Detection Of Data Injection Attacks Research Articles

Random Subspace Ensemble-Based Detection of False Data Injection Attacks in Automatic Generation Control Systems

Automatic Generation Control (AGC) systems in smart grids are increasingly vulnerable to cyber-attacks, particularly False Data Injection (FDI) attacks, due to their reliance on information and communication technologies. These vulnerabilities pose significant threats to the reliable operation of power systems. To address this challenge, this research paper introduces the machine learning (ML) based cyberattack detection technique designed to identify FDI attacks with the highest accuracy proficiently. The study involves a comprehensive analysis of three features: the original discrete signal feature, the cycle-to-cycle-based feature, and the sample-to-sample-based feature. These features are utilized for detecting FDI attacks and distinguishing them from normal load variations. The research meticulously collects data by simulating diverse FDI attacks, including step attacks, pulse attacks, random attacks, and normal load variation cases on an AGC power system. Four ML classifiers are selected and compared for the classification task. The simulation results reveal that the sample-to-sample-based feature proves highly effective in distinguishing FDI attacks compared to the original signal and cycle-to-cycle-based features. Notably, the results indicate that the random subspace ensemble (RaSE) classifier, utilizing sample-to-sample-based features, effectively identifies and classifies all normal and FDI attacks. This research provides valuable insights into the potential of ML techniques for enhancing FDI attack detection in the AGC of power systems. It provides a potential pathway for overcoming the limitations associated with traditional model-based FDI detection methods.

Modeling and detection of false data injection attacks in cyber-physical distribution system with load aggregator interaction

With the increasing number of users and multi-type loads accessing the cyber–physical distribution system (CPDS), the bidirectional interaction between the system becomes more and more frequent. The Load aggregator (LA) also plays an increasingly important role in the interaction process. However, the LA’s high dependence on information and lack of security measures make it vulnerable to attacks, so this paper analyzes the interactive security of the LAs from two points. Considering the game process between the LAs and users from the attacker’s point of view, this paper puts forward an attack strategy aiming cost function of the LAs, establishes a bi-level multi-objective programming attack model of false data injection attacks(FDIAs), and proposes an attack detection method based on the multi-state matching method and improved similar daily data preprocessing generative adversarial network (P-GAN) from the defender’s point of view to defend against the above attack strategy. Furthermore, a hybrid detection mechanism combining event triggering and periodic detection is proposed to ensure response speed and adaptability of detection. The effectiveness of the proposed attack model and the detection method is verified by simulation analysis.

Locational Detection of False Data Injection Attacks in the Edge Space via Hodge Graph Neural Network for Smart Grids

Locational Detection of False Data Injection Attacks in the Edge Space via Hodge Graph Neural Network for Smart Grids

Comparison of deep learning algorithms for site detection of false data injection attacks in smart grids

False Data Injection Attacks (FDIA) pose a significant threat to the stability of smart grids. Traditional Bad Data Detection (BDD) algorithms, deployed to remove low-quality data, can easily be bypassed by these attacks which require minimal knowledge about the parameters of the power bus systems. This makes it essential to develop defence approaches that are generic and scalable to all types of power systems. Deep learning algorithms provide state-of-the-art detection for FDIA while requiring no knowledge about system parameters. However, there are very few works in the literature that evaluate these models for FDIA detection at the level of an individual node in the power system. In this paper, we compare several recent deep learning-based model that proven their high performance and accuracy in detecting the exact location of the attack node, which are convolutional neural networks (CNN), Long Short-Term Memory (LSTM), attention-based bidirectional LSTM, and hybrid models. We, then, compare their performance with baseline multi-layer perceptron (MLP)., All the models are evaluated on IEEE-14 and IEEE-118 bus systems in terms of row accuracy (RACC), computational time, and memory space required for training the deep learning model. Each model was further investigated through a manual grid search to determine the optimal architecture of the deep learning model, including the number of layers and neurons in each layer. Based on the results, CNN model exhibited consistently high performance in very short training time. LSTM achieved the second highest accuracy; however, it had required an averagely higher training time. The attention-based LSTM model achieved a high accuracy of 94.53 during hyperparameter tuning, while the CNN model achieved a moderately lower accuracy with only one-fourth of the training time. Finally, the performance of each model was quantified on different variants of the dataset—which varied in their l2\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$${\ ext{l}}_{2}$$\\end{document}-norm. Based on the results, LSTM, CNN obtained the highest accuracy followed by CNN-LSTM and lastly MLP.

Metaheuristics based dimensionality reduction with deep learning driven false data injection attack detection for enhanced network security

Recent sensor, communication, and computing technological advancements facilitate smart grid use. The heavy reliance on developed data and communication technology increases the exposure of smart grids to cyberattacks. Existing mitigation in the electricity grid focuses on protecting primary or redundant measurements. These approaches make certain assumptions regarding false data injection (FDI) attacks, which are inadequate and restrictive to cope with cyberattacks. The reliance on communication technology has emphasized the exposure of power systems to FDI assaults that can bypass the current bad data detection (BDD) mechanism. The current study on unobservable FDI attacks (FDIA) reveals the severe threat of secured system operation because these attacks can avoid the BDD method. Thus, a Data-driven learning-based approach helps detect unobservable FDIAs in distribution systems to mitigate these risks. This study presents a new Hybrid Metaheuristics-based Dimensionality Reduction with Deep Learning for FDIA (HMDR-DLFDIA) Detection technique for Enhanced Network Security. The primary objective of the HMDR-DLFDIA technique is to recognize and classify FDIA attacks in the distribution systems. In the HMDR-DLFDIA technique, the min–max scalar is primarily used for the data normalization process. Besides, a hybrid Harris Hawks optimizer with a sine cosine algorithm (hybrid HHO‐SCA) is applied for feature selection. For FDIA detection, the HMDR-DLFDIA technique utilizes the stacked autoencoder (SAE) method. To improve the detection outcomes of the SAE model, the gazelle optimization algorithm (GOA) is exploited. A complete set of experiments was organized to highlight the supremacy of the HMDR-DLFDIA method. The comprehensive result analysis stated that the HMDR-DLFDIA technique performed better than existing DL models.

False Data Injection Attack Detection, Isolation, and Identification in Industrial Control Systems Based on Machine Learning: Application in Load Frequency Control

The integration of advanced information and communication technology in smart grids has exposed them to increased cyber attacks. Traditional model-based fault detection systems rely on mathematical models to identify malicious activities but struggle with the complexity of modern systems. This paper explores the application of artificial intelligence, specifically machine learning, to develop fault detection mechanisms that do not depend on these models. We focus on operational technology for fault detection, isolation, and identification (FDII) within smart grids, specifically examining a load frequency control (LFC) system. Our proposed approach uses sensor data to accurately identify threats, demonstrating promising results in simulated environments.

Corrigendum: A data-driven ensemble technique for the detection of false data injection attacks in the smart grid framework

Corrigendum: A data-driven ensemble technique for the detection of false data injection attacks in the smart grid framework

Detection of false data injection attacks in smart grid based on adaptive inhibition unscented Kalman filter

Abstract False data injection attacks (FDIAs) cause incorrect system states by tampering with measurements, seriously affecting the EMS’s control process. However, the well-designed FDIAs can bypass traditional bad data detection (BDD) mechanisms. Aiming at the challenge, we improve the unscented Kalman filter and combine AIUKF with weighted least squares (WLS) to detect FDIAs. Utilizing the different convergence rates of the two estimators, the cosine similarity is introduced for FDIA detection. Various test conditions in IEEE-14-bus are simulated to underline the capability of AIUKF in state estimation. The results indicate that the proposed detection approach is superior for detecting FDIAs.

The Method for smart grid false data injection attack detection based on multilevel fingerprint identity authentication

The Method for smart grid false data injection attack detection based on multilevel fingerprint identity authentication

A survey on detection and localisation of false data injection attacks in smart grids

A survey on detection and localisation of false data injection attacks in smart grids

Detection of False Data Injection Attacks on Smart Grids Based on A-BiTG Approach

A false data injection attack (FDIA) is the main attack method that threatens the security of smart grids. FDIAs mislead the control center to make wrong judgments by modifying the measurement data of the power grid system. Therefore, the effective and accurate detection of FDIAs is crucial for the safe operation of smart grids. However, the current deep learning-based methods do not fully exploit the short-term local characteristics and long-term dependencies of power grid data and have poor correlation with past and future time series information, resulting in a lack of credibility in the detection results. In view of this, an FDIA detection model combining a bidirectional temporal convolutional network and bidirectional gated recurrent unit with an attention mechanism (A-BiTG) was proposed. The proposed model utilizes a bidirectional time convolutional network (BiTCN) and bidirectional gated recurrent unit (BiGRU) to consider past and future temporal information in the grid. This enhances the ability of the model to capture long-term dependencies and extract features, while also solving the model’s problem of exploding and vanishing gradients. In addition, an attention mechanism (AM) was added to dynamically assign weights to the extracted feature information and retain the most valuable features to improve the detection accuracy of the model. Finally, the proposed method was compared with existing methods on the IEEE 14-bus and IEEE 118-bus test systems. The results show that the proposed detection model is more robust and superior under different noise environments and FDIA signals with different intensities.

Bayesian GAN-Based False Data Injection Attack Detection in Active Distribution Grids With DERs

Bayesian GAN-Based False Data Injection Attack Detection in Active Distribution Grids With DERs

A data-driven ensemble technique for the detection of false data injection attacks in the smart grid framework

The major component of the smart grid (SG) is the advanced metering infrastructure (AMI), which monitors and controls the existing power system and provides interactive services for invoicing and electricity usage management with the utility. Including a cyber-layer in the metering system allows two-way communication but creates a new opportunity for energy theft, resulting in significant monetary loss. This article proposes an approach to detecting abnormal consumption patterns using energy metering data based on the ensemble technique AdaBoost, a boosting algorithm. Different statistical and descriptive features are retrieved from metering data samples, which account for extreme conditions. The model is trained for malicious and non-malicious data for five different attack scenarios, which are analyzed on the Irish Social Science Data Archive (ISSDA) smart meter dataset. In contrast to prior supervised techniques, it works well even with unbalanced data. The efficacy of the proposed theft detection method has been evaluated by comparing the accuracy, precision, recall, and F1 score with the other well-known approaches in the literature.

A Fusion Adaptive Cubature Kalman Filter Approach for False Data Injection Attack Detection of DC Microgrids

With the widespread application of information technology in microgrids, microgrids are evolving into a class of power cyber–physical systems (CPSs) that are deeply integrated with physical and information systems. Due to the high dependence of microgrids’ distributed cooperative control on real-time communication and system state information, they are increasingly susceptible to false data injection attacks (FDIAs). To deal with this issue, in this paper, a novel false data injection attack detection method for direct-current microgrids (DC MGs) was proposed, based on fusion adaptive cubature Kalman filter (FACKF) approach. Firstly, a DC MG model with false data injection attack is established, and the system under attack is analyzed. Subsequently, an FACKF approach is proposed to detect attacks, capable of accurately identifying the attacks on the DC MG and determining the measurement units injected with false data. Finally, simulation validations were conducted under various DC MG model conditions. The extensive simulation results demonstrate that the proposed method surpasses traditional CKF detection methods in accuracy and effectiveness across different conditions.

A cyberattack resilient model for battery electric bus transit fleets using real-time adaptive system information

This paper aims to assess and tackle the cyber–physical security threats stemming from vulnerabilities of battery-based electric bus (BEB) fleets to cyberattacks. An optimization model is adopted for scheduling the battery swapping in BEB fleets and is utilized for cybersecurity assessments. New methods are proposed for detection of false data injection attacks (FDIAs) against the information of the BEB scheduling model. A supervised machine learning-based method is used for identification of potential cyberattacks against the system parameters that govern the operation of the BEB transit fleet. The proposed cybersecurity model is integrated with the BEB scheduling model to form a cyberattack-resilient scheduling framework for the BEB transit fleet. Two categories of data are considered for the simulation of attack scenarios and assessment of the proposed cybersecurity framework: Type 1 – Signals that are received from sources local to the battery swapping station (BSS), and Type 2 – Signals that are received from sources external to the BSS which can be intercepted and tampered by the attacker. The simulation results are presented to evaluate potential disruptions in the BEB transit operation due to FDIAs against the system’s operating parameters. It is demonstrated that a soft cyberattack mildly deviating the fleet operating parameters, e.g., the bus arrival time by up to 10 min or battery SoC by 5%, does not cause a considerable impact on the scheduling parameters or the financial metrics. A moderate or aggressive attack, however, affecting the fleet operating parameters considerably, can adversely impact the scheduling information and the fleet financial metrics.

Locational Detection of False Data Injection Attacks in Smart Grids: A Graph Convolutional Attention Network Approach

Locational Detection of False Data Injection Attacks in Smart Grids: A Graph Convolutional Attention Network Approach

Robust Graph Autoencoder-Based Detection of False Data Injection Attacks Against Data Poisoning in Smart Grids

Machine learning-based detection of false data injection attacks (FDIAs) in smart grids relies on labeled measurement data for training and testing. The majority of existing detectors are developed assuming that the adopted datasets for training have correct labeling information. However, such an assumption is not always valid as training data might include measurement samples that are incorrectly labeled as benign, namely, adversarial data poisoning samples, which have not been detected before. Neglecting such an aspect makes detectors susceptible to data poisoning. Our investigations revealed that detection rates (DRs) of existing detectors significantly deteriorate by up to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$9 - 29\%$</tex-math></inline-formula> when subject to data poisoning in generalized and topology-specific settings. Thus, we propose a generalized graph neural network (GNN)-based anomaly detector that is robust against FDIAs and data poisoning. It requires only benign datasets for training and employs an autoencoder with Chebyshev graph convolutional recurrent layers with attention mechanism to capture the spatial and temporal correlations within measurement data. The proposed convolutional recurrent graph autoencoder (CR-GAE) model is trained and tested on various topologies (from 14, 39, and 118-bus systems). Due to such factors, it yields stable generalized detection performance that is degraded by only <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$1.6 - 3.7\%$</tex-math></inline-formula> in DR against high levels of data poisoning and unseen FDIAs in unobserved topologies.

Detection of False Data Injection Attacks on Distributed Energy Resources Integration into Distribution Networks

Background: Compared with the traditional power system, the large-scale access of distributed energy resources in the new power system has a great impact on the structure and operation mode of the power grid, and it is also more susceptible to device-level and network-level FDI attacks. Objective: In order to improve the accuracy and precision of detecting false data injection attacks in distributed energy resources integration into distribution networks and to further explore time series modeling methods for measurement data, it is helpful for the FDIAs detection method to be widely adopted and applied in new power systems. Method: To address false data injection attacks on distributed energy resource integration into distribution grids within new power systems, a data-driven time series anomaly detection method is employed. Firstly, time-aware shapelets are extracted from time series data, and then the shapelet evolution graph is constructed to capture the correlation between the shapelets. Finally, time series representation vectors are learned using segment embeddings derived from the shapelet evolution graph through the DeepWalk algorithm. These representation vectors are then input into a BO-XGBoost anomaly detector, facilitating the detection of FDIAs. Results: After multiple rounds of parameter tuning, the parameters of Shapelet quantity (K=40) and segment length (L=4) achieved an accuracy of 92.8% in FDIA detection. Comparative experimental results with different algorithms indicate that, compared to other unsupervised learning methods, this approach exhibits an accuracy improvement of 20-40%. In the case of BOXGBOOST, it achieves a 5% increase in accuracy compared to the unmodified XGBOOST. Conclusion: The experimental results indicate that this method can effectively detect false data injection attacks on the integration of distributed energy resources into distribution grids within new power systems. This model significantly enhances detection accuracy and precision while also imparting physical significance to the dynamic evolution of time series models.

Detection, differentiation and localization of replay attack and false data injection attack based on random matrix

Replay attack and false data injection attack (FDIA) are two common types of cyber-attacks against supervisory control and data acquisition systems, aiming to disrupt the normal operation of the power system by falsifying meter measurements. In this paper, we proposed a systematic methodology to defend hybrid attack with both replay attack and FDIA. Specifically, we propose a detection method applying random matrix theory to: (1) detect the hybrid attack on static state estimation, and (2) distinguish FDIA from replay attack as well as localize falsified measurements. Firstly, short-term forecast on load and renewable power generation is conducted to obtain the predicted measurements. Secondly, random variables are calculated by differentiating the forecasting measurements and real-time measurements. A random matrix is consequently constructed with the above random variables. Thirdly, hybrid attacks are detected by the changes of the linear eigenvalue statistics of the random matrix obtained by the sliding time window. More importantly, a novel multi-label classifier to distinguish replay attack from FDIA is designed to localize FDIA by combining SVD decomposition and eigenvalue analysis with convolutional neural network (SVD-CNN). Finally, comprehensive simulations on the IEEE 14-bus system and IEEE 57-bus system are provided to validate the performance of the proposed method. It is shown that the proposed detection method has strong detection ability by filtering measurement noise. Moreover, the proposed SVD-CNN improves the accuracy in FDIA localization.

Detection of False Data Injection Attack in Power System Based on Hellinger Distance

The deep integration of sensor, computer and communication networks has dramatically improved the efficiency and operational performance of the electric grid. However, it also exposes the grid to rising threats of cyber-physical attacks. False data injection attack (FDIA) is one of the most representative attacks. To improve the security of grid operation, we propose a Hellinger-distance -based FDIA detection method by tracking the dynamic characteristics of measurement variations at adjacent moments. First, the irrelevant components of measured data are sieved out by empirical modal decomposition (EMD). Second, the image transform algorithms are used to deal with the mapping of measurement variations to refine the distribution characteristics. Last, the discrepancies between the probability distributions are derived based on Hellinger distance to determine whether FDIA exists. Concerning state-variable attacks on different nodes, the method is tested using the IEEE 14-bus system. The results indicate that the proposed scheme has high-level detection precision for false data injection attacks.