λ > 0

5On case2746wp, there is a single vector v that covers all buses.
Theorem: if v 1 , v 2 ∈ subspace S, then ∃ ∞ many v ∈ S withsupport(v ) = support(v 1 ) ∪ support(v 2 )Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201839 / 40

Summary
Very high-fidelity grid attacks appear easily computable.

Defensive idea 1: use network resources to change power flow physics
in unpredictable ways

Defensive idea 2: change covariance structure in a way that cannot
be instantaneously learned

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201840 / 40

Summary
Very high-fidelity grid attacks appear easily computable.

Defensive idea 1: use network resources to change power flow physics
in unpredictable ways

Defensive idea 2: change covariance structure in a way that cannot
be instantaneously learned

Adversarial learning of moments under streaming data is a niceproblem!

Wed.Aug.15.113946.2018@blacknwhite

Bienstock, Escobar, Shukla (Columbia)

Variance Analysis

Mopta 201840 / 40