  The Internet of Things (IoT) provides a salient communication environment to
facilitate the coordinated charging of electric vehicle (EV) load. However, as
IoT is connected with the public network, the coordinated charging system is in
a low-level cyber security and greatly vulnerable to malicious attacks. This
paper investigates the malicious mode attack (MMA), which is a new cyberattack
pattern that simultaneously attacks massive EV charging piles to generate
continuous sinusoidal power disturbance with the same frequency as the
poorly-damped wide-area electromechanical mode. Thereby, high amplitude forced
oscillations could be stimulated by MMA, which seriously threats the power
system stability. First, the potential threat of MMA is clarified by
investigating the vulnerability of the IoT-based coordinated charging load
control system, and an MMA process like Mirai is pointed out as an example. And
then, based on the attack process, an MMA model is established for impact
analysis where expressions of the mean and stochastic responses of the MMA
forced oscillation are derived to discover main impact factors. Further, to
mitigate the impact of MMA, a defense strategy based on multi-index information
active disturbance rejection control is proposed to improve the stability and
anti-disturbance ability of the power system, which considers the impact
factors of both mode damping and disturbance compensation. Simulations are
conducted to verify the existence and characteristics of MMA threats, and the
efficiency of the proposed defense strategy is also validated.
