## 4 FDI Attacks on the AC/DC Multi-Area LFC System with Virtual Inertia
### The Test LFC Sytem under FDI Attacks: Basics  
As noted in Section 3.1, in this article we focus on the attack scenario where the uploading communication channels of wide-area measurements are attacked. Thus, the system output after FDI corruptions would become  
\[\mathbf{\hat{y}}[k]=\left\{ \begin{array}{ll}\mathbf{y}[k]&\text{if, }k\
otin\mathcal{T}_{f};\\ \mathbf{y}[k]+\mathbf{D}_{f}\mathbf{f}[k]&\text{if, }k\in\mathcal{T}_{f},\end{array} \right. \tag{29}\]  
where \(\mathbf{f}[\cdot]\in\mathbb{R}^{n_{f}}\) represents the FDI attack signal, \(\mathcal{T}_{f}\) denotes the FDI attack period, and \(\mathbf{D}_{f}\) characterizes the part of measurements that are attacked by FDI. Again, as illustrated in Figure 1, FDI attacks on wide-area measurements would mainly corrupt the supervisory AGC and SPMC controls as these loops use the wide-area measurements as the controller inputs, which also implies that the virtual inertia emulator is not compromised directly by FDI. Based on (22) and (29), the closed-loop model of the test LFC system under FDI attacks can be expressed as  
\[\mathbf{x}[k+1] = \mathbf{A}_{cl}\mathbf{x}[k]\,+\,\mathbf{B}_{d}\mathbf{d}[k]\,+\,\mathbf{B}_{f}\mathbf{f} [k]\,, \tag{30}\] \[\mathbf{\hat{y}}[k] = \mathbf{C}\mathbf{x}[k]+\mathbf{D}_{f}\mathbf{f}[k]\,,\]  
where \(\mathbf{A}_{cl}:=\mathbf{A}+\mathbf{B}_{u}\mathbf{K}\mathbf{C}\) and \(\mathbf{B}_{f}:=\mathbf{B}_{u}\mathbf{K}\mathbf{D}_{f}\). We can see that the corruptions on the supervisory control loops by FDI attacks would further affect the involved physical system. To illustrate the attack strategy that an FDI attacker can exploit to be disruptive to the LFC system, let us start from the stationary FDI attack scenario where the attack occurs as a constant bias injection on wide-area measurements during the attack period, i.e., \(\mathbf{f}[k]=\mathbf{f}\) for \(k\in\mathcal{T}_{f}\) and \(\mathbf{f}\) is a constant vector while \(\mathbf{f}[k]=\mathbf{0}\) for \(k\
otin\mathcal{T}_{f}\). We say such attack is \"stationary\" as the attack value remains unchanged during the attack period. As a typical FDI scenario, the stationary FDI attack has been studied in a large amount of literature work [12; 39; 41]. According to the number of manipulated wide-area measurements, stationary FDI attacks can be classified into two types in general, i.e., univariate attack (\(n_{f}=1\)) and multivariate attack (\(n_{f}>1\)). Similar to the advanced DoS attack which aims to corrupt the system stability with an optimal strategy, an intelligent FDI attack with full system knowledge also would seek to maximize its impact on the targeted LFC system. To evaluate the attack impact, the indices of maximum frequency deviation (MFD) and steady-state frequency deviation (SSFD) for frequency stability are commonly deployed. In the univariate FDI attack scenario, intuitively, the attacker would prefer a larger constant bias injection to have the maximum impact from the perspective of MFD or SSFD. However, a large constant injection may also trigger data quality alerts. In general, data quality alerts would be triggered if the calculated ACE in the control center exceeds 0.05 p.u., according to the grid code in [7]. In order to have enough attack impact and remain undetected with respect to data quality checking programs, an adversary may have to compromise multiple wide-area measurements with vast attack resources to launch multivariate stationary attacks. Let us still consider an intelligent attack scenario where the attacker is also equipped with full knowledge of the underlying system (i.e., all the system parameters in Section 2 and possible data quality checking programs). Then, the multivariate attack can choose an appropriate injection of \(\mathbf{f}\). In the following, we characterize the optimal strategy for stationary FDI attacks where the attacker aims to have enough attack impact and remain undetected from the data quality checking program, and in the mean time try to compromise as less measurements as possible.