Security Analysis of Interdependent Critical Infrastructures: Power, Cyber and Gas

Our daily life is becoming more and more reliant on services provided by the infrastructures

power, gas , communication networks. Ensuring the security of these

infrastructures is of utmost importance. This task becomes ever more challenging as

the inter-dependence among these infrastructures grows and a security breach in one

infrastructure can spill over to the others. The implication is that the security practices/

analysis recommended for these infrastructures should be done in coordination.

This thesis, focusing on the power grid, explores strategies to secure the system that

look into the coupling of the power grid to the cyber infrastructure, used to manage

and control it, and to the gas grid, that supplies an increasing amount of reserves to

overcome contingencies.

The first part (Part I) of the thesis, including chapters 2 through 4, focuses on

the coupling of the power and the cyber infrastructure that is used for its control and

operations. The goal is to detect malicious attacks gaining information about the

operation of the power grid to later attack the system. In chapter 2, we propose a

hierarchical architecture that correlates the analysis of high resolution Micro-Phasor

Measurement Unit (microPMU) data and traffic analysis on the Supervisory Control

and Data Acquisition (SCADA) packets, to infer the security status of the grid and

detect the presence of possible intruders. An essential part of this architecture is

tied to the analysis on the microPMU data. In chapter 3 we establish a set of anomaly

detection rules on microPMU data that

flag "abnormal behavior". A placement strategy

of microPMU sensors is also proposed to maximize the sensitivity in detecting anomalies.

In chapter 4, we focus on developing rules that can localize the source of an events

using microPMU to further check whether a cyber attack is causing the anomaly, by

correlating SCADA traffic with the microPMU data analysis results. The thread that

unies the data analysis in this chapter is the fact that decision are made without fully estimating the state of the system; on the contrary, decisions are made using

a set of physical measurements that falls short by orders of magnitude to meet the

needs for observability. More specifically, in the first part of this chapter (sections 4.1-

4.2), using microPMU data in the substation, methodologies for online identification of

the source Thevenin parameters are presented. This methodology is used to identify

reconnaissance activity on the normally-open switches in the substation, initiated

by attackers to gauge its controllability over the cyber network. The applications

of this methodology in monitoring the voltage stability of the grid is also discussed.

In the second part of this chapter (sections 4.3-4.5), we investigate the localization

of faults. Since the number of PMU sensors available to carry out the inference

is insufficient to ensure observability, the problem can be viewed as that of under-sampling

a "graph signal"; the analysis leads to a PMU placement strategy that can

achieve the highest resolution in localizing the fault, for a given number of sensors.

In both cases, the results of the analysis are leveraged in the detection of cyber-physical

attacks, where microPMU data and relevant SCADA network traffic information

are compared to determine if a network breach has affected the integrity of the system

information and/or operations.

In second part of this thesis (Part II), the security analysis considers the adequacy

and reliability of schedules for the gas and power network. The motivation for

scheduling jointly supply in gas and power networks is motivated by the increasing

reliance of power grids on natural gas generators (and, indirectly, on gas pipelines)

as providing critical reserves. Chapter 5 focuses on unveiling the challenges and

providing solution to this problem.