2676 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO.

3, MAY 2020

CASeS: Concurrent Contingency Analysis-Based

Security Metric Deployment for the Smart Grid
Parisa Akaber, Bassam Moussa , Mohsen Ghafouri , Ribal Atallah, Basile L. Agba,
Chadi Assi , and Mourad Debbabi

Abstract—Security metric deployment is of immense impor- dynamic changes in the electricity demand. Moreover, the
tance for power utilities especially in future smart grids, which grid’s cyber component is responsible for communicating cor-
are being actively pursued in smart cities initiatives around the rective actions in case of any emergency to relevant devices
world. Through these metrics, utilities attain real-time aware-
ness of the grid’s security posture. In this paper, we propose of the physical component. However, along with the advan-
a contingency analysis based security evaluation framework for tages induced from cyber-physical coupling, the integration of
smart grid systems - CASeS. Based on the power flow equations the cyber infrastructure in the power grid augments the threats
of the grid, communication network characteristics, and concur- facing the system [4]. Indeed, the impact of compromises in
rent power contingencies, CASeS leverages Markovian Decison either component is a candidate to expand and initiate the
Processes (MDP) to quantify the smart grid security. The secu-
rity index delivered through CASeS emerges as a novel solution well-known phenomenon of cascading failures [5], [6].
for concurrent power contingency consideration, and allows for On the other hand, the availability of the cyber components
the preparation of corrective actions to address the quantified augments the operational technology (OT) data generated by
grid criticality level. We evaluate CASeS on the standard IEEE the physical processes with essential information technol-
14-Bus and 39-Bus systems. The collected results demonstrate ogy (IT) data that reports on the system health. This enables
the usefulness of CASeS in quantifying the security of those
systems. the collection of reports and alerts from various cyber com-
ponents dispersed across the grid, along with the sampled
Index Terms—Smart grids, security, cyber-physical systems, measurements and received control commands. However, the
power system simulation, power system measurements, observ-
ability, power system protection. need to gain intelligence and insights on the system secu-
rity status from the collected data persists. Indeed, the smart
grid lacks the definition of metrics that reflect the cyber-
I. I NTRODUCTION physical system security, and provide operators with full
ODAY, our power grid is witnessing a major evolution system awareness on the cyber and physical levels.
T to a smarter and more capable grid. The idea of Smart
Grid has been introduced with a goal of enhancing the current
While the security evaluation techniques have been exten-
sively deployed in IT domains over the past decade, those
state of the electric grid by providing more reliable, available, solutions fall short in interpreting the system dynamics and
and efficient power generation, transmission, and distribution addressing the smart grid security and functional real-time
networks [1]. The smart grid could be defined as a Cyber- requirements. Security metrics tailored for the smart grid are
Physical network with tight coupling between the cyber and expected to infer knowledge from the system operations, along
physical components. Power network components (generation with on-the-fly alerts from deployed security monitoring solu-
units, protection relays, circuit breakers, transformers, etc) tions to expose threats targeting the grid, and quantify the
are highly dependent on the availability of a communication overall system security. The significance of such metrics has
network infrastructure and vice versa [2], [3]. motivated researchers to develop and deploy security evalua-
The cyber side of the grid works closely with the power tion techniques for the smart grid [7]–[10]. However, none of
network to provide real time monitoring, and respond to the those techniques considered the impact of Concurrent Power
Contingencies while evaluating the grid’s security.
Manuscript received March 12, 2019; revised July 15, 2019 and In this paper, we define a security metric (CASeS) based
November 7, 2019; accepted December 11, 2019. Date of publication
December 16, 2019; date of current version April 21, 2020. This work was on concurrent contingency analysis for the smart grid. Our
supported in part by Concordia University and in part by the NSERC/Hydro- metric combines cyber security analysis with Hardware-in-
Québec Thales Senior Industrial Research Chair in Smart Grid Security. the-Loop (HIL) simulation of the smart grid, and leverages
The work of Bassam Moussa was supported by FRQNT Postdoctoral
Research Scholarship. Paper no. TSG-00371-2019. (Corresponding author: concurrent contingencies, to evaluate the system criticality
Bassam Moussa.) level, based on power system dynamics and alerts generated by
P. Akaber, B. Moussa, M. Ghafouri, C. Assi, and M. Debbabi are with intrusion detection systems deployed at different grid levels.
the Concordia Security Research Centre, Concordia University, Montreal,
QC H3G 1M8, Canada (e-mail: [email protected]). The presented framework associates cyber alerts received by
R. Atallah and B. L. Agba are with Hydro-Québec Research Institute, utility operators with potential physical impact on the system
Varennes, QC J3X 1S1, Canada. operations. CASeS captures direct physical impact of cyber-
Color versions of one or more of the figures in this article are available
online at http://ieeexplore.ieee.org. based attacks in the form of load and/or generation loss, along
Digital Object Identifier 10.1109/TSG.2019.2959937 with the implicit impact by bringing the system closer to its
1949-3053 c 2019 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.
Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2677

(R1-R6) controlling circuit breakers on those lines. Assume

that those relays receive commands from remotely located
operators through the communication network to control the
associated circuit breakers. The power transferred over lines
L1-L6 to the residential areas can be interrupted through relays
R1-R6. Based on single contingency analysis, a compromise
of R1 by attacking its cyber component and gaining control
over the circuit breaker to eventually interrupt power flow over
L1, can be countered by supplying the needed power of load 3
through other transmission lines mainly L6 (assuming that L6
has the needed capacity). In a similar fashion, such an analysis
can be performed for a compromise of other relays transmis-
sion line 8. Now, consider a situation in which multiple relays
are compromised. Such a scenario cannot be captured through
Fig. 1. Multiple link contingency analysis example.
single contingency analysis. It puts the system under the risk
stability operating margins. CASeS empowers utilities with of load loss or even blackout. In Fig. 1, through a concurrent
real-time insights inferred from measurements and reports, compromise of R1 and R6, an attacker can prevent the util-
and allows the prediction of the consequences of concurrent ity from delivering power over L1 and L6 and thus causing
contingencies at the system level. This allows the anticipation a blackout at Load 3. Therefore, to better protect the system
of probable power outages and serves as an asset in utilities against similar situations, we should identify similar contin-
corrective actions and decision making in case of emergency. gencies and prevent the system from entering such states where
The novelties of CASeS can be summarized as follows: multiple relays are concurrently compromised. Similar states
• The combination of cyber security analysis with HIL sim-
in Fig. 1 include {R2, R3} and {R4, R5} as concurrent con-
ulation for the identification and formulation of power tingencies. Thus, in a large system, concurrent contingency
system cyber-physical concurrent contingencies. identification is not a straight forward task due to the multitude
• Proposal of a cyber-physical security metric and its calcu-
of combinations and the presence of cascading effects [11].
lation for smart grid using Markovian Decision Models Nevertheless, in a system with high availability demands, such
combined with a power grid co-simulation approach to as the smart grid, concurrent contingency analysis is a must
reflect in real-time the security posture of the smart grid. to foresee hidden system states and prepare corrective actions.
• Quantification of the grid security posture, illustration of
the criticality level of the different grid states, and smart III. CAS E S F RAMEWORK
grid security intelligence inference based on collected The definition of a security metric through the CASeS
security alerts and reports. framework is made possible through the collaboration of sev-
The remainder of this manuscript is structured as fol- eral modules. Those modules use data related to the grid
lows. Section II presents concurrent contingency. Section III topology, communication network topology, and access con-
describes CASeS architecture. Numerical results are dis- trol policies to identify concurrent contingencies. The resulting
cussed in Section IV. Related work is covered in Section V. CASeS framework, as used by utilities, quantifies the secu-
Section VI highlights the concluding remarks and future work. rity threats associated with the different system states, and
is presented in Section III-I. Next, we present each of those
II. C ONCURRENT C ONTINGENCY: A M OTIVATION components followed by the overall framework architecture.
Contingency analysis, in general, is one of the fundamental
tools for power grid monitoring and control. Contingency anal- A. Cyber-Physical Model
ysis can be defined as a set of if/else scenarios used to quantify At the core of our framework, we represent the smart grid as
the impact of component failures on the overall system func- an interconnected network composed of two systems, of cyber
tionality. The ideal smart gird operates according to the (N−1) and physical natures, tangled together in an interdependent
security measure which ensures secure power supply even in manner. To define this interdependency, we follow the mod-
case of a failure of any of the grid components. However, in els presented in [12] and [13]. In this model, the smart grid
the presence of multiple and concurrent contingencies, (N −1) components are internally connected to each other through
restriction is no longer sufficient to assure the grid’s avail- direct and indirect interdependencies. This interdependency
ability. To emphasize the impact of concurrent contingency results in a deviation from the normal performance of power
consideration on the system functionality and its usefulness in networks due to abnormal operation of the cyber network [12].
assessing the criticality level of the system, we consider the This abnormal behavior is mainly characterized by failures and
following example (Fig. 1). inappropriate behavior in the power system as an outcome of
The system presented in Fig. 1, shows a transmission failures in the cyber network.
network used to deliver power to three residential areas, as In an interdependent smart grid, the operation of one ele-
managed by a power utility. This network is composed of three ment depends on the existence and proper functionality of
substations, transmission lines (labeled as L1-L6), and relays other elements. For example, the failure of a controller or

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
2678 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO. 3, MAY 2020

access point in the communication network may lead to the

failure of the physically connected circuit breaker or substa-
tion in the power network [12]. The cyber component failure
can be a direct result of cyber attacks as witnessed in the 2015
Ukranian blackout [14].
In brief, our cyber-physical model of the smart grid encom-
passes power components which are controlled and monitored
through cyber components. Through a compromise of the
cyber network, an attacker can:
• Initiate or block open/close command to breakers or tie-
switches.
• Drop measurement values (e.g., voltage, current, power,
etc.) sent by compromised components.
• Report false status data (e.g., breaker status, capacitor
bank status, etc.) to the control center.
• Override commands sent by the control center to com-
promised components. Fig. 2. Network topology as seen by the connectivity matrix builder.

B. Threat Model
We consider an attacker who is knowledgeable about the we define two primitives <c, h, h >, <c, h > is the exis-
cyber-physical nature of the smart grid, and is interested in tence of a service h on c, and <h, h > is the connectivity
exploiting the cyber-physical inter-dependency to induce phys- allowing the access to service h from a component running
ical damage through compromising cyber components. The the service h. This procedure results in the identification and
attacker has the expertise to perform reconnaissance and intel- formulation of accessibility between network components in
ligence gathering operations to locate vulnerabilities in the the form of a matrix. The resulting matrix is presented as
cyber components deployed in the smart grid, and leverage C[D×D], where D is the total number of network components.
their link with the physical components. Our attacker quan- An entry Cij ∈ C is 1 if the network component j has a ser-
tifies his success in the form of physical disturbances in the vice h that is accessible through service h running on network
power grid, and he will execute his attacks to fulfill this goal. component i, and 0 otherwise. The ability of an attacker to
To successfully compromise a component, the attacker can compromise a component c running a service h is later cap-
leverage several possible attack vectors including but not lim- tured by linking a privilege ph to the service h appearing in the
ited to: distributed denial of service (DDoS), alter and hide c primitives (<c,h,h >). This privilege is awarded the attacker
(AaH), and data integrity. The attacker can make use of known upon successful compromise of the service h. Moreover, the
vulnerabilities in systems, which are identified through ICS- compromise of service h will result in a new privilege ph
CERT [15], or exploit zero-day vulnerabilities in the available attained by the attacker and thus granting him with the ability
system components. On the other hand, the attacker can gain to gain further accessibility to the network.
control over the cyber components of the grid through infil- Considering the system model presented in Fig. 2, and the
trating into the control center LAN, or the substation LAN as potential attack points, the connectivity matrix builder estab-
detailed in [16]. Thus, the attacker view of the system topol- lishes logical links that associate possible compromises of the
ogy is that of services running on the available devices and attack points with the power components that an attacker can
vulnerabilities associated with those services. For example, a control. For example, through an initial compromise of in the
relay as shown in Fig. 2 resembles a service present in the wide area network, the attacker can gain a privilege that grants
system, or a privilege gained by the attacker allowing him him access to a service in the network gateway. Eventually, the
to eventually control the physical circuit breakers. Here, it attacker gains access to the LAN in the substation, and later
is important to mention that generation stations are assumed through another compromise, manages to control the protec-
to be well-protected or disconnected from the cyber-network, tion relays present in the substation. The connectivity matrix
and attackers can not gain control over components of such builder prepares such associations for later use in the security
stations [12]. Thus, the attacker will direct his interest to metric evaluation.
coordinated attacks on IP-based substation components only.
D. MDP State Tree Generator
C. Connectivity Matrix Builder Given the connectivity matrix C generated in the previous
The connectivity matrix builder takes as input the com- block, an MDP Tree Generator enumerates all the possible
munication network topology including the network elements system states and transitions among them. An MDP provides
associated with the power grid, firewall rules and access con- a mathematical framework for modeling decision-making sit-
trol policies. Then, the connectivity matrix builder formulates uations where outcomes are partly random and partly under
this input as services associated with the network components, the control of the decision maker. To deploy any MDP, the
and connectivity among those services. For each component c, below elements should be defined.

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2679

• S a finite set of states probabilities to the transitions between states, we use the
• A a finite set of actions Common Vulnerability Scoring System [17], [18]. Using
• Pa (s, s ) transition probability CVSS, we input parameters (base, temporal, environmen-
• Ra (s, s ) reward function tal, etc) for a specific condition to receive a 0-10 score
• γ ∈ [0, 1] discount factor. of the risk posed by a particular vulnerability. We divide
From which S, A, and Pa (s, s ) are mandatory components to the score provided by CVSS by 10 to transform it into
build the MDP tree. In its basic setting, the attacker takes an a probability following a similar approach to that in [9],
action, and gets a reward from the system, and the system [19]–[21]. For example, a score of 10 results in a proba-
changes its state. Then the attacker senses the state of the bility equals to 1. We use different examples of possible
system, takes an action, gets a reward, and so on, so forth. vulnerabilities from CVSS to assign transition probabil-
The state transitions are probabilistic and depend solely on the ities, and reflect the possibility of compromises in the
actual state and the action taken by the attacker. The reward system under study. For the initial transit of the system
obtained by the attacker depends on the action taken, and on from state s0 , we consider known and unknown software
both the original and the new state of the system. All those vulnerabilities that can be exploited from distance. We
characteristics of the MDP make it most suitable to model assume that the attacker is capable of remotely exploit-
the system behavior, and the interaction with the attacker. We ing these vulnerabilities to execute his attack, and thus we
present these components next, while Ra (s, s ) and γ will be randomly add those vulnerabilities along with the conse-
presented in Section III-H: quent transition probabilities to the system components.
• S is a finite set of system states. Any attack scenario could Those exploits constitute the set of actions A0 associated
be divided into a finite number of actions followed by an with the initial system state. On the other hand, to account
attacker or a group of attackers with pre-defined objec- for zero-day attacks exploiting unknown vulnerabilities,
tives. In this research, we define a “security state” for the we have assigned a small probability of 0.01 to the system
system as a set of compromised power-communication security states that enables transitions representing zero
network components. A security state reflects the attack day exploits. This allows the attacker to exploit such vul-
propagation in the system, and the privileges the attacker nerabilities and advance in his attack. On the other hand,
has attained through those compromises. The system it allows for a better quantification of the system security
starts from an initial security state where no components in the presence of zero-day vulnerabilities.
are compromised. Upon receiving intrusion detection Furthermore, it is worth noting that the presented tran-
alerts about ongoing attacks, the system moves to a new sition model does not address availability/confidentiality
state which highlights the attack progress and identifies attacks, nor does it address attacks that exploit shared cre-
the potentially compromised components. The critical- dentials/trusts or an insider. The modeling of those attacks
ity of a security state increases as the attack advances pertains as a need for more accurate cyber threat models
and the attacker is closer to imposing physical impact on for the smart grid.
the system operations. It is worth mentioning that high- To generate the MDP tree, we start from an initial
tech power components used in smart grid such as circuit state ∅ where no components are compromised. Next, using
breakers and switches have a cyber part (e.g., application Algorithm 1 and the connectivity matrix as input, the MDP
running on them) which could be compromised through state tree generator creates the MDP states and transitions.
a cyber attack. Starting from the initial state, Algorithm 1 creates entry
• A is a finite set of actions: For each state s, we asso- points corresponding to states accessible from the initial state
ciate a set of actions As an attacker might initiate. Each (lines 6-9), along with an associated transition. The reach-
action in As represents exploiting a known or zero-day able states represent components that are connected to the
vulnerability in a system component (i.e., SQL injec- Internet. Then, based on those new states, and starting with
tion, ssh vulnerability, etc). By taking action Ai from As , an entry point i, we add a new reachable state sij whenever
the attacker leverages the system inter-dependency and component j is connected to component i. This connectiv-
connectivity, and gains access to an additional compo- ity is implied through the use of the connectivity matrix
nent that augments his reward and brings him closer to builder. It is worth noting that, createReachableStates(s)
his target. In our implementation of actions associated function is a recursive function which returns all the pos-
with a state, we assigned random known software vul- sible states reachable from state s considering all the
nerabilities to the communication network components. components in this state and their connectivity to other
Moreover, to improve the system realism, we randomly components.
assigned actions that represent zero-day attacks exploit- Applying Algorithm 1 on the network topology in 2 while
ing unknown vulnerabilities to various Information and considering attack points at the control center (CC), WAN
Communication Technology (ICT) components available SCADA Network (W), gateway (G), and relays (R) results in
in our system model. the MDP shown in Fig. 3. This MDP is obtained through the
• Pa (s, s ) represents the probability to successfully transit following steps:
from state s to a reachable state s by taking action a. • Create the initial state ∅. Lines (3,4)
In our case, this probability is defined as the attacker’s • Create new states as states reachable from the initial state.
success rate for a specific attack scenario. To assign Lines (6-8)

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
2680 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO. 3, MAY 2020

Algorithm 1 MDPGenerator(int[][] ComponentsConnectivity) concurrent contingency identifier reconfigures the grid topol-
1: Output: Array<State> states; ogy into a set of k clusters (k ∈ {2, 3, 4, . . .}). Each cluster
2: Array<Transition> transitions;
3: State emptyState = new State() contains a set of transmission lines whose concurrent failure
4: states.add(emptyState); results in a higher reward function compared to individual
5: for (i:componentsConnectivity) do failures. For the case of a cluster formed of two transmission
6: if (i is an attacker’s entrypoint) then
7: State initial =new State(i); lines, we can mathematically represent this relation in Eq. (1):
8:      
9:
states.add(initial);
transitions.add(emptyState, initial);
RF uns ({ti }, P) + RF uns tj , P < RF uns ti , tj , P (1)
10: end if where RF uns (T,P) denotes the value of attacker reward func-
11: for (j:componentsConnectivity[i]) do
12: if (i is not connected to j) then tion due to the failure of the set T of transmission lines given
13: continue; the power network topology P. This function is part of our
14: end if smart grid testbed presented in Section III-G. Considering the
15: if (i and j mutually connected) then
16: if (sij does not exist) then example in Fig. 1, the individual failure of R6 or R8 does not
17: State sij = new State(i, j); impact the system. However, an attack that brings down both
18: states.add(sij ) relays would cause a blackout in the residential area. Hence,
19: transitions.add(initial, sij );
20: createReachableStates(sij ); the concurrent contingency identifier would place R6 and R8
21: else in a cluster.
22: transitions.add(initial,getState(i,j)); On the other hand, our concurrent contingency extensively
23: end if
24: else looks for contingencies that divide the grid into clusters of
25: State sij = new State(i, j); size k ∈ {2,3,4}. This can be changed to consider clusters of
26: states.add(sij ) larger sizes. However, based on the outcome of the analysis
27: transitions.add(initial, sij );
28: createReachableStates(sij ); presented in [12], we can see that it is enough to target a
29: end if relatively small number of the links available in a large power
30: end for system to induce a significant loss in the load served by this
31: end for
system. Hence, for each subset of relays of size k, if Eq. 1
is satisfied, we create a cluster representing this subset. Thus,
the concurrent contingency identifier outputs a set of clusters
representing the concurrent contingencies in the system.

F. Complementary State Generator

An analysis of the outcome of the MDP state tree gen-
erator indicates that the concurrent contingencies identified
through the clustering of the power grid are not present as
reachable states in the generated MDP. To address this issue,
we introduce the Complementary State Generator. The com-
Fig. 3. MDP state transition diagram generated based on network topology plementary state generator uses the clusters output by the
in Fig. 2.
concurrent contingency identifier, and the previously gener-
ated MDP, to introduce additional states resembling concurrent
contingencies into the MDP tree. This process results in a
• For each state s, we add new reachable states based on
complete MDP tree, and is presented in Algorithm 2:
components connected to those of s. For instance, G1 is
1) For each cluster, we consider all the possible state com-
connected to W so a combinatorial state WG1 would be
binations called subSt; including the state representing
added to the state W. Lines (17-20).
all the cluster elements. Line (5)
We would like to point out that we are considering single
2) For each subset of states subSt, we find the root node
contingency analysis in two substations only as the MDP state
using the function getRoot. Line (7)
space is simple to enumerate in this case, and we aim at testing
3) For each state s ∈ subSt, we find the path from the
the efficiency of using our security metric approach. However,
root to s. Line (9)
this study can be extended and applied to n substations as we
4) We combine all the paths for subSt states in order
shall see in the numerical results section.
to build one combinatorial path combPath, which
includes new states and transitions from the root to
E. Concurrent Contingency Identifier the complementary state covering all the elements in a
To perform a complete contingency analysis, it is essential cluster. Line (11)
to consider concurrent contingencies. This is mainly driven 5) The compromise of different components is considered
by the fact that the analysis of historical blackouts revealed as independent actions, we assign a transition probability
the presence of multiple failures in the grid [22]. To identify for added transitions, calculated as: Pr(A∩B) = Pr(A)×
such contingencies, our concurrent contingency identifier uses Pr(B)
the power grid topology to identify sets of components whose 6) We add the new states and transitions to produce the
concurrent failure deeply impacts the grid’s availability. The complete MDP tree. Lines (12, 13)

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2681

Algorithm 2 MDPComplete(MDPtree) small overloading conditions in the transmission lines,

1: Given : Array <Cluster> clusters; whereas excessive loading levels will result in the trig-
2: Output: Array <State> completedSt;
3: Array <Transition> completedTr; gering of the protection system as the system interprets
4: for (cluster:clusters) do that as an electrical fault. Thus, to calculate the reward
5: for (subSt:MDPtree.states.getSubSt(cluster)) do function based on the dynamic behavior of the power
6: Array <Path> paths;
7: State root = subSt.getRoot(); system, the output collected from the testbed is used to
8: for (clusterState:subSt) do verify whether any operational limit is violated or not.
9: paths.add(getPath(root, clusterState)); Following any violation or operation of the protection
10: end for
11: Path combPath = paths.combine(); system, the AC power flow equations should be resolved
12: completedSt.addAllSt(combPath.states); based on the system’s new topology and parameters. This
13: completedTr.addAllTr(combPath.transitions); iterative approach continues until the solution is obtained
14: end for
15: end for within the operating limits.
• The operation of the power system is dependent on the
sufficient generation and consumption of active as well
as reactive power. The reactive power flow may not
be used directly as consumed energy, however, its flow
is crucial for power system stability and proper opera-
tion. As an example, electrical motors consume a huge
amount of reactive power and insufficient generation of
reactive power will result in a huge voltage drop and
consequently, system instability. Thus, the magnitude of
apparent unserved power (|Suns | = |Puns + jQuns |)
Fig. 4. Complete MDP state transition diagram produced by Algorithm 2. should be used instead of active power in the calculation
of reward function.
Using the complementary state generator on the example in • Generally speaking, the main aim of an adversary is
Fig. 2, we get the complete MDP tree shown in Fig. 4. to cause damage and/or make the system vulnerable to
future incidents. In some cases, the adversary may not
G. Smart Grid Testbed cause immediate damage rather only directs the system
The impact of exploiting concurrent contingencies in the toward instability so that any failure, load increase, or
power system may result in loss of a generation unit, drop attack, results in complete system load outage or blackout.
in the served load, and/or bringing the system close to its Such scenarios are to be considered in the calculation of
instability limit. The quantification of the attack impact on reward function. Therefore, a term is added to the reward
the power system is made possible through the use of our function in order to quantify how far is the system from
smart grid testbed presented in [23]. We are able to check the its safe operational limits.
• The loss of load is not the only risk that an adversary
system behavior when concurrent contingencies are exploited,
and eventually compute the loss in load, generation, and vari- can impose on the power system. Despite the fact that
ations in the system. The outcome of this evaluation is used losing a generator may be compensated by other gen-
for the computation of the MDP reward function. eration units, the disconnection of a generation unit will
result in huge economic damage to the system. Moreover,
such an outage increases the pressure on the other gen-
H. Security Metric Calculator erators of the system, and may even result in a blackout
In this section, we define the reward function and the dis- if the production of remaining generators is not sufficient
count factor for the MDP, and calculate the security metric I(s) to supply the load, and balance the frequency. Therefore,
for each system state s. The reward function Ra (s, s ) is the the impact of losing a generation unit is also included in
received reward (from the attacker’s point of view) after transi- the proposed metrics.
tioning from state s to s due to action a. The reward function is Considering all the mentioned points, we define the reward
often assumed to be the unserved active power of the load [12] function as:
or the ratio that represents overloading of the transmission  
lines [9]. However, the use of these reward functions has some Ra (s, s ) = RF PowComp(s ), P − RF(PowComp(s), P) (2)
disadvantages which are discussed as follows.
• The security metrics are often calculated using the power where
flow solution and the static features of the power system
 
such as overloading level or unserved load. However, the RF PowComp(s ), P = α1 ηL + α2 ηG + α3 ηsm
power system dynamics, capacity limits and the impact of N
Loads
dependencies between the operation of different compo- ηL = SLunsi
nents are neglected in the calculation of these existing i=1
metrics. As an example, the attack may result in the 
NGenerators
overloading condition in several transmission lines of the ηG = SGunsi
system as shown in [9]. The power system can sustain i=1
Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
2682 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO. 3, MAY 2020

On the other hand, the discount factor γ represents the dif-

ference in importance between future and present rewards. In
other words, the discount factor values the immediate reward
above future delayed reward, and presents the uncertainty
about the future. From the mathematical perspective, it makes
an infinite sum finite. If we set γ = 1, the summation in Eq. 3
would not converge.
Assuming that we could estimate the current security state
by analyzing the alerts received from intrusion detection
systems, the Bellman Equation (Optimal Value Function) [25]
could be followed to quantify the criticality level of the current
state from the security perspective.
Fig. 5. 9-bus WSCC transmission system [24]. We leverage the Bellman equation which is a formulation
to connect a state (value/reward) to its predecessor as follows:
N i
Loads      
ηsm = It+1 (s) = max Pa s, s Ra s, s + γ It (s ) . (3)
a∈A(s)
i=1 k=1 s ∈S
   i The main objective behind this representation is to find the
l=1,l=k fl
× max 0, 1− ×Sloadi . system state with the maximum impact (reward), reachable
Sloadi
from the current state, in the most efficient manner (maxi-
In these equations, ηL , ηG , and ηsm represent the unserved mum success probability), as seen by the attacker. In CASeS,
apparent power, unused apparent generation, and system oper- the value iteration technique is implemented to compute the
ation margin, respectively. The coefficients α1 , α2 , and α3 are It+1 (s) from the Bellman Equation. The importance of the
their respective weights. NLoads , NGenerators and i represent Bellman equations is that they let us express values of current
the number of loads, number of generators, and the set of trans- states as values of other states. This means that if we know
mission lines connected to load i, respectively. The parameters the value of future state s , we can very easily calculate the
SLunsi , SGunsi , Sloadi and fl indicate the apparent unserved load, value of current state s. This opens a lot of doors for iterative
unused generator, the power consumption of ith load, and avail- approaches for calculating the value for each state, since if we
able capacity of lth transmission line, respectively. Assuming know the value of the next state, we can know the value of
α2 = α3 = 0 will result in a reward function considering the the current state. The most important thing about the Bellman
unserved power only while the assumption of α1 = α2 = 0 equation is that it allows us to calculate optimal policies, and
results in a function similar to that defined in [9]. solve the MDP from the attacker point of view. Moreover, dur-
We demonstrate the calculation of the reward function on ing intermediate states that correspond to cyber compromises,
the Western System Coordinating Council (WSCC) 9-bus the attacker receives a zero one-step reward, which is a very
transmission system, along with the associated load values and common practice in reinforcement learning. As the attacker
transmission line capacities, as shown in Fig. 5. B1-B18 are starts to explore the system by choosing actions correspond-
system circuit breakers that receive control commands from ing to exploits, the MDP starts to update the value of each state
their corresponding overcurrent (OC) relays. An outage of a it ends up in. Once the attacker reaches a terminal state (a state
single transmission line caused by an attack on relays does not that affects the unserved apparent power, unused apparent gen-
have an impact on the unserved load is expected as expected eration, or system operation margin), the reward propagates in
due to the (N-1) criteria. If two circuit breakers B16 and B17 a backward fashion and eventually the estimated value of all
are attacked, load 3 will be disconnected from the system and states along the way will be updated based on the recursive
ηL increases. If the circuit breakers B18 and B7 are attacked, Bellman equation (3). Even though a one-step reward from
the system still supplies the loads, whereas it loses one gen- state S to state S is zero, as the MDP completes the learning of
erator (G2) and the term ηG increases accordingly. In this the value of each state (i.e., the Bellman equation converges),
scenario, load 1 is supplied only through the transmission line it exploits the realized optimal policy to choose the action that
between buses 4 and 5. Thus, any fault or new attack on com- puts the system in the next state S that has the highest value.
ponents of this line will result in outage of this load, i.e., the This way, the attacker receives a zero step reward, but the
system is pushed toward its operation limits (ηsm increases). MDP made sure that the state it reached has the highest value
Moreover, as evaluated through our testbed, in this scenario and by following the optimal policy, it will eventually reach
transmission lines 8-9 and 4-6 have 10% and 7% overload, the terminal state with the highest reward.
respectively. The operation code of the transmission lines will The calculated value It+1 (s), as presented in Eq. (3),
not be violated in limited time spans due to such overloading, represents the security metric associated to the state s.
while any increase in the load will result in loss of transmis-
sion lines. Using the testbed, attacks on B2 and B15 resulted I. Framework Realization
in 146% overload on transmission line 4-5. As a result, Load1 We combine all the above mentioned components to enable
becomes disconnected in addition to the Load3 due to the the system security evaluation through CASeS as shown in
operation of the protection system at B7 or B8. Fig. 6. Based on the power and communication network

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2683

to operate normally based on the stable frequency and volt-

age provided by the generators. However, due to technical
limitations in capacity and type of generators such strategy
may not be always applicable. Another strategy can be the
development of microgrids in lower voltage levels. This strat-
egy not only increases the robustness of the system, but also
reduces its operation cost following the attacks or outages.
Deployment of such energy infrastructures ensures that fol-
lowing an anomaly in the behavior of the transmission system
the system loads remain connected to the system. Moreover,
for long term defense strategies, the power system utilities can
Fig. 6. CASeS architecture. increase the number of redundant transmission lines between
different areas of the system to transfer power through several
paths, and improve the reliability of the system. Such an action
topologies, CASeS extensively scans the combined cyber-
significantly improves the stability margin of the system and
physical components, and identifies concurrent contingencies.
its robustness, and ensures that even in case of multiple attacks
Using a Stochastic Markovian Decision Process [26], CASeS
or faults, the system operation is not interrupted. Despite the
enumerates the system security states, identifies states with
huge advantages of such remedy actions, it incurs a huge cost
multiple compromised components using the complementary
for the utilities.
state generator, and assigns relevant indices to those states
reflecting their criticality level. The resulting MDP is updated
only when there is a change in the system topology, or a IV. N UMERICAL E VALUATION
new vulnerability is identified on one of the system compo-
In this section, we present the evaluation of the proposed
nents. This allows CASeS to work offline, and prepare the
approach on the standard IEEE 14-Bus and 39-Bus NEW
MDP regardless of the system size. Based on the resulting
England systems. To complement the power component, we
model and the assigned indices, CASeS identifies the security
build an associated substation communication network as man-
state of the system and allows the preparation of corrective
dated by the IEC 61850-90-4 standard [27], connect this
actions corresponding to this state. To perform the online
network for monitoring and control purposes to the control
security assessment, operators in security centers of utilities
center based on Fig. 2, and evaluate the security posture for the
can combine CASeS framework with streams of alerts gen-
resulting system. We present the combined power and commu-
erated by intrusion detection systems, advanced sensors, and
nication systems for the 14-Bus in Fig. 7, along with a detailed
system management solutions to quantify the system secu-
presentation of the substation S12 network. Similar networks
rity state. Using those alerts, CASeS can identify the possible
are considered for other substations, but are not included in
attacker actions and consequent rewards, and eventually out-
the figure for simplicity of presentation. In our setup, a sub-
put the security metric. Hence, based on CASeS functionality,
station network consists of a substation bus connecting the
operators have a quantification of the system security posture,
main gateway, a HMI component, time sources and the relays
and are capable of initiating protection and recovery schemes
available in that substation. Furthermore, the network includes
in response to the identified threats. It is worth noting that
a process bus connecting the protection and control relays to
CASeS is intended to complement the knowledge the operator
merging units positioned in the different bays. Each transmis-
already has about the system topology and operations includ-
sion line is controlled by two relays located at substations
ing but not limited to control commands to open/close circuit
connected by this line; yet presented as a single relay accessi-
breakers, increase/decrease power generation, etc. Thus, legit-
ble from both substations, considering that those relays have
imate system operations initiated by the operators will not
similar functionality and an attacker need to compromise only
initially raise alerts by the deployed firewalls and intrusion
one of those relays to interrupt power flow over a transmis-
detection systems, nor conflict with the framework insights
sion line. Moreover, we randomly assigned vulnerabilities to
and generated outcome.
the network’s cyber components based on CVSS scores. To
assign those vulnerabilities, we created a pool of randomly
generated vulnerabilities and assigned each cyber component
J. Mitigation Schemes one vulnerability from this pool. In those experiments, we did
Based on the outcome of CASeS, the system operator can not consider any zero day vulnerabilities. However, this setup
initiate several strategies to limit the identified physical impact can be easily adjusted to consider zero day vulnerabilities.
resulting from the attack. Those strategies provide a level of We conducted experiments for different values of αi used in
robustness to the system, and may incur some technical or Eq. (2) while varying the discount factor γ used in Eq. (3).
economic costs as well. A primary defense strategy is the The αi variation aims at favoring one term of the reward func-
rescheduling of the system generators and equipping those tion over other terms, while the variation of γ presents the
generators with Automatic Generation Control (AGC). This attacker’s interest in future rewards (γ = 0.9) as opposed to
strategy improves the reliability of the system by letting the immediate rewards (γ = 0.1). For the 14-Bus system, we
separate isolated islands in the system (created by attacks) considered attacker’s interest in substations S2 and S4, since

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
2684 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO. 3, MAY 2020

TABLE II
CAS E S S ECURITY I NDEX BASED ON M ULTIPLE C ONTINGENCIES
FOR IEEE 14-B US S YSTEM

Fig. 8. Resulting MDP state transition diagram for S2.

Fig. 7. IEEE 14-Bus power-communication network.

TABLE I
CAS E S S ECURITY I NDEX BASED ON S INGLE -C ONTINGENCY
FOR IEEE 14-B US S YSTEM

Fig. 9. Resulting MDP state transition diagram for S4.

present only the results when two relays belonging to S2 and

S4 are compromised. To enable the calculation of the secu-
rity index, CASeS computes a complete MDP state transition
diagram, and creates new states to represent concurrent contin-
this illustrates the different factors of the reward function. The gencies. The resulting security index is presented in Table II.
areas affected by this interest are highlighted in Fig. 7. All sim- As can be seen from the calculated security index, concur-
ulations in this section were executed on a windows machine rent contingencies puts the system at risk from several aspects.
with Intel Core i7 CPU running at 2.67 GHz and equipped Moreover, based on the collected results, the attack will impact
with 12 GB of RAM. the system more if the attacker’s choice favors future rewards.
In the first set of results, we consider the IEEE 14-Bus This is a result of more rewarding actions associated with
system, and present the outcome of CASeS framework to com- future states as identified by the MDP.
ment on its impact on the evaluation of the system security To output the security index results, CASeS leveraged
in the presence of single contingencies, and the added value the MDP state transition diagram complemented with states
concurrent contingencies bring to this study. In the presence of representing concurrent contingencies. CASeS built a com-
single contingencies, using the MDP generated in the absence plete MDP representing the entire 14-Bus system presented in
of the complementary state generator, we evaluated the secu- Fig. 7, while considering two contingencies at a time. This
rity index for single contingencies. The resulting values are results in an increase in the MDP size from 48 states to
presented in Table I. As expected, those results abide by the 117 states. We represent the state transition diagrams for sub-
(N-1) design criteria and do not result in any load or generation station S2 and S4 in Figs. 8 and 9 respectively, while the
loss. However, our security metric captures variations in the state transition diagram for the whole system is presented
system operating margins as indicated in the last two rows of in Fig. 10. In Figs. 8 and 9, the states shown in red are the ones
Table I. CASeS quantifies this change as a security threat and corresponding to the additional states introduced by the com-
consequently calculates an index resembling the compromise plementary state generator presented in Section III-F. Those
of a single relay belonging to S2 or S4. states result from the concurrent contingency of several relays
Next, we evaluated the 14-Bus system security index in the through the compromise of different cyber components iden-
presence of two concurrent contingencies. This can be easily tified as W for wide area network, G for substation gateway,
extended for a larger number of contingencies, however we and R for relay.

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2685

Fig. 10. MDP state transition diagram for 14-Bus system.

TABLE III
CAS E S S ECURITY I NDEX BASED ON S INGLE -C ONTINGENCY that impact as presented in the resulting security index in the
FOR IEEE 39-B US S YSTEM last two rows of Table III. In the presence of multiple con-
tingencies, CASeS captures a larger impact and presents a
better evaluation of the system security posture as reflected in
Table IV. We can see that through the complete MDP gener-
ated by CASeS to reflect on the different security states of the
system, we have a better quantification of the system secu-
rity, especially for the cases when the impact is implicit, and
takes the form of bringing the system close to its stability
margins. As for the MDP, the initial MDP generated for the
TABLE IV
CAS E S S ECURITY I NDEX BASED ON M ULTIPLE C ONTINGENCIES
39-Bus system consisted of 982 states. This number increased
FOR IEEE 39-B US S YSTEM to 1051 states upon the application of the complementary state
generator component.
Finally, we comment on the runtime of the approach. We
have collected results on the MDP generation, MDP comple-
tion, and index calculation runtime. For each of the different
values of γ , and different combinations of the weight factors
(α1 , α2 , α3 ), we performed a hundred runs of the approach,
and we report on the average runtime of those runs. The aver-
age runtimes of the collected results are presented in Table V.
We performed a similar exercise for the 39-Bus NEW As can be seen from the table, the runtime increases with
England system, and we present the collect results for single the increase in system size. This is expected as the increase
and multiple contingencies in Tables III and IV respectively. in system size results in more transition states in the gener-
We consider the attacker interest in targeting substations S11 ated MDPs, and consequently affects the index calculation.
and S12. Due to properties of the 39-Bus NEW England However, keeping in mind that the preparation of the MDPs
system, in the presence of single contingencies, the system can be done offline, the MDP generation and completion
suffers the loss of loads when S12 is targeted as captured runtimes become of less importance to the system operators.
through the first row of Table III. Moreover, this loss affects On the other hand, the index calculation requires an average of
the system stability margins, and CASeS successfully captures 1.93 seconds for the IEEE 14-Bus system and 2.34 seconds for

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
2686 IEEE TRANSACTIONS ON SMART GRID, VOL. 11, NO. 3, MAY 2020

TABLE V
A PPROACH RUNTIME R ESULTS (S ECONDS ) concurrent power contingencies. The presented framework,
CASeS, quantifies the system security level, and assigns a
security index to system states based on the dynamic changes
in the system served load and the success chances of cyber-
attacks. CASeS security index quantifies the grid criticality
level, and reflects the system security posture. Results col-
the IEEE 39-Bus system. This indicates that CASeS quantifies lected through CASeS can be utilized to define corrective
in a timely manner the system security posture. actions for system protection in the presence of cyber-attacks.
Based on the collected and presented results, CASeS is We have demonstrated CASeS capabilities on different IEEE
capable of identifying the system security posture according test systems. The collected results through experimentation
to threats received or identified during the system operations. reveal CASeS capabilities, and manifest the need of such a
Moreover, through CASeS security metric, operators can rank framework for power system protection and control.
different system components based on their criticality level As a future work, we aim at extending the defined metric
and allocate protection resources accordingly. to cover other components of the smart grid. We are mainly
interested in the security quantification of wide area monitor-
V. R ELATED W ORK ing systems (WAMS), and we believe that we can build on
There have been several research efforts for propos- top of CASeS to design a security metric tailored for WAMS.
ing security evaluation techniques to quantify the criticality
level of systems from a security point of view in the IT
domain [28]–[30]. However, those solutions can not be easily R EFERENCES
adapted to cyber-physical systems such as smart grid, since [1] H. Farhangi, “The path of the smart grid,” IEEE Power Energy Mag.,
those techniques are not tailored to meet the characteristics vol. 8, no. 1, pp. 18–28, Jan./Feb. 2010.
[2] R. Baheti and H. Gill, “Cyber-physical systems,” Impact Control
and dynamics of cyber-physical systems. Technol., vol. 12, no. 1, pp. 161–166, 2011.
Recently, the security assessment of the smart grid gained [3] H. Georg, S. C. Müller, C. Rehtanz, and C. Wietfeld, “Analyzing cyber-
much interest from the research community [4], [7]–[10], [13], physical energy systems: The INSPIRE cosimulation of power and
ICT systems using HLA,” IEEE Trans. Ind. Informat., vol. 10, no. 4,
[16], [31]. Indeed, Zonouz et al. [9] introduced SOCCA as pp. 2364–2373, Nov. 2014.
a cyber-physical contingency analysis framework to quantify [4] B. Moussa, M. Debbabi, and C. Assi, “Security assessment of time
the physical impact of cyber-attacks. Through SOCCA, the synchronization mechanisms for the smart grid,” IEEE Commun. Surveys
Tuts., vol. 18, no. 3, pp. 1952–1973, 3rd Quart., 2016.
authors use cyber and physical network typologies to define a [5] Y. Mo et al., “Cyber–physical security of a smart grid infrastructure,”
security metric representing overloaded transmission lines in Proc. IEEE, vol. 100, no. 1, pp. 195–209, Jan. 2012.
the presence of cyber attacks. Nevertheless, this metric does [6] S. Sridhar, A. Hahn, and M. Govindarasu, “Cyber–physical system
security for the electric power grid,” Proc. IEEE, vol. 100, no. 1,
not consider concurrent contingencies, and fails to capture pp. 210–224, Jan. 2012.
other physical impact at the power system level. Another work [7] Z. Lu, X. Lu,W. Wang, and C. Wang, “Review and evaluation of secu-
from the literature that is close to ours is presented in [13] rity threats on the communication networks in the smart grid,” in Proc.
Military Commun. Conf. (MILCOM), 2010, pp. 1830–1835.
where the authors devise a combinatorial impact evaluation
[8] A. Hahn and M. Govindarasu, “Cyber attack exposure evaluation frame-
in the power grid based on cyber-physical relations between work for the smart grid,” IEEE Trans. Smart Grid, vol. 2, no. 4,
the grid components. This evaluation establishes a metric to pp. 835–843, Dec. 2011.
quantify cyber-attacks impact on IP-based substations, and [9] S. Zonouz, C. M. Davis, K. R. Davis, R. Berthier, R. B. Bobba, and
W. H. Sanders, “SOCCA: A security-oriented cyber-physical contin-
identifies critical substations which may present a significant gency analysis in power infrastructures,” IEEE Trans. Smart Grid, vol. 5,
risk on the system when compromised. However, the authors no. 1, pp. 3–13, Jan. 2014.
consider a single substation outage as the worst case scenario [10] S. Zonouz, C. M. Davis, K. R. Davis, R. Berthier, R. B. Bobba, and
W. H. Sanders, “SCPSE: Security-oriented cyber-physical state estima-
and do not use any real power system testbed for the evalua- tion for power grid critical infrastructures,” IEEE Trans. Smart Grid,
tion of the impact. Our work can be mainly distinguished from vol. 3, no. 4, pp. 1790–1799, Dec. 2012.
the literature by the consideration of concurrent power con- [11] R. Kinney, P. Crucitti, R. Albert, and V. Latora, “Modeling cascading
failures in the North American power grid,” Eur. Phys. J. B, Condens.
tingencies (multiple coordinated cyber-physical compromises) Matter Complex Syst., vol. 46, no. 1, pp. 101–107, 2005.
stemming from a cyber origin, and evaluating the physical [12] B. Moussa, P. Akaber, M. Debbabi, and C. Assi, “Critical links identi-
impact of those compromises using a realistic HIL smart grid fication for selective outages in interdependent power-communication
networks,” IEEE Trans. Ind. Informat., vol. 14, no. 2, pp. 472–483,
testbed. Through CASeS, we leverage cyber-physical depen- Feb. 2018.
dencies, the communication network architecture, intrusion [13] C.-W. Ten, A. Ginter, and R. Bulbul, “Cyber-based contingency
detection system reports, firewall rules and access control poli- analysis,” IEEE Trans. Power Syst., vol. 31, no. 4, pp. 3040–3050,
Jul. 2016.
cies, and power system dynamics to provide a quantification [14] R. M. Lee, M. J. Assante, and T. Conway, Analysis of the Cyber Attack
of the system security based on explicit and implicit physical on the Ukrainian Power Grid SANS Ind. Control Syst., Bethesda, MD,
impact of cyber attacks. This quantification allows the antici- USA, 2016.
pation of the impact of cyber compromises, and the preparation [15] Industrial Control Systems Cyber Emergency Response Team. Accessed
Sep. 10, 2018. [Online]. Available: https://ics-cert.us-cert.gov/
of real-time corrective actions. [16] Y. Zhang, L. Wang, Y. Xiang, and C.-W. Ten “Inclusion of SCADA
cyber vulnerability in power system reliability assessment considering
VI. C ONCLUSION optimal resources allocation,” IEEE Trans. Power Syst., vol. 31, no. 6,
pp. 4379–4394, Nov. 2016.
In this paper, we presented a contingency analysis-based [17] P. Mell, K. Scarfone, and S. Romanosky, “Common vulnerability scoring
security evaluation framework with a special emphasis on system,” IEEE Security Privacy, vol. 4, no. 6, pp. 85–89, Nov. 2006.
Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.
AKABER et al.: CASeS: CONCURRENT CONTINGENCY ANALYSIS-BASED SECURITY METRIC DEPLOYMENT FOR SMART GRID 2687

[18] P. Mell, K. Scarfone, and S. Romanosky, A Complete Guide to the Ribal Atallah received the B.E. degree in com-
Common Vulnerability Scoring System Version 2.0, vol. 1. Cary, NC, puter engineering from the Notre Dame University
USA: FIRST, 2007, p. 23. of Louaize, Lebanon, in 2009, the M.Sc.E.
[19] P. Cheng, L. Wang, S. Jajodia, and A. Singhal, “Aggregating CVSS base degree in computer engineering from Lebanese
scores for semantics-rich network security metrics,” in Proc. IEEE 31st American University in 2012, and the Ph.D.
Symp. Reliable Distrib. Syst., 2012, pp. 31–40. degree in information and systems engineering from
[20] M. Zhang, L. Wang, S. Jajodia, and A. Singhal, “Network attack surface: Concordia University, Montreal, Canada, in 2017.
Lifting the concept of attack surface to the network level for evaluating He is currently a Cybersecurity Research Scientist
networks’ resilience against zero-day attacks,” IEEE Trans. Dependable with Hydro-Québec working on various machine
Secure Comput., to be published. learning algorithms to protect the smart grid against
[21] L. Wang, T. Islam, T. Long, A. Singhal, and S. Jajodia, “An attack cyber attacks. His research interests include deep
graph-based probabilistic security metric,” in Proc. IFIP Annu. Conf. learning, deep reinforcement learning, cyber security of the smart grid, and
Data Appl. Security Privacy, 2008, pp. 283–296. intelligent transportation systems and queuing theory.
[22] Defense Use Case, Analysis of the Cyber Attack on the Ukrainian Power
Grid. Elect. Inf. Sharing Anal. Center, Mar. 2016.
[23] A. Albarakati, B. Moussa, M. Debbabi, A. Youssef, B. L. Agba, and
M. Kassouf, “Openstack-based evaluation framework for smart grid Basile L. Agba received the M.Sc. and Ph.D. degrees in electronics and
cyber security,” in Proc. IEEE Int. Conf. Commun. Control Comput. optoelectronics from the University of Limoges, France. He is the Vision
Technol. Smart Grids (SmartGridComm), 2018, pp. 1–6. and Partnerships Manager and the Senior Scientist with the Hydro-Quebec
[24] B. Russell, Power System Control and Protection. Amsterdam, Research Institute. Since 2009, he has been an Adjunct Professor with the
Netherlands: Elsevier Sci., 2012. [Online]. Available: École de technologie supérieure, Montreal. He has coauthored many scien-
https://books.google.ca/books?id=zMqybMj5LjMC tific publications and the Springer book Wireless Communications for Power
[25] F.-Y. Wang, H. Zhang, and D. Liu, “Adaptive dynamic programming: Substations: RF Characterization and Modeling.
An introduction,” IEEE Comput. Intell. Mag., vol. 4, no. 2, pp. 39–47,
May 2009.
[26] J. Filar and K. Vrieze, Competitive Markov Decision Processes. Chadi Assi (Fellow, IEEE) received the B.Eng. degree from the Lebanese
Heidelberg, Germany: Springer, 2012. University, Beirut, in 1997, and the Ph.D. degree from the Graduate Center,
[27] “Network engineering guideline for communication networks and City University of New York, NY, USA, in April 2003. He was a Visiting
systems in substations,” IEC-TW57, Geneva, Switzerland, Rep. IEC Scientist with Nokia Research Center, Boston, from 2002 to 2003 for one year,
61850–90-4, 2013. working on quality-of-service in optical access networks. He is currently a
[28] J. Pamula, S. Jajodia, P. Ammann, and V. Swarup, “A weakest-adversary Professor with Concordia University, where he holds the Tier I University
security metric for network configuration security analysis,” in Proc. 2nd Research Chair. He is currently supervising a group of 14 Ph.D. students
ACM Workshop Quality Prot., 2006, pp. 31–38. and 4 M.A.Sc. students and has successfully supervised 18 Ph.D. students
[29] M. Frigault, L. Wang, A. Singhal, and S. Jajodia, “Measuring network and 25 M.A.Sc. students. His students received very prestigious awards from
security using dynamic Bayesian network,” in Proc. 4th ACM Workshop NSERC and FQRNT. His current research interests are in the general areas of
Quality Prot., 2008, pp. 23–30. networks, network design and modeling, network optimization, resource vir-
[30] I. Kotenko and M. Stepashkin, “Attack graph based evaluation of tualization and network, and cyber security. He received the Prestigious Mina
network security,” in Proc. IFIP Int. Conf. Commun. Multimedia Rees Dissertation Award from the City University of New York in August
Security, 2006, pp. 216–227. 2002 for his research on wavelength-division-multiplexing optical networks
[31] C.-W. Ten, K. Yamashita, Z. Yang, A. V. Vasilakos, and A. Ginter, and lightpath provisioning. He held a Tier II University Chair with Concordia
“Impact assessment of hypothesized cyberattacks on interconnected bulk from 2012 to 2017 in the area of wireless networks. He is on the Editorial
power systems,” IEEE Trans. Smart Grid, vol. 9, no. 5, pp. 4405–4425, Board of the IEEE C OMMUNICATIONS S URVEYS AND T UTORIALS, and
Sep. 2018. serves as an Associate Editor for the IEEE T RANSACTIONS ON V EHICULAR
T ECHNOLOGY, the IEEE T RANSACTION ON COMMUNICATIONS, the IEEE
Parisa Akaber, photograph and biography not available at the time of T RANSACTIONS ON M OBILE C OMPUTING, and the IEEE T RANSACTIONS
publication. ON N ETWORK AND S ERVICE M ANAGEMENT .

Bassam Moussa received the B.S. degree in com-

puter science from the Lebanese University, Beirut,
Lebanon, in 2004, the M.Sc. degree in com- Mourad Debbabi received the Ph.D. and M.Sc.
puter science from the American University of degrees in computer science from the University
Beirut, Beirut, Lebanon, in 2009, and the Ph.D. of Paris-Sud, Orsay, France. He is a Full Professor
degree in information and systems engineering from with the Concordia Institute for Information Systems
Concordia University, Montreal, in 2018. He is cur- Engineering, where he is an Associate Dean
rently a Postdoctoral Fellow with Thales Research Research and Graduate Studies with the Gina
and Technology in Artificial Intelligence eXpertise Cody School of Engineering and Computer Science.
(cortAIx). His research interests include cybersecu- He holds the NSERC/Hydro-Quebec Thales Senior
rity for the smart grid, security of cyber-physical Industrial Research Chair in Smart Grid Security and
systems, IoT security, security metrics, time synchronization systems, commu- the Concordia Research Chair Tier I in Information
nication protocols, and cascading failures. He holds the FRQNT Postdoctoral Systems Security. He is also the President of the
Award with cortAIx. National Cyber Forensics and Training Alliance Canada. He is a member
of CATAAlliance’s Cybercrime Advisory Council. He serves/served on the
Mohsen Ghafouri received the B.Sc. and master’s boards of Canadian Police College, PROMPT Québec and Calcul Qué́bec.
degrees in electrical engineering from the Sharif He is the Founder and one of the Leaders with the Security Research Centre,
University of Technology, Tehran, Iran, in 2009 and Concordia University. He served as a Senior Scientist with the Panasonic
2011, respectively, and the Ph.D. degree in electrical Information and Network Technologies Laboratory, Princeton, NJ, USA; an
engineering from Polytechnique Montreal, Montreal, Associate Professor with the Computer Science Department, Laval University,
QC, Canada, in 2018. He was a Researcher with Canada; the Senior Scientist with General Electric Research Center, New
Iranian Power System Research Institute, Sharif York, USA; the Research Associate with the Computer Science Department,
University from 2011 to 2014. In 2018, he was a Stanford University, California, USA; and the Permanent Researcher with
Researcher with CYME International, Eaton Power the Bull Corporate Research Center, Paris, France. He supervised to success-
System Solutions, Montreal, QC, Canada. In August ful completion 30 Ph.D. students, 76 Master students, and 14 Postdoctoral
2018, he joined as the Horizon Postdoctoral Fellow Fellows. He published 5 books and more than 300 peer-reviewed research
with Security Research Group, Concordia University, where he is currently articles in international journals and conferences on cyber security, cyber
an Assistant Professor. His research interests include cyber security of forensics, smart grid, privacy, cryptographic protocols, threat intelligence gen-
smart grids, power system modeling, microgrid, wind energy, and control eration, malware analysis, reverse engineering, specification and verification
of industrial processes. of safety-critical systems, and programming languages and type theory.

Authorized licensed use limited to: Institute of Aeronautical Engineering. Downloaded on October 16,2024 at 11:21:00 UTC from IEEE Xplore. Restrictions apply.