## 4 FDI Attacks on the AC/DC Multi-Area LFC System with Virtual Inertia
### A Type of Stealthy FDI Attack on the Test LFC System: Zero-Dynamics Attack  
For the stationary FDI attacks above, though the intelligent ones with enough system knowledge and vast attack resources can remain undetected from data quality checking programs, advanced detection schemes can still be developed to reveal their occurrence. In [32], we have proposed an anomaly detector for the detection, isolation, and even recovery of both stationary univariate and multivariate FDI attacks. In this subsection, we further explore the possibility of a type of FDI attack that can be stealthy with respect to arbitrary anomaly detectors. This comes to a type of dynamic (time-variant) FDI attack called _zero-dynamics attack_. Within a zero-dynamic attack strategy, the attacker can make the system outputs zero but drive the state (e.g., frequency of each area) trajectory of the underlying system (i.e., the test LFC system interconnected by AC/HVDC transmission lines and equipped with ESS for inertia emulation) to a possible unsafe set (e.g., the MFD defined in the previous subsection reaches a certain value that can mislead to wrong system operations). As the system outputs also act as inputs to an arbitrary anomaly detector, the diagnostic signal of the anomaly detector would not be able to trigger alerts for this type of attack when the system outputs are zero. To formalize the attack scenario, we introduce the following definition based on the work in [42]. **Definition 1**. : _[Zero-dynamics attack] An FDI attack \(\mathbf{f}[k]\) is called zero-dynamics attack if the corrupted system output \(\tilde{\mathbf{y}}\) in (29) satisfies \(\tilde{\mathbf{y}}[k]=0\) for \(k\in\mathcal{T}_{f}\). Without less of generality, we let \(\mathcal{T}_{f}\) be the time interval \([0,\,T_{f})\)._  
That is to say, one cannot decouple such an FDI attack from the system outputs, and therefore it can not be detected by an arbitrary anomaly detector. It has been shown in [42] that the attack sequence that makes the outputs identically zero for all \(k\in T_{f}\) is given by  
\[\mathbf{f}[k]=z_{0}^{k}\mathbf{f}_{0}\,, \tag{32}\]  
where \(z_{0}\) is the system zero and \(\mathbf{f}_{0}\) is the corresponding input zero direction. Considering the LFC system model in (30) under FDI attacks, such a signal \(\mathbf{f}[\cdot]\) in (32) can be checked by using the Rosenbrock system matrix and correspondingly the input zero direction for a system zero \(z_{0}\in\mathbb{C}\) can be obtained, according to the work in [42]. This can be written as  
\[\mathbf{P}(z)= \begin{bmatrix}\mathbf{A}_{cl}-z\mathbf{I}&\mathbf{B}_{d}&\mathbf{B}_{f}\\ \mathbf{C}&\mathbf{0}&\mathbf{D}_{f}\end{bmatrix} \,,\quad\mathbf{P}(z_{0}) \begin{bmatrix}\mathbf{ x}_{0}\\ \mathbf{d}_{0}\\ \mathbf{f}_{0}\end{bmatrix} =\mathbf{0}\,. \tag{33}\]  
It can be observed that \(\mathbf{f}[k]=z_{0}^{k}\mathbf{f}_{0}\) is a zero-dynamics attack if and only if there exists \(\mathbf{x}_{0}\in\mathbb{C}^{n_{x}}\) and \(\mathbf{d}_{0}\in\mathbb{C}^{n_{d}}\) that satisfies (33). This implies that the zero-dynamics attack \(\mathbf{f}[k]=z_{0}^{k}\mathbf{f}_{0}\) is stealthy only if there is a simultaneous disturbance signal \(\mathbf{d}[k]=z_{0}^{k}\mathbf{d}_{0}\) and initial state \(\mathbf{x}[0]=\mathbf{x}_{0}\). Note the fact that the disturbance signal in the LFC system model of (30) represents load changes. Thus it may be infeasible for the case \(\mathbf{d}[k]=z_{0}^{k}\mathbf{d}_{0}\) in practice. However, one can consider a scenario where the loads keep constant while a zero-dynamics attack \(\mathbf{f}[k]=z_{0}^{k}\mathbf{f}_{0}\) is launched by the attacker to make system outputs zero. Such a zero-dynamics attack can be obtained from the following equation,  
\[ \begin{bmatrix}\mathbf{A}_{cl}-z_{0}\mathbf{I}&\mathbf{B}_{f}\\ \mathbf{C}&\mathbf{D}_{f}\end{bmatrix}\begin{bmatrix}\mathbf{x}_{0}\\ \mathbf{f}_{0}\end{bmatrix} =\mathbf{0}\,.