Optimal Data Attacks on Power Grids: Leveraging Detection & Measurement Jamming

Meter measurements in the power grid are susceptible to manipulation by adversaries, that can lead to errors in state estimation. This paper presents a general framework to study attacks on state estimation by adversaries capable of injecting bad-data into measurements and further, of jamming their reception. Through these two techniques, a novel detectable jamming' attack is designed that changes the state estimation despite failing bad-data detection checks. Compared to commonly studied hidden’ data attacks, these attacks have lower costs and a wider feasible operating region. It is shown that the entire domain of jamming costs can be divided into two regions, with distinct graph-cut based formulations for the design of the optimal attack. The most significant insight arising from this result is that the adversarial capability to jam measurements changes the optimal ‘detectable jamming’ attack design only if the jamming cost is less than half the cost of bad-data injection. A polynomial time approximate algorithm for attack vector construction is developed and its efficacy in attack design is demonstrated through simulations on IEEE test systems.

💡 Research Summary

The paper extends the conventional cyber‑attack models on power‑system state estimation by allowing an adversary to both inject false data into insecure measurements and to jam (i.e., block) the reception of those measurements. Using the DC power‑flow model, the authors first review the standard weighted least‑squares estimator, the residual‑based bad‑data detection test, and the subsequent bad‑data removal process. Traditional “hidden” attacks keep the residual unchanged (a = Hc) and therefore evade detection, while “detectable” attacks deliberately trigger the detector but rely on the estimator’s removal of a subset of measurements so that the remaining corrupted data still changes the state estimate. The feasibility of a detectable attack is shown to be equivalent to finding a cut in the measurement graph G_H whose insecure edges constitute a strict majority; the optimal attack corresponds to the minimum‑cardinality such cut.

The novel contribution is the introduction of measurement jamming. Each insecure measurement can be either (i) corrupted at cost p_I or (ii) jammed at cost p_J (with 0 ≤ p_J ≤ p_I). By jamming k_J edges of a cut C, the effective size of the cut is reduced to |C| − k_J, and the attacker needs to inject false data only into a majority of the remaining insecure edges. The authors formulate the optimal “detectable jamming” attack as a mixed integer program (P‑2) that minimizes the total cost p_J·k_J + p_I·k_I subject to feasibility constraints derived from the cut structure. They prove that the optimal attack can be obtained by evaluating all feasible cuts and, for each, choosing the best k_J; the overall problem splits into two regimes based on the relative magnitude of p_J and p_I/2.

If p_J ≥ p_I/2, jamming is not sufficiently cheap, and the optimal strategy reduces to the classic detectable attack (no jamming) or at most a single jammed edge; the cost reduction is marginal. If p_J < p_I/2, the attacker can substantially lower the cost by jamming enough insecure edges so that only a small minority needs to be injected, yielding up to a 50 % cost saving compared with the pure detectable attack. The authors also show that the set of system configurations vulnerable to detectable‑jamming attacks is identical to that for detectable attacks and strictly larger than the set vulnerable to hidden attacks.

To solve the problem efficiently, the paper proposes a polynomial‑time approximation algorithm that iteratively computes minimum‑weight cuts on a graph where each edge is weighted by p_I (for injection) or p_J (for jamming). The algorithm recursively adjusts the cut by “promoting” edges to be jammed when it reduces the total cost, guaranteeing a solution within a provable bound of the optimum.

Extensive simulations on IEEE 14‑bus, 30‑bus, and 118‑bus test systems validate the theory. Results demonstrate that when p_J < p_I/2, the optimal detectable‑jamming attack costs 30 %–60 % less than the best detectable attack and achieves a higher success probability. Moreover, the authors find that protecting the system against such attacks requires securing at least half of all measurements—a much stricter requirement than for hidden attacks, where protecting a number of measurements proportional to the number of buses suffices.

In conclusion, incorporating measurement jamming dramatically expands the adversary’s capability, lowers the economic barrier to successful attacks, and challenges existing resilience metrics. The work suggests that future grid security designs must consider both data integrity and communication availability, and that increasing the proportion of incorruptible (or highly protected) measurements is essential to mitigate this broader class of threats. Future directions include extending the analysis to the nonlinear AC model, dynamic jamming strategies, and real‑time detection‑and‑mitigation schemes.