Abstract:Grid-interactive smart buildings integrated with building automation systems (BAS) have gained increasing attention in recent years because of their ability to enable timely data communication that links physical and cyber-based control systems. However, the increasing integration has made both buildings and power grids more vulnerable to cyber-attacks. This study highlights the critical importance of cyber security considering negative energy impacts on grid-interactive buildings, which can severely jeopardize the safety and stability of power grids. This paper first proposes a novel man-in-the-middle (MITM) cyber-attack with specific malicious intent to manipulate the building power demand from the heating, ventilation, and air conditioning (HVAC) systems. The model predictive control (MPC) strategy is implemented to maximize power consumption or load ramp rate while simultaneously ensuring optimal building thermal comfort and evading detection by building occupants. Furthermore, the expert rules, i.e., air handling unit performance assessment rules (APAR), are incorporated as critical constraints in the MPC algorithm to bypass the fault detection alarms. The results demonstrate the capabilities of the proposed MITM cyber-attack scenarios in achieving predetermined objectives without triggering any fault detection alarms. In attack Scenario 1, the total power consumption is increased by up to 55%, and in attack Scenario 2, the load ramp rate is increased by 19 times compared with the fault-free BAS. The comparison between DoS (denial of service), FDI (false data injection), and the proposed cyber-attack, which focuses on their impact on the power grid and concealment analysis, is conducted to raise awareness of the severity and stealthiness of the proposed cyber-attacks. This paper is among the first few developing comprehensive MITM cyber-attacks to intelligently manipulate building power consumption exploiting real-time BAS data. It unveils the important risks associated with BAS and provides valuable insights for further assessment of cyber security of grid-interactive smart buildings.

Cyber-attack against heating system in integrated energy systems: Model and propagation mechanism

Towards a Framework for Cyber Attack Impact Analysis of Electric Cyber Physical Systems.

Vulnerability Assessment of Electrical Cyber-Physical Systems Against Cyber Attacks

Coordinated Heat and Power Cyber-attacks with Time Window Matching Strategy

Analysis of Malware-Induced Cyber Attacks in Cyber-Physical Power Systems

False-Data-Injection-Enabled Network Parameter Modifications in Power Systems: Attack and Detection

Distributed Event-Based Control for Thermostatically Controlled Loads under Hybrid Cyber Attacks

Multi-Objective False Data Injection Attacks of Cyber–Physical Power Systems

Sensor Attacks and Resilient Defense on HVAC Systems for Energy Market Signal Tracking

Differential Evolution-Based Three Stage Dynamic Cyber-Attack of Cyber-Physical Power Systems

A Study on Operation Control of Urban Centralized Heating System Based on Cyber-Physical Systems

Dynamic Security Control in Heat and Electricity Integrated Energy System With an Equivalent Heating Network Model

Research on reliability assessment and multi-time scale improvement strategy of electricity-gas integrated energy system under cyber attack

Dynamic Data Injection Attack Detection of Cyber Physical Power Systems with Uncertainties

Unveiling stealthy man-in-the-middle cyber-attacks on energy performance in grid-interactive smart buildings

Modeling and Assessing Load Redistribution Attacks Considering Cyber Vulnerabilities in Power Systems

A Verifiable Framework for Cyber-Physical Attacks and Countermeasures in a Resilient Electric Power Grid

On False Data Injection Attacks Against Distributed Energy Routing in Smart Grid

Cyber security in cyber-physical systems: on false data injection attacks in the smart grid

Simulation Model of Cascading Effects from Cyber Attacks on Electric Power Infrastructure Networks

Small-Signal Angle Stability-Oriented False Data Injection Cyber-Attacks on Power Systems