  To address the increasing vulnerability of power grids, significant attention
has been focused on the attack detection and impact mitigation. However, it is
still unclear how to effectively and quickly recover the cyber and physical
networks from a cyberattack. In this context, this paper presents the first
investigation of the Cyber Recovery from Dynamic load altering Attack (CRDA).
Considering the interconnection among electricity, transportation, and cyber
networks, two essential sub-tasks are formulated for the CRDA: i) Optimal
design of repair crew routes to remove installed malware and ii) Adaptive
adjustment of system operation to eliminate the mitigation costs while
guaranteeing stability. To achieve this, linear stability constraints are
obtained by estimating the related eigenvalues under the variation of multiple
IBR droop gains based on the sensitivity information of strategically selected
sampling points. Moreover, to obtain the robust recovery strategy, the
potential counter-measures from the adversary during the recovery process are
modeled as maximizing the attack impact of remaining compromised resources in
each step. A Mixed-Integer Linear Programming (MILP) problem can be finally
formulated for the CRDA with the primary objective to reset involved droop
gains and secondarily to repair all compromised loads. Case studies are
performed in the modified IEEE 39-bus power system to illustrate the
effectiveness of the proposed CRDA compared to the benchmark case.
