## 7 Experimental Demonstration
### Analysis of Special Cases  
In this section, we show how the governor prevents area-wise attacks discussed in Section 4.4, and how to upgrade governor rules for two special cases: (1) when a critical infrastructure in an area requires power supply irrespective of whether the other area is stable or not, and (2) how to prevent  
Figure 10: Load shedding attack—with a governor. load shedding attacks where the attacker reduces the load shedding command to cause overloading instead of performing extra shedding. **Area-wise Attacks. ** We assume that generation loss contingency (GLC) occurs, and the load shedding attack (LSA) is prevented by the governor in all cases. Cases are represented by attack number (CRA). Attack 1 (X;X;X): An adversary performs LSA in the same area X where GLC occurs, and DRAS X responds to mitigate the contingency. He DRAS X governor verifies the command issued by DRAS X according to Rule 6 since it knows about the state information (and GLC) and verifies whether this command is required and safe for the local system X. Attack 2 (X;X;Y): GLC occurs in area X; the system responds in the same area, but an adversary performs LSA in area Y. If compromised, DRAS Y issues LSA commands; it will be detected by the DRAS Y governor since there is no contingency in area Y, and, therefore, it will disallow commands and notify SOC. If commands are issued by PU to DRAS Y, the PU governor will detect this malicious command since it knows that the DRAS X governor has already taken action in X, and there is no need to perform any further action. If DRAS X cannot mitigate GLC, it asks PU to take a certain action, and this request goes through the DRAS X governor. Finally, the DRAS X governor verifies the request and forwards it to PU and the PU governor. The PU command will be verified according to Rule 2. Attack 3 (X;X;X,Y): GLC occurs in area X; the system responds in the same area, but an adversary performs LSA in both areas X and Y. When an adversary issues LSA commands in X, it will be detected by the DRAS X governor according to Rule 6. In the case of Y, LSA commands are verified similarly as in the case of Attack 2. Attack 4 (X;Y;X): GLC occurs in area X; the system responds in a different area: area Y. This is the case when DRAS X requests PU to perform load shedding since it cannot mitigate GLC. DRAS X issues the request, and it goes through the DRAS X governor which will verify it and send it to PU and the PU governor for the state information update. PU will issue commands to DRAS Y, and it will be verified by the PU governor which knows that the contingency is to be mitigated by issuing commands in area Y. However, LSA occurs in X. When DRAS X issues a malicious command, it will be captured by the DRAS X governor, and it is discarded because it knows that DRAS X issued a request to PU. One of the limitations of the governor is that if an attacker performs an LSA attack first in the case of GLC before DRAS X issues a command to PU, the DRAS X governor will allow commands if they are safe for the system according to Rule 6. In any case, the governor will not allow commands that will destabilize the system. PU must anticipate future generation loss and send state information to DRASs so that they can take action quickly. Attack 5 (X;Y;Y): GLC occurs in area X; the system responds in area Y where LSA occurs. PU issues a command to DRAS Y on the request of DRAS X, and they are verified by the PU governor. The DRAS Y governor verifies whether the commands (both malicious and legitimate) is required based on the signature of PU and whether it is safe for the local system. Attack 6 (X;X;Y;X,Y): Suppose 20% GLC occurs in X, the systems responds in X,Y, and an adversary performs LSA in X,Y. DRAS X decides to perform 20% LS in X and requests PU to perform 10% LS in Y. In X, if an adversary adds Z% of extra LS commands, it will be verified by the DRAS X governor. Moreover, it will verify the request that is sent to PU and the PU governor. In Y, PU issues a command to DRAS Y through the PU governor.