Impact modeling of DSO-TSO cross-domain fault propagation attacks

Cross-domain threats are a real challenge for power system operators. While existing research has focused primarily on cyberattacks within either transmission or distribution networks, a critical gap remains in understanding the impacts of cross-domain threats. In response, this paper analyzes coordinated attacks originating from medium-voltage (MV) systems and propagating to high-voltage (HV) transmission systems (TSs) through shared substations. A new approach is proposed to model the possibility of such fault propagation from distribution system operator’s (DSO) domain to TS operator’s (TSO) domain. The hybrid-attack scenario consists of two sequential steps: 1) manipulating the protection settings of protective devices 2) causing man-made faults on MV feeders. This is formulated as a bilevel optimization problem considering attackers’ and TSO’s perspective. In addition, the concept of minimal cut-sets is deployed to capture the process of the fault propagation through shared substations. The proposed framework can be used by TSOs as a tool for conducting the impact assessment. The proposed model is tested on the IEEE reliability test system to demonstrate its effectiveness. The simulation results show that the hybrid attacks can lead to significant disruptions, including direct and indirect load shedding, as well as multiple transmission/MV line outages, and hence should be considered by system operators
in their security management policies.