## 2 Modeling of Compromised LFC System and False Data Injection Attacks  
### Basics of a Compromised LFC System  
The diagram of a typical multi-area LFC system is depicted in Figure 1. The system consists of \(n\) areas. The attacker randomly selects one area (Area \(i\) ) to launch cyber attacks. Other normal areas are represented by area (\(j(j=1,...,\ i-1,i+1,...,\ n)\)). The attack target is the remote terminal unit (RTU) of the compromised area. RTU is used to collect tie-line power data. Since RTU is compromised, tie-line data cannot be correctly transmitted to the control center, so that area control error (ACE) cannot be correctly calculated. Through the proportion integral differential (PID) controller, the wrong ACE signals produce the wrong control command. Based on the relationships between control command and active power (the relationships are represented by the transfer functions in Figure 1), incorrect control command could lead to power imbalance. Then, power imbalance leads to the fluctuation of system frequency, which endangers the stability of the power system. The dynamic model of the compromised system is:  
\[ \begin{split}\dot{x_{i}}(t)=&(A_{i}+\Delta A_{i}(t ))x_{i}(t)+(B_{i}+\Delta B_{i}(t))u_{i}(t)\\ &+E_{ij}\Delta f_{j}(t)+F_{i}\Delta p_{i}^{d}\\ y_{i}(t)=& C_{i}x_{i}(t)+G_{i}\omega_{i}(t)\end{split}  \tag{1}\]  
Figure 1: Diagram of the multi-area compromised LFC system. where  
\[x_{i}=[\Delta P_{i}^{S}\ \ \Delta P_{i}^{m}\ \ \Delta f_{i}\ \ \Delta P_{i}^{t}]^{T}\]  
\[y_{i}=\Delta P_{i}^{f}\]  
with  
\[A_{i}= \begin{bmatrix}-\dfrac{1}{T_{i}^{S}}&0&-\dfrac{1}{R_{i}T_{i}^{S}}&0\\ \dfrac{1}{T_{i}^{t}}&-\dfrac{1}{T_{i}^{t}}&0&0\\ 0&\dfrac{1}{M_{i}}&-\dfrac{D_{i}}{M_{i}}&-\dfrac{1}{M_{i}}\\ 0&0&2\pi\sum_{j=1,j\
eq i}^{n}T_{ij}&0\end{bmatrix} \]  
\[B_{i}= \begin{bmatrix}-\dfrac{1}{T_{i}^{S}}\\ 0\\ 0\\ 0\end{bmatrix} ,E_{ij}= \begin{bmatrix}0\\ 0\\ 0\\ -2\pi\sum_{j=1,j\
eq i}^{n}T_{ij}\end{bmatrix} ,F_{i}= \begin{bmatrix}0\\ 0\\ -\dfrac{1}{M_{i}}\\ 0\end{bmatrix} \]  
\[C_{i}= \begin{bmatrix}0\ \ 0\ \ \beta_{i}\ \ 0\end{bmatrix} \]  
where \(\Delta P_{i}^{S}\) and \(\Delta P_{i}^{m}\) represent the deviation of the governor valve position and the generator output power, respectively; \(\beta_{i}\) represents the frequency bias coefficient; \(\Delta f_{i}\) represents the deviation of frequency. \(\Delta P_{i}^{t}\) and \(\Delta P_{i}^{t}\) represent the deviation of the tie-line power and the load fluctuation, respectively; \(D_{i}\), \(R_{i}\), and \(M_{i}\) represent the generator unit damping coefficient, the speed drop, and the inertia of the synchronous machine, respectively; \(T_{ij}\) is the synchronizing coefficient between area \(i\) and area \(j\); \(T_{i}^{t}\) and \(T_{i}^{S}\) represent the time constants of the turbine and the governor, respectively; \(G_{i}\) is a constant known matrix representing the distribution matrix of the bounded measurement noise \(\omega_{i}(t)\). Notice that the generating units are transformed into an equivalent unit in order to reduce the model complexity. A model fitting method can be used to transform the multi-unit into an equivalent unit. The details of the model fitting are given in [25] and omitted here due to space limitations. The time-varying uncertainties of \(A_{i}\) and \(B_{i}\) satisfy  
\[\Delta A_{i}(t)=\Phi\sigma(t)\Psi_{a} \tag{2}\]  
\[\Delta B_{i}(t)=\Phi\sigma(t)\Psi_{b} \tag{3}\]  
\[\sigma(t)^{T}\sigma(t)\leq I \tag{4}\]  
where \(\Phi\), \(\Psi_{a}\), and \(\Psi_{b}\) are the distribution matrix of the variation vector \(\sigma(t)\). In this paper, we only focus on the situations in which \((A_{i}+\Delta A_{i}(t))\) is asymptotically stable.