Attack-Resiliency Analytics for Wide-Area Control Systems in Smart Grids

Abstract

Wide-area monitoring, protection, and control (WAMPAC) systems damp inter-area oscillations in large interconnected grids, but their reliance on synchronized PMU measurements carried over wide-area networks exposes them to false data injection (FDI) attacks. This paper presents an attack-resiliency analytics framework that formally models the coupled dynamics of the wide-area damping loop, automatic generation control, and the governor and excitation systems, and formulates the optimal stealthy FDI attack as a mixed-integer linear program (MILP). The anomaly detection model (ADM) enters as a replaceable constraint set: either a static bad-data detection (BDD) rule or a boundary learned from benign operation calibrated to a common false-positive rate. On the IEEE 39 and 118 bus systems, with reference dynamics validated on an OPAL-RT hardware-in-the-loop testbed, the optimal attack with wide-area access attains 3.3 and 8.1 times the benign objective and reaches a 0.5Hz frequency excursion more than twice as fast as an attack confined to automatic generation control. Learned boundaries reduce the attack objective by 15.5 55.0% and prevent over-frequency relay trips in all configurations, with feasible stealthy attacks remaining in every case, and residual risk tracks the width of the learned boundary rather than the detector family.