Vector correlation learning and pairwise optimization feature selection for false data injection attack detection in smart grid

Smart grids are vulnerable to cyber-attacks, which can cause significant damage and huge economic losses. Generally, state estimation (SE) is used to observe the operation of the grid. State estimation of the grid is vulnerable to false data injection attack (FDIA), so diagnosing this type of malicious attack has a major impact on ensuring reliable operation of the power system. In this paper, we present an effective FDIA detection method based on residual recurrent neural network (R2N2) prediction model and adaptive judgment threshold. Specifically, considering the data contains both linear and nonlinear components, the R2N2 model divides the prediction process into two parts: the first part uses the linear model to fit the state data; the second part predicts the nonlinearity of the residuals of the linear prediction model. The adaptive judgment threshold is inferred through fitting the Weibull distribution with the sum of squared errors between the predicted values and observed values. The thorough simulation results demonstrate that our scheme performs better than other prediction based FDIA detection schemes.

The modern-day designs of power system have become very complex hardware-software based systems as a result of the rapid development of the Internet of Things (IoT) technology. Designing a smart grid with different smart devices at different location contribute to increase the efficiency of generation, transmission and distribution. State estimation is the most fundamental components in a smart grid to determine the state of operation of the grid with the sensor data and grid topology. It is very important to ensure the authenticity of measurements of the sensor devices in smart grid clusters. The data from such devices that reflect the operation of the grid can be tempered by false data injection attack (FDIA). This paper presents a novel architecture for cluster-based false data injection attack detection and location identification in smart gird. The state vector of the smart grid is represented as a multivariate time series. A vector autoregressive processes are used to predict this FDIA detection and location identification process by exploiting the spatula and temporal correlation of states. Various schemes such as general observation schemes (GOSs) have been proposed to detect and isolate this kind of attacks on a single sensor, but they are inappropriate to detect confrontation when multiple sensors are under attack. Here, we propose a scheme called cluster-based iterative observer scheme (IOS), which uses a mathematical model for smart grid that identifies the confrontations on the smart grid and isolate the attacks on the sensors by clustering the sensors of the smart grid into a small group (subset) of sensors and perform rigorous tests on these group of sensors to isolate the sensors are attacked. At the end of this paper, performance analysis by comparing the results of the proposed algorithm with the existing methods. From the result, the performance of proposed methods is better than conventional methods in terms of false data detection rate, prediction accuracy rate and security. The efficiency of the proposed scheme to identify and quarantine the confrontations in the smart network is shown in simulations results.KeywordsFalse data injection attackSmart gridInternet of thingsRenewable energyState estimationPrediction general observation schemesIterative observer schemeCyber physical systemsKalman filter

The smart grid combines the classical power system with the information technology, leading to a cyber-physical system. In such an environment, the malicious injection of data has the potential to cause severe consequences. Classical residual-based methods for bad data detection are unable to detect well designed false data injection (FDI) attacks. Moreover, most of the works on FDI attack detection are based on the linearized DC model of the power system and fails to detect attacks based on the AC model. The aim of this paper is to address these problems by using the graph structure of the grid and the AC power flow model. We derive an attack detection method that is able to detect previously undetectable FDI attacks. This method is based on concepts originating from graph signal processing (GSP). The proposed detection scheme calculates the graph Fourier transform of an estimated grid state and filters the graph’s high-frequency components. By comparing the maximum norm of this outcome with a threshold, we can detect the presence of FDI attacks. Case studies on the IEEE 14-bus system demonstrate that the proposed method is able to detect a wide range of previously undetectable attacks, both on angles and on magnitudes of the voltages.

In the recent years, cyberattacks to smart grids are becoming more frequent. Among the many malicious activities that can be launched against smart grids, the False Data Injection (FDI) attacks have raised significant concerns from both academia and industry. FDI attacks can affect the (internal) state estimation process—critical for smart grid monitoring and control—thus being able to bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection and precise localisation of FDI attacks are becoming of paramount importance to ensure smart grids security and safety. Several papers recently started to study and analyse this topic from different perspectives and address existing challenges. Data‐driven techniques and mathematical modelling are the major ingredients of the proposed approaches. The primary objective is to provide a systematic review and insights into FDI attacks joint detection and localisation approaches considering that other surveys mainly concentrated on the detection aspects without detailed coverage of localisation aspects. For this purpose, more than 40 major research contributions were selected and inspected, while conducting a detailed analysis of the methodology and objectives in relation to the FDI attacks detection and localisation. Key findings of the identified papers were provided according to different criteria, such as employed FDI attacks localisation techniques, utilised evaluation scenarios, investigated FDI attack types, application scenarios, adopted methodologies and the use of additional data. Finally, open issues and future research directions were discussed.

The introduction of information and communication technologies makes network environments increasingly open, leaving smart-grid control systems incredibly vulnerable to malicious attacks. False data injection (FDI) attacks stealthily tamper with measurement data, resulting in erroneous decisions made by the control center that greatly influence the normal operation of the power system. By taking advantage of real-time data acquisition with edge computing, in this article, we propose a scheme based on classification of predicted residuals (CPRs) for the FDI attack detection. The CPR scheme first predicts the acquired measurement data at the edge of the sensing network via developing an accurate prediction model. Followed the novel real-time classification method under the edge devices supporting, it classifies the predicted residuals independent of the false data to enhance the detection accuracy. Through these two steps, the detection rate of FDI attacks is greatly improved. The proposed scheme is validated in a real microgrid testbed. Experimental results show that the CPR scheme performs well in detecting FDI attacks and remains sensitive in injection attack probability and magnitude. The detection scheme even has effectiveness at low injection attack probability and magnitude (5% and 0.018 per thousand, respectively). Furthermore, it also proves that the proposed scheme has applicability in high real-time requirements at the edge of smart grids.

In this paper, we consider the problems of state estimation and false data injection detection in smart grid when the measurements are corrupted by colored Gaussian noise. By modeling the noise with the autoregressive process, we estimate the state of the power transmission networks and develop a generalized likelihood ratio test (GLRT) detector for the detection of false data injection attacks. We show that the conventional approach with the assumption of Gaussian noise is a special case of the proposed method, and thus the new approach has more applicability. The proposed detector is also tested on an independent component analysis (ICA) based unobservable false data attack scheme that utilizes similar assumptions of sample observation. We evaluate the performance of the proposed state estimator and attack detector on the IEEE 30-bus power system with comparison to conventional Gaussian noise based detector. The superior performance of both observable and unobservable false data attacks demonstrates the effectiveness of the proposed approach and indicates a wide application on the power signal processing.

Incentive edge-based federated learning for false data injection attack detection on power grid state estimation: A novel mechanism design approach

The work presented in this chapter is an extension of our previous research of bringing together the Cognitive Dynamic System (CDS) and the Smart Grid (SG) by focusing on AC state estimation and Cyber-Attack detection. Under the AC power flow model, state estimation is complex and computationally expensive as it relies on iterative procedures. On the other hand, the False Data Injection (FDI) attacks are a new category of cyber-attacks targeting the SG that can bypass the current bad data detection techniques in the SG. Due to the complexity of the nonlinear system involved, the amount of published works on AC based FDI attacks have been fewer compared to their DC counterpart. Here, we will demonstrate how the entropic state, which is the objective function of the CDS, can be used as a metric to monitor the grid’s health and detect FDI attacks. The CDS, acting as the supervisor of the system, improves the entropic state on a cycle to cycle basis by dynamically optimizing the state estimation process through the reconfiguration of the weights of the sensors in the network. In order to showcase performance of this new structure, computer simulations are carried out on the IEEE 14-bus system for optimal state estimation and FDI attack detection.

False data injection attacks (FDIA) are a main category of cyber-attacks threatening the security of power systems. Contrary to the detection of these attacks, less attention has been paid to identifying the attacked units of the grid. To this end, this work jointly studies detecting and localizing the stealth FDIA in power grids. Exploiting the inherent graph topology of power systems as well as the spatial correlations of measurement data, this paper proposes an approach based on the graph neural network (GNN) to identify the presence and location of the FDIA. The proposed approach leverages the auto-regressive moving average (ARMA) type graph filters (GFs) which can better adapt to sharp changes in the spectral domain due to their rational type filter composition compared to the polynomial type GFs such as Chebyshev. To the best of our knowledge, this is the first work based on GNN that automatically detects and localizes FDIA in power systems. Extensive simulations and visualizations show that the proposed approach outperforms the available methods in both detection and localization of FDIA for different IEEE test systems. Thus, the targeted areas can be identified and preventive actions can be taken before the attack impacts the grid.

In this study, to enhance the system reliability under false data injection (FDI) attacks and DC-link voltage (DCLV) sensor failures, a hybrid control strategy for a DC microgrid (DCMG) based on the Lagrange extrapolation and voltage observer is proposed. Under normal conditions without FDI attacks or DCLV sensor failures, the DCMG system works in a distributed control scheme. To enhance the reliability of the system under the DCLV sensor failure or FDI attack, the DCMG system utilizes a hybrid control strategy that combines distributed control with decentralized control. The hybrid control strategy is achieved by the proposed detection algorithms for FDI attacks and DCLV sensor failures. The detection of FDI attacks is accomplished by comparing the predicted secondary controller output based on the Lagrange extrapolation with the actual one. When a power agent detects an FDI attack, its control mode is switched to decentralized control by using the proposed hybrid control strategy. The DCLV sensor failure detection algorithm to enhance system reliability against DCLV sensor failures is achieved by comparing the estimated DCLV with the measured one from the voltage observer. Upon detecting a DCLV sensor failure, the operation of the power agent is switched to the current control mode to sustain the system operation even under DCLV sensor failures. The proposed detection algorithms are simple, effective, and precise, operating without mutual interference that deteriorates the detection accuracy. Simulation and experiments are carried out under various uncertain test conditions to validate the reliability and effectiveness of the proposed control strategy.

The rapid adoption of the Industrial Internet of Things (IIoT) model has exposed methods to inadequate security measures. False data injection attacks (FDIAs) pose a significant security threat in IIoT, as they aim to mislead industrial platforms by manipulating sensor readings. In IIoT, owing to the data attacker’s changeability, the FDIA is the most critical intrusion network. As aggressive devices permitted in the network perform their typical data-collecting tasks, identifying an FDIA becomes a nontrivial effort due to potential attacks. Conventional attack detection models have proven insufficient in addressing FDIAs, and most current countermeasures focus on the need to legalise data, primarily in the context of data clustering services. Presently, deep learning (DL) systems are employed for detecting FDIA in real-time and supply personalised protective measures to the threat. This paper presents an Intelligent Management of False Data Injection Attacks Using Feature Selection and Voting Classifier (IMFDIA-FSVC) technique in IIoT systems. The primary purpose of the IMFDIA-FSVC technique is to develop a model for detecting and mitigating FDIAs to ensure safe and trustworthy operations of IIoT systems. Initially, the data pre-processing stage involves two stages: missing value analysis and normalisation to standardise the input data for an effective study. For an effective feature selection, the IMFDIA-FSVC model utilises a statistical and information-theoretic selection (SITS) technique to select optimal features from the input data. Finally, the classification process is mainly deployed by three models: the temporal convolutional network (TCN), the deep belief network (DBN), and the autoencoder (AE). An ensemble classifier is then performed using the voting classifier. The comparison study of the IMFDIA-FSVC method showed a superior accuracy value of 99.15% compared to existing models on the IIoT and FDIA datasets.

The safe and reliable operation of power systems is an important guarantee for the healthy development of the national economy. Industry and people’s lives are inseparable from electricity, so the safety and reliability of electricity supply is very important. The sudden interruption of power supply will not only bring serious economic losses, but also seriously affect people’s normal lives and even endanger social stability. False data injection attack (FDIAs) are a new type of power system network attack method. FDIAs are a new type of power system network attack method. It can successfully bypass the bad data detection mechanism, offset the power measurement data, and mislead the control center under extremely subtle conditions. Therefore, it poses a very serious threat to the stable operation of the power system. Therefore, this article first analyzes the principle of false data injection attacks, in order to provide a theoretical basis for subsequent attack detection. Then this paper constructs a detection method based on extreme learning from the perspective of optimizing learning efficiency. Based on the IEEE14-bus standard test system, the method is verified through simulation, which shows the feasibility of this method, which provides a direction for building a safe and stable smart grid.

The industries are deploying Internet of Things (IoT) for complex applications in their respective domains which employ different sensors to collect data from different plants and pass it over signal conditioning units to obtain desired results. Now-a-days, these plants are vulnerable to cyber-attacks and one of prominent attacks is False Data Injection Attack (FDIA) which means injecting false data into the sensor readings, which has considerable losses that may include loss of human lives, equipment, etc. Hence, the proposal aims to develop a Machine Learning Algorithm which can protect the clean data from corrupted data and are useful for Anomaly Detection and Data Cleaning. False data injection is detected through three machine learning algorithms namely, Linear Regression with Least squares method (OLS) and Gradient descent and K-Means clustering and the suitable detection model is obtained through comparison of performance indices. Further, Auto Encoder neural network is applied to reconstruct the true data from the false data.

Due to the integration of cyber–physical systems, smart grids have faced the new security risks caused by false data injection attacks (FDIAs). FDIAs can bypass the traditional bad data detection techniques by falsifying the process of state estimation. For this reason, this paper studies the detection and isolation problem of FDIAs based on the adaptive Kalman filter bank (AKFB) in smart grids. Taking the covert characteristics of FDIAs into account, a novel detection method is proposed based on the designed AKF. Moreover, the adaptive threshold is proposed to solve the detection delay caused by a priori threshold in the current detection methods. Considering the case of multiple attacked sensor nodes, the AKFB-based isolation method is developed. To reduce the number of isolation iterations, a logical decision matrix scheme is designed. Finally, the effectiveness of the proposed detection and isolation method is demonstrated on an IEEE 22-bus smart grids.

False data injection attack (FDIA) could manipulate measurement information collected by supervisory control and data acquisition (SCADA) system, which tempers with decisions of power grid and threatens the state estimation of smart grid. Aiming at the state estimation of smart grid, the principle of FDIA under the AC power flow model is studied and a FDIA detection model based on improved convolutional neural network CNN is constructed By adding the gate recurrent unit (GRU) to the fully connected layer in CNN, the CNN-GRU network is designed to train and update network parameters based on historical measurement data of power grid, and extract spatial and temporal characteristics of the data to implement efficient and real-time FDIA detector. Finally, in the IEEE 118 bus test systems, experiments are carried out to verify the effectiveness of the proposed method.