{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T03:50:56Z","timestamp":1791258656811,"version":"4.1.0"},"reference-count":56,"publisher":"Wiley","issue":"9","license":[{"start":{"date-parts":[[2026,8,29]],"date-time":"2026-08-29T00:00:00Z","timestamp":1787961600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"},{"start":{"date-parts":[[2026,8,29]],"date-time":"2026-08-29T00:00:00Z","timestamp":1787961600000},"content-version":"tdm","delay-in-days":0,"URL":"http:\/\/doi.wiley.com\/10.1002\/tdm_license_1.1"}],"content-domain":{"domain":["onlinelibrary.wiley.com"],"crossmark-restriction":true},"short-container-title":["Risk Analysis"],"published-print":{"date-parts":[[2026,9]]},"abstract":"<jats:title>ABSTRACT<\/jats:title>\n                  <jats:p>\n                    Malicious and negligent insiders pose significant security risks to mission\u2010critical systems like electric power grids due to their high privileges in increasingly digitized infrastructures. This paper investigates the vulnerability of smart power grids to\n                    <jats:italic>load redistribution<\/jats:italic>\n                    (LR) attacks in the presence of insider threats. We introduce a stochastic optimization model to minimize the expected risk of high operation costs due to LR attacks by protecting critical grid components and deploying detection technologies, such as honeypots, to detect insider threats and prevent information leakage. Our model accounts for uncertainties in insider presence, honeypot effectiveness, and attack targets, and uses the\n                    <jats:italic>conditional value\u2010at\u2010risk<\/jats:italic>\n                    (CVaR) measure, which can be adjusted based on the decision\u2010maker's conservatism. In addition, it accounts for real\u2010time power demand variations and dynamic false\u2010data injection by attackers. To enhance tractability, we transform our model, originally formulated as a\n                    <jats:italic>trilevel mixed\u2010integer nonlinear programming<\/jats:italic>\n                    (Tri\u2010MINLP) problem, into an approximate single\u2010level\n                    <jats:italic>mixed\u2010integer linear programming<\/jats:italic>\n                    (MILP) formulation. We apply our proposed model to the IEEE 14\u2010bus test system, and our results highlight the effectiveness of our approach in lowering the risk of high operation costs due to LR attacks. In addition, we present several insights by assessing the impact of key factors on the expected financial risk of attacks, including the protection budget, insider\u2010threat likelihood, honeypot\u2010detection effectiveness, and the defender's decision\u2010making\u00a0conservatism.\n                  <\/jats:p>","DOI":"10.1111\/risa.70336","type":"journal-article","created":{"date-parts":[[2026,8,29]],"date-time":"2026-08-29T11:58:10Z","timestamp":1788004690000},"update-policy":"https:\/\/doi.org\/10.1002\/crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Minimizing Risk of Load Redistribution Attacks on Electric Grids in the Presence of Insider Threats"],"prefix":"10.1111","volume":"46","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-7653-5413","authenticated-orcid":false,"given":"Lujia","family":"Zhan","sequence":"first","affiliation":[{"name":"Department of Electrical and Computer Engineering, School of Engineering and Applied Science The George Washington University  Washington District of Columbia USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0389-9993","authenticated-orcid":false,"given":"Saharnaz","family":"Mehrani","sequence":"additional","affiliation":[{"name":"Department of Information Technology and Operations Management, College of Business Florida Atlantic University  Boca Raton Florida USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2686-5980","authenticated-orcid":false,"given":"Chengzhi","family":"Xie","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, School of Engineering and Applied Science The George Washington University  Washington District of Columbia USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-2237-4284","authenticated-orcid":false,"given":"Payman","family":"Dehghanian","sequence":"additional","affiliation":[{"name":"Department of Electrical and Computer Engineering, School of Engineering and Applied Science The George Washington University  Washington District of Columbia USA"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"311","published-online":{"date-parts":[[2026,8,29]]},"reference":[{"key":"e_1_2_9_2_1","doi-asserted-by":"crossref","unstructured":"Alahmari A. andB.Duncan.2020. \u201cCybersecurity Risk Management in Small and Medium\u2010Sized Enterprises: A Systematic Review of Recent Evidence.\u201d InInternational Conference on Cyber Situational Awareness Data Analytics and Assessment (CyberSA) 1\u20135.","DOI":"10.1109\/CyberSA49311.2020.9139638"},{"key":"e_1_2_9_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cor.2013.06.009"},{"key":"e_1_2_9_4_1","unstructured":"Anderson D. D. M.Cappelli J. J.Gonzalez et\u00a0al.2004. \u201cPreliminary System Dynamics Maps of the Insider Cyber\u2010Threat Problem.\u201d InProceedings of the International Conference of the System Dynamics Society 25\u201329."},{"key":"e_1_2_9_5_1","doi-asserted-by":"publisher","DOI":"10.1109\/TCSS.2014.2377811"},{"key":"e_1_2_9_6_1","doi-asserted-by":"publisher","DOI":"10.1111\/risa.13511"},{"key":"e_1_2_9_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/JIOT.2015.2459049"},{"key":"e_1_2_9_8_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-0-387-77322-3_1"},{"key":"e_1_2_9_9_1","doi-asserted-by":"crossref","unstructured":"Belqruch A. andA.Maach.2019. \u201cSCADA Security Using SSH Honeypot.\u201d InProceedings of the 2nd International Conference on Networking Information Systems & Security 1\u20135.","DOI":"10.1145\/3320326.3320328"},{"key":"e_1_2_9_10_1","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2014.40"},{"key":"e_1_2_9_11_1","unstructured":"Collins M. M.Theis R.Trzeciak et\u00a0al.2016.Common Sense Guide to Mitigating Insider Threats. Tech. Rep. CMU\/SEI\u20102016\u2010TR\u2010015.Software Engineering Institute Carnegie Mellon University Pittsburgh PA."},{"key":"e_1_2_9_12_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJCIS.2008.016096"},{"key":"e_1_2_9_13_1","unstructured":"Eldridge B. R. P.O'Neill andA.Castillo.2017.Marginal Loss Calculations for the DCOPF. Technical Report FERC Staff Paper Issuance Date: January 30 2017 Federal Energy Regulatory Commission Washington DC USA."},{"key":"e_1_2_9_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2019.2926441"},{"key":"e_1_2_9_15_1","doi-asserted-by":"publisher","DOI":"10.1049\/gtd2.12758"},{"key":"e_1_2_9_16_1","doi-asserted-by":"publisher","DOI":"10.1111\/j.1539-6924.2006.00791.x"},{"key":"e_1_2_9_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/3303771"},{"key":"e_1_2_9_18_1","doi-asserted-by":"crossref","unstructured":"Huang W. T.Yang Z.Dai Y.Tang X.Li andG.Liu.2023. \u201cSecurity Constrained Economic Dispatch Based on Shift Factor Adaptive Calculation.\u201d In2023 IEEE International Conference on Advanced Power System Automation and Protection (APAP) 178\u2013182.IEEE.","DOI":"10.1109\/APAP59666.2023.10348413"},{"key":"e_1_2_9_19_1","first-page":"4","article-title":"Insiders and Insider Threats\u2014An Overview of Definitions and Mitigation Techniques","volume":"2","author":"Hunker J.","year":"2011","journal-title":"Journal of Wireless Mobile Networks, Ubiquitous Computing, and Dependable Applications"},{"key":"e_1_2_9_20_1","unstructured":"Lee R. M. M. J.Assante andT.Conway.2016.Analysis of the Cyber Attack on the Ukrainian Power Grid: Defense Use Case. Tech. rep. Electricity Information Sharing and Analysis Center (E\u2010ISAC) and SANS Institute.https:\/\/nsarchive.gwu.edu\/sites\/default\/files\/documents\/3891751\/SANS\u2010and\u2010Electricity\u2010Information\u2010Sharing\u2010and.pdf."},{"key":"e_1_2_9_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2016.2631891"},{"key":"e_1_2_9_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1952982.1952995"},{"key":"e_1_2_9_23_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2020.3023426"},{"key":"e_1_2_9_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2022.3222309"},{"key":"e_1_2_9_25_1","unstructured":"Mandiant.2023.COSMICENERGY: New OT Malware Possibly Related to Russian Emergency Response Exercises. Google Cloud Blog.https:\/\/cloud.google.com\/blog\/topics\/threat\u2010intelligence\/cosmicenergy\u2010ot\u2010malware\u2010russian\u2010response\/."},{"key":"e_1_2_9_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/BF01580665"},{"key":"e_1_2_9_27_1","doi-asserted-by":"publisher","DOI":"10.1504\/IJCIS.2004.003795"},{"key":"e_1_2_9_28_1","doi-asserted-by":"crossref","unstructured":"Niu X. J.Li J.Sun andK.Tomsovic.2019. \u201cDynamic Detection of False Data Injection Attack in Smart Grid Using Deep Learning.\u201d InIEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT) 1\u20136.IEEE.","DOI":"10.1109\/ISGT.2019.8791598"},{"key":"e_1_2_9_29_1","doi-asserted-by":"publisher","DOI":"10.1287\/opre.2013.1186"},{"key":"e_1_2_9_30_1","doi-asserted-by":"crossref","unstructured":"Nurse J. R. O.Buckley P. A.Legg et\u00a0al.2014. \u201cUnderstanding Insider Threat: A Framework for Characterising Attacks.\u201d In2014 IEEE Security and Privacy Workshops 214\u2013228.IEEE.","DOI":"10.1109\/SPW.2014.38"},{"key":"e_1_2_9_31_1","doi-asserted-by":"publisher","DOI":"10.1111\/risa.12781"},{"key":"e_1_2_9_32_1","doi-asserted-by":"publisher","DOI":"10.21314\/JOR.2000.038"},{"key":"e_1_2_9_33_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0378-4266(02)00271-6"},{"key":"e_1_2_9_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2004.825888"},{"key":"e_1_2_9_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2008.2004825"},{"key":"e_1_2_9_36_1","doi-asserted-by":"crossref","unstructured":"Santos E. Jr. H.Nguyen F.Yu et\u00a0al.2008. \u201cIntent\u2010Driven Insider Threat Detection in Intelligence Analyses.\u201d In2008 IEEE\/WIC\/ACM International Conference on Web Intelligence and Intelligent Agent Technology vol. 2 345\u2013349.IEEE.","DOI":"10.1109\/WIIAT.2008.376"},{"key":"e_1_2_9_37_1","doi-asserted-by":"crossref","unstructured":"Sanzgiri A. andD.Dasgupta.2016. \u201cClassification of Insider Threat Detection Techniques.\u201d InProceedings of the 11th Annual Cyber and Information Security Research Conference 1\u20134.","DOI":"10.1145\/2897795.2897799"},{"key":"e_1_2_9_38_1","doi-asserted-by":"publisher","DOI":"10.3390\/en81011883"},{"key":"e_1_2_9_39_1","unstructured":"Shehod A.2016. \u201cUkraine Power Grid Cyberattack and US Susceptibility: Cybersecurity Implications of Smart Grid Advancements in the US.\u201dTech. rep. Massachusetts Institute of Technology.https:\/\/cams.mit.edu\/wp\u2010content\/uploads\/2016\u201022.pdf."},{"key":"e_1_2_9_40_1","doi-asserted-by":"crossref","unstructured":"Spitzner L.2003. \u201cHoneypots: Catching the Insider Threat.\u201d InProceedings of the 19th Annual Computer Security Applications Conference 170\u2013179.","DOI":"10.1109\/CSAC.2003.1254322"},{"key":"e_1_2_9_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/JPROC.2011.2165269"},{"key":"e_1_2_9_42_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2023.3289788"},{"key":"e_1_2_9_43_1","unstructured":"Van den Bergh K. E.Delarue andW.D'haeseleer.2014. \u201cDC Power Flow in Unit Commitment Models.\u201dTech. Rep. EN2014\u201012 KU Leuven Energy and Environment TME Working Paper.https:\/\/www.mech.kuleuven.be\/en\/tme\/research\/energyenvironment\/pdf\/wpen2014\u201312.pdf."},{"key":"e_1_2_9_44_1","doi-asserted-by":"publisher","DOI":"10.1109\/TII.2024.3393005"},{"key":"e_1_2_9_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRS.2016.2628887"},{"key":"e_1_2_9_46_1","first-page":"889","article-title":"Power System Reliability Evaluation Considering Load Redistribution Attacks","volume":"8","author":"Xiang Y.","year":"2016","journal-title":"IEEE Transactions on Smart Grid"},{"key":"e_1_2_9_47_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.epsr.2017.05.020"},{"key":"e_1_2_9_48_1","doi-asserted-by":"crossref","unstructured":"Xiang Y. X.Zhang D.Shi Y.Jin Z.Wang andL.Wang.2018. \u201cA Robust Power Grid Defense Model Considering Load Demand and Wind Generation Uncertainties.\u201d InIEEE Power & Energy Society General Meeting (PESGM) 1\u20135.IEEE.","DOI":"10.1109\/PESGM.2018.8585823"},{"key":"e_1_2_9_49_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-12385-7_56"},{"key":"e_1_2_9_50_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPWRD.2014.2300099"},{"key":"e_1_2_9_51_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSMCC.2007.897487"},{"key":"e_1_2_9_52_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ress.2013.08.003"},{"key":"e_1_2_9_53_1","doi-asserted-by":"publisher","DOI":"10.1109\/TSG.2011.2123925"},{"key":"e_1_2_9_54_1","doi-asserted-by":"publisher","DOI":"10.3390\/asi8040115"},{"key":"e_1_2_9_55_1","doi-asserted-by":"publisher","DOI":"10.1111\/risa.13269"},{"key":"e_1_2_9_56_1","doi-asserted-by":"publisher","DOI":"10.1287\/opre.1080.0684"},{"key":"e_1_2_9_57_1","unstructured":"Zimmerman R. C.Murillo\u2010Sanchez andD.Gan.2015. \u201cMatpower: A Matlab Power System Simulation Package [Online].\u201dMarch."}],"container-title":["Risk Analysis"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/risa.70336","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1111\/risa.70336","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1111\/risa.70336","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,10,6]],"date-time":"2026-10-06T03:03:41Z","timestamp":1791255821000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1111\/risa.70336"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,8,29]]},"references-count":56,"journal-issue":{"issue":"9","published-print":{"date-parts":[[2026,9]]}},"alternative-id":["10.1111\/risa.70336"],"URL":"https:\/\/doi.org\/10.1111\/risa.70336","archive":["Portico"],"relation":{},"ISSN":["0272-4332","1539-6924"],"issn-type":[{"value":"0272-4332","type":"print"},{"value":"1539-6924","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,8,29]]},"assertion":[{"value":"2025-12-09","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-07-22","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-08-29","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}],"article-number":"e70336"}}