Detecting load redistribution attacks via support vector models. Issue 5 (15th June 2020)

• Record Type: Journal Article
• Authors: Chu, Zhigang; Kosut, Oliver; Sankar, Lalitha
• Is Part Of: IET smart grid. Volume 3:Issue 5(2020)
• Page Start: 551
• Page End: 560
• Publication Date: 2020-06-15
• Subjects: support vector machines -- regression analysis -- load forecasting -- learning (artificial intelligence); random LR attacks -- SVM detector -- random attacks -- attack consequences -- load redistribution attacks -- support vector models -- detection framework -- cyber‐attacks -- redistribute loads -- multioutput support vector regression load predictor -- subsequent support vector machine attack detector -- SVR predictor -- historical load data -- publicly available PJM zonal loads -- IEEE 30‐bus system -- SVM attack detector -- normal data -- attack space; Smart power grids -- Periodicals; Computer science -- Periodicals; Energy industries -- Periodicals; Broadcasting -- Periodicals; 333.79110285
• DOI: 10.1049/iet-stg.2020.0030
• Languages: English
• ISSNs: 2515-2947

Abstract

Abstract : A machine learning‐based detection framework is proposed to detect a class of cyber‐attacks that redistribute loads by modifying measurements. The detection framework consists of a multi‐output support vector regression (SVR) load predictor and a subsequent support vector machine (SVM) attack detector to determine the existence of load redistribution (LR) attacks utilising loads predicted by the SVR predictor. Historical load data for training the SVR are obtained from the publicly available PJM zonal loads and are mapped to the IEEE 30‐bus system. The features to predict loads are carefully extracted from the historical load data capturing both temporal and spatial correlations. The SVM attack detector is trained using normal data and randomly created LR attacks so that it can maximally explore the attack space. An algorithm to create random LR attacks is introduced. The results show that the SVM detector trained merely using random attacks can effectively detect not only random attacks but also intelligently designed attacks. Moreover, using the SVR predicted loads to re‐dispatch generation when attacks are detected can significantly mitigate the attack consequences.