Е-Публикации
Технически университет - София

Abstract: Photovoltaics with energy storage are the current trend in solar energy. Hybrid inverters are the backbone of low-power installations of this type. If a single installation is compromised, there are no significant security concerns. However, multiple devices can be targeted simultaneously. Taking into account their increasing share in the energy mix, distributed cyber-attacks against these devices can threaten grid stability. The Bulgarian electric power system has been analyzed in order to determine its development which is in line with EU-wide trends. It can be concluded that hybrid inverters are expected to grow rapidly in number and in installed power. The vulnerability of hybrid inverters to cyber-attacks has been analyzed, and the possible consequences for the energy system have been identified. The technology allows it to be used as a hybrid means of influence, and this aspect is poorly addressed in existing cybersecurity regulations. A risk assessment has been made, based on which measures to improve security have been proposed.

References

1. Su Q. Wang H. Sun C. Li B. Li J. Cyber-attacks against cyber-physical power systems security: State estimation, attacks reconstruction and defense strategy Appl. Math. Comput. 2022 413 126639 10.1016/j.amc.2021.126639
2. Harrou F. Taghezouit B. Bouyeddou B. Sun Y. Cybersecurity of photovoltaic systems: Challenges, threats, and mitigation strategies: A short survey Front. Energy Res. 2023 11 1274451 10.3389/fenrg.2023.1274451
3. E&ENEWS Sobczak B. ‘Cyber Event’ Disrupted U.S. Grid Networks—DOE 2019 Available online: https://www.eenews.net/articles/cyber-event-disrupted-u-s-grid-networks-doe/ (accessed on 1 April 2025)
4. Ye J. Giani A. Elasser A. Mazumder S.K. Farnell C. Mantooth H.A. A Review of Cyber–Physical Security for Photovoltaic Systems IEEE J. Emerg. Sel. Top. Power Electron. 2022 10 4879 4901 10.1109/JESTPE.2021.3111728
5. Ahmed C.M. Palleti V.R. Mishra V.K. A practical physical watermarking approach to detect replay attacks in a CPS J. Process Control 2022 116 136 146 10.1016/j.jprocont.2022.06.002
6. Zhao A.P. Li S. Gu C. Yan X. Hu P.J.-H. Wang Z. Xie D. Cao Z. Chen X. Wu C. et al. Cyber Vulnerabilities of Energy Systems IEEE J. Emerg. Sel. Top. Ind. Electron. 2024 5 1455 1469 10.1109/JESTIE.2024.3434350
7. Yang K. Wang H. Wang H. Sun L. An effective intrusion-resilient mechanism for programmable logic controllers against data tampering attacks Comput. Ind. 2022 138 103613 10.1016/j.compind.2022.103613
8. Kang B. Maynard P. McLaughlin K. Sezer S. Andrén F. Seitl C. Kupzog F. Strasser T. Investigating Cyber-Physical Attacks against IEC 61850 Photovoltaic Inverter Installations Proceedings of the IEEE 20th Conference on Emerging Technologies & Factory Automation (ETFA) Luxembourg 8–11 September 2015 1 8 10.1109/ETFA.2015.7301457
9. Ghiasi M. Niknam T. Wang Z. Mehrandezh M. Dehghani M. Ghadimi N. A comprehensive review of cyber-attacks and defense mechanisms for improving security in smart grid energy systems: Past, present and future Electr. Power Syst. Res. 2023 215 Pt A 108975 10.1016/j.epsr.2022.108975
10. Benkraouda H. Chakkantakath M.A. Keliris A. Maniatakos M. SNIFU: Secure Network Interception for Firmware Updates in legacy PLCs Proceedings of the IEEE 38th VLSI Test Symposium (VTS) San Diego, CA, USA 5–8 April 2020 1 6 10.1109/VTS48691.2020.9107609
11. Sahoo S. Dragičević T. Blaabjerg F. Cyber Security in Control of Grid-Tied Power Electronic Converters—Challenges and Vulnerabilities IEEE J. Emerg. Sel. Top. Power Electron. 2021 9 5326 5340 10.1109/JESTPE.2019.2953480
12. Riurean S. Fîță N.-D. Păsculescu D. Slușariuc R. Securing Photovoltaic Systems as Critical Infrastructure. A Multi-Layered Assessment of Risk, Safety, and Cybersecurity Sustainability 2025 17 4397 10.3390/su17104397
13. Dedrick J. Perrin K.A. Sabaghian E. Wilcoxen P.J. Assessing cyber attacks on local electricity markets using simulation analysis: Impacts and possible mitigations Sustain. Energy Grids Netw. 2023 34 100993 10.1016/j.segan.2023.100993
14. Li F. Xie R. Yang B. Guo L. Ma P. Shi J. Detection and Identification of Cyber and Physical Attacks on Distribution Power Grids with PVs: An Online High-Dimensional Data-Driven Approach IEEE J. Emerg. Sel. Top. Power Electron. 2022 10 1282 1291 10.1109/JESTPE.2019.2943449 36090809
15. SMA Solar Technology AG Public Cyber Security: Guidelines for a Secure System Communication Technical Information; CyberSecurity-TI-en-20 SMA Solar Technology AG Niestetal, Germany 2025 Available online: https://files.sma.de/downloads/CyberSecurity-TI-en-20.pdf (accessed on 4 April 2025)
16. Terneva Z. Nenova M. Terneva V. Vladimirov I. Nikolova D. Cyberattack types—Methods and technics for protection of communication resources Proceedings of the 57th International Scientific Conference on Information, Communication and Energy Systems and Technologies (ICEST) Ohrid, North Macedonia 16–18 June 2022 1 4 10.1109/ICEST55168.2022.9828665
17. Khan R. Maynard P. McLaughlin K. Laverty D. Sezer S. Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid Proceedings of the 4th International Symposium for ICS & SCADA Cyber Security Research (ICS-CSR) Belfast, UK 23–25 August 2016 10.14236/ewic/ICS2016.7
18. Priyadarshini I. Kumar R. Sharma R. Singh P.K. Satapathy S.C. Identifying cyber insecurities in trustworthy space and energy sector for smart grids Comput. Electr. Eng. 2021 93 107204 10.1016/j.compeleceng.2021.107204
19. Sharabov M. Tsochev G. Gancheva V. Tasheva A. Filtering and Detection of Real-Time Spam Mail Based on a Bayesian Approach in University Networks Electronics 2024 13 374 10.3390/electronics13020374
20. Symantec Dragonfly: Cyberespionage Attacks Against Energy Suppliers, Security Response 2014 Available online: https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers (accessed on 10 April 2025)
21. Carter C. Onunkwo I. Cordeiro P. Johnson J. Cyber Security Assessment of Distributed Energy Resources Proceedings of the IEEE 44th Photovoltaic Specialist Conference (PVSC) Washington, DC, USA 25–30 June 2017 2135 2140 10.1109/PVSC.2017.8366503
22. Teymouri A. Mehrizi-Sani A. Liu C.-C. Cyber Security Risk Assessment of Solar PV Units with Reactive Power Capability Proceedings of the IECON 2018—44th Annual Conference of the IEEE Industrial Electronics Society Washington, DC, USA 21–23 October 2018 2872 2877 10.1109/IECON.2018.8591583
23. Tuyen N.D. Quan N.S. Linh V.B. Tuyen V.V. Fujita G. A Comprehensive Review of Cybersecurity in Inverter-Based Smart Power System Amid the Boom of Renewable Energy IEEE Access 2022 10 35846 35875 10.1109/ACCESS.2022.3163551
24. Gao R. Yang G.-H. Sampled-data distributed state estimation with multiple transmission channels under denial-of-service attacks Appl. Math. Comput. 2022 429 127229 10.1016/j.amc.2022.127229
25. Kulbacki M. Chaczko Z. Barton S. Wajs-Chaczko P. Nikodem J. Rozenblit J.W. Klempous R. Ito A. Kulbacki M. A Review of the Weaponization of IoT: Security Threats and Countermeasures Proceedings of the IEEE 18th International Symposium on Applied Computational Intelligence and Informatics (SACI) Timisoara, Romania 23–25 May 2024 000279 000284 10.1109/SACI60582.2024.10619778
26. Nenova M. Atanasov D. Kassev K. Nenov A. Intrusion Detection System Model Implementation against DDOS attacks Proceedings of the IEEE International Conference on Microwaves, Antennas, Communications and Electronic Systems (COMCAS) Tel-Aviv, Israel 4–6 November 2019 1 4 10.1109/COMCAS44984.2019.8958346
27. Hristov M. Nenova M. Iliev G. Avresky D. Integration of Splunk Enterprise SIEM for DDoS Attack Detection in IoT Proceedings of the IEEE 20th International Symposium on Network Computing and Applications (NCA) Boston, MA, USA 23–26 November 2021 1 5 10.1109/NCA53618.2021.9685977
28. Tatipatri N. Arun S.L. A Comprehensive Review on Cyber-Attacks in Power Systems: Impact Analysis, Detection, and Cyber Security IEEE Access 2024 12 18147 18167 10.1109/ACCESS.2024.3361039
29. Aoufi S. Derhab A. Guerroumi M. Survey of false data injection in smart power grid: Attacks, countermeasures and challenges J. Inf. Secur. Appl. 2020 54 102518 10.1016/j.jisa.2020.102518
30. Musleh A.S. Chen G. Dong Z.Y. Wang C. Chen S. Vulnerabilities, Threats, and Impacts of False Data Injection Attacks in Smart Grids: An Overview Proceedings of the International Conference on Smart Grids and Energy Systems (SGES) Perth, Australia 23–26 November 2020 77 82 10.1109/SGES51519.2020.00021
31. Mohammadpourfard M. Khalili A. Genc I. Konstantinou C. Cyber-Resilient Smart Cities: Detection of Malicious Attacks in Smart Grids Sustain. Cities Soc. 2021 75 103116 10.1016/j.scs.2021.103116
32. Huang Y. He H. Advance learning technique for the electricity market attack detection Comput. Electr. Eng. 2022 100 107865 10.1016/j.compeleceng.2022.107865
33. Patel H.R. Replay Attack Detection in Smart Grids Using Switching Multi-Sine Watermarking Master’s Thesis Concordia University Montreal, QC, Canada 2023
34. Khazaei J. Asrari A. Second-Order Cone Programming Relaxation of Stealthy Cyberattacks Resulting in Overvoltages in Cyber-Physical Power Systems IEEE Syst. J. 2022 16 4267 4278 10.1109/JSYST.2021.3108635
35. Peng S. Liu M. Zuo K. Tan W. Deng R. Stealthy Data Integrity Attacks Against Grid-tied Photovoltaic Systems Proceedings of the IEEE 6th International Conference on Industrial Cyber-Physical Systems (ICPS) Wuhan, China 8–11 May 2023 1 7 10.1109/ICPS58381.2023.10128033
36. Karnouskos S. Stuxnet worm impact on industrial cyber-physical system security Proceedings of the IECON 2011—37th Annual Conference of the IEEE Industrial Electronics Society Melbourne, VIC, Australia 7–10 November 2011 4490 4494 10.1109/IECON.2011.6120048
37. Kushner D. The real story of stuxnet IEEE Spectr. 2013 50 48 53 10.1109/MSPEC.2013.6471059
38. Matrosov A. Rodionov E. Harley D. Malcho J. Stuxnet Under the Microscope 2010 Available online: https://www.esetnod32.ru/company/viruslab/analytics/doc/Stuxnet_Under_the_Microscope.pdf (accessed on 15 April 2025)
39. Dragos Inc CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations 2017 Available online: https://www.dragos.com/wp-content/uploads/CrashOverride-01.pdf?utm_referrer (accessed on 10 April 2025)
40. Slowik J. Dragos Inc CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack 2019 Available online: https://www.dragos.com/wp-content/uploads/2021/03/CRASHOVERRIDE.pdf?hs (accessed on 10 April 2025)
41. Rector S. A Case Study of the CRASHOVERRIDE Malware, Its Effects and Possible Countermeasures Cybersecurity Undergraduate Research Showcase. 5. Old Dominion University Norfolk, VA, USA 2024 10.25776/rtqr-kd18
42. Khan S. Madnick S. Protecting Chiller Systems from Cyberattack Using a Systems Thinking Approach Network 2022 2 606 627 10.3390/network2040035
43. Elnour M. Meskin N. Khan K. Jain R. HVAC system attack detection dataset Data Brief 2021 37 107166 10.1016/j.dib.2021.107166
44. Chen D. Sun Q.Z. Qiao Y. Defending against cyber-attacks in building HVAC systems through energy performance evaluation using a physics-informed dynamic Bayesian network (PIDBN) Energy 2025 322 135369 10.1016/j.energy.2025.135369
45. Elnour M. Meskin N. Khan K. Jain R. Application of data-driven attack detection framework for secure operation in smart buildings Sustain. Cities Soc. 2021 69 102816 10.1016/j.scs.2021.102816
46. Li G. Ren L. Fu Y. Yang Z. Adetola V. Wen J. Zhu Q. Wu T. Candan K.S. O’Neill Z. A critical review of cyber-physical security for building automation systems Annu. Rev. Control 2023 55 237 254 10.1016/j.arcontrol.2023.02.004
47. Ding S. Gu W. Lu S. Yu R. Sheng L. Cyber-attack against heating system in integrated energy systems: Model and propagation mechanism Appl. Energy 2022 311 118650 10.1016/j.apenergy.2022.118650
48. Morales-Gonzalez C. Harper M. Cash M. Luo L. Ling Z. Sun Q.Z. Fu X. On building automation system security High-Confid. Comput. 2024 4 100236 10.1016/j.hcc.2024.100236
49. Li G. Ren L. Pradhan O. O’Neill Z. Wen J. Yang Z. Fu Y. Chu M. Huang J. Wu T. et al. Emulation and detection of physical faults and cyber-attacks on building energy systems through real-time hardware-in-the-loop experiments Energy Build. 2024 320 114596 10.1016/j.enbuild.2024.114596
50. Moudgil V. Hewage K. Hussain S.A. Sadiq R. Integration of IoT in building energy infrastructure: A critical review on challenges and solutions Renew. Sustain. Energy Rev. 2023 174 113121 10.1016/j.rser.2022.113121
51. Fan C. Lei Y. Sun Y. Mo L. Novel transformer-based self-supervised learning methods for improved HVAC fault diagnosis performance with limited labeled data Energy 2023 278 Pt B 127972 10.1016/j.energy.2023.127972
52. Karbasi A. Farhadi A. A cyber-physical system for building automation and control based on a distributed MPC with an efficient method for communication Eur. J. Control 2021 61 151 170 10.1016/j.ejcon.2021.04.008
53. Moosavi S.A. Asgari M. Kamel S.R. Developing a comprehensive BACnet attack dataset: A step towards improved cybersecurity in building automation systems Data Brief 2024 57 111192 10.1016/j.dib.2024.111192 39736899
54. Galler M. Basic Recommendations For HVAC Cybersecurity ASHRAE J. 2021 63 1 2 Available online: https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=932229 (accessed on 25 April 2025)
55. Association of European Refrigeration Component Manufacturers (ASERCOM) ASERCOM Cyber-Security Guideline for Connected HVAC/R Equipment 2018 Available online: https://asercom.org/wp-content/uploads/2021/01/English_CyberSecurity-Guideline.pdf (accessed on 20 March 2025)
56. Vijayshankar S. Chang C.-Y. Utkarsh K. Wald D. Ding F. Balamurugan S.P. King J. Macwan R. Assessing the impact of cybersecurity attacks on energy systems Appl. Energy 2023 345 121297 10.1016/j.apenergy.2023.121297
57. IEC 61850-7-420:2021 Communication Networks and Systems for Power Utility Automation—Part 7-420: Basic Communication Structure—Distributed Energy Resources and Distribution Automation Logical Nodes International Electrotechnical Commission Geneva, Switzerland 2021
58. European Commission Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on Horizontal Cybersecurity Requirements for Products with Digital Elements and Amending Regulations (EU) No 168/2013 and (EU) 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act) (Text with EEA Relevance), OJ L, 2024/2847, 20.11.2024, Document 32024R2847 Available online: https://eur-lex.europa.eu/eli/reg/2024/2847/oj/eng (accessed on 28 May 2025)
59. European Commission Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on Measures for a High Common Level of Cybersecurity Across the Union, Amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and Repealing Directive (EU) 2016/1148 (NIS 2 Directive) (Text with EEA Relevance), OJ L 333, 27.12.2022, Document 32022L2555 Available online: https://eur-lex.europa.eu/eli/dir/2022/2555/oj/eng (accessed on 28 May 2025)
60. International Electrotechnical Commission International Society of Automation, ISA/IEC 62443 Series of Standards Available online: https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards (accessed on 28 May 2025)
61. European Union Agency for Cybersecurity, ENISA Guideline on Security Measures Under the EECC, Fourth edition, July 2021 Available online: https://www.enisa.europa.eu/publications/guideline-on-security-measures-under-the-eecc (accessed on 28 May 2025)
62. IEEE Std 1547.3-2023 (Revision of IEEE Std 1547.3-2007) IEEE Guide for Cybersecurity of Distributed Energy Resources Interconnected with Electric Power Systems IEEE New York, NY, USA 2023 1 183 10.1109/IEEESTD.2023.10352402
63. Sarker P.P. Das U. Varshney N. Shi S. Kulkarni A. Farahmandi F. Tehranipoor M. When Everyday Devices Become Weapons: A Closer Look at the Pager and Walkie-talkie Attacks arXiv 2025 10.48550/arXiv.2501.17405
64. Rogers M. Ruppersberger C.A.D. Investigative Report on the U.S. National Security Issues Posed by Chinese Telecommunications Companies Huawei and ZTE U.S. House of Representatives Permanent Select Committee on Intelligence Washington, DC, USA 2012
65. Euronews Eleven EU Countries Took 5G Security Measures to ban Huawei, ZTE Available online: https://www.euronews.com/next/2024/08/12/eleven-eu-countries-took-5g-security-measures-to-ban-huawei-zte (accessed on 30 May 2025)
66. PV-Magazine Una Empresa Danesa Descubre «Componentes Sospechosos» en Tecnología Energética Importada (Danish Company Discovers ‘Suspicious Components’ in Imported Energy Technology) Available online: https://www.pv-magazine.es/2025/05/27/una-empresa-danesa-descubre-componentes-sospechosos-en-tecnologia-fotovoltaica-importada/ (accessed on 29 May 2025)
67. European Commission Commission Delegated Regulation (EU) 2024/1366 of 11 March 2024 Supplementing Regulation (EU) 2019/943 of the European Parliament and of the Council by Establishing a Network Code on Sector-Specific Rules for Cybersecurity Aspects of Cross-Border Electricity Flows, OJ L, 2024/1366, 24.5.2024, Document 32024R1366 Available online: https://eur-lex.europa.eu/eli/reg_del/2024/1366/oj/eng (accessed on 28 May 2025)
68. SolarPower Europe Solutions for PV Cyber Risks to Grid Stability 2025 Available online: https://api.solarpowereurope.org/uploads/SPE_2025_Solutions_for_PV_Cyber_Risks_to_Grid_Stability_032dc2ae5a.pdf (accessed on 28 May 2025)
69. Market Data Forecast Global Solar Hybrid Inverter Market Research Report—Segmentation By Product (Single-Phase Hybrid Solar Inverter and Three-Phase Hybrid Solar Inverter), by End User (Commercial, Residential, and Others), and Region—Industry Forecast 2024 to 2032 Available online: https://www.marketdataforecast.com/market-reports/solar-hybrid-inverter-market (accessed on 31 May 2025)
70. Independent Bulgarian Energy Exchange (IBEX) Available online: https://ibex.bg (accessed on 4 April 2025)
71. Electricity System Operator (ESO) Available online: https://eso.bg (accessed on 4 April 2025)
72. Photovoltaic Geographical Information System (PVGIS) Available online: https://joint-research-centre.ec.europa.eu/photovoltaic-geographical-information-system-pvgis_en (accessed on 4 April 2025)
73. International Renewable Energy Agency (IRENA) Electricity Storage Valuation Framework: Assessing System Value and Ensuring Project Viability International Renewable Energy Agency Abu Dhabi, United Arab Emirates 2020 978-92-9260-161-4
74. Schmalensee R. Competitive Energy Storage and the Duck Curve MIT CEEPR Working Paper Series, CEEPR WP 2020-012 MIT Center for Energy and Environmental Policy Research Cambridge, MA, USA 2020 Available online: https://ceepr.mit.edu (accessed on 28 May 2025)
75. eRisk Group The Californian Duck is Coming to Europe, with a Smile eRisk Group Baarn, The Netherlands 2014 Available online: https://eriskgroup.com/ (accessed on 28 May 2025)
76. Hartner M. Permoser A. Through the valley: The impact of PV penetration levels on price volatility and resulting revenues for storage plants Renew. Energy 2018 115 1184 1195 10.1016/j.renene.2017.09.036
77. Pavlík M. Ever More, Frequent Negative, Electricity Prices: A New Reality and Challenges for Photovoltaics and Wind Power in a Changing Energy Market—Threat or Opportunity, and Where Are the Limits of Sustainability? Energies 2025 18 2498 10.3390/en18102498
78. Understanding Ultralow and Negative Power Prices: Causes, Impacts and Improvements, Eurelectric Position Paper 2024 Available online: https://www.eurelectric.org/ (accessed on 30 May 2025)
79. ENTSO-E ENTSO-E Expert Panel Initiates the Investigation into the Causes of Iberian Blackout Available online: https://www.entsoe.eu/news/2025/05/09/entso-e-expert-panel-initiates-the-investigation-into-the-causes-of-iberian-blackout/ (accessed on 30 May 2025)
80. ENTSO-E Incident in the Power System of North Macedonia on May 18th Available online: https://www.entsoe.eu/news/2025/05/30/incident-in-the-power-system-of-north-macedonia-on-may-18th/ (accessed on 30 May 2025)
81. PV-Magazine El Tema de la Ciberseguridad es un Problema Real, Pero la Información de Reuters hay que Cogerla con Pinzas. (Cybersecurity Is a Real Problem, but Reuters’ Reporting Should Be Taken with a Grain of Salt.) Available online: https://www.pv-magazine.es/2025/05/15/el-tema-de-la-ciberseguridad-es-un-problema-real-pero-la-informacion-de-reuters-hay-que-cogerla-con-pinzas/ (accessed on 29 May 2025)

Issue