Deep Learning-based Detection of Stealth False Data Injection Attacks in Large-Scale Power Grids

拟议的研究旨在通过提高电网关键基础设施在数据操纵攻击方面的弹性来加强国家安全。提出了一种被称为DEFENDA（检测虚假和意外数据攻击）的综合方法，用于量化数据的完整性并表征虚假数据对电力系统的影响。这些攻击被称为不可观察或隐形虚假数据注入（FDI）攻击，它们被精心设计以绕过传统的坏数据检测。DEFENDA的愿景是快速检测传感器操纵攻击并纠正错误数据。该项目旨在为输电系统运行提供增强的最先进的网络物理安全策略，其结果将为解决类似问题提供信息，包括在发电、输电和配电级别以及通信网络、银行系统、云计算和存储以及其他关键基础设施中的网络物理攻击检测。DEFENDA将通过深度神经网络（DNN）架构为现实世界的电网提供攻击检测策略，以提供卓越的表征能力和改进的检测性能。具体来说，DEFENDA旨在基于深度长短期记忆（LSTM）递归神经网络（RNN）开发一种高效且强大的FDI攻击检测机制，该机制捕获状态和测量数据的时间序列性质，并学习其各自的正常和恶意模式。为了确保检测效率，DEFENDA研究了深层架构和底层超参数的最佳选择。此外，DEFENDA通过三个措施确保检测稳健性。首先，defena能够通过深度LSTM自动编码器（LSTM- ae）替换任何缺失的状态和测量数据，即使在存在干扰攻击的情况下也能提高检测性能。其次，使用深度变分LSTM自编码器（V-LSTM-AE）， DEFENDA能够检测到未通过异常检测器表征的攻击。最后，defena基于集中式、半集中式和分散式检测架构进行检测决策融合。defena还将创建并提供具有场景的合成案例，旨在促进网络物理分析和攻击检测的研究。通过所开发的场景展示网络安全和数据完整性的重要性，该项目将培养一代人解决社会面临的问题。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

The proposed research aims to strengthen national security by improving the resilience of power grid critical infrastructure with respect to data manipulation attacks. A comprehensive methodology referred to as DEFENDA - DEtection of FalsE and uNexpected Data Attacks - is proposed to quantify the integrity of data and to characterize the impact of false data on power systems. These attacks are referred to as unobservable or stealth false data injection (FDI) attacks, and they are crafted to bypass traditional bad data detection. DEFENDA's vision is to quickly detect sensor manipulation attacks and correct the false data. The project aims to contribute enhanced state-of-the-art cyber-physical security strategies for transmission system operation, where results will inform solution of similar problems including cyber-physical attack detection at generation, transmission, and distribution levels as well as in communication networks, banking systems, cloud computing and storage, and other critical infrastructures. DEFENDA will contribute attack detection strategies for real-world power grids via deep neural network (DNN) architectures known to offer superior representational power and improved detection performance. Specifically, DEFENDA aims to develop an efficient and robust FDI attack detection mechanism based on a deep long-short-term-memory (LSTM) recurrent neural network (RNN) that captures the time series nature of the status and measurement data and learns their respective normal and malicious patterns. To ensure detection efficiency, DEFENDA investigates optimal selection of the deep architecture and underlying hyper-parameters. Furthermore, DEFENDA ensures detection robustness through three measures. First, DEFENDA enables replacement of any missing status and measurement data via a deep LSTM auto-encoder (LSTM-AE) to enhance detection performance even in presence of jamming attacks. Second, using a deep variational LSTM auto-encoder (V-LSTM-AE) DEFENDA is capable to detect attacks that have not been characterized via an anomaly detector. Finally, DEFENDA carries out detection decision fusion based on centralized, semi-centralized, and decentralized detection architectures. DEFENDA will also create and make available synthetic cases with scenarios designed to promote research in cyber-physical analysis and attack detection. By demonstrating the importance of cyber security and data integrity though the scenarios developed, the project will prepare a generation to solve the problems facing society.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.