## 5 Case Study
### False Data Injection (FDI) Attack  
Concerning the real application of false data injection attacks and mitigation operations completely similar to DoM, missing data attack DC current sensors as a measurement method are used for cyber attack detection. Concerning missing data attacks, as shown in Figure 17, the actual measurement current shows several significantly different responses from the prediction value. As mentioned in section two, there are several stages of frequency response features such as arresting, recovery, and post-recovery period. Moreover, a false data injection attack occurred during the recovery period, signifying the constant zero additional current value through the LCC line. On the other hand, the current measurement and prediction showed an identical response at the arresting period. This circumstance verifies that the detection of normalized cooperation concepts was performed well. As a result, the power system operator should alleviate this problem to avoid large mismatches of balancing arrangement through the proposed algorithm.  
Nevertheless, the VSC current response showed a noticeable difference. As was noted in the previous analysis, the VSC line improved mitigation control as indicated by the ramp-rate deviation value, which was obtained using the actual current flowing between two lines as described in Equation (9). Furthermore, because each line has a varied maximum power rating, there will be complications when the missing data attack mitigation mechanism is activated. When additional power through the LCC line is restricted to a specific amount, such as zero power response, adjustment of additional power through the VSC is equally crucial, as it is also incremented. The frequency nadir improvement value in the system around Jeju Island illustrates the impact of the proposed methodology.  
As illustrated in Figures 26 and 27, the active power response will reduce to zero when false data injection is applied at the specified time. This attack operation shows a similarity with a missing data attack. However, this attack showed slight differences because the E-FCR operation was already active at the temporary time. On the other hand, there was a significant negative effect of this attack; this situation could be explained through mitigation operation response. When adaptive control was activated, it was useless due to the limitation of active rating power capacity in the VSC#3 line. These remarkable differences could be explained only by different ramp-rate values when attack and adaptive control through VSC#3 line are applied. In addition, a poisoned signal from the VSC#3 line showed good performance due to zero response when an FDI attack suddenly occurred.  
As illustrated in Figures 28 and 29, the response of frequency nadir in Jeju Island showed a better response compared with missing data attacks. This situation could be reflected in temporary power transfer from E-FCR. Even though power transfer was suddenly lost between two asynchronous areas, the frequency maintained a higher than minimum frequency nadir value, i.e., 59.4 Hz. However, when the attacked time was cleared, the steady-state value of power and frequency response was similar to normal  
Figure 25: Mainland frequency in the missing data attack operation.  
operation. On the other hand, this situation cannot be described as a missing data attack due to large mismatches in terms of balancing arrangement operations.  
Figure 28: Jeju Island frequency in the false data injection attack operation.  
Figure 26: LCC active power response in the false data injection attack operation.  
Figure 27: VSC active power response in the false data injection attack operation.