## 3 DoS Attacks on the AC/DC Multi-Area LFC System with Virtual Inertia
### The Test LFC System under DoS Attacks
 \tag{22}\]  
As noted earlier, vulnerabilities within the wide-area communication network (e.g., SCADA system) may allow cyber attacks. In this section, we focus on the following DoS attack scenario; the adversary has compromised the communication channels of wide-area measurements, preventing these measurements from being transmitted to the control center for power modulation (i.e., supervisory AGC and SPMC loops); recall Figure 1. According to the authors of [39], it is reasonable to assume that the channel for AGC and SPMC control signals is equipped with advanced encryption techniques; therefore, we mainly focus on the uploading channels of wide-area measurements instead of control signals on the feedback loop. As stated in Section 2.3, we know that the control loop of inertia emulation is using local information only and thus not attacked directly by DoS. Due to the DoS attack, the missing measurements are typically replaced with the last received ones. By properly designing the DoS attack sequences, the attacker can corrupt the normal operation of the controllers and consequently the involved physical system, e.g., the system stability. We show such effects of DoS attacks in what follows. According to the authors of [16], the DoS attack on the output vector \(\mathbf{y}\) can be treated as a switching on/off event. Let \(\hat{\mathbf{y}}\) denote the output vector under DoS attacks, and the control signal becomes  
\[\mathbf{u}[k]=K\hat{\mathbf{y}}[k]\,. \tag{23}\]We also consider that the controllers are equipped with ZOH. Hence the wide-area measurements in the LFC loop under DoS attacks can be further expressed as  
\[\tilde{\mathbf{y}}[k]=\left\{ \begin{array}{ll}\mathbf{y}[k]=\mathbf{Cx}[k]&\text{if, }S_{1}\,;\\ \tilde{\mathbf{y}}[k-1]=\mathbf{Cx}[k-1]&\text{if, }S_{2}\,.\end{array} \right. \tag{24}\]  
where \(S_{1}\) and \(S_{2}\) are \"positions\" indicating whether the wide-area measurements are under DoS attacks or not, \(\tilde{\mathbf{x}}\) is an introduced auxiliary vector that satisfies  
\[\tilde{\mathbf{x}}[k]=\left\{ \begin{array}{ll}\mathbf{x}[k]&\text{if, }S_{1}\,;\\ \tilde{\mathbf{x}}[k-1]&\text{if, }S_{2}\,.\end{array} \right. \tag{25}\]  
Next, to include DoS attacks into the control loop, let us augment the state vector with the introduced vector \(\tilde{\mathbf{x}}^{\top}[k-1]\), i.e., \(\mathbf{z}[k]:=\left[\mathbf{x}^{\top}[k]\;\;\tilde{\mathbf{x}}^{\top}[k-1]\right]^{\top}\). Then, one can integrate (23) with (22) to derive the closed-loop model of the test LFC system under DoS attacks,  
\[\mathbf{z}[k+1]\;=\;\Phi_{j}\mathbf{z}[k]\;+\;B_{d,cl}\mathbf{d}[k]\,, \tag{26}\]  
where \(j\) indicates the switch position such that \(j=1\) for position of \(S_{1}\) (no DoS attacks), and \(j=2\) for position of \(S_{2}\) (under DoS attacks), and the corresponding matrices are  
\[\Phi_{1}= \begin{bmatrix}\mathbf{A}+\mathbf{B}_{u}\mathbf{KC}&\mathbf{0}\\ \mathbf{I}&\mathbf{0}\end{bmatrix} \,,\quad\Phi_{2}= \begin{bmatrix}\mathbf{A}&\mathbf{B}_{u}\mathbf{ KC}\\ \mathbf{0}&\mathbf{I}\end{bmatrix} \,,\quad\mathbf{B}_{d,cl}= \begin{bmatrix}\mathbf{B}_{d}\\ \mathbf{0}\end{bmatrix} \,. \tag{27}\]  
**Remark 1** (DoS attacks on \"selected\" measurements). : _In the attack scenario above, we can observe that all the system outputs are assumed to be attacked by DoS; see (24). This is mainly for the simplicity of illustrating the formulations of closed-loop system matrices. However, the developed framework can subsume the scenario where only part of measurements are attacked. One can introduce diagonal matrices with the elements of binary vectors sitting on the main diagonals to indicate which wide-area measurement is under a DoS attack. For instance, let us introduce \(\tilde{\mathbf{y}}[k]=\mathbf{P}_{1,m}\mathbf{Cx}[k]+\mathbf{P}_{2,m}\mathbf{Cx}[k-1]\) for the switch position \(S_{2}\) when the m-th measurement is attacked by DoS, and \(\mathbf{P}_{1,m}\), \(\mathbf{P}_{2,m}\) are such diagonal matrices that characterize the \"position\" of the attacked measurement._