Assessment and Verification of Machine Learning Applications for Detecting False Data Injection Attacks in Automatic Generation Control

Abstract

Although the increasing integration of Internet of Things devices into the modern grid infrastructure has improved grid performance and efficiency in many ways, cyberattacks now pose a significant threat to system stability and reliability. For instance, false data injection attacks modify sensor measurements and control signals, disrupting power balancing and supplication tasks performed by generation control systems. Detecting these attacks can mitigate their impact. In this paper, three machine learning detection methods are comparatively analyzed to determine implementation efficacy and practicality: long short-term memory, generative adversarial networks, and cluster-driven ensemble learning. The novel cluster-driven ensemble learning algorithm (and its associated intrusion detection system) best satisfies the evaluation criteria due to its accuracy, resource requirements, and decentralized architecture. Additionally, this paper proposes a framework for an open-source, portable cyber-physical testbed using the SEED Internet Emulator. With the framework described, the SEED Emulator can be used to address the lack of existing cybersecurity testbed platforms for grid applications and can be applied to verify the efficacy of the proposed solution. A successful implementation of the cluster-driven ensemble learning intrusion detection system will improve grid security and stability, mitigating the costly social, economic, and environmental consequences of data injection attacks.