  By manipulating tens of thousands of internet-of-things (IoT) enabled
high-wattage electrical appliances (e.g., WiFi-controlled air-conditioners),
large-scale load-altering attacks (LAAs) can cause severe disruptions to power
grid operations. In this work, we present a rare-event sampling approach to
identify LAAs that lead to critical network failure events (defined by the
activation of a power grid emergency response (ER)). The proposed sampler is
designed to "skip" over LAA instances that are of little interest (i.e., those
that do not trigger network failure), thus significantly reducing the
computational complexity in identifying the impactful LAAs. We perform
extensive simulations of LAAs using the Kundur two-area system (KTAS) power
network while employing the rare-event sampler. The results help us identify
the victim nodes from which the attacker can launch the most impactful attacks
and provide insights into how the spatial distribution of LAAs triggers the
activation of ERs.
