# Power Grid Reliability Evaluation Considering Wind Farm Cyber Security and Ramping Events
## 2 Wind Farm Cyber Architecture and Security Risks  
The diagram in Figure 1 is a typical communication network of a wind farm. The WTs use cables to transmit data to a local network of the wind power plant. Within a specified zone, several wind farm management systems are connected to a main control center. As the backup of the main control center, the remote control center is connected to the wide area network of wind farm supervisory control and data acquisition (SCADA) systems. As International Electrotechnical Commission (IEC) 61400-25 and IEC 61850-7 specify the uniformed Internet Protocol based communication standards, the equipment and system operation of wind farm are supported by SCADA protocols such as the Object Linking and Embedding for Process Control, Modbus/Transmission Control Protocol or vendor-specific protocols. And the conventional network is supported by the protocols of Telnet, File Transfer Protocol, and HyperText Transfer Protocol.  
Wind farm cyber security risks mainly come from the cyber-physical access to the core equipment of wind farm SCADA and energy management system (EMS). As shown in Figure 1, in order to gain the privilege to control a WT, the potential attack paths can be achieved by intruding: (1) The wind turbine control panel (WTCP); (2) the operating and control local area network (LAN) of wind farms; (3) the control center LAN of wind farms; and (4) the remote control LAN in the substation [16].  
The WTCP is a vulnerable node in the control network of a wind farm. Once the pin of a WTCP is cracked, the operating and control data of a WT can be monitored and revised. Additionally, the fiber optics or switches of a WTCP can be physically accessed by microcomputers. Generally, wind turbines are linked in a ring topology communication network [14]. The failure of one link has no impact on the others. However, in linear or star topology, by compromising the terminal or central WT, it is possible to intercept legitimate command and control messages to mislead the operation of dozens, possibly hundreds, of wind turbines.  
A virtual private network (VPN) is provided to vendors for devices or software services and is another vulnerable point of the cybersecurity. The remote access of a VPN with outdated and unencrypted protocols can be used by attacker to reach the wind farm control LAN. Real-time command and measurement information can be revised on the workstation. Similarly, through a VPN, both the wind farm control center and remote control are at risk of being intruded. If the Inter-Control Center Communications Protocol (ICCP) server and SCADA server are compromised, the attacker could gain the privilege to obstruct the operation of wind farms. The attacker could change the output of the WT, inject false data [20], or instigate an emergency shutdown, which could be a hard stop that induces excessive wear and tear on critical mechanical components. In this paper, the occurrence of cyber-attacks was modeled as the competition result between compromising and fixing the cyber vulnerabilities. The consequent operating and physical states of WTs were projected on the system reliability evaluation.