State estimation under false data injection attacks: Security analysis and system protection