Detection Of False Data Injection Attacks Research Articles

The Detection of False Data Injection Attack for Cyber–Physical Power Systems Considering a Multi-Attack Mode

Amidst the evolving communication technology landscape, conventional distribution networks have gradually metamorphosed into cyber–physical power systems (CPPSs). Within this transformative milieu, the cyber infrastructure not only bolsters grid security but also introduces a novel security peril—the false data injection attack (FDIA). Owing to the variable knowledge held by cyber assailants regarding the system’s network structure, current achievements exhibit deficiencies in accommodating the detection of FDIA across diverse attacker profiles. To address the historical data imbalances encountered during practical FDIA detection, we propose a dataset balancing model based on generating adversarial network-gated recurrent units (GAN-GRU) in conjunction with an FDIA detection model based on the Transformer neural network. Harnessing the temporal data extraction capabilities of gated recurrent units, we construct a GRU neural network system as the GAN’s generator and discriminator, aimed at data balance. After preprocessing, the balanced data are fed into the Transformer neural network for training and output classification to discern distinct FDIA attack types. This model enables precise classification amidst varying FDIA scenarios. Validation involves testing the model on load data from the IEEE 118-bus system and affirming its high accuracy and effectiveness in detecting power systems after multiple attacks.

Detection of false data injection attack in power grid based on spatial-temporal transformer network

False data injection attacks (FDIA) severely impact the secure operation of power grid, making accurate FDIA detection crucial for stability of power grid. Considering the complex spatiotemporal dependency of the power grid, this paper proposes a new FDIA detection method based on the Spatial-Temporal Transformer network to effectively integrate the topology and data of the power grid. In the Spatial Transformer network, the self-attention mechanism is utilized to capture the global dependency of the power grid, while the graph convolutional layer is employed to establish the local dependency of the power grid. In the Temporal Transformer network, the self-attention mechanism is employed to capture the long-term sequence dependency of power grid data, overcoming the limitation of long short-term memory network (LSTM) which can only model limited temporal dependency. Therefore, the Spatial-Temporal Transformer network can effectively mine spatiotemporal features in power grid, improving detection accuracy. The proposed detection method is evaluated using real load data from NYISO in IEEE 14-bus and IEEE 118-bus systems. Simulation results demonstrate the effectiveness and robustness of the proposed method.

A Novel False Measurement Data Detection Mechanism for Smart Grids

With the growing cyber-infrastructure of smart grids, the threat of cyber-attacks has intensified, posing an increased risk of compromised communication links. Of particular concern is the false data injection (FDI) attack, which has emerged as a highly dangerous cyber-attack targeting smart grids. This paper addresses the limitations of the variable dummy value model proposed in the authors previous work and presents a novel defense methodology called the nonlinear function-based variable dummy value model for the AC power flow network. The proposed model is evaluated using the IEEE 14-bus test system, demonstrating its effectiveness in detecting FDI attacks. It has been shown that previous detection techniques are unable to detect FDI attacks, whereas the proposed method is shown to be successful in the detection of such attacks, guaranteeing the security of the smart grid’s measurement infrastructure.

A False Data Injection Attack Detection Strategy for Unbalanced Distribution Networks State Estimation

With the advance in communication facilities and information technologies, the state estimation (SE) of distribution networks is subject to intensified cybersecurity threats caused by false data injection attacks (FDIAs). To address the issues, this paper proposes a novel FDIA detection strategy for unbalanced distribution networks. The SE model and corresponding general imperfect FDIA are introduced first to emulate the attacking behavior in practice. To achieve FDIA detection, we propose a square-root unscented Kalman filter (SR-UKF) based forecasting-aided SE (FASE) to generate estimation results. By modifying the filtering step of the proposed FASE into a redundant linear regression form, random outliers can be effectively detected and suppressed by leveraging the projection statistics (PS). Afterward, based on the acquired SE results, a generalized likelihood ratio test (GLRT) is designed to detect FDIAs on consecutive snapshots. In the GLRT, the dynamic time warping (DTW) distance between two innovation sequences is set as the test variable, which is compared with the offline determined detection threshold under a specific false alarm rate. The feasibility of the proposed general imperfect FDIA and the effectiveness of the proposed FDIA detection strategy are validated through extensive numerical simulations.

Detection of Stealthy False Data Injection Attacks in Modular Multilevel Converters

A modular multilevel converter (MMC) in a high-voltage direct-current (HVDC) transmission system consists of an electric-coupled physical system and a communication-coupled cyber system, leading to a cyber-physical system (CPS). Such a CPS is vulnerable to false data injection attacks (FDIA), which are the main category of cyberattacks. FDIAs can be launched by injecting false data into the control or communication system of the MMC to change the submodule (SM) capacitor voltage seen by the central controller. Consequently, the capacitor voltage of the attacked SM will deviate from its normal value and thus threaten the safe operation of the converter. Stealthy FDIAs characterized by elaborated attack sequences are more dangerous because they can deceive and bypass the attack detector presented in the existing literature for the MMC. To address this issue, this paper proposes a stealthy FDIA detection method to obtain the real SM capacitor voltages. Thus, the attacked SM can be located by comparing its real capacitor voltage with prespecified thresholds. Simulation results validate the effectiveness of the proposed detection and protection strategies.

Laplace-Domain Hybrid Distribution Model Based FDIA Attack Sample Generation in Smart Grids

False data injection attack (FDIA) is a deliberate modification of measurement data collected by the power grid using vulnerabilities in power grid state estimation, resulting in erroneous judgments made by the power grid control center. As a symmetrical defense scheme, FDIA detection usually uses machine learning methods to detect attack samples. However, existing detection models for FDIA typically require large-scale training samples, which are difficult to obtain in practical scenarios, making it difficult for detection models to achieve effective detection performance. In light of this, this paper proposes a novel FDIA sample generation method to construct large-scale attack samples by introducing a hybrid Laplacian model capable of accurately fitting the distribution of data changes. First, we analyze the large-scale power system sensing measurement data and establish the data distribution model of symmetric Laplace distribution. Furthermore, a hybrid Laplace-domain symmetric distribution model with multi-dimensional component parameters is constructed, which can induce a deliberate deviation in the state estimation from its safe value by injecting into the power system measurement. Due to the influence of the multivariate parameters of the hybrid Laplace-domain distribution model, the sample deviation generated by this model can not only obtain an efficient attack effect, but also effectively avoid the recognition of the FDIA detection model. Extensive experiments are carried out over IEEE 14-bus and IEEE 118-bus test systems. The corresponding results unequivocally demonstrate that our proposed attack method can quickly construct large-scale FDIA attack samples and exhibit significantly higher resistance to detection by state-of-the-art detection models, while also offering superior concealment capabilities compared to traditional FDIA approaches.

An Overview of Supervised Machine Learning Approaches for Applications in Active Distribution Networks

Distribution grids must be regularly updated to meet the global electricity demand. Some of these updates result in fundamental changes to the structure of the grid network. Some recent changes include two-way communication infrastructure, the rapid development of distributed generations (DGs) in different forms, and the installation of smart measurement tools. In addition to other changes, these lead to distribution grid modifications, allowing more advanced features. Even though these advanced technologies enhance distribution grid performance, the operation, management, and control of active distribution networks (ADNs) have become more complicated. For example, distribution system state estimation (DSSE) calculations have been introduced as a tool to estimate the performance of distribution grids. These DSSE computations are highly dependent on data obtained from measurement devices in distribution grids. However, sufficient measurement devices are not available in ADNs due to economic constraints and various configurations of distribution grids. Thus, the modeling of pseudo-measurements using conventional and machine learning techniques from historical information in distribution grids is applied to address the lack of real measurements in ADNs. Different types of measurements (real, pseudo, and virtual measurements), alongside network parameters, are fed into model-based or data-based DSSE approaches to estimate the state variables of the distribution grid. The results obtained through DSSE should be sufficiently accurate for the appropriate management and overall performance evaluation of a distribution grid in a control center. However, distribution grids are prone to different cyberattacks, which can endanger their safe operation. One particular type of cyberattack is known as a false data injection attack (FDIA) on measurement data. Attackers try to inject false data into the measurements of nodes to falsify DSSE results. The FDIA can sometimes bypass poor traditional data-detection processes. If FDIAs cannot be identified successfully, the distribution grid’s performance is degraded significantly. Currently, different machine learning applications are applied widely to model pseudo-measurements, calculate DSSE variables, and identify FDIAs on measurement data to achieve the desired distribution grid operation and performance. In this study, we present a comprehensive review investigating the use of supervised machine learning (SML) in distribution grids to enhance and improve the operation and performance of advanced distribution grids according to three perspectives: (1) pseudo-measurement generation (via short-term load forecasting); (2) DSSE calculation; and (3) FDIA detection on measurement data. This review demonstrates the importance of SML in the management of ADN operation.

Adaptive robust FDI attack detection for cyber–physical​ systems with disturbance

This paper investigates the problem of attack detection for cyber–physical systems (CPSs) with disturbances, measurement noises, and false data injection (FDI) attacks. A classical linear discrete-time system attack model is constructed and a robust attack detector based on the mixed H_/H ∞ is designed. Firstly, a system with an actuator that suffered a malicious attack is modeled. Then, a robust attack detector based on the mixed H_/H ∞ is designed in which the H_ index and H ∞ index are used to characterize the sensitivity to attacks and robustness to disturbances and measurement noises, respectively. And an adaptive detection threshold with a compensation term is proposed. Besides, the designed robust attack detector enables the attack detection dynamic system to be asymptotically stable and to guarantee the H_/H ∞ performance, and the robust attack detector gains are solved from a convex optimization. Finally, the obtained theoretical results are validated through a numerical simulation and a three-area power system simulation.

MMTD: Multistage Moving Target Defense for Security-Enhanced D-FACTS Operation

In recent studies, moving target defense (MTD) has been applied to detect false data injection (FDI) attacks using distributed flexible AC transmission system (D-FACTS) devices. However, the inherent conflict between the security goals of MTD (i.e., detecting FDI attacks) and the economic goals of D-FACTS devices (i.e., reducing power losses) would impede the application of MTD in real systems. Moreover, the detection capabilities of existing MTDs are often insufficient. This paper proposes a multi-stage MTD (MMTD) approach to resolve these two issues by adding a group of designed security-oriented schemes before D-FACTS’ economy-oriented scheme to detect FDI attacks. We keep these security-oriented schemes for a very short time interval and then revert to the economy-oriented scheme for the remaining time to ensure the economic requirements. We prove that a designed MMTD can significantly improve the detection capability compared to existing one-stage MTDs. We find the supremum of MMTD’s detection capability and study its relationship with system topology and D-FACTS deployment. Meanwhile, a greedy algorithm is proposed to search the MMTD strategy to reach this supremum. Simulation results show that the proposed MMTD can achieve the supremum against FDI attacks while outperforming current MTD strategies on economic indicators.

The detection mechanism for false data injection attack via the ellipsoidal set‐membership approach

AbstractThe false data injection (FDI) attack detection problem in cyber‐physical systems (CPSs) is investigated in this paper. A novel attack detection algorithm is proposed based on the ellipsoidal set‐membership approach. In comparison to the existing FDI attack detection methods, the developed attack detection approach in this paper neither requires predefined thresholds nor specific statistical characteristics of the attacks. In order to guarantee that the estimation ellipsoid contains normal states despite the unknown but bounded (UBB) process and measurement noises, the one‐step ellipsoidal set‐membership estimation method is put forward. In addition, a convex optimization algorithm is introduced to calculate the gain matrix of the observer recursively. Moreover, with the help of the state estimation ellipsoid, the residual ellipsoid can be obtained for attack detection. Whether a detector can detect the FDI attack depends on the relationship between the residual value and residual ellipsoidal set. Finally, the effectiveness of the proposed method is demonstrated by a numerical simulation example.

False data injection attack detection for nuclear reactor based on chaotic time/frequency-hopping spread spectrum

False data injection (FDI) attacks represent a serious threat to securing nuclear reactor operation. Efficient FDI attack detection is essential to prevent related unforeseen nuclear accidents. However, owing to their design principles, the existing detection methods are limited in their ability to detect multiple types of FDI attacks. To address this issue, we propose a detection scheme for FDI attacks on a nuclear reactor based on the chaotic time/frequency-hopping (TH/FH) spread spectrum. The proposed scheme uses frequency hopping modulation, demodulation, and filtering of the signal based on hyper-chaotic sequences to limit the attacker's access to the system's real data and eliminate the adverse effects of attacks on the system. Furthermore, theoretical analysis derives the stability constraint of the frequency hopping frequency and demonstrates the detectability and defendability of the proposed scheme. Experimental simulations demonstrated that our proposed scheme can detect two typical FDI attacks, replay attacks and covert attacks, without compromising system operation, and defend against and reproduce covert attack signals.

Detecting False Data Injection Attacks in Industrial Internet of Things Using an Optimized Bidirectional Gated Recurrent Unit-Swarm Optimization Algorithm Model

The rapid adoption of the Industrial Internet of Things (IIoT) paradigm has left systems vulnerable due to insufficient security measures. False data injection attacks (FDIAs) present a significant security concern in IIoT, as they aim to deceive industrial platforms by manipulating sensor readings. Traditional threat detection methods have proven inadequate in addressing FDIAs, and most existing countermeasures overlook the necessity of validating data, particularly in the context of data clustering services. To address this issue, this study proposes an innovative approach for FDIA detection using an optimized bidirectional gated recurrent unit (BiGRU) model, with the Sailfish Optimization Algorithm (SOA) employed to select optimal weights. The proposed model exploits temporal and spatial correlations in sensor data to identify fabricated information and subsequently cleanse the affected data. Evaluation results demonstrate the effectiveness of the proposed method in detecting FDIAs, outperforming state-of-the-art techniques in the same task. Furthermore, the data cleaning process showcased the ability to recover damaged or corrupted data, providing an additional advantage.

Distributed elastic recovery strategy of AC/DC hybrid microgrid under false data injection attack

AbstractThe AC/DC hybrid microgrid, which integrates AC microgrid and DC microgrid, greatly improves the flexibility of distributed energy. However, it is imperative to acknowledge that the microgrid in question is accompanied by a significantly elevated network security risk. To solve this problem, this article proposes a false data injection attack detection and alarm method based on active power output. The detection algorithm is capable of detecting attacks at any location within the microgrid and mitigating the impact of communication delay. Moreover, a distributed elastic recovery strategy based on the aforementioned detection algorithm is proposed. This strategy aims to expeditiously restore the compromised agent to its rated state. Finally, a simulation model is developed to demonstrate the effectiveness of the proposed strategy.

Efficient Multi-Source Self-Attention Data Fusion for FDIA Detection in Smart Grid

As a new cyber-attack method in power cyber physical systems, false-data-injection attacks (FDIAs) mainly disturb the operating state of power systems by tampering with the measurement data of sensors, thereby avoiding bad-data detection by the power grid and threatening the security of power systems. However, existing FDIA detection methods usually only focus on the detection feature extraction between false data and normal data, ignoring the feature correlation that easily produces diverse data redundancy, resulting in the significant difficulty of detecting false-data-injection attacks. To address the above problem, we propose a multi-source self-attention data fusion model for designing an efficient FDIA detection method. The proposed data fusing model firstly employs a temporal alignment technique to integrate the collected multi-source sensing data to the identical time dimension. Subsequently, a symmetric hybrid deep network model is built by symmetrically combining long short-term memory (LSTM) and a convolution neural network (CNN), which can effectively extract hybrid features for different multi-source sensing data. Furthermore, we design a self-attention module to further eliminate hybrid feature redundancy and aggregate the differences between attack-data features and normal-data features. Finally, the extracted features and their weights are integrated to implement false-data-injection attack detection using a single convolution operation. Extensive simulations are performed over IEEE14 node test systems and IEEE118 node test systems; the experimental results demonstrate that our model can achieve better data fusion effects and presents a superior detection performance compared with the state-of-the-art.

An unsupervised cyberattack detection scheme for AC microgrids using Gaussian process regression and one‐class support vector machine anomaly detection

AbstractThis paper addresses the cybersecurity of hierarchical control of AC microgrids with distributed secondary control. The false data injection (FDI) cyberattack is assumed to alter the operating frequency of inverter‐based distributed generators (DGs) in an islanded microgrid. For the microgrids consisting of the grid‐forming inverters with the secondary control operating in a distributed manner, the attack on one DG deteriorates not only the corresponding DG but also the other DGs that receive the corrupted information via the distributed communication network. To this end, an FDI attack detection algorithm based on a combination of Gaussian process regression and one‐class support vector machine (OC‐SVM) anomaly detection is introduced. This algorithm is unsupervised in the sense that it does not require labelled abnormal data for training which is difficult to collect. The Gaussian process model predicts the response of the DG, and its prediction error and estimated variances provide input to an OC‐SVM anomaly detector. This algorithm returns enhanced detection performance than the standalone OC‐SVM. The proposed cyberattack detector is trained and tested with the data collected from a 4 DG microgrid test model and is validated in both simulation and hardware‐in‐the‐loop testbeds.

A Data Mining/ANFIS and Adaptive Control for Detection and Mitigation of Attacks on DC MGs

The integration of information and communication technologies (ICTs) has provided modern smart grids, such as direct current (DC) microgrids (MGs), with various advantages, e.g., the possibility of large-scale integration of renewable energy sources and complex control schemes. This extensive deployment of ICTs, however, makes DC MGs prone to a variety of cyber threats, e.g., false data injection (FDI) attacks. On this basis, this paper develops online detection and mitigation schemes to counter FDI attacks against DC MGs. Initially, in the offline training of the detection scheme, the density-based spatial clustering of applications with noise (DBSCAN) method is used for extracting prescriptive features of DC MG measurements and clustering them in healthy and under-attack operations under several uncertainties in DC MG operations. These features are used to train an adaptive network-based fuzzy inference system (ANFIS) architecture for the online identification of FDI attacks. Afterward, the trained ANFIS is used to detect FDI attacks and obtain the attack vectors benefiting from the real-time measurements estimated by an optimal state observer. Finally, an adaptive model predictive controller (AMPC) is developed to update the power-sharing commands—and mitigate the FDI attack—using the ANFIS’s obtained attack vectors. The effectiveness of the proposed framework is evaluated for several realistic FDI attack scenarios and different uncertainties. To show the scalability of the proposed detection and mitigation methods, a DC MG with eight converters is also studied in the presence of FDI attacks and uncertainties using real-time simulations.

Detection of False Data Injection Attacks in Distributed State Estimation of Power Networks

In a power network, it is important to detect a cyber attack. In this paper, we propose a method for detecting false data injection (FDI) attacks in distributed state estimation. An FDI attack is well known as one of the typical cyber attacks in a power network. As a method of FDI attack detection, we consider calculating the residual (i.e., the difference between the observed and estimated values). In the proposed detection method, the tentative residual (estimated error) in ADMM (Alternating Direction Method of Multipliers), which is one of the powerful methods in distributed optimization, is applied. First, the effect of an FDI attack is analyzed. Next, based on the analysis result, a detection parameter is introduced based on the residual. A detection method using this parameter is then proposed. Finally, the proposed method is demonstrated through a numerical example on the IEEE 14-bus system.

Resilient distributed estimation against FDI attacks: A correntropy-based approach

In this paper, we consider the resilient distributed estimation in adversarial networks, compromised by false data injection (FDI) attacks. We develop a two-step distributed approach to detect the compromised nodes of the network due to FDI attacks. Specifically, we develop a distributed correntropy-based discrimination scheme followed by a distributed state perception scheme to distinguish the compromised nodes from the secure, such that the reliable neighbors could be determined by each node in a distributed manner. We further theoretically analyze the mean and mean-square performance of the resilient distributed estimation, and propose an optimal reference neighbor selection scheme to enhance the network estimation performance. Illustrative simulations validate the superior performance of both FDI attack detection and parameter estimation of the proposed distributed algorithms for adversarial networks, especially under heavy and time-varying FDI attacks. The theoretical results well predict the performance of the proposed resilient distributed estimation algorithm.

A Novel ZSV-Based Detection Scheme for FDIAs in Multiphase Power Distribution Systems

Modern power systems are vulnerable to false data injection attacks (FDIAs) due to the widespread applications of two-way communication networks for system operation and control. Diagnosing such malicious attacks are of great significance for the resilient operations of power systems. Yet, in literature, the majority of studies in FDIA detection focus on power transmission systems. In this paper, a novel FDIA detection scheme is proposed for three-phase distribution systems based on zero-sequence voltage (ZSV). From the voltage and power measurements, the bus voltages are estimated, and then the estimated ZSV is calculated as the sum of the estimated bus voltages on the three phases to represent the degree of unbalance of the distribution system. Via mathematical analysis of the linear distribution system state estimation (DSSE) model, the distribution of the estimated ZSV under the normal condition is derived, based on which a whitening process is adopted on the estimated ZSV to weaken the effect of measurement noises. The <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\mathcal {L}_{2}$ </tex-math></inline-formula> -norm of the whitened ZSV vector is then compared with a predefined threshold for FDIA detection. Moreover, the probability of false alarm of the proposed scheme is derived, which can be utilized to determine the detection threshold for a desired tolerance of false alarm rate. The proposed scheme is validated on several IEEE Test Feeders and simulation results show the effectiveness of the proposed scheme in detecting FDIAs in three-phase distribution systems.

Distribution System State Estimation and False Data Injection Attack Detection with a Multi-Output Deep Neural Network

Distribution system state estimation (DSSE) has been introduced to monitor distribution grids; however, due to the incorporation of distributed generations (DGs), traditional DSSE methods are not able to reveal the operational conditions of active distribution networks (ADNs). DSSE calculation depends heavily on real measurements from measurement devices in distribution networks. However, the accuracy of real measurements and DSSE results can be significantly affected by false data injection attacks (FDIAs). Conventional FDIA detection techniques are often unable to identify FDIAs into measurement data. In this study, a novel deep neural network approach is proposed to simultaneously perform DSSE calculation (i.e., regression) and FDIA detection (i.e., binary classification) using real measurements. In the proposed work, the classification nodes in the DNN allow us to identify which measurements on which phasor measurement unit (PMU), if any, were affected. In the proposed approach, we aim to show that the proposed method can perform DSSE calculation and identify FDIAs from the available measurements simultaneously with high accuracy. We compare our proposed method to the traditional approach of detecting FDIAs and performing SE calculations separately; moreover, DSSE results are compared with the weighted least square (WLS) algorithm, which is a common model-based method. The proposed method achieves better DSSE performance than the WLS method and the separate DSSE/FDIA method in presence of erroneous measurements; our method also executes faster than the other methods. The effectiveness of the proposed method is validated using two FDIA schemes in two case studies: one using a modified IEEE 33-bus distribution system without DGs, and the other using a modified IEEE 69-bus system with DGs. The results illustrated that the accuracy and F1-score of the proposed method are better than when performing binary classification only. The proposed method successfully detected the FDIAs on each PMU measurement. Moreover, the results of DSSE calculation from the proposed method has a better performance compared to the regression-only method, and the WLS methods in the presence of bad data.