Detection of False Data Injection Attacks in Smart Grids A Real-Time Principle Component Analysis
Detection of False Data Injection Attacks in Smart Grids A Real-Time Principle Component Analysis
Abstract—False Data Injection (FDI) is one of the most The defense against FDI attacks can be divided into
dangerous attacks on cyber-physical systems as it could lead to protection and detection strategies. The protection strategy is
disastrous consequences in the operation of the power grids. In based on saving the power grid data such as voltage
this paper, a comprehensive investigation of the (FDI) attacks in measurements from being affected by FDI attacks. An
smart grids is presented. A detection algorithm is utilized in example of protection strategy is the power grid measurement
analyzing the FDI attacks in real-time environment based on data redundancy enhancement [7]. Nevertheless, the high
Principle Component Analysis (PCA). It provides an adequate redundancy requirements and unsecured performance under
solution to the FDI problem for its ability to extract information distinct power grid situations are the main limitations of the
about correlation of the collected measurements. This provides
FDI protection strategy [8]. On the other hand, the FDI
a more accurate and sensitive response than the previous FDI
detection techniques. Furthermore, the light computations
detection strategy adopts the Bayesian framework in detecting
associated with this algorithm make it a very good candidate for FDI attacks, which generates a unique pattern in the power
real-time environment testing. The results concluded in the grid data [9]. Nonetheless, if the FDI attacks levels are close
paper illustrate a very promising future for the PCA-based real- to the natural power grid measurements levels, the detection
time FDI attack detection schemes. strategy may not be able to detect them. The common name of
these attacks in the literature is stealthy attacks [8]. This is the
Keywords—Cyber-physical systems, cyber security, false data major limitation of FDI detection strategy.
injection attack (FDIA), phasor measurement units (PMU),
principle component analysis (PCA), real-time implementation, To address the detection of FDI attacks, several studies
smart grid have been carried out using different algorithms and
techniques. Most of these techniques utilize estimation and
I. INTRODUCTION probability theories as presented in [10]. The authors proposed
The recent years have witnessed the introduction of a state estimation-based prediction technique to address the
various smart grid technologies which aim to 1) improve the FDI attacks in [11]. Graphical methods have been introduced
assets of the grid, 2) increase its utilization, 3) raise its in [12] to study defending mechanisms against FDI attacks on
capability to react to and resolve the problems of the grid in a power system state estimation. An integration between
faster and more efficient manner. Though these continually historical and forecasted measurements is presented in [13] in
evolving technologies have opened the door to huge order to enhance the resiliency of smart grids against FDI
advantages to the power grid operations, they have also attacks. Various other techniques have been adopted to detect
created different challenges to the operation of power grids. FDI attacks, such as Kalman filter [14], sparse optimization
The complicated smart grid’s functionalities and structures [15], and machine learning [16]. However, there is still a
necessitate advanced, decentralized, and sophisticated research gap in the area of real-time implementation of the
monitoring and control schemes. These schemes must be proposed methods in the current FDI attack detection
employed to ensure a coherent, smooth, and stable grid techniques. This is due to the massive computations involved
operation [1]. To address these concerns, different information in these techniques as well as the need for the full and accurate
technologies and communication systems have been power grid model parameters.
integrated with the operation of the smart grid. This digital
integration has changed the smart grid into a cyber-physical To bridge the research gap, this paper proposes a new
system, thereby making it prone to vulnerabilities of data detection technique built on the Principle Component
injection attacks. The influence of these attacks is discussed in Analysis (PCA). This technique illustrates the covariance
[2]. In addition, it is found that physical and cyber attacks are structure of a set of measurements through straightforward
highly linked and may be handled together as a single linear combinations. The main features of PCA are: 1)
structure. dimension reduction, and 2) pattern identification of
association among the measurements of a network [17]. PCA
There are various sorts of cyber-physical attacks, and they has been involved deeply in anomaly detection problems in
have different impacts, forms, and types. Some of these many fields such as: Data Mining [18] and Internet of things
attacks are: time synchronization attacks [3], GPS spoofing (IoT) [19]. Through the reduction of the dimension of the
attacks [4], and Denial-of-Service (DOS) attacks [5]. Another measurements, PCA provides a fast and efficient method for
important attack is the false data injection (FDI) attack. In this detecting anomalies (FDI attacks) in an online real-time
attack, false data is injected or manipulated stealthily either in environment [20]. This attribute makes PCA a very attractive
the control loops or system measurements to mutate the grid method for detecting FDI attacks. The main contributions that
behavior [6]. As a result, this attacks would be dangerous to differentiate this paper from previously published works are
the power grid operation, for they are very difficult to reveal. stated as:
2959 on June 05,2024 at 05:09:17 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: University of New South Wales. Downloaded
ALGORITHM 1: PCA-BASED FDI ATTACK DETECTION
Input: Measurements Z
Output: Score of anomalies
Initialization: covariance matrix
1. While new measurements set received, do
2. Calculate the mean
3. for i = 1 – n, do
4. Calculate − − /
5. Add − − / to covariance matrix
6. end for
7. Return covariance matrix
8. Calculate eigenvectors V from =
9. Find the score of anomalies
10. end While
11. Return score of anomalies
2960 on June 05,2024 at 05:09:17 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: University of New South Wales. Downloaded
(a) (a)
(b) (b)
(c) (c)
Fig. 3. Case-I results: (a) Voltage magnitude-based FDI profile, (b) 2-D Fig. 4. Case-II results: (a) Voltage magnitude-based FDI profile, (b) 2-D
principle components representation, (c) Score of anomaly illustration principle components representation, (c) Score of anomaly illustration
1) Case I: FDI in one PMU with different magnitudes: method in detecting even a slight change in the measurement
This case aims at finding the sensitivity of the PCA-based such as 5%.
FDI attack detection towards the different magnitudes of FDI 2) Case II: Two 10% FDI attacks in adjacent PMUs:
attacks. The case introduces 5 FDI attacks at different time The objective of this case is to investigate the response of the
steps of voltage magnitude readings of bus 10. The attacks PCA detection method when multiple adjacent PMUs are
are: 20% increase starting at 4s, 10% decrease starting at 20s, manipulated. This represents a form of stealthy attacks where
5% increase starting at 43s, 10% increase starting at 50s, and the attacker manipulates adjacent PMUs’ readings which
5% decrease starting at 70s. These attacks are illustrated in shall make it harder to detect. To illustrate this, we conducted
Fig. 3 (a). Fig. 3 (b) illustrates the PCA results of the FDI two attacks: the first attack decreases the voltage magnitude
attacks in two principle components space where it is shown by 10% at busses 12, 13, and 14 starting at 22s. The second
that the attacks are situated far from the normal measurement attack injects a 10% increase in voltage magnitudes at busses
points. In Fig. 3 (c), the scores of anomaly are illustrated. The 4, 6, 9, 11, and 13 starting at 50s. These attacks are illustrated
score of anomaly shows that higher magnitude FDI attacks in Fig. 4 (a). Fig. 4 (b) illustrates the PCA results of these two
are easily separated from the normal measurement points. FDI attacks in two principle components space where it is
The results, in this case, show that PCA can be a very
2961 on June 05,2024 at 05:09:17 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: University of New South Wales. Downloaded
two FDI attacks are designed: 5-20% random increase and
decrease in voltage magnitude at all busses starting at 27s and
20% decrease in voltage magnitude at all busses starting at
57s. These attacks are illustrated in Fig. 5 (a). The first FDI
attacks represent the case when the attacker has access to the
whole measurements of the grid, yet he or she does not have
the knowledge of the grid topology; thus, he or she just
changes the measurements randomly. The second FDI attack
illustrates the case when the attacker has the full knowledge
of the grid, and thus he or she creates an attack that mimics
the dynamics of the power grid. Figure 5 (b) illustrates the
PCA results of these two FDI attacks in two principle
components space, and the scores of anomaly are illustrated
(a) in Fig 5 (c). While the first attack is clearly pinpointed, the
second one is not separable from the normal measurement
points. This result is based on the fact that PCA detection
algorithm depends on the correlation between the
measurements points. Thus, if the whole system’s
measurements are changed with the same associated
magnitude, then the correlation between the measurements
will be the same as the normal measurements points, and the
attack will not be separable. This case is considered to be the
most severe case where the full power grid is breached.
C. Relative Comparison
In order to compare the performance of the PCA-based FDI
attacks detection method with other methods, several relative
comparison points are considered as follows:
(b) 1) Detection of stealthy attacks:
PCA-based FDI attacks detection has shown a great
performance in detection such attacks. This makes it one of
the few algorithms that can pinpoint smart stealthy attacks.
Other form of algorithms such as [14] and [15] are not able to
do such work as they do not consider the correlation
information of the measurements collected. Thus, this cannot
be feasible for them. On the other hand, machine learning
based algorithms such as [16] show similar behavior to the
PCA algorithm in detection stealthy attacks.
2) Detection of full system breach:
Full system breach remains the main challenge for almost all
the FDI attack detection algorithms including PCA based
method. However, the main difference here is that PCA
method can identify full system attack if the correlation
(c)
Fig. 5. Case-III Results: (a) Voltage magnitude-based FDI profile, (b) 2-D between the measurements is not the same as the normal
principle components representation, (c) Score of anomaly illustration measurement points even if the whole measurements are
change. Other algorithms fail fully when it comes to detection
clearly shown that the attacks are situated far from the normal any type of full system breaches.
measurements points. In Fig. 4 (c), the scores of anomaly are 3) Scalability:
illustrated. It is clear that both of the attacks were pinpointed This means the ability to perform the detection algorithm in
successfully as they have a much higher score of anomaly large systems. Unlike most of the detection algorithms, PCA
than the normal measurement points. This illustrates the provides a light computational border which makes it
satisfying response of PCA in detecting these kinds of scalable.
stealthy attacks. This represents an advantage of PCA based 4) Real-time compatibility:
detection method. This is the most important attribute because it indicates the
3) Case III: 10% FDI in all PMUs: possibility of conducting the detection algorithm in real time.
This case illustrates the situation when the whole In literature, this is possible only with the machine learning
measurements are being manipulated with FDI attacks. This based algorithms. However, these algorithms require
hints a very high vulnerability of the system as the attacker extensive training to be conducted prior to employment. This
needs to have a full access to the grid and its parameters. Note is not the case with the PCA method. Table 1 illustrates a brief
the test case is designed to analyze an alarming situation. relative comparison of the main FDI attack detection
Else, an attacker having access to full measurement is a algorithms along with the PCA algorithm.
problem of national security. To illustrate this type of attacks,
2962 on June 05,2024 at 05:09:17 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: University of New South Wales. Downloaded
TABLE 1. BRIEF RELATIVE COMPARISON OF DIFFERENT BAD DATA DETECTION ALGORITHMS
Reference Algorithm Detection of Stealthy Attacks Detection of full system breach Scalability Real-Time Compatibility
[14] Kalman Filter Not possible Not possible Not Scalable Not Compatible
Sparse
[15] NA Not possible Not Scalable Not Compatible
Optimization
Compatible with
[16] Machine Learning Possible Not possible Scalable
exhaustive training
The proposed Possible when the system
PCA Possible Scalable Compatible
work dynamics are unknown
[9] H. M. Khalid and J. C.-H. Peng, "A bayesian algorithm to enhance the
IV. CONCLUSION resilience of WAMS applications against cyber attacks," IEEE
Transactions on Smart Grid, vol. 7, no. 4, pp. 2026 - 2037, 2016.
A PCA method for detecting FDI attacks in smart grids is
presented in this paper. This technique utilizes the covariance [10] H. M. Khalid and J. C.-H. Peng, "Immunity toward data-injection
attacks using multisensor track fusion-based model prediction," IEEE
structure of a set of measurements through straight forward Transactions on Smart Grid, vol. 8, no. 2, pp. 697 - 707, 2017.
linear combinations of these measurements. The proposed [11] A. S. Musleh, H. M. Khalid, S. M. Muyeen and A. Al-Durra, "A
scheme is implemented for the first time, to the best of the prediction algorithm to enhance grid resilience toward cyber attacks in
authors’ knowledge, in a real-time environment. The method WAMCS applications," IEEE Systems Journal, vol. 13, no. 1, pp. 710-
efficacy is investigated using different case studies. The 719, 2019.
results presented in case studies show the effectiveness of this [12] S. Bi and Y. J. Zhang, "Graphical methods for defense against false-
method in FDI detection. Nevertheless, the method has a data injection attacks on power system state estimation," IEEE
limitation in detecting attacks when all measurements are Transactions on Smart Grid, vol. 5, no. 3, pp. 1216 - 1227, 2014.
affected at the same time. Future studies will focus on finding [13] A. Ashok, M. Govindarasu and J. Wang, "Cyber-physical attack-
solutions to overcome this drawback possibly by integrating resilient wide-area monitoring, protection, and control for the power
grid," Proceedings of the IEEE, vol. 105, no. 7, pp. 1389 - 1407, 2017.
both voltage magnitude and angle in the PCA based FDI
attacks detection which shall increase the effectiveness of the [14] K. Manandhar, X. Cao, F. Hu and Y. Liu, "Detection of faults and
attacks including false data injection attack in smart grid using kalman
PCA algorithm. filter," IEEE Transactions on Control of Network Systems, vol. 1, no.
4, pp. 370 - 379, 2014.
ACKNOWLEDGMENT [15] L. Liu, M. Esmalifalak, Q. Ding, V. A. Emesih and Z. Han, "Detecting
false data injection attacks on power grid by sparse optimization,"
The research is partially supported by funding from the IEEE Transactions on Smart Grid, vol. 5, no. 2, pp. 612 - 621, 2014.
UNSW Digital Grid Futures Institute, UNSW, Sydney, under [16] M. Esmalifalak, L. Liu, N. Nguyen, R. Zheng and Z. Han, "Detecting
a cross disciplinary fund scheme and by Khalifa University stealthy false data injection using machine learning in smart grid,"
under the Advanced Power and Energy Center (Award No. IEEE Systems Journal, vol. 11, no. 3, pp. 1644 - 1652, 2017.
RC2-2018-06). [17] C. Mei and J. Fan, Data Analysis Methods, Higher Education Press,
2006.
References
[18] B. Liu, Y. Xiao, P. S. Yu, Z. Hao and L. Cao, "An efficient approach
[1] S. M. Muyeen and S. Rahman, Communication, control and security
for outlier detection with imperfect data labels," IEEE Transactions
challenges for the smart grid, IET, 2017. on Knowledge and Data Engineering, vol. 26, no. 7, pp. 1602 - 1616,
[2] Y. Mo, T. H.-J. Kim, K. Brancik, D. Dickinson, H. Lee, A. Perrig and 2014.
B. Sinopoli, "Cyber–physical security of a smart grid infrastructure,"
[19] D. H. Hoang and H. D. Nguyen, "A PCA-based method for IoT
Proceedings of the IEEE, vol. 100, no. 1, pp. 195 - 209, 2011. network traffic anomaly detection," in 2018 20th International
[3] Z. Zhang, S. Gong, A. D. Dimitrovski and H. Li, "Time Conference on Advanced Communication Technology (ICACT), 2018.
synchronization attack in smart grid: impact and analysis," IEEE
[20] Y.-J. Lee, Y.-R. Yeh and Y.-C. F. Wang, "Anomaly detection via
Transactions on Smart Grid, vol. 4, no. 1, pp. 87 - 98, 2013. online oversampling principal component analysis," IEEE
[4] C. Konstantinou, M. Sazos, A. S. Musleh, A. Keliris, A. Al-Durra and Transactions on Knowledge and Data Engineering, vol. 25, no. 7, pp.
M. Maniatakos, "GPS spoofing effect on phase angle monitoring and 1460 - 1470, 2013.
control in a real-time digital simulator-based hardware-in-the-loop [21] Y. Liu, P. Ning and M. K. Reiter, "False data injection attacks against
environment," IET Cyber-Physical Systems: Theory & Applications,
state estimation in electric power grids," ACM Transactions on
vol. 2, no. 4, pp. 180-187, 2017.
Information and System Security , vol. 14, no. 1, pp. 1-33, 2011.
[5] S. Liu, X. P. Liu and Abdulmotaleb El Saddik, "Denial-of-Service [22] A. S. Musleh, S. Muyeen, A. Al-Durra, I. Kamwa, M. A. Masoum and
(dos) attacks on load frequency control in smart grids," in 2013 IEEE
S. Islam, "Time-delay analysis of wide-area voltage control
PES Innovative Smart Grid Technologies Conference (ISGT),
considering smart grid contingences in a real-time environment,"
Washington, 2013.
IEEE Transactions on Industrial Informatics, vol. 14, no. 3, pp. 1242-
[6] G. Liang, J. Zhao, F. Luo, S. R. Weller and Z. Y. Dong, "A review of 1252, 2018.
false data injection attacks against modern power systems," IEEE
[23] A. S. Musleh, S. Muyeen, A. Al-Durra and I. Kamwa, "Testing and
Transactions on Smart Grid, vol. 8, no. 4, pp. 1630 - 1638, 2017.
validation of wide-area control of STATCOM using real-time digital
[7] Q. Yang, J. Yang, W. Yu, D. An, N. Zhang and W. Zhao, "On false simulator with hybrid HIL–SIL configuration," IET Generation,
data-injection attacks against power system state estimation: modeling Transmission & Distribution, vol. 11, no. 12, pp. 3039-3049, 2017.
and countermeasures," IEEE Transactions on Parallel and Distributed
[24] "IEEE Standard for Synchrophasors for Power Systems, IEEE
Systems, vol. 25, no. 3, pp. 717 - 729, 2014.
C37.118-2011," IEEE Power and Energy Soc., 2011.
[8] G. Chaojun, P. Jirutitijaroen and M. Motani, "Detecting false data
injection attacks in AC state estimation," IEEE Transactions on Smart
Grid, vol. 6, no. 5, pp. 2476 - 2483, 2015.
2963 on June 05,2024 at 05:09:17 UTC from IEEE Xplore. Restrictions apply.
Authorized licensed use limited to: University of New South Wales. Downloaded