Detecting load redistribution attacks via support vector models

• Published in: IET Smart Grid Vol. 3; no. 5; pp. 551 - 560
• Main Authors: Chu, Zhigang, Kosut, Oliver, Sankar, Lalitha
• Format: Journal Article
• Language: English
• Published: Durham The Institution of Engineering and Technology 01.10.2020; John Wiley & Sons, Inc; Wiley
• Subjects: Algorithms; attack consequences; attack space; Classification; cyber-attacks; Design; detection framework; Electric power; historical load data; IEEE 30‐bus system; learning (artificial intelligence); load forecasting; load redistribution attacks; Machine learning; multioutput support vector regression load predictor; Neural networks; normal data; publicly available PJM zonal loads; random attacks; random LR attacks; redistribute loads; regression analysis; Sensors; Spatial data; Special Section: Privacy and Security in Smart Grids; subsequent support vector machine attack detector; Support vector machines; support vector models; SVM attack detector; SVM detector; SVR predictor; IEEE 30-bus system; redistribute loads; cyber-attacks; support vector machines; detection framework; load redistribution attacks; multioutput support vector regression load predictor; regression analysis; historical load data; SVM detector; publicly available PJM zonal loads; support vector models; normal data; random LR attacks; SVR predictor; attack consequences; load forecasting; attack space; SVM attack detector; learning (artificial intelligence); random attacks; subsequent support vector machine attack detector
• ISSN: 2515-2947; 2515-2947
• DOI: 10.1049/iet-stg.2020.0030

A machine learning-based detection framework is proposed to detect a class of cyber-attacks that redistribute loads by modifying measurements. The detection framework consists of a multi-output support vector regression (SVR) load predictor and a subsequent support vector machine (SVM) attack detector to determine the existence of load redistribution (LR) attacks utilising loads predicted by the SVR predictor. Historical load data for training the SVR are obtained from the publicly available PJM zonal loads and are mapped to the IEEE 30-bus system. The features to predict loads are carefully extracted from the historical load data capturing both temporal and spatial correlations. The SVM attack detector is trained using normal data and randomly created LR attacks so that it can maximally explore the attack space. An algorithm to create random LR attacks is introduced. The results show that the SVM detector trained merely using random attacks can effectively detect not only random attacks but also intelligently designed attacks. Moreover, using the SVR predicted loads to re-dispatch generation when attacks are detected can significantly mitigate the attack consequences.