The Information Security Issues of Distributed Economic Dispatch for New Generation Power Systems—Present Situation and Forecast

Abstract

With the large scale and high proportion of distributed generation connected to the power grid, the distributed economic dispatch system has attracted more attention because of its significant advantages. However, the distributed economic dispatch system faces more serious information security issues due to the variation of communication topology. Therefore, the purpose of this paper is to review the information security issues that may occur in the distributed economic dispatch system and the defense measures. By summarizing the existing literature on information security issues and defense measures, it can be found that the current research focuses on the cyber-side defense for information security, and lacks consideration of the cyber-physical coupling characteristics. Additionally, the separate cyber-side defense measures still have a defense blind spot and cannot respond in a timely manner to the physical-side actions caused by information security issues. Finally, the establishment of the information security issues model and the construction of the integrated security defense system are discussed from the perspective of the power cyber-physical system. This research will be helpful in the construction of the security defense system for information issues in distributed economic dispatch systems.

1. Introduction

The new generation power system takes wind, solar, and other new energies as mainstays while fossil fuels will serve as supplements, and the proportion of new energy sources is gradually increasing. Meanwhile, smart meters, distributed generation inverters, and other intelligent terminals will be widely integrated into the new generation power system. These characteristics contribute to promoting the cleanliness, flexibility, digitization, and intelligence of the power system [1]. A large number of geographically dispersed distributed generations (DGs), such as photovoltaic, wind power and energy storage, access the power system [2]. Therefore, it is crucial to design an efficient economic dispatch strategy. Under the premise of satisfying the system power quality and safe operation, the active power among each DG is rationally distributed to minimize the economic cost of system operation.

Depending on the structure, the economic dispatch system can be divided into the centralized model and the distributed model. The centralized economic dispatch system has advantages such as simplicity and efficient operation. When the number of DGs is larger, the centralized economic dispatch system has poor reliability and robustness, high construction and maintenance costs, heavy computational burden on the dispatch center, and the inability to meet the “plug-and-play” needs for DGs. Therefore, the requirements of stable control and optimized operation of the system can no longer be met [3,4]. Compared with the centralized economic dispatch system, the distributed economic dispatch system has the characteristics of decentralization, higher reliability and scalability, smaller communication burden, and greater robustness and privacy. The DGs in the distributed economic dispatch system can make decisions independently, perform necessary information interaction with others through the communication network, and cooperate with each other to complete the economic dispatch task. In the distributed economic dispatch system, the topology of the communication network changes from the star shape in the centralized mode to an arbitrary connected graph. Intelligent agents cooperate with each other to complete the tasks of information collection, processing, computation, and decision [5,6].

Although the distributed economic dispatch system has many of the advantages described above, the large scale and complexity of the system make it imperative to consider security issues. Currently there are two new types of security issues in the distributed economic dispatch system, namely cyber-attacks conducted by attackers external to the system and malicious behaviors initiated by internal members of the system. First of all, the local communication network topology of the distributed economic dispatch system is no longer a single star topology, and its variation provides wider space conditions for the implementation of cyber-attacks from the external environment [7,8]. At the same time, the solution of distributed economic dispatch problems usually needs to be completed through an iterative process, which provides wider time conditions for attackers to implement cyber-attacks. Once one or more nodes in the system suffer from cyber-attacks, the false information will quickly spread to all nodes, preventing the distributed economic dispatch system from running in the optimal state, and even causing system instability. In addition, the prerequisite for the successful implementation of distributed economic dispatch is that each participant is “honest” and trusts and cooperates with each other. However, each individual involved in the power system economic dispatch has independent control and decision-making power in the distributed mode. Therefore, a small number of individuals may carry out malicious behaviors to gain more economic benefits, which destroys the optimal operating state of the system and damages the overall economic benefits of the system [9].

If there is no security protection mechanism in the system, it may fail to achieve the goal of economic dispatch, result in data loss and heavy economic losses, and even cause system instability due to cyber-attacks or malicious behaviors. Therefore, based on collecting and summarizing the existing literature and research, this paper comprehensively reviews information security issues in distributed economic dispatch. It covers the types, hazards, and preventive measures of information security issues, and suggests areas for future research. The work of this paper will provide some guidance for the subsequent design of the distributed integrated security and economic dispatch strategy of the new generation power system.

The structure of this paper is as follows: In Section 2, two typical information security issues, namely external cyber-attacks and internal malicious behavior, are introduced and qualitatively evaluated. Furthermore, the countermeasures of external cyber-attacks and internal malicious behaviors are summarized in Section 3 and Section 4, respectively. Finally, based on the current research situation, the model building of information issues and the security defense system are discussed in Section 5.

2. Information Security Issues in Distributed Economic Dispatch Systems

The three elements of power system information security objectives are confidentiality, integrity, and availability, or “CIA” for short [10]. From the perspective of breaking or violating the three elements of security, the information security issues of economic dispatch in the new generation power system will arise from both internal and external sources of the system [11]. Figure 1 shows the information security issues of the distributed economic dispatch system. Data acquisition equipment, mainly using phasor measurement units (PMUs), collects voltage and current data from the power distribution network and DGs, calculates active and reactive power, and uploads the data to communication networks. Based on the uploaded power and other data information, the designed distributed economic dispatch strategy calculates output commands for DGs and adjusts their output through control equipment. Similar to existing cyber-physical systems (CPSs), the external information security concerns mainly arise from a series of attacks targeting communication networks and PMUs. Furthermore, the internal information security issues are specific to distributed economic dispatch systems and are caused by the malicious behavior of selfish nodes within the system.

2.1. External Cyber-Attacks

External network attacks mainly target physical equipment and communication networks. As a crucial piece of data acquisition equipment, PMU data directly impact the operational effectiveness of system monitoring, early warning, protection, and dispatch control. Cyber-attacks causing abnormal PMU data include false data injection (FDI) attack and time synchronization (TS) attack [12]. According to the different means of attack on communication networks, the attacks can be divided into information attacks and communication attacks. Information attacks are usually implemented on the cyber side to manipulate the transmitted information, and for FDI attack and replay attack [13,14]. Communication attacks usually target communication links or channels to disrupt communication to affect system information interaction, and the denial of service (DoS) attack is the most important type of communication attack.

2.1.1. TS Attack

PMUs digitize voltage and current sampled signals from voltage transformers and current transformers using analog-to-digital converters [15,16]. These signals are processed by phasor computation modules and synchronized with GPS to generate phasor measurement data with timestamps. PMUs synchronize time using civilian GPS, which does not require authentication, making them vulnerable to a GPS spoofing attack, also known as a TS attack. The attacker first emits interference signals to disrupt GPS receivers, preventing them from receiving accurate GPS information. They then spoof incorrect GPS signals to the receivers, altering the time signal of PMUs and introducing errors in phase angle measurements. Synchronized measurement data under TS attack can be represented as follows [12]:

$$z_t^{\mathrm{TS}}=e^{j\Delta {\theta }_t}{z}_t$$

(1)

$$\Delta {\theta }_t=2\pi f\Delta t_{att}$$

(2)

where $z_t$ is the normal phasor measurement data at time $t$ for the PMU; $z_t^{\mathrm{TS}}$ is the phasor measurement data for the PMU at time $t$ under TS attack; $\Delta {\theta }_t$ represents the phase shift caused by the TS attack at time $t$ for the PMU; $\Delta t_{att}$ represents the time deviation caused by the TS attack at time $t$ for the PMU; $f$ is the frequency of the power system.

The phase shift caused by a TS attack directly alters measurements such as active power, which affects the decisions in distributed economic dispatch and increases the operating costs of the power system. Furthermore, measurement data under TS attack may affect system state estimation and dispatch controls, potentially leading to cascading failures or widespread blackout incidents. TS attack can compromise data integrity without physical network access, and current GPS receivers have difficulty detecting false GPS signals [17,18,19].

2.1.2. DoS Attack

In a DoS attack, the attacker sends a large number of invalid messages to the neighboring nodes to block the communication link and disrupt the normal transmission of information in the communication network. The effect of a DoS attack on a communication network is equivalent to the loss of data packets, which results in the failure of information transmission between nodes. The communication link with data packet loss can be considered as disconnected, so the topology of a communication network subjected to DoS attack is changed from a fixed topology to a time-varying one [20,21]. Due to the randomness of DoS attack, the attack may occur at any communication time and on any communication link. The communication topology of the system after a DoS attack will have two types, as shown in Figure 2 [22].

In Figure 2a, the attacker concentrates resources to block all the communication links of a node so that it cannot communicate normally with its neighboring nodes. The node is isolated in the communication network, and the system communication network topology becomes an unconnected graph. In Figure 2b, the attacker performs information blocking only on one or more communication links of a node. However, the node still maintains communication with some of its neighbors and the system communication network topology remains connected.

2.1.3. FDI Attack

In an FDI attack, the attacker injects predetermined false data into PMU measurement data [23] or communication data in communication networks [24], thereby compromising data integrity and authenticity. The system makes dispatch decisions based on PMU measurement data and communication data. Therefore, the false data directly affect the dispatch or state estimation of the system, leading to deviations from the economically optimal state. This will result in increased operational costs or economic losses and may even lead to serious power incidents.

A stealthy attack is a common well-coordinated and designed malicious FDI attack [25], whose attack signals can bypass protection mechanisms such as bad data detection without triggering alarms. Furthermore, it will usually cause the system to operate in a non-optimal state, resulting in economic losses. Stealthy attacks can be categorized into offline and online forms [26]. The former injects false data into the consensus formation process of distributed algorithms, which usually does not destroy the convergence of the algorithms. However, it will lead to the imbalance of supply and demand power and the decrease in the consensus efficiency of distributed algorithms, and will also cause the distributed system to deviate from the optimal operating point. The latter injects false data into the cost parameters of power generation, which can increase the operating cost of the power system while maintaining the balance of supply and demand power.

2.1.4. Replay Attack

A replay attack compromises data integrity by maliciously intercepting and then retransmitting data [27]. In a replay attack, the attacker first intercepts and records the normal transmission data and then selects some of the normal data to transmit to the neighbor nodes in the form of data duplication or data delay [28]. A replay attack allows the attacker to obtain the system data so as to grasp the system operation status, which destroys the closure of the system. In addition, a replay attack will cause some nodes to receive incorrect information, which will degrade the system performance and even cause a loss of stability.

2.2. Internal Malicious Behaviors

The internal information security issues of distributed economic dispatch systems arise from the malicious behaviors of some nodes participating in economic dispatch to gain more economic benefits, and can be categorized into deception behavior and fraud behavior.

2.2.1. Deception Behavior

Deception behavior is similar to external deception attack, but performed by selfish nodes within the system. Depending on the scale, the deception behavior can be performed by a single individual [29] or by multiple cooperating individuals [30]. In single individual deception, a single selfish node injects random data to interfere with the distributed algorithm. The node sends misleading messages to the neighbor nodes to influence the consensus process of the distributed system, and affects the operation of the system to converge to the desired target value of the selfish node. Therefore, single individual deception destroys the optimal economic operation of the system and benefits the selfish node. In multi-individual cooperative deception, multiple selfish nodes cooperate to launch deception behaviors to their neighboring nodes, dragging all the common nodes to the operating state of the selfish nodes, causing greater economic losses in the system.

2.2.2. Fraud Behavior

Fraud behavior is the behavior of selfish nodes that participate in distributed algorithms by falsely modifying their information to gain benefits. Depending on the modification of the selfish node’s information, the fraud behavior can be classified into constraint fraud behavior [31] and cost fraud behavior [32]. In constraint fraud behavior, selfish nodes use false constraints when their neighbor nodes participate in the distributed algorithm, and the rest of the nodes optimize their objective function by considering their original constraints. The selfish nodes use false constraints to make the system to run in their own profitable operating state by reducing their own cost function. Cost fraud behavior is a false modification of the true cost function by the selfish nodes, resulting in a coordination process that is more favorable to their self-interest.

Overall, internal malicious behaviors are implemented by internal selfish nodes to improve their own economic interests. Therefore, the behaviors only decrease the overall economic efficiency of the system and generally do not affect other aspects of system performance.

2.3. Impact Assessment of Information Security Issues

Based on the above analysis,

Table 1. Characteristics of the information security issues.

Information Security Issues	Type	Means	Purpose
External cyber-attack	TS attack	Tampering with data timestamps	Destroying information integrity
	DoS attack	Communication interruption	Disrupting communication availability
	FDI attack	Injecting false data	Destroying information integrity
	Replay attack	Tampering with real-time data	Destroying information integrity
Internal malicious behavior	Deception behavior	Injecting false data	Undermining system economy
	Fraud behavior	Tampering with one’s own information	Undermining system economy

synthesizes the characteristics of various types of information security issues in distributed economic dispatch systems.

This paper qualitatively evaluates the impact of external attacks using six indicators: communication availability, information integrity, data confidentiality, system economy, destructiveness, and stealthiness of the attack, as shown in Figure 3. A TS attack is extremely stealthy and destroys data integrity by spoofing incorrect GPS signals to the GPS receivers in PMUs and tampering with timestamps. A DoS attack affects the information communication by disrupting the communication channel, causing certain damage and economic loss to the system. An FDI attack in deception attacks has a high degree of stealthiness and destructiveness by intercepting the communication information and injecting false information, causing the system to operate in non-optimal conditions, and resulting in economic loss to the system. A replay attack in deception attacks also has a high degree of stealth and attacks in real time through the means of communication data duplication or delay, resulting in the degradation of the system performance and a certain amount of economic loss.

Internal malicious behaviors, which are dishonest behaviors performed by internal malicious nodes in order to improve their own economic interests, only reduce the overall economic benefit of the system and do not cause any other impact.

3. Countermeasures for External Cyber-Attack

In this paper, the strategies to respond to external cyber-attacks on the system are categorized into pre-attack prevention, detection during the attack, and suppression during the attack, which can be analyzed according to the different defense stages [33].

3.1. Pre-Attack Prevention

Some of the more researched pre-attack prevention methods include communication authentication, data encryption, and secure communication mechanisms based on emerging technologies, as shown in Figure 4.

Communication authentication: Communication authentication verifies the identity of the communicating parties and confirms whether the communication information is complete or modified. At present, digital signature technology [34,35], digital certificates [36], and anonymous authentication technology [37] are widely used, which can effectively prevent many types of attacks. In addition, communication authentication based on the hash tree has also been promoted and applied. Ref. [38] proposes an authentication scheme based on the Merkle hash tree, which has low operational cost and computational complexity, and can effectively defend against FDI attack and replay attack. Ref. [39] proposed a trusted sensing foundation based on hash message authentication, encrypting measurement data in PMUs to effectively prevent attackers from conducting an FDI attack.

Data encryption: In order to ensure the integrity and confidentiality of data, information is usually encrypted by specific means before it is transmitted. Currently, there are two main types of encryption algorithms: symmetric encryption algorithms and asymmetric encryption algorithms. The former is single key encryption, which means that the same key is used for both the encryption process and the decryption process. The commonly used symmetric encryption algorithms are the data encryption standard (DES) [40], the triple data encryption standard (3DES) [41], the advanced encryption standard (AES) [42], and cryptography algorithms SM1 and SM4 formulated by China’s National Commercial Cryptography Management Office. The asymmetric encryption algorithms are public key encryptions, where the public key and secret key exist in pairs; the public key is publicly released and the secret key is held by the user. Asymmetric encryption algorithms include elliptic curve cryptography (ECC) [43,44], Rivest–Shamir–Adleman (RSA) [45], the Paillier cryptosystem [46], and cryptography algorithms SM2 and SM9 formulated by China’s National Commercial Cryptography Management Office. In addition, in order to improve the speed of communication encryption and decryption while ensuring the security of communication information, researchers have started to try to combine multiple encryption algorithms to improve the performance, such as ECC-AES encryption algorithms [47], improved DES-RSA hybrid encryption algorithms [48], and AES-RSA hybrid [49] encryption algorithms.

Secure communication mechanisms based on new technologies: In addition to communication authentication and data encryption, two traditional means to prevent external attacks, new information security technologies represented by trusted computing technology [50] and blockchain technology [51], are also gradually applied to prevent information attacks in power systems. Based on trusted computing technology, the trusted communication channel is established between communication nodes to achieve trusted identity authentication of the communication nodes, which can ensure the integrity and trustworthiness of communication data and prevent tampering by cyber-attackers [52]. Blockchain technology has the characteristics of decentralization, data security and trustworthiness, non-tampering, and programmability, which can provide reliable technical support for power system communication [53].

3.2. Detection during Attack

According to the different operation mechanisms, the more researched and applied attack detection methods mainly include signature-based detection, anomaly-based detection, and hybrid detection [54,55], as shown in Figure 5.

3.2.1. Signature-Based Detection

This type of detection is mainly applied to known or previously experienced attack methods and attack types. It is usually necessary to first build a database of attack behavior signatures, and then compare the real-time data with the signature database to detect attacks. Currently, the main attack detection methods based on this mechanism are the following:

State transition analysis [56,57]: This method is based on a state transition diagram, where each attack behavior is defined by its initial state, attack state, and the conditions for transition between states. These state transitions are represented in a state transition diagram and integrated into the detection model, where the state transition conditions are the signatures of different attacks.

Expert system [58]: The conclusions are drawn from known attacks based on the expert experience and translated into fixed rules or conditions. When any one of the conditions is met, an attack is proven to have occurred and the type of the attack is identified.

Petri nets [59,60]: Petri nets are used to represent the initial state, attack state, and state transition features under attack behaviors, and are integrated into the model to judge the occurrence of the attack behavior based on whether the state transition conditions are satisfied or not.

Conditional probability [61]: For each attack behavior, a corresponding sequence of events is established, and then the probability of the attack occurring is inferred according to Bayes theorem.

Blacklist and whitelist [62,63]: By creating a blacklist based on known attack behaviors, any attack behavior that exists in the blacklist will be detected. Conversely, by creating a whitelist based on legitimate behaviors, the detection information is verified and any behavior that does not exist in the whitelist will trigger the alarm.

A signature-based detection mechanism can effectively detect known attacks with high detection accuracy and low error rates. However, the disadvantage is that it cannot detect the attack types that are not in the signature database, and this type of detection mechanism tends to fail when the attacker slightly changes the attack signatures. Therefore, this detection mechanism needs to periodically update the signature database.

3.2.2. Anomaly-Based Detection

Anomaly-based detection is based on the normal state of the constructed system. When the real-time operational data deviate significantly from the normal state or exceed the predefined threshold, the system is considered to have abnormal behavior, indicating that it is suffering from an attack. Anomaly-based detection methods are mainly divided into two categories: statistical-based methods and artificial intelligence-based (AI-based) methods.

The core idea of statistical-based methods is to use statistical methods to build a statistically generative model. In the model, data with probability values below a threshold are considered anomalous, indicating that a cyber-attack has occurred. This class of method can be further categorized into two subclasses: parametric and nonparametric detection methods [64]. Parametric detection methods assume a basic distribution model of the data and estimate the parameters of the distribution model based on empirical data. Representative methods of parametric detection include the Gaussian mixture model (GMM) [65] and the regression model [66]. Nonparametric detection methods do not rely on any distribution model, and the main methods include the Markov model [67,68] and kernel density estimation (KDE) [69]. Ref. [70] proposed a modified state estimator based on Kalman filtering and designed a chi-square-based detection method to detect FDI attacks on PMUs by integrating attacked estimation information with undamaged measurement information. Statistical-based detection mechanisms are easy to implement and have a fast detection speed after the model is constructed. However, the detection accuracy is highly dependent on empirical data and model assumptions, and insufficient empirical data are likely to lead to erroneous detection results.

AI-based detection methods extract the abnormal state when the attacks occur through machine learning, and distinguish the normal state from the abnormal state caused by the attacks through classification or clustering algorithms. AI-based detection methods can be further categorized into two subclasses: supervised learning and unsupervised learning.

Unsupervised learning utilizes unlabeled data to obtain unknown feature relationships between data through model training, and can be categorized into the dimensionality reduction model, clustering model, and neural network model according to the different learning methods. Principal component analysis (PCA) can reduce the dimensionality of high-dimensional data, remove noise and unimportant features, and effectively separate normal and abnormal data without losing important information, so it is often used for data processing before machine learning training [71]. However, PCA is a linear dimensionality reduction and cannot realize nonlinear dimensionality reduction. The neighborhood preserving embedding (NPE) algorithm not only achieves linear and nonlinear dimensionality reduction, but also has better detection results than PCA [72]. Compared with the dimensionality reduction model, the K-means clustering method [73] reduces the computational complexity, is easy to implement, and has better performance in attack detection. With the development of the smart grid, the amount of power system data will be explosive and characterized by a nonlinear structure, data imbalance, and missing data. Therefore, it will be difficult for traditional methods to improve the detection ability. As a result, unsupervised neural network models such as sparse autoencoders (SAEs) [74], generative adversarial networks (GANs) [75], deep belief networks (DBNs) [76], and stacked autoencoders (SAs) [77] are gradually being applied to solve these issues.

Supervised learning detection methods use labeled data to train the model and obtain the optimal relationship model among the known features in the data, and usually provide better detection performance compared to unsupervised learning detection methods. Usually, supervised learning can be categorized into classification and regression models, and neural network models. Among the classification and regression models, logistic regression (LR), the K-nearest neighbor (KNN) algorithm, naive Bayes (NB), decision tree (DT), support vector machine (SVM), and random forest (RF) are widely used [78,79,80,81,82]. Ref. [83] utilized a support vector regressor (SVR) to extract an affine relationship within PMUs, for verifying FDI attack on PUM measurement data and identifying injected false data. In general, detection methods based on DT have the highest accuracy and correctness. The KNN algorithm and SVM show high accuracy in small-sample data but have high computational complexity. LR is simple to compute and easy to implement, and is effective for binary classification problems. NB has low data quality requirements and is insensitive to missing data. RF has a high level of resistance to overfitting. With the increasing requirements for computational power and the development of neural network models, researchers have gradually applied neural network models such as the recurrent neural network (RNN) [84], convolutional neural network (CNN) [85], long short-term memory (LSTM) neural network [86], multi-layer perceptron (MLP) [87,88], and vector neural network (VNN) [12] to detect attacks on PMUs and communication networks. Compared with traditional machine classification and regression detection algorithms, neural network-based detection models have powerful nonlinear feature extraction capabilities and better detection and identification results.

Overall, artificial intelligence-based detection methods are able to adjust the model in time according to the changes in data information and have high detection accuracy, but they incur a high cost by consuming a large amount of resources, and may not be able to provide accurate detection results when there are insufficient sample data.

3.2.3. Hybrid Detection

Hybrid detection methods combine two or more of the above detection strategies. By combining multiple detection mechanisms, the accuracy of attack detection can be improved. When signature-based strategies are used in conjunction with anomaly-based techniques, the hybrid system can detect intruders attempting to modify attack signatures stored in the model database [89]. To improve the system performance, several fusion methods and techniques are sometimes adopted to integrate detection models. Ref. [73] significantly reduces the time complexity and improves the detection accuracy by combining K-means clustering and SVM. Ref. [90] uses PAC for data dimensionality reduction and then detects attacks through a hybrid RF-SVM classification model. Ref. [91] used a hybrid CNN-LSTM attack detection model with particle swarm optimization to detect anomalous data in PMUs and determine the type of attack, combining the advantages of both neural network models. Ref. [92] proposed a transformer-bidirectional long short-term memory (BLSTM) attack detection model to detect phase shifts in PMU measurement data caused by TS attack. Ref. [93] proposed a model and dual data-driven TA attack detection mechanism, which included two model threshold-based detection methods and detection using an autoencoder neural network (AENN) and RF, and demonstrated good detection performance against TS attack. Combining different approaches can make the detection system more robust, but the detection results are not always optimal. In fact, developing hybrid detection systems from different approaches that can interoperate effectively is a challenging task.

3.2.4. Comparison of Detection Methods

A comparison of the three methods, signature-based detection, anomaly-based detection, and hybrid detection, is shown in the

Table 2. Performance comparison of classification detection methods.

Metrics	Signature-Based Detection	Anomaly-Based Detection	Hybrid Detection
Complexity	Low	Medium	High
Detection Accuracy	High	Medium	High
False Positive Rate	Very low	High	Low
False Negative Rate	Medium	High	Low
False Alarm Rate	Low	High	Medium
Implementation Cost	Low	Medium	High

. The false positive rate represents the probability that the detection model will consider normal data as attack data; the false negative rate represents the probability that the detection model will consider attack data as normal data.

3.3. Suppression during Attack

Currently, there are several methods to mitigate the impact of cyber-attacks:

Attack vector removal: Attack vector removal refers to removing the attack-injected portion of the attacked measure values and restoring the measure data to its original state to mitigate the impact of data integrity attacks [33]. Ref. [94] used a matrix decomposition technique to decompose the communication information matrix into a low-rank measure value matrix and a sparse attack matrix, and the actual measure matrix is obtained after removing the attack matrix. In addition, some neural network algorithms have been applied to recover communication data during attacks. CNN [95], GAN [96], and the denoising autoencoder (DAE) [97] can eliminate the biases caused by attacks and recover the communication values affected by FDI attack.

Designing compensators. Designing compensators is a common and straightforward method used to mitigate DoS attack by compensating for lost data to protect the communication channel [98]. Ref. [99] established model-free predictive compensation to predictively compensate for the problem of communication data loss caused by DoS attack by obtaining the supply–demand imbalance power. Ref. [100] designed a CNN-LSTM hybrid deep neural network compensator, which can effectively solve the problem of data loss due to DoS attack.

4. Countermeasures for Internal Malicious Behavior

Currently, research on power system information security issues mainly focuses on external network attacks, while research on selfish nodes implementing malicious behaviors in distributed economic dispatch scenarios is relatively rare. Countermeasures for internal malicious behaviors usually include detection and prevention.

4.1. Detection of Internal Malicious Behavior

According to the different mechanisms, the current malicious behavior detection methods mainly include two categories: trust management and AI-based.

In the trust management detection mechanism, the nodes in the system repeatedly interact with each other and get information to evaluate the reputation of the nodes. The nodes then distinguish between normal nodes and malicious nodes and ensure that only trusted nodes can participate in network communication [101]. With the widespread application of blockchain technology, many researchers have also combined the blockchain with trust management. Reputation values are stored in the blockchain, which ensures the invariance, decentralization, and availability of data [102,103].

AI-based detection mechanisms: In the field of network information intrusion detection, neural network models have been very popular for identifying and classifying anomalous behavior. Ref. [104] proposed three online detection and localization strategies for malicious nodes based on neural network models with a temporal difference, spatial difference, and frequency difference, which showed significant detection and localization performance. Based on the CNN technique, Refs. [29,105] implement the detection and localization of internal malicious nodes in a gossip-based distributed projected gradient algorithm.

4.2. Prevention for Internal Malicious Behavior

The currently recognized effective means of preventing and controlling malicious behavior by selfish nodes is the application of resilient distributed algorithms. The algorithms isolate selfish nodes in the communication network or ignore their communication data, while normal nodes maintain communication with each other and continue to execute the distributed algorithms. Ref. [106] proposes a resilient distributed algorithm based on trusted nodes, which achieves consensus among normal and trusted nodes after excluding selfish nodes. This idea of completely removing malicious information was then further extended to a family of algorithms known as mean subsequence reduced (MSR) algorithms [107]. The idea of this class of method is that a normal node ranks the information values received from all its neighbors in order of magnitude. The normal nodes then remove the F largest and F smallest values (F represents the estimated upper bound of nodes performing malicious behavior), and use only the remaining information to update their own state.

The method is likely to discard some normal information, resulting in slower system convergence. To overcome this problem, the weighted MSR (W-MSR) [108] algorithm and event-based MSR (E-MSR) [109] algorithm have been successively proposed. The former calculates the weighted average of the filtered valid information, and the latter achieves resilient consensus by reducing the frequency of information exchange between nodes through event-triggered mechanisms. Both algorithms can effectively reduce the impact of the malicious behavior of the selfish nodes on the convergence speed of the distributed algorithm and the economy of the system.

5. Prospects for Information Security Measure Methods in Distributed Economic Dispatch Systems

The current research on information security lacks consideration of the cyber-physical coupling characteristics, and single cyber-side defense measures still have a defense blind spot and cannot promptly respond to the physical-side actions. Therefore, cyber-physical coupling needs to be considered in subsequent research. Combined with previous analysis, this section discusses two aspects: information security issues models and the integrated security defense system.

5.1. Information Security Issues Model

The basis for solving the internal and external information security issues in distributed economic dispatch systems is to construct the dynamics model of the system in distributed control mode, and further integrate the external cyber-attack model and internal malicious behavior model from the perspective of the power CPS.

5.1.1. New Generation Power System CPS Model

The new generation power system CPS combines power information technology with the power physical system, where the power flow and information flow coexist and influence each other. The continuous dynamic behavior of the power system is coupled with the discrete dynamic behavior of the information system to improve the control and operation performance of the power system. However, because of the high level of cyber-physical coupling, the information security issues may lead to cascading failure reaction of the power system, thus affecting the safe and stable operation of the system. Therefore, the construction of a CPS model adapted to the new generation power system is the basis and premise of the prevention and control of information security issues.

At present, the research on the construction of the power CPS model mainly focuses on traditional centralized control systems, and lacks research on the power system under distributed control. Constructing a new generation power system CPS model is crucial for preventing and controlling information security problems in power systems under distributed control. This involves considering changes in real-time physical and communication topology, the mutual conversion of power and information flows, as well as the cyber-physical interaction process.

In this paper, the active distribution network model [110] is combined with a distributed economic dispatch strategy [111] to propose a preliminary distributed economic dispatch model system that considers the cyber-physical coupling. The model is formulated as follows:

$$\left[\begin{array}{c}\dot{\mathit{\lambda }}\\ {\dot{\mathit{x}}}_{\mathrm{DG}}\end{array}\right]=\left[\begin{array}{cc}{\mathit{C}}_{\lambda }& {\mathit{A}}_{\lambda }\\ {\mathit{C}}_{\mathrm{DG}}& {\mathit{A}}_{\mathrm{DG}}\end{array}\right]\left[\begin{array}{c}\mathit{\lambda }\\ {\mathit{x}}_{\mathrm{DG}}\end{array}\right]+\left[\begin{array}{c}{\mathit{B}}_{\lambda }\\ {\mathit{B}}_{\mathrm{DG}}\end{array}\right]{\mathit{u}}_{dq}$$

(3)

where ${\mathit{A}}_{\lambda }=(-{\mathit{L}}_{B1}{\mathit{A}}_P{\mathit{S}}_i+{\mathit{F}}_i)\mathit{M}$; ${\mathit{B}}_{\lambda }=-{\mathit{L}}_{B1}{\mathit{A}}_P{\mathit{S}}_u+{\mathit{F}}_u$; ${\mathit{C}}_{\lambda }={\mathit{L}}_{B2}$; ${\mathit{L}}_{B1}=\mathrm{diag}\{0,\mathit{L}+\mathit{D}\}$. ${\mathit{x}}_{\mathrm{DG}}$ is the state variable of the DG control model; $\mathit{\lambda }$ is the incremental cost of power generation by the DG; ${\mathit{u}}_{dq}$ denotes the dq-axis component of the grid-connected voltage of the DG; ${\mathit{A}}_{\mathrm{DG}}$ and ${\mathit{B}}_{\mathrm{DG}}$ are constant matrices related to the parameters of the DG control model; ${\mathit{C}}_{\mathrm{DG}}$ is related to the parameters of the DG control model and to the power-cost function of the DG; $\mathit{M}$ is a constant transformation matrix; $\mathit{L}$ and $\mathit{D}$ are the Laplacian matrix and degree matrix of communication topology of the nodes except the leader node, respectively; ${\mathit{L}}_{B2}$ is the degree matrix of the communication topology of the leader node with other nodes; ${\mathit{A}}_p$ is related to the power-cost function of the DG; ${\mathit{S}}_i$, ${\mathit{S}}_u$, ${\mathit{S}}_i$, and ${\mathit{F}}_u$ are related to the active power emitted by the DG.

The most important communication data in the distributed economic dispatch system are the incremental cost of generation of each DG, the change in which affects the control of the DGs in the system. The following analysis preliminarily examines the impact of information security issues on the system in conjunction with the distributed economic dispatch model shown in Equation (3). The DoS attack blocks the communication link and prevents normal communication, resulting in a change in the communication topology. The parameters of the matrices $\mathit{L}$, $\mathit{D}$, and ${\mathit{L}}_{B2}$ in the model that are related to the communication topology are affected. The FDI attack and replay attack cause the active power of DGs to deviate from the economic optimum by tampering with the incremental cost $\mathit{\lambda }$ of the communication transmission. Therefore, the matrices ${\mathit{A}}_{\lambda }$ and ${\mathit{B}}_{\lambda }$ are changed by the FDI attack and replay attack. Similarly, the deception behavior tampers with the incremental cost $\mathit{\lambda }$ of the communication transmission, so that ${\mathit{A}}_{\lambda }$ and ${\mathit{B}}_{\lambda }$ are changed by deception behavior. Fraud behavior involves a spurious modification of the cost function, which affects ${\mathit{C}}_{\mathrm{DG}}$ and ${\mathit{A}}_p$ in the model. Further research is needed to understand the impact of external cyber-attacks and internal malicious behaviors on the stability and convergence of the distributed economic dispatch system. This can be achieved by establishing mathematical models and integrating them with the distributed economic dispatch model.

5.1.2. External Cyber-Attack Model

The current research of cyber-attack models usually separates the information system from the physical system. Therefore, the complete attack and response process of the cyber-attack is divided into two phases: information invasion of the information system, and impact analysis and control of the physical system. This leads to the corresponding defense measures only for a single information or physical level. The cyber-attack based on the new generation power system CPS has new characteristics. It contributes to the construction of the cyber-physical hybrid model of the cyber-attack that considers the cyber-physical coupling and clearly studies the relationship between the information attack and the physical response. In addition, the subjective behaviors of the attackers will significantly increase the randomness of cyber-attacks, making cyber-attacks more difficult to detect and their effect more difficult to control. Therefore, by introducing the knowledge of game theory, such as offensive and defensive games, human intention is considered as a factor in the modeling of cyber-attacks.

5.1.3. Internal Malicious Behaviors Model

Internal malicious behaviors with extremely stealth are difficult to manage and defend in the distributed economic dispatch system. The behaviors hide malicious data in a large amount of normal data in order to seek benefits and destroy the economic operation of the system. Processing historical data and extracting the characteristics of malicious behaviors implied in the data, and using the portrait method to portray the malicious behavior pattern, can improve the accuracy of judging the malicious behaviors of the internal members in the distributed economic dispatch system. Similarly, the implementation of malicious behavior is accompanied by human intention and psychological fluctuations. The behavioral performance and psychological state of the implementer of malicious behaviors can be inferred from game theory and a psychological perspective. The possibility of the occurrence and development of malicious behavior can be judged.

5.2. Integrated Security Defense System

The current defense measures for information security issues mainly focus on cyber-side detection and suppression. In the future, it will be necessary to design corresponding defense measures based on the information security issues model from the perspective of the new generation power system CPS. Additionally, constructing the distributed economic dispatch information security issues defense system is crucial.

5.2.1. Secure Measurement Technology Based on PMU

The GPS timing and communication methods of PMUs have information security risks, and their measurement and communication data are vulnerable to TS attack and FDI attack, respectively. The measurement data provided by PMUs serve as a critical foundation for power system state estimation, situational awareness, and dispatch control. Any anomalies in the data caused by attacks can lead to erroneous system decisions, ultimately threatening the security and stability of the power system. To ensure reliable support for economic dispatch in the power system, it is imperative to establish secure measurement technology based on PMUs. Firstly, at the active defense level, the system should be made more resistant to attacks by improving physical devices. This includes developing secure cryptographic chips to encrypt the communication of measurement data and enhancing the anti-interference capability of GPS signal receivers. Secondly, the detection and recovery from attacks are paramount, constituting a critical step in mitigating PMU information security risks. A deep analysis needs to be conducted of the time synchronization deviation characteristics and specific effects on phasor measurement and communication caused by the TS attack and FDI attack. Based on these attack characteristics, it should fully utilize PMU measurement data to develop local detection and recovery methods based on temporal features, and integrate system topology and parameter information to establish regional detection and recovery methods based on data spatio-temporal correlations.

5.2.2. Defense Technology Support Base on Blockchain

The rapid development of information security technology, represented by trusted computing technology and blockchain technology, provides a new solution to address the information security of the distributed economic dispatch system. In particular, blockchain technology is well suited to the characteristics of the new generation power system, as shown below. The decentralized characteristics of the blockchain correspond to the distribution characteristics of power sources and loads in the new power system. The new power system in the future will be dominated by DGs such as wind power and photovoltaic power. Blockchain technology ensures data integrity through encryption algorithms, which provides a degree of prevention against cyber-attacks. Each block is timestamped and arranged chronologically in a chain structure to ensure data traceability, which can prevent the malicious behaviors of selfish nodes that intentionally transmit false information. Node information transmission adopts consensus algorithms, such as the PoW algorithm, for attack detection and security strategy decisions to resist external cyber-attacks. The blockchain provides a script code system and supports the application and development of various scenarios, and smart contracts can be written according to the actual application requirements.

Therefore, combining the specific application of the distributed economic dispatch of the new generation power system, key blockchain technologies can be integrated into various aspects of information security defense by taking it as a unified underlying technology platform. This includes the following five aspects: the construction of a node identity registration and authentication system, the construction of a communication data encryption and verification system, the design of a node punishment and incentive mechanism, the compilation of a distributed economic dispatch smart contract, and the research into new defense methods based on consensus mechanisms. These defensive means of realizing information security protection against external cyber-attacks and internal malicious behavior are the next research direction to focus on.

5.2.3. Cyber-Physical Cooperative Defense System

Due to the deep cyber-physical coupling of the power CPS, the information security issues on the cyber side and the stable operation status on the physical side are closely related and mutually interacting. Separate security defense measures on the cyber side cannot respond to failures or damages on the physical side, while real-time measurement information on the physical side affects communication and decision-making on the cyber side. Defense measures based on the cyber side are relatively mature. However, there are also shortcomings such as high real-time information requirements, inability to simultaneously achieve high accuracy and low leakage rates in detection, and suppression measures only targeting specific information security issues.

The cyber-physical cooperative defense in power systems can include attack detection and identification, security risk assessment of the power CPS, security strategy decision-making, and consensus. However, the following issues also need to be considered: (1) Data heterogeneity and balance. In the power CPS, there is a coexistence of continuous physical data and discrete information data, with significant differences in real-time and temporal characteristics. Additionally, most of the data represent normal power system operations, and there is a lack of relevant data for information security issues and defense. (2) Rational utilization of information and physical resources. The physical side possesses defense resources such as manpower, technology, and equipment. By optimizing the allocation of physical defense resources and coordinating with cyber-side security defense technologies, the defense effectiveness can be maximized.

Therefore, the construction of a cyber-physical cooperative defense system for the power system is worthy of attention in the future. This needs to make full use of the characteristics of interdependence and support between information and physics in the power system and coordinate the allocation of defense resources.

6. Conclusions

This paper provides a thorough review of the information security problems of the distributed economic dispatch system and its protective measures. Four kinds of external network attacks and two kinds of internal malicious behaviors are introduced. This paper emphatically summarizes the three-phase defense measures of prevention, detection, and suppression for external network attacks, and the detection and prevention measures for internal malicious behaviors. Most of the existing studies have failed to analyze the impact of information security issues on DGs and power systems, and the designed defense measures only focus on the information layer without considering the cyber-physical coupling of the power system. Therefore, future research on information security issues of the distributed economic dispatch system can be mainly approached from the following two directions. Firstly, it is necessary to consider the characteristics of cyber-physical coupling to establish an information security issues model and analyze the impact on the performance of the distributed economic dispatch system. The second aspect is to design the security defense system. This includes the development of secure measurement technology based on PMUs and cyber-physical collaborative defense strategies integrating new information security technologies such as the blockchain. This article aims to review the current research status of information security issues and provide guidance for future studies.