Learning-Based Cooperative False Data Injection Attack and Its Mitigation Techniques in Consensus-Based Distributed Estimation

In this study, to enhance the system reliability under false data injection (FDI) attacks and DC-link voltage (DCLV) sensor failures, a hybrid control strategy for a DC microgrid (DCMG) based on the Lagrange extrapolation and voltage observer is proposed. Under normal conditions without FDI attacks or DCLV sensor failures, the DCMG system works in a distributed control scheme. To enhance the reliability of the system under the DCLV sensor failure or FDI attack, the DCMG system utilizes a hybrid control strategy that combines distributed control with decentralized control. The hybrid control strategy is achieved by the proposed detection algorithms for FDI attacks and DCLV sensor failures. The detection of FDI attacks is accomplished by comparing the predicted secondary controller output based on the Lagrange extrapolation with the actual one. When a power agent detects an FDI attack, its control mode is switched to decentralized control by using the proposed hybrid control strategy. The DCLV sensor failure detection algorithm to enhance system reliability against DCLV sensor failures is achieved by comparing the estimated DCLV with the measured one from the voltage observer. Upon detecting a DCLV sensor failure, the operation of the power agent is switched to the current control mode to sustain the system operation even under DCLV sensor failures. The proposed detection algorithms are simple, effective, and precise, operating without mutual interference that deteriorates the detection accuracy. Simulation and experiments are carried out under various uncertain test conditions to validate the reliability and effectiveness of the proposed control strategy.

In the recent years, cyberattacks to smart grids are becoming more frequent. Among the many malicious activities that can be launched against smart grids, the False Data Injection (FDI) attacks have raised significant concerns from both academia and industry. FDI attacks can affect the (internal) state estimation process—critical for smart grid monitoring and control—thus being able to bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection and precise localisation of FDI attacks are becoming of paramount importance to ensure smart grids security and safety. Several papers recently started to study and analyse this topic from different perspectives and address existing challenges. Data‐driven techniques and mathematical modelling are the major ingredients of the proposed approaches. The primary objective is to provide a systematic review and insights into FDI attacks joint detection and localisation approaches considering that other surveys mainly concentrated on the detection aspects without detailed coverage of localisation aspects. For this purpose, more than 40 major research contributions were selected and inspected, while conducting a detailed analysis of the methodology and objectives in relation to the FDI attacks detection and localisation. Key findings of the identified papers were provided according to different criteria, such as employed FDI attacks localisation techniques, utilised evaluation scenarios, investigated FDI attack types, application scenarios, adopted methodologies and the use of additional data. Finally, open issues and future research directions were discussed.

The integration of information and communication technologies (ICTs) has provided modern smart grids, such as direct current (DC) microgrids (MGs), with various advantages, e.g., the possibility of large-scale integration of renewable energy sources and complex control schemes. This extensive deployment of ICTs, however, makes DC MGs prone to a variety of cyber threats, e.g., false data injection (FDI) attacks. On this basis, this paper develops online detection and mitigation schemes to counter FDI attacks against DC MGs. Initially, in the offline training of the detection scheme, the density-based spatial clustering of applications with noise (DBSCAN) method is used for extracting prescriptive features of DC MG measurements and clustering them in healthy and under-attack operations under several uncertainties in DC MG operations. These features are used to train an adaptive network-based fuzzy inference system (ANFIS) architecture for the online identification of FDI attacks. Afterward, the trained ANFIS is used to detect FDI attacks and obtain the attack vectors benefiting from the real-time measurements estimated by an optimal state observer. Finally, an adaptive model predictive controller (AMPC) is developed to update the power-sharing commands—and mitigate the FDI attack—using the ANFIS’s obtained attack vectors. The effectiveness of the proposed framework is evaluated for several realistic FDI attack scenarios and different uncertainties. To show the scalability of the proposed detection and mitigation methods, a DC MG with eight converters is also studied in the presence of FDI attacks and uncertainties using real-time simulations.

For target tracking in radar network, any anomaly in a part of the system can quickly spread over the network and lead to tracking failures. False data injection (FDI) attacks can damage the state estimation mechanism by modifying the radar measurements with unknown and time-varying attack variables, therefore making traditional filters inapplicable. To tackle this problem, we propose a novel consensus-based distributed state estimation (DSE) method for target tracking with FDI attacks, which is effective even when all radars are under FDI attacks. First, a real-time residual-based detector is introduced to the DSE framework, which can effectively detect FDI attacks by analyzing the statistical properties of the residual. Secondly, a simple yet effective attack parameter estimation method is proposed to provide attack parameter estimation based on a pseudo-measurement equation, which has the advantage of decoupled estimation of state and attack parameters compared with augmented state filters. Finally, for timely attack mitigation and global consistency achievement, a novel hybrid consensus method is proposed which can compensate for the estimation error caused by FDI attacks and provide estimation accuracy improvement. The simulation results show that the proposed solution is effective and superior to the traditional DSE method for target tracking in the presence of FDI attacks.

The introduction of information and communication technologies makes network environments increasingly open, leaving smart-grid control systems incredibly vulnerable to malicious attacks. False data injection (FDI) attacks stealthily tamper with measurement data, resulting in erroneous decisions made by the control center that greatly influence the normal operation of the power system. By taking advantage of real-time data acquisition with edge computing, in this article, we propose a scheme based on classification of predicted residuals (CPRs) for the FDI attack detection. The CPR scheme first predicts the acquired measurement data at the edge of the sensing network via developing an accurate prediction model. Followed the novel real-time classification method under the edge devices supporting, it classifies the predicted residuals independent of the false data to enhance the detection accuracy. Through these two steps, the detection rate of FDI attacks is greatly improved. The proposed scheme is validated in a real microgrid testbed. Experimental results show that the CPR scheme performs well in detecting FDI attacks and remains sensitive in injection attack probability and magnitude. The detection scheme even has effectiveness at low injection attack probability and magnitude (5% and 0.018 per thousand, respectively). Furthermore, it also proves that the proposed scheme has applicability in high real-time requirements at the edge of smart grids.

The work presented in this chapter is an extension of our previous research of bringing together the Cognitive Dynamic System (CDS) and the Smart Grid (SG) by focusing on AC state estimation and Cyber-Attack detection. Under the AC power flow model, state estimation is complex and computationally expensive as it relies on iterative procedures. On the other hand, the False Data Injection (FDI) attacks are a new category of cyber-attacks targeting the SG that can bypass the current bad data detection techniques in the SG. Due to the complexity of the nonlinear system involved, the amount of published works on AC based FDI attacks have been fewer compared to their DC counterpart. Here, we will demonstrate how the entropic state, which is the objective function of the CDS, can be used as a metric to monitor the grid’s health and detect FDI attacks. The CDS, acting as the supervisor of the system, improves the entropic state on a cycle to cycle basis by dynamically optimizing the state estimation process through the reconfiguration of the weights of the sensors in the network. In order to showcase performance of this new structure, computer simulations are carried out on the IEEE 14-bus system for optimal state estimation and FDI attack detection.

The smart grid combines the classical power system with the information technology, leading to a cyber-physical system. In such an environment, the malicious injection of data has the potential to cause severe consequences. Classical residual-based methods for bad data detection are unable to detect well designed false data injection (FDI) attacks. Moreover, most of the works on FDI attack detection are based on the linearized DC model of the power system and fails to detect attacks based on the AC model. The aim of this paper is to address these problems by using the graph structure of the grid and the AC power flow model. We derive an attack detection method that is able to detect previously undetectable FDI attacks. This method is based on concepts originating from graph signal processing (GSP). The proposed detection scheme calculates the graph Fourier transform of an estimated grid state and filters the graph’s high-frequency components. By comparing the maximum norm of this outcome with a threshold, we can detect the presence of FDI attacks. Case studies on the IEEE 14-bus system demonstrate that the proposed method is able to detect a wide range of previously undetectable attacks, both on angles and on magnitudes of the voltages.

While acquiring precise and intelligent state sensing and control capabilities, the cyber physical power system is constantly exposed to the potential cyber-attack threat. False data injection (FDI) attack attempts to disrupt the normal operation of the power system through the coupling of cyber side and physical side. To deal with the situation that stealthy FDI attack can bypass the bad data detection and thus trigger false commands, a system feature extraction method in state estimation is proposed, and the corresponding FDI attack detection method is presented. Based on the principles of state estimation and stealthy FDI attack, we analyze the impacts of FDI attack on measurement residual. Gaussian fitting method is used to extract the characteristic parameters of residual distribution as the system feature, and attack detection is implemented in a sliding time window by comparison. Simulation results prove that the proposed attack detection method is effectiveness and efficiency.

The rapid adoption of the Industrial Internet of Things (IIoT) model has exposed methods to inadequate security measures. False data injection attacks (FDIAs) pose a significant security threat in IIoT, as they aim to mislead industrial platforms by manipulating sensor readings. In IIoT, owing to the data attacker’s changeability, the FDIA is the most critical intrusion network. As aggressive devices permitted in the network perform their typical data-collecting tasks, identifying an FDIA becomes a nontrivial effort due to potential attacks. Conventional attack detection models have proven insufficient in addressing FDIAs, and most current countermeasures focus on the need to legalise data, primarily in the context of data clustering services. Presently, deep learning (DL) systems are employed for detecting FDIA in real-time and supply personalised protective measures to the threat. This paper presents an Intelligent Management of False Data Injection Attacks Using Feature Selection and Voting Classifier (IMFDIA-FSVC) technique in IIoT systems. The primary purpose of the IMFDIA-FSVC technique is to develop a model for detecting and mitigating FDIAs to ensure safe and trustworthy operations of IIoT systems. Initially, the data pre-processing stage involves two stages: missing value analysis and normalisation to standardise the input data for an effective study. For an effective feature selection, the IMFDIA-FSVC model utilises a statistical and information-theoretic selection (SITS) technique to select optimal features from the input data. Finally, the classification process is mainly deployed by three models: the temporal convolutional network (TCN), the deep belief network (DBN), and the autoencoder (AE). An ensemble classifier is then performed using the voting classifier. The comparison study of the IMFDIA-FSVC method showed a superior accuracy value of 99.15% compared to existing models on the IIoT and FDIA datasets.

In recent studies, moving target defense (MTD) has been applied to detect false data injection (FDI) attacks using distributed flexible ac transmission system (D-FACTS) devices. However, the inherent conflict between the security goals of MTD (i.e., detecting FDI attacks) and the economic goals of D-FACTS devices (i.e., reducing power losses) would impede the application of MTD in real systems. Moreover, the detection capabilities of existing MTDs are often insufficient. This article proposes a multistage MTD (MMTD) approach to resolve these two issues by adding a group of designed security-oriented schemes before D-FACTS' economy-oriented scheme to detect FDI attacks. We keep these security-oriented schemes for a very short time interval and then revert to the economy-oriented scheme for the remaining time to ensure the economic requirements. We prove that a designed MMTD can significantly improve the detection capability compared to existing one-stage MTDs. We find the supremum of MMTD's detection capability and study its relationship with system topology and D-FACTS deployment. Meanwhile, a greedy algorithm is proposed to search the MMTD strategy to reach this supremum. Simulation results show that the proposed MMTD can achieve the supremum against FDI attacks while outperforming current MTD strategies on economic indicators.

False data injection attack (FDIA) is a typical cyber-attack aiming at falsifying measurement data for state estimation (SE), which may incur catastrophic consequences on cyber-physical system operation. In this paper, we develop a deep learning based methodology for detection, localization, and data recovery of FDIA on power systems in a coherent and holistic manner. However, the multi-modal probability distributions of both measurements and state variables in SE due to ever-changing operating points and structural/topological changes pose great challenges in detecting and localizing FDIA. To address this challenge, we first propose an enhanced attack model to launch massive FDIA on limited access points. Second, we train an auto-encoder (AE) with a Bayesian change verification (BCV) classifier using <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$N-1$</tex> contingencies to detect FDIA with unseen <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$N-k$</tex> operational topologies. Third, to avoid model collapse caused by multi-modal measurement distribution, an AE-based generative adversarial network (GAN) is derived to generate a diverse candidate set of normal measurement vectors with various operational topologies. Finally, we develop a pattern match algorithm to localize and recover the falsified measurements and state variables by comparing the falsified measurement vectors with the normal measurement vectors in the candidate set. Case studies with IEEE benchmark systems and a modified 415-bus China Southern Grid system are provided to validate the proposed methodology. It shows that the proposed methodology achieves an average 95% accuracy for detection, over 80% accuracy for localization of FDIA, and recovers the measurement and state variables close to their true values.

The load frequency control (LFC) system is an essential component of the smart grid and is located between cyberspace information and the physical infrastructure. Because the operation of LFC depends on the modern network communication technology, it is vulnerable to network attacks. The false data injection attack (FDIA) injects attack data into the data collected by the LFC system, affecting the control center's calculation and causing errors in the control signals, which affects the stable operation of the power system. For the LFC system, this article builds a cyber-physical model. Based on the model, an FDIA detection and defense mechanism based on the GAN network is proposed. By calculating, contrasting, and replacing the control signals, the proposed method can detect and defend against FDIAs. The experimental results on the two-area interconnected power system, the IEEE 39-bus, and IEEE 118-bus power system show that the proposed defense method can ensure the power system frequency and tie-line power deviation remain within the set value when suffered from FDIA.

To detect false data injection attacks (FDIAs) in power grid reconstruction and solve the problem of high data dimension and bad abnormal data processing in the power system, thereby achieving safe and stable operation of the power grid system, this study introduces machine learning methods to explore the detection of FDIAs. First, through the utilization of the standard IEEE node system and the simulation of FDIAs under the condition of non-complete topology information, the construction of the attack data set is completed, and the MatPower tool is applied to simulate and analyze the data set. Second, based on the isolated Forest (iForest) abnormal score data processing algorithm combined with the Local Linear Embedding (LLE) data dimensionality reduction method, an algorithm for data feature extraction is constructed. Finally, based on the combination of the Convolutional Neural Network (CNN) and the Gated Recurrent Unit (GRU) network, an algorithm model for FDIAs detection is constructed. The results show that in the IEEE14-bus node and IEEE118-bus node systems, the overall distribution of the state estimated before and after the attack vector injection is consistent with the initial value. In the iFores algorithm, the number of iTree and the number of samples affect the extraction of abnormal score data. When the number of iTree n is determined to be 100, and the corresponding number of samples w is determined to be 10, the algorithm has the best detection effect. The FDIAs detection algorithm model based on CNN-GRU shows good detection effects under high attack intensity, with an accuracy rate of more than 95%, and its performance is better than other traditional detection algorithms. In this study, the bad data detection model based on deep learning has an active role in the realization of the safe and stable operation of the smart grid.

False data injection attack (FDIA) could manipulate measurement information collected by supervisory control and data acquisition (SCADA) system, which tempers with decisions of power grid and threatens the state estimation of smart grid. Aiming at the state estimation of smart grid, the principle of FDIA under the AC power flow model is studied and a FDIA detection model based on improved convolutional neural network CNN is constructed By adding the gate recurrent unit (GRU) to the fully connected layer in CNN, the CNN-GRU network is designed to train and update network parameters based on historical measurement data of power grid, and extract spatial and temporal characteristics of the data to implement efficient and real-time FDIA detector. Finally, in the IEEE 118 bus test systems, experiments are carried out to verify the effectiveness of the proposed method.

False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages the auto-regressive moving average (ARMA) type graph filters (GFs) which can better adapt to sharp changes in the spectral domain due to their rational type filter composition compared to the polynomial type GFs such as Chebyshev. To the best of our knowledge, this is the first work based on GNN that automatically detects and localizes FDIA in power systems. Extensive simulations and visualizations show that the proposed approach outperforms the available methods in both detection and localization of FDIA for different IEEE test systems. Thus, the targeted areas can be identified and preventive actions can be taken before the attack impacts the grid.