PaperlayerView exact revision on arXiv

Source-linked AI summary

Smart Grid Cyber Attacks Detection using Supervised Learning and Heuristic Feature Selection

Jacob Sakhnini, Hadis Karimipour, Ali Dehghantanha

arXiv:1907.03313v1cs.CRcs.LGcs.NE

TL;DR

Stealthy FDI attacks can bypass standard smart-grid defenses, so alternative detection methods are needed. The paper tests SVM, KNN, and ANN classifiers with BCS, BPSO, and GA heuristic feature selection, comparing classification accuracy and computational efficiency. SVM and KNN detect FDI attacks across all three IEEE systems, with SVM the most versatile and GA the most efficient feature-selection method for accuracy and feature count.

  • Problem

    Stealthy FDI attacks can bypass standard smart-grid defenses, so alternative detection methods are needed.

    Source: §I · p. 1

  • Method

    The paper tests SVM, KNN, and ANN classifiers with BCS, BPSO, and GA heuristic feature selection, comparing classification accuracy and computational efficiency.

    Source: §I · p. 2

  • Results

    SVM and KNN detect FDI attacks across all three IEEE systems, with SVM the most versatile and GA the most efficient feature-selection method for accuracy and feature count.

    Source: §V · p. 4, §VI · p. 5

  • Takeaways & Limitations

    Heuristic feature selection maintained or sometimes increased classification accuracy with significantly fewer features in the tested systems.

    Source: §VI · p. 5

Abstract

from arXiv · show

False Data Injection (FDI) attacks are a common form of Cyber-attack targetting smart grids. Detection of stealthy FDI attacks is impossible by the current bad data detection systems. Machine learning is one of the alternative methods proposed to detect FDI attacks. This paper analyzes three various supervised learning techniques, each to be used with three different feature selection (FS) techniques. These methods are tested on the IEEE 14-bus, 57-bus, and 118-bus systems for evaluation of versatility. Accuracy of the classification is used as the main evaluation method for each detection technique. Simulation study clarify the supervised learning combined with heuristic FS methods result in an improved performance of the classification algorithms for FDI attack detection.

I. INTRODUCTION

Stealthy false data injection (FDI) attacks can bypass standard smart-grid defenses, motivating alternative detection methods. The paper evaluates supervised classifiers paired with heuristic feature selection across prior concerns about algorithm comparisons and system-size versatility.

I. INTRODUCTION

  • FDI alters measurements stealthily and can bypass standard defenses; smart-grid communication also increases exposure to measurement tampering and cyberattacks.The introduction notes that cyberattacks may aim at power theft or outages and disturbances.Source: §I · p. 1
  • FDI detection has also been studied using spatial-temporal, real-time, and statistical correlations in meter measurements.Prior work cited in the passage favored real-time correlation for scalability and low computational cost.Source: §I · p. 1
  • Earlier work found high feature correlation in low-variation simulations, while larger systems were expected to have less measurement covariance, motivating alternative feature selection.PCA retained 0.99 of variance in the cited study, but the passage attributes the high correlation to its limited simulation variation.Source: §I · p. 1
  • Prior comparisons reported that KNN may perform better on small systems, Gaussian-kernel SVM on larger systems, and single-layer perceptrons are less accurate than SVM.The paper hypothesizes that a more complex multilayer perceptron, or ANN, may be more accurate.Source: §I · p. 1
  • The study addresses limited cross-validation across algorithm parameters and evaluation on only one power system in prior work.The cited IEEE 30-bus study could not establish versatility across systems of varying sizes.Source: §I · p. 1
  • Three classifiers—SVM, KNN, and ANN—are paired with BCS, BPSO, and GA feature selection, with accuracy and computational efficiency as comparison criteria.The paper reports that heuristic selection can yield higher accuracy with fewer features.Source: §I · p. 2

A. State Estimation of Power Systems

The section describes state estimation from grid measurements and the residual test used to flag bad data, then explains how FDI attacks manipulate measurements through the system Jacobian.

A. State Estimation of Power Systems

  • State estimation relates system state variables to recorded grid measurements, including power flow, voltage magnitude, and phase angles.The passage describes state estimation as supporting prediction of system state for optimal power generation.Source: A. State Estimation of Power Systems · p. 2
  • Under global observability, state estimation is formulated as a least-squares problem; its variables include the measurement vector, state vector, Jacobian, and measurement error.The passage identifies k as the time step and the gain matrix as G(k) = H^T(k)W^-1H(k).Source: A. State Estimation of Power Systems · p. 2
  • Traditional bad-data detection uses a 2-norm residual threshold: measurements above the predefined threshold are treated as bad and removed before the next iteration.The state estimate uses the gain matrix and covariance matrix described in the passage.Source: A. State Estimation of Power Systems · p. 2

B. False Data Injection Attacks

  • FDI attacks inject malicious meter data by manipulating network measurements with a linear factor of the system Jacobian; the attack vector is a = Hc.The state-estimation error term Γ must remain within a system-dependent threshold.Source: B. False Data Injection Attacks · p. 2

III. SUPERVISED LEARNING BASED DETECTION OF FALSE DATA INJECTION

The paper cross-validates supervised classifiers with heuristic feature-selection methods. Its feature-selection approach searches for an accuracy-oriented subset represented as a binary feature mask.

III. SUPERVISED LEARNING BASED DETECTION OF FALSE DATA INJECTION

  • Three supervised classification algorithms are cross-validated alongside three heuristic feature-selection techniques for FDI detection.The passage introduces the following sections as describing the implemented algorithms.Source: §III · p. 2

A. Feature Selection

  • The paper uses GA, Cuckoo Search, and PSO to seek feature subsets that improve classifier accuracy and computational efficiency in large, complex power systems.The passage identifies PCA as prior dimensionality-reduction work and motivates heuristic selection by the somewhat nonlinear behavior of large-scale systems.Source: A. Feature Selection · p. 2
  • Each candidate feature subset is encoded as a binary vector, with 1 indicating a selected feature and 0 indicating an excluded feature.Source: A. Feature Selection · p. 2

1) Binary Cuckoo Search:

Binary Cuckoo Search adapts Cuckoo Search to binary feature-selection solutions. It updates nests using random walks and Levy flights, while retaining high-quality solutions across generations.

1) Binary Cuckoo Search:

  • BCS is a binary implementation of Cuckoo Search, an optimization algorithm based on cuckoo parasitism.Source: 1) Binary Cuckoo Search · p. 2
  • Cuckoo Search assigns eggs to randomly chosen nests, carries forward high-quality nests, and keeps the number of nests fixed while hosts may remove discovered eggs or build new nests.Source: 1) Binary Cuckoo Search · p. 2
  • Nest solutions are updated by Levy-flight random walks; the random step lengths can produce longer moves over time to explore the search space.The passage identifies the new egg value at time t as the updated value.Source: 1) Binary Cuckoo Search · pp. 2–3

2) Genetic Algorithm:

The section describes GA as an evolutionary feature-selection method and BPSO as a binary heuristic whose particles track personal and global best solutions.

2) Genetic Algorithm:

  • GA represents each candidate feature subset as a binary vector and uses FDI classification accuracy on that subset as its fitness.Each iteration removes lower-fitness solutions and retains higher-fitness ones.Source: 2) Genetic Algorithm · p. 3

3) Binary Particle Swarm Optimization:

  • BPSO is used for feature selection; its particles represent feasible solutions and update using each particle’s personal best and the population’s global best.The section describes initialization with a user-defined particle population, but the supplied passage does not specify further update mechanics.Source: 3) Binary Particle Swarm Optimization · p. 3

B. Classification Algorithms

The study evaluates supervised classifiers, including an SVM using a Gaussian kernel. It varies the SVM penalty and kernel-coefficient parameters and cross-validates accuracy.

B. Classification Algorithms

  • The study implements three types of supervised classification algorithms for cross-validation and analysis.The algorithms use different mathematical approaches to classify data.Source: B. Classification Algorithms · p. 3

1) Support Vector Machine:

  • The SVM constructs high-dimensional hyperplanes and uses a Gaussian kernel for nonlinear classification based on statistical variances.The paper gives computational efficiency as a reason for selecting this kernel.Source: 1) Support Vector Machine · p. 3
  • The SVM is tested with varying penalty parameter C and kernel coefficient γ, with accuracy cross-validated.Source: 1) Support Vector Machine · p. 3

2) K- Nearest Neighbours:

The section describes KNN classification by nearest neighbours and an ANN with a single hidden layer, whose node calculations use weighted inputs and a bias.

2) K- Nearest Neighbours:

  • KNN classifies data using its closest k neighbours, with closeness determined by Euclidean distance.For k > 1, classification uses the neighbours’ majority; the study tests and cross-validates various k values.Source: 2) K- Nearest Neighbours · p. 3

3) Artificial Neural Network:

  • Each ANN node computes an output using its transfer function, weighted inputs, and node bias.The node output is y_i; x_j denotes an input, w_ij its connection weight, and θ_i the node bias.Source: 3) Artificial Neural Network · p. 3
  • The ANN architecture has an input layer, one hidden layer, and an output layer; input and output node counts match the feature count and two classes, respectively.Source: 3) Artificial Neural Network · p. 3
  • The ANN is implemented with varying learning rate α and back propagation as its learning solver.Source: 3) Artificial Neural Network · p. 3

C. Evaluation Methods

The classification algorithms are evaluated by prediction accuracy on testing data.

C. Evaluation Methods

IV. METHODOLOGY

The study generates IEEE bus-system measurements, cross-validates classifiers, and evaluates heuristic feature selection with optimized parameters. SVM and KNN detect FDI attacks across all three systems, with SVM and GA yielding the strongest reported results.

IV. METHODOLOGY

  • Measurements from IEEE 14-, 57-, and 118-bus systems formed 10,000 training instances and 1,000 test instances, with half the training data attacked.Power-flow measurements were mapped to voltage-bus-angle state variables using the Jacobian matrix.Source: §IV · p. 3
  • The experiment first cross-validated classifiers on original features, then tested each feature-selection method with optimized classifier parameters..Source: §IV · p. 4

V. EXPERIMENTAL RESULTS

  • On IEEE 14-bus data without feature selection, classifier parameters were selected by maximum cross-validated accuracy across parameter sweeps.The sweeps varied SVM’s C and γ, KNN’s neighbor count, and ANN’s learning rate; Figure 1 shows the accuracy sweeps and Table I reports optimal parameters and accuracy.Source: §V · p. 4, Figure 1 · p. 4, Table I · p. 4
  • BCS, BPSO, and GA were configured using Table II, and their selected feature subsets were evaluated with SVM, KNN, and ANN across the three systems.Classification accuracy was recorded for each classifier and feature-selection pairing.Source: §V · p. 4, Table II · p. 4
  • SVM and KNN detected FDI attacks across all three systems; SVM led in accuracy, while GA achieved the highest accuracy with minimal features.All three heuristic feature-selection methods reduced feature counts successfully.Source: Table III · p. 4, Table IV · p. 4, Table V · p. 4

VI. CONCLUSION

Supervised learning detected FDI attacks across the tested IEEE systems, and heuristic feature selection maintained or sometimes increased accuracy with fewer features. GA was the most efficient feature-selection method by accuracy and feature count, while SVM with GA was the most accurate and versatile pairing.

VI. CONCLUSION

  • Supervised learning detected FDI attacks on IEEE 14-, 57-, and 118-bus systems, while heuristic feature selection maintained or sometimes increased accuracy with fewer features.The implemented SVM and KNN were more accurate and versatile across the systems than the implemented ANN.Source: §VI · p. 5
  • More complex ANN architectures are expected to perform better on larger systems, but at higher computational cost..Source: §VI · p. 5
  • GA was the most efficient heuristic feature-selection method in accuracy and feature count; SVM with GA was the most accurate and versatile across the three systems..Source: §VI · p. 5
Loading 1907.03313v1…