A Robust Optimaiztion-Based Strategy for Optimal
Power System Protection Considering Uncertainties
Yingmeng Xiang and Lingfeng Wang
Department of Electrical Engineering and Computer Science
University of Wisconsin-Milwaukee, Milwaukee, WI 53211, USA
AbstractDeveloping efficient strategies for defending electric
power systems against attacks is a major concern, especially
when uncertainties are involved. This paper addresses the
allocation of the defensive resource to minimize the damage
when there are uncertainties regarding the resource the
attacker has. A Multiple-Attack-Scenario (MAS) defender-
attacker-defender model is proposed by extending the
conventional tri-level defender-attacker-defender model. The
proposed model considers the uncertainties related to the
offensive resource and the interactions involving the security
personnel at the top-level, the attacker at the middle-level and
the power system operator at the bottom-level. The Column-
and-Constraint Generation (C&CG) algorithm is implemented
by decomposing the MAS defender-attacker-defender model
into an upper-level problem for the security personnel, and a
lower-level problem for the attacker involving the optimal
power flow analysis-based corrective power re-dispatch
implemented by the power system operator. Case studies are
performed based on the IEEE RTS79 system, and the results
validate that the proposed method is able to minimize the
damage when uncertainties are involved in the offensive
resource. This work can offer meaningful insights into power
system protection involving uncertainties in a cyber-physical
environment.
Index Terms Robust optimization, power system protection,
tri-level programming, Column-and-Constraint Generation
method.
I. INTRODUCTION
The cyber-physical security of electric power grids is an
increasing concern in both planning and operation during
recent years with the wide deployment of smart grid
technologies and the growing vandalism/terrorism activities.
Conventionally, the N-1 or even N-2 criteria are implemented
in power grids for maintaining the reliable operation of
power grids in the face of random equipment failures and
different forms of disturbances [1]. But they are insufficient
to protect the power systems against malicious attacks, which
usually target multiple critical components simultaneously. In
this regard, some research is devoted to studying the
vulnerabilities of the power systems and identifying the
critical components. In [2] and [3], a bi-level attacker-
defender model was developed. In this model, it is assumed
that the attacker tries to maximize the damage considering
the corrective action taken by the defender. Thus, this
attacker-defender model can be solved by a bi-level max-min
optimization problem, and the critical components can be
identified.
Based on the vulnerability analysis which can identify the
critical components or weakness of the network, it is
meaningful to develop strategies to wisely allocate the
limited defensive resources (including budgets, security-
related human resources, etc.) to efficiently safeguard the
power grid. In [4] and [5], a tri-level defender-attacker-
978-1-5386-2212-4/17/$31.00 2017 IEEE
defender model was studied, and the defenders include the
security personnel who harden some well-selected
components before the attack occurs and the power system
operator who re-dispatches the power after the attack takes
place in order to minimize the damage. For this tri-level
model, the implicit enumeration algorithm [4] and the C&CG
algorithm were adopted [6]. In [7], when assuming both the
attacker and the defender take action without knowing the
action of the other, a two-player game theoretic approach was
developed. When the interaction between the attacker and the
defender involves multiple rounds, Markov game could be
adopted [8], [9].
In real-world scenarios, the decision-making for the
allocation of the defensive resource often involves a number
of uncertainties, as it is extremely difficult for the defender to
obtain accurate and complete information about the attacker.
For example, the defender may not accurately know the
offensive resources (including the skill levels, tools,
privileges and capabilities, etc.) that the attacker has when
making the decision on the defensive strategy. It is thus
meaningful to develop informed defensive strategies
considering the relevant uncertainties to reflect the real
scenarios more accurately [10]. In this study, we solve this
defensive strategy development problem considering
uncertainties using the robust optimization, which is an
effective method for dealing with uncertainties in a variety of
problems, such as unit commitment [11] and renewable
energy integration [12]. Specifically, a MAS defender-
attacker-defender model is proposed, where the uncertainties
in the offensive resource are modeled as a set of offensive
scenarios with corresponding probabilities, and the max-min
defender-attacker interaction in each offensive scenario is
considered. The main contribution of this paper is the optimal
decision-making for the allocation of limited defensive
resources considering uncertainties in offensive resources.
II. PROBLEM FORMULATION
As shown in [4] and [5], a tri-level defender-attacker-
defender model was found to be suitable for developing
defensive strategies against malicious attacks. This tri-level
model is shown in Fig. 1, which involves three agents acting
in sequence: (a) at the top-level, the power system security
personnel identifies the critical components, aiming to
minimize the consequence caused by the attacker; (b) at the
middle-level, the attacker seeks to maximize the consequence
by attacking the judiciously-selected targets; (c) at the
bottom-level, the power system operator takes remedial
actions to minimize the consequence after the attacker
disrupts the targeted components. The middle-level and the
bottom-level form a typical attacker-defender model, which
describes the attackers decision-making to identify the
components to attack. This attacker-defender model is a bi-
level optimization problem, in which the offensive resource
is often involved and has a great impact on the consequence
of the attack. In this study, similar to [13] the offensive
resource is quantitatively represented by the maximum
number of components that the attacker is able to
successfully trip. Once the offensive resource is known, the
bi-level attacker-defender optimization problem can be
solved. This is the basis for solving the tri-level problem
depicted in Fig. 1, as this tri-level model assumes that the
security personnel at the top-level has the complete and
accurate information about the offensive resource.
Fig. 1 Conventional defender-attacker-defender model
In a more realistic sense, the security personnel are often
not able to obtain the exact information about the offensive
resource. In other words, the security personnel have to
develop the defensive strategy with uncertain information
about the offensive resource, although the offensive resource
is well known to the attacker. In this study, the offensive
resource is modeled by a probability distribution over a set of
attack scenarios, in which an attack scenario is characterized
by its related offensive resource. A specific example of the
offensive scenario set and the probability distribution is given
here. For example, if the security personnel estimate the
attacker may have the capability to disconnect two lines,
three lines, four lines or five lines with probabilities 0.2, 0.3,
0.4 and 0.1, respectively, the attack scenario set is {two lines,
three lines, four lines, five lines}, and the probability
distribution is {0.2, 0.3, 0.4, 0.1}. The security personnels
objective is to allocate the defensive resource optimally to
defend the power grid considering all these four offensive
scenarios and the corresponding probabilities, neither the
offensive scenario {two lines} with probability 1, nor the
offensive scenario {four lines} with probability 1.
The MAS defender-attacker-defender model is proposed
in Fig. 2. At the upper-level, the security personnel make
decisions to identify the components to defend in order to
minimize the expected damage considering all the possible
offensive scenarios and their corresponding probabilities. In
each scenario with a certain amount of offensive resources
given, the attacker determines the components to attack
whereas the corrective power re-dispatch performed by the
power grid operator is considered. In this proposed MAS
defender-attacker-defender model, from top to bottom three
kinds of agents are involved: the security personnel, the
attacker, and the operator. The upper-level agent is
interacting with multiple middle-level agents. This is
different from the conventional defender-attacker-defender
978-1-5386-2212-4/17/$31.00 2017 IEEE
model, in which the upper-level agent interacts with only one
middle-level agent. It should be noted that this MAS
defender-attacker-defender model can easily shrink to the
conventional defender-attacker-defender model, which only
considers one single offensive scenario.
Fig. 2 Proposed Multiple-Attack-Scenario defender-attacker-defender model
For the sake of clarity and brevity, the transmission lines
are assumed to be the only assets that can be defended by the
security personnel and disrupted by the attacker. However,
the proposed modeling and solution methods in this paper
can be extended to incorporate other kinds of system assets,
like transformers and generators. Also, at the bottom-level, a
DC power flow model is used to evaluate the performance of
the power system. This linearized model is a reasonable
simplification of the power system operation, and is widely
used in power system planning and security analysis.
Moreover, the damage is characterized by the load
curtailment caused by the attacker.
The mathematical problem for the proposed MAC
defender-attacker-defender model is formulated as the
following tri-level optimization problem.
min ( ) [max ( ) min { ( ), ( ), ( )]
( ), ( )}
(1)
s.t. {0,1} (2)
(1 ( )) ( ) {0,1} (3)
( )( ) ( )( )
( )=( + ( ) (s)) (4)
( )| () ( )+| () ( )
+ ( ) = (5)
0 ( ) (6)
( ) (7)
0 ( ) (8)
The variables and constants are explained as follows:
and indicate the defensive resource allocation vector and
offensive resource allocation vector, respectively; and
are the feasible sets for and , respectively; , , ,
mean the bus voltage angle vector, generator power
output vector, transmission line power flow vector, and load
demand curtailment vector, respectively; , and are the
set of buses, the set of generators, and the set of transmission
lines, respectively; s represents an offensive scenario; S is the
set of offensive scenarios; is the probability distribution of
S; Subscripts n, j, l denote indices of the buses, generators
and transmission lines, respectively; , , and are the A. Upper-Level Problem
reactance of line l, maximum generation of generator j, In the ULP, the security personnel determine the optimal
power flow limit of transmission line l, and load demand at allocation of the defensive resource to minimize the expected
bus n, respectively; ( ) and ( ) are the origin bus and the damage caused by a given set of offensive strategy
destination bus of line l, respectively; and ( ) is the
combinations .
expected value of load curtailment considering the = [ , , ] (9)
probability distribution of the attack scenario set S. where k is the number of offensive strategy combinations,
As shown in the objective function (1), the security and the sign means the value of a variable is given or
personnel aim to minimize the expected load curtailment known. Denote the dimension of S as , thus is the
under all possible offensive scenarios considering the attack number of offensive scenarios. For the example given in
strategy made in each offensive scenario, in which the power Section II, is 4. Each offensive strategy combination
re-dispatch carried out by the operator is incorporated. consists of offensive strategies, and each offensive
Constraint (2) captures the limitation of the offensive strategy corresponds to certain known offensive resource.
resource. is a binary decision variable, if its value is 1, it Thus, we have
means line l is protected. Similarly, constraint (3) shows the = { ( ), , ( )} = 1, , (10)
limitation of the defensive resource. is a binary decision The ULP is constructed as follows:
variable; when its value is 0, it means line l is attacked. min (11)
Constraints (4)-(8) are related to the optimal power flow {( )[ , ( )]} = 1, , (12)
analysis. Constraint (4) calculates the power flow on the
{0,1} (13)
transmission lines, and the status of line l is obtained by
+ ( ) (s) . A line will be out of service only , ( )( ) ( )( )
( )= + ( ) ( )
when it is attacked and it is not being protected. Constraint
(5) ensures the power inflow and outflow balance at each , , = 1, , (14)
, , ,
bus. Constraint (6) ensures that the generation output of each ( )| () ( )+| () ( )+
generation does not exceed its maximum capacity. It is ,( )= , , = 1, , (15)
indicated in (7) that the line power flow is restricted within ,
0 ( ) , , = 1, , (16)
the allowed range [ , ]. The non-negativity constraint
,
(8) guarantees that the load curtailment at each bus is less ( ) , , = 1, , (17)
than the nominal demand. 0 , ( ) , , = 1, , (18)
III. SOLUTION METHOD In the objective function (11), the security personnel try
to minimize , which is the maximum of the expected
This section presents the solution method for the MAS damages in k offensive strategy combinations. The remedial
defender-attacker-defender problem formulated in (1)-(8) in power re-dispatch at the bottom-level is considered for each
Section II. The solution method is based on the C&CG offensive scenario and each offensive strategy combination,
algorithm, a two-stage robust optimization approach. The tri- , ,
level MAS defender-attacker-defender problem is thus ( ) ( ), ( )( ) , ( ), ( ) and , ( ) are
transformed to an upper-level problem (ULP) and a lower- calculated for each offensive scenario s and each offensive
level problem (LLP) in order to implement the C&CG strategy combination i. The big-M theory can be adopted to
algorithm. In the ULP, the security personnel determine the linearize constraint (14) [14].
defensive resource allocation considering a set of offensive B. Lower-Level Problem
strategy combinations while each offensive strategy The LLP calculates the expected damage caused by the
combination consists of attack strategies for all possible attacker in all the offensive scenarios, which are represented
offensive scenarios. The ULP generates the lower bound for as follows.
the MAS defender-attacker-defender problem. In the LLP, = [( ) ( )] (19)
for each offensive scenario, the interaction between the where ( ) is the damage in scenario s.
attacker and the power system operator is modeled by a bi-
Note that in each offensive scenario with a given
level optimization problem and the optimal offensive plan for
offensive resource, the attacker tries to maximize the damage
each offensive scenario is obtained. These obtained offensive
considering the power system operators response to
strategies for all offensive scenarios form an offensive
minimize to the damage. In each scenario, the interaction is
strategy combination, which will be added to the set of
modeled as a max-min bi-level problem which is illustrated
offensive strategy combinations if the convergence is not
as follows.
met. The expected value of load loss for all the offensive
scenarios forms the upper bound for the MAS defender- (s) =max ( ) min { ( ), ( ), ( )
attacker-defender problem. The ULP and the LLP will be ( ), ( )}

calculated iteratively until the lower bound and upper bound (20)
merge, which means that the convergence is achieved and the (1 ( )) ( ) {0,1} (21)
obtained value is an optimal solution. () ( ) () ( )
( )= + ( ) (s)
The ULP and the LLP are explained in detail as follows.
, ( ( )) (22)

978-1-5386-2212-4/17/$31.00 2017 IEEE

 ( )| () ( )+| () ( )+ Step [5]. Output the optimal values, including which is the
optimal expected damage, which is the optimal
( )= , ( ) (23)
defensive resource allocation, and ( ) which is
0 ( ) , (
( )) (24) the optimal offensive strategy in attack scenario s.
( ) , ( ( ), ( )) (25) IV. CASE STUDIES
0 ( ) , ( ( )) (26) The case studies are carried out on the IEEE RTS79
In this bi-level optimization, the lower-level (22)-(26) system [15]. Each line is denoted by the combination of its
represents the power re-dispatch after certain lines are tripped origin and destination buses. If there are parallel transmission
due to the attack. As strong duality exits for the lower-level, lines with the same origin and destination buses, they are
the bi-level optimization is transformed into a single level regarded as individual lines. The case studies are based on
maximization problem using the duality principle. The dual Matlab and CPLEX. Two case studies are presented as
variables for each of the constraints (22)-(26) are given follows.
following the constraints, including A. Case 1
( ), ( ), ( ), ( ), ( ) and ( ). The obtained As an example, the security personnel have the defensive
single level problem is shown as follows [4]-[5]. For brevity, resource to defend two lines; in other words, = 2. Also,
the sign (s) denoting the attack scenario is omitted. assume two attack scenarios, one is attacking five lines and
=max{ , , , , , , , , , } { + the other is attacking three lines; thus = {5, 3} . The
corresponding probabilities are 0.4 and 0.6, respectively; thus,
+ ( + ) } (27) = {0.4, 0.6}. The simulation results are shown in Table I.
Table I. Simulation results for case 1
(1 ) (28) Variables Result
( ) ( )
| () =| () (29) Expected load loss (MW) 3.864
Defended lines 14-16, 16-19
+ 1 (30) Attacked lines in attack scenario 1
3-24, 9-11,10-11, 12-13, 12-23
| +
0 (31) (Offensive resource is 5)
Attacked lines in attack scenario 2
+ 15-21, 15-21, 16-17
| () | ()+ + = 0 (32) (Offensive resource is 3)
0 (33) Load loss in attack scenario 1 (MW) 6.48
Load loss in attack scenario 2 (MW) 2.12
0 (34) To demonstrate the benefit of the proposed MAS
0 (35) defender-attacker-defender model over the conventional
0 (36) defender-attacker-defender model, comparative studies are
provided. In the conventional model, if the security personnel
C. C&CG Algorithm only consider scenario 1, the defended lines are {9-12, 12-
The proposed MAS defender-attacker-defender problem 23}. Similarly, the defended lines are {15-21, 20-23} if only
is decomposed into an ULP and an LLP as described scenario 2 is considered. For each defense strategy, the load
previously. The C&CG algorithm is adopted to solve the losses in scenario 1 and scenario 2, as well as the expected
overall MAS defender-attacker-defender problem based on load loss which considers the attack scenario set {5, 3} and
the ULP and the LLP. The implementation of the C&CG related probabilities {0.4, 0.6} are given in Table II.
algorithm is explained in detail as follows [4], [6]. Table II. Comparative studies for case 1
Step [1]. Initialize the upper bound as = , and the lower Defended Load loss (MW)
bound as = . Initialize the set of offensive lines Attack scenario 1 Attack scenario 2 Expected
14-16, 16-19 6.48 2.12 3.864
strategy combinations with a random feasible 9-12, 12-23 6.17 3.09 4.322
offensive strategy combination. Set the iteration 15-21, 20-23 8.42 1.94 4.532
index k=1. It can be seen that for the proposed MAS defender-
Step [2]. Solve the ULP with (9)-(18) to get and . As the attacker-defender model, although the load loss in a single
ULP is a mixed integer linear problem, it can be attack scenario may not be the least, the expected load loss
solved with commercial solvers, such as CPLEX. for multiple attack scenarios is the least. Thus, the
Update UB with the obtained . conventional defender-attacker-defender model can be used
Step [3]. Solve the LLP, which involves two sub-steps. In the to develop the optimal strategy for defending against a
first sub-step, the optimization problem consisting presumed single attack, but the performance of its obtained
of (27)-(36) is solved with the obtained in step defensive strategy is compromised when an offensive
[2], (s) and ( ) are obtained. This calculation scenario different from the presumed one occurs. Rather, the
should be performed for times until all the proposed MAS defender-attacker-defender model is suitable
offensive scenarios are analyzed. In the second sub- for developing an optimal defensive strategy when there are
step, is calculated with (19), also is obtained uncertainties related to the attacker, i.e., when multiple
using (10) by combining all ( ) . Update LB presumed offensive scenarios need to be considered.
with . Importantly, add to . B. Case 2
Step [4]. If UB and LB are equal, the convergence is reached, In order to demonstrate the scalability of the proposed
go to next step; otherwise, k=k+1, go to step [2]. MAS defender-attacker-defender model, another case study

978-1-5386-2212-4/17/$31.00 2017 IEEE

is provided considering the offensive scenario set as {2, 3, 4, defender-attacker-defender can minimize the expected load
5} with the corresponding probabilities {0.2, 0.3, 0.4, 0.1}. If curtailment considering a set of multiple offensive scenarios.
the defensive resource of the security personnel is 3, the V. CONCLUSIONS AND FUTURE WORK
results for the case study are shown in Table III and the
attacked lines for each specific offensive scenario is given in Considering the fact that the defender often faces
Fig. 3. uncertainties related to the offensive resource of the attacker
Table III. Simulation results for case 2 when making defense plans, this paper proposes a MAS
Variables Result defender-attacker-defender model, which captures the
Expected load loss (MW) 2.828 uncertainties of the attackers offensive resource as well as
Defended lines 14-16, 15-21, 16-19 the interaction between the security personnel, the attacker,
and the power system operator. The MAS defender-attacker-
defender model is decomposed into an ULP and a LLP. The
C&CG algorithm is implemented based on the ULP and the
LLP to solve the overall MAS defender-attacker-defender
problem. The proposed model can be adopted to develop
defensive strategies with more practical considerations. In the
future work, the modeling of uncertainties will be extended
by considering different kinds of offensive scenarios, as well
as the forecast and forensics of attacks. Also, the
incorporation of the novel power re-dispatch strategies, such
as optimal transmission switching and busbar switching, in
the MAS defender-attacker-defender model will be explored.

REFERENCES
[1] A. J. Wood, B. F. Wollenberg, and G. B. Shebl, Power generation,
operation, and control. 2nd ed. New York: John Wiley & Sons, Inc.;
1996.
[2] J. Salmeron, K. Wood, and R. Baldick, Analysis of Electric Grid
Security Under Terrorist Threat, IEEE Trans. Power Syst., vol. 19, no.
2, pp. 905912, May 2004.
[3] J. M. Arroyo and F. D. Galiana, On the Solution of the Bilevel
Programming Formulation of the Terrorist Threat Problem, IEEE
Trans. Power Syst., vol. 20, no. 2, pp. 789797, May 2005.
[4] W. Yuan, L. Zhao and B. Zeng, Optimal power grid protection
through a defenderattackerdefender model, Reliability Engineering
& System Safety, vol. 121, pp. 83-89, Jan. 2014.
[5] N. Alguacil, A. Delgadillo, and J. M. Arroyo, A trilevel programming
Fig. 3 Illustration of the attack and defense strategies for case 2. approach for electric grid defense planning, Computers & Operations
The optimal defense strategy is to protect lines {4-9, 6- Research, vol. 41, pp. 282-290, Jan. 2014.
10, 14-16}, {11-14, 16-17, 16-19}, {11-13, 14-16, 15-21} [6] B. Zeng, and L. Zhao, Solving two-stage robust optimization
problems using a column-and-constraint generation method,
and {10-12, 12-23, 14-16} for defending against single attack Operations Research Letters, vol. 141, pp. 457-461, Sept. 2013.
scenarios 1 (offensive resource is 2), scenarios 2 (offensive [7] Y. Xiang, and L. Wang, A game-theoretic approach to optimal defense
resource is 3), scenarios 3 (offensive resource is 4), scenarios strategy against load redistribution attack, in IEEE Power & Energy
4 (offensive resource is 5), respectively. Similar to case 1, Society General Meeting, 2015.
[8] L. Wei, A. Sarwat, W. Saad, and S. Biswas, Stochastic Games for
comparative study results are provided to show the Power Grid Protection Against Coordinated Cyber-Physical Attacks,
performance of different defense strategies under different IEEE Trans. on Smart Grid, 2016, in press.
attack scenarios, as shown in Table IV. [9] C. Y. T. Ma, D. K. Y. Yau, X. Lou, N. S. V. Rao, "Markov Game
Table IV. Comparative studies for case 2 Analysis for Attack-Defense of Power Networks Under Possible
Load loss (MW) Misinformation", IEEE Trans. Power Syst., vol. 28, no. 2, pp. 1676-
Defended Attack Attack Attack Attack 1686, 2012.
lines scenario scenario scenario scenario Expected [10] C. Liu, C. Lee, H. Chen, and S. Mehrotra, Stochastic robust
1 2 3 4 mathematical programming model for power system optimization,
IEEE Trans. Power Syst., 2016, in press.
14-16, 15-
1.36 1.8 3.42 6.48 2.828 [11] H. Ye, J. Wang, and Z. Li, MIP Reformulation for Max-min Problems
21, 16-19
in Two-stage Robust SCUC, IEEE Trans. Power Syst., 2016, in press.
4-9, 6-10,
0.71 3.09 3.87 6.48 3.265 [12] H. Ye, J. Wang, Y. Ge, J. Li, and Z. li, Robust Integration of High-
14-16
level Dispatchable Renewables in Power System Operation, IEEE
11-14, 16-
1.360 1.80 5.16 8.42 3.718 Trans. Sustainable Energy, 2016, in press.
17, 16-19
[13] G. Chen, Z. Y. Dong, D. J. Hill, and Y. S. Xue, Exploring Reliable
11-13, 14-
1.36 3.09 3.22 6.48 3.145 Strategies for Defending Power Systems Against Targeted Attacks,
16, 15-21
IEEE Trans. Power Syst., vol. 26, no. 3, pp. 10001009, Aug. 2011.
10-12, 12-
1.36 3.09 3.87 4.48 3.195 [14] G. P. McCormick, Computability of global solutions to factorable
23, 14-16
nonconvex programs: Part I Convex underestimating problems,
By comparing the expected load loss, which is calculated Mathematical Programming, vol. 10, pp. 146175, 1976.
considering all the four attack scenarios and the related [15] P. M. Subcommittee, IEEE reliability test system, IEEE
probabilities, it is concluded that the proposed MAS Transactions on Power Apparatus and Systems, vol. PAS-98, no. 6, pp.
2047-2054, Nov. 1979.

978-1-5386-2212-4/17/$31.00 2017 IEEE