Machine Learning Methods for Attack Detection in the Smart Grid

By Mete Ozay, Inaki Esnaola, Fatos Tunay, Yarman Vural, Sanjeev R. Kulkarni, H. Vincent Poor. 2015

550 citations recorded by the source corpus.

Attack detection problems in the smart grid are posed as statistical learning problems for different attack scenarios in which the measurements are observed in batch or online settings. In this approach, machine learning algorithms are used to classify measurements as being either secure or attacked. An attack detection framework is provided to exploit any available prior knowledge about the system and surmount constraints arising from the sparse structure of the problem in the proposed approach. Well-known batch and online learning algorithms (supervised and semisupervised) are employed with decision- and feature-level fusion to model the attack detection problem. The relationships between statistical and geometric properties of attack vectors employed in the attack scenarios and learning algorithms are analyzed to detect unobservable attacks using statistical learning methods. The proposed algorithms are examined on various IEEE test systems. Experimental analyses show that machine learning algorithms can detect attacks with performances higher than attack detection algorithms that employ state vector estimation methods in the proposed attack detection framework.

Subfields: Artificial Intelligence, Computer Networks and Communications, Control and Systems Engineering

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Control and Systems Engineering

Citations in the corpus

A survey on data fusion in internet of things: Towards secure and privacy-preserving fusion (2019, background): “Reliable data collection resisting various attacks [52, 89, 90] is of paramount significance to provide efficient and reliable power transmission and distribution, which can help improve the security and trustworthiness.”
Real-Time Detection of False Data Injection Attacks in Smart Grid: A Deep Learning-Based Intelligent Mechanism (2017, methodology): “[7] modelled the attack strategy using Gaussian process and used machine learning methods for attack detection.”
Toward Massive Machine Type Communications in Ultra-Dense Cellular IoT Networks: Current Issues and Machine Learning-Assisted Solutions (2018, unknown): “For example, SVMs can be used in IoT devices to detect network intrusion [178] and spoofing attacks [30].”
IoT Security Techniques Based on Machine Learning: How Do IoT Devices Use AI to Enhance Security? (2018, methodology): “For example, IoT devices can use SVMs to detect network intrusion [9] and spoofing attacks [12], apply K-NNs in network intrusion [13] and malware [14] detection, and utilize NNs to detect network intrusion [15] and DoS attacks [16].”
A Survey on IoT Security: Application Areas, Security Threats, and Solution Architectures (2019, methodology): “Spooﬁng: Attacks from spoofers can be avoided by using Q-learning [176], Dyna-Q [176], Support Vector Machines (SVM) [177], Deep Neural Network (DNN) model [178], incremental aggregated gradient (IAG) [46], and distributed FrankWolfe (dFW) [179] techniques.”
A Survey of Machine and Deep Learning Methods for Internet of Things (IoT) Security (2018, methodology): “In a previous work, an SVM was used to secure a smart grid, and attack detection in a smart grid was empirically studied [139].”
Online False Data Injection Attack Detection With Wavelet Transform and Deep Neural Networks (2018, unknown): “, [18]–[20], [24]–[27], [29].”
Machine Learning in IoT Security: Current Solutions and Future Challenges (2019, background): “[135] studied in detail, different ML algorithms for attack detection in smart grid.”
Application of Big Data and Machine Learning in Smart Grid, and Associated Security Concerns: A Review (2019, methodology): “[254] used supervised learning to classify measurement data as secure or compromised, and thus detected FDIA.”