Source-linked AI summary
Dynamic Detection of False Data Injection Attack in Smart Grid using Deep Learning
Xiangyu Niu Jiangnan Li, Jinyuan Sun
TL;DR
FDI attacks can bypass bad-data detection and change estimated grid states, while existing defenses make restrictive assumptions about attacks. The paper combines deep learning over time-series measurements and network features; its experiments report high detection accuracy in supported scenarios, with accuracy dependent on attack power.
Problem
FDI attacks can bypass bad-data detection and alter estimated grid states, while existing defenses rely on assumptions that may be restrictive for modern threats.
Source: §I · p. 1Method
The framework combines LSTM-based time-series detection with CNN processing of measurement and network features, alongside a static detector.
Source: §I · p. 2, A. The Combined Attack Detection Method · p. 3, C. Dynamic Detection Method · p. 4Results
The two-level scheme is reported to achieve high detection accuracy across scenarios; the dynamic detector exceeds 90% accuracy for random FDI attacks at high attacking power but has low accuracy at low attacking power.
Source: §IV · p. 5Takeaways & Limitations
The model learns normal behavior independently of specific attacks and is reported to detect unseen attacks, including when the state-vector estimator fails.
Source: §V · p. 6
Abstract
from arXiv · showhide
Modern advances in sensor, computing, and communication technologies enable various smart grid applications. The heavy dependence on communication technology has highlighted the vulnerability of the electricity grid to false data injection (FDI) attacks that can bypass bad data detection mechanisms. Existing mitigation in the power system either focus on redundant measurements or protect a set of basic measurements. These methods make specific assumptions about FDI attacks, which are often restrictive and inadequate to deal with modern cyber threats. In the proposed approach, a deep learning based framework is used to detect injected data measurement. Our time-series anomaly detector adopts a Convolutional Neural Network (CNN) and a Long Short Term Memory (LSTM) network. To effectively estimate system variables, our approach observes both data measurements and network level features to jointly learn system states. The proposed system is tested on IEEE 39-bus system. Experimental analysis shows that the deep learning algorithm can identify anomalies which cannot be detected by traditional state estimation bad data detection.
I. INTRODUCTION
Smart-grid communication growth creates cybersecurity risks, including FDI attacks that can bypass bad-data detection and alter estimated grid states. The paper proposes a deep-learning detector combining time-series measurements and network features to address limitations in detecting evolving attacks.
I. INTRODUCTION
- FDI attackers can bypass existing bad-data detection and intentionally change estimated grid states, creating a need for smart-grid-specific intrusion detection.Smart-grid communication growth also expands opportunities for cyberattacks.Source: §I · p. 1
- Existing FDI defenses protect selected basic measurements or verify state variables independently, while prior machine-learning work does not address dynamic attack behavior adequately.The paper notes that supervised binary classifiers may not detect evolving threats or changing system configurations.Source: §I · p. 1
- The proposed deep-learning framework combines LSTM-based temporal modeling with CNN processing of measurement and network inputs, alerting when residuals exceed a threshold.The CNN balances the two input sources.Source: §I · pp. 1–2
II. BACKGROUND
The background describes power-system measurements and state estimation, then explains how malicious measurement injections can alter estimated states. It distinguishes target attackers with sufficient insider information from random attackers with partial information.
A. False Data Injection Attack
- The power-system state comprises bus voltage magnitudes and angles, while measurements, states, and measurement errors are represented as vectors.The passage identifies the voltage magnitudes V and angles θ as state components.Source: A. False Data Injection Attack · p. 2
- The DC measurement model linearizes the AC model and relates m measurements to n state variables through matrix H, determined by topology and line impedances.H is described as constant for a given power system.Source: A. False Data Injection Attack · p. 2
- Weighted least squares estimates the state by minimizing a covariance-weighted measurement residual.The estimate uses the measurement vector z and covariance matrix R.Source: A. False Data Injection Attack · p. 2
- An injected measurement vector adds malicious data a to the original measurements, producing an estimated state that may differ from the original estimate by a nonzero vector c.The paper assumes target attackers have enough insider information to construct the altered estimate, while random attackers have only partial information.Source: A. False Data Injection Attack · p. 2
B. Convolutional Neural Network
A CNN transforms an input tensor through successive layers into an output such as a class score. Its parameters are trained to reduce the difference between computed outputs and training labels.
B. Convolutional Neural Network
- The described CNN architecture uses convolutional, pooling, and fully connected layers.Source: B. Convolutional Neural Network · p. 2
- A CNN transforms the input tensor layer by layer into a final output, such as a class score.Convolutional and fully connected layers apply transformations based on weights, biases, and input activations.Source: B. Convolutional Neural Network · p. 2
- CNN parameters are trained with gradient descent to minimize the loss between computed outputs and training labels.Source: B. Convolutional Neural Network · p. 2
C. Recurrent Neural Network
Recurrent neural networks process sequential data, including time series, by updating hidden states over time. A bidirectional RNN combines forward and backward hidden-unit scores to produce its result.
C. Recurrent Neural Network
- RNNs are specialized for sequential data such as time-series values.The paper contrasts this with CNNs, which are specialized for high-dimensional tensors such as images.Source: C. Recurrent Neural Network · p. 2
- The recurrent equation defines hidden-unit values using the prior hidden state and the input at time t.Here, h represents the state and x(t) the time-series input at time t.Source: C. Recurrent Neural Network · p. 2
- At each time step, a bidirectional RNN maintains forward and backward hidden units and combines their scores to produce the result.The figure caption describes a typical three-layer bidirectional recurrent network.Source: C. Recurrent Neural Network · pp. 2–3, Figure 2 · p. 3
1) Long Short-Time Memory:
LSTM cells preserve long dependencies while retaining short-term memories, using three gates to manage information flow.
1) Long Short-Time Memory:
- LSTM preserves long-term dependencies while retaining short-term memories, unlike a vanilla RNN with a single gate.Source: 1) Long Short-Time Memory · p. 3
- Each LSTM cell uses input, output, and forget gates to regulate information flow.Source: 1) Long Short-Time Memory · p. 3
- The notation defines σg and σc as sigmoid and tangent functions, ◦ as element-wise product, and c and h as cell-state and hidden-unit vectors.Source: 1) Long Short-Time Memory · p. 3
III. DETECTING DATA LEVEL FALSE DATA INJECTION ATTACK
The section focuses on dynamic FDI attacks that relax static-method assumptions about how many measurements attackers can corrupt. Its example shows a multi-bus attack that static methods fail to detect.
III. DETECTING DATA LEVEL FALSE DATA INJECTION ATTACK
- Prior static methods assume attackers know system topology but can corrupt only a limited number of data points; mitigation depends on the compromised-substation proportion staying below a threshold.Source: §III · p. 3
- The threat model removes the limit on corrupted measurements and assumes attackers understand the static detection mechanism.Source: §III · p. 3
- In the illustrated dynamic attack, measurements at buses 2 and 3 are compromised from t = 3; static methods fail when two thirds of measurements are modified through t = 6.Source: §III · p. 3
A. The Combined Attack Detection Method
The combined system pairs an independently built static detector with a dynamic detector that uses measurement and network-packet features. Offline training uses historical data and supports retraining as real-time measurements arrive.
A. The Combined Attack Detection Method
- The system combines an independently built static detector, such as a state estimator or FDI detector, with a dynamic detector.Source: A. The Combined Attack Detection Method · p. 3
- The dynamic detector uses data measurements and tcpdump-captured network packets, whose NSL-KDD feature set has 41 basic, content-based, and traffic-based features.Some packet features use a fixed window, defaulting to 2 seconds.Source: A. The Combined Attack Detection Method · p. 3
- Offline training uses historical measurements, while incoming real-time measurements support retraining and prediction-model updates.Source: A. The Combined Attack Detection Method · p. 3
B. State Estimator Method
The state-estimator method describes chi-square testing and residual-based bad-data detection, including a threshold rule and an l2-norm formulation for the DC model.
B. State Estimator Method
- Bad data detected by the chi-square test must be eliminated or corrected to obtain the correct states.Source: B. State Estimator Method · p. 4
- The method identifies the largest normalized residual and J(ˆx) performance index as two important hypotheses; J(ˆx) follows a chi-square distribution and is compared with preset threshold τ.Source: B. State Estimator Method · p. 4
- For the DC model, traditional bad-data detection approaches often reduce to the l2-norm of the measurement residual.Source: B. State Estimator Method · p. 4
C. Dynamic Detection Method
The dynamic detector learns temporal patterns from measurements, while a combined framework adds network-packet features to address cases where measurement-based detection may fail.
C. Dynamic Detection Method
- The single-source dynamic model passes time-series power-system data through several LSTM layers to learn high-dimensional temporal features.Its recurrent decision extends from one previous state to the previous n states.Source: C. Dynamic Detection Method · p. 4, Figure 5 · p. 4
- Binary classification may have low recall on highly unbalanced real-world power-system data, although recall is important because cyber attacks can have catastrophic consequences.Source: C. Dynamic Detection Method · p. 4
- The detector predicts the next data point from prior time-series inputs and flags an anomaly by comparing the prediction with the actual measurement.The loss uses parameters φ and θ, with threshold τ deciding whether an attack has started.Source: C. Dynamic Detection Method · p. 4
- The combined framework targets cases where fabricated data derived from legitimate measurements may evade a data-level detector.Source: C. Dynamic Detection Method · p. 4
- The combined detector transforms measurement and packet-level features with separate CNNs before concatenation, learning their relative weights to address their differing dimensions.Directly concatenating the input vectors may yield minimal improvement because the input dimensions differ significantly.Source: C. Dynamic Detection Method · p. 4, Figure 6 · p. 5
IV. CASE STUDY ON IEEE 39 BUS SYSTEM
On the IEEE 39-bus case study, detection accuracy exceeded 90% for random FDI attacks at high attacking capability, but was low at low attacking capability. The study also evaluates attacks derived from a real event.
IV. CASE STUDY ON IEEE 39 BUS SYSTEM
- The experiments use an IEEE 10-generator, 39-bus system with a 39-element state vector and a 10 Hz measurement rate.The communication network is emulated with two computers, and the measurement and packet inputs are time-synchronized.Source: §IV · p. 5, Figure 7 · p. 5
- The dynamic detector is a three-layer bidirectional RNN with LSTM cells, trained for 10 epochs using a 60%/20%/20% train/validation/test split and grid-searched threshold.State estimation is not implemented in this experiment.Source: §IV · p. 5
- Attacks include Gaussian-distributed injections and a targeted false generator-trip event derived from a real event, which the authors say most state-estimation bad-data detectors do not consider.The random attack vectors are drawn from N(0, 0.5).Source: §IV · p. 5
- Above 90% detection accuracy was achieved for random FDI attacks when k/n was high, while accuracy was low when attacking capability was low.The authors state that adding a state-estimator detector could address low attacking capability; their two-level scheme is described as achieving high accuracy across different scenarios.Source: §IV · p. 5, Figure 8 · p. 5
- The authors report that the dynamic detector does not require full power-system knowledge and could be built at an early stage of an electricity network.Source: §IV · p. 5
V. CONCLUSION
The paper proposes a deep-learning framework for detecting measurement anomalies due to FDI attacks, combining convolutional and recurrent neural networks. Its conclusion emphasizes learning normal behavior and using hybrid features to detect attacks when state estimation fails.
V. CONCLUSION
- The proposed FDI measurement-anomaly framework combines convolutional and recurrent neural networks.Source: §V · pp. 5–6
- The model learns normal behavior rather than a particular attack, and the authors state that it can detect unseen attacks.Source: §V · p. 6
- The two-level detector uses hybrid features and can detect attacks when the state-vector estimator fails; the paper presents a case study on the IEEE 39-bus system.Source: §V · p. 6