Detection Of False Data Injection Attacks Research Articles

False data injection attacks detection on power systems with convolutional neural network

False data injection attack (FDIA) could manipulate measurement information collected by supervisory control and data acquisition (SCADA) system, which tempers with decisions of power grid and threatens the state estimation of smart grid. Aiming at the state estimation of smart grid, the principle of FDIA under the AC power flow model is studied and a FDIA detection model based on improved convolutional neural network CNN is constructed By adding the gate recurrent unit (GRU) to the fully connected layer in CNN, the CNN-GRU network is designed to train and update network parameters based on historical measurement data of power grid, and extract spatial and temporal characteristics of the data to implement efficient and real-time FDIA detector. Finally, in the IEEE 118 bus test systems, experiments are carried out to verify the effectiveness of the proposed method.

Locational Detection of the False Data Injection Attack in a Smart Grid: A Multilabel Classification Approach

State estimation is critical to the monitoring and control of smart grids. Recently, the false data injection attack (FDIA) is emerging as a severe threat to state estimation. Conventional FDIA detection approaches are limited by their strong statistical knowledge assumptions, complexity, and hardware cost. Moreover, most of the current FDIA detection approaches focus on detecting the presence of FDIA, while the important information of the exact injection locations is not attainable. Inspired by the recent advances in deep learning, we propose a deep-learning-based locational detection architecture (DLLD) to detect the exact locations of FDIA in real time. The DLLD architecture concatenates a convolutional neural network (CNN) with a standard bad data detector (BDD). The BDD is used to remove the low-quality data. The followed CNN, as a multilabel classifier, is employed to capture the inconsistency and co-occurrence dependency in the power flow measurements due to the potential attacks. The proposed DLLD is “model-free” in the sense that it does not leverage any prior statistical assumptions. It is also “cost-friendly” in the sense that it does not alter the current BDD system and the runtime of the detection process is only hundreds of microseconds on a household computer. Through extensive experiments in the IEEE bus systems, we show that DLLD can perform locational detection precisely under various noise and attack conditions. In addition, we also demonstrate that the employed multilabel classification approach effectively enhances the presence-detection accuracy.

Cost-Benefit Analysis of Moving-Target Defense in Power Grids

We study moving-target defense (MTD) that actively perturbs transmission line reactances to thwart stealthy false data injection (FDI) attacks against state estimation in a power grid. Prior work on this topic lacks an analysis of the relationship between MTD's effectiveness (in detecting FDI attacks) and the associated cost of the perturbations (incurred by the grid operator). To address the issue, we present formal design criteria to select MTD reactance perturbations that are truly effective. Based on a key optimal power flow (OPF) formulation, we find that the effective MTD may incur a non-trivial operational cost. We show that MTD's detection capability and the associated cost depend on the separation between the column spaces of measurement matrices before and after the MTD perturbation. We use the metric of smallest principal angles between the subspaces to characterize the separation. We show that different degrees of the separation provide a spectrum of tradeoffs between the MTD's detection capability and its cost. Furthermore, we present closed-form expressions in the case of a two-bus system to illustrate the tradeoffs. While our analysis is primarily based on a direct current (dc) power flow model, we show that the perturbations designed using this model are also effective in detecting FDI attacks against ac power flows. Similarly, the cost-benefit tradeoff still holds under the ac power model. Extensive simulations, using the MATPOWER simulator and benchmark IEEE bus systems, verify and illustrate the proposed design approach that for the first time addresses both key aspects of cost and effectiveness of the MTD.

False Data Injection Attack Detection for Industrial Control Systems Based on Both Time- and Frequency-Domain Analysis of Sensor Data

This article studies the intrusion detection problem for industrial control systems (ICSs) with repetitive machining under false data injection (FDI) attacks. A data-driven intrusion detection method is proposed based on both time- and frequency-domain analysis. The proposed method only utilizes the sensor measurements required in closed-loop control, and does not consume additional system resources or rely on the system model. In addition, features in time and frequency domain are extracted at the same time, having higher reliability than the intrusion detection methods which only utilize the features in time domain. After feature extraction, hidden Markov models (HMMs) are established by using the feature vectors under normal operating conditions of the ICS, and then the trained HMMs are utilized in real-time intrusion detection. Finally, experiments are carried out on a networked multiaxis engraving machine with FDI attacks. The experimental results show the effectiveness and superiority of the proposed intrusion detection method.

Deep learning based method for false data injection attack detection in AC smart islands

This paper investigates the false data injection attacks (FDIA) in an AC smart island and the detection solution of the attack on distributed energy resources in a smart island. In this study, a new scheme of FDIA detection is proposed based on wavelet singular values as input index of deep learning algorithm. In the proposed method, switching surface based on sliding mode control breaks down for adjusting accurate factors of wavelet transform and then features of wavelet coefficients are extracted by singular value decomposition. Indexes are determined according to the wavelet singular values in switching surface of voltage and current which defines the input indexes of deep machine learning and detecting FDIA. This cyber-protection plan has been put forward for cyber diagnostic and examined in different types of attacks happening in voltage and current signals derivation of measuring sensors as well as sending and receiving data from communication and control systems. The main priority of the suggested detection plan is the high capability to detect FDIA with a high accuracy. To show the effectiveness of the proposed method, simulation studies are performed on AC smart island in MATLAB/Simulink environment.

Interval Observer-Based Detection and Localization Against False Data Injection Attack in Smart Grids

The cyber security of large-scale smart grid against false data injection attack (FDIA) is concerned in this article. FDIA can modify the sensor data and make internal states cause bias without being detected by the bad data detection system. We propose a method for FDIA detection and localization in the smart grid in this article. First, a series of interval observers are designed by considering the bounds of internal states, modeling errors, and disturbances to estimate the interval states of the grid physical system. By using the interval residuals of interval observers, a detection scheme against FDIA is proposed. For FDIA localization, the measurement data of the corresponding sensor is used as the input of the interval observer. Therefore, each interval observer is responsible for FDIA detection and localization of the corresponding sensor. Furthermore, the logic localization judgment matrix is constructed for localizing the sensor in which FDIA is injected. Then, the detection and localization scheme against FDIA is proposed based on the interval observer and the logic localization judgment matrix. Finally, simulations on the IEEE 36-bus grid are performed to illustrate the effectiveness of the proposed interval observer-based FDIA detection and localization algorithm.

Brief Survey on Attack Detection Methods for Cyber-Physical Systems

In recent years, cyber-physical systems (CPSs) have attracted intense attention due to their potential applications in many areas. However, the strong reliance on communication networks makes CPSs vulnerable to intentional cyberattacks. Therefore, a great number of attack detection methods have been proposed to enforce security of CPSs. In this article, various false data injection attack detection methods presented for CPSs are investigated and reviewed. According to the knowledge of control information, the controllers of CPSs are categorized as centralized and distributed controllers. Existing centralized attack detection approaches are discussed in terms of i) linear time-invariant systems, ii) actuator and sensor attacks, iii) nonlinear systems, and iv) systems with noise. Furthermore, the development of distributed attack detection is reviewed according to different decoupling methods. Some challenges and future research directions in the context of attack detection approaches are provided.

On Hiddenness of Moving Target Defense against False Data Injection Attacks on Power Grid

Recent studies have exploited moving target defense (MTD) for thwarting false data injection (FDI) attacks against the state estimation (SE) by actively perturbing branch parameters (i.e., impedance or admittance) in power grids. To hide the activation of MTD from attackers, a new strategy named hidden MTD has been proposed by the latest literature. A hidden MTD can increase the defender’s chance to detect FDI attacks and avoid the attacker from inferring new branch parameters. However, by using an MTD-confirming detector like the bad data detection (BDD) checker in SE, we observe that it is still possible for the attacker to detect this hidden MTD when the power flows change with time. To uncover the insight of MTD’s hiddenness, we study the conditions needed for achieving a hidable MTD. We find that the hiddenness of MTD is closely related to the branch perturbations, system topology, and attacker’s knowledge. From the attacker’s perspective, we prove that an MTD can be detected by the attacker only if he/she knows the previous parameters of a set of branches that forms a circle and the measurements corresponding to those branches after MTD. But once the attacker has full knowledge of branch parameters before MTD and has obtained all measurements after MTD, it is proved that we can never achieve a hidable and effective MTD. From the defender’s perspective, since it is impossible to know the attacker’s capability, we cannot determine whether a constructed MTD is hidable or not by purely depending on the MTD design. To address this issue, we propose that, by protecting a basic set of measurements, we always can achieve a hidable and effective MTD regardless of the changes of power flows, the attacker’s knowledge, and the branch perturbations. Furthermore, we validate our findings with the IEEE standard test power systems.

Optimal D-FACTS Placement in Moving Target Defense Against False Data Injection Attacks

Moving target defense (MTD) is a defense strategy to detect stealthy false data injection (FDI) attacks against the power system state estimation using distributed flexible AC transmission system (D-FACTS) devices. However, existing studies neglect to address a fundamental yet critical issue, i.e., the D-FACTS placement, by assuming that all lines are equipped with D-FACTS devices. To tackle this problem, we first derive analytical necessary conditions and requirements on the D-FACTS placement for a complete MTD. Further, we propose sufficient conditions using a graph theory-based topology analysis to ensure that the MTD under the proposed D-FACTS placement has the maximum rank of its composite matrix, which is indicative of the MTD effectiveness. Based on the analytical conditions, we design D-FACTS placement algorithms by using the minimum number of D-FACTS devices to achieve the maximum MTD effectiveness. A novel MTD-based ACOPF model, in which the reactance of D-FACTS lines is introduced as decision variables, is proposed to find a trade-off between the system loss and the MTD effectiveness. Numerical results on 6-bus, IEEE 14-bus, and IEEE 118-bus systems show the efficacy of MTDs using the proposed D-FACTS placement algorithms in maximizing the composite matrix rank and detecting FDI attacks.

Secure Information Fusion using Local Posterior for Distributed Cyber-Physical Systems

In modern distributed cyber-physical systems (CPS), information fusion often plays a key role in automate and self-adaptive decision making process. However, given the heterogeneous and distributed nature of modern CPSs, it is a great challenge to operate CPSs with the compromised data integrity and unreliable communication links. In this paper, we study the distributed state estimation problem under the false data injection attack (FDIA) with probabilistic communication networks. We propose an integrated ”detection + fusion” solution, which is based on the Kullback-Leibler divergences (KLD) between local posteriors and therefore does not require the exchange of raw sensor data. For the FDIA detection step, the KLDs are used to cluster nodes in the probability space and to partition the space into secure and insecure subspaces. By approximating the distribution of the KLDs with a general <inline-formula><tex-math notation="LaTeX">$\chi ^2$</tex-math></inline-formula> distribution and calculating its tail probability, we provide an analysis of the detection error rate. For the information fusion step, we discuss the potential risk of double counting the shared prior information in the KLD-based consensus formulation method. We show that if the local posteriors are updated from the shared prior, the increased number of neighbouring nodes will lead to the diminished information gain. To overcome this problem, we propose a near-optimal distributed information fusion solution with properly weighted prior and data likelihood. Finally, we present simulation results for the integrated solution. We discuss the impact of network connectivity on the empirical detection error rate and the accuracy of state estimation.

A Machine-Learning-Based Technique for False Data Injection Attacks Detection in Industrial IoT

The accelerated move toward the adoption of the Industrial Internet-of-Things (IIoT) paradigm has resulted in numerous shortcomings as far as security is concerned. One of the IIoT affecting critical security threats is what is termed as the false data injection (FDI) attack. The FDI attacks aim to mislead the industrial platforms by falsifying their sensor measurements. FDI attacks have successfully overcome the classical threat detection approaches. In this article, we present a novel method of FDI attack detection using autoencoders (AEs). We exploit the sensor data correlation in time and space, which in turn can help identify the falsified data. Moreover, the falsified data are cleaned using the denoising AEs (DAEs). Performance evaluation proves the success of our technique in detecting FDI attacks. It also significantly outperforms a support vector machine (SVM)-based approach used for the same purpose. The DAE data cleaning algorithm is also shown to be very effective in recovering clean data from corrupted (attacked) data.

Active Learning-Based XGBoost for Cyber Physical System Against Generic AC False Data Injection Attacks

With the exponential growth of information and communication technology, the traditional power system is gradually evolving into a cyber physical energy system (CPES) with frequently interactions between physical and cyber components. CPES indeed revolutionize the power grid efficiency and operational performance, but it also gives rise to new security challenges, causing catastrophic consequences in power system. Therefore, this article proposes a new false data injection attack (FDIA) detection mechanism to automatically recognize the intrusions and thereby improve the cybersecurity of CPES. In this mechanism, a two-stage FDIA model is developed to generate training dataset for the machine learning-based detector, and an extreme gradient boosting (XGBoost) classifier is meticulously designed by combining with active learning and Bayesian optimization techniques to improve training efficiency and model performance respectively. The proposed FDIA defense strategy can properly extract the nonstationary and nonlinear attacking features and thus locate the biased states with a high accuracy. The obtained numerical results on the standard IEEE 14-, 57- and 118-bus systems highlight the destructive effects of the developed two-stage FDIA and comprehensively demonstrate the effectiveness of the proposed FDIA detection mechanism.

A hybrid method for false data injection attack detection in smart grid based on variational mode decomposition and OS-ELM

A hybrid method for false data injection attack detection in smart grid based on variational mode decomposition and OS-ELM

False Data Injection Attack Detection based on Hilbert-Huang Transform in AC Smart Islands

In Smart Island (SI) systems, operators of power distribution system usually utilize actual-time measurement information as the Advanced Metering Infrastructure (AMI) to have an accurate, efficient, advanced control and monitor of whole their system. SI system can be vulnerable to complicated information integrity attacks such as False Data Injection Attack (FDIA) on some equipment including sensors and controllers, which can generate misleading operational decision in the system. Hence, lack of detailed research in the evaluation of power system that links the FDIAs with system stability is felt, and it will be important for both assessment of the effect of cyber-attack and taking preventive protection measures. In this regards, time-frequency-based differential approach is proposed for SI cyber-attack detection according to non-stationary signal assessment. In this paper, non-stationary signal processing approach of Hilbert-Huang Transform (HHT) is performed for the FDIA detection in several case studies. Since various critical case studies with a small FDIA in data where accurate and efficient detection can be a challenge, the simulation results confirm the efficiency of HHT approach and the proposed detection frame is compared with shallow model. In this research, the configuration of the SI test case is developed in the MATLAB software with several Distributed Generations (DGs). As a result, it is found that the HHT approach is completely efficient and reliable for FDIA detection target in AC-SI. The simulation results verify that the proposed model is able to achieve accuracy rate of 93.17% and can detect FDIAs less than 50 ms from cyber-attack starting in different kind of scenarios.

A Novel False Data Injection Attack Detection Model of the Cyber-Physical Power System

The False data injection attack (FDIA) against the Cyber-Physical Power System (CPPS) is a kind of data integrity attack. With more and more cyber vulnerabilities detected out, different types of FDIAs are emerging as severe threats to the stable operation of CPPS gradually. In this paper, the invasion pathway of the FDIA against CPPS is explored in detail, and a novel FDIA detection model based on ensemble learning is further provided. First, a pseudo-sample database is built to assist the training and evaluation of this model, and it's more important to update the model in the future. Furthermore, the optimal feature set is extracted to characterize the behavior of the FDIA, which improves the precision of the FDIA detection model. Finally, a focal-loss-lightgbm (FLGB) ensemble classifier is constructed to detect the FDIA behavior automatically and accurately. We illustrated the performance of this model by a fusion of measurement data and power system audit logs. This model utilizes the offline training way, the conclusion shows the high precision and stability of this model, which ensures the stable operation of the smart grid and improves the FDIA resistance ability of the CPPS.

Learning-Based Cooperative False Data Injection Attack and Its Mitigation Techniques in Consensus-Based Distributed Estimation

For the false data injection attack (FDIA) in the consensus-based distributed estimation, the information of weight matrix is critical for both attackers and defenders. In this paper, we study the impact of the weight matrix on the FDIA and the attack mitigation techniques. We first propose a learning-based cooperative FDIA strategy, where malicious nodes acquire the information of weight matrix cooperatively and launch the attack covertly. Two types of FDIA, the sudden FDIA and the dynamic FDIA, are considered to tamper the consensus result of the network to a pre-designed false value. Moreover, using the obtained information of weight matrix, a real-time surveillance and response mechanism is constructed to enhance the covertness of FDIA strategy. Since the surveillance and response mechanism can bypass existing FDIA detection methods, we further investigate the attack mitigation techniques against the learning-based cooperative FDIA. A real-time FDIA detection method and a reassessment mechanism with a punishment scheme are presented to resist the surveillance and response mechanism in the learning-based cooperative FDIA. Comprehensive simulation results verify that the attacker can obtain the information of weight matrix, and tamper the consensus result to a false value by launching the learning-based cooperative FDIA. And the real-time FDIA detection method can detect the malicious nodes efficiently and promptly.

Developing graphical detection techniques for maintaining state estimation integrity against false data injection attack in integrated electric cyber-physical system

Abstract The merging of power grid, information, and communication technology promotes the intelligent development of smart grid, which is also more prone to cyber attack threats. Especially, the intelligently designed False Data Injection (FDI) attacks severely disturb the normal management and state estimation operations in power system. In this paper, the graphical detection technology which uses Graph Network (GN) is developed for detecting tampered measurements without external knowledge and manual preprocess of historical data. To solve the detection of FDI attacks location issue from the diversified dimensionality in power systems, the Capsule Network combined with GN is developed, which can extract preserve the detailed properties around each note such as location, direction, connection, etc. To evaluate the superior performance of proposed method, the proposed detection technology is carried out through standard IEEE 30-bus and IEEE 118-bus systems. The simulation results demonstrate that the proposed method can detect FDI attacks accurately with different attack sparsity and magnitude of disturbances.

Detecting Dynamic Attacks in Smart Grids Using Reservoir Computing: A Spiking Delayed Feedback Reservoir Based Approach

Spiking neural networks have been widely used for supervised pattern recognition exploring the underlying spatio-temporal correlation. Meanwhile, spatio-temporal correlation manifests significantly between different components in a smart grid making the spiking neural network a desirable candidate for false data injection attack detection. In this paper, we develop a spiking-neural-network-based technique for dynamic cyber-attack detection in a smart grid. This is achieved through judiciously integrating spiking neurons with a special recurrent neural network called the delayed feedback reservoir computing. The inter-spike interval encoding is also explored in the precise-spike-driven synaptic plasticity based training process. The simulation results suggest that the introduced method outperforms multi-layer perceptrons and can achieve a significantly better performance compared to the state-of-the-art techniques. Furthermore, our analysis indicates that the delay value in the delayed feedback reservoir will have a substantial impact on the overall system performance.

Detection of False Data Injection Attacks in Smart Grids Based on Graph Signal Processing

The smart grid combines the classical power system with the information technology, leading to a cyber-physical system. In such an environment, the malicious injection of data has the potential to cause severe consequences. Classical residual-based methods for bad data detection are unable to detect well designed false data injection (FDI) attacks. Moreover, most of the works on FDI attack detection are based on the linearized DC model of the power system and fails to detect attacks based on the AC model. The aim of this paper is to address these problems by using the graph structure of the grid and the AC power flow model. We derive an attack detection method that is able to detect previously undetectable FDI attacks. This method is based on concepts originating from graph signal processing (GSP). The proposed detection scheme calculates the graph Fourier transform of an estimated grid state and filters the graph’s high-frequency components. By comparing the maximum norm of this outcome with a threshold, we can detect the presence of FDI attacks. Case studies on the IEEE 14-bus system demonstrate that the proposed method is able to detect a wide range of previously undetectable attacks, both on angles and on magnitudes of the voltages.

T2S2G: A Novel Two-Tier Secure Smart Grid Architecture to Protect Network Measurements

False data injection (FDI) attacks are a major security threat to smart grid (SG) communication systems. In FDI attacks, the attacker has the ability of modifying the measurements transmitted by smart grid entities such as smart meters, buses, etc. Many solutions have been proposed to mitigate FDI attacks in the SG. However, most of these solutions rely on centralized state estimation (SE), which is computationally expensive. To engulf this problem in FDI attack detection and to improve security of SGs, this paper proposes novel two-tier secure smart grid (T2S2G) architecture with distributed SE. In T2S2G, measurement collection and SE are involved in first tier while compromised meter detection is involved in second tier. Initially the overall SG system is divided into four sections by the weighted quad tree (WQT) method. Each section is provided with an aggregator, which is responsible to perform SE. Measurements from power grids are collected by remote terminal units (RTUs) and encrypted using a parallel enhanced elliptic curve cryptography (PEECC) algorithm. Then the measurements are transmitted to the corresponding aggregator. Upon collected measurements, aggregator estimates state using the amended particle swarm optimization (APSO) algorithm in a distributed manner. To verify authenticity of aggregators, each aggregator is authenticated by a logical schedule based authentication (LSA) scheme at the control server (CS). In the CS, fuzzy with a neural network (FNN) algorithm is employed for measurements classification. Our proposed T2S2G shows promising results in the following performance metrics: Estimation error, number of protected measurements, detection probability, successful detection rate, and detection delay.