Cyber Attack Impact Characterization for IEC 61850-based Substations

IEC 61850-based Substation Automation Systems (SAS) are essential to the modern grid as they ensure secure and efficient operation and maintain overall system safety. However, there has been an increase in cybersecurity concerns about IEC 61850 SAS due to its lack of security features. A deeper understanding of the system-wide impacts on the grid due to cyber attacks is crucial to develop necessary risk assessments and cybersecurity countermeasures. This paper presents a systematic methodology for the impact characterization of cyber attacks on IEC 61850-enabled substation buses and analyzes the corresponding impact on the grid through the grid voltage performance. To identify relevant attack vectors, NESCOR vulnerability classes are utilized. Two data integrity attacks (single and pulsating trip) in different scenarios (isolated and coordinated) are executed on three types of substation buses (generation, transmission, and load). A comprehensive assessment of the impacts is conducted within a cyber-physical system (CPS) hardware-in-the-loop (HIL) testbed environment utilizing a modified Kundur’s four-machine, two-area power system. The transient voltage stability of the sensitive bus voltages is examined using the voltage profile index (VPI) as an impact characterization metric. The experimental results for our model reveal that data integrity attacks on generation and load buses exhibit a higher severity than on transmission buses. The severity also varies with the type and location of the attack.