Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Large Language Models for Power System Security: A Novel Multi-Modal Approach for Anomaly Detection in Energy Management Systems

Aydin Zaboli, Junho Hong, Alexandru Stefanov, Chen-Ching Liu, Chul-Sang Hwang

TL;DR

The paper tackles EMS cybersecurity by proposing a multi-point anomaly-detection framework that integrates GenAI-based ADS with a novel SoM-GI multimodal analysis to detect attacks spanning SE, databases, and HMI displays. It demonstrates that traditional chi-square-based bad-data detection can be bypassed by stealth and topology- or display-manipulation attacks, while GenAI–assisted detectors can identify inconsistencies across numerical, visual, and semantic dimensions. The SoM-GI approach addresses GenAI's spatial-reasoning limits by embedding visual markers and rules to correctly interpret segmented HMI screens, enabling robust detection of display-replay and CB-status anomalies. Validation on the IEEE 14-bus system across scenarios shows the framework’s potential for enhanced grid security, though practical deployment requires edge- or on-site AI, data governance, and scalability considerations.

Abstract

This paper elaborates on an extensive security framework specifically designed for energy management systems (EMSs), which effectively tackles the dynamic environment of cybersecurity vulnerabilities and/or system problems (SPs), accomplished through the incorporation of novel methodologies. A comprehensive multi-point attack/error model is initially proposed to systematically identify vulnerabilities throughout the entire EMS data processing pipeline, including post state estimation (SE) stealth attacks, EMS database manipulation, and human-machine interface (HMI) display corruption according to the real-time database (RTDB) storage. This framework acknowledges the interconnected nature of modern attack vectors, which utilize various phases of supervisory control and data acquisition (SCADA) data flow. Then, generative AI (GenAI)-based anomaly detection systems (ADSs) for EMSs are proposed for the first time in the power system domain to handle the scenarios. Further, a set-of-mark generative intelligence (SoM-GI) framework, which leverages multimodal analysis by integrating visual markers with rules considering the GenAI capabilities, is suggested to overcome inherent spatial reasoning limitations. The SoM-GI methodology employs systematic visual indicators to enable accurate interpretation of segmented HMI displays and detect visual anomalies that numerical methods fail to identify. Validation on the IEEE 14-Bus system shows the framework's effectiveness across scenarios, while visual analysis identifies inconsistencies. This integrated approach combines numerical analysis with visual pattern recognition and linguistic rules to protect against cyber threats and system errors.

Large Language Models for Power System Security: A Novel Multi-Modal Approach for Anomaly Detection in Energy Management Systems

TL;DR

The paper tackles EMS cybersecurity by proposing a multi-point anomaly-detection framework that integrates GenAI-based ADS with a novel SoM-GI multimodal analysis to detect attacks spanning SE, databases, and HMI displays. It demonstrates that traditional chi-square-based bad-data detection can be bypassed by stealth and topology- or display-manipulation attacks, while GenAI–assisted detectors can identify inconsistencies across numerical, visual, and semantic dimensions. The SoM-GI approach addresses GenAI's spatial-reasoning limits by embedding visual markers and rules to correctly interpret segmented HMI screens, enabling robust detection of display-replay and CB-status anomalies. Validation on the IEEE 14-bus system across scenarios shows the framework’s potential for enhanced grid security, though practical deployment requires edge- or on-site AI, data governance, and scalability considerations.

Abstract

This paper elaborates on an extensive security framework specifically designed for energy management systems (EMSs), which effectively tackles the dynamic environment of cybersecurity vulnerabilities and/or system problems (SPs), accomplished through the incorporation of novel methodologies. A comprehensive multi-point attack/error model is initially proposed to systematically identify vulnerabilities throughout the entire EMS data processing pipeline, including post state estimation (SE) stealth attacks, EMS database manipulation, and human-machine interface (HMI) display corruption according to the real-time database (RTDB) storage. This framework acknowledges the interconnected nature of modern attack vectors, which utilize various phases of supervisory control and data acquisition (SCADA) data flow. Then, generative AI (GenAI)-based anomaly detection systems (ADSs) for EMSs are proposed for the first time in the power system domain to handle the scenarios. Further, a set-of-mark generative intelligence (SoM-GI) framework, which leverages multimodal analysis by integrating visual markers with rules considering the GenAI capabilities, is suggested to overcome inherent spatial reasoning limitations. The SoM-GI methodology employs systematic visual indicators to enable accurate interpretation of segmented HMI displays and detect visual anomalies that numerical methods fail to identify. Validation on the IEEE 14-Bus system shows the framework's effectiveness across scenarios, while visual analysis identifies inconsistencies. This integrated approach combines numerical analysis with visual pattern recognition and linguistic rules to protect against cyber threats and system errors.

Paper Structure

This paper contains 37 sections, 57 equations, 10 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Problem Statement
  3. Research Objectives
  4. Related Work
  5. Contributions
  6. GenAI vs. Traditional ML/DL Approaches for Anomaly Detection in EMSs
  7. Paper Structure
  8. A Proposed Multi-point Attack Model in Energy Management Systems
  9. GenAI Implementation Methodology and Prompt Engineering
  10. Model Selection and Deployment Strategy
  11. Structured Prompt Engineering Framework
  12. Attack Vectors and Experimental Validation
  13. Attack Point #1: Stealth Attacks (Gray Dashed Line)
  14. A Mathematical Construction of SE and Stealth Attacks
  15. Scenario #1A: 5-Point Distributed Stealth Attack
  16. ...and 22 more sections

Figures (10)

  • Figure 1: A general proposed framework for different attack points in EMSs.
  • Figure 2: The ranges of stealth attacks for different buses according to the bus voltage magnitudes for an IEEE 14-bus system.
  • Figure 3: A visualization of the attack vector in Scenario #1A, (a) system voltage profile under attack (b) attack magnitude distribution (%).
  • Figure 4: A visualization of the attack vector in Scenario #1B, (a) system voltage profile under attack (b) attack magnitude distribution (%).
  • Figure 5: An illustration of a standard IEEE 14-bus system.
  • ...and 5 more figures