## 2 Covert Cyber Deception Assault
### Legacy Bad-Data Detectors in PCCs  
The measurement data and the state variables are related through the following alternating AC power flow observation model:  
\[Z_{meter}=\mathrm{h}(\delta)+e, \tag{1}\]  
where \(\mathrm{h}(\delta)\) is a non-linear relationship between measurement data, \(Z_{meter}\), and the state vector \(\delta_{i}\)\(e=[e_{1},e_{2},...,e_{m}]^{T}\) is the Gaussian measurement noise vector with standard deviation \(\sigma\). Using a linear or direct current (DC) power flow model, the observation model in (1) becomes further simplified with a small sacrifice of accuracy, as follows [26; 27]:  
\[Z_{meter}=\mathrm{H}\delta+e. \tag{2}\]  
In a DC power flow problem, the Jacobian matrix \(\mathrm{H}\) can be approximated as follows:  
\[\mathrm{H}=\frac{\mathrm{h}(\delta)}{\mathrm{h}\delta}\bigg{|}_{\delta=0}, \tag{3}\]  
where \(\mathrm{H}\) is composed of topology and impedance data only. One objective of (2) is to determine the estimated state, \(\delta\), that is the best fit for the meter measurements. In other words, we can say that the best estimated value can minimize estimation weighted least square (WLS) error, \(\left(Z_{meter}-\mathrm{H}\delta\right)^{\mathrm{T}}\Omega\left(Z_{meter}- \mathrm{H}\delta\right)\). By applying the WLS statistical estimation criteria, the estimated voltage phase angle is given as follows:  
\[\delta=(\mathrm{H}^{\mathrm{T}}\Omega\mathrm{H})^{-1}\mathrm{H}^{\mathrm{T}} \Omega Z_{meter}=\mathrm{W}Z_{meter}, \tag{4}\]  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Abbreviation** & **Term** & **Abbreviation** & **Term** \\ \hline AD & anomaly detection & GA & genetic algorithm \\ AGC & auto-generation control & MF & measurement features \\ BDD & bad-data detection & NCA & neighborhood component analysis \\ CCD & covert cyber deception & OPF & optimal power flow \\ CSD & cyber stealthy deception & PCA & principle component analysis \\ EC & evolutionary computation & PCC & power control center \\ ED & Euclidean distance & PSO & particle swarm optimization \\ EMS & energy management system & ROC & receiver operating characteristic \\ FDI & false data injection & RTU & remote terminal unit \\ FE & feature extraction & SE & state estimation \\ FS & feature selection & SG & smart grid \\ \hline \hline \end{tabular}
\end{table}
Table 1: Nomenclature.  
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Standard IEEE Bus System** & **States** & **Features** & **Selected Features** \\ \hline
14-bus & 13 & 53 & 23 \\
39-bus & 38 & 130 & 61 \\
57-bus & 56 & 216 & 111 \\
118-bus & 117 & 489 & 233 \\ \hline \hline \end{tabular}
\end{table}
Table 2: Average number of features selected by GA.  
where \(\mathrm{W}=(\mathrm{H}^{\mathrm{T}}\Omega\mathrm{H})^{-1}\mathrm{H}^{\mathrm{T}}\Omega\) and \(\Omega\) is a diagonal matrix where diagonal elements are \(\Omega_{ii}=\sigma^{-2}\), with \(\sigma_{i}^{-2}\) being the variances of meter errors. Noise in the wireless medium, faulty meters or malicious user behavior (like CCD assaults) can be potential sources for abnormal data in estimated measurements. Current power systems use a residual-based detector for BDD to protect state estimation [28]. The difference between observed meter measurements \(Z_{meter}\) and estimated measurements \(\hat{Z}\) is the residual, \(R\), and it is expressed as follows:  
\[R=Z_{meter}-Z_{estimated}=(I-M)Z_{meter}. \tag{5}\]  
The expected value and the co-variance of the residual are:  
\[\begin{array}{l}E(R)=0,\\ \mathrm{cov}(R)=(I-A)R.\end{array} \tag{6}\]  
The BDD present in the PCC performs the \(l_{2}\)-norm test [28] to compare the results with a predefined threshold. The hypothesis of not being attacked is accepted if we have:  
\[\max_{i}|R_{i}|\leq\lambda, \tag{7}\]  
where \(R_{i}\) is the component of residual vector \(R\) and \(\lambda\) is the threshold.