How 70-Year-Old Math Is Protecting Tomorrow's Power Grids

The Numbers Behind a Secure Power Grid

Imagine you're in charge of cybersecurity for a power grid spanning a million households. You know adversaries might try to inject false data into the system—manipulating the information flows that keep the grid stable—but you can only afford to monitor a handful of nodes. Which nodes should you watch? Where will an attacker get the most bang for their buck? These questions sound straightforward, but they hide a mathematical thicket that has stymied researchers for years.

Now consider a new result: a team from Uppsala University, the University of Pennsylvania, and KTH Royal Institute of Technology has found a way to simplify this security puzzle from an astronomically complex optimization problem into something that depends only on a network's structure—not its size. For a million-node grid and a ten-node grid, the math becomes effectively identical. "This is a game-changer for large-scale systems," the researchers write. Their secret weapon? A measure of node importance called Katz centrality, borrowed from a 1953 paper and repurposed for the cybersecurity arms race.

The finding has immediate implications for protecting the infrastructure that keeps modern civilization running: power grids, water distribution networks, transportation systems, and the industrial control systems thatmanufacture everything from pharmaceuticals to semiconductors.

The Stakes Have Never Been Higher

The motivation for this work isn't academic curiosity. It's a pattern of increasingly sophisticated attacks on critical infrastructure that has alarmed governments and researchers alike.

In 2010, the Stuxnet malware silently destroyed uranium centrifuges in Iran by manipulating the control systems that managed them—making the machines spin themselves apart while the on-site monitors reported everything was fine. In 2014, the Havex Trojan slipped into European utility networks through updates to industrial software, surveilling energy companies for months. In 2016, the Industroyer attack cut power to 230,000 people in Ukraine for six hours by exploiting the same communication protocols that keep modern grids synchronized. And in 2020, Israeli authorities caught a Triton-like attack on a water distribution network—malware designed to alter the chemical composition of drinking water before it was stopped.

These attacks share a crucial feature: they were stealthy. They stayed below the detection threshold, allowing adversaries to maintain access for extended periods or execute their payloads without triggering defensive responses. The new paper tackles this exact problem—how do you defend against an attacker who knows exactly how much mischief they can cause before being detected?

The researchers call this the "stealthy false data injection attack" problem. An adversary gains access to certain nodes in a networked control system and injects false data into the information flows between nodes—enough to cause real damage, but carefully calibrated to avoid tripping alarms at monitored locations. Meanwhile, a defender can choose where to place their limited monitoring resources, hoping to catch attacks before they cause too much harm. It's a high-stakes game of cat and mouse, played out in the mathematics of interconnected systems.

The Mathematics of Interconnected Systems

To understand the problem, we need to build a model—mathematically, at least—of how these networks behave.

The researchers consider what they call a "positive networked control system." Each node in the network represents a one-dimensional subsystem—like a single power plant, water pump, or intersection in a traffic network. These nodes have states, denoted as continuous variables that must remain non-negative (which makes sense: you can't have negative water pressure or negative voltage). The nodes are connected by directed edges representing information flows, and each node is influenced by the states of its neighbors through its governing equation.

In a normal, attack-free scenario, the system evolves according to a clean mathematical relationship where each node's rate of change depends on its own state and the states of its neighbors. This creates a coupled system of differential equations—a mathematical description of how information and influence propagate through the network.

The network's "performance" is defined as the total accumulated deviation from equilibrium across all nodes over a given time period. Think of this as measuring how much the system fluctuates away from its stable operating point. Without attacks, this baseline performance loss is something the system can tolerate. But the adversary's goal is to maximize this performance loss while staying undetected.

The attack works by injecting false data into the information broadcast from certain "attack nodes" to their neighbors. The attacked nodes receive corrupted information and adjust their behavior accordingly, causing ripple effects throughout the network. The adversary is constrained by two factors: an overall energy budget limiting how much false data they can inject, and—critically—the stealthiness requirement that the attack remain below detection thresholds at monitored nodes.

At the monitored nodes, the defender watches the output energy—the accumulated signal strength over time—and triggers an alarm if it exceeds a predefined threshold. The adversary must keep their attack's visible footprint below these thresholds at every monitored node simultaneously.

This creates an optimization problem: the adversary wants to maximize the network's performance loss subject to staying stealthy, while the defender wants to choose which nodes to monitor to minimize the maximum damage the adversary can inflict. It's a classic two-player game, but with continuous actions and constraints that make finding the equilibrium computationally brutal.

The Worst-Case Disruption and Its Bound

The researchers formalize the adversary's problem as finding the "worst-case disruption"—the maximum performance loss achievable by any stealthy attack, given a particular choice of monitor nodes and attack nodes. This worst-case disruption is a single number that captures how vulnerable a particular defensive configuration is: the higher the number, the more damage a sophisticated attacker could cause without being detected.

Computing this number exactly requires solving a non-convex optimization problem—one with mathematical properties that make finding the true optimum essentially intractable for large networks. But the researchers show that the worst-case disruption is upper-bounded by the solution to a semi-definite programming (SDP) problem.

Semi-definite programming is a class of optimization problems that, while still computationally demanding, are far more tractable than general non-convex problems. SDPs can be solved reliably using existing algorithms, and their complexity scales reasonably with problem size—though "reasonably" here still means that a network with a million nodes requires solving a matrix with a million rows and columns, which is no small feat.

The key insight comes from exploiting the "positivity" of the system—the fact that all states and signals must remain non-negative. This constraint, which reflects the physics of many real-world systems, turns out to impose enough structure to dramatically simplify the problem.

Under a sufficient condition related to the system's robustness, the researchers prove that this upper bound is actually tight: the worst-case disruption exactly equals the solution to the SDP problem. This means the bounding exercise isn't an approximation—it's an exact characterization of how bad things can get.

But the real payoff comes next.

From Million-Dollar Problems to Pocket Change Computations

The SDP problem, while more tractable than the original formulation, still scales with network size. For a network with N nodes, the SDP involves matrices of dimension N×N, and solving such problems requires computational resources that grow roughly with the cube of N. For a million-node network, this becomes genuinely difficult.

The researchers' second major contribution establishes that, under the same sufficient condition, the SDP problem can be simplified into a form that depends only on the network's structure—not its size. This simplification reveals a deep connection to a network measure called Katz centrality.

Katz centrality, introduced by Leo Katz in 1953, quantifies how important each node is based on both its direct connections and its connections through the rest of the network. A node that connects to many other nodes gets a higher score, but so does a node that connects to nodes that themselves connect to many others. The measure essentially counts how many walks of different lengths flow through each node, with longer walks weighted less heavily—a geometric decay that prevents influence from distant parts of the network from overwhelming local structure.

The researchers develop two adapted versions of Katz centrality for this security context. The "monitor Katz centrality" incorporates the alarm thresholds that define the defender's detection capabilities. The "performance Katz centrality" incorporates the weighting factors that determine how much each node contributes to the overall performance loss. Together, these measures create a structural fingerprint of the network's vulnerability.

The critical theorem: the worst-case disruption is finite (meaning the defender can limit the damage to a bounded amount) if and only if a certain geometric condition relating these two centrality measures holds. Specifically, the condition states that for every possible combination of attack nodes, the set of feasible attack signals determined by the performance weights must be contained within the set of stealthy attacks determined by the monitoring thresholds. In simpler terms: the defender's detection capabilities must be calibrated to catch attacks before they cause unacceptable damage.

This condition is both necessary and sufficient. If it fails, no amount of monitoring can prevent unbounded damage—the adversary can always find a stealthy attack that causes arbitrarily large performance loss. If it holds, then the defender's configuration provides meaningful protection.

A Shortcut for the Real World

Knowing whether protection is possible is valuable, but in practice, the defender needs to actually choose which nodes to monitor. The optimization problem (17) in the paper—finding the monitor set that minimizes the maximum disruption over all possible attack scenarios—is combinatorially hard: the defender must select β nodes from N possibilities, where β and N could each be in the thousands or millions.

The researchers address this with a heuristic search algorithm that leverages the structural insights from their analysis. The algorithm works by computing the two adapted Katz centrality measures for every node in the network and then selecting monitor nodes based on their centrality scores in a way that guarantees the geometric condition is satisfied. No optimization problem needs to be solved; the answer emerges directly from the network structure.

This heuristic sacrifices optimality for speed. It might not find the absolute best monitor configuration, but it consistently finds configurations that are near-optimal in practice—typically within a few percent of the theoretical best, while running in a fraction of the time. For large-scale systems where finding the true optimum is computationally infeasible anyway, this approximation is often more valuable than a perfect solution that can't be computed in useful time.

The algorithm also provides a natural way to understand why certain nodes are important for security: they have high monitor Katz centrality (they're well-positioned to catch attacks) or high performance Katz centrality (they strongly influence the overall system performance). This interpretability is crucial for security analysts who need to justify their defensive choices to stakeholders.

Validating the Theory at Scale

Theoretical results are only as good as their empirical support, and the researchers validate their findings through extensive simulations on Erdős-Rényi random graphs—mathematical networks where each possible edge exists independently with some fixed probability. These random graphs provide a controlled testbed for understanding how the theory behaves across different network sizes and densities.

One key validation examines whether the upper bound from the SDP formulation is tight. The researchers compute both the upper bound (from the semi-definite program) and a lower bound (from constructing specific attack scenarios) and compare them across networks of varying sizes. Across hundreds of random graphs with networks ranging from small (20 nodes) to moderately large (100 nodes), the two bounds coincide nearly exactly. The worst-case disruption is exactly what the SDP predicts—no more, no less.

Upper vs Lower Bound Discrepancy by Network Size

Label	Value
N=20	0.001
N=40	0.0008
N=60	0.0015
N=80	0.0021
N=100	0.0012

Data extracted from Figure 4 of the paper, showing relative difference |Γ(upper) - Γ(lower)| / Γ(lower) for Erdős-Rényi random graphs with connection probability 0.3.

Upper-to-Lower Bound Ratio by Network Size

Label	Value
N=20	1.002
N=40	1.001
N=60	1.003
N=80	1.002
N=100	1.001

Data from Figure 6, showing Γ_upper / Γ_lower across Erdős-Rényi random graphs with varying network sizes.

The charts above illustrate this finding. In the left panel, we see the relative difference between the upper and lower bounds for the worst-case disruption across different network sizes. For most networks, the difference is negligible—less than 0.1%. In the right panel, we see the ratio of upper to lower bounds, which clusters tightly around 1.0 across the range of network sizes tested. This confirms that the theoretical analysis accurately captures the practical vulnerability of these systems.

The second major validation examines the heuristic monitor selection algorithm. The researchers compare the monitor sets found by their Katz centrality-based heuristic against the theoretically optimal monitor sets obtained by solving the full mixed-integer SDP problem (which, while theoretically solvable, becomes computationally prohibitive for networks larger than a few dozen nodes). The comparison proceeds in two ways.

First, they look at the "performance ratio"—how much worse is the worst-case disruption under the heuristic monitor set compared to the optimal set? Across 100 random graphs, the heuristic performs remarkably well, typically achieving disruptions within about 1.05 times the optimal value. In other words, the heuristic gets within 5% of optimal security performance, even though it runs orders of magnitude faster.

Heuristic vs Optimal Monitor Performance

Label	Value
Graph 1	1.02
Graph 2	1.08
Graph 3	1.04
Graph 4	1.06
Graph 5	1.03
Graph 6	1.05
Graph 7	1.07
Graph 8	1.01

Data from Figure 7a, comparing heuristic monitor set performance to optimal mixed-integer SDP solution across Erdős-Rényi random graphs.

Second, they examine whether the heuristic uses more or fewer monitors than the budget allows. The results show that the heuristic typically selects only slightly more monitors than the minimum required—adding just 0.5 to 1.5 extra monitors beyond the prescribed budget across different network configurations. This small over-selection is a practical tradeoff: by ensuring the security condition is satisfied, the heuristic sometimes includes a few extra nodes that aren't strictly necessary for optimal protection.

Together, these validations demonstrate that the theory not only works in practice but works efficiently—bridging the gap between what can be proven mathematically and what can be computed in the real world.

Why This Changes Things

Before this work, security analysis for large-scale networked control systems faced a fundamental trade-off: either you could model the problem accurately but not solve it for networks with more than a few dozen nodes, or you could get a quick answer but lose confidence in its accuracy. The new results break this trade-off by revealing that the structure of the problem—encoded in Katz centrality—contains all the information needed for security assessment, independent of how large the network is.

This has several practical implications. First, it enables security audits of existing infrastructure. A utility company with a million-node grid could now compute the worst-case disruption and identify vulnerable configurations using the same computational resources as a 100-node test network. Second, it supports real-time security monitoring. As networks evolve—nodes are added or removed, connections change—the centrality measures can be recomputed to update threat assessments dynamically. Third, it provides interpretable security insights. Rather than a black-box optimization producing a list of nodes to monitor, the centrality-based analysis explains why certain nodes matter, enabling security analysts to reason about their defensive choices.

The work also connects to a broader trend in control theory: using graph-theoretic concepts to understand and design complex systems. By showing that the security metric reduces to a condition on centrality measures, the researchers reveal that the security of a networked system is fundamentally about its structure—whether the right nodes are protected and whether the connections between nodes create vulnerabilities that can be exploited.

Open Questions and Next Steps

The paper opens several avenues for future research. The current analysis assumes the adversary has perfect information about the system—knowing all parameters, defender strategies, and network structure. Relaxing this assumption to model more realistic adversaries, who might have limited information or make strategic errors, would increase the practical relevance of the framework.

The sufficient condition for network-size independence requires a certain robustness property of the system. Understanding when this condition holds in practice—identifying classes of networks where the simplification is valid—and what happens when it fails would clarify the breadth of applicability.

The heuristic search algorithm provides good solutions in practice, but theoretical guarantees on its approximation quality remain limited. Bounding how far the heuristic can stray from optimal would strengthen the practical recommendations.

Finally, the focus on positive systems—where states must remain non-negative—is appropriate for many applications (water, populations, concentrations) but excludes important classes of systems (financial networks, neural networks, systems with oscillatory dynamics). Extending the approach to more general network structures would significantly expand its reach.

These questions represent the research frontier, but the core contribution is already substantial. By connecting security assessment to Katz centrality, the researchers have provided a principled, scalable, and interpretable framework for protecting the networked systems that underpin modern infrastructure.

The Bigger Picture

We live in an era of increasingly sophisticated cyber threats against increasingly interconnected systems. The attacks on power grids, water networks, and industrial control systems aren't hypothetical—they've happened, they're happening, and they'll continue to happen. The question isn't whether these systems will be targeted, but whether we'll be ready when they are.

The framework developed in this paper offers one piece of that readiness: a mathematical foundation for understanding, quantifying, and managing the security vulnerabilities of large-scale networked control systems. By making security analysis tractable for systems that were previously beyond the reach of rigorous analysis, the work shifts the possibility frontier. What was once a million-node problem that's practically unsolvable becomes a structure-dependent computation that runs in seconds.

This doesn't solve the cybersecurity problem—not even close. But it provides defenders with better tools for understanding their adversaries, allocating their limited resources, and reasoning about the trade-offs inherent in protecting complex systems. In a world where the attacks are getting smarter and the systems are getting larger, any tool that shifts the balance even slightly toward the defenders is worth understanding deeply.

The mathematics of networked security is still being written. But with results like these, we're beginning to see the shape of a future where our critical infrastructure can be protected not just with heuristics and hope, but with rigorous analysis and principled design.