On the demand side, prosumers such as residential, commercial, industrial consumers, have their dispatch centers to monitor their loads and generations in a User Energy System. These dispatch centers are managed by User Energy Management System (UEMS) (Ma L et al., 2016). Among them, residential and commercial electricity consumption affected by current electricity price is small and industrial electricity consumption is often relatively large, due to the difference in production costs elasticity. For example, residential prosumers have micro power generation units installed on the user side, such as photovoltaic and wind power, and can meet part of the power demand on the demand side through self-generation. The architecture of a User Energy System is shown in Figure 1.

In this architecture, prosumers can be divided into several areas for better control. Each area is controlled by a Distributed Control Unit (DCU), which is responsible for transferring distributed information. In UEMS, each DCU communicates with the demand-side control center to achieve measurement and control of the demand side. The center makes decisions based on the information uploaded by the DCUs. These DCUs control the energy transactions of prosumers in the area, generate electricity prices according to the power consumption and load type of the corresponding area, and upload them to the demand-side control center. The demand-side control center can communicate with the external distribution grid about its electricity information.

The Electricity price tampering attack scenario based on MITM attack is simulated in the experiment. MITM attack on electricity price provide false information to interfere with the power market. MITM attack secretly changed the communication mode between UEMS and demand side control center. It makes the initial connection becomes a new connection with the intervention of a MITM attacker. Therefore, the normal tariff transmitted in the original connection will be replaced by malicious electricity price required by the bidder. UEMS will no longer purchase and use power resources according to the normal electricity price. MITM attack mode is shown in Figure 2.

When a price tampering attack occurs on the demand side, it will cause demand changes to the corresponding area. Based on the price elasticity of electricity demand (PEED) model proposed by Hu et al. (2008), the electricity consumption change of an area after the attack can be expressed.

1) Large power consumers consume more variable electricity such as industrial users, and their electricity prices are higher than ordinary ones. When the price tampering attack occurs, due to the influence of production costs, large power consumers purchase electricity under certain restrictions. The electricity consumption D a after the price tampering attack is defined as:

2) Small power consumers usually consume load relatively constantly, such as residential and commercial users. They seldom change their own electricity demand when the electricity price changes. Suppose their electricity consumption in a certain area is D b 0 , it can be considered that the price tampering attack has no intuitive effect on their electricity demands, the electricity consumption D b after the price tampering attack refers to: D b 0 = D b .

According to the power consumption changes of these two types of consumers, the PEED model is used to express the electricity consumption D of the region after the price tampering attack: D = ( D a 0 + D b 0 ) + E ⋅ ( D a 0 + D b 0 ) ⋅ [ p ¯ − p ′ ] p ′ (2) where p ¯ is the benchmark electricity price from the external grid, the unit is ¥/kW. E is the self-elasticity coefficient of electricity demand price: E = ( ( D a 0 − D a / D a 0 ) / ( p ¯ − p / p ) ) .

To sum up, if the price tampering attack is successful, the target area has an electricity change Δ D in the total demand: Δ D = | D − ( D a 0 + D b 0 ) | (3)

Here are general intrusion detection processes of the power system:

1) Establish state estimation functions. The state estimation equation is: z = h ( x ) + e , where z = ( z 1 , z 2 , … , z m ) is the measured value vector of the measuring component; h ( x ) is nonlinear electricity balance functions; x = ( x 1 , x 2 , … , x n ) is a state vector; e = ( e 1 , e 2 , … , e m ) is the measurement error vector.

2) Simplify the state estimation functions. In order to facilitate calculation, assumptions are as follows: the bus voltage value is approximately equal to 1; the shunt component, bus, branch circuit, and reactive power flow can be ignored. Now, h ( x ) can be linearized to H x , where H m × n is a constant Jacobian matrix.

3) Modify the state estimation functions. When the price tamping attack occurs, prosumers response to change the demand loads, and the measured value vector is modified as Z a = z + a , where z is the true measured value, a = ( a 1 , a 2 , … , a m ) is a non-zero attack vector. This will cause the state vector to change: x ^ b a d   = x ^ + c , where x ^ is the initial state value, c is the amount of impact of the attack.

Now, the measurement error vector after the price tamping attack can be obtained: ‖ z a − H x ^ b a d ‖ R − 1 2 = ‖ z + a − H ( x ^ + c ) ‖ R − 1 2 = ‖ z − H x ^ + a − H c ‖ R − 1 2 (4)

Assuming that small independent effects make an additive contribution to each observation, the measuring datum are random and have a multivariate normal distribution based on historical data analysis. So a Bayesian model is established to describe the true data z as z ∼ N ( μ , σ 2 ) . When there is a price tamping attack, some specific measures such as electricity price and load demands are bound to be changed. The combination of these measures will cause the state variables to move away from their true values.

When the attacker knows the defense information of the defender (layout H and error detection algorithm, etc.), the covert attack can make a − H c zero, and the deviation | z i − Z i | generated by one measurement is not enough to be detected by the detection system.

When the deviation of all measured values in the vector is accumulated from the vector, the accumulated deviation will become prominent. The detection scheme studied in this section identifies attacks based on cumulative errors, such as the relationship between electricity changes and abnormal pricing measures.

Here, a space-based cumulative error detection method based on hypothesis testing is introduced. The cumulative deviation is as follows: ∑ i = 1 n ( z i ′ − Z ′ ) 2 σ i ′ 2 (5)

Here we consider two assumptions: H 0 and H 1 . H 0 is a null hypothesis in which the measured load value is true; H 1 is an assumption that the cyber system has been attacked. These two assumptions can be described as: H 0 : ‖ a ‖ 0 = 0 H 1 : ‖ a ‖ 0 > 0 (6)

We assume that measurement vector z ′ = ( z 1 ′ , z 2 ′ , … , z m ′ ) follows a multivariate Gaussian distribution and z i ′ are independent of each other. It can be expressed as z i ′ ∼ N m ( μ i ′ , σ i ′ ) , i ∈ [ 1 , m ] . Here, Z ′ is the average vector and Ξ is a diagonal covariance matrix. Thus, J ( z ′ ) = ( z ′ − Z ′ ) T Ξ − 1 ( z ′ − Z ′ ) , i.e., J ( z ′ ) ∼ χ 2 ( m ) . Based on the above, the hypothesis test is given by a threshold τ corresponding to the load changes. When J ( z ′ ) < τ , H 0 holds and the attack is undetected; when J ( z ′ ) ≥ τ , H 1 holds and the attack is detected.

An intrusion detection test environment is built to check the strategy’s effectiveness (Figure 3A). Its equivalent topology is shown in Figure 3B. In the Test Verification Center of the Principal Information and Safety Laboratory, the avalanche application attack test tool, Hessman switches, and Wireshark packet capture tools are used to test price tamping attacks. The communication side port connection diagram for the test process is shown in the Figure 3C.

In the experimental environment, each DCU (using 4 DCUs for simulation test) is connected to the simulation dispatch center through a Hessman switch. Simulated packet sending tools are used to send GOOSE/SV messages to UEMS, which simulates the normal output and consumption of each area on the demand side. In each DCU, the price information is collected in the information link through the packet capture tool and sent to the demand side control center regularly. In the demand side control center, the intrusion detection strategy is tested to detect the attacks. Due to limited resources, 4 DCUs are simulated in a UEMS.

The experiment test steps are as follows:

1) The input and output ports of DCU, UEMS, avalanche application attack tester, switch, and other devices are connected according to the communication topology. The DCUs are connected at all levels to the demand side control center through the communication equipment switch. Through the Hessman switch, the analog demand side control center and the switch connection port are assigned to VLAN100. Configure the DCU and switch connection ports at all levels as TRUNK ports.

In order to reflect the superiority of the intrusion detection strategy, a horizontal comparison is carried out. The detection results of traditional single-point detection, non-parametric cumulative detection, and cumulative error detection strategies under the same attack scheme and threshold are analyzed.

The relevant parameters of the experiment 1 are set as follows:

1) Set the current market electricity price to 100 ¥/kW.

The detection success rate obtained by simulation is shown in Figure 4A. The abscissa shows the number of detections. The ordinate is the detection success rate. 100 trials are conducted and the detection success rate is the ratio of successful intrusion detection number in the total number of tests. During the test, the detection success rate varies with the number of tests. This is due to errors (such as communication data packet loss and communication delay) that may occur during the test. From the overall trend, the cumulative error detection mentioned can achieve a detection success rate of more than 76%, the cumulative detection success rate (73% in 100 trials), and the single-point detection success rate (66% in 100 trials). It can be seen that the detection success rate is sorted according to size: cumulative error detection success rate > non-parametric cumulative detection success rate > single point detection success rate.

The relationship between detection success rate and the threshold τ is shown in Figure 4B. The abscissa shows the logarithmic function lg ( τ / 10 ) of the threshold τ . Different threshold values of 20, 40, 80, … 2,560 are chosen for tests. When τ ≤80, the detection success rate reaches the maximum and will not increase. When τ > 80, the detection success rate gradually decreases with the increment of the threshold value, the sensitivity of the algorithm becomes insufficient, and some price tampering attacks are missed from detection. When τ > 1,280, the detection success rate is less than 50%.

To examine the detection success of the defense strategy against different attack methods, experiment 2 first analyzed the detection success of the strategy when attacking different regions with the same amount of price tampering attack, Table 1. The parameters for experiment 2 are set as follows.

1) Set the current market electricity price to 100 ¥/kW.

The detection success rate obtained from the simulation is shown in Figure 5.

The horizontal coordinates of Figure 6 represent the 14 attack methods and the vertical coordinates represent the detection success rate. From the experimental results, it can be concluded that the detection success rate is higher when the tariff tampering attack attacks more DCUs, indicating that the proposed strategy is more effective in detecting tariff tampering attacks when they occur in more areas.

In this section, an improved IEEE-33 node distribution system (Meng et al., 2015) is used to verify the effectiveness of the proposed game model. As shown in Figure 7, the IEEE-33 node distribution system is divided into 4 areas. Each area contains a DCU, which is deployed on nodes 1, 2, 5, 25. The load is divided into the industrial, residential, and commercial load. Detailed load demand before attacks is shown in Table 2.

The distribution system sets normal electricity price p = 100 ¥/kW, p ¯ = 98 ¥/kW, u = 200 ¥/kW. The value ranges of 4 areas are: γ 1 ∈ [ 5 % , 10 % ] , γ 2 ∈ [ 5 % , 14 % ] , γ 3 ∈ [ 5 % , 16 % ] , γ 4 ∈ [ 5 % , 20 % ] . The power generation cost coefficient of each area is shown in Table 3, where a, b, c is the cost factor for power generation.

Refer to Table 2, D a 0 is the load before the price tampering attack of the industrial load; D b 0 is the load before the price tampering attack of the residential/commercial load. According different load ratios in each area, the importance of 4 regions are f1 = 0.9690, f2 = 0.4953, f3 = 0.2476, and f4 = 0.6110. When the threshold is set as, the detection result is better than others. When τ = 20 , the detection success rate is 83.0% for areas where detection and defense resources are deployed.

In the scenario analysis, the attacker modifies the electricity price to 80% of the normal electricity price to discuss the optimal defense strategy pair. In 4 attack target areas, assuming that the number of attack target areas is not greater than 3, there are 14 selectable offensive strategy combinations.

The load changes Δ D under various price tampering attack modes are calculated as shown in Table 4. It shows the variation of load under various offensive strategies. The offensive strategy that causes the largest load change is a14, which is 534.5 kW, and the strategy that causes the smallest load change is a1, which is 27 kW. At the same time, it can be obtained that attacking more areas often causes more load changes than attacking a single area. Compared to the attack modes of single target areas, a1, a2, a3, and a4, it shows that attack on area 2 causes a greater change in load than the attack on other areas.

According to different load changes Δ D in 14 attack modes, the defenders can calculate optimal γ k 、 β k to determine the ratio of power purchase and load shedding. Based on the quantitative model, the optimal values of γ k 、 β k are calculated iteratively by particle swarm optimization algorithm as shown in Table 5.

In Table 5, γ 1 ∗ , γ 2 ∗ , γ 3 ∗ , γ 4 ∗ are the optimal proportion of electricity provided by the electricity seller; β 1 ∗ , β 2 ∗ , β 3 ∗ , β 4 ∗ are the optimal loss weight coefficient of 4 areas. For the attack target area k, γ k tends to its maximum value when the cost function takes the minimum value. This is because, under current parameters, the cost of self-generated electricity is much smaller than the cost of purchasing electricity from the external grid. The prosumers tend to use self-generated electricity than purchase electricity outside. γ k is chosen to its maximum value, which is consistent with the policy of preferential consumption of self-generated electricity. It also shows that although the attack target area k is changed, the optimal values γ k   、   β k for the attacked area don’t change under different attack modes.

Under various attack modes, the electricity purchased from the external grid, self-generated power, and load-shedding capacity can be obtained, as shown in Figure 8A. The attack loss results can be further quantified as shown in Figure 8B.

In Figure 8B, the abscissa is the attack mode and the ordinate is the quantized loss value under attack. This illustration shows that attack method a14 causes the largest loss value of 898000¥; the attack mode a2 causes the smallest loss value of 86000¥.

In general, the loss value caused by the attack modes with more target areas is greater than that with fewer target areas. The overall loss value with three areas (attack modes a11-a14) as the attack target is greater than that of targeting two areas (attack modes a5-a10). The overall loss value of targeting two areas (attack modes a5-a10) is greater than that of targeting a single area (attack modes a1-a4).

To reflect the defense deploy verification with limited defense resources, the deployment area of the intrusion detection strategy has been limited to less than or equal to 2, so there are currently 10 methods to deploy intrusion detecting equipment, as shown in Figure 9. In 4 attack target areas, 14 selectable offensive strategy combinations have been mentioned before, so the total number of game rounds is R = 14 * 10 = 140.

According to the offensive strategy space and defense strategy space, the Nash equilibrium points under various attacks are obtained as shown in Table 6. The intersection of the offensive strategy and the defense strategy (green block) in Table 6 is the Nash equilibrium point under various attack modes.

It can be found that under the condition that the offensive resources and the defense resources have sufficient configuration, the Nash equilibrium point will appear in the place where the attack target and the defense target are consistent, namely (a1, d1), (a2, d2), (a3, d3), (a4, d4), (a5, d5), (a6, d6), (a7, d7), (a8, d8), (a9, d9), (a10, d10). It matches the actual deployment situation. In the case of insufficient defense resources, the Nash equilibrium points are (a11, d5), (a12, d9), (a13, d6), (a14, d10). The optimal defense strategy is not matched the actual deployment situation.

Considering 14 attack modes, the comparison of the loss value with optimal defense strategy and without defense strategy are shown in Figure 10A. For attack mode a1 to attack mode a14, the loss values decreased by 61.4, 37.6, 56.3, 46.5, 73.2, 56.0, 22.8, 36.2, 56.8, 31.5, 52.1, 45.2, 57.2, 31.7%. The results show that the optimal defense protection strategy can significantly reduce the losses caused by attacks.

Taking attack mode a13 as an example, the loss value of different defense strategies under 10 attack modes is shown in Figure 10B. The abscissa represents the defense strategy, and the ordinate represents the loss value under the current attack mode and defense strategy. It can be seen that the defense strategy d6 has the best defense result and the loss value is 345500¥. On the contrary, the defense strategy d2 has the worst defense result, even if it has no defense result. In summary, Nash equilibrium point (a13, d6) has the best deployment and defense strategy.