Economic Impact Assessment of Denial-of-Service and Time-Delay Attacks on Advanced Metering Infrastructure

This paper evaluates the impact of denial-of-service (DoS) and time-delay attacks (TDAs) on Advanced Metering Infrastructure (AMI) communication networks, focusing on both communication performance degradation and the associated economic consequences. The study uses a Mininet-based simulation environment implementing a communication model inspired by the Distributed Network Protocol 3 (DNP3) over UDP, with a topology comprising eight smart meters, two data concentrators, two base stations, and one utility server, organized into two sites with redundant communication paths.

Five attack/degradation scenarios were implemented using Linux Traffic Control (tc netem): (1) a 500 ms time-delay attack, (2) 20% packet loss, (3) 50% packet loss, (4) combined 500 ms delay with 20% packet loss, and (5) data concentrator failure. Performance metrics collected included round-trip time (RTT), timeout count, successful measurement count, duplicate count, and measurement availability, with the communication degradation rate defined as Drate = Ntimeout/Nrequests.

The experimental results show that under normal conditions, the average RTT was approximately 0.22 ms with only one timeout event. The 500 ms delay attack increased the average RTT to approximately 69.5 ms but resulted in only one timeout event, indicating that delay-based attacks primarily affect latency without immediately compromising data availability. Packet loss attacks significantly impacted reliability: 20% packet loss produced 28 timeout events with an average RTT of approximately 47 ms, while 50% packet loss resulted in 87 timeout events. The combined degradation scenario (500 ms delay plus 20% packet loss) produced the worst communication impairment, with 104 timeout events and an average RTT of approximately 51.4 ms. The median RTT remained around 0.18 ms in all scenarios, indicating that degradation was concentrated on affected links rather than spread across the entire network.

The data concentrator failure scenario demonstrated the value of the redundant architecture: with both concentrators operational, only 1 timeout was registered out of 445 requests (0.22% timeout rate), while with one concentrator unavailable, timeouts increased to 104 out of 2,311 requests (4.50%), with 102 of those occurring on the affected concentrator. Despite this twenty-fold increase, overall measurement availability remained high.

For the economic impact analysis, the measured degradation rate from the 50% packet loss scenario (Drate = 5.31%, corresponding to 87 timeouts over 1,638 polling transactions) was extrapolated to a regional-scale deployment of 10,000 smart meters. The economic model used the formula Impact = N × E × Drate × P, where N is the number of affected meters (10,000), E is the average daily energy consumption per meter (0.0320 MWh/day, derived from a 90% residential / 10% commercial customer mix based on EIA Form 861 data), Drate is the communication degradation rate (5.31%), and P is the ISO-NE real-time electricity price.

Using a reference price of 59.38/MWh (based on ISO-NE Day-Ahead Energy Market data for PNode LD.ALLINGS 13.8), the estimated economic impact was approximately 1,009 per day. Under a worst-case price of 300/MWh (based on the December 2017–January 2018 cold-weather event when real-time Hub LMPs exceeded 300/MWh), the estimated impact increased to approximately 5,097 per day, nearly five times the reference value. When extrapolated to approximately 1.5 million meters (a scaling factor of 150), the estimated economic exposure increased to approximately 151,300 per day at 59.38/MWh and 764,600 per day at 300/MWh.

The paper concludes that communication delays increase latency, packet loss significantly increases timeout rates and reduces measurement availability, and the combined scenario produces the highest degradation. The dual redundancy architecture was shown to maintain data availability under concentrator failure. The authors note that the reported economic values should be interpreted as conservative order-of-magnitude estimates, since utilities can mitigate part of the effect of missing data through interpolation, historical load profiles, or other data estimation methods, and the results illustrate the potential worst-case impact of cyberattacks targeting AMI communication infrastructure.

Improvements to AI Systems Based on This Paper:

1. AI-Driven Anomaly Detection for AMI Latency Attacks

• Train a supervised or unsupervised model (e.g., LSTM autoencoder) on RTT distributions, timeout counts, and duplicate ratios to distinguish normal (mean RTT 0.22 ms, 1 timeout) from delay-based attacks (mean RTT 69.5 ms, few timeouts) and packet-loss attacks (high timeout counts, degraded availability).

• The improved AI system can real-time classify attack type (delay vs. loss vs. combined) and estimate severity (e.g., 20% vs. 50% loss) from streaming telemetry, enabling early mitigation.

2. Predictive Impact Assessment for Redundant Topologies

• Use the measured timeout rates (0.22% with dual concentrators vs. 4.50% with single) to train a regression model that predicts availability loss as a function of active nodes, link quality, and traffic load.

• The improved AI system can recommend optimal failover strategies (e.g., pre-emptively rerouting traffic when a concentrator degrades) and forecast the marginal benefit of adding redundancy for a given network size.

3. Economic Risk Forecasting Under Dynamic Pricing

• Integrate the economic model (Impact = N × E × Drate × P) with real-time price feeds (e.g., ISO-NE LMP) and weather/load forecasts. Train a reinforcement learning agent to optimize polling schedules (e.g., reduce request frequency during high-price windows) or prioritize data retransmission for critical meters.

• The improved AI system can dynamically adjust communication policies to minimize financial exposure (e.g., from 1,009/day to lower) while maintaining acceptable measurement availability.

4. Adaptive Resilience Against Combined Attacks

• Use the combined scenario (104 timeouts, RTT 51.4 ms) as a training case for a decision-tree or random-forest classifier that maps network metrics (RTT, timeout rate, duplicate count) to a degradation severity score.

• The improved AI system can trigger automated countermeasures (e.g., switch to backup paths, reduce polling rate, or activate local data caching) when the score exceeds a threshold, and quantify the trade-off between data freshness and communication cost.

5. Scalable Extrapolation for Large-Scale Deployments

• Build a simulation-to-reality transfer model using the paper’s scaling factor (150× for 1.5M meters) to estimate aggregate economic risk for utility-scale networks.

• The improved AI system can run what-if analyses (e.g., varying Drate, price spikes, or meter density) to support investment decisions in cybersecurity and redundancy, and generate risk heatmaps for different geographic or customer segments.

Advanced Metering Infrastructure (AMI) plays an important role in modern power systems by providing near real-time consumption data for operational planning and load estimation. Despite this, AMI communication networks are vulnerable to certain cyberattack types, such as denial-of-service (DoS) and time delay attacks (TDAs), which may compromise data availability. This paper evaluates the impact of these attack types on AMI communication using a Mininet-based simulation environment that implements a communication model inspired by the Distributed Network Protocol 3 (DNP3) for communication among smart meters, data concentrators, and utility systems. Different cyberattack scenarios are analyzed, including communication delay, packet loss, combined degradation rate (D rate), and concentrator failure, to evaluate their effects on network performance and data availability. The results indicate increased latency, higher communication unavailability rates, and reduced data reliability under attack conditions. In addition, the study correlates how communication degradation can result in potential uncertainties in energy demand estimation and provides estimates of the associated financial impacts on energy procurement, using electricity pricing data from the Independent System Operator-New England (ISO-NE). The experimental results reveal that a 500 ms delay increased the average RTT (Round-trip time) from 0.22 ms to 69.5 ms, while a 50% packet loss scenario resulted in 87 timeout events and a 5.31% communication degradation rate. Under a regional-scale deployment of 10,000 smart meters, this degradation could cause an estimated economic impact of 1,009/day under normal market conditions and up to 5,097/day during high-price events.