# Microgrid Cyber-Security: Review and Challenges toward Resilience
## 4 Perspective-Based Interventions Addressing Cyber Attacks
### Microgrid Control
#### 4.3.2 Automation Control against Cyber-Attacks  
Since control systems were conventionally developed to detect, process, and mitigate the systematic and unpredicted errors, there is no wonder it has been the focus of numerous research cases in the field of attack predictability, detection and protection. Microgrids are prone to the same types of attacks found in the utility grid. DoS events provoke multiple issues without a doubt, but at the same time, they are easily detected by the system operator which will probably recognize in an adequate rapidity that it is under attack. Similarly, the superior severity of the FDI attacks is largely attributed to the detection method's complexity and variability upon the adopted control structure [47]. Broadly, detection and mitigation of conventional attacks are already well explored in the literature. FDI that succeeds in penetrating the network while maintaining discretion without altering the system observability disturbance alarms, also known as stealth attacks [48], are able to cause unpredictable stability issues and the worse is that they are practically impossible to detect [49]. From a defender perspective, recent research attainable choices are perceived into either addressing the fault detection and isolation in control loops (detection based) [50] or working on precaution measures based on threat modeling and security analysis (protection based) [51]. The popular method used to detect bad measurement data in power transmission systems is the Static State Estimator (SSE). It is generally based on a weighted least squared (WLS) solution and it is not immune against attacks itself [52; 53]. State estimation is also important to microgrid control functionality and it is usually found in traditional energy management systems derived from steady-state models [18]. However, static state models were no longer able to capture the systems' dynamics accurately with the exacerbated numbers of DERs on the generation side and the debuting retrofits on the demand side. The research presented in [18] emphasizes the importance of deploying a secure dynamic state estimation on the side of AC-connected microgrids as a portion of the distribution network. Similar to [54] they proposed an estimator algorithm for a standard structure-preserving model that incorporates system dynamics. Method validation illustrates the estimator's ability to give a secure dynamic state estimation when supplied with inaccurate measurements caused by either an attack that manipulates communication between transceivers and the microgrid operator, or attacks that manipulate measurement units themselves, even without considering an attack scenario. Traces left on the operation of observers turn into an efficient key to be used in attack detection. Distributed state estimation method is used as a way of detecting cyber-attacks of the FDI type. In [55], a consensus-based controlled DC microgrid was investigated where each distributed generation unit had employed the Unknown Input Observer (UIO) to estimate the state of its neighboring units and isolating the fault source consequently. Another control approach using UIO was proposed in [50]. A fully decentralized load frequency controller was developed and tested with a perspective to be applied to multi-AC and DC microgrids. Given that the relative simplicity of the cyber-attack detection of the FDI type in distributed control schemes, authors in [49] have decided to raise the bar by firstly introducing a stealth attack that is able to deceive the conventional distributed voltage observer without triggering the detection mechanism. After that, they proposed a general algorithmic-based detection framework for DC microgrids where they added a cooperative vulnerability factor (CVF) to the voltage PI controller. Finally, and under worst-case scenarios, artificial disturbances were added to by coupling the CVF with the secondary current sublayer in order to enhance the chance of capturing the attacks.