Design of False Data Injection Attack for Automatic

Generation Control
Susmitha T Rayabagi Prasanta K Jena Subhojit Ghosh
Department of Electrical Engineering Department of Electrical Engineering Department of Electrical Engineering
National Institue of Technology, Raipur National Institue of Technology, Raipur National Institue of Technology, Raipur
Raipur, India Raipur, India Raipur, India
[email protected] [email protected] [email protected]

Abstract— With the incorporation of cyber infrastructure of large magnitude are introduced by the sensors, they can be
into the power system, cyber threats have become a rising detected through the bad data detection methods [4].
concern. Severe damage to the physical infrastructure can be However, errors can be carefully introduced into the
caused by tampering the control applications of electric grids. measurements by the intruder to produce erroneous state
The Automatic Generation Control (AGC) is one such attractive
control application as it is responsible for maintaining a
estimate without being detected by the algorithms. This class
constant system frequency. This paper discusses how a class of of attacks are known are False Data Injection (FDI) attacks.
attacks known as the False Data Injection (FDI) attacks on the Various techniques of generating such attacks have been
state estimation function can hinder the operation of AGC and discussed in [5]. This erroneous estimate will deceive the
lead to unwanted frequency variations. Using the data of IEEE control applications into taking wrong decisions which can
9 bus system a three area AGC is configured and the effects of drastically affect the functioning of power system. One such
FDI attacks are observed. important control application is the AGC (Automatic
Generation Control) [6]. The AGC is responsible for
Keywords—Automatic Generation Control, False Data
maintaining the balance between load and generation and
Injection attack, State Estimation
hence in turn is responsible for maintaining constant
I. INTRODUCTION frequency. The same is achieved by generating appropriate
control signals to the generators by utilizing the power flow
New and advanced technologies are constantly being
values estimated by the state estimator. By attacking the state
introduced into the existing power system to improve the
estimator an adversary can deviate the power flow estimates,
overall performance while satisfying the continuous load
so as to mislead the AGC to generate inappropriate control
demand. Information and Communication Technology (ICT)
signals. These faulty signals can destabilize the load-
tools for Wide Area Monitoring and Control, Smart Metering,
generation balance and disturb the frequency to a great extent.
Intelligent sensing and data acquisition etc are transforming
Huge deviation from the nominal frequency may even lead to
the legacy grids to smart grid [1]. The integration with ICT
blackout. The effect of such data attacks are being studied
tools allows for information being communicated through
extensively [2] [5] [7].
cyber infrastructure. The energy management system (EMS)/
In [6] the effect of pipelining state estimation with the
Supervisory Control and Data Acquisition (SCADA) systems
AGC operation is demonstrated along with the impact on the
perform the task of continuously monitoring and controlling
operation of AGC due to data attacks on state estimation. An
the power grid through the acquired sensor information [2].
attack impact model is developed to study and analyze the
Inspite of the advantages, the integration of cyber technology
effect of data attacks. The impact of data integrity attacks on
into physical grid infrastructure makes the power system
the control functions of the power system is highlighted in
vulnerable towards cyber-attacks, which are processed at
[8]. The impact of data attacks in AGC is quantified in terms
communication layer.
of load-generation imbalance and frequency deviation. The
Energy Management System governs the overall smart
PowerCyber CPS test bed at Iowa University is used to
grid operations through state estimation. State Estimation
showcase the effects of cyberattacks on the AGC in [9]. Two
(SE) plays a vital role in supervisory control of power grids
types of attacks namely: measurement-based attack and
[3]. The measurements acquired from various meters,
control-based attack are demonstrated, to depict the
sensors, RTUs along with the status of switches and circuit
frequency deviation leading to unnecessary load shedding.
breakers is utilized by the state estimator to determine the
In [10] different ways of data manipulation at the cyber
state of the power grid. The estimated states are further
layer are discussed. Attack vectors of varying types are
passed to all the energy management system (EMS)
applied to a two area AGC, and a Kalman filter is used to
applications such as the contingency analysis, automatic
detect the anomalies based on the norm of the residue. A
generation control, load forecasting and optimal power flow,
simultaneous input and state-estimation based algorithm is
etc. As the information obtained from the state estimator is
used to analyze data attacks on AGC in [11]. The algorithm
responsible for undertaking many critical decisions it is
simultaneously detects and compensates the attack, so that
always an attractive target for the attackers aiming at
the AGC operates based on the actual measurements instead
disruption of the grid operation.
of the manipulated measurements. In [12] it is shown how
The measurements utilized by the state estimator are
the control signal of AGC i.e. the Area Control Error can be
prone to some degree of errors due to noise in communication
cleverly manipulated by the attacker so as to maintain the
channels or discrepancy in the measurement units. Such small
system operation at a desired frequency. Along with this an
errors can be eliminated in the estimator itself. Even if errors
Unknown Input Observer is used to detect the attacks. In this

978-1-7281-8873-7/20/$31.00 ©2020 IEEE

Authorized licensed use limited to: ULAKBIM UASL - Afyon Kocatepe Universitesi. Downloaded on December 08,2021 at 07:38:10 UTC from IEEE Xplore. Restrictions apply.
 paper, the impact of false data injection attacks has been are Chi squares technique and Largest Normalized Residual
quantified in terms of frequency deviation and further an technique [13].
attack vector that maximizes the impact has been designed. Chi Square method detects the presence of bad data in the
The proposed algorithm initiates with state estimation from entire measurement set but cannot pinpoint the faulty data.
the sensor measurement [5]. An attack vector that bypasses Largest Normalized Residual (LNR) method overcomes this
the BDD test is further designed using the estimated states. disadvantage as it can detect which measurement is faulty.
With the state estimate (𝑥̂) obtained from WLS algorithm, the
II. STATE ESTIMATION AND FDIA IN SMART GRID estimated measurements ( ℎ(𝑥̂) ) are obtained. Further the
normalized residual vector is calculated as:
A. State Estimation
State Estimation acts as a medium through which all the |𝑟𝑖 |
𝑟𝑖𝑁 = (5)
raw data obtained can be transformed into reliable √Ω𝑖𝑖
information which helps in managing the power system [13].
The most widely used approach for state estimation is the where 𝑟𝑖 is the residual value which is given by 𝑟𝑖 = 𝑧𝑖 −
Weighted Least Square (WLS) technique. The measurements ℎ𝑖 (𝑥̂ ), Ω𝑖𝑖 is the diagonal value of Ω (Residual Covariance
Matrix of size m×m). Each normalized residue is compared
and the state variables are related as:
with the threshold value (ct). If the value exceeds the threshold
then that particular measurement is suspected of bad data. The
𝑧 = ℎ(𝑥) + 𝑒 (1) value of threshold is chosen depending on the detection
𝑧 ∈ [𝑝𝑖 , 𝑞𝑖 , 𝑝𝑓𝑙, 𝑞𝑓𝑙 ] sensitivity and is normally chosen around 3 [13].

where, z is the measurement vector, x represents the state D. Constructing the FDI Attack
vector, h represents the non linear relation between z and x In this sub-section design of attack vector that can bypass
and e represents the error vector. If there are n buses in the the BDD test and hence disturb the AGC operation is
network then there are 2n-1 state variables. The number of discussed. The traditional methods of detecting errors in the
measurements m must be greater than the number of state measurements depend on the residue calculated between the
variable i.e. 2n-1. actual measurements and the estimated values. If the attacker
has prior information about the system configuration the
errors introduced in the measurements can be engineered
B. Wieghted Least Square (WLS) based State Estimation
such that the residue remains in the acceptable range. Such
The WLS algorithm works on the basic principle of least manipulation avoids the error being detected by BDD test.
squares method with weights assigned to different
measurements. This method aims at finding an estimate x Let a be the error vector which will be introduced into the
which will minimize the square of the residual error between measurement vector z. Let the new measurement vector za be
the provided observations and values calculated through the given as
model function. The weight reflects the reliability of
incorporating the observation/measurement [14] in state 𝑧𝑎 = 𝑧 + 𝑎 (6)
estimation. The objective function of WLS is given as:
This error vector is referred to as attack vector. With za
𝑚 being used for state estimation, an erroneous state vector 𝑥𝑏𝑎𝑑
2
(𝑧𝑖 − ℎ𝑖 (𝑥))
𝐽(𝑥) = ∑ (2) is obtained as below:
𝑅𝑖𝑖
𝑖=1
𝑥𝑏𝑎𝑑 = 𝑥 + (𝐻𝑇 𝑊𝐻)−1 𝐻𝑇 𝑊𝑎 (7)
where, 𝑧𝑖 is the value of measurement i in a set of m
measurements and ℎ𝑖 (𝑥) is the estimated value of The residue vector is given as
measurement i. 𝑅𝑖𝑖 are the diagonal entries in the covariance 𝑟𝑏𝑎𝑑 = 𝑧𝑎 − 𝐻𝑥𝑏𝑎𝑑 (8)
matrix R of size m×m. The vector form of is given as:
Combining equations (6), (7) and (8) the following relation
𝐽(𝑥) = [𝑧 − ℎ(𝑥)]𝑇 𝑅 −1 [𝑧 − ℎ(𝑥)] (3) can be developed:
where, 𝑅−1 is the weight matrix and denoted by W. The 𝑟𝑏𝑎𝑑 = 𝑧 − 𝐻𝑥 + 𝑎 − 𝐻(𝐻𝑇 𝑊𝐻)−1 𝐻 −1 𝑊𝑎 (9)
estimation problem is solved in an iterative fashion by taking
an initial guess. The correction vector for the state estimate Observing the above equation if the attack vector a is
after every iteration is as: replaced by 𝐻𝑐 where c is any arbitrary nonzero vector, the
resultant residue is given as:
∆𝑥 𝑘 = 𝐺 −1 (𝑥 𝑘 )𝐻 𝑇 (𝑥 𝑘 )𝑅 −1 (𝑧 − ℎ(𝑥 𝑘 )) (4)
𝑟𝑏𝑎𝑑 = 𝑧 − 𝐻𝑥 (10)
where, k is iteration number G is the gain matrix and H is the
From equation (10) is can be concluded that when an
Jacobian matrix of size m×n
attack vector satisfying the condition 𝑎 = 𝐻𝑐 is introduced
C. Bad Data Detection into the measurement vector, the bad data detection
In state estimation paradigm, bad data are measurements algorithms fail to detect the anomaly.
that are contaminated or differ from the normal trend III. FDIA IN AUTOMATIC GENERATION CONTROL
followed by the measurements [14]. The presence of bad data
can mislead the operator about the relevant operating scenario A. AGC: Basic Principles
of the grid. The most common methods for detecting bad data Frequency is a global parameter throughout the power
system, and has to be maintained constant for reliable

Authorized licensed use limited to: ULAKBIM UASL - Afyon Kocatepe Universitesi. Downloaded on December 08,2021 at 07:38:10 UTC from IEEE Xplore. Restrictions apply.
 operation of the power system. When multiple machines with formed. Transmission lines between bus 5 and bus 7 (𝐿57 ),
drooping governor characteristics are connected in parallel, bus 8 and 9 (𝐿89 ) and between bus 4 and 6 (𝐿46 ) are the three
sharing of load change is carried out at a unique frequency tie lines. The change in these tie line powers and the
[15]. When a load change occurs, the governor adjusts the frequency deviation are used to calculate the ACE of each
output of the generators such that the balance between output area.
and generation is maintained. The balancing action is
C. Data Attack on AGC
accompanied by a frequency deviation at steady state. The
frequency deviation with n machines connected in parallel for Assuming the attacker has a prior knowledge of the system
a load change of ΔPL is given as: configuration an attack vector is constructed as discussed in
the last section. This attack vector is introduced into the
−∆𝑃𝐿 measurement vector and hence a new measurement vector is
∆𝑓𝑠𝑠 = (11) formed (equation 6). When estimation is performed through
1 1 1
( + +⋯⋯ )+𝐷 the manipulated measurement, a faulty estimate of the state
𝑅1 𝑅2 𝑅𝑛
variables is obtained. Since the attack satisfies the residual
constraint it will pass through the BDD algorithms without
where, R1, R2, up to Rn are droop constants and D is load
raising any alarm. The tie line powers which are used in the
damping constant. The primary task of the AGC is to bring the
AGC loop are also estimated with the new state estimate.
frequency back to its nominal value. When large
These estimated power values will vary significantly from
interconnected systems are considered, they are divided into
their scheduled levels. According to equation (12) the ACE is
Balancing Authority (BA) areas [16]. Each of these areas is
calculated with the change in the tie line power from the
connected through tie lines for exchange of power. In such a
scheduled value as below:
scenario the AGC is also responsible for maintaining the tie
line power to their scheduled values. Each of these areas runs ∆𝑃𝑡𝑖𝑒 = 𝑃𝑎𝑐𝑡 − 𝑃𝑠𝑐ℎ (13)
the AGC algorithm at their individual control centers [17].
The AGC algorithm monitors the frequency in real-time by where, 𝑃𝑎𝑐𝑡 will be the value obtained from the estimation
calculating the Area Control Error (ACE) as: process and 𝑃𝑠𝑐ℎ is the scheduled value. Hence for each area
their respective ACE will be calculated in the similar fashion.
𝐴𝐶𝐸 = ∆𝑃𝑡𝑖𝑒 + 𝛽∆𝑓 (12) Fig 2a shows the integration of SE and BDD algorithms along
with the AGC representation for area 1. Similar to area 1 the
where, ∆𝑃𝑡𝑖𝑒 is change in tie line power, β is known as
other two areas are modelled.
stiffness of the system and ∆𝑓 is the frequency deviation. This
signal is updated in every AGC cycle (two to four seconds) Considering the three area concept the net change in the
[15]. The measurements including the tie line power flows are tie line power for each area is given as:
passed through the SE algorithm in order to eliminate noise
and faulty data. The tie line flows obtained from the SE ∆𝑃𝑇𝑖𝑒1 = ∆𝑃12 + ∆𝑃13
algorithm are used to calculate ∆𝑃𝑡𝑖𝑒 . ∆𝑃𝑇𝑖𝑒2 = ∆𝑃23 + ∆𝑃21 (14)
∆𝑃𝑇𝑖𝑒3 = ∆𝑃31 + ∆𝑃32
B. Modelling of AGC for IEEE nine bus system
The variables ∆𝑃12 , ∆𝑃23 , ∆𝑃31 (refer Fig 2b) represent the
change in the power flowing in lines 𝐿57 , 𝐿89 , 𝐿46
Bus2 Bus7 Bus8 Bus9 Bus3 respectively. The scheduled power in each of these lines is
GS GS fixed where as the actual power flowing will be estimated
Gen2 T2 T3 Gen3 from the state estimation algorithm. When the measurements
Area2 Load8 are attacked the calculated ACE value and hence the control
Bus5 Bus6
signal will be incorrect. The ACE acts like a correction signal
Area3
for generators which is usually zero in the normal operating
Load5 Load6 conditions. When the ACE value shifts the generators also
shift their operating point such that the ACE is returned to
Bus4 zero. Since the calculated ACE is incorrect, the generator
Area1 receives a wrong command to increase or decrease the
T1
generation which leads to undesired variations in the system
Bus1
frequency. Such variations in frequency demand remedial
procedures like disconnecting loads or generators to be called
GS into action and can lead to more severe events like cascade
failures and massive blackouts.
Fig. 1. IEEE 9 Bus System
IV. SIMULATION STUDIES
The IEEE nine bus system consists of three synchronous The WLS algorithm is implemented to perform SE for the
generators, three two winding transformers and three loads. IEEE nine bus system. Since there are nine buses (n=9), the
The inner ring consists of six transmission lines of rating number of states to be estimated are seventeen (2n-1). The
220kV [18]. measurement set consists of 31 measurements which include
For implementing AGC, the IEEE nine bus system is slack bus voltage, active and reactive power flows. After the
divided into three areas as shown in Fig 1. The division is execution of WLS algorithm the bad data tests are conducted
carried out such that each area comprises of a generator and to check the presence of faulty data. As expected the Bad data
a load. The generators in each area are considered to be under tests work well when there are random errors and help in
AGC. On dividing the network as shown, three tie lines are discarding such errors.

Authorized licensed use limited to: ULAKBIM UASL - Afyon Kocatepe Universitesi. Downloaded on December 08,2021 at 07:38:10 UTC from IEEE Xplore. Restrictions apply.
 Fig. 2. (a) SE integration with AGC (b) simple representation of Fig.1 depicting the tie lines
Notation: here ΔPtie1 is the change in the tie line power, ACE1 represents the ACE for area 1, ΔPm1 is the change in the mechanical power input, ΔPL1
is the change in the load in area 1, M1 is the inertia of generator in area 1, D1 is the load damping constant and the Δf1 represents the frequency
deviation in area 1, P12, P23, P31 are the tie line power flows.

Assuming the attacker has gained the information about the attacker can launch a series of attacks. Each attack is
the system configuration i.e. the attacker is able to construct introduced such that at every cycle of AGC operation a false
Jacobian matrix (H) with the known system configuration. value of tie line power change is utilized.
Assuming the attacker is able to manipulate every
measurement in the set then no element in the vector a is zero.
The attack vector introduced will satisfy the condition 𝑎 =
𝐻𝑐 , the vector c is non zero random valued. Power flow
values are estimated from this faulty data and the change in
tie line power (∆𝑃57 , ∆𝑃89 , ∆ 𝑃46 ) is obtained and tabulated as
shown in Table 1 (in p.u).

TABLE. I. CHANGE IN TIE LINE POWER FLOW

∆𝑃57 (∆𝑃12 ) 0.0549

∆𝑃89 (∆𝑃23 ) 0.0706

∆𝑃46 (∆𝑃13 ) -0.1722

Using these values, the net change in power for each area
is calculated using equation (14). These values are then
passed on to the AGC loop.

TABLE. II. POWER AND FREQUENCY DEVIATION FOR EACH

AREA Fig. 3. Frequency variations obtained from the 3 area model of AGC

To illustrate the effect of introducing several attacks, the

Area Net power change (p.u) ∆𝒇(Hz)
state es 7estimation is injected with several attack vectors
1. -0.1172 -0.09 such that the AGC picks faulty estimates of the tie line power
at each cycle. At every AGC cycle the deviation that will
2. 0.0157 0.1015 result due to the erroneous estimate is obtained from the
SIMULINK model for AGC, the blue line indicated in Fig 4
3. -0.2428 -0.15 represents this deviation. The frequency plot indicated by the
red line in Fig. 4. indicates a normal case where there is no
change in tie line powers. Due to which there is no command
As seen from Table 2 the power levels are deviated. In area to raise or lower the generator outputs and hence the
1, the power has decreased from the scheduled value which
frequency is maintained at an almost constant value.
will cause the generator is reduce its generation. But since
Observing the data from Fig 4 it can be concluded that the
there is no such change in reality the load generation balance
will be disturbed such that the frequency goes down (column data attacks show a deceiving scenario of the network and
3 of Table 2). Fig 3 shows the deviations in frequencies (Table lead the AGC into taking wrong control decisions. As seen,
2) for the three areas. The results shown in Fig 3 illustrate the the attack vector at 5th cycle was able to deviate the frequency
case of a single attack. In order to deviate the frequency further to a maximum. This indicates that the generator output

Authorized licensed use limited to: ULAKBIM UASL - Afyon Kocatepe Universitesi. Downloaded on December 08,2021 at 07:38:10 UTC from IEEE Xplore. Restrictions apply.
 [4] G. Chaojun, P. Jirutitijaroen and M. Motani, "Detecting False Data
Injection Attacks in AC State Estimation," in IEEE Transactions on
Smart Grid, vol. 6, no. 5, pp. 2476-2483, Sept. 2015, doi:
10.1109/TSG.2015.2388545.
[5] Liu, Y., Ning, P., and Reiter, M. K. 2011. "False data injection attacks
against state estimation in electric power grids" ACM Trans. Info. Syst.
Sec. 14, 1, Article 13 (May 2011), 33 pages. DOI =
10.1145/1952982.1952995.
[6] R. Tan et al., "Modeling and Mitigating Impact of False Data Injection
Attacks on Automatic Generation Control," in IEEE Transactions on
Information Forensics and Security, vol. 12, no. 7, pp. 1609-1624, July
2017, doi: 10.1109/TIFS.2017.2676721.
[7] R. Deng, G. Xiao, R. Lu, H. Liang and A. V. Vasilakos, "False Data
Injection on State Estimation in Power Systems—Attacks, Impacts,
and Defense: A Survey," in IEEE Transactions on Industrial
Informatics, vol. 13, no. 2, pp. 411-423, April 2017, doi:
10.1109/TII.2016.2614396.
[8] S. Sridhar and G. Manimaran, "Data integrity attacks and their impacts
on SCADA control system," IEEE PES General Meeting, Providence,
RI, 2010, pp. 1-6, doi: 10.1109/PES.2010.5590115.
[9] A. Ashok, Pengyuan Wang, M. Brown and M. Govindarasu,
Fig. 4. Deviations in frequency (area 1) for a series of attacks "Experimental evaluation of cyber attacks on Automatic Generation
Control using a CPS Security Testbed," 2015 IEEE Power & Energy
changed drastically and the load generation imbalance caused Society General Meeting, Denver, CO, 2015, pp. 1-5, doi:
10.1109/PESGM.2015.7286615.
at this instant can lead to bigger issues and destabilize the
[10] M. Khalaf, A. Youssef and E. El-Saadany, "Detection of false data
entire network. injection in automatic generation control systems using Kalman filter,"
2017 IEEE Electrical Power and Energy Conference (EPEC),
V. CONCLUSION Saskatoon, SK, 2017, pp. 1-6, doi: 10.1109/EPEC.2017.8286194.
In this paper we demonstrated that data attacks can [11] M. Khalaf, A. Youssef and E. El-Saadany, "Joint Detection and
Mitigation of False Data Injection Attacks in AGC Systems," in IEEE
be introduced into the state estimation without being Transactions on Smart Grid, vol. 10, no. 5, pp. 4985-4995, Sept. 2019,
detected. These data attacks pass the BDD test without raising doi: 10.1109/TSG.2018.2872120.
any suspicion from the operator. It is shown that errors [12] A. Ameli, A. Hooshyar, E. F. El-Saadany and A. M. Youssef, "Attack
introduced disrupt the operation of AGC which will lead to Detection and Identification for Automatic Generation Control
unwanted frequency variations in the system. We were able Systems," in IEEE Transactions on Power Systems, vol. 33, no. 5, pp.
4760-4774, Sept. 2018, doi: 10.1109/TPWRS.2018.2810161.
to show that one of the attacks was able to create a maximum
[13] Ali Abur, Antonio Gomez Exposito, "Power System State Estimation
frequency deviation. Hence illustrating that the data attacks Theory and Implementation", New York, NY, USA: Marcel Decker
can mislead the control applications into taking unnecessary Inc, 2004 ISBN: 0-8247-5570-7
actions. [14] Tilo Strutz, "Data Fitting and Uncertainty A practical introduction to
weighted least squares and beyond", Germany: Vieweg+Teubner
REFERENCES Verlag, 1st Edition 2011, ISBN 978-3-8348-1022-9
[1] Li, B “Detection of false data injection attacks in smart grid cyber- [15] Prabha Kundur, "Power system Stability and Control", New York,
physical systems” Doctoral thesis (2019), Nanyang Technological USA: McGraw-Hill, 1994
University, Singapore. [16] D. Apostolopoulou, P. W. Sauer and A. D. Domínguez-García,
[2] S. Bi and Y. J. Zhang, "Graphical Methods for Defense Against False- "Automatic Generation Control and Its Implementation in Real Time,"
Data Injection Attacks on Power System State Estimation," in IEEE 2014, 47th Hawaii International Conference on System Sciences,
Transactions on Smart Grid, vol. 5, no. 3, pp. 1216-1227, May 2014, Waikoloa, HI, 2014, pp. 2444-2452, doi: 10.1109/HICSS.2014.307.
doi: 10.1109/TSG.2013.2294966. [17] S. Sridhar and M. Govindarasu, "Model-Based Attack Detection and
[3] Y. Huang, S. Werner, J. Huang, N. Kashyap and V. Gupta, "State Mitigation for Automatic Generation Control," in IEEE Transactions
Estimation in Electric Power Grids: Meeting New Challenges on Smart Grid, vol. 5, no. 2, pp. 580-591, March 2014, doi:
Presented by the Requirements of the Future Grid," in IEEE Signal 10.1109/TSG.2014.2298195.
Processing Magazine, vol. 29, no. 5, pp. 33-43, Sept. 2012, doi: [18] JP Berard, "IEEE 9 Bus System Example", OPAL-RT
10.1109/MSP.2012.2187037. TECHNOLOGIES Inc, version R0, Oct 2017

Authorized licensed use limited to: ULAKBIM UASL - Afyon Kocatepe Universitesi. Downloaded on December 08,2021 at 07:38:10 UTC from IEEE Xplore. Restrictions apply.