Detection Of Data Injection Attacks Research Articles

Detection of Stealthy False Data Injection Attacks in Modular Multilevel Converters

A modular multilevel converter (MMC) in a high-voltage direct-current (HVDC) transmission system consists of an electric-coupled physical system and a communication-coupled cyber system, leading to a cyber-physical system (CPS). Such a CPS is vulnerable to false data injection attacks (FDIA), which are the main category of cyberattacks. FDIAs can be launched by injecting false data into the control or communication system of the MMC to change the submodule (SM) capacitor voltage seen by the central controller. Consequently, the capacitor voltage of the attacked SM will deviate from its normal value and thus threaten the safe operation of the converter. Stealthy FDIAs characterized by elaborated attack sequences are more dangerous because they can deceive and bypass the attack detector presented in the existing literature for the MMC. To address this issue, this paper proposes a stealthy FDIA detection method to obtain the real SM capacitor voltages. Thus, the attacked SM can be located by comparing its real capacitor voltage with prespecified thresholds. Simulation results validate the effectiveness of the proposed detection and protection strategies.

An Intrusion Detection Method Based on Self-Generated Coding Technology for Stealthy False Data Injection Attacks in Train-Ground Communication Systems

This paper investigates the problem of intrusion detection of stealthy false data injection (FDI) attacks in train-ground communication systems. An intrusion detection method is proposed based on the self-generated coding technology. Different from the existing pseudo-random coding generators-based detection methods, the proposed method designs a self-generated multiplicative coding scheme by employing the authentication mechanism, where the coding sequences to encrypt and decrypt the original measurement data of trains are dynamically updated by parsing the latest timestamp online such that the attacker is not able to obtain the prior knowledge of the coding sequences, which improves the security of the data transmission in the train-ground communication network. Under stealthy FDI attacks, the proposed method increases the output residuals of the remote state estimator, which ensures that the residual-based detector continuously outputs alarm. Furthermore, in order to mitigate the impact of the attack on the system, a dead reckoning algorithm-based defence model is established to reconstruct the position information of trains compromised by the attacker. Finally, the effectiveness and superiority of the proposed method are verified through semi-physical simulation experiments.

The detection mechanism for false data injection attack via the ellipsoidal set‐membership approach

AbstractThe false data injection (FDI) attack detection problem in cyber‐physical systems (CPSs) is investigated in this paper. A novel attack detection algorithm is proposed based on the ellipsoidal set‐membership approach. In comparison to the existing FDI attack detection methods, the developed attack detection approach in this paper neither requires predefined thresholds nor specific statistical characteristics of the attacks. In order to guarantee that the estimation ellipsoid contains normal states despite the unknown but bounded (UBB) process and measurement noises, the one‐step ellipsoidal set‐membership estimation method is put forward. In addition, a convex optimization algorithm is introduced to calculate the gain matrix of the observer recursively. Moreover, with the help of the state estimation ellipsoid, the residual ellipsoid can be obtained for attack detection. Whether a detector can detect the FDI attack depends on the relationship between the residual value and residual ellipsoidal set. Finally, the effectiveness of the proposed method is demonstrated by a numerical simulation example.

False data injection attack detection for nuclear reactor based on chaotic time/frequency-hopping spread spectrum

False data injection (FDI) attacks represent a serious threat to securing nuclear reactor operation. Efficient FDI attack detection is essential to prevent related unforeseen nuclear accidents. However, owing to their design principles, the existing detection methods are limited in their ability to detect multiple types of FDI attacks. To address this issue, we propose a detection scheme for FDI attacks on a nuclear reactor based on the chaotic time/frequency-hopping (TH/FH) spread spectrum. The proposed scheme uses frequency hopping modulation, demodulation, and filtering of the signal based on hyper-chaotic sequences to limit the attacker's access to the system's real data and eliminate the adverse effects of attacks on the system. Furthermore, theoretical analysis derives the stability constraint of the frequency hopping frequency and demonstrates the detectability and defendability of the proposed scheme. Experimental simulations demonstrated that our proposed scheme can detect two typical FDI attacks, replay attacks and covert attacks, without compromising system operation, and defend against and reproduce covert attack signals.

Generalized Graph Neural Network-Based Detection of False Data Injection Attacks in Smart Grids

False data injection attacks (FDIAs) pose a significant threat to smart power grids. Recent efforts have focused on developing machine learning (ML)-based defense strategies against such attacks. However, existing strategies offer limited detection performance since they (a) lack the capability of embedding the spatial aspects of the power system topology in the detection mechanism, (b) offer topology-specific detection that does not generalize well to practical systems with seasonal reconfigurations in their topology, or (c) offer detection based on only seen types of FDIAs present in the training set. Therefore, in this paper, we aim to develop a defense strategy that offers an improved generalization ability and detection performance against unseen attacks. Towards this objective, we propose a graph autoencoder (GAE)-based detection strategy that (a) captures spatio-temporal features of power systems, hence, offering improved detection performance, (b) is trained on comprehensive graphs reflecting various realizations of power system topologies, hence, offering better generalization abilities, and (c) works effectively against unseen FDIAs. The proposed detector is trained and tested on various topological configurations from 14, 39, and 118-bus systems offering detection rates (DRs) of 93.6%, 95.7%, and 99.1%, respectively, when tested against unseen FDIAs and unseen topologies. This presents an improvement of <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">$11.5 - 30\%$</tex-math></inline-formula> compared to existing ML-based strategies.

Distributed elastic recovery strategy of AC/DC hybrid microgrid under false data injection attack

AbstractThe AC/DC hybrid microgrid, which integrates AC microgrid and DC microgrid, greatly improves the flexibility of distributed energy. However, it is imperative to acknowledge that the microgrid in question is accompanied by a significantly elevated network security risk. To solve this problem, this article proposes a false data injection attack detection and alarm method based on active power output. The detection algorithm is capable of detecting attacks at any location within the microgrid and mitigating the impact of communication delay. Moreover, a distributed elastic recovery strategy based on the aforementioned detection algorithm is proposed. This strategy aims to expeditiously restore the compromised agent to its rated state. Finally, a simulation model is developed to demonstrate the effectiveness of the proposed strategy.

Deep Latent Space Clustering for Detection of Stealthy False Data Injection Attacks Against AC State Estimation in Power Systems

This paper proposes a self-supervised latent space clustering algorithm, called the Deep Latent Space Clustering, for the detection of stealthy false data injection attacks (FDIAs) in smart grids against state estimation algorithms. The stealthy FDI model considered is based on the accurate AC state estimation and is able to bypass conventional bad data detection (BDD) algorithms with ease. The key element of the detection model is a stacked autoencoder network that first undergoes a carefully designed two-step finetuning process, following which a trainable clustering head is stacked on top of the finetuned encoder and the final network is further trained to achieve a clean clustering of the data into benign and compromised samples without labelled supervision. To test the efficacy and scalability of the detection model, it is tested on the standard IEEE 14 bus, 118 bus and 300 bus test systems. The self-supervised clustering model is compared to several supervised, semi-supervised and unsupervised algorithms proposed in the literature for detection of FDI on the aforementioned test cases and has been found to perform at par with the state of the art among them.

Detection of False Data Injection Attacks in Distributed State Estimation of Power Networks

In a power network, it is important to detect a cyber attack. In this paper, we propose a method for detecting false data injection (FDI) attacks in distributed state estimation. An FDI attack is well known as one of the typical cyber attacks in a power network. As a method of FDI attack detection, we consider calculating the residual (i.e., the difference between the observed and estimated values). In the proposed detection method, the tentative residual (estimated error) in ADMM (Alternating Direction Method of Multipliers), which is one of the powerful methods in distributed optimization, is applied. First, the effect of an FDI attack is analyzed. Next, based on the analysis result, a detection parameter is introduced based on the residual. A detection method using this parameter is then proposed. Finally, the proposed method is demonstrated through a numerical example on the IEEE 14-bus system.

Decentralized attack detection for multi‐area power systems via interconnection‐decoupled sliding mode observer

AbstractThis article deals with the false data injection attack (FDIA) detection problem for multi‐area power systems. Considering the large‐scale characteristic of the multi‐area power systems, a novel decentralized detection scheme is proposed to detect FDIAs. First, an unknown input sliding mode observer (UI‐SMO) is designed to decouple the interconnected terms, meanwhile, a robust term in the UI‐SMO can attenuate the effect of the load variation, by which the obtained residual is only sensitive to local FDIAs. The strict reachability of the sliding surface in the estimate error space is ensured by the robust term with an auxiliary variable, and the stability of the sliding mode dynamics is achieved. Then, a detection logic is delicately designed based on a two‐phase residual threshold. Due to the strong attenuating ability to load variation, the proposed detection scheme shows better detectability than some existing works with only decoupling interconnections. Finally, the theoretical results are backed up by a three‐area power system simulation with comparison between proposed UI‐SMO‐based and traditional UIO‐based detection scheme.

Detection of false data injection attacks on power systems using graph edge-conditioned convolutional networks

State estimation plays a vital role in the stable operation of modern power systems, but it is vulnerable to cyber attacks. False data injection attacks (FDIA), one of the most common cyber attacks, can tamper with measurement data and bypass the bad data detection (BDD) mechanism, leading to incorrect results of power system state estimation (PSSE). This paper presents a detection framework of FDIA for PSSE based on graph edge-conditioned convolutional networks (GECCN), which use topology information, node features and edge features. Through deep graph architecture, the correlation of sample data is effectively mined to establish the mapping relationship between the estimated values of measurements and the actual states of power systems. In addition, the edge-conditioned convolution operation allows processing data sets with different graph structures. Case studies are undertaken on the IEEE 14-bus system under different attack intensities and degrees to evaluate the performance of GECCN. Simulation results show that GECCN has better detection performance than convolutional neural networks, deep neural networks and support vector machine. Moreover, the satisfactory detection performance obtained with the data sets of the IEEE 14-bus, 30-bus and 118-bus systems verifies the effective scalability of GECCN.

Detection of false data injection attacks in cyber–physical systems using graph convolutional network

Detection of false data injection attacks in cyber–physical systems using graph convolutional network

Detection of False Data Injection Attacks in Smart-Grid Systems: Benchmarking Deep Learning Techniques

In essence, smart grids are electrical networks that transmit and distribute electricity in a reliable, effective manner using information and communication technology (ICT). Trust and security are of the utmost importance. False data injection (FDI) attacks are one of the most serious new security problems, and they can drastically raise the price of the energy distribution process. However, rather than smart grid infrastructures, the majority of current research focuses on FDI defenses for conventional electricity networks. By utilizing spatial-temporal correlations between grid components, we create an effective and real-time technique to identify FDI attacks in smart grids called a deep learning framework. We show that the suggested method offers an accurate and dependable solution using realistic simulations based on the smart grid compared to the benchmarked techniques.

False data injection attack in smart grid cyber physical system: Issues, challenges, and future direction

Smart grid integrates the physical power system infrastructure with internet-of-things-based digital communication networks that work together for grid stability, sustainability, and reliability. A significant number of smart devices converge in cyber-physical systems to make the smart grid more competitive and efficient in addressing the energy challenges and vulnerabilities in power system confidentiality, integrity, and availability in smart grid cyber-physical security systems. False data injection attacks are the most malicious threats in the smart grid paradigm and have been widely applied recently. Last few years, several detection algorithms for identifying the false data injection attack have been developed. Addressing these issues, this paper reports a false data injection attack and threat mathematical model, impacting the on-grid system, economy, and society. The classification of false data injection attack detection algorithms and mathematical models are mainly presented. Finally, issues and challenges are identified from existing research and recommended for future research direction.

Detection of False Data Injection Attacks in Smart Grids Based on Expectation Maximization.

The secure operation of smart grids is closely linked to state estimates that accurately reflect the physical characteristics of the grid. However, well-designed false data injection attacks (FDIAs) can manipulate the process of state estimation by injecting malicious data into the measurement data while bypassing the detection of the security system, ultimately causing the results of state estimation to deviate from secure values. Since FDIAs tampering with the measurement data of some buses will lead to error offset, this paper proposes an attack-detection algorithm based on statistical learning according to the different characteristic parameters of measurement error before and after tampering. In order to detect and classify false data from the measurement data, in this paper, we report the model establishment and estimation of error parameters for the tampered measurement data by combining the the k-means++ algorithm with the expectation maximization (EM) algorithm. At the same time, we located and recorded the bus that the attacker attempted to tamper with. In order to verify the feasibility of the algorithm proposed in this paper, the IEEE 5-bus standard test system and the IEEE 14-bus standard test system were used for simulation analysis. Numerical examples demonstrate that the combined use of the two algorithms can decrease the detection time to less than 0.011883 s and correctly locate the false data with a probability of more than 95%.

Detection of False Data Injection Attack in AGC System Based on Random Forest

False data injection attacks change the control effect of automatic generation control systems, which may cause a destructive impact on power systems. In this paper, the data from the regular operation of a system and the data from false data injection attacks in the historical data are studied and classified. The normal operating parameters and abnormal operation parameters under various attack scenarios are collected as samples for training the detection model based on time series. The random forest algorithm model is selected for detection through the comparison of detection effects, and various data training models are accumulated during the operation process to improve the model’s accuracy. Finally, Simulink simulation experiments verify the consistency of the detection results of the simulated attack algorithm. This detection method can realize real-time attack detection and synchronize the detection results to the database with high timeliness. It can be used in systems with rich data samples and has broad applicability.

Detection of False Data Injection Attacks in Smart Grid Based on Joint Dynamic and Static State Estimation

Power system state estimation is an essential component of the modern power system energy management system (EMS), and accurate state estimation is an indispensable basis for subsequent work. However, the attacker can inject biases into measurements to launch false data injection attacks (FDIAs) in smart grids, which ultimately cause state estimates to deviate from security values. This paper proposed the joint use of static state estimation and dynamic state estimation to detect the FDIA, i.e. the joint use of weighted least squares (WLS) and extended Kalman filter (EKF) with exponential weighting function (WEKF), which improves the robustness of state estimation. Since the WLS estimation considers only the measurements at the current moment, the recursive feature of the WEKF enables the estimation process to involve both historical state and current measurements. Therefore, consistency tests and residual tests were performed using the estimations of WLS and WEKF to effectively detect FDIA. In addition, a cluster partitioning approach with approximate equal redundancy of subsystems is proposed to locate the FDIA. The detection of FDIA triggers the partitioning of the network system, and then the chi-square test is used separately in each sub-network to determine the location of FDIA. Finally, the experimental results in the IEEE-14 bus system and the IEEE-30 bus system demonstrate that the approach can effectively detect and locate FDIAs.

Data-driven Approach for State Prediction and Detection of False Data Injection Attacks in Smart Grid

In a smart grid, state estimation (SE) is a very important component of energy management system. Its main functions include system SE and detection of cyber anomalies. Recently, it has been shown that conventional SE techniques are vulnerable to false data injection (FDI) attack, which is a sophisticated new class of attacks on data integrity in smart grid. The main contribution of this paper is to propose a new FDI attack detection technique using a new data-driven SE model, which is different from the traditional weighted least square based SE model. This SE model has a number of unique advantages compared with traditional SE models. First, the prediction technique can better maintain the inherent temporal correlations among consecutive measurement vectors. Second, the proposed SE model can learn the actual power system states. Finally, this paper shows that this SE model can be effectively used to detect FDI attacks that otherwise remain stealthy to traditional SE-based bad data detectors. The proposed FDI attack detection technique is evaluated on a number of standard bus systems. The performance of state prediction and the accuracy of FDI attack detection are benchmarked against the state-of-the-art techniques. Experimental results show that the proposed FDI attack detection technique has a higher detection rate compared with the existing techniques while reducing the false alarms significantly.

Detection and Localization of False Data Injection Attacks in Smart Grid Based on Joint Maximum a Posteriori-Maximum Likelihood

Detection and Localization of False Data Injection Attacks in Smart Grid Based on Joint Maximum a Posteriori-Maximum Likelihood

An Efficient Privacy-Enhancing Cross-Silo Federated Learning and Applications for False Data Injection Attack Detection in Smart Grids

Federated Learning is a prominent machine learning paradigm which helps tackle data privacy issues by allowing clients to store their raw data locally and transfer only their local model parameters to an aggregator server to collaboratively train a shared global model. However, federated learning is vulnerable to inference attacks from dishonest aggregators who can infer information about clients’ training data from their model parameters. To deal with this issue, most of the proposed schemes in literature either require a non-colluded server setting, a trusted third-party to compute master secret keys or a secure multiparty computation protocol which is still inefficient over multiple iterations of computing an aggregation model. In this work, we propose an efficient cross-silo federated learning scheme with strong privacy preservation. By designing a double-layer encryption scheme which has no requirement to compute discrete logarithm, utilizing secret sharing only at the establishment phase and in the iterations when parties rejoin, and accelerating the computation performance via parallel computing, we achieve an efficient privacy-preserving federated learning protocol, which also allows clients to dropout and rejoin during the training process. The proposed scheme is demonstrated theoretically and empirically to provide provable privacy against an honest-but-curious aggregator server and simultaneously achieve desirable model utilities. The scheme is applied to false data injection attack detection (FDIA) in smart grids. This is a more secure cross-silo FDIA federated learning resilient to the local private data inference attacks than the existing works.

A New False Data Injection Attack Detection Model for Cyberattack Resilient Energy Forecasting

As power systems are gradually evolving into more efficient and intelligent cyber–physical energy systems with the large-scale penetration of renewable energies and information technology, they become increasingly reliant upon more accurate and complex forecasting. The accuracy and generalizability of the forecasting rest, to a great extent, upon the data quality, which is very susceptible to cyberattacks. False data injection (FDI) attacks constitute a class of cyberattacks that could maliciously alter a large portion of supposedly protected data, which may not be easily detected by existing operational practices, thereby deteriorating the forecasting performance causing catastrophic consequences in the power system. This article proposes a novel data-driven FDI attack detection mechanism to automatically detect the intrusions and thus enrich the reliability and resiliency of energy forecasting systems. The proposed mechanism is based on cross-validation, least-squares, and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">z</i> -score metric providing accurate detections with low computational cost and high scalability without utilizing either system’s models or parameters. The effectiveness of the proposed detector is corroborated through six representative tree-based wind power forecasting models. Experiments indicate that corrupted data injected into input, output, and input–output data is properly located and removed, whereby the accuracy and generalizability of the final forecasts are recovered.