# Undetectable Relentless Incremental GPS-Spoofing Attack on Time Series PMU
Measurements and Detection Model

Imtiaj Khan
Electrical and Computer Engineering
Virginia Tech
Blacksburg, VA, USA
<EMAIL_ADDRESS>Virgilio Centeno  Electrical and Computer Engineering
Virginia Tech

###### Abstract

The Phasor Measurement Unit (PMU) is an important metering device for smart
grid. Like any other Intelligent Electronic Device (IED), PMUs are prone to
various types of cyberattacks. However, one form of attack is unique to the
PMU, the GPS-spoofing attack, where the time and /or the one second pulse (1
PPS) that enables time synchronization are modified and the measurements are
computed using the modified time reference. This article exploits the
vulnerability of PMUs in their GPS time synchronization signal. At first, the
paper proposes an undetectable gradual GPS-spoofing attack with small
incremental angle deviation over time. The angle deviation changes power flow
calculation through the branches of the grids, without alerting the System
Operator (SO) during off-peak hour. The attacker keeps instigating slow
incremental variation in power flow calculation caused by GPS-spoofing
relentlessly over a long period of time, with a goal of causing the power flow
calculation breach the MVA limit of the branch at peak-hour. The attack is
applied by solving a convex optimization criterion at regular time interval,
so that after a specific time period the attack vector incurs a significant
change in the angle measurements transmitted by the PMU. Secondly, while the
attack modifies the angle measurements with GPS-spoofing attack, it ensures
the undetectibility of phase angle variation by keeping the attack vector less
than attack detection threshold. The proposed attack model is tested with
Weighted Least Squared Error (WLSE), Kalman Filtering, and Hankel-matrix based
GPS-spoofing attack detection models. Finally, we have proposed a gradient of
low-rank approximation of Hankel-matrix based detection method to detect such
relentless small incremental GPS-spoofing attack. The results demonstrate the
failure of WLSE and Kalman Filtering models in the detection of proposed
relentless GPS-spoofing attack. While Hankel-matrix based model provides
insights on phase angle variation during such attack, the proposed gradient of
low-rank approximation of Hankel-matrix based detection model can perform
significantly better and can detect the proposed attack model conclusively. We
tested the proposed attack schemes and the detection models with simulated
measurements of IEEE 24 bus RTS om PSS/E and MATLAB.

###### Index Terms:

PMU, Cyberattacks, Undetectable, GPS spoofing, Timestamp, Relentless, Hankel.

##  I Introduction

Introducing smart metering and protective devices brought a revolution in the
traditional power grid. A smart grid comprises of two parts: a physical part
which is the conventional power grid and a control center which receive data
and takes decision based on the data it received, combination of both part is
referred as Cyber-Physical System (CPS). In a typical CPS, Supervisory Control
And Data Acquisition (SCADA) and Advanced Metering Infrastructure (AMI) are
utilized in a two-way communication system between physical power system and
control center at the cyber layer [1]. The control center monitors any
fluctuation or economic dispatch, unit commitment and optimal power flow (OPF)
[2].

More advanced and complicated CPS require fast and accurate Intelligent
Electronic Devices (IEDs), one such example is Phasor Measurement Unit (PMU),
which is relatively newer type of metering device providing voltage and
current magnitudes and phase angles in a time synchronized format [3]. The
measurement data provided by PMUs are time-tagged with Universal Time
Coordinate (UTC) and the time information include second-of-century (SOC)
count, fraction-of-second (FRACSEC) count, and time quality flag. The time
information is synchronized with a reliable time-source and the most common
time-source is the Global Positioning System (GPS). In addition to the
magnitudes and phase angles of voltage and current components, PMUs also
provide frequency and Rate of Change of Frequency (ROCOF) data [4]. Installing
PMU in the smart grid created a new horizon in terms of accuracy and speed [5]
[6]. In conventional SCADA based system, data transfer rate is one sample per
second, where in PMU the data transfer rate is 30 to 120 sample per second [7]
[8].

Despite being reliable in terms of time-tagged data and accuracy, PMUs are
still susceptible to various type of cyber attacks [9] [10] [11]. The most
common type of cyber attack against PMU, similar to other IEDs and network
system, is the malicious data injection attack such as false data injection
attack (FDIA). Other common types of cyberattacks include data modification
and replay attacks [12]. In FDIA, the attacker injects bad data into the
system and thereby modifying the power system data fed into the control
centre. If the state estimation is performed with falsified data, the System
Operator (SO) at control centre may take wrong decision such as taking
restorative action or emergency shut down even though the operating condition
is not actually violated. Another frequent type of attack that can hamper PMU
integrated grid performance is Denial of Service (DoS) attack. In this case
the attacker injects large volume of data through the communication channel,
therefore the data transfer to destination gets blocked due to the large
volume of data traffic [13] [14]. Man In the Middle (MITM) and Side Channel
attacks are also critical for PMU [15] [16].

Since PMU relies on GPS signal for time synchronization, it opens the
possibility of a new type of attack: GPS-spoofing attack. PMU generally uses
public GPS which lacks the sophisticated protection scheme used for military
GPS. GPS-spoofing attack poses very serious concern over the cybersecurity of
the CPS [17]. It may affect the magnitude and the phase angle, however the
phase angle is the most susceptible portion of the synchrophasor, because
shift in the GPS 1 PPS, which is used as the common reference for all PMUS, is
reflected by the phase angle shift [18]. Slowly changing time reference for an
individual PMU slowly shift the phase angle data [19] [20] provided by the
particular PMU from a particular node. Gradual change of phase angle of a
particular node with respect to the other nodes in the grid can, in some
scenarios, provide incorrect information to a system operator (SO) at control
centre that may lead the SO take unnecessary actions. Moreover, the gradual
shift in phase angle measurements due to the GPS-spoofing attack has the
potential to impact any PMU base transmission line fault detection and
identification of event location [17].

The phase angle shift caused by the GPS-spoofing attack can affect a PMU based
transmission line differential protection scheme. As soon as the spoofed phase
angle crosses the threshold, the relay will trip despite the absence of an
actual violation of the operating constraint. In this way the attacker can
disrupt the normal operating condition of the grid, without creating any
physical change in the cyber-physical model. This phenomenon can be referred
as misoperation [21].

Several researchers focused on the protection of PMU integrated smart grid
against cyber attacks. Most works are based on detecting FDIA. Detection of
FDIA is similar to conventional Bad Data Detection (BDD) method [22] [23].
Conventional BDD algorithms observe the residuals of the measured and expected
variables and do statistical test to find the outliers. GPS-spoofing attack
can also be considered as a type of BDD, since modification in time reference
lead to the shift in phase angles. In GPS-spoofing attack, the voltage and
current magnitude may remain unchanged, depending on the algorithm employed by
the PMU manufacturer. As a result, it can be considered similar to a FDIA with
only the phase angle data modified.

Considering the defense strategy taken by control center, it is possible to
create attacks that are undetectable by BDD algorithms [24] [25]. This
statement is also true for GPS-spoofing attack if the attack is considered as
a variation of FDIA with corrupted phase angle data [26]. These types of
undetectable and stealthy attacks can still be prevented by placing PMUs into
optimal locations of the grid [27]. The goal of this article is to create an
GPS-spoofing attack, which cannot be prevented by optimal PMU placement or by
BDD algorithms. The key idea is to inject a shift in the phase angle by
creating and maintaining an effective delay in time reference of an individual
PMU. Doing so, the attacker will be able to change the phase angle difference
between the spoofed PMU and any other monitored PMU in the system. The sample
attack used in this article is made in such a way that, its impact on the
power flow calculation is insignificant for one instance of attack. The attack
is incrementally applied after some interval of time for over a specific time
period T.

The attackers’ goal is to eventually cause a significant impact on the SO’s
perceived power flow measurement after the time period T. During off-peak
hour, the power flow in the line under attack is well below its limit, as
indicated by the angle difference of the PMUs at the both ends of the line.
The SO will not suspect the power flow to exceed the limit at this time,
therefore a significant increase in the calculated power flow will alert the
SO about possible cyberattack. The attacker exploits this issue and over the
period T, at each time instance s/he creates insignificant increase in the
phase angle of a PMU at one end of the line, causing an insignificant increase
in the derived power flow through the line. The accumulative effect of the
increases grows larger over time, and after T, which can be made to coincide
with the peak load, if performed correctly the line power flow as determined
by the phase angle difference from PMU measurements exceeds the line’s limit.
At peak load-hour, the SO at the control centre is prepared for possible
operational limit violations in the physical grid, therefore if the calculated
power flow exceeds the line low limit at that time, the SO, considering a
physical cause for the event, may then take the protocols required for
operational limit violation despite the operational limit is not actually
violated. Therefore, the load-shedding or other restorative measures will be
taken, which will lead to a hamper in the supply of power to the critical
points of the grid.

The attacker starts the attack at the initial time $t_{0}$. The phase angle
shift $a_{0}$ generated by the spoofed signal will be derived by solving
optimization equation which aims at enabling the attack undetectable by
commonly used detection techniques that are discussed in section III. The
attacker creates a spoofed GPS signal to the PMU at bus $i$ and/ or $j$ at
$t_{0}$, introducing a time shift $\Delta t_{0}=\frac{a_{0}}{2\pi f}$ [28],
corresponding to the optimal phase angle measurement shift $a_{0}$ caused by
spoofing and system frequency $f$. The fast data transmission rate of PMUs,
along with the time required by optimization equation for undetectable attack,
put a constrain on the attacker regarding the knowledge of the target angle
$\theta_{i}$ and $\theta_{j}$. Assuming the time required to execute
optimization equation is $T_{s}$ sec., the attacker is required to have the
knowledge of $\theta_{i0}$ and $\theta_{j0}$ at least $T_{s}$ sec. ago. It is
practically impossible for the attacker to have the exact phase angle value of
a future timestamp. To circumvent this issue, attacker can exploits data
estimation or recovery techniques to accurately predict the phase angles of
the timestamp which is $T_{s}$ sec. later. At the timestamp $t_{0}-T_{s}$,
considering the $T_{s}$ sec. of computational time-lag, the proposed attack
model estimates the phase angles $\theta_{i0}$ and $\theta_{j0}$ of timestamp
$t_{0}$. Attacker solves the optimization equation for undetectable attack to
generate the optimal phase angle shift $a_{0}$ using the estimated
$\theta_{i0}$ and $\theta_{j0}$.

All the sampled measurements of PMU following the timestamp $t_{0}$ will carry
on this time shift in their measurements and the corresponding phase angle
measurements will be phase shifted by $\Delta\theta_{0}=2\pi f\Delta
t_{0}=a_{0}$. The next attack is initiated at time $t_{1}$, after S number of
samples. At time $t_{1}-T_{s}$, the attacker estimates the phase angle
measurements $\theta_{i1}$ and $\theta_{j1}$ for timestamp $t_{1}$. At
$t_{1}$, the attacker solves the optimization equation using previously
estimated phase angle measurements, ($\theta_{i1}$ and $\theta_{j1}$), to
compute the new attack value $a_{1}$. The corresponding time shift that the
attacker needs to introduce by GPS-spoofing will be $\Delta
t_{1}=\frac{a_{1}}{2\pi f}$ . The overall phase angle shift in the PMU
measurement for the next S number of samples becomes $\Delta\theta_{1}=2\pi
f\Delta t_{1}+\Delta\theta_{0}$. The power flow through the branch $i-j$ will
also deviate accordingly. The attacker keeps instigating the spoofing attack
for the following timestamps $t_{2},t_{3},....\text{until T}$, at which the
power flow through the branch $i-j$ reaches the peak value. The tempered power
flow, which kept increasing from the actual power flow in the previous
timestamps, suffers from maximum deviation and crosses the power flow limit of
the line $i-j$.

The main difference between the GPS-spoofing attack of the proposed model and
FDIA is that, in the conventional FDIA the attacker needs to get into the
cyber layer or breach network security to initiate the attack. In this model
the attacker is not required to breach network security, the attack is
launched by spoofing the GPS signal received by the PMU, and the attack is
outside of the cyber-physical system of the smart grid. In FDIA, the attacker
injects the false data into the cyber layer; however, in the GPS spoofing
attack model discussed in this work, the attacker doesn’t inject any falsified
measurement, rather s/he forces the PMU algorithm to introduce a phase shift
in the computed phasor by disrupting GPS signal received by the PMU’s GPS
receiver. Instead of altering the phase angle measurement directly, the GPS
spoofing attack shifts the 1 Pulse-Per-Second (PPS) signal used by the PMU for
time reference, and this shift in 1 PPS reference signal is reflected by a
small change in phase angles for the phasors computing until the next 1 PPS is
received. The overall topological structure of the GPS-spoofing attack
considered in this work can be depicted in fig 1.

The contribution of this work has four aspects: firstly, we utilize a Hankel-
matrix based data recovery technique, that estimates phasor measurements of
the future timestamp which is $T_{s}$ later. Secondly, with the pre-estimated
phasor measurements, the attacker calculates the phase angle shifts using
optimization equation for each 1 PPS of the GPS receiver with a goal of
keeping the small individual change in phase angle measurement undetectable by
most bad data detection algorithms. The constraints of this optimization
method is similar to stealthy FDIA methods discussed in previous literature.
However, existing stealthy FDIA algorithms considered the attack vector to be
greater than a significance threshold $\zeta$, whereas the proposed method in
this article consider the attack vector to be less than $\zeta$ to create
insignificant variation in the phase angle measurements at each time instance.
Our proposed model creates an attack that has the objective of slowly shifting
a PMU angle to achieve a maximum impact at the peak loading time of a line
monitored by two PMUs. In conventional FDIA, attack values at each timestamp
are discrete from the previous ones; however, in the proposed GPS-spoofing
model the phase shift $\theta_{m}$ at each affected timestamp $t_{m}$ is
maintained over 1 PPS and added up to the phase shifts incurred by the
previous attacks $\sum_{k=1}^{m}\theta_{k-1}$ that was introduced at the
corresponding 1 PPS signals at the timestamps $t_{0},t_{1},...t_{m-1}$.
Finally, we have proposed a novel gradient of low-rank approximation error of
Hankel-matrix based relentless incremental GPS-spoofing attack detection
method and verified the effectiveness of proposed detection model.

Figure 1: GPS spoofing attack structure

The paper is organized as follows: Section II briefly discusses the data
estimation technique utilizing Hankel-matrix based missing data recovery
model. Section III explains the proposed undetectable attack scheme.The
conventional Bad Data Detection (BDD) techniques as well as proposed novel
gradient of low-rank approximation error of Hankel-matrix based detection
model is discussed in section IV. The test setup for the proposed stealthy
attack is discussed in section V. Section VI provides the results depicting
the impact of the proposed GPS-spoofing attack on the power flow calculations
as well as analyzes the performances of several BDD models, including the
novel gradient based model. Section VI concludes the work.

The main contribution of this article can be summarized as follows:

  * •

A relentless small incremental GPS-spoofing attack model is proposed targeting
the power flow calculations;

  * •

An optimization criterion is proposed to create an attack that is undetectable
against conventional BDD. and can incur a significant impact on the perceived
power flow between two nodes during peak load-hour by assuming an angle
stability limit in the constraint, even though the actual flow through the
same branch remain unchanged;

  * •

The undetectibility of the proposed GPS-spoofing attack at each affected
timestamp is tested against multiple BDD algorithms such as WLSE, Kalman
Filtering, and Hankel-matrix. Measurements with noise from the IEEE 24 bus RTS
in PSS/E are used to generator phasor measurements;

  * •

A gradient of low-rank approximation error of Hankel-matrix based model is
proposed and tested to detect such relentless small incremental GPS-spoofing
attack model;

##  II Estimation of Future Measurements

The first step of the proposed model is the estimation of phasor measurements
for future timestamp. Pre-estimation of measurements for future timestamp
works similarly as missing data recovery techniques. Several missing data
recovery models can be found in literature, such as spatial and temporal
OnLine Algorithm for Phasor data recovery models [29] [30], singular value
thresholding [31], JPT algorithm [32], supervised cascaded convolutional auto-
encoders [33], Iterative Adaptive Approach (IAA) [34], tensor decomposition
[35] etc. Even though the methods proposed in [31] \- [35] provide accurate
missing data recovery, they are applicable for off-line recovery only. Online
algorithm with temporal singular vector proposed in ref [30] provide
relatively higher accuracy than the algorithm with spatial singular vector
[29]. A more advantageous missing data recovery method was proposed in [36]
using low-rank Hankel structure. This method has the ability to estimate
larger number of missing data than the method proposed in [30]. Furthermore,
the Hankel-matrix based algorithm can correct consecutive bad data as well as
help the system operator distinguish GPS-spoofing attack from conventional
FDIA [37]. The Hankel-matrix based missing data recovery model takes phasor
measurements from PMUs as input, and subsequently perform low rank
approximation to estimate the next measurement. The first step of Hankel-
matrix based model is to create measurement matrix Z, containing phasor
measurements over $\tau$ consecutive time instances as in eqn. 5.

$\displaystyle\begin{matrix}\textbf{Z}=[z_{1}z_{2}....z_{\tau}]\end{matrix}$
(1)

The Hankel-matrix is created by shifting each row to one data point left from
the previous row. From the measurement matrix Z, the Hankel-matrix $H$ can be
created with varying number of rows $\kappa$, constituting a
$\kappa\times\tau-\kappa+1$ matix as in eqn 2.

$\displaystyle H=\begin{bmatrix}z_{1}&z_{2}&...&z_{\tau-\kappa+1}\\\
z_{2}&z_{3}&...&z_{\tau-\kappa+2}\\\ ...&...&...&...\\\ ...&...&...&...\\\
z_{\kappa}&z_{\kappa+1}&...&z_{\tau}\end{bmatrix}$ (2)

The low rank approximation is defined as converting the original matrix H into
a new matrix with lower rank $r$, where $r<rank(\textbf{H})$. The low rank
approximation is performed by taking first r largest singular values from the
Singular Value Decomposition (SVD) of H, which is $U\Sigma V^{*}$. The low
rank approximated matrix $\bar{\textbf{H}}$ is created with rank-$r$ matrix
$U\Sigma^{r}V^{*}$. The low rank approximation error is defined as eqn 3.

$\displaystyle
e^{r}(\textbf{H})=\frac{||U\Sigma^{r}V^{*}-\textbf{H}||_{F}}{\textbf{H}}$ (3)

To estimate missing data at the time instance $\tau+1$ using the measurements
from previous $\tau$ time instances, the state variable $d$ is predicted using
the following relation [30]:

$\displaystyle\hat{d}=(\hat{U^{r}}^{T}\ast\hat{U^{r}})^{-1}\hat{U^{r}}\ast\bar{\textbf{H}}$
(4)

where $\hat{U^{r}}$ is the first $r$ dominant left singular matrix from $U$.
For each PMU channel $i$, where $i=1,2,...,M$, $M$ being the number of PMU
channels, the data at time instance $\tau+1$ is estimated from
$\hat{U^{r}}\hat{d}$.

Assuming the PMU channel I contains missing data at the time instance
$\tau+1$. The system operator (SO) at the control center fills the missing
data at that time instance with estimated measurement. The measurement at time
$\tau+1$ is expressed as $\hat{z_{\tau+1}}=\hat{U^{r}}\hat{d}$.

During physical event or certain cyberattack causing data-drop through
communication channel, it is possible to have consecutive missing data in the
measurement stram sent by PMUs to the PDCs. To tackle this scenerio, the
consecutive missing data is estimated using the previously estimated missing
data. To estimate missing data at the time instance $\tau+2$, measurement
matrix similar to eqn 5 is created with measurements stream from $z_{2}$ to
$\bar{z_{\tau+1}}$. The estimated measurement $\bar{z_{\tau+2}}$ is derived
using the term $\hat{U^{r}}\hat{d}$, there $\hat{d}$ is new estimated state
variable with updated measurement matrix.

The estimated measurements using low rank approximation of Hankel-matrix
provide accurate recovery of consecutive missing data, however, the accuracy
declines for very large number of consecutive missing data. A properly tuned
Hankel-matrix provides upto $99.8\%$ accuracy when consecutive missing data
constitutes $40\%$ of the measurement matrix [36].

The proposed undetectable GPS-spoofing attack model relies on phasor
measurements in real-time to solve the optimization algorithm aiming at
shifting the time reference for PMUs. The computational time of the
optimization algorithm puts an obstacle to the attacker in the way of spoofing
the GPS signal in real-time. Therefore, instead of solving the optimization
algorithm in real-time, the attacker take the computational delay into
consideration and solve the optimization criterion few timestamps ahead of the
actual timestamp when the shift in time reference due to GPS-spoofing attack
takes place. It is physically impossible to have the exact measurement
information beforehand; as a result, the attacker of the proposed model
depends on predicting measurements few timestamps in future and solve the
optimization algorithm to figure out the required shift in timestamp to
instigate undetectable GPS-spoofing attack.

##  III Formulation of Undetectable Timing Attack

During GPS-spoofing attack, the time synchronization with GPS signal is
distorted and the PMUs start sending measurements of shifted timestamp to
PDCs. Due to the change in horizontal time-axis, the most affected part of
phasor measurement is the phase angle under GPS-spoofing attack; in contrast
to only a slight change in the magnitude measurements. The SO needs to apply
bad data detection algorithm on phase angle measurements particularly, rather
than looking at the magnitudes, in order to identify the existence of any
consecutive bad data caused by GPS-spoofing attack. This requirement can be
exploited by the attacker. The key idea is that the attacker needs to shift
the time reference by a very small amount, which causes very small deviation
in phase angle measurements, subsequently making the attack undetected by the
SO. If the attacker keeps shifting the time reference by this small amount
after each second over a period of time, there will be a significant amount of
shift in time reference after the whole period. From the perspective of SO, it
is not possible to detect this shift in GPS 1 PPS time reference by performing
state estimation based bad data detection on phasor measurements after each
millisecond or fractions of second, since the shift in GPS 1 PPS time
reference satisfies the undetectibility constraints of state estimation based
method.

###  III-A Optimizing Attack Vector

The most common bad data detection method employed at the control center is
Weighted Least Squared Error (WLSE) based state estimation. The undetectable
attack model in this work focuses on circumventing the WLS based state
estimation technique.

For an n bus system, the state variable at a specific time instance can be
represented as the vector $\textbf{x}=[x_{1},x_{2},....x_{n}]$ and the
measurement variables can be represented with the vector
$\textbf{z}=[z_{1},z_{2},....z_{m}]$. Here m is the number of meters (m$>>$n).
The relation between z and x can be expressed as

$\textbf{z}=\textbf{H}\textbf{x}+e$ (5)

H is the Jacobian matrix that represents the non-linear relation between the
state variable and the measurement variable. $e=[e_{1},e_{2},....e_{m}]$ is
the measurement error vector. An FDIA will go undetected if
$||z-H\hat{x}||_{2}$ is less than threshold $\tau^{r}$, $\hat{x}$ being the
estimated state variable which can be calculated from the Weighted Least
Square (WLS) method $\hat{x}=(H^{T}R^{-1}H)^{-1}H^{T}R^{-1}z$. R is the
measurement error covariance matrix. If the attack a vector is applied during
FDIA, the measurement vector under attack will be $z_{a}=z+a$ and the
estimated state variables under attack will be $\hat{x_{a}}=\hat{x}+c$. The
estimated attack vector is $c=(H^{T}H)^{-1}H^{T}a$. After injecting the attack
vector, $||z_{a}-H\hat{x_{a}}||_{2}$ = $||z+a-H\hat{x}-Hc||_{2}$ $\leq$
$||z-H\hat{x}||_{2}$ \+ $||a-Hc||_{2}$. For a carefully crafted attack vector,
such as $a=Hc$, the estimation residual becomes
$||z_{a}-H\hat{x_{a}}||_{2}\leq\tau^{r}$. As the estimation residual becomes
less than threshold $\tau^{r}$, the SO fails detect FDIA [27].

The attacker goal is to make the term $||a-Hc||_{2}$ as small as possible so
that $||z_{a}-H\hat{x}_{a}||_{2}$ remains less than the threshold $\tau^{r}$.
$a-Hc$ can be written as $Fa$, where the term $F=(H(H^{T}H)^{-1}H^{T}-I)$. The
attacker needs to satisfy the following criterion:

$\begin{array}[]{rrclcl}\displaystyle\min_{a}&||Fa||_{2}\\\ \end{array}$ (6)

To avoid getting detected, the term $||Fa||_{2}$ needs to be between
$\tau^{r}$ and $||z-H\hat{x}||_{2}$ and the attacker must satisfy the
following optimizer:

$\begin{array}[]{rrclcl}\displaystyle\min_{a}&||Fa||_{2}\\\
\textrm{s.t.}&||Fa||_{2}\leq\tau^{r}-||z-H\hat{x}||_{2}\\\ \end{array}$ (7)

Assume the impact threshold of attack vector is $\zeta$, implying if the
attack vector is greater than this value, there will be a significant impact
on the system, else the attacker cannot inflict any damage to the grid. To
avoid detection, the attack vector a must be less than impact threshold during
each time instance, however the total impact, after the phase angle deviation
at every time instance being added up, will be significant at the end of total
time period T. For each time instance, the attacker has to satisfy the
following:

$\begin{array}[]{rrclcl}\displaystyle\min_{a}&||Fa||_{2}\\\
\textrm{s.t.}&||Fa||_{2}\leq\tau^{r}-||z-H\hat{x}||_{2}\\\ &||a||_{1}<\zeta\\\
\end{array}$ (8)

Each time instance can be depicted as index i; i = 1,2,….,T. T = total time
period. Therefore for the whole time period the optimization criteria becomes:

$\begin{array}[]{rrclcl}i=1:T&\\{\\\
\displaystyle\min_{a_{i}}&||Fa_{:,i}||_{2}\\\
\textrm{s.t.}&||Fa_{:,i}||_{2}\leq\tau^{r}-||z_{:,i}-H\hat{x}_{:,i}||_{2}\\\
&||a_{:,i}||_{1}<\zeta\\\ \\}\\\ \\\ &\sum_{i=1}^{T}||a_{i}||_{1}>\zeta\\\
\end{array}$ (9)

The next challenge is to find the impact threshold $\zeta$. The $\zeta$ must
be less than the $\ell_{1}$ norm of the attack vector for single time instance
to avoid detection, but it must be greater than the sum of the $\ell_{1}$ norm
of the attack vector over the total T period of time to incur damage to grid
operation. Since the $||a||_{1}$ can takes the value between 0 to $\zeta$ at
each time instance, it should be between $\zeta/T$ and $\zeta$ so that the
$\sum_{i=1}^{T}||a_{i}||_{1}>\zeta$ condition is satisfied.

The optimizer 9 becomes:

$\begin{array}[]{rrclcl}i=1:T&\\{\\\
\displaystyle\min_{a_{i}}&||Fa_{:,i}||_{2}\\\
\textrm{s.t.}&||Fa_{:,i}||_{2}\leq\tau^{r}-||z_{:,i}-H\hat{x}_{:,i}||_{2}\\\
&\zeta/T<||a_{:,i}||_{1}<\zeta\\\ \\}\\\ \end{array}$ (10)

In the optimization criteria 10, mentioning the suffix $i$ is redundant, since
if the attack vector at each time instance satisfies
$\zeta/T<||a_{:,i}||_{1}<\zeta$, the impact will be automatically greater than
threshold over the whole time period T. Additionally, $\zeta/T$ can be
replaced as $\zeta^{\prime}$. Since the eqn 10 is a convex, there exists a
global minima that corresponds to the attack vector satisfying undetectibility
constraint. For the second inequality constraint, the solver needs to search
the point in a wide range of values between $\zeta^{\prime}$ and $\zeta$,
depending on the size of time period T. The second inequality constraint can
be computationally simplified by making the attack vector within the range
$\zeta^{\prime}$ to $\zeta^{\prime}+\epsilon$, where $\epsilon$ is a small
positive integer. In this case, the the solver needs to search for the optimum
attack vector within small range of constraints.

###  III-B Determining Impact Threshold

The next challenge is to find the impact threshold $\zeta^{\prime}$. The
impact must not exceeds the operating limit of the power system. For an
instance, if the operating constraint is violated, the control center will be
aware of the situation earlier than the expected and will take restorative
action before the target is achieved by the attacker. The operating limits of
the power system are:
Branch current limit between the bus i and bus j,

$-I_{lim}\leq I\leq I_{lim}$

Power flow limit between the bus i and bus j,

$-P_{lim}\leq P\leq P_{lim}$

The power flow between two buses generally depends on the voltage magnitudes
of the two nodes, the phase angles of two nodes and the line admittance
between the nodes. In AC power flow model, real power flow between the bus i
and bus j will be:

$\begin{gathered}P_{ij}=V_{i}^{2}(g_{si}+g_{ij})-V_{i}V_{j}[g_{ij}cos(\theta_{i}-\theta_{j})+\\\
b_{ij}sin(\theta_{i}-\theta_{j}]\end{gathered}$ (11)

$g_{si}$ is the shunt conductance at bus i, $g_{ij}$ is the line conductance
between bus and bus j, and $b_{ij}$ is the line susceptance between bus i and
bus j. $V_{i}$ and $V_{j}$ are the voltages at bus i and j respectively. For
simplicity, the DC power flow model has been considered in this work. In the
DC power flow model the voltage phase difference are very small
$(\theta_{i}\approx\theta_{j})$ and the voltage magnitudes at buses i and j
are normalized to unit. The state variable x constitutes with the voltage
phasors
$(x=[V_{1}\angle\theta_{1},V_{2}\angle\theta_{2},....V_{n}\angle\theta_{n}])$;
n = total number of buses. Only power that comes into consideration is the
real power in DC power flow model. The reactance of the line between i and j
is $x_{ij}$ and the line resistance is $r_{ij}$, as a result the susceptance
$b_{ij}=\frac{-x_{ij}}{r^{2}_{ij}+x^{2}_{ij}}$. The line resistance is
considered to be negligible in DC power flow model, which implies $r<<x$.
Hence the susceptance can be approximated as $b_{ij}\approx-1/x_{ij}$.
The power flow between the bus i and j in DC model can be expressed as
follows:

$\displaystyle\begin{gathered}P_{ij}=-V_{i}V_{i}sin(\theta_{i}-\theta_{j})b_{ij}\\\
\approx sin(\theta_{i}-\theta_{j})/x_{ij}\\\
\approx\frac{\theta_{i}-\theta_{j}}{x_{ij}}\end{gathered}$ (15)

In the attack model described in the previous subsection, attack vector a
consists of two elements (since two phase angles are required to be shifted in
order to create meaningful attack vector[26]). The $\ell_{0}$ norm of vector
$a$ is 2. Elements of attack vector a represents the shift in voltage phase
angle at different buses. Assuming two attack targets bus i and bus j, the
corresponding shift in phase angles are represented by $a_{i}$ and $a_{j}$.
After the attack, the new power flow will be:

$\displaystyle\begin{gathered}P^{\prime}_{ij}=\frac{\theta_{i}+a_{i}-\theta_{j}-a_{j}}{x_{ij}}\\\
=\frac{\theta_{i}-\theta_{j}}{x_{ij}}+\frac{a_{i}-a_{j}}{x_{ij}}\\\
=P_{ij}+\frac{a_{i}-a_{j}}{x_{ij}}\end{gathered}$ (19)

To make the power flow between bus i and bus j within the power flow limit,
$P^{\prime}_{ij}$ must be less than $|P_{lim}|$. The second constraint of the
eqn 8 can be rewritten as:

$\displaystyle\begin{gathered}\frac{a_{i}-a_{j}}{x_{ij}}<|P_{lim}|-\frac{\theta_{i}-\theta_{j}}{x_{ij}}\end{gathered}$
(21)

The right hand term of the eqn 21 can be approximated as the impact threshold
$\zeta^{\prime}$. The optimization criterion from eqn 10 is modified to the
following form:

$\displaystyle\begin{gathered}\begin{array}[]{rrclcl}t=1:T&\\{\\\
\displaystyle\min_{a_{i}}&||Fa_{:,i}||_{2}\\\
\textrm{s.t.}&||Fa_{:,i}||_{2}\leq\tau^{r}-||z_{:,i}-H\hat{x}_{:,i}||_{2}\\\
&\zeta^{\prime}<||a_{:,i}||_{1}<\zeta^{\prime}+\epsilon\\\ &\epsilon>0\\\
\\}\\\ \end{array}\\\ \\\
\textrm{where},\zeta^{\prime}=x_{ij}\left[|P_{lim}|-\frac{\theta_{i,t}-\theta_{j,t}}{x_{ij}}\right]/T\end{gathered}$
(31)

To implement the attack, the attacker needs to solve the eqn. 31 at every time
instance $t_{i}$, that puts an obstacle for the attacker with the
computational time required by eqn. 31. Therefore the attacker needs to
predetermine the attack vector, specifically few times instance ahead of $i$,
to inflict the GPS-spoofing attack at exactly $i$. $T_{s}$ being the maximum
computational time required to solve eqn. 31, the attacker needs to determine
the attack vector at least a $t_{i}-T_{s}$ time instance to implement the
corresponding GPS 1 PPS shift at exactly $t_{i}$. If there exists $K$ number
of measurements between $t_{i}$ and $T_{s}$, the attacker must predict the
following $K$ phase angle measurements accurately to have prior knowledge
about the phase angle at $t_{i}$. To predict the $K$ number of data, the
proposed attack model exploits missing data recovery model described in
section II.

##  IV Test of Undetectibility

GPS-spoofing attacks impact the phase angle measurements most, therefore it
can be considered as FDIA targeting phase angle measurements only [38]. System
Operator (SO) looks for the uccessive bad data in the measurements to suspect
the occurance of FDIA, which makes FDIA detection similar to Bad Data
Detection (BDD). As discussed in section III, the most common Bad Data
Detection technique is the WLSE based state estimation method [39], where the
System Operator (SO) receives the measurements from the physical power system
and calculates the residuals between the actual measurement $z$ and the
estimated measurement $H\hat{x}$. The notation z, H and x are same as
discussed in III. The SO considers the measurements as suspicious if the
residual $||r||_{2}=||\hat{z}-H\hat{x}$ is less than a predetermined threshold
$\tau^{r}$.

Kalman Filtering (KF) [40] is an effective tool to detect bad data caused by
electrical events and FDIA. For a system, if the state variable is $x(t)$ and
the measurement variable is $y(t)$, the state variable at time $t+1$ can be
estimated from the previous state $x(t)$ using the following relation:

$x(t+1)=Ax(t)+w(t)$ (32)

KF estimates the state variables $\hat{x}(t)$ at time t using the state
variables and measurements upto t-1. P(t) is the covariance of estimates at
time t. The time updates of state variables and covariance matrix are
expressed as:

$\displaystyle x(t+1|t)=Ax(t)+w(t)$ (33) $\displaystyle
P(t|t-1)=AP(t-1)A^{T}+Q$ (34)

Consequently, the measurements are updated using the following relations:

$\displaystyle K(t)=P(t|t-1)H^{T}[HP(t|t-1)H^{T}+R]^{-1}$ (35) $\displaystyle
P(t|t)=P(t|t-1)-K(t)HP(t|t-1)$ (36)
$\displaystyle\hat{x}(t)=A\hat{x}(t-1)+K(t)[z(t)-H\hat{x}(t|t-1)]$ (37)
$\displaystyle P(t)=[I-K(t)H]P(t|t-1)$ (38)

$K(t)$ is the Kalman gain at time t. Starting from an initial condition
$\hat{x(0)}=0$ and $P(0)=\text{covariance matrix of: }\hat{x(0)}$, KF provides
a recursive calculation of state variables using minimized mean-squared error.
The residuals between the measurement $z(t+1)$ and the estimation
$H\hat{x}(t+1)$ is tested against predefined threshold $\tau^{k}$. If the
residual exceeds the predetermined threshold, it is perceived as a bad data.
The KF estimator generates better estimations of state variables than WLSE
based estimator [40]; however conventional FDIA may impact the estimation
performance, which can be avoided by updating measurement weighting function
$W(t)=R^{-1}$ using the following equation [41] :

$(W_{new}(t))^{-1}=(W(t))^{-1}\times e^{|z(t)-H\hat{x}(t|t-1)|}$ (39)

The updated weighting function in eqn 39 increases the FDIA detection
probability for the deviation based KF approach compared to the conventional
KF estimator [42].

Hankel-matrix based bad data detection is another useful tool to detect the
existence of any anomaly in time-series measurements, which looks for bad data
over moving time-window [43]. Since the proposed attack scheme initiates a
gradual incremental variation in phase angle over time, Hankel-matrix based
BDD is an useful tool to detect such attacks. However, since the proposed
attack model modifies the phase angle measurements very slowly over time, and
the phase angle can deviate sharply during load change of peak-hour, it is not
sufficient to observe low-rank approximation error of Hankel-matrix alone for
the affected node to conclusively determine the occurrence of any attack.

###  IV-A Proposed Detection Model

In addition to the detection model proposed in [43], we have exploited the
spatial relation among the affected node and its topologically neighboring
nodes. Phase angle measurements variations during GPS-spoofing attack can be
identified using the gradient change in the low-rank approximation error of
unwrapped phase angle measurements [43]. The key idea is: since the unwrapping
process, by linearizing phase angle measurements, cause a monotonous decrease
in low rank approximation error. Since any change in horizontal time-axis
created by GPS-spoofing attack will cause a shift in the transition between
$+/-\pi$ to $-/+\pi$, the unwrapped phase angle measurement will demonstrate
distortion in time series, subsequently causing a sharp change in gradient.
However, the gradient change of low-rank approximation error of a single node
is not enough evidence that the measurements from that node are under
attacked.

For any load variation driven angle deviation of a particular node, it is
expected that such angle-variation will be propagated to the neighboring
location of the grid. Therefore, the affected node should show similar
gradient change, either positive or negative, as the neighbouring nodes in
low-rank approximation error of unwrapped phase angle measurements. For GPS-
spoofing attack targeting a particular node, the gradient change in low-rank
approximation error for that particular node is opposite to the gradient
change in low-rank approximation error of neighboring or topologically
connected nodes. We can analytically express the relation between the change
of gradient in low-rank approximation error among node $i$ and all other M
nodes that are physically connected to $i$ as below:

$\displaystyle\frac{Gr_{i}}{|Gr_{i}|}\neq\frac{Gr_{j}}{|Gr_{j}|}$ (40)
$\displaystyle Gr_{k}=\frac{\Delta L_{k}}{\Delta t}$ (41)

Where $L_{k}$ = Unwrapped voltage/current phase angle measurements of node
$k$.

##  V Experiment Method

The proposed undetectable attack has been tested on IEEE 24 bus reliability
test system [44]. The physical power system is simulated in PSS/E.

The attack vector $a$ corresponds to the voltage phase angle. The attacker
calculates the phase angle deviation required to instigate undetectable attack
described in section III, and then creates the corresponding time shift by
spoofing the GPS 1 PPS signal. The relation between the time shift $t_{d}$ and
corresponding specific angle variation $\Delta\theta$ can be written as:

$\Delta\theta=2\pi f_{0}t_{d}$ (42)

The optimization criterion described in eqn 31 is solved using MATLAB Yalmip
tool box. For each time instance, the phase angle shift required to satisfy
all the constraint in eqn 31 is computed by using the Yalmip solver. The
attack vector $a$ represents the required phase angle shift $\Delta\theta$ to
incur successful attack. The attack vector $a$ calculated with optimization
equation is added to the phase angle and power measurements extracted from
PSS/E.

The attacker solves the optimization algorithm of eqn. 31 at each time
instance using the phase angle measurements predicted $T_{s}$ sec. before
corresponding time instance. Before analyzing the attack model, the accuracy
of missing data recovery model to estimate future measurements needs to be
verified. To check the accuracy of measurement estimation, voltage phase angle
measurements are predicted consecutively. Hankel-matrix based missing data
recovery model requires several predetermined parameters. Generally, longer
measurement matrix is preferable, therefore a large value is preferable [36]
for the Hankel-matrix length $\tau$. We have tested a varying $\tau$ values to
check the estimation accuracy. The number of rows $\kappa$ in Hankel-matrix
depend on the matrix- length, a general rule of thumb being $\kappa=\tau/2$.
Ref [36] proposed eqn. 43 to choose the estimation threshold of Hankel-matrix
$\tau^{e}$, particularly for voltage phase angle.

$\tau^{e}=max(2,30e^{-3(t_{i}-t_{d})})\cdot\sum_{i=2}^{L}\frac{|\theta(i,t_{i})-\theta(i,t_{i}-1)|}{L-1}$
(43)

where L refers to the number of initial trusted measurements, t is time
instance, $t_{d}$ is the latest bad data occurrence time. The choice of L
depends on the attacker. Since the measurement matrix is of length $\tau$, and
the first estimation at time instance $\tau+1$ is performed with previous
$\tau$ measurements; the number of initial trusted measurments can be equal to
$\tau$.

To evaluate the undetectability of proposed phase angle shift caused by GPS-
spoofing attack, we have utilized the aforementioned BDD methods: conventional
WLSE residual test, Deviation based Kalman Filtering based residual test (DKF)
and Hankel-matrix based estimation residual test. The residuals between the
actual measurement and estimation using each method is tested with a
predetermined threshold. The threshold is determined using Largest Normalized
Residual test [2]. The predetermined threshold $\beta$ is chosen as 3 [2].
Finally, we test the effectiveness of the gradient-change in low-rank
approximation error among neighbouring node-PMUs, as discussed in subsection
IV-A.

For IEEE 24 bus RTS used for this work, load ($L_{1}$) at bus 13 is increased
incrementally by 50$\%$ of $L_{1}$ at 5 sec., at 9 sec., and at 13 sec. In
this way, a dynamic load varying condition is considered which behaves
similarly as off-peak and peak-hour of real-world load variation. Here 13 sec.
to 15 sec. duration is considered as peak-hour. The attacker instigate a small
shift in GPS 1 PPS over time period T, such that the perceived power flow
through the branch 13-23, which is calculated from DC power flow using the
shifted phase angle measurements at each end of the branch , increases. The
target is to make a significant impact on the calculated power flow during the
peak load after 13 sec. At this time, the calculated power flow through the
branch 13-23, perceived by SO, will cross the critical MVA limit of the
branch, even though the actual MVA is within the limit. The MVA rating of the
line 13-23 of IEEE 24 bus RTS is 500 MVA [44].

Since the attacker instigates small incremental deviation in phase angle over
time, it requires a long time for power flow to become large enough to cross
MVA limit. As a result, attacker starts the attack at much earlier time of the
peak-hour. In our simulation, the attacker starts the GSA from 2 sec.

##  VI Result

Before evaluating the proposed undetectable attack model, the Hankel-matrix
based data estimation model needs to be verified. The attacker predicts future
measurements to perform the optimization algorithm in order to create the
proposed undetectable attack. For L number of initial trusted measurements,
the attackers starts estimating the $(L+1)^{th}$ measurement. The estimation
accuracy for continuous time instances is expected to decrease with time.
Nevertheless, it is necessary to determine the number of continuous
measurements that can be estimated accurately by the proposed model.

To test the feasibility of the data estimation model, we have performed
continuous estimation, starting at $(L+1)^{th}$ time instance, of voltage
phase angle measurement of bus 3 from the power system. A random Gaussian
noise with mean 0 and variance 0.5 is added to the measurement to reflect the
measurement noise in real world.

Figure 2: Estimation accuracy with initial trusted measurement number, L = 20
Figure 3: Estimation accuracy with initial trusted measurement number, L = 30
Figure 4: Estimation accuracy with initial trusted measurement number, L = 50

All the data in the trusted measurement window after $2L$ time instances are
estimated measurements at previous time instances, As a result it is expected
that the gap between estimation accuracy and the threshold will be smaller.
This is confirmed from the results illustrated in fig 2 to 4. The optimization
algorithm of eqn 31 requires approximately $T_{s}=0.15$ sec. of computational
time. Since the PMU transmit 60 measurements per sec., it is sufficient for
the attacker to estimate $0.15\times 60=9$ measurements accurately, to ensure
the formulation of proposed attack model at time instance $t_{i}$. From the
figures 2 to 4, the estimation model can accurately estimate measurements with
substantial gap between the accuracy and threshold upto 25 continuous time
instance for the case of $L=50$. The attacker implements the estimation model
with 50 initial trusted measurements.

###  VI-A Impact on Power Flow measurement

At first, starting at 2 sec., the proposed optimization algorithm for each
time instance is executed and the corresponding optimal attack vector
$a_{op}=\theta_{0}$, which is the phase angle shift required to achieve the
target of misleading the power flow calculation, is determined. In the rest of
the paper, the term attack vector and phase angle shift will be used
interchangeably. Time-shifts (as in eqn. 42) are applied to the GPS 1 PPS
signal of the corresponding PMUs located at the bus 23, simulated by adding
corresponding optimized attack value $a_{op}$ to the voltage phase angle
measurements of bus 23. The power flow through the branch connecting the buses
13 and 23 is calculated using DC power flow equation. Since there is a
presence of time shift in the GPS 1 PPS into the corresponding PMUs at the
both ends of the branch connecting buses 13 and 23, the perceived power flow
through the branch will be different from the actual value.

In the second case, two random time shifts are applied to GPS signals received
by the corresponding PMUs located at buses 3 and 18 and the corresponding
power flow is calculated at each time instance, starting from 5 sec. The
attack vector in this case is $a_{rand}$.

Figure 5: Power flow calculation between bus 13 and bus 23 for $a_{op}$ over T
time period

Fig. 5 demonstrates the results obtained from applying GPS-spoofing attack
using proposed attack model. From fig. 5, we can observe that the perceived
power flow calculated using the shifted phase angle measurement is higher than
the actual power flow through the branch 13-23. for each time instance after
initiating attack at 2 sec. When the power flow through the branch increases,
the calculated power flow is also increased by a small amount, keeping the
calculated power flow within the line flow limit. After 14 sec, when the
maximum power flows through the branch at peak hour, the calculated MVA
exceeds the critical line flow limit, which is $95\%$ of 500 MVA. Therefore
the control center, thinking that critical MVA limit has been exceeded, will
be forced to take contingency actions despite the actual flow is within the
limit, and the branch 13-23 will be tripped.

From fig. 5, we can conclude that the attacker can successfully cause change
gradual change in power flow calculation by initiating an incremental GPS-
spoofing attack over a long time, and the attacker can make the perceived flow
calculation by SO exceed the flow limit for a particular branch, forcing the
SO react against a false alarm of critical flow limit breach.

###  VI-B Undetectibility Analysis

To check the detectibility of proposed attack scheme, normalized estimated
residuals at each timestamp is calculated using WLSE and DKF methods
separately. The state variable, $X$, is a $24\times 1$ matrix comprised of
voltage phase angles, and the Jacobian matrix, $H$, is $38\times 24$ bus
admittance matrix. The current measurement variable, $Z$, is a $38\times 1$
matrix representing the current flow through the 38 branches of IEEE 24 bus
RTS. Fig. 7 and 6 demonstrate the normalized estimation residuals obtained
using WLSE and DKF methods, respectively. The normalized estimation residuals
$||r||_{2}\||\Omega||_{2}$ at each timestamp is observed. From the results, it
is evident that the largest normalized residual is less than threshold
$\beta=3$ for both WLSE and DKF methods.

Figure 6: Normalized WLSE residuals between the observed and expected current
measurements through the branch between bus 13 and 23 Figure 7: Normalized DKF
residuals between the observed and expected current measurements through the
branch between bus 13 and 23

Results from fig. 7 and 6 indicates the undetectibility of the proposed attack
model using two of most commonly used robust detection techniques: WLSE and
DKF.

Hankel-matrix based detection model proposed in LABEL:rt detects distortion in
unwrapped phase angle measurements to determine the possiblity of GPS-spoofing
attack. To analyze the effectiveness of Hankel-matrix model, we have extracted
unwrapped phase angle measurements for both of normal condition, period of
time, and of gradual GPS-spoofing attack condition discussed in this article
over same 15 sec. time period. Estimation error using Low rank approximation
with moving time window of length $W=80$, $W=100$ and $W=120$.

Figure 8: Estimation error of Hankel-matrix under normal and attack conditions
over moving time window, W = 80 Figure 9: Estimation error of Hankel-matrix
under normal and attack conditions over moving time window, W = 100 Figure 10:
Estimation error of Hankel-matrix under normal and attack conditions over
moving time window, W =120

All three cases of different time-window lengths W, the attack condition
demonstrates spikes in estimation error using low-rank approximation of
Hankel-matrix. However, similar spike can be observed for phase angle
deviations due to load changes too. Therefore, the spikes in fig. 10 to
LABEL:hank3 are not conclusive evidence of GPS-spoofing attack.

###  VI-C Effectiveness of Gradient of Hankel-Matrix Model

As discussed in subsection IV-A, the comparison of change in gradient of low-
rank approximation error among neighboring PMUs can indicate small deviation
in phase angle measurements of a particular PMU measurements, implying a
possible GPS-spoofing attack.

Figure 11: Change in gradient of low-rank approximation error between Bus 13
and 23 Figure 12: Change in gradient of low-rank approximation error between
Bus 13 and 12

The change in gradient of low-rank approximation error between two buses is
demonstrated with boolen expression. The value $1$ signifies a change in
gradient of low-rank approximation error between two buses, and the value $0$
signifies unchanged condition. Fig. 11 shows that, the gradient changes
frequently after 2 sec. among the low-rank approximation errors of Hankel-
matrices of bus 13 and 23, using unwrapped phase angle measurements. However,
gradients of low-rank approximation errors of Hankel-matrices using unwrapped
phase angle measurements does not demonstrate any change among bus 13 and 12
(fig. 12). Similar changes are observed among bus 23 and 12, and bus 23 and
11, separately. The results imply the effectiveness of gradient of Hankel-
matrix model in the detection of proposed gradual undetectable GPS-spoofing
attack.

##  VII Conclusion

Despite providing efficient and accurate time-synchronized data, the Phasor
Measurement Unit (PMU) is prone to various types of cyberattacks. One of the
most critical cyber attacks against PMU is the GPS-spoofing attack, where the
reference signal for time-tagging is modified. This paper aims at developing a
stealthy GPS-spoofing attack, where the attacker inject very small scale shift
in the GPS 1 PPS signal at each timestamp, and gradually increases the
deviation. Since the effect of timestamp shift is reflected by a shift in
phase angle, the perceived power flow through a branch calculated using the
phase angle at the both ends of the branch is changed, even though the actual
power flow through the same branch remains unchanged. The attacker’s goal is
to increase the perceived power flow, and make the perceived power flow
exceeds the line flow limit at the peak hour.

At first, the paper proposes an undetectable relentless small incremental GPS-
spoofing attack scheme which is able to bypass the Bad Data Detection (BDD)
algorithm. The attack is applied by solving a convex optimization criterion at
regular time interval, so that after a specific time period the attack vector
incurs a significant change in the perceived power flow calculated with
shifted phase angles, hence forcing the SO take contingency actions. Secondly,
the proposed attack model is tested on the IEEE 24 bus RTS in PSS/E. The
corresponding impact on the calculated power flow through the branch
connecting buses 13 and 23 is observed. Load at bus 13 is varied to reflect
the off-peak and peak energy demand. Thirdly, the undetectability of the
proposed algorithm is tested against WLS, DKF and Hankel-matrix. The result
shows that the attacker can modify the perceived power flow through the branch
13-23 and make it cross the line flow limit at the peak hour (13 sec.).
Moreover, it can be observed that the proposed attack remains undetected
against WLSE and DKF methods. Even though Hankel-matrix model with unwrapped
phase angle measurements demonstrates spikes during gradual deviation of phase
angle over time, it cannot detect the proposed attack conclusively. Proposed
novel detection model, that compares the gradient of low-rank approximation of
Hankel-matrix among topologically connected node measurements, can
conclusively detect relentless small incremental GPS-spoofing attack.

## References

  * [1] M. M. Ahmed and W. L. Soo, “Supervisory control and data acquisition system (SCADA) based customized remote terminal unit (RTU) for distribution automation system,” PECon 2008 - 2008 IEEE 2nd International Power and Energy Conference, pp. 1655–1660, 2008.
  * [2] A. Abur and A. Gomex Exposito, “Power system state estimation : theory and implementation,” p. 327, 2004.
  * [3] A. G. Phadke and J. S. Thorp, “Synchronized Phasor Measurements and Their Applications,” 2017.
  * [4] IEEE Power & Energy Society, “IEEE Std C37.118.2-2011 (Revision of IEEE Std C37.118-2005) - IEEE Standard for Synchrophasor Data Transfer for Power Systems.,” IEEE Standards, 2011.
  * [5] V. Terzija, G. Valverde, D. Cai, P. Regulski, V. Madani, J. Fitch, S. Skok, M. M. Begovic, and A. Phadke, “Wide-area monitoring, protection, and control of future electric power networks,” Proceedings of the IEEE, vol. 99, no. 1, pp. 80–93, 2011.
  * [6] J. De La Ree, V. Centeno, J. S. Thorp, and A. G. Phadke, “Synchronized phasor measurement applications in power systems,” IEEE Transactions on Smart Grid, vol. 1, no. 1, pp. 20–27, 2010.
  * [7] M. Kezunovic, S. Meliopoulos, V. Venkatasubramanian, and V. Vittal, “Application of Time-Synchronized Measurements in Power System Transmission Networks,” 2014.
  * [8] G. B. Giannakis, V. Kekatos, N. Gatsis, S. J. Kim, H. Zhu, and B. F. Wollenberg, “Monitoring and optimization for power grids: A signal processing perspective,” IEEE Signal Processing Magazine, vol. 30, no. 5, pp. 107–128, 2013.
  * [9] C. Tu, X. He, Z. Shuai, and F. Jiang, “Big data issues in smart grid – A review,” Renewable and Sustainable Energy Reviews, vol. 79, pp. 1099–1107, 11 2017.
  * [10] W. Li, L. Vanfretti, and J. H. Chow, “Pseudo-Dynamic Network Modeling for PMU-Based State Estimation of Hybrid AC/DC Grids,” IEEE Access, vol. 6, pp. 4006–4016, 11 2017.
  * [11] Z. Shuai, W. Huang, C. Shen, J. Ge, and Z. J. Shen, “Characteristics and Restraining Method of Fast Transient Inrush Fault Currents in Synchronverters,” IEEE Transactions on Industrial Electronics, vol. 64, pp. 7487–7497, 9 2017.
  * [12] M. N. Aman, K. Javed, B. Sikdar, and K. C. Chua, “Detecting data tampering attacks in synchrophasor networks using time hopping,” IEEE PES Innovative Smart Grid Technologies Conference Europe, 7 2016.
  * [13] A. Chawla, A. Singh, P. Agrawal, B. K. Panigrahi, B. R. Bhalja, and K. Paul, “Denial-of-Service Attacks Pre-Emptive and Detection Framework for Synchrophasor Based Wide Area Protection Applications,” IEEE Systems Journal, pp. 1–12, 2021.
  * [14] S. M. Farooq, S. Nabirasool, S. Kiran, S. M. Suhail Hussain, and T. S. Ustun, “MPTCP based mitigation of Denial of Service (DoS) Attack in PMU Communication Networks,” Proceedings of 2018 IEEE International Conference on Power Electronics, Drives and Energy Systems, PEDES 2018, 7 2018\.
  * [15] C. Beasley, X. Zhong, J. Deng, R. Brooks, and G. K. Venayagamoorthy, “A survey of electric power synchrophasor network cyber security,” IEEE PES Innovative Smart Grid Technologies Conference Europe, vol. 2015-Janua, 1 2015\.
  * [16] X. Zhong, P. Arunagirinathan, A. Ahmadi, R. Brooks, and G. K. Venayagamoorthy, “Side-channels in electric power synchrophasor network data traffic,” ACM International Conference Proceeding Series, vol. 06-08-Apri, 4 2015\.
  * [17] Z. Zhang, S. Gong, A. D. Dimitrovski, and H. Li, “Time synchronization attack in smart grid: Impact and analysis,” IEEE Transactions on Smart Grid, vol. 4, no. 1, pp. 87–98, 2013.
  * [18] X. Fan, L. Du, and D. Duan, “Synchrophasor data correction under GPS spoofing attack: A state estimation-based approach,” IEEE Transactions on Smart Grid, vol. 9, no. 5, pp. 4538–4546, 2018.
  * [19] X. Jiang, J. Zhang, B. J. Harding, J. J. Makela, and A. D. Domínguez-García, “Spoofing GPS receiver clock offset of phasor measurement units,” IEEE Transactions on Power Systems, vol. 28, no. 3, pp. 3253–3262, 2013.
  * [20] I. Akkaya, E. A. Lee, and P. Derler, “Model-based evaluation of GPS spoofing attacks on power grid sensors,” 2013 Workshop on Modeling and Simulation of Cyber-Physical Energy Systems, MSCPES 2013, 2013.
  * [21] J. Xie, A. P. Meliopoulos, and G. Cokkinides, “PMU-based line differential protection under GPS spoofing attack,” Proceedings of the Annual Hawaii International Conference on System Sciences, vol. 2020-Janua, pp. 3350–3358, 2021.
  * [22] O. Vukovic and G. Dan, “Security of fully distributed power system state estimation: Detection and mitigation of data integrity attacks,” IEEE Journal on Selected Areas in Communications, vol. 32, no. 7, pp. 1500–1508, 2014\.
  * [23] O. Kosut, L. Jia, R. J. Thomas, and L. Tong, “Malicious Data Attacks on Smart Grid State Estimation: Attack Strategies and Countermeasures,” pp. 220–225, 11 2010.
  * [24] LiuYao, NingPeng, and R. K., “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security (TISSEC), vol. 14, p. 33, 6 2011.
  * [25] R. Deng, G. Xiao, R. Lu, H. Liang, and A. V. Vasilakos, “False data injection on state estimation in power systems-attacks, impacts, and defense: A survey,” IEEE Transactions on Industrial Informatics, vol. 13, pp. 411–423, 4 2017.
  * [26] S. Barreto, M. Pignati, G. Dán, J. Y. Le Boudec, and M. Paolone, “Undetectable Timing-Attack on Linear State-Estimation by Using Rank-1 Approximation,” IEEE Transactions on Smart Grid, vol. 9, pp. 3530–3542, 7 2018.
  * [27] G. B. Huang, Q. Y. Zhu, and C. K. Siew, “Extreme learning machine: Theory and applications,” Neurocomputing, vol. 70, pp. 489–501, 12 2006.
  * [28] E. Shereen, M. Delcourt, S. Barreto, G. Dán, J.-Y. Le Boudec, and M. Paolone, “Feasibility of time-synchronization attacks against pmu-based state estimation,” IEEE Transactions on Instrumentation and Measurement, vol. 69, no. 6, pp. 3412–3427, 2020.
  * [29] P. Gao, M. Wang, S. G. Ghiocel, J. H. Chow, B. Fardanesh, and G. Stefopoulos, “Missing data recovery by exploiting low-dimensionality in power system synchrophasor measurements,” IEEE Transactions on Power Systems, vol. 31, no. 2, pp. 1006–1013, 2016.
  * [30] G. M. De Mijolla, S. Konstantinopoulos, P. Gao, J. H. Chow, and M. Wang, “An evaluation of algorithms for synchrophasor missing data recovery,” in 2018 Power Systems Computation Conference (PSCC), pp. 1–6, 2018.
  * [31] J.-F. Cai, E. J. Candès, and Z. Shen, “A singular value thresholding algorithm for matrix completion,” SIAM J. Optim., vol. 20, pp. 1956–1982, 2008.
  * [32] K. D. Jones, A. Pal, and J. S. Thorp, “Methodology for performing synchrophasor data conditioning and validation,” IEEE Transactions on Power Systems, vol. 30, no. 3, pp. 1121–1130, 2015.
  * [33] Y. Chen, Y. Wang, and Q. Yang, “Cascaded denoising convolutional auto-encoders for automatic recovery of missing time series data,” in 2020 19th International Symposium on Distributed Computing and Applications for Business Engineering and Science (DCABES), pp. 283–286, 2020.
  * [34] P. Stoica, J. Li, and J. Ling, “Missing data recovery via a nonparametric iterative adaptive approach,” IEEE Signal Processing Letters, vol. 16, no. 4, pp. 241–244, 2009.
  * [35] D. Osipov and J. H. Chow, “Pmu missing data recovery using tensor decomposition,” IEEE Transactions on Power Systems, vol. 35, no. 6, pp. 4554–4563, 2020.
  * [36] Y. Hao, M. Wang, J. H. Chow, E. Farantatos, and M. Patel, “Modelless data quality improvement of streaming synchrophasor measurements by exploiting the low-rank hankel structure,” IEEE Transactions on Power Systems, vol. 33, no. 6, pp. 6966–6977, 2018.
  * [37] I. Khan and V. Centeno, “Detecting gps-spoofing attack on pmu data with phase angle unwrapping technique and low-rank approximation of hankel matrix,” in 2022 IEEE Power and Energy Society General Meeting (PESGM), pp. 1–5, 2022\.
  * [38] S. Mousavian, J. Valenzuela, and J. Wang, “A Probabilistic risk mitigation model for cyber-attacks to PMU networks,” IEEE Transactions on Power Systems, vol. 30, no. 1, pp. 156–165, 2015.
  * [39] D. Mukherjee, “Data-driven false data injection attack: A low-rank approach,” IEEE Transactions on Smart Grid, pp. 1–1, 2022.
  * [40] K. Manandhar, X. Cao, F. Hu, and Y. Liu, “Detection of faults and attacks including false data injection attack in smart grid using kalman filter,” IEEE Transactions on Control of Network Systems, vol. 1, no. 4, pp. 370–379, 2014.
  * [41] Q. Yang, J. Yang, W. Yu, D. An, N. Zhang, and W. Zhao, “On false data-injection attacks against power system state estimation: Modeling and countermeasures,” Parallel and Distributed Systems, IEEE Transactions on, vol. 25, pp. 717–729, 03 2014.
  * [42] C. Pei, Y. Xiao, W. Liang, and X. Han, “A deviation-based detection method against false data injection attacks in smart grid,” IEEE Access, vol. 9, pp. 15499–15509, 2021.
  * [43] I. Khan and V. Centeno, “Realtime detection of pmu bad data and sequential bad data classifications in cyber-physical testbed,” IEEE Access, vol. 11, pp. 71235–71249, 2023.
  * [44] C. Grigg, P. Wong, P. Albrecht, R. Allan, M. Bhavaraju, R. Billinton, Q. Chen, C. Fong, S. Haddad, S. Kuruganty, W. Li, R. Mukerji, D. Patton, N. Rau, D. Reppen, A. Schneider, M. Shahidehpour, and C. Singh, “The ieee reliability test system-1996. a report prepared by the reliability test system task force of the application of probability methods subcommittee,” IEEE Transactions on Power Systems, vol. 14, no. 3, pp. 1010–1020, 1999\.