  This work proposes a moving target defense (MTD) strategy to detect
coordinated cyber-physical attacks (CCPAs) against power grids. A CCPA consists
of a physical attack, such as disconnecting a transmission line, followed by a
coordinated cyber attack that injects false data into the sensor measurements
to mask the effects of the physical attack. Such attacks can lead to
undetectable line outages and cause significant damage to the grid. The main
idea of the proposed approach is to invalidate the knowledge that the attackers
use to mask the effects of the physical attack by actively perturbing the
grid's transmission line reactances using distributed flexible AC transmission
system (D-FACTS) devices. We identify the MTD design criteria in this context
to thwart CCPAs. The proposed MTD design consists of two parts. First, we
identify the subset of links for D-FACTS device deployment that enables the
defender to detect CCPAs against any link in the system. Then, in order to
minimize the defense cost during the system's operational time, we use a
game-theoretic approach to identify the best subset of links (within the
D-FACTS deployment set) to perturb which will provide adequate protection.
Extensive simulations performed using the MATPOWER simulator on IEEE bus
systems verify the effectiveness of our approach in detecting CCPAs and
reducing the operator's defense cost.
