Economic Impact Assessment of Denial-of-Service and Time-Delay Attacks on Advanced Metering Infrastructure

Technical Summary: Economic Impact Assessment of DoS and Time-Delay Attacks on AMI

Problem Statement
Advanced Metering Infrastructure (AMI) is critical for modern power systems, providing near real-time consumption data essential for load forecasting and operational planning. However, AMI communication networks are vulnerable to cyberattacks, specifically Denial-of-Service (DoS) and Time-Delay Attacks (TDAs). While existing research has extensively covered device-level security and detection mechanisms for false data injection, there is a significant gap in understanding how communication degradations (delays and packet loss) translate into tangible economic consequences. When AMI data is delayed or lost, utilities may underestimate future energy demand, forcing them to procure surplus energy in the real-time market at volatile and often higher prices compared to day-ahead markets. This paper addresses the lack of quantitative analysis linking communication impairment rates to financial losses in energy procurement.

Methodology
The study employs a simulation-based approach using the Mininet network emulation platform to model an AMI architecture. The experimental setup includes:

• System Modeling: A topology comprising eight smart meters, two data concentrators (DCs), two base station switches, and a utility server. The architecture utilizes a dual-redundant design where meters in two sites have primary and backup concentrators.
• Communication Protocol: A DNP3-inspired communication model was implemented over User Datagram Protocol (UDP) to simulate the "master-outstation" polling behavior. The model uses a 1-second timeout threshold and a 3-second polling interval. It does not include retransmission logic within the same cycle, reflecting specific behaviors where failed requests are recorded as timeouts and retried in subsequent cycles.
• Attack Scenarios: Five scenarios were implemented using the Linux Traffic Control utility (tc netem) to introduce controlled impairments:
  1. Time-Delay Attack: A fixed 500 ms delay on selected links.
  2. Packet Loss (20%): 20% of packets dropped.
  3. Packet Loss (50%): 50% of packets dropped.
  4. Combined Degradation: Simultaneous 500 ms delay and 20% packet loss.
  5. Data Concentrator Failure (DC-down): One concentrator disabled to test redundancy.
• Performance Metrics: The study measured Round-Trip Time (RTT), timeout counts, successful measurement counts, and calculated a Communication Degradation Rate ($D_{rate}$) defined as the ratio of timeout events to total polling requests.
• Economic Estimation: The observed $D_{rate}$ was extrapolated to a regional scale of 10,000 smart meters. The economic impact was calculated using the formula: $Impact = N \times E \times D_{rate} \times P$, where $N$ is the number of meters, $E$ is average daily consumption (weighted for residential/commercial mix), $D_{rate}$ is the degradation rate, and $P$ is the real-time electricity price from the Independent System Operator–New England (ISO–NE).

Key Contributions

1. AMI Architecture Development: Creation of a Mininet-based AMI communication architecture utilizing a DNP3-inspired model over UDP to relay meter data.
2. Scenario Implementation: Execution of specific cyberattack-inspired degradation scenarios (delay, packet loss, combined degradation, and hardware failure) to evaluate their effects on AMI availability.
3. Quantitative Economic Estimation: Derivation of the economic consequences of communication degradation by correlating experimentally observed impairment rates with real-time electricity pricing data from ISO–NE.

Results

• Communication Performance:
  • Baseline: Under normal conditions, the system exhibited an average RTT of 0.22 ms with only one timeout event.
  • Delay: A 500 ms delay increased the average RTT to 69.5 ms but resulted in only one timeout, indicating that moderate delays alone do not immediately compromise data availability within the 1-second threshold.
  • Packet Loss: Packet loss proved to be the primary driver of communication failure. A 20% loss rate caused 28 timeouts, while a 50% loss rate resulted in 87 timeouts.
  • Combined Attack: The scenario combining 500 ms delay and 20% packet loss yielded the highest degradation, with 104 timeouts and an average RTT of 51.4 ms.
  • Redundancy: In the DC-down scenario, the redundant architecture maintained operational continuity. While the timeout rate increased from 0.22% (1/445) to 4.50% (104/2,311) when one concentrator failed, the remaining concentrator preserved measurement visibility, preventing total data loss.
• Economic Impact:
  • Using a 50% packet loss scenario ($D_{rate} \approx 5.31\%$) and extrapolating to 10,000 meters:
    • Under normal market conditions (ISO–NE price of \59.38/MWh), the estimated daily economic impact is approximately **\1,009**.
    • Under worst-case high-price events (modeled at \300/MWh, based on the 2017–2018 cold weather event), the estimated daily impact rises to approximately **\5,097**.
  • Scaling: The authors note that extrapolating these figures to the 1.5 million meters deployed in the New England region suggests potential daily exposures of \151,300 (normal prices) and \764,600 (high prices), though these are presented as worst-case illustrations rather than precise predictions.

Significance and Claims
The paper claims that while previous studies have demonstrated the technical severity of DoS and TDAs on AMI data streams, little attention has been paid to the resulting financial implications. This work provides a quantitative link between communication degradation and operational costs, demonstrating that even modest communication impairments can force utilities to purchase expensive real-time energy due to forecasting inaccuracies. The study emphasizes that while redundancy mechanisms (like dual concentrators) can mitigate total data loss, they do not eliminate the economic risks associated with increased latency and packet loss. The authors present these findings as a conservative, order-of-magnitude estimate, acknowledging that actual utility losses may be mitigated by interpolation or historical load profiling, but confirming that cyberattacks on AMI infrastructure carry significant economic weight beyond mere technical disruption.