Emulating Wide Area Communication Networks for Testing Cyber Attack Scenarios

This paper develops a cyber-physical emulation framework for testing how communication-network attacks can affect wide-area remedial action schemes in power systems. Using Sandia’s SCEPTRE platform, a virtual network of PMU and RAS/PDC devices was coupled with a MATLAB/PSTess simulation of the miniWECC system, with DNP3/TCP used to exchange timestamped voltage-magnitude and phase-angle measurements and with timing parameters tuned to reduce closed-loop communication latency from roughly 1.2 seconds to about 43 milliseconds in a three-PMU case. The framework was then used to test denial-of-service and ARP-spoofing/man-in-the-middle attacks during a multi-stage grid disturbance; the DoS attempt was largely ineffective in the tested setup, while a MitM attack launched during the disturbance blocked RAS operation and led to system instability and simulation shutdown. When the same attack was initiated after the RAS had already acted, measurement accuracy degraded and communication timing diverged, but the system remained stable. The results show that both attack timing and communication latency are critical to evaluating cyber-physical risk in wide-area protection and control, and the work provides a scalable testbed foundation for future studies involving larger virtual networks, additional protocols, and intrusion-detection or mitigation tools.