Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches

TL;DR

Results indicate that GNN-based methods outperform k-means and autoencoder in detection and show promise in accurately localizing attacks for simple scenarios, although they still face challenges in more complex cases.

Abstract

This paper explores the detection and localization of cyber-attacks on time-series measurements data in power systems, focusing on comparing conventional machine learning (ML) like k-means, deep learning method like autoencoder, and graph neural network (GNN)-based techniques. We assess the detection accuracy of these approaches and their potential to pinpoint the locations of specific sensor measurements under attack. Given the demonstrated success of GNNs in other time-series anomaly detection applications, we aim to evaluate their performance within the context of power systems cyber-attacks on sensor measurements. Utilizing the IEEE 68-bus system, we simulated four types of false data attacks, including scaling attacks, additive attacks, and their combinations, to test the selected approaches. Our results indicate that GNN-based methods outperform k-means and autoencoder in detection. Additionally, GNNs show promise in accurately localizing attacks for simple scenarios, although they still face challenges in more complex cases, especially ones that involve combinations of scaling and additive attacks.

Figures (16)

• Figure 1: Single line diagram of the IEEE 68-bus system with 16 SGs.
• Figure 2: Step scenario with small attack magnitude with $c=1.006$. The attack results in gradual divergence of angle differences during the attack.
• Figure 3: Step scenario with large attack magnitude with $c=1.03$. As expected, the large attack magnitude results in larger deviations in angle differences compared to the small attack magnitude scenario.
• Figure 4: Poisoning scenario with large attack magnitude with $\mu_C = 0$ and $\sigma_C = 0.08$.
• Figure 5: Ramp scenario with small attack magnitude, with $m=0.000007$. The attack results in gradual divergence of angle differences during the attack.