Abstract:Grid-interactive smart buildings integrated with building automation systems (BAS) have gained increasing attention in recent years because of their ability to enable timely data communication that links physical and cyber-based control systems. However, the increasing integration has made both buildings and power grids more vulnerable to cyber-attacks. This study highlights the critical importance of cyber security considering negative energy impacts on grid-interactive buildings, which can severely jeopardize the safety and stability of power grids. This paper first proposes a novel man-in-the-middle (MITM) cyber-attack with specific malicious intent to manipulate the building power demand from the heating, ventilation, and air conditioning (HVAC) systems. The model predictive control (MPC) strategy is implemented to maximize power consumption or load ramp rate while simultaneously ensuring optimal building thermal comfort and evading detection by building occupants. Furthermore, the expert rules, i.e., air handling unit performance assessment rules (APAR), are incorporated as critical constraints in the MPC algorithm to bypass the fault detection alarms. The results demonstrate the capabilities of the proposed MITM cyber-attack scenarios in achieving predetermined objectives without triggering any fault detection alarms. In attack Scenario 1, the total power consumption is increased by up to 55%, and in attack Scenario 2, the load ramp rate is increased by 19 times compared with the fault-free BAS. The comparison between DoS (denial of service), FDI (false data injection), and the proposed cyber-attack, which focuses on their impact on the power grid and concealment analysis, is conducted to raise awareness of the severity and stealthiness of the proposed cyber-attacks. This paper is among the first few developing comprehensive MITM cyber-attacks to intelligently manipulate building power consumption exploiting real-time BAS data. It unveils the important risks associated with BAS and provides valuable insights for further assessment of cyber security of grid-interactive smart buildings.

Vulnerability of Building Energy Management against Targeted False Data Injection Attacks:Model Predictive Control vs. Proportional Integral

Vulnerability and Impact of Machine Learning-Based Inertia Forecasting under Cost-Oriented Data Integrity Attack

Learning-Based Resilient FCS-MPC for Power Converters under Actuator FDI Attacks

Secure MPC/ANN-Based False Data Injection Cyber-Attack Detection and Mitigation in DC Microgrids

Model-based adaptive security control strategy against false data injection attacks in cyber–physical systems

Multi-Objective False Data Injection Attacks of Cyber–Physical Power Systems

Tube Model Predictive Control Based Cyber-Attack-Resilient Optimal Voltage Control Strategy in Wind Farms

Sensor Attacks and Resilient Defense on HVAC Systems for Energy Market Signal Tracking

Unveiling stealthy man-in-the-middle cyber-attacks on energy performance in grid-interactive smart buildings

Resilient Consensus Control Scheme for Distributed Energy Storage Systems in DC Microgrids Against False Data Injection Attacks

False data injection attacks and countermeasures in smart microgrid systems

Cybersecurity Analysis of Data-Driven Power System Stability Assessment

Robust security‐based model predictive control for nonlinear cyber‐physical system under random occurring deception attacks and actuator saturation

Validation of a Model Predictive Control Strategy on a High Fidelity Building Emulator

Control Conditions for Equal Power Sharing in Multi-Area Power Systems for Resilience Against False Data Injection Attacks

Adaptive Security Control against False Data Injection Attacks in Cyber-Physical Systems

Using personal environmental comfort systems to mitigate the impact of occupancy prediction errors on HVAC performance

Resilient Model Predictive Control of Cyber–Physical Systems Under DoS Attacks

Adaptive control for cyber-physical systems under man-in-the-middle attacks with false data injections

Moving-horizon False Data Injection Attack Design against Cyber-Physical Systems