{'fraction_non_alphanumeric': 0.03462719910639486, 'fraction_numerical': 0.011672717118123429, 'mean_word_length': 4.841924959216966, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 2, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Adversarial Models Towards Data Availability and Integrity of Distributed State Estimation for Industrial IoT-Based Smart Grid

Security issue of distributed state estimation (DSE) is an important prospect for the rapidly growing smart grid ecosystem. Any coordinated cyberattack targeting the distributed system of state estimators can cause unrestrained estimation errors and can lead to a myriad of security risks, including failure of power system operation. This article explores the security threats of a smart grid arising from the exploitation of DSE vulnerabilities. To this aim, novel adversarial strategies based on two-stage data availability and integrity attacks are proposed towards a distributed industrial Internet of Things-based smart grid. The former's attack goal is to prevent boundary data exchange among distributed control centers, while the latter's attack goal is to inject a falsified data to cause local and global system unobservability. The proposed framework is evaluated on IEEE standard 14-bus system and benchmarked against the state-of-the-art research. Experimental results show that the proposed two-stage cyberattack results in an estimated error of approximately 34.74% compared to an error of the order of 10^-3 under normal operating conditions.


Introduction
A smart grid [1] is considered as a blend of modern communications infrastructures, a plethora of cyber-physical systems, intelligent sensing and metering entities, and modern energy management systems (EMS) based on the optimization of energy, network availability, demand, and son. With the emergence of Industry 4.0, industrial Internet of Things (IIoT), 5G/6G, and fog/edge/cloud computing, intelligent EMS solutions are becoming significant tools for smart grid implementation.
Centralized state estimation (SE) [2], [3], [4], [5] is the most prominent scheme in the EMS of a smart grid. However, in view of the rapidly changing operational requirements of today's smart grid, the traditional centralised SE model may no longer be suitable for the control and operation of an increasingly distributed environment, taking into account the increased adoption of distributed energy resources [6], distributed computing, and large scale deployment of IIoT devices in smart grid infrastructure. As an alternative solution, distributed SE (DSE) [7], [8], [9] has attracted significant attention in academia due to its several benefits, such as improved communication overhead, reduced computation burden, high scalability, and high robustness.
Compared with the traditional centralized SE model, DSE seems to be a more feasible component of the emerging smart energy management and security solutions. Yet, the DSE has its own limitations. For example, inter-area communication within the distributed state estimators can be subject to random gross errors, failure in communication link, and security threats. Thus, security aspects of the DSE need to be robust against communication noise, communication delays, link failures, and unexpected changes due to cyberattacks. In particular, coordinated cyberattacks may intend to infringe local estimators across the distributed IIoT networks of the power grid environment. Local zones within the distributed environment can be easily protected by their respective grid operators; however, boundary measurements among the local zones are sensitive and very critical. Consequently, if such tie-line parameters are exposed to cyberattacks, this will result in perturbation of critical system states of the distributed grid, and failure of the power system operation. Thus far, many articles have been reported on DSE. However, there has been very little work on the impact of cyberattacks towards the DSE. It is therefore of utmost importance to explore potential vulnerabilities towards the distributed power system and look for security solutions. To fill the research gap, this paper proposes adversarial models towards the DSE of smart grid. This article's major contributions include the following: 1 The SE problem is formulated using a distributed optimization approach based on the alternating direction method of multipliers (ADMM). Here, the formulated DSE is compared to a benchmark using a centralised-based weighted least squares (WLS) SE technique under normal operating conditions. 2 A data availability attack is proposed to investigate if the cyberattack can prevent boundary data exchange across a communication link and result in local unobservability of the distributed power grid. 3 In addition, a two-stage cyberattack is proposed to investigate if the combined attack of data availability and integrity can destabilize both the local zone where the attack was launched and the entire network. 4 Finally, the proposed framework is evaluated using sets of metrics such as local and global state estimated error, mean squared error (MSE), and estimation error using 2 -norm under various scenarios.
The rest of this paper is arranged as follows. First, background on security aspects of SE of the power system is presented in Section 2. Then, Section 3 reviews the existing literature on bad data analysis in DSE. Next, problem formulation of the DSE via ADMM algorithm is discussed in Section 4. The subsequent section discusses proposed framework and adversarial models methodology. Furthermore, Section 6 discusses performance evaluation of the proposed framework. Finally, the paper is concluded in Section 7.

Background
SE [2], [4] has been well practised in the industry for the last couple of decades. It is an essential component of the smart grid EMS, and its main functions include estimation of power system states and detecting bad data and/or cyberattacks based on measurements received from communication devices on a regular basis. The measurement model is given by = + for a DC power flow model and = ( ) + for an AC power flow model [2]. Here, = ( 1 , 2 , ...,  ) such that ∈ ℝ ×1 refers to measurement vector, or () ∈ ℝ × , commonly known as the Jacobian matrix, is a function that relates and power system states = ( 1 , 2 , ...,  ) such that ∈ ℝ  ×1 . And, ∈ ℝ ×1 is an additive noise, which is attributable to the communication channel and is usually modeled to follow additive white Gaussian noise (AWGN) distribution.
WLS [2], [3], [7], [8] is one of the most widely used centralised SE method that uses minimization of weighted sum of the squares of residual errors. Although WLS has a good performance for the traditional centralised SEs, it may not be viable for IIoT-based smart grid characterised by distributed renewable energy sources, ubiquitous networked devices, and distributed computing environment. Meanwhile, with the advent of a distributed management system [1], the implementation of SE necessitates a more distributed solution. Moreover, a report has indicated that the WLS-based centralised SE can be evaded by false data injection attacks [3], [4], [5], [10]. To overcome these limitations, DSE is eminently required for the ubiquitous IIoT-based smart grid. DSE has also been very promising in practice where the practical application of the DSE can be found in the multizone state estimators of smart grids, which may be run by separate system operators, each of which trying to determine its own system states [9].

Related Work
In recent past, a great deal of effort has been made in developing DSE techniques and the security issues related with them. The majority of DSE techniques may be classified as either hierarchical or fully distributed [9]. Hierarchical DSE approaches work on two-levels: first, a local estimation using local measurements across individual power system zones, followed by a final aggregated estimation using the local estimations and boundary information at a central coordinator. The authors of [7] proposed hierarchical-based DSE and distributed bad data analysis for multi-zone power systems. For the bad data analysis, each zone computes local residue vectors and gain matrices associated with the boundary measurements and sends the results to a central coordinator. The coordinator then exploits the communicated data to determine if any gross errors corrupt the measurements using largest normalised residue (LNR) [2] test. A similar line of research in [8] proposes bad data detection in a distributed method of WLS-based SE in multi-zone power system. In [8], the proposed SE leverages weight updates of actual and pseudo measurements at both local and global levels to improve accuracy of the local and global state estimators. LNR test is used to assess whether or not the measurements involve bad data. Similarly, the authors of [11] proposed distributed bad data identification using LNR test based on the hierarchical DSE where the central coordinator exploits the sensitivitiesof local objective functions with respect to boundary states. Although the related works ( [7], [8], [11]) introduced a robust DSE against bad data as compared to the centralized version, there are some drawbacks. Foremost is the hierarchical approach where estimations are performed at two levels: local zones and the central coordinator. Although the hierarchical distributed methods can alleviate communication overheads to a certain degree, as the power system grows in a very large scale, computational complexity and communication congestion issues can occur because of the presence of the centralized coordinator. Another drawback is that the bad data analysis is investigated at the central coordinator ignoring the impact of the bad data at the local SEs and global level. Moreover, the proposed bad data analysis techniques are based on LNR test, a conventional bad data detector which is found to be vulnerable to false data injection attacks [1], [3], [5].
Smart grid is turning into larger and more complex cyberphysical system as increasingly more IIoT network devices, and renewable and distributed energy resources are incorporated [6]. Consequently, the grid computing is shifting into a more fully distributed paradigm. Unlike to the hierarchicalbased distributed state estimators, the fully DSEs [12], [13], [14], [15], [16], [17] do not require a coordinator and hence offer significantly better performance in terms of communication overhead and reduced computational burden. In fully distributed SE approaches, the global SE result is obtained through localized estimations and a minimal information exchange among the neighbors. In [12], a fully DSE algorithm is proposed for wide-area monitoring in power systems. The authors showed that no coordinator is needed for each local zone to obtain provable estimation convergence of the integrated grid to that of the WLS-based centralized SE. Similarly, in [13], a bus-level DSE based on graph-theoretic and the conventional WLS algorithm is proposed. One of the potential advantages of [13] is that the approach does no longer require partitioning of the power system as the SE is based on a bus-level; however, it incurs very high computational and communication costs, especially with a large number of buses.
Under normal conditions, the aforementioned techniques perform well; nevertheless, their performance can suffer in the presence of malicious data attacks. A fully DSE solution and network topology identification is proposed in [14] leveraging the WLS algorithm where bad data is considered at local zone measurements. Moreover, in [15], the authors studied fully DSE problem using Kalman filter for large- scale power systems in the presence of bad data at both local and boundary measurements. Further, [16] and [17] studied the impact of cyberattacks in the fully DSE scheme. The DSE framework in [16] jointly conducts SE and analyses attack identification using the LNR test. The technique has a benefit of more robust estimation especially under cyberattacks. However, there are certain drawbacks in the work. One is that the cyberattack is assumed to remain local as the main intention is to avoid utilizing the bad data during the iterative estimation procedures. This implies that all the participating zones are trusted during the updates. However, the distributed optimization's periodic information exchange can be vulnerable to the adversarial attacks. For example, a malicious user who is aware of the underlying network topology, or a more intelligent and coordinated adversary can compromise the exchanged data. In addition, the work in [17] suggested a DSE framework for a joint SE and attack detection using residue norms across individual local zones. It is the first work to theoretically demonstrate the performance of a DSE in the presence of a single attack and simultaneous cyberattacks (namely, deception and denial of service (DoS) attacks). Contrary to the aforementioned approaches, the proposed framework investigates the security issues of the DSE, primarily from the adversarial point of view. The approach of this research is distinctive in the following ways: • First, unlike the previous state-of-the-art works, the proposed method explores the effect of cyberattack against both local control centers and the integrated grid under a fully distributed environment formulated via ADMM algorithm.
• Moreover, a two-stage cyberattack against the distributed environment is examined by proposing orchestrated data availability attack and distributed false injection attack.
• Furthermore, the distributed environment is evaluated using a variety of evaluation metrics under three distinct scenarios (i.e., normal circumstance, availability attack against a local SE, and availability and false injection attack against the integrated grid). In all cases, the proposed method is compared against ground truth system states and the centralised WLS SE technique. Table 1 summarizes the comparison of this work to the previously published articles. To the best of our knowledge, the research work being introduced in this article is unique in providing significant security issues of a smart grid by focusing on adversarial strategies towards the distributed state estimator of the EMS.

Problem Formulation
Recently, it has become so natural to look to paralleled and distributed computation algorithms as a mechanism for exploring large-scale statistical problems. Distributed optimization [18,19,20,21] techniques allow us to decompose an optimization problem into smaller, more manageable subproblems that can be solved concurrently. These have gained significant attention in a variety of applications, such as machine learning [18], signal processing [21], and power flow [19]. A review of numerous distributed optimization methods can be found in [18], [20].
ADMM [18,19,20] is a powerful algorithm, very suitable for distributed optimization. It integrates the quality of the augmented Lagrangian and the method of multipliers with the distributed processing function of dual decomposition. The ADMM-based DSE offers several advantages. First, it has the advantage of decomposing large-scale problems into sub-problems, allowing for completely distributed or decentralized solutions. Here, the distributed control centers try to solve independent and paralleled sub-problems and form a final solution. Moreover, the distributed control centers that use ADMM often have to exchange small volumes of information with a subset of other distributed control centers, minimizing communication overhead of central coordination and communication as much as possible. The ADMM-based SE approach also has benefits in terms of robustness in the face of individual distributed control center link failure. Besides, because the ADMM-based distributed optimization can perform parallel computations, it has the potential to outperform centralized SE algorithms in terms of computational efficiency, such as achieving fast convergence rate. This makes the ADMM as a viable solution to a distributed IIoT-based smart energy grid. In this paper, the SE problem is formulated via the ADMM algorithm (hereinafter referred to as the ADSE). The following two generalised assumptions are introduced on the distributed optimization problem. Comments based on these assumptions have also been included. Assumption 2 (Separability). Following Assumption 1, the objective function is separable with respect to the decomposion of system variables into sub-vectors/sub-matrices.
Assumption 1 signifies that each zone of the power system knows its local information including local measurement values , Jacobian information , and state vectors where partitioning of the state vectors complies with the subsets of buses in each subsystem. Hence, the measurement model can be formulated by = + for the DC power flow model or by (1) for the AC power flow model.
Assumption 2 implies that the objective function ( ) is separable such that the the optimization problem can lead to a decentralized algorithm ( ) = Furthermore, this poses that the subsystems to jointly solve the distributed optimization problem̂ = arg min ( ) ∑ =1 ( In the multi-zone system, a minimal information is communicated among the adjacent zones to account for the boundary measurement data [7] [16]. For example, see the boundary between 1 and 2 of Fig. 1 where the associated sensors read power flow measurements across the transmission line between buses 5 and 4. Suppose ι = {1, 2, ..., } is a neighbor of = {1, 2, ..., } such that ι ≠ . Let (ι) represents the subvector of shared with ι . Similarly, let ι ( ) be the subvector of ι shared with . Since the main objective of the distributed optimization problem is to enable each subsystem to independently solvê = arg min ( ) ∑ =1 ( ), this imposes a constraint on the shared states, i.e.
Considering the objective function and constraints of (2) and following the standard ADMM algorithm [19], [18], the Augmented Lagrangian function (3) is considered for the multi-area power system where ι is the Lagrange multiplier, K refers to the set of neighboring nodes adjacent to the ℎ zone, and > 0 is Lagrange penalty parameter. The proposed ADSE involves three main procedures as shown in Algorithm 1. The algorithm begins by defining power flow parameters including bus/branch data, and observed measurement values. Next, subvectors of each zone are initialized, namely 0 , 0 , [ ( ) ] 0 ∀ . After that, at each iteration ≥ 0 the vectors , ι , and ι are updated using (4a), (4b), and (4c), respectively. (4a) refers to the minimization of the local state vectors and is performed independently across each zone, in distributed and parallel way. (4b) and (4c), respectively refer to the minimization of the shared states and the update of Lagrange multiplier. Following the approach in [16] the closed-form solution to (4a) is given by (5) where the updates and are respectively given by +1 ∶= 1 ∑ ι∈ +1 ι , and +1 ∶= + +1 − 0.5( + ). And, is a diagonal matrix such that ∈ ℝ × .

System Model
Consider a wide-area monitoring of smart grid communication comprising of IIoT sensor networks. Fig. 1 shows Algorithm 10: 11: 12: end while 13: end procedure single-line diagram of the standard IEEE 14-bus system. The network topology is partitioned in to four non-overlapping zones, namely 1 , 2 , 3 , and 4 , similar to the power system partitioning adopted in [7]. Each zone has internal buses, internal branches, boundary buses and boundary branches. Each local SE obtains its own as well as the entire grid system states by leveraging the internal and boundary data. For the AC model, four different types of power system quantities are considered, namely, real power injection, reactive power injection, real power flow, and reactive power flow. Bus interfacing, configurations, types and locations of measurements are shown in Fig. 1 and Table 2. Fig. 2 shows the boundary data exchange under adversarial attacks. In Fig. 2, the communication links for boundary data exchange among the zones are labeled as , , , and .

Proposed Cyberattack Framework
Here, the proposed threat model is analysed towards the ADSE formulated by Algorithm 1. Our main intuition is to explore the impact of cyberattack on the DSE, specifically with the following two main attack goals:

Attack Goal 1 (AG1):
To investigate if the cyberattack launched in a particular zone results in local zone unobservability.

Attack Goal 2 (AG2):
To investigate if the cyberattack launched in a particular zone results in a global unobservability. In Fig. 2, 1 is a data availability attack against boundary data across the communication links. On top of that, a data integrity attack ( 1 ) against Zone 2 is considered. The attack type 2 is a data integrity attack whilst the boundary data exchange is happening among the neighbors. While 1 and 1 happen one event after the other, the 2 attack type is mutually exclusive of the former.
In Fig. 2, attack types 1 and 1 represent data availability and integrity attacks, respectively, and they are part of the AG1. Further, the integrity attack under the AG2 is represented by 2 . Under the first scenario, a data availability attack can occur at points , , , or . However, it can be noted that the attack does not have to compromise all the communication links. Zone 2 ( 2 ) is taken as a case study and disrupt links and . In this case, data availability attack across the two links will isolate 2 and now it can be observed how it affects the distributed DSE of 2 . Next, it is shown how the attacker can further destabilise 2 by injecting false data into 2 . Finally, it is demonstrated how the false data attack injected into 2 can actually destabilise not only 2 but also the entire grid when the communication of the distributed system happens properly assuming that there is no data availability attack. This attack is represented by 2 under the AG2 scenario. Definition 1 (Local zone unobservability). An attack vector is said to cause system local zone unobservability if, by removing the compromised sensors, results in non-optimal system states of the bus(es) adjoined to the sensors of that particular zone. Remark 1. For Definition 1, two distinct assumptions are made. One assumption is that the communication medium of the distributed system is vulnerable to data availability attacks causing loss of boundary update. And, the other assumption is a data integrity attack against a local zone. To this end, we propose a two-stage data availability and integrity attacks towards the distributed smart grid.

Data Availability Attack
Suppose that the inter-zone communication is subject to a data availability attack considering a scenario when an at-tacker targets against availability of the boundary information. DoS [22], [23] attacks are the most common availability attacks against communication systems that can be constructed at the physical layer (e.g. jamming attack), at the data link layer (e.g. collision attack), at the transport layer (e.g. flooding attack), targeting routing protocols or in the form of replay attacks into the network. DoS jamming attacks [23] are common towards shared networks where a malicious user can continually send unwanted signals to block any legitimate access to the communication medium. This work proposes a DoS attack that can prevent the individual zones from further sharing of their periodic boundary data. under these scenarios the exchange of boundary data can be modeled by the two random variables , and 1 , . Furthermore, assume that the probability of a boundary data availability being lost under the attack is denoted by , then the conditional probability of the update data that can be received by the local zones is given by (6).
There are two cases worth considering: when = 1 and following the birth-death process of Proposition 1 if either , = 0 or 1 , = 1. This yields +1 = 0 which indicates under a successful data availability attack the local zones will not receive any boundary update. In this case, the local zones need to retain the previous recent update (i.e. +1 ← , ∀ ≤ ). Consequently, when the distributed system is subject to the availability attack, then (5) is reduced to (8) where * ≤ refers to an iteration index at which the last boundary update occurs just before the availability attack has occurred.

Data Integrity Attack
After a successful launch of the availability attack, a malicious injection attack is considered that can compromise measurement readings of a single zone. This attack is formulated in 5.3. Now under this attack scenario, the SE solution becomes where , and , refer to the attacked local states and compromised measurement values ( + ), respectively.
Definition 2 (Global unobservability). The attack vector is said to cause global unobservability if, by removing the compromised sensors, results in non-optimal system states of the bus(es) adjoined to the sensors of multiple zones.

Remark 2. The cyberattack in Definition 2 occurs when there is an inter-zone information exchange.
Under this scenario, the iterative version of (5) and the update terms for the boundary exchange are used:

Threat Model of the Data Integrity Attack
Consider a false data injection attack [3], [10] vector of the form = { , } ≠ 0 which can compromise a limited number of measurements. The malicious data attack can target a subset of sensors denoted by adjoined to a particular node of the local estimator and cause system unobservability of the power grid. Note that the adversary cunningly selects sufficient number of such that the resulting attack vector (i) ← ( , 1) end if 12: end procedure is unobservable which may ultimately result in the perturbation of the critical system states. Let  be the total number of measurement/sensor readings across zone . We say that the attack vector causes local unobservability if the compromised sensors (where ⊆  ) are removed and if the convergence of the corresponding states is not achieved within an acceptable estimation error. One of the possible adversarial approach can be to counterfeit out of the  measurements provided that the attacker has access to the sensor readings.

Proposition 2.
Suppose that   = { 1 , 2 , ..., } refers to the set of indices of the compromised sensors, the attack vector can be formulated through (13) where is a non-zero injection vector whose array size corresponds to the non-zero column size of .

Remark 3. Equation (13) is a distributed adversarial model
with the assumption that the malicious user is aware of network structure of the power system.
The data integrity attack of Proposition 2 is applicable for the two attack goals (i.e. AG1 and AG2). The attack construction procedure of (13) is presented in Algorithm 2.

Performance Evaluation and Discussion
This section provides justification through numerical simulations and discussions of the results.

Test System Scenario
To demonstrate the performance of the proposed framework, sets of experiments are conducted on the multi-zone scheme of the IEEE 14-bus system given in Fig. 1. For all numerical results of this work, AC power flow model with voltage magnitudes and angles are considered. A total of 46 measurement quantities are used for the entire grid (i.e., 8 in 1 , 14 in 2 , 14 in 3 , and 10 in 4 ). Following the network partitioning of Fig. 1, the measurement readings are grouped into internal and boundary (see Table 2 for the different measurement configurations of each zone). Both the internal and boundary data include active and reactive power injection (i.e. at buses), and active and reactive power flow (i.e. along branches) of the power grid. The set of power injection measurements are indicated by { } where refers to the deployed sensor at the ℎ bus. Similarly, the set of power flow measurements are indicated by { 1 − 2 } where 1 − 2 refers to the deployed sensor along the branch or transmission line 1 − 2 . To make the measurements more realistic, the communication channel is modeled as AWGN noise where a mean = 0 and variance 2 = 10 −4 is added to each measurement quantity.
The experiments of the developed framework are conducted using MATLAB R2019B. Measurement dataset is generated based on Fig. 1 where relevant power system parameters including bus/branch data, admittance matrices, and the Jacobian matrices are extracted using MATPOWER [24]. First, estimation of system states is computed under normal circumstance using the iterative procedures of Algorithm 1 of the ADSE. Next, the performance evaluations of the proposed ADSE are compared to the centralised SE approach, which serves as a benchmark for power system SE tasks. The proposed ADSE is expected to have an approximated estimation accuracy to that of the centralized approach. Therefore, the estimation performances of the ADSE are benchmarked against the commonly known WLS-based [2] [3] centralised state estimator. Further, the ADSE is evaluated with respect to the proposed AG1 and AG2 considering the communication architecture given in Fig. 2.

Results and Discussion
The following error metrics are adopted under three different scenarios. First, state estimated error ( =̂ − ) ∀ ,∀ between estimations of each local zone and ground truth states, as well as estimations of each local zone and the centralised WLS state estimator is considered under normal circumstances. Similarly, the global estimation result is compared to the ground truth states and the centralised WLS state estimator. This evaluation metric helps us to assess the estimation performance of the ADSE against the WLS technique. Another metric is estimation error based on the 2norm where the estimation of each zone and the global level is compared to the corresponding ground truth system states, and to the centralised WLS state estimator. The 2 -norm based estimation error is given by wherê and , respectively refer to the vectors of estimated and ground truth system states. Furthermore, to verify the im-

Scenario I (under normal condition)
First, the estimation results of the ADSE are plotted in Fig. 3, also compared to the WLS-based centralised SE and ground truth states. While Fig. 3a is estimation results of the WLS-based centralised SE, Fig. 3b is the global estimation result of the ADSE. Results of these two are also compared to the ground truth states in Fig. 3c. Next, 2 is shown in Fig  4a, showing the errors between the global estimated values and ground truth states, and between the global estimated values and centralised WLS. Additionally, Fig. 4b is estimation error using the 2 of some selected buses (e.g. buses 2 from 1, 3 from 2, and 13 from 3 are used). Finally, the deviation between estimation differences of bus indices to the centralised WLS is considered. This error metric is similar to the one adopted in [12]. The deviation between estimation differences between two different bus indices of and is given by , = |(̂ −̂ ) WLS − (̂ −̂ ) ADSE |, where |.| is the absolute value operator. This result is depicted in Fig. 4c. Under Scenario I, the mean error in terms of the  2 of the WLS-based SE and the ADSE is about 0.095% and 0.11%, respectively. Likewise, the estimation error in terms of MSE of the WLS-based SE and the ADSE is about 0.000093% and 0.00016% respectively. These estimation errors are acceptable for the EMS of the power system [2].
The numerical results shown above demonstrate that, under normal operating conditions, the proposed ADSE method converges within acceptable estimation errors. It can also be shown that the estimation performances, including under measurement noises, are close to the results of the WLS estimator.

Scenario II (Under AG1)
To verify the impact of AG1, first, estimation errors of the local and global DSE under normal circumstances are considered, shown in Fig. 5a. Then, the error between estimations obtained using (8) (i.e. after availability attack on the shared boundary data), and ground truth states of each local zone is shown in Fig. 5b. Starting from iteration 2 (where the availability attack occurs) the estimation error of Fig. 5b is higher compared to the estimation error under the normal circumstances of Fig. 5a. For the integrity attack, let the adversary targets sensors connected to bus 4 of 2 (i.e. { 4 , 4−5 , 4−7 , 3−4 }). Note that although 2 is taken as an example, without loss of generality the attack vector can be originated from other zones as well. Based on the targeted measurements, the attacker can cunningly select the injection vector to construct a non-zero attack vector = as defined by (13). In this regard, let for bus 4 of 2 is times the nominal voltage magnitude 0 , which is given by (14).
Then, the attack vector is obtained by replacing (14) in = . Let = −15% for the data integrity attack of Scenario II and Scenario III although different values can be possible. The local unobservability attack considering the availability and integrity attacks is shown in Fig. 5c. The estimation result under the AG1 of both the availability and integrity attacks shows much higher average estimation error (i.e. 34.74% in terms of 2 ). Accordingly, As there is no boundary communication among the neighbor zones, the local unobservability is limited within Zone 2.

Scenario III (Under AG2)
Now the impact of the false injection attack (14) originated from zone 2 is evaluated under AG2. Under this scenario (shown in Fig. 5d), the exchange of boundary data among the zones is considered as demonstrated in Section 5.2.2. Consequently, this attack affects both 2 and the rest of the zones. Under this scenario, the neighboring zones exchange boundary data and the local zones are compromised, resulting in estimation error ( 2 ) of 9.73, 21.51, 6.33, and 13.87% respectively for 1 , 2 , 3 , and 4 .

Conclusion
This article has provided an in-depth analysis of the security threats of IIoT-based smart grid and highlighted serious security vulnerabilities. It was shown that a coordinated two-stage data availability and integrity attack can destabilise local zones of the distributed smart grid. Moreover, it was demonstrated how the data integrity attack can actually destabilise not only a particular zone but also the entire grid when the communication of the distributed system occurs properly. While the estimation error of the DSE is acceptable for smart grid EMS under normal operating conditions, it becomes unbounded (both locally and across the integrated grid) in the presence of orchestrated cyberattacks. Hence, the investigation of cyberattacks in the DSE in this article can help system designers foresee any potential interaction between the grid and adversaries. In consequence, it calls for solutions against the DSE vulnerabilities to improve the security and widespread adoption of IIoT-based smart grid ecosystem.
Future work recommendations can be taken into account, both from the perspective of the adversaries and system operators. As coordinated cyberattack against the DSE may have a wide range of security consequences such as energy theft, risk and reliability, secure operation and stability, electricity market and pricing economics, and so on, the study of threat models based on these impacts is an open research issue. Moreover, from the system operator/defence perspective, one potential future research can be if it is possible to develop a distributed attack detection using, for example, a game-theoretic approach leveraging the grid-adversary interaction. Further, after the attack identification, the operator may then need to mitigate compromised measurements (for example, leveraging pseudo-measurements) using datadriven approaches. Last but not least, to further deter the incumbent security challenges across the distributed smart grid, preventative security measure against the incumbent cyberattacks is another open research issue.