PaperlayerView exact revision on arXiv

Source-linked AI summary

Exposing Noise-Deficiency Signatures of Deep Learning-Based False Data Injection Attacks Through AC State Estimation

Yichen Liu, Hongyu Wu, Bo Liu

arXiv:2610.31799v1eess.SYcs.SY

TL;DR

DL-based FDI attacks can resemble normal measurements and evade conventional detectors, leaving their residual-space signatures insufficiently understood. This paper analyzes deficient residual variation and tests detection methods using SE residuals. On IEEE 14-bus and 118-bus systems, a label-free two-sided test detects up to 99% of attacks, while BDD detects at most 5%.

  • Problem

    DL attacks can resemble normal measurements and evade conventional BDD and measurement-space detectors, while their residual-space signatures remain insufficiently understood.

    Source: §I · pp. 1–2

  • Method

    The paper characterizes residual-space variation under local SE conditions and examines label-free residual-energy testing and supervised detection using full residual vectors.

    Source: §I · p. 2, B. Conditions for the Signature · p. 3

  • Results

    On IEEE 14-bus and 118-bus systems, the label-free two-sided test detects up to 99% of attacks at about the same false-alarm rate on normal measurements, while BDD detects at most 5%.

    Source: B. Attack Effectiveness Against… · p. 6, 1) Detectability · p. 7, §V · p. 10

  • Takeaways & Limitations

    Residual energy already contains a strong attack signature that conventional upper-tail BDD does not exploit.

    Source: 1) Detectability · p. 7

    The residual-variation deficiency is a tendency under the stated assumptions, not a guarantee for every trained generator.

    Source: C. Origin of the Signature · p. 4

Abstract

from arXiv · show

Deep learning (DL)-based false data injection (FDI) attacks can resemble normal measurements and evade both conventional bad data detection (BDD) and measurement-space data-driven detectors. This paper identifies a previously overlooked signature of such attacks in state-estimation (SE) residual space. The residuals of reconstruction-based DL attacks exhibit deficient stochastic variation, manifested as abnormally small residual energy and reduced directional dispersion. We establish the conditions under which this signature emerges and explain why the attacks carrying it can evade conventional BDD. We show that SE can reveal residual-space differences obscured by operating-state variation in measurement space. We then explain the origin of the signature through the noise-suppression mechanism of DL attack generation. A generator can learn the reproducible structure of historical measurements but cannot reproduce stochastic measurement components that are unpredictable from its input. This signature enables label-free detection using a simple two-sided test on the conventional BDD statistic, while the full residual vector can also be exploited when labeled attack samples are available. Experiments on the IEEE 14-bus and 118-bus AC systems show that the label-free test detects up to 99% of three representative DL attacks at a false-alarm rate comparable to that of BDD, which detects at most 5%. Ablation studies further examine the effects of residual representation, decision rule, and measurement-noise magnitude and distribution.

I. INTRODUCTION

Conventional BDD and measurement-space detectors can miss DL-based FDI attacks that resemble normal measurements, and the statistical signatures of these attacks in SE residual space remain underexplored. The paper identifies deficient residual variation as a detectable signature and investigates its origin and use.

I. INTRODUCTION

  • Classical BDD can miss attacks that do not inflate residual statistics, while measurement-space detectors target distribution shifts in raw measurements.Classical FDI attacks can evade BDD but may shift measurements away from the normal operating distribution.Source: §I · p. 1
  • DL attacks learn from historical SCADA measurements to stay close to normal-operation distributions, reducing their dependence on explicit system knowledge.Unlike classical FDI attacks, they need not be constructed from an explicit system model.Source: §I · p. 1
  • Although DL attacks have advanced to nonlinear AC systems, their residual-space signatures and potential for detection without labeled attacks or generator knowledge remain unclear.Prior studies report unusually low BDD statistics, but their statistical implications remain largely unexplored.Source: §I · pp. 1–2
  • The paper identifies deficient stochastic variation in SE residuals of DL attacks that evade BDD and measurement-space detectors.The deficiency appears as low residual energy and reduced directional dispersion, which operating-state variation can obscure in measurement space.Source: §I · p. 2
  • The paper explains the signature through conditional-mean reconstruction and evaluates label-free residual-energy tests and supervised classifiers on full residual vectors.The study also examines residual representation, decision rules, and measurement-noise conditions.Source: §I · p. 2

A. AC State Estimation

AC state estimation uses SCADA measurements and a nonlinear power-flow model to estimate the operating state. Bad data detection evaluates post-estimation residuals, including through a weighted-residual χ2 test.

A. AC State Estimation

  • SCADA measurements comprise bus injections, branch flows, and voltage magnitudes, related to the system state through a nonlinear AC power-flow mapping with additive measurement noise.The noise is modeled as zero-mean Gaussian with diagonal covariance.Source: A. AC State Estimation · p. 2
  • Weighted-least-squares state estimation solves the measurement model iteratively, typically using Gauss–Newton, and supplies estimates to downstream energy-management applications.Those applications include contingency analysis, optimal power flow, and economic dispatch.Source: A. AC State Estimation · p. 2

B. Bad Data Detection

  • The post-estimation residual measures the discrepancy between observed and model-reconstructed measurements, and BDD tests it for inconsistencies.The widely used χ2 test evaluates the weighted residual norm; under Gaussian noise, that statistic approximately follows a χ2 distribution with m − n degrees of freedom.Source: B. Bad Data Detection · p. 2

C. DL Attacks

The paper studies reconstruction-based DL attacks and identifies a residual-space signature: their residuals show deficient variation, which state estimation can expose even when operating-state variation obscures differences in measurement space. The section characterizes conditions for this signature and explains its relation to BDD detection.

C. DL Attacks

  • DL attacks replace legitimate measurements with values synthesized from historical SCADA data, and the threat model excludes attackers who adapt to residual-space detection.The attacker is assumed to lack the system model, line parameters, and the operator’s state-estimation solver.Source: C. DL Attacks · p. 3
  • The DNN completion, autoencoder reconstruction, and RL-GAN attacks all generate measurements through mappings trained with squared reconstruction loss.Their architectures and training procedures differ; the section examines their shared reconstruction property as an origin of the signature.Source: C. DL Attacks · p. 3

A. Residual-Space Signature

  • DL attacks exhibit abnormally small residual energy and reduced directional dispersion, a residual-space signature reflected in low BDD statistics and lower effective covariance rank.The scalar BDD statistic captures residual energy, while the full residual covariance reflects directional dispersion.Source: A. Residual-Space Signature · p. 3

B. Conditions for the Signature

  • State estimation removes first-order state variation from residuals, leaving normal residuals driven by meter noise and attacked residuals by the generator-output remainder.The attacked remainder includes retained meter-noise variation and reconstruction errors; only its projection through S enters the residual.Source: B. Conditions for the Signature · p. 3
  • When an attack reproduces normal operating-state variation but is noise-deficient along a residual-sensitive direction, its residual variance is lower than normal.The local model’s noise-deficiency condition compares variation in the attacked remainder with meter noise; reduced covariance can keep upper-tail BDD detection probability no higher than for normal measurements under the stated assumptions.Source: B. Conditions for the Signature · pp. 3–4
  • Operating-state variation can obscure noise-covariance differences in measurement space, where the variance ratio approaches 1 along state-dominated directions, while residuals expose the deficiency.This does not imply identical measurement distributions.Source: B. Conditions for the Signature · p. 4

C. Origin of the Signature

Squared-loss reconstruction can suppress measurement-noise variation that is unpredictable from a generator’s input, producing deficient variation in SE residuals. Under stated Gaussian and covariance assumptions, that deficiency explains why upper-tail BDD may miss attacks.

C. Origin of the Signature

  • Conditional-mean reconstruction suppresses meter-noise covariance unpredictable from the generator input, creating residual variation deficiency along residual-sensitive directions.Under the local model, the projected reconstruction error can also shift the residual mean or add covariance, offsetting that deficiency.Source: C. Origin of the Signature · p. 4
  • For DNN attacks, unobserved-channel noise satisfies the deficiency condition in contributing residual directions; AE compression does not guarantee it, and RL-GAN codes may leave the training distribution.The conditional-mean analysis explains the mechanism but does not guarantee the signature for every attack.Source: C. Origin of the Signature · p. 4
  • A trained generator’s reconstruction error can offset noise-suppression deficiency; during training, residual energy may move from above to below the normal range as reconstruction improves.The deficiency is a tendency under the stated assumptions, not a guarantee for every trained generator.Source: C. Origin of the Signature · p. 4
  • Under the local residual model, zero attacked-residual mean, covariance ordering, and Gaussian residuals, upper-tail BDD detection probability is at most its false-alarm rate.The result does not automatically apply when reconstruction-based attack residuals are non-Gaussian.Source: C. Origin of the Signature · p. 4
  • Residual bias may offset covariance reduction; for unbiased attacks, uniform covariance reduction lowers expected residual energy without changing effective rank.Reduced effective ranks therefore reflect nonuniform changes in residual covariance.Source: C. Origin of the Signature · p. 5

D. Signature-Based Defense

The defense uses residual energy for a label-free two-sided test and retains the full residual vector for supervised detection when attack labels are available. These choices target the signature’s low energy and directional information, respectively.

D. Signature-Based Defense

  • Earlier residual-based FDI detectors used distributional similarity, neural networks, or Mahalanobis scoring, but did not explicitly target deficient stochastic variation in DL attacks.Standard label-free outlier scores may rank concentrated attack residuals as more normal, leaving a concentration-sensitive vector detector for future work.Source: D. Signature-Based Defense · p. 5
  • A label-free two-sided test on residual energy uses normal validation data to set empirical lower and upper thresholds at the target false-alarm rate.Its lower threshold targets deficient residual energy, while its upper threshold retains sensitivity to excessive energy.Source: D. Signature-Based Defense · p. 5
  • A supervised classifier on the full residual vector can use directional and cross-channel information discarded by the scalar energy statistic.It requires labeled attack samples; both evaluated detectors use the measurement model, noise covariance, and SE solver already required by BDD.Source: D. Signature-Based Defense · p. 5

IV. EXPERIMENTS

The experiments evaluate the residual-space signature and its detectability on two IEEE AC systems against three DL attacks.

IV. EXPERIMENTS

  • The evaluation uses IEEE 14-bus and 118-bus AC systems and tests DNN, AE, and RL-GAN attacks.The attacks are identified as DNN, AE, and RL-GAN.Source: §IV · p. 5
  • The evaluation first presents its setup and protocol, then tests attacks against existing defenses and evaluates label-free signature detection.The label-free evaluation also verifies and quantifies the signature.Source: §IV · p. 5
  • A further analysis examines residual representation, decision rule, and measurement-noise conditions.Source: §IV · p. 5

A. Experimental Setup

Experiments use IEEE 14-bus and 118-bus AC systems with fixed SCADA measurement configurations. Normal snapshots are generated from scaled ERCOT load profiles, then partitioned for training, validation, and testing.

A. Experimental Setup

  • Experiments use IEEE 14-bus and 118-bus AC systems with measurement and state dimensions of (68, 27) and (591, 235), respectively.Each system uses a fixed measurement configuration across snapshots, attacks, and random seeds.Source: A. Experimental Setup · p. 5
  • 8000 normal snapshots per system are generated from scaled ERCOT load profiles, AC power-flow solutions, and measurement noise set to 1% of each channel’s nominal magnitude.Snapshots support attack-model training, residual calibration, and detector evaluation.Source: A. Experimental Setup · p. 5
  • Each system’s normal data are split into 5600 training, 1200 validation, and 1200 test samples, with 1200 test samples per attack set.Validation is reserved for threshold calibration and hyperparameter tuning; detector labels come only from training data.Source: A. Experimental Setup · p. 5
  • Ablations compare residual-space outlier detectors and supervised classifiers trained separately by system and attack, using 100 labels per class for supervised models.Supervised results average five seeds; the classical-FDI-trained detector uses SVM, XGBoost, and MLP classifiers.Source: A. Experimental Setup · p. 6

B. Attack Effectiveness Against Existing Defenses

The studied DL attacks largely evade conventional BDD and transfer inconsistently to a detector trained on classical FDI attacks. A label-free two-sided test on residual energy detects them substantially more often than BDD at similar false-alarm rates.

B. Attack Effectiveness Against Existing Defenses

  • BDD detects only 0.01–0.05 of the three DL attacks on both systems, near its normal-measurement false-alarm rates of 0.045 and 0.044.The classical-FDI-trained detector also transfers inconsistently: its MLP scores 0.00 on all six attacks, while XGBoost reaches F1 values of 0.52–0.69.Source: B. Attack Effectiveness Against… · p. 6, Table IV · p. 6
  • Every 14-bus AE-attack snapshot has post-SE deviation greater than input perturbation, with a median ratio of 1.38.The reported example shows that the attack shifts the SE output at least as much as it perturbs measurements.Source: B. Attack Effectiveness Against… · p. 6, Figure 1 · p. 6

1) Detectability:

  • 0.89–0.99 of the six attack configurations are detected by the two-sided test, versus at most 0.05 by BDD, with false-alarm rates of 0.040 and 0.041 on the 14-bus and 118-bus systems.The lower threshold accounts for 0.87–0.98 of detections; the upper threshold flags at most 0.05.Source: Table V · p. 6, 1) Detectability · p. 7

2) Signature:

Across all six configurations, attacked residual energy is concentrated below normal levels. During training, attacks move from high to low residual energy as BDD detection falls, while two-sided detection remains effective when BDD approaches its false-alarm rate.

2) Signature:

  • Attacked residual-energy distributions shift toward lower values in every configuration, with median J reduced by a factor of 4.0–44.4.This lower-tail departure contrasts with the elevated residual energy targeted by conventional BDD.Source: 2) Signature · p. 7

3) Training Dynamics:

  • As AE and DNN training progresses, attack residual energy moves from abnormally high to low while BDD detection declines; at later checkpoints, median J values are 10.5 and 9.7 versus a normal 5th percentile of 27.0.At epochs 2830 (AE) and 35000 (DNN), BDD detection falls to 0.04 and 0.05.Source: 3) Training Dynamics · p. 7, Figure 3 · p. 8, Table VI · p. 8
  • When BDD detection reaches the normal false-alarm rate, two-sided detection is 0.75 (AE) and 0.89 (DNN), with no observed early-stopping window that evades both tests.At minimum two-sided detection, only 0.39 (AE) and 0.34 (DNN) of attacks fall within the stated normal J range, while BDD still detects 0.18 and 0.37.Source: 3) Training Dynamics · p. 7, Figure 3 · p. 8, Table VI · p. 8

4) Quantification:

The residual signature combines lower residual energy with reduced directional dispersion. In supervised ablations, residuals outperform raw measurements across configurations and classifiers, with an SVM achieving uniformly high detection on residuals.

4) Quantification:

  • Across all six configurations, median attack J is 4.0–44.4 times smaller than normal, and effective rank falls from 7.7 to 1.6–5.1 on 14-bus and from 69.1 to 1.2–2.8 on 118-bus.The lower-threshold test flags 0.87–0.98 of attacked measurements.Source: 4) Quantification · p. 8

1) Representation:

  • Residual-based F1 exceeds raw-measurement F1 by 0.08–0.40 in every configuration, rising from 0.54–0.88 on z to 0.87–0.96 on r.Averaged over six configurations, F1 rises from 0.67 to 0.99 for SVM, from 0.82 to 0.85 for MLP, and from 0.93 to 0.96 for XGBoost.Source: 1) Representation · p. 8, Figure 4 · p. 8, Table VIII · p. 9
  • On residuals, an SVM reaches at least 0.983 for every attack and system, whereas no classifier detects all six attacks reliably on raw measurements.On raw measurements, XGBoost reaches at least 0.960 in four configurations, while SVM ranges from 0.51 to 0.80.Source: 1) Representation · p. 9

2) Decision Rule:

The label-free two-sided test detects up to 99% of attacks at about BDD’s false-alarm rate, while BDD detects at most 5%. Noise tests show strong detection across tested magnitudes and distributions, and supervised residual detection complements the test under non-Gaussian and correlated noise.

2) Decision Rule:

  • The label-free two-sided test detects 0.89–0.99 of attacks, while supervised residual classifiers achieve mean F1 scores of 0.87–0.96.The two-sided test requires neither labeled attacks nor attack-specific training.Source: 2) Decision Rule · p. 9
  • Full-residual outlier detectors detect at most 0.005 of attacks for IF and at most 0.06 for one-class SVM and autoencoders, near their 5% normal-snapshot flag rate.The passage concludes that statistical distinguishability alone does not ensure detection; the decision rule must match the signature’s direction.Source: 2) Decision Rule · p. 9

3) Noise Magnitude and Shape:

  • At Gaussian noise levels of 0.5%–3%, the two-sided test detects 0.977–1.000 of attacks at a 0.052 false-alarm rate.Performance is reported as stable across the tested noise magnitudes.Source: 3) Noise Magnitude and Shape · p. 9
  • Across Laplace, Student-t3, uniform, and correlated noise, the two-sided test detects 0.704–0.882 of attacks with false-alarm rates of 0.043–0.064.Heavy-tailed and correlated noise yield the lowest detection rates; calibrating thresholds on normal data for each condition keeps false alarms near target.Source: 3) Noise Magnitude and Shape · p. 9
  • With 100 labeled samples per class, supervised residual detection reaches 0.988–0.999 across tested noise conditions, complementing the test under non-Gaussian and correlated noise.Its false-alarm rates are higher, at 0.062–0.098; both residual-space detectors exceed BDD, which detects at most 0.055 of attacks.Source: 3) Noise Magnitude and Shape · p. 9

V. CONCLUSION

  • The signature is deficient residual-space variation, appearing as reduced residual energy and directional dispersion, and can support label-free or supervised detection.The paper traces it to conditional-mean reconstruction suppressing unpredictable meter-noise components exposed by SE; when residual bias is small, BDD detection can fall to or below its normal-data false-alarm rate.Source: §V · p. 9
  • BDD detects at most 5% of attacks, while the label-free two-sided test detects up to 99% at about the same false-alarm rate on normal measurements.Experiments cover IEEE 14-bus and 118-bus systems and DNN, AE, and RL-GAN attacks.Source: §V · p. 10
Loading 2610.31799v1…