Power system is one of the most critical cyber–physical systems in a sustainable society, whose security and reliability can significantly impact other infrastructures. Therefore, security and resilience of smart grids are one of the most challenging research questions in protection of critical infrastructures. After cyberattacks on the U.S. power grid in 2018, the national security agency announced cyberattacks might cause a blackout in transmission systems. Therefore, it is critical to model cyberattack scenarios, propose a detection strategy to mitigate these threats in a realistic context, and study how the models can improve the defense of large-scale grids. In this paper, a bi-level mixed-integer linear programming (BMILP) model is developed to accurately model false data injections (FDIs) that are targeted to overflow multiple transmission lines and cause a blackout in large-scale grids. Compared to the existing research, the proposed model considers that attackers might have limited access to measurement buses and models attacks on targeted transmission lines without being detected by existing DC state-estimation. In addition, to protect the system against these attacks, it is proved that a detection framework based on recursive weighted least-square (WLS) state-estimation can detect the FDIs, unlike classical weighted least square (WLS) estimation that fails to identify stealthy FDIs. To validate the effectiveness of the proposed attack model and detection framework in practical grid infrastructures, the IEEE 118-bus benchmark and a 2000-bus synthetic grid replicating the electricity network of Texas, U.S. are used.

电力系统是可持续社会中最关键的网络物理系统之一，其安全性和可靠性会显着影响其他基础设施。因此，智能电网的安全性和弹性是关键基础设施保护中最具挑战性的研究问题之一。2018 年美国电网遭受网络攻击后，美国国家安全局宣布网络攻击可能导致输电系统断电。因此，对网络攻击场景进行建模，提出一种在现实环境中减轻这些威胁的检测策略，并研究这些模型如何改进大规模电网的防御至关重要。在本文中，开发了一种双层混合整数线性规划 (BMILP) 模型，以准确模拟虚假数据注入 (FDI)，这些虚假数据注入 (FDI) 旨在使多条传输线溢出并导致大规模电网停电。与现有研究相比，所提出的模型认为攻击者可能对测量总线的访问有限，并对目标传输线进行模型攻击，而不会被现有的直流状态估计检测到。此外，为了保护系统免受这些攻击，证明了基于递归加权最小二乘 (WLS) 状态估计的检测框架可以检测 FDI，这与经典加权最小二乘 (WLS) 估计无法识别隐身行为不同。外国直接投资。为了验证所提出的攻击模型和检测框架在实际电网基础设施中的有效性，