PaperlayerView exact revision on arXiv

Source-linked AI summary

Detecting False Data Injection and Unstable Operation in Smart Grid via System-Aware Graph Boundary Learning

Emad Efatinasab, Denis Donadel, Mirco Rampazzo, Chuadhry Mujeeb Ahmed

arXiv:2609.35506v1cs.CR

TL;DR

Unstable operating examples are difficult and potentially unsafe to collect, while FDI threats in DSGC remain little explored, leaving stability prediction and attack detection rarely addressed together. StarGNN learns from stable configurations and physics-constrained pseudo-negatives, using one score for instability and unseen attack detection. It reports strong stability prediction and attack detection across unseen scenarios, including against a constrained adaptive attacker.

  • Problem

    Stability prediction methods often require scarce unstable examples, while FDI threats in DSGC remain largely unexplored and are rarely addressed jointly with instability detection.

    Source: §1 · p. 2

  • Method

    StarGNN learns a stable-region boundary from stable configurations and physics-constrained pseudo-negatives, using one risk score and threshold for instability and FDI detection.

    Source: §1 · p. 2, §6.5 · p. 7

  • Results

    StarGNN reports 0.989 accuracy and 0.97 macro F1-score on stability prediction, 0.988 mean attack recall against generic FDI, and 0.899 attack recall against an adaptive attacker.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The same stable-only model and threshold performed on stability prediction and the nine unseen attacks considered in the threat model.

    Source: §9 · pp. 12–13

    Evaluation is limited to a four-node DSGC benchmark, so retained detection performance in larger systems is not established.

    Source: §9 · p. 13

Abstract

from arXiv · show

Cyber-physical power systems increasingly rely on data-driven tools to detect instability and support reliable grid operation. However, reliable stability prediction is difficult when unstable operating configurations are rare, sensitive, or unavailable during model development, since collecting such data safely and at scale is often impractical. At the same time, False Data Injection (FDI) attacks can manipulate reported system parameters to trigger false instability alarms or conceal unsafe operation, and such threats in Decentral Smart Grid Control (DSGC) systems remain largely unexplored. These challenges are rarely addressed jointly, leaving a gap between stability prediction and attack detection that this work aims to close. In this paper, we introduce StarGNN, a graph learning framework that learns the stable operating region exclusively from clean stable configurations and uses a single abnormality score to flag reported configurations that should not be trusted as evidence of safe operation, covering both genuine instability and unseen FDI manipulations. Each configuration is represented as a producer-consumer star graph and processed by a role aware graph neural network, with physics constrained pseudo-negatives generated by perturbing reaction time and price response parameters standing in for the unavailable unstable and attack data. A single threshold, calibrated only on held-out stable data, is used without task or attack specific adjustment. Evaluated on nine unseen FDI scenarios, StarGNN detects between 0.780 and 0.973 of attacks on stable configurations and retains a post attack instability recall between 0.972 and 0.999 on unstable ones, with 0.899 recall against a stronger adaptive attacker, showing that stable-only boundary learning can support both stability prediction and attack detection without access to genuine unstable labels or attack samples during training.

1 Introduction

Frequency-linked pricing couples participants’ economic responses to grid dynamics, making stability depend on response intensity, adaptation delays, and measurement windows. StarGNN addresses the scarcity of unstable and attack data with a stable-only graph-learning detector for instability and FDI manipulation.

1 Introduction

  • In DSGC, local frequency deviations guide electricity prices, linking demand response to the balance between generation and consumption.A frequency decrease signals insufficient generation, while an increase indicates excess supply.Source: §1 · p. 1
  • Instability examples are uncommon, unsafe to reproduce deliberately, and costly to collect, limiting the practical applicability of methods that require unstable training data.Collection may also require substantial expertise, resources, and time.Source: §1 · pp. 1–2
  • FDI detection in DSGC remains largely unexplored, and supervised detectors can lose performance when test attacks differ from training patterns.The paper frames stability prediction and attack detection as joint challenges.Source: §1 · p. 2
  • StarGNN learns a stable-region boundary from stable configurations and uses one risk score and threshold to flag both natural instability and FDI manipulation.The threshold is calibrated only on held-out stable data, without task- or attack-specific adjustment.Source: §1 · p. 2
  • 0.989 accuracy and 0.97 macro F1-score are reported for stability prediction, alongside 0.988 mean attack recall against generic FDI and 0.899 recall against an adaptive attacker.The security evaluation covers nine unseen FDI scenarios and a constrained adaptive attacker with binary alarm feedback.Source: §1 · p. 2

2 Related Work

Prior smart-grid stability studies commonly use supervised learning, while existing FDI work gives limited attention to DSGC. This paper frames its attacks around DSGC physical structure and participant interactions.

2 Related Work

  • Most reviewed stability-prediction approaches assume representative stable and unstable samples, and prior work had not modeled DSGC configurations as graphs capturing producer-consumer dependencies.The review describes a range of machine-learning approaches, including tree-based models, CNNs, and LSTMs.Source: §2 · p. 2
  • FDI detection in power systems includes autoencoder- and GAN-based methods and graph autoencoders, but DSGC-specific FDI threats remain little studied.The cited graph autoencoder learns spatio-temporal features across topology realizations to improve generalization to unseen attacks.Source: §2 · p. 2
  • The paper’s non-adaptive FDI scenarios are system-driven, reflecting participant roles, interactions, operating ranges, power balance, and measurement or control manipulations.The authors distinguish these attacks from attacks designed to exploit a particular prediction model.Source: §2 · p. 3

3 System model

The system model combines grid physics with price-based demand response, using local frequency as an indicator of generation-demand balance. Stability is assessed around the synchronous operating point, while the model receives operational parameters rather than characteristic roots.

3 System model

  • Local frequency indicates generation-demand balance, and its signal adjusts electricity prices so producers and consumers can respond without centralized price computation.A frequency drop indicates insufficient generation; a rise reflects excess supply.Source: §3 · p. 3
  • Local stability depends on reaction times, nominal powers, and price-response coefficients and is assessed around the synchronous operating point using the linearized model’s characteristic equation.Characteristic roots are not supplied to the model during training or inference; it receives only operational parameters.Source: §3 · p. 3
  • The four-participant DSGC system contains one producer and three consumers, with producer-consumer links forming a star and no direct consumer-to-consumer interactions.Each configuration contains reaction-time, power, and price-response variables for the participants.Source: §3 · p. 3
  • The detector uses the same learned risk score to identify either physical instability or manipulated system information.The represented configuration includes reaction-time, power, and price-response variables.Source: §3 · p. 3

4 Threat Model

The threat model targets integrity attacks on reported DSGC parameters before a stability monitor processes them. It considers multiple attacker capabilities and treats both instability concealment and false alarms as objectives.

4 Threat Model

  • An attacker may compromise the measurement or reporting path and tamper with configuration values before the monitoring system processes them.The model includes instrumentation compromise, substation communication weaknesses, and man-in-the-middle interception.Source: §4 · p. 3
  • Attackers may alter reaction time, power, or price-response reports at inference time, from a single parameter to coordinated changes across participants.They are not assumed to modify training data, detector parameters, thresholds, or stability labels.Source: §4 · p. 3
  • Capability profiles range from black-box generic attacks to grey-box balance-preserving and replay attacks, plus a constrained adaptive attacker limited to one participant’s reaction time and price response.The adaptive attacker can submit a limited number of candidates and observe binary alarm responses, but has no access to the detector’s continuous score or threshold.Source: §4 · p. 3
  • The primary objective is to conceal an unreliable configuration as normal, while a secondary objective is to make stable configurations appear abnormal.The detector maps both genuine instability and attacked reports to one abnormal class because manipulated reports cannot be trusted as evidence of safe operation.Source: §4 · p. 4
  • None of the attack samples are used to train the detector or construct pseudo-negatives, so evaluation tests detection of unseen manipulations using stable training data and encoded physical structure.Source: §4 · p. 4

5 False Data Injection Attacks

The study evaluates nine non-adaptive FDI scenarios spanning DSGC-specific parameter and power manipulation, coordinated attacks, load redistribution, and replay. It also tests a constrained adaptive attacker that attempts to conceal unstable operation.

5 False Data Injection Attacks

  • Nine non-adaptive FDI scenarios cover parameter bias, power manipulation, participant compromise, coordinated manipulation, load redistribution, and replay-style substitution.Attacks are generated at inference time, independently of the detector, with manipulated values restricted to admissible feature ranges from clean training data.Source: §5 · p. 4
  • The first six attacks use generic DSGC-specific manipulations, while the remaining three adapt established load-redistribution and replay patterns.The scenarios range from isolated parameter falsification to coordinated, constraint-preserving manipulation.Source: §5 · p. 4
  • A constrained adaptive attacker compromises one participant and changes only reaction-time and price-response reports, using up to 26 binary-alarm queries to conceal an unstable point.The attacker lacks access to the model, risk score, and threshold; mutable features stay within admissible bounds and may deviate by at most 50% of their training-derived range.Source: §5 · p. 4

6 Methodology

StarGNN trains on stable configurations and physics-constrained pseudo-negatives, representing each configuration as a producer–consumer star graph. Its risk score and threshold are used for both instability prediction and unseen-attack detection.

6 Methodology

  • The pipeline generates physics-constrained pseudo-negatives from stable configurations, processes both as star graphs, and applies one stable-validation-calibrated threshold to instability prediction and unseen-attack detection.The training objective combines separation, ranking, compactness, and variance terms.Source: §6 · p. 4

6.1 Stable-Only Data Preparation

  • Only stable configurations enter model development; unstable configurations are held out for final evaluation, while stable samples are split 60%/20%/20% into training, validation, and testing.The final stability test combines held-out stable samples with all available unstable samples; attacks are generated from held-out stable configurations.Source: §6.1 · pp. 4–5

6.2 Physics-Constrained Pseudo-Negative Generation

  • Pseudo-negatives perturb reaction-time parameters, price-response coefficients, or both, without intentionally changing nominal power.They preserve admissible parameter limits and producer–consumer power balance, provide contrast for boundary learning, and are not ground-truth unstable samples; 16 variants are stored per stable training configuration.Source: §6.2 · pp. 5–6

6.3 Topology-Aware Graph Representation

  • Each 12-dimensional configuration is reorganized into a four-node star graph, preserving the producer–consumer interaction pattern rather than treating variables as unrelated features.The producer occupies the first row and the three consumers the remaining rows; each node groups standardized reaction time, nominal power, and price response.Source: §6.3 · p. 6

6.4 StarGNN Risk Model

  • StarGNN uses role-aware message passing: the producer receives information from all three consumers, while each consumer receives information only from the producer.Graph aggregation retains the producer embedding separately and combines it with mean and element-wise maximum consumer pooling, preserving the producer's central role and the strongest consumer response.Source: §6.4 · pp. 6–7
  • The model maps the graph representation to an embedding and scalar risk logit; larger logits indicate a stronger instability cue relative to stable training configurations.The logit is used directly as the score, not converted to a probability at inference.Source: §6.4 · p. 7

6.5 Stable-Only Training Objective

  • The stable-only objective combines binary separation, paired ranking, stable-embedding compactness, and a variance floor to limit representation collapse.The ranking term encourages each pseudo-negative to score at least 1 above its paired clean configuration; only stable embeddings are pulled toward the stable center.Source: §6.5 · p. 7
  • A single threshold is calibrated from held-out stable scores alone and used for both tasks; neither unstable nor attacked samples influence its value.The implemented threshold is the 0.90 quantile, corresponding to approximately 10% of stable validation configurations above threshold when scores are untied.Source: §6.5 · p. 8

7 Evaluation

The evaluation uses an augmented four-node DSGC dataset and assesses attack impact on a supervised predictor before testing StarGNN’s stability detection and response to unseen FDI attacks. StarGNN retains strong instability detection under non-adaptive attacks, while detection of attacks on stable configurations varies by manipulated feature and declines against adaptive feedback.

7.1 Dataset

  • The augmented dataset contains 60,000 simulated configurations of a four-node DSGC system: 21,720 stable and 38,280 unstable, with no attack samples.FDI scenarios are generated separately and excluded from StarGNN training.Source: §7.1 · p. 8

7.2 Attack Impact Evaluations

  • 48.43% of initially correct unstable MLP predictions flip to stable under coordinated FDI, while price-response bias causes the largest stable-to-unstable flip rate at 27.65%.Power-profile attacks have smaller effects: power imbalance produces flip rates of 1.73% and 1.70%, and balance-preserving power, load redistribution, and local load redistribution remain close to or below 1%.Source: §7.2 · pp. 8–9, Table 3 · p. 9

7.3 StarGNN Stability Prediction Evaluation

  • 0.989 accuracy, 0.970 macro F1-score, and 0.999 ROC AUC are reported for StarGNN’s stability prediction.The model uses stable samples and physics-constrained pseudo-negatives, and the threshold is calibrated from the 0.90 quantile of stable validation scores; 0.993 standardized partial ROC AUC is reported for FPR ≤0.05.Source: §7.3 · p. 9

7.4 Unseen FDI Attack Detection Results

  • 0.973 attack recall for price-response bias and 0.971 for coordinated FDI are the strongest reported detections on clean stable configurations.Power imbalance and local load redistribution are harder cases, with attack recalls of 0.780 and 0.793; balance-preserving power reaches 0.867.Source: §7.4 · p. 10, Table 4 · p. 10
  • Above 97% unstable recall remains under all nine non-adaptive attacks applied to unstable configurations.Reaction-time bias has the lowest reported recall at 0.972; coordinated FDI retains 0.980, node takeover 0.985, and replay substitution 0.987.Source: §7.4 · p. 10, Table 5 · p. 10
  • With 25 additional binary-alarm queries, adaptive concealment lowers unstable recall to 0.899, while the ROC AUC remains 0.975.The adaptive setting assumes repeated modified reports and observable binary alarms; the authors frame it as a stress test rather than an always-available capability.Source: §7.4 · pp. 10–11

8 Discussion

StarGNN maintains strong anomaly-score rankings across instability, stable-origin attacks, and attacked unstable configurations. Ablations identify pseudo-negatives as the main source of boundary contrast, while the graph structure and threshold choice also matter.

8.1 Ablation Study

  • At α=0.90, clean stability prediction has macro F1-score 0.970, generic attacks mean recall 0.988, literature-inspired attacks mean recall 0.995, and the adaptive attack recall is 0.899.Fixed unseen attacks remain detectable across most examined thresholds, while the adaptive attack is more sensitive to increasingly permissive thresholds.Source: §8.1 · p. 11
  • Removing pseudo-negatives drops macro F1-score from 0.970 to 0.092 and ROC AUC from 0.999 to 0.494, leaving the model unable to distinguish unseen unstable configurations from stable ones.Without pseudo-negatives, stable-only training does not supply enough information to identify which departures should receive higher risk scores.Source: §8.1 · p. 11
  • The parameter-matched MLP reaches macro F1-score 0.920 versus StarGNN’s 0.970 despite using the same twelve features, pseudo-negatives, and loss terms.The comparison supports preserving producer–consumer structure rather than treating participant variables as an unstructured vector.Source: §8.1 · p. 11
  • Removing the ranking term lowers macro F1-score to 0.964 and ROC AUC to 0.998; its pairwise loss encourages each pseudo-negative to score higher than its source stable configuration.Binary separation already distinguishes stable samples from pseudo-negatives, while ranking adds a smaller consistent improvement.Source: §8.1 · p. 11

8.2 Comparison with Stable-Only Baselines

  • 0.999 ROC AUC for genuine instability, 0.955 for stable-origin attack detection, and 0.993 for attacked unstable configurations show strong score ordering across all three settings.These are StarGNN’s results in the threshold-independent comparison with stable-only baselines.Source: Table 7 · p. 12, §8.2 · p. 12
  • Conventional stable-only baselines exclude unstable and attacked data from training and calibration, and are not given StarGNN’s physics-constrained pseudo-negatives.Higher unstable-origin than stable-origin attack AUC for some baselines can reflect visible physical abnormality, not stronger identification of injected manipulation.Source: §8.2 · p. 12

8.3 Computational Complexity

  • For fixed layer count and hidden dimension, star-graph message passing scales linearly with participant count, and shared transformations keep model size independent of that count.Message aggregation is O(LVH), with no all-pairs node interaction; the per-configuration forward cost is O(LVH^2 + LVH).Source: §8.3 · p. 12

9 Conclusion

The conclusion presents StarGNN as a stable-only framework using one model and threshold for stability prediction and unseen-attack detection. Its results are validated on a four-node benchmark, and the authors identify larger-system validation as future work.

9 Conclusion

  • StarGNN uses stable configurations and physics-constrained pseudo-negatives to learn a single risk score while preserving producer–consumer structure.The conclusion states that the same score performs well on stability prediction and provides acceptable detection across the nine unseen attacks in the threat model.Source: §9 · pp. 12–13
  • The evaluated DSGC benchmark contains one producer and three consumers, so the reported detection results are validated only in this four-node setting.The authors note that larger systems may contain operating patterns and attack interactions absent from the available benchmark; larger-scale validation is future work.Source: §9 · p. 13

A Open Science

B StarGNN framework details

  • The framework trains on stable and pseudo-negative four-node star graphs, then calibrates a test threshold using validation data from the same stable and pseudo-negative sample dataset.Its training objectives include separation and ranking loss, SVDD compactness, and regularization.Source: B StarGNN framework details · p. 14

C Detailed FDI Attack Construction

The appendix describes how attacks are constructed after the model and threshold are fixed, with reported values constrained to admissible bounds.

C Detailed FDI Attack Construction

C.1 Non-Adaptive FDI Attacks

The non-adaptive attack constructions manipulate reported reaction-time, price-response, and power variables, sometimes coordinating changes across feature groups. Several designs preserve basic power-balance consistency, while others model participant-report compromise or unbalanced consumer reports.

C.1 Non-Adaptive FDI Attacks

  • Reaction-time bias falsifies participants’ reported response-time behavior through the reaction-time parameter, adapting a time-delay attack idea to a dataset without packet-level delays.Source: §C.1 · p. 14
  • Price-response bias changes reported participant responses to frequency-dependent prices, altering how economic-control behavior is presented to the monitoring system.Source: §C.1 · p. 14
  • Power-imbalance attacks modify consumer-power reports while leaving producer power unchanged, without coordinating changes to preserve producer–consumer balance.The construction is related to load-altering attacks.Source: §C.1 · p. 15
  • Balance-preserving power attacks modify consumer-power values and recompute producer power; the reaction-time attack’s manipulated report also remains consistent with the basic power-balance relation.Source: §C.1 · p. 15
  • A node-takeover attack changes all three reported attributes—reaction time, price response, and power—for one participant, modeling compromise of its reporting unit.Source: §C.1 · p. 15
  • Coordinated FDI combines reaction-time and price-response manipulation with either power-imbalance or balance-preserving power attacks, spanning control-related and power-related variables.Source: §C.1 · p. 15

C.2 Literature-Inspired FDI Scenarios

The section operationalizes literature-inspired FDI scenarios through static manipulations of reported loads and participant attributes. The attacks include demand redistribution and replay-style substitution using attributes observed in clean operation.

C.2 Literature-Inspired FDI Scenarios

  • Before boundary clipping, the load-redistribution attack preserves aggregate consumer demand while changing its distribution across participants.It models an attacker attempting to hide manipulation at the aggregate-demand level while altering local reports.Source: §C.2 · p. 15
  • The local attack modifies one or two consumer-power reports, adjusts another in the opposite direction, and approximately preserves total consumer demand.Producer power is recomputed after the redistribution.Source: §C.2 · p. 15
  • Because the dataset contains static configurations rather than temporal sequences, direct temporal replay is not implemented.Instead, one participant’s complete reported attribute vector is replaced with attributes from another clean stable configuration; the remaining participants retain their original values.Source: §C.2 · p. 15
  • Replay-style substitution combines individually valid values observed in clean operation, but the substituted participant may be inconsistent with the rest of the current configuration.The static replay adaptation changes one participant’s attributes while leaving the others unchanged.Source: §C.2 · p. 15

C.3 Adaptive Single Node Concealment Attack

The adaptive attacker seeks to conceal an unstable operating point by changing only one participant’s reaction-time and price-response reports. Its search uses binary alarm feedback and bounded perturbations; the section also reports threshold-sensitivity analyses for several detection settings.

C.3 Adaptive Single Node Concealment Attack

  • The attacker searches for a manipulated report of an unstable point that does not trigger the StarGNN abnormality alarm.Only one participant’s reaction-time and price-response reports are mutable; power reports and other participants’ attributes remain unchanged.Source: §C.3 · p. 15
  • Each mutable feature may change by at most 50% of its training-derived range, with candidate values clipped to admissible feature bounds.The allowed change is defined relative to the corresponding training-derived feature range.Source: §C.3 · p. 15
  • The attacker has no access to StarGNN’s architecture, parameters, risk score, gradients, or threshold, and receives only binary alarm feedback.Its randomized search combines local exploration around the retained candidate with global exploration over the admissible region, using at most 26 evaluations per attacked sample.Source: §C.3 · p. 16
  • Among alarm-free candidates, the attacker retains the one with the largest normalized displacement from the original unstable configuration.The search favors candidates differing as much as possible within the allowed single-participant perturbation region.Source: §C.3 · p. 16
  • Figure 5 shows the distribution of paired risk-score increases s(ex) − s(x) for pseudo-negatives.Source: Figure 5 · p. 17
  • Figure 6 reports threshold sensitivity for clean stability prediction and three attack settings, with the selected operating point at α=0.90.The adaptive attack is regenerated independently at each threshold using the corresponding binary detector feedback.Source: Figure 6 · p. 17, §C.3 · p. 17

Related papers

Loading 2609.35506v1…