A Real-Time Multistage False Data Detection Method Based on Deep Learning and Semisupervised Scoring Algorithms

Abstract

This article proposes a real-time multistage data-driven method to detect false data injected by an intruder. The proposed method is based on an accurate load model constructed by deep neural networks (long short-term memory and gated recurrent unit) where historical demand along with extra weather features are employed to formulate the problem as a sequence of predictions and build an appropriate DNN model. A distinct feature of the proposed method that dramatically improves accuracy is hyperparameter optimization (e.g., dropout rate, batch size, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\beta _{1}$</tex-math></inline-formula> , <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\beta _{2}$</tex-math></inline-formula> , <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$\alpha$</tex-math></inline-formula> ) based on cross-validation. Since hyperparameter optimization consumes enormous resources to analyze the different combinations of hyperparameters and causes out-of-memory problems, we have implemented our framework based on a parallel distributed computing technique on high-performance computer clusters. A variety of case studies are examined to find the best model. At the end of this step, the best model is employed as a base reference to a semisupervised scoring algorithm for the purpose of finding sequence of injected false data. To improve the detection efficiency, inter-range, pruning, and minimum score are added to the proposed methodology that suppress high false-positive rates. Several scenarios from a real-world dataset have been studied in this article, and the results demonstrate that the proposed method can be used to detect various types of attacks, including scaling, ramping, professional ramping, and random attacks, with a good performance score (i.e., recall, precision, and <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$F1$</tex-math></inline-formula> score) for all of them. Furthermore, it can mitigate false data with the forecasted load values.