SUGAR-Enabled Intrusion Detection System for Electric Grid Cyber Threats (Topic 1/b)

The United States electric grid is becoming increasingly susceptible to cyber-attacks due to the high dependence on communication-based automated control for system operation, as well as advancements in the intrusion capabilities of adversaries. False Data Injection Attacks (FDIAs) and control-related attacks (CRAs), two emerging classes of cyber-attacks, can cause large-scale disruption in the operation of the grid, which in turn could have severe societal and economic impacts. In this project, we will develop a novel Intrusion Detection System (IDS) based on Pearl Street Technologies’ SUGAR simulation, modeling, and optimization engine, that will include Bad-Data Detection (BDD) and Control-Related Attack Detection (CRAD) layers to detect and prevent FDIAs and CRAs, respectively. The BDD layer of our IDS detects any malicious attack on SCADA measurements and is based on a novel linear circuit-theoretic state estimator. The CRAD layer of our IDS, following an “assume breach” scenario, analyzes all control actions for malicious intrusions by running steady-state simulations in real-time using our provably convergent SUGAR engine. In Phase I of this project, we plan to demonstrate that the BDD layer of the IDS detects any class of FDIAs within a second, including those that presently bypass any available commercial grade IDSs in the industry. Furthermore, we will demonstrate that the CRAD layer of the IDS robustly flags any control action that can thwart the reliability or security of the grid. The proposed IDS product has applications at both the transmission- and distribution-levels. Phase I R&D will concentrate on developing the technology as a software layer that can be deployed in the central control rooms of transmission and distribution operators and balancing authorities; future development through Phase II and beyond will involve decentralizing the IDS so that it can be deployed directly inside critical substations and other critical energy infrastructure. We propose to the develop the IDS so that it can be installed as a software layer inside existing cybersecurity solutions in use by the utilities, and will seek partnerships with these cybersecurity vendors throughout the course of this SBIR project.