Attention-Enhanced Graph Filtering for False Data Injection Attack Detection and Localization

TL;DR

The paper addresses false data injection attacks in power grids by proposing ACEOT, a joint detection and localization framework that combines topology-aware ARMA graph filtering with an Encoder-Only Transformer and a learnable positional encoding. This hybrid model captures both local structural dependencies and global grid-wide interactions, improving FDIA detection and node-level localization while mitigating over-smoothing and noise amplification. Evaluated on IEEE-14 and IEEE-300 bus systems with NYISO-derived data, ACEOT demonstrates competitive detection performance and markedly superior localization accuracy, particularly in larger networks, highlighting scalability for online grid cybersecurity. The work offers a practical, topology-aware defense approach that leverages graph filtering and attention mechanisms to robustly identify and localize compromised buses in real-world power-system operations.

Abstract

The increasing deployment of Internet-of-Things (IoT)-enabled measurement devices in modern power systems has expanded the cyberattack surface of the grid. As a result, this critical infrastructure is increasingly exposed to cyberattacks, including false data injection attacks (FDIAs) that compromise measurement integrity and threaten reliable system operation. Existing FDIA detection methods primarily exploit spatial correlations and network topology using graph-based learning; however, these approaches often rely on high-dimensional representations and shallow classifiers, limiting their ability to capture local structural dependencies and global contextual relationships. Moreover, naively incorporating Transformer architectures can result in overly deep models that struggle to model localized grid dynamics. This paper proposes a joint FDIA detection and localization framework that integrates auto-regressive moving average (ARMA) graph convolutional filters with an Encoder-Only Transformer architecture. The ARMA-based graph filters provide robust, topology-aware feature extraction and adaptability to abrupt spectral changes, while the Transformer encoder leverages self-attention to capture long-range dependencies among grid elements without sacrificing essential local context. The proposed method is evaluated using real-world load data from the New York Independent System Operator (NYISO) applied to the IEEE 14- and 300-bus systems. Numerical results demonstrate that the proposed model effectively exploits both the state and topology of the power grid, achieving high accuracy in detecting FDIA events and localizing compromised nodes.

Figures (8)

• Figure 1: Comparison of node information aggregation in grid-structured and non-Euclidean graphs. Graph-based convolution aggregates information from neighboring nodes in irregular topologies.
• Figure 2: ARMAConv Architecture. The input consists of $N$ node feature vectors $X \in \mathbb{R}^{h_c}$, where $N$ is the number of buses in the power grid, and the output is a set of $N$ vectors with the same dimensionality. The dashed block illustrates Eq. \ref{['eq:arma-average']}, which computes the average over $K$ parallel stacks. Each stack follows Eq. \ref{['eq:arma']} and comprises $T$ recursive propagation steps, where each step combines the input processed by a neural network, a bias term $\theta$, and the modified Laplacian operator $\tilde{L}$ applied to a separate neural network. The output of each stack is propagated through the architecture, with the initial input passed recursively to the $T$-th step.
• Figure 3: Encoder-Only Transformer architecture. Both the input and output consist of $N$ node embeddings $\mathbf{X} \in \mathbb{R}^{d_{model}}$. Each encoder layer comprises a multi-head self-attention sub-layer followed by a position-wise feed-forward network, with residual connections and normalization applied at each stage.
• Figure 4: Scaled dot-product attention mechanism. Queries ($Q$), keys ($K$), and values ($V$) are obtained through linear projections of the input embeddings and combined via scaled dot-product attention to produce context-aware node representations.
• Figure 5: ARMAConv Encoder-Only Transformer (ACEOT) architecture. The model takes the weighted adjacency matrix, node-level power injections $(P,Q)$, and node indices as input, and outputs both node-level attack probabilities for localization and a graph-level probability for FDIA detection.