In a communications-based cyberattack, malicious actors can spread through a network of different infected devices as the devices communicate with each other. Modern power grids can be vulnerable to this kind of attack, due to their complexity, remote access, and their ability to rapidly react to consumer energy needs. In his research at UMass Boston, Zografopoulos studies how cyberattacks can spread through a network of connected devices—and how they can be stopped.

“Grids of the past were passive,” says Zografopoulos. “Every item was just consuming power; it wasn’t generating.” These days, he says, power grids have to react to power flowing back into the grid, often from renewable sources. 

“Today we have rooftop solar panels and solar farms, electric vehicles which can both charge and discharge, large-scale battery storage, and even micro nuclear reactors which can operate on either the distribution side or the transmission side. The power grid has become a far more intricate system, and in order to coordinate it and keep it balanced, we need constant communication and a seamless exchange of information.”

Threat actors can hijack communications between devices in a power grid, exploiting their connectivity. In a modern interconnected system, an effective cyberattack could have cascading effects on power distribution and transmission. A single devastating cyberattack could cripple device after device, cascading through vast sections of the power grid. In 2015 and 2016, hackers did exactly that in Ukraine, using malware to plunge entire cities into darkness. 

With the support of his new NSF grant, Zografopoulos will be developing and testing several different ways to protect networks. For instance, by adopting secure communications techniques, such as encryption and data verification, power distributors can strengthen vulnerable parts of the network and give them an added layer of protection. UMass Boston students will have a chance to contribute to this research: the grant includes funding to support at least one graduate student, as well as undergraduate students.

Zografopoulos will also experiment with “network islanding,” a practice of locking down portions of a communications network to isolate areas that have been compromised. Communications could then be routed around the affected areas using redundant pathways and network reconfiguration. Like quarantining an infection, islanding could allow communication networks to keep functioning, even while a cyberattack is underway. 

The experiments will take place in Zografopoulos’ Infrastructure Cybersecurity and Resilience Laboratory (ICARUS), in the ICARUS testbed they have constructed. The testbed mimics an entire power grid in a virtual format, running the same software in the same configurations as an actual power grid—but without any actual power exchange through generation or consumption.

“Everything that is happening in our real-time testbed is exactly the same as if it were being tested in Eversource, or National Grid, or any of those distribution or transmission system operators,” Zografopoulos says. This enables his team to safely observe, in real time, what happens when the virtual equipment is hit with a cyberattack.

This unique testbed setup was recently expanded with a donation of equipment from SEL (Schweitzer Engineering Laboratories). The testbed now includes a satellite-synchronized clock to ensure that different power system components are perfectly in sync, automation controllers designed to control distribution systems, and an Ethernet security gateway and switch designed to protect communication networks from cyberattacks. 

By connecting this equipment to ICARUS, Zografopoulos has been able to create a “microgrid,” a miniature version of the power network that offers a clearer view of how cyberattacks could disrupt energy distribution. It also makes the ICARUS lab a unique environment to design safer, more resilient protections for tomorrow’s power grids.