## 3 Zero-Dynamics Attack on Wind Turbine  
Thanks to the development of communication and computing technology, modern wind turbine systems are generally operated by remote control and monitoring systems such as SCADA systems [39; 40; 41]. Operating wind power generators using the SCADA system enables efficient monitoring and control over wide areas such as wind farms [42; 43]. An operator of the SCADA system can comprehensively manage the system based on the signals delivered through the network such as rotor and generator speed, wind speed, and generator torque; see, e.g., [39; 40] for details. For the reasons discussed above, the network-based monitoring (or controlling) systems bring an advantage in terms of efficient management of the system. Through a communication network, multiple wind turbines installed in a wide area can be managed in one place, which can result in reduced manpower and immediate state monitoring [44; 45]. However, there are also problems with network usage, such as vulnerabilities to cyberattack. If a large area is connected through communication lines, the number of paths through which an attacker with a malicious purpose can inject signals into the system may increase [46; 47; 48]. In fact, many studies on cyberattacks using these vulnerabilities have been conducted recently [8; 49], such as data integrity attack [6], false-data injection attack [50], ZDA [7], etc. Among these cyberattacks, ZDA is one of the sophisticated cyberattacks based on system dynamics [23; 24]. Consider a wind turbine system that operates as shown in Figure 3. The turbine receives control input from a remote controller and feeds the system state back to the controller through a network. ZDA becomes possible by occupying the network line between the controller and target system. Assume that the attacker who has taken control of the network line knows the model information of the system and can add the attack signal \(a_{k}\) to the controller output, as shown in Figure 4. Then, using the system model, the attacker can generate a sophisticated attack signal that enables the discrete-time output signal to pretend that the system is operating normally but make the internal state actually unbounded [51; 52]. The mathematical explanation for the zero-d \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \(J_{r}\) & \(J_{g}\) & \(K_{sh}\) & \(R\) & \(\lambda_{opt}\) & \(C_{p,max}\) \\ \hline
30,375 kg\(\cdot\)m\({}^{2}\) & 151 kg\(\cdot\)m\({}^{2}\) & 0.31\(\times\)10\({}^{6}\) N\(\cdot\)m/rad & 11.25 m & 6 & 47.24\% \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Model parameters of a small-sized wind turbine. Figure 3: Schematic of remotely monitored and controlled wind turbine systems subject to zero-dynamics attacks. ZDA—zero-dynamics attack; SCADA—supervisory control and data acquisition. From (8), the dynamics of the wind turbine under ZDA becomes  
\[ \begin{split}\hat{x}_{k+1}&=\hat{A}_{\text{d}}\hat{x}_{ k}+\hat{B}_{\text{d}}(\hat{u}_{k}+a_{k})\\ \hat{y}_{k}&=C_{\text{d}}\hat{x}_{k},\end{split}  \tag{9}\]  
where \(a_{k}\) is the attack signal of ZDA. The attack signal \(a_{k}\) is generated from a dynamic system which is identical to the zero dynamics of the system. We recall that the zero dynamics of the system (9) can be identified by rewriting it in the normal form [53] given by  
\[ \begin{split}\eta_{k+1}&=S_{\text{d}}\eta_{k}+P_{ \text{d}}\xi_{k},\ \eta_{k}\in\mathbb{R}^{2}\\ \xi_{k+1}&=\psi_{\text{d}}^{\top}\eta_{k}+\phi_{ \text{d}}\xi_{k}+g_{\text{d}}(\hat{u}_{k}+a_{k}),\ \xi_{k}\in\mathbb{R}\\ \hat{y}_{k}&=\xi_{k},\end{split}  \tag{10}\]  
where the dynamics of \(\xi_{k}\) explains how the input \(u_{k}\) directly affects the system output (\(\hat{y}_{k+1}\) explicitly depends on \(u_{k}\)) and that of \(\eta_{k}\) describes the internal behavior of the system. The dynamics \(\eta_{k+1}=S_{\text{d}}\eta_{k}\) is called the zero dynamics and the eigenvalues of \(S_{\text{d}}\) correspond to the zeros of the system (9).