## 5 Case Study
### Denial of Service (DoS) Attack  
#### 5.3.1 Delay of Measurement (DoM) Attack  
As illustrated in Figures 18 and 19, the active power response from LCC#2 showed an exactly similar response to that reflected in the DC current operation. Furthermore, as mentioned in the previous section regarding cyber attack detection, DC current was used as the detection parameter. In a real application, the power system operator could easily monitor the DC current value through a sensor system. In terms of multi-infeed DC operations, the power system operator should monitor several lines, e.g., three lines in the Korean power system. Cyber attack detection should consider two-state operations, i.e., the current and prediction of the current value. In this study, DC current prediction was calculated using the normalized correlation concept. If there was a difference value between the current and prediction state, the attack operation was detected, and mitigation control should be approached with regard to the algorithm of cyber mitigation attack control.  
In the case of the DoM attack, as described in Figure 15, the actual current showed a different response from the prediction value. Naturally, power system operators should mitigate this problem. The proposed algorithm as described in Figure 12 could easily maintain the security of the balancing arrangement by adjusting the value of the ramp-rate operation. Moreover, a remarkable difference could be seen in mitigation control in the system. Mitigation control was activated in VSC#3 based on an adaptive droop application in a multi-infeed dc system. An adaptive droop calculation was calculated from the deviation of actual current according to Equation (9). Even though mitigation control was activated, there was complexity due to the characteristic of attack operation, especially at one rectifier station. Load-frequency control within the MIDC system majorly changed. This situation is exactly similar to those shown in Figures 18 and 19; when the  
Figure 18: LCC active power response in the delay of measurement attack operation.  
current through LCC was delayed, mitigation control automatically made an increment value of the current in the VSC line.  
On the other hand, adjustment of additional power through VSC is also important, such as decrement, especially when additional power through the LCC line reaches a certain value and is consistent. In addition, the effect of the proposed methodology is described through the enhancement of frequency nadir value in the Jeju Island system. Moreover, the detailed description of the DoM attack and mitigation control is explained in the following section.  
As shown in Figures 20 and 21, mitigation control is important when a delay of measurement attack has occurred. This situation could be determined through minimum frequency nadir, which must be applied in Jeju Island, i.e., 59.2 Hz. This frequency is important for standard evaluation because if the actual frequency value is lower than standard, load shedding must be active. However, a delay of measurement attack for 1.1 s could be tolerated due to the frequency nadir value remaining higher than 59.3 Hz. Moreover, the mitigation control showed exceptional improvement, which could improve the deviation of a frequency response by up to 0.82 Hz.  
Figure 19: VSC active power response in the delay of measurement attack operation.  
Figure 20: Jeju Island frequency in the delay of measurement attack operation.