## 1 Introduction
In this paper, we present an intelligent governor for the smart grid system (IGNORE) to limit the success of attacks when a grid's cyber system has been compromised and leveraged by an adversary to mount attacks on the physical system. IGNORE is based on the concept of the security reference monitor. The security reference monitor is a concept to enforce security policies before taking any action in the system to make sure any action is not a violation of the system policy. Therefore, the governor is a component that serves to protect a system from attacks that are more severe and frequent than is acceptable by enforcing security policies on the actions of the system's higher-level functions. A higher-level function of a smart grid refers to an application-level service that serves a wider motive in the system and without which system is not complete. For instance, the demand response function is important for the day-to-day resilience of the system. It allows the power utility to control customers' load on-demand in response to power fluctuations. A governor may contain modules corresponding to each higher-level function. Each module consists of security policies that need to be enforced. A security policy is a set of rules that partition the state of a system into a set of authorized or secure states, and a set of unauthorized or non-secure states [25]. It defines what actions a governor should take to make sure the system is in a safe state. A governor not only maintains the safety properties in the case of attacks originated from compromised components in the system but also prevents attacks from the subversion of the local system. The underlying principle for generating a governor's security policies is the requirement and safety property. The requirement property is based on the need for certain commands in the system at a specific time, and the safety property ensures that the system will be in a safe state after implementing the commands. Based on these properties, IGNORE evaluates whether commands issued by a cyber system are required as well as safe in/for the system. In a smart grid, if an adversary compromises a demand response automation server (DRAS), they send malicious commands to perform un-safe load shedding (or curtailment) in a region. The governor for demand response prevents such attacks by evaluating whether load shedding (or curtailment) commands are required and safe for the system. In order to understand how to design a governor system for a cyber-physical function, we narrow the focus of this paper to understanding its application in a smart grid domain. We describe the methodology to build IGNORE and present its usefulness in the smart grid infrastructure by designing a governor for its DR function. Moreover, we describe new attack categories, how the governor prevents those attacks, and what attacks are not prevented. We are among the first to design a system to prevent a subset of malicious power supply and load altering attacks from a compromised cyber function in a grid. Our key contribution is to understand how to design a governor for the grid's DR functionality, prevention of different attacks, and factors that should be considered by power engineers while developing this system, and to show its effectiveness through empirical results. This work sheds light on how a higher-level function of a smart grid is protected by analyzing the system's cyber and physical aspects even when some parts of the cyber system are compromised. The rest of this paper is organized as follows: Section 2 provides a description of where the governor is useful. Section 3 provides a brief introduction to the DR functionality. Section 4 presents attacks on the DR. Section 5 introduces the methodology to design a governor system and Section 6 presents the DR governor. In Section 7, we present the test system which includes a conceptual overview of DR and power system modeling that is used to perform experiments. Furthermore, we demonstrate attacks on the grid and show how the governor prevents those attacks.