A Framework for Detecting False Data Injection Attacks in Large-Scale Wireless Sensor Networks.

False data injection attacks (FDIAs) on sensor networks involve injecting deceptive or malicious data into the sensor readings that cause decision-makers to make incorrect decisions, leading to serious consequences. With the ever-increasing volume of data in large-scale sensor networks, detecting FDIAs in large-scale sensor networks becomes more challenging. In this paper, we propose a framework for the distributed detection of FDIAs in large-scale sensor networks. By extracting the spatiotemporal correlation information from sensor data, the large-scale sensors are categorized into multiple correlation groups. Within each correlation group, an autoregressive integrated moving average (ARIMA) is built to learn the temporal correlation of cross-correlation, and a consistency criterion is established to identify abnormal sensor nodes. The effectiveness of the proposed detection framework is validated based on a real dataset from the U.S. smart grid and simulated under both the simple FDIA and the stealthy FDIA strategies.

Detection of False Data Injection Attacks in Smart Grids Based on Expectation Maximization.

The secure operation of smart grids is closely linked to state estimates that accurately reflect the physical characteristics of the grid. However, well-designed false data injection attacks (FDIAs) can manipulate the process of state estimation by injecting malicious data into the measurement data while bypassing the detection of the security system, ultimately causing the results of state estimation to deviate from secure values. Since FDIAs tampering with the measurement data of some buses will lead to error offset, this paper proposes an attack-detection algorithm based on statistical learning according to the different characteristic parameters of measurement error before and after tampering. In order to detect and classify false data from the measurement data, in this paper, we report the model establishment and estimation of error parameters for the tampered measurement data by combining the the k-means++ algorithm with the expectation maximization (EM) algorithm. At the same time, we located and recorded the bus that the attacker attempted to tamper with. In order to verify the feasibility of the algorithm proposed in this paper, the IEEE 5-bus standard test system and the IEEE 14-bus standard test system were used for simulation analysis. Numerical examples demonstrate that the combined use of the two algorithms can decrease the detection time to less than 0.011883 s and correctly locate the false data with a probability of more than 95%.

False Data Injection Detection for Phasor Measurement Units.

Cyber-threats are becoming a big concern due to the potential severe consequences of such threats is false data injection (FDI) attacks where the measures data is manipulated such that the detection is unfeasible using traditional approaches. This work focuses on detecting FDIs for phasor measurement units where compromising one unit is sufficient for launching such attacks. In the proposed approach, moving averages and correlation are used along with machine learning algorithms to detect such attacks. The proposed approach is tested and validated using the IEEE 14-bus and the IEEE 30-bus test systems. The proposed performance was sufficient for detecting the location and attack instances under different scenarios and circumstances.

A Novel Technique to Detect False Data Injection Attacks on Phasor Measurement Units.

The power industry is in the process of grid modernization with the introduction of phasor measurement units (PMUs), advanced metering infrastructure (AMI), and other technologies. Although these technologies enable more reliable and efficient operation, the risk of cyber threats has increased, as evidenced by the recent blackouts in Ukraine and New York. One of these threats is false data injection attacks (FDIAs). Most of the FDIA literature focuses on the vulnerability of DC estimators and AC estimators to such attacks. This paper investigates FDIAs for PMU-based state estimation, where the PMUs are comparable. Several states can be manipulated by compromising one PMU through the channels of that PMU. A Phase Locking Value (PLV) technique was developed to detect FDIAs. The proposed approach is tested on the IEEE 14-bus and the IEEE 30-bus test systems under different scenarios using a Monte Carlo simulation where the PLV demonstrated an efficient performance.

Artificial intelligence for cybersecurity monitoring of cyber-physical power electronic converters: a DC/DC power converter case study.

Power electronic converters are widely implemented in many types of power applications such as microgrids. Power converters can make a physical connection between the power resources and the power application. To control a power converter, required data such as the voltage and the current of that should be measured to be used in a control application. Therefore, a communication-based structure including sensors and communication links can be used to measure the desired data and transmit that to the controllers. So, a power converter-based system can be considered as a type of cyber-physical system, and it can be vulnerable to cyber-attacks. Then, it can strongly be recommended to use a strategy for a power converter-based system to monitor the system and identify the existence of cyber-attack in the system. In this study, artificial intelligence (AI) is deployed to calculate the value of the false data (i.e., constant false data, and time-varying false data) and detect false data injection cyber-attacks on power converters. Besides, to have a precise technical evaluation of the proposed methodology, that is evaluated under other issues, i.e., noise, and communication link delay. In the case of noise, the proposed strategy is examined under noises with different signal-to-noise ratios . Further, for the case of the communication delay, the system is examined under both symmetrical (i.e., same communication delay on all inputs) and unsymmetrical communication delays (i.e., different communication delay/delays on the inputs). In this work, artificial neural networks are implemented as the AI-based application, and two types of the networks, i.e., feedforward (as a basic type) and long short-term memory (LSTM)-based network as a more complex network are tested. Finally, three important AI-based techniques (regression, classification, and clustering) are examined. Based on the obtained results, this work can properly identify and calculate the false data in the system.

Event-triggered robust distributed output feedback model predictive control for nonlinear MASs against false data injection attacks.

In this paper, an event-triggered distributed output feedback model predictive control scheme for the nonlinear disturbed multiagent systems with sensor-controller channel false data injection attacks is proposed. To provide valid system states to the controller in the event of cyber attacks, a robust multivariate observer is designed to realize the estimation and separation of uncompromised system states, false data injection attacks, and measurement disturbances, simultaneously. Based on these reconstructed signals and a newly-designed linear robustness constraint, the distributed predictive controller is established to achieve smooth cooperative stabilization among agents. Meanwhile, an event-triggered mechanism is applied to save computing resources, and it restricts the error of predictive states and estimated states to guarantee the feasibility of the optimization control problem. Theoretical analyses on robustness and security for the nonlinear multiagent systems under event-triggered distributed output feedback model predictive control are presented. Finally, a simulation on two pairs of one-link flexible joint manipulator systems verifies the theoretical results.

Dynamic event-triggered fuzzy non-fragile control of DC microgrids.

This paper studies the event-triggered fuzzy non-fragile control of uncertain DC microgrids subject to false data injection (FDI) attacks, controller saturation, network delays and premise mismatching. Firstly, a dynamic event-triggered mechanism (ETM) is proposed, which can save more communication bandwidth than the static ETMs, and remove the complex Zeno-free computation required by the continuous-time ETMs. Secondly, a fuzzy time-delay closed-loop system model is established, which provides a unified framework to study the effects of the dynamic ETM, FDI attacks, uncertainties, saturation, delays and premise mismatching. Thirdly, mean-square exponential stability criteria are established, and co-design method for the saturated fuzzy non-fragile (SFNF) controller and the dynamic ETM is presented. Simulation results confirm that the SFNF controller can stabilize the unstable DC microgrid, while the dynamic ETM significantly reduces the triggering rate by 84.98%. Comparisons show that the proposed controller performs better than the non-fragile controller, fuzzy controller and robust linear controller, and the dynamic ETM achieves a lower triggering rate than the static ETMs.

Security correction control of stochastic cyber-physical systems subject to false data injection attacks with heterogeneous effects.

In this paper, the interconnected observer intervention-based security correction control idea is proposed for stochastic cyber-physical systems (CPSs) subjected to false data injection attacks (FDIAs). The FDIAs are injected into the controller-to-actuator channel by the adversary via wireless transmission. In particular, the FDIAs with heterogeneous effects are constructed, which consist of periodic attacks with unknown parameters and bias injection attacks with asymptotic convergence property. A novel interconnected adaptive observer structure is designed to online estimate the heterogeneous attack effects. The security correction control scheme with resilience is presented by integrating interconnected adaptive observer and robust technology. It is demonstrated that the impaired state signals can be corrected and desired security performance can be guaranteed for stochastic CPSs under FDIAs with heterogeneous effects. Finally, two simulation verifications, including a F-16 longitudinal dynamics system controlled by network, are established to verify the validity and feasibility for the presented strategy.

Analysis of false data injection attacks in power systems: A dynamic Bayesian game-theoretic approach.

False data injection (FDI) attack is a malicious kind of cyber attack that targets state estimators of power systems. In this paper, a dynamic Bayesian game-theoretic approach is proposed to analyze FDI attacks with incomplete information. In this approach, players' payoffs are identified according to a proposed bi-level optimization model, and the prior belief of the attacker's type is constantly updated based on history profiles and relationships between measurements. It is proven that the type belief and Bayesian Nash equilibrium are convergent. The stability and reliability of this approach can be guaranteed by the law of large numbers and the central limit theorem. The time complexity and space complexity are O(nmnsnl) and O(1), respectively. Numerical results show that the average success rate to identify at-risk load measurements is 98%. The defender can efficiently allocate resources to at-risk load measurements using the dynamic Bayesian game-theoretic approach.