WGMwgm QEqe EPep PMSpms BECbec DEde

[1] [1]This work is the result of the research project funded by the Faculty
of Science, Engineering and Built Environment (SEBE), Deakin University under
the scheme ’Mini ARC Analogue Program (MAAP)’.

[orcid=0000-0001-7908-8807] [1] [2]

[orcid=0000-0003-3916-1381]

[orcid=0000-0001-7769-3384]

[orcid=0000-0002-2354-7960]

[orcid=0000-0001-7769-3384]

[1]

# FedDiSC: A Computation-efficient Federated Learning Framework for Power
Systems Disturbance and Cyber Attack Discrimination

Muhammad Akbar Husnoo<EMAIL_ADDRESS>Centre for Cyber Security
Research and Innovation (CSRI), School of Information Technology, Deakin
University, Geelong, VIC 3216, Australia  Adnan Anwar
<EMAIL_ADDRESS>Haftu Tasew Reda<EMAIL_ADDRESS>Nasser
Hosseinzadeh<EMAIL_ADDRESS>Centre for Smart Power and
Energy Research (CSPER), School of Engineering, Deakin University, Geelong,
VIC 3216, Australia  Shama Naz Islam<EMAIL_ADDRESS>Abdun Naser Mahmood
<EMAIL_ADDRESS>Department of Computer Science & IT, Latrobe
University, Bundoora, VIC 3086, Australia  Robin Doss<EMAIL_ADDRESS>
###### Abstract

With the growing concern about the security and privacy of smart grid systems,
cyberattacks on critical power grid components, such as state estimation, have
proven to be one of the top-priority cyber-related issues and have received
significant attention in recent years. However, cyberattack detection in smart
grids now faces new challenges, including privacy preservation and
decentralized power zones with strategic data owners. To address these
technical bottlenecks, this paper proposes a novel Federated Learning-based
privacy-preserving and communication-efficient attack detection framework,
known as FedDiSC, that enables Discrimination between power System
disturbances and Cyberattacks. Specifically, we first propose a Federated
Learning approach to enable Supervisory Control and Data Acquisition
subsystems of decentralized power grid zones to collaboratively train an
attack detection model without sharing sensitive power related data. Secondly,
we put forward a representation learning-based Deep Auto-Encoder network to
accurately detect power system and cybersecurity anomalies. Lastly, to adapt
our proposed framework to the timeliness of real-world cyberattack detection
in SGs, we leverage the use of a gradient privacy-preserving quantization
scheme known as DP-SIGNSGD to improve its communication efficiency. Extensive
simulations of the proposed framework on publicly available Industrial Control
Systems datasets demonstrate that the proposed framework can achieve superior
detection accuracy while preserving the privacy of sensitive power grid
related information. Furthermore, we find that the gradient quantization
scheme utilized improves communication efficiency by 40% when compared to a
traditional federated learning approach without gradient quantization which
suggests suitability in a real-world scenario.

###### keywords:

Federated Learning Anomaly Detection Cyber Attack Internet of Things (IoT)
Smart Grid

##  1 Introduction

The widespread adoption of Internet of Things (IoT) in the Smart Grid (SG)
paradigm has spawned an unprecedented growth in data volumes generated by edge
devices. Such data are particularly vital for numerous key operations of power
systems including demand forecasting, grid optimization, monitoring and
control of power systems, etc. As such, the overall energy grid system
management can be performed more dynamically and efficiently. However, the
increase in heterogeneity, diversity, and complexity within the power system
infrastructure poses a critical challenge to its integrity. Ensuring data
integrity is one of the core missions of modern power systems [1]. This is
because the ubiquity of modern cyber-physical power grid components coupled
with advancements in information technology now enables data processing and
decision making at the edge [2] as compared to traditional cloud storage-based
control centres.

The progress of digital technology has brought about major improvements in the
energy critical infrastructure, thus alleviating the modern world’s most
crucial problem of how to reconcile the insatiable demand for energy. Despite
its significant benefits, SGs still face many technical challenges. Although
smart sensing devices play a critical role in the SG paradigm, cyber attacks
can impose a serious impact on the integrity and resilience of the system [3].
Many of the SG’s cyber-physical components become potential targets of cyber
attacks [4]. One such critical cyber attack is False Data Injection (FDI), a
critical cyber attack in which malicious adversaries launch severe attacks by
corrupting raw sensor measurements or state estimation outcomes [5].
Furthermore, attackers constantly improve their attack crafting methods to
disguise the compromised measurements as natural disturbances/faults such that
the detection between malicious and non-malicious events becomes overwhelming
and infeasible for bad data detection methods [6]. Therefore, it is imperative
to design effective countermeasures to defend modern power systems against
such types of cyber threats.

In the recent past, several studies have been conducted to develop defenses
against cyber attacks on SGs. Previous works have focused on leveraging
machine learning algorithms for cyberattack detection in smart grid systems.
For example, the work in [7] utilizes a supervised learning-based distributed
support vector machine along with alternating direction method of multipliers
and achieved sufficient detection performance and lower computation
complexities when tested on IEEE standard test systems. Another literature by
Anwar, Mahmood and Shah [8] claims that their solution based on Principal
Component Analysis and Sequential Minimal Optimization (SMO)-based support
vectors outperformed popular machine learning algorithms when tested on
industrial control systems datasets. More recently, deep learning approaches
have been employed for cyber attack detection due to their superior accuracy
against conventional machine learning algorithms. For instance, in [9], the
authors developed an unsupervised deep belief network-based detection method
which led to satisfactory results when tested on IEEE standard test system. On
the other hand, the work in [10] proposes a state-of-the-art deep ensembled
learning algorithm to improve FDI detection in a residential demand response
context. However, centralized cyber attack detection techniques proposed in
numerous previous literature suffer from: 1) limited storage capabilities, 2)
communication bottlenecks, and most importantly, 3) privacy issues.
Researchers often overlook the fact that power system data may contain
sensitive information and its communication to centralized control centres may
eventually lead to privacy leakages [11].

To address the aforementioned challenges, a promising privacy-preserving
distributed learning-based cyber attack detection method that leverages
Federated Learning (FL) was proposed. This new machine learning paradigm
enables edge devices to train a cyber attack detection deep learning neural
network model on-device at the edge with their local training samples, all
without requiring the sharing of their local dataset without compromising
privacy. For example, the work in [12] proposed a FL framework for detecting
FDI attacks on solar PV DC/DC and DC/AC converters. Similarly, [13] developed
an incentive-based federated attack detection on power grid state estimations
which is claimed to outperform existing works. The authors in [14] implemented
a federated transformer-based FDI detection system followed by extensive
validations on IEEE standard test systems which revealed the effectiveness of
their proposed mechanism. Unfortunately, there are limited number of studies
that focus on FL for detecting stealthy cyber threats on power control
systems.

In this work, we propose the suitability of a federated cyber attack detection
mechanism as a means to discriminate between malicious and non-malicious power
system disturbances which relieves the burden of a power system operator to
determine whether a certain power disturbance is intentional and thus, provide
reliable decision support. We set up distributed power grid zones whereby
SCADA sub-systems can locally detect cyber threats instead of uploading data
to the control centre, thereby addressing storage capability, communication
reliability and privacy issues faced by centralized approaches. In particular,
the main contributions of this paper are summarized as follows:

  1. 1.

We propose a light-weight privacy-preserving on-device collaborative deep
cyber attack detection framework for power system networks based on federated
learning, known as FedDiSC.

  2. 2.

We put forward a representation learning-based Deep Auto-Encoder (DAE) network
to accurately detect power system and cybersecurity anomalies.

  3. 3.

We leverage the use of DP-SIGNSGD [15], a privacy-preserving gradient
quantization scheme, to improve the computation efficiency of our proposed
framework. Such a scheme decreases the communication overhead by reducing the
number of parameters exchanged between the client nodes and the central
orchestrator.

  4. 4.

We conduct extensive experiments on publicly available Industrial Control
Systems datasets to validate that our proposed framework indeed detects
anomalies with high accuracy whilst keeping a low communication overhead. We
evaluate our proposed framework against several FL-based deep learning models
and centralized machine learning models as discussed in Section 4.2 and find
that our attack detection framework achieves a superior accuracy of 94.8% and
a 40% decrease in training time.

The remainder of this paper is structured as follows: The previous state-of-
the-art literature in regards to cyber attack detection and Federated Learning
is presented in Section 2. The proposed FedDiSC approach, including the system
model, detection module, etc. is presented in Section 3. Simulation scenarios
for validating the effectiveness of our proposed approach on publicly
available datasets are presented in Section 4. Finally, we conclude the paper
in Section 5.

##  2 Related Works

In what follows, we summarize the current state-of-the-art research on cyber
attack detection and FL by classifying the previous related literature into
two main categories: Data-driven cyber attack detection and Federated Learning
in relation to SGs.

###  2.1 Data-driven Cyber Attack Detection

Whilst there are several approaches and directions in cyber attack detection,
model-based detection algorithms have garnered huge attention in literature
due to their scalability, real-time detection capabilities and non-dependence
of system parameters [16]. For instance, the work in [17] is one of the
earliest to investigate the use of a Gaussian process regression modelling
technique based on prior information to develop an early warning system to
mitigate the impact of cyberattacks in smart grids. Another work in [4]
trained popular machine learning models such as Random Forests, Naive Bayes,
etc. on industrial control datasets and achieved high detection performance.
The same further explored the use of different benchmark classifiers such as
Random Forest, J48, JRip, etc. in [18]. Hao, Piechocki, Kaleshi, Chin and
Fan[19] proposed the use of a Robust Principal Component Analysis (RPCA)
approach for both random and targeted FDI attack detection. In similar line,
Yang, Wang, Zhou, Ruan and Liu [20] employed four conventional machine
learning models, namely one-Class SVM, Robust covariance, Isolation forest and
Local outlier factor method for cyber attack detection and achieved high
classification performance after simulation on an IEEE 14-bus system. Another
recent study undertaken by Kumar, Saxena and Choi [21] addressed the problem
of cyberattack detection by training several popular machine learning models
such as AdaBoost, Gradient Boosting, Nearest Neighbours, etc. on a power
system dataset to achieve detection accuracy ranging between 70% and 92%.

In recent years, with the exponential rise of deep learning applications,
researchers are actively utilizing newer deep learning algorithms to further
advance and improve cyber threat detection in smart grids. For example, the
work in [22] developed a multi-layer perceptron based approach for improving
the resilience of SG systems against FDI attacks. Another work by Niu, Li, Sun
and Tomsovic [23] developed a CNN-LSTM network for anomaly detection in smart
grids which outperformed traditional bad data detectors. Similarly, the
authors in [24] employ a state-of-the-art CNN as a multi-label classifier to
defend against potential corrupted measurement threats. Wang, Zhang, Ma and
Jin [25] proposed the use of a Kalman filter paired with a recurrent neural
network demonstrated significantly improved detection rates against cyber
attacks on smart grids. More recently, Bitirgen and Filik [26] proposed a CNN-
LSTM ensembled model combined with particle swarm optimization which achieved
high cyberattack detection accuracy rates as compared to existing
works.However, there is a privacy issue when separate power grid zones are
managed by various system operators, which is a very common scenario in power
system networks. And, much of the above literature do not address the problem
of user privacy when dealing with such sensitive power related data for
detection of cyber threats. Unlike existing research works, our proposed
privacy-preserving gradient quantization scheme combined with FL addresses
this privacy issue by enabling a computationally-efficient on-device
collaborative training of the attack detection model for discriminating
between power system disturbances and cyber attacks.

###  2.2 Federated Learning in smart grid applications

FL is a fundamentally novel machine learning paradigm that enables
collaborative decentralised on-device training of models without requiring the
physical migration of raw data to a centralized server [27]. Since its
inception, FL has been applied to several SG applications where privacy is
paramount. Taik and Cherkaoui [28] pioneered the application of FL in the
smart grid domain by designing a privacy-preserving demand load forecasting
framework that required no data sharing. They trained a LSTM model on a real-
world Texas load consumption dataset and achieved sufficient forecasting
performance to claim the effectiveness of FL in the smart grid domain. Another
study in [29] leveraged FL applications for distributed energy resources
forecasting and validated their high forecasting performance using a GridLAB-D
simulations and Pecan Street dataset. Similarly, Gholizadeh and Musilek [30]
and Yang, Wang, Zhao and Wu [31] achieved sufficient load prediction
performance after employing FL for demand forecasting. Due to its prominence
and optimal performance in the demand forecasting application, FL quickly
garnered traction in other aspects of the smart grid domain. For example, the
authors in [32] designed a federated temporal convolutional network for energy
theft detection. They claimed that, after extensive data-driven experiments
using a real-energy consumption dataset, their federated framework can achieve
high accuracy of detection with a smaller computation overhead. On similar
line, Ashraf, Waqas, Abbas, Baker, Abbas and Alasmary [33] achieved comparable
performance in energy theft detection after employing federated conventional
machine learning algorithms on real-world datasets. More recently, there has
been few works in relation to federated cyberattack detection. The work in
[12] proposed a FL framework for detecting FDI attacks on solar PV DC/DC and
DC/AC converters. Similarly, [13] developed an incentive-based federated FDI
attack detection on power grid state estimations which is claimed to
outperform existing works. The authors in [14] implemented a federated
transformer-based FDI detection system followed by extensive validations on
IEEE standard test systems which revealed the effectiveness of their proposed
mechanism. In contrast, our focus in this paper constitutes of developing a
federated grid-wide anomaly detection framework for power control systems that
enables the discrimination between non-malicious power system disturbances and
malicious FDI threats whilst being computationally efficient.

##  3 Proposed Methodology

In this section, we will first present the system model considered for this
scenario, followed by our proposed computationally-efficient FL-based privacy-
preserving intrusion detection framework.

###  3.1 System Model and Assumptions

Figure 1: An overview of the FL-based intrusion detection framework. An
intuitive workflow of our proposed framework is as follows: 1) The edge IEDs
in power grid zones uploads its data securely to a SCADA sub-system. 2) The
control centre distributes unanimous model and parameter initialization to all
SCADA sub-systems. 3) Local models are trained by each SCADA sub-system with
their own local dataset. 4) Each SCADA sub-system updates its compressed
gradient to the control centre. 5) The control centre aggregates the uploaded
compressed gradients to obtain the latest model. 6) The control centre sends
back the model updates to each SCADA sub-system. The steps 1-6 are then
repeated until the global model reaches optimal convergence.

Throughout this manuscript, we consider a generic zone-wise distributed power
grid system, which involves a control centre and $K$ edge-based Supervisory
Control and Data Acquisition (SCADA) sub-systems that collaboratively train an
FDI attack detection model as illustrated in Figure 1. The edge-based SCADA
sub-systems train the aforementioned shared model locally using their own
local dataset, which is collected from the different IED sensing nodes in each
respective power grid zones. After local training, the model updates are then
shared to the control centre which uses majority-voting aggregation algorithm
to average the model updates, thus obtaining an updated global model. The
updated model gradients are then shared back to the edge SCADA sub-systems,
which will in turn be used for FDI attack detection. The three key actors
present in our proposed system model are briefly described as follows:
1) Control Centre: The control centre is the central facility that monitors
and coordinates the grid operations. Typically, the control centre has cloud
servers and computational resources which provide sufficient computation power
to act as the central orchestrator of the FL set-up. It will be mainly
responsible for initializing the global model, broadcasting the model
parameters to the edge-based SCADA sub-systems and lastly, aggregating the
shared model gradients from the edge-based clients. We assume that the control
centre is an honest-but-curious participant, which means that the control
centre attempts to learn as much a possible without acting adversarial.
2) SCADA Sub-systems: The SCADA sub-systems are edge-based clients with
advanced data acquisition capabilities that play a significant role in the
collection and monitoring of data sensed by each sensor device (i.e., IED)
within a power grid system. The SCADA sub-systems will act as the FL nodes
whereby they will train a local model using their own local dataset and update
the compressed gradients to the control centre. Furthermore, we assume that
each SCADA sub-system is honest and not curious, in which case they will not
be communicating with each other laterally.
3) Power Grid Zones: The power grid zones are considered to be equipped with
decentralized monitoring of the SG which consist of sensor networks and IEDs
(such as relays, synchrophasors, and so on). The IEDs across the physical
power grids constantly sense grid-related data including voltage phase angle,
current magnitude, relay status, and so on. The IEDs are assumed to be
connected to the SCADA sub-system using high-speed communication network to
transmit sensed data frequently.

###  3.2 Proposed Attack Detection Module

Figure 2: A schematic overview of our proposed attack detection module
architecture with an example of a data sample going through the anomaly
detection process. The detection module consists of three components: 1)
Encoder: The encoder compresses the input into a lower dimensional latent
space representation. 2) Latent Distribution: By imposing a bottleneck in the
network, we enforce a compressed knowledge representation of the original
input such that sample latent vectors can be fed to the decoder. 3) Decoder:
The decoder outputs a reconstruction of the original input which is then
compared against the original input.

The problem of cyber attack detection in power systems is formulated using a
DAE model, as shown in Figure 2. DAEs are powerful unsupervised representation
learning-based neural networks whose goals are to achieve identity mapping
between their inputs and outputs [34]. Auto-encoders learn important features
of by sending an input vector, $x_{i}$, to an encoder, $f_{\alpha}$, which
maps $x_{j}$ to a latent space representation (also commonly referred to as
information bottleneck), $y^{(j)}$ which is essentially a compressed low-
dimensional knowledge representation of the original input, such that
$y^{(j)}=f_{\alpha}(x_{j})=a(Zx_{j}+c)$, where $a$ is an element-wise
activation function, $Z$ is the weight matrix and $c$ is the bias vector of
the encoder. The sample latent vector, $y_{j}$ is then passed to the decoder,
$g_{\alpha^{\prime}}$, which performs a reconstruction of the original input,
$x_{j}$, through
$x_{j}=g_{\alpha^{\prime}}(y_{i})=a(Z^{\prime}y_{j}+c^{\prime})$ while
minimizing the reconstruction error. The parameters of the model $Z$,
$Z^{\prime}$, $c$ and $c^{\prime}$ are to be adjusted throughout the federated
training process such that $\alpha$,
$\alpha^{\prime}=arg\displaystyle{\min_{\alpha,\alpha^{\prime}}}\ell(x_{j},y_{j})$
where $\ell(x_{j},y_{j})$ is the reconstruction error function to be
minimized.

The proposed DAE network architecture consists of two symmetrical deep belief
networks, the first five shallow layers representing the encoding half of the
network and the second set of five shallow layers representing the model’s
decoding part. The layers consist of Restricted Boltzmann Machines (RBMs),
which are the building blocks of deep belief networks. Each RBM layer allows
communication between its previous and subsequent layer, i.e., it serves as a
hidden layer to the previous nodes and as a visible layer to the subsequent
nodes. However, there is no lateral communication between nodes of a single
layer. The RBMs are trained using the Contrastive Divergence Algorithm [35].
In addition, all the DAE layers used rectified linear unit (ReLU) activation
function as it improves the performance of RBMs, is easier to train and often
achieves better performance. The reconstruction error is a description of the
existence of cyber attacks. In our scenario, the reconstruction error metric
selected is the Mean Squared Error (MSE) which acts as a measurement of
anomaly degree. If the reconstruction error, $r$, exceeds a certain threshold
$\tau$, then a cyber attack may have occurred. At the end of the training
process, the reconstruction errors for the training set are sorted in
ascending order and the value where an inflection point occurs in the error
distribution is chosen as the value for $t$. For the purpose of
classification, we add soft-max layers at the end of the RBM stack. The batch
size and learning rate for training was set to 100 and 10-3 respectively. This
model serves as the basis for FDI attack detection in this manuscript.

###  3.3 Privacy-preserving Gradient Quantization Mechanism

During training, the goal of the DAE is to optimize the objective function,
$g(x)=arg\displaystyle{\min_{\alpha,\alpha^{\prime}}}\ell(x_{j},y_{j})$ such
that the reconstruction error is minimized. Typically, the search for the
optimal DAE parameters for any given identity-mapping task, $f:M\rightarrow
N$, within an FL set-up, can be accomplished through the use of Stochastic
Gradient Descent (SGD) algorithm which chooses the loss of random training
samples to approximate the objective function. However, as depicted in Figure
1, large-scale federated training for cyber attack detection in smart grid
systems requires frequent bi-directional communication of local model updates
between the control centre and the SCADA sub-systems. The size of the local
model updates increases the communication bandwidth which limits the
scalability of our proposed approach to larger number of client nodes.
Furthermore, the context of local model gradients can leak privacy through
easy accessibility, thus not conforming to the privacy-preserving guarantees
of FL [11].

Input: learning rate $\eta$, one-bit quantizer $sign(.)$, $K$ SCADA sub-
systems with independent gradients $g^{t}_{k}$, current weight parameter
$Z^{t}$.

SCADA sub-system:

Compute normalized gradient $\bar{g}^{t}_{k}=g^{t}_{k}-\mu^{t}_{k}$. Compute
quantized gradient $\hat{g}^{t}_{k}=dpsign(\bar{g}^{t}_{k})$. Send
$\hat{g}^{t}_{k}$ to control centre.

Control Centre:

Obtain gradient $\hat{g}^{t}_{k}$ from each SCADA sub-system $k$. Compute new
gradient $\hat{g}_{MV}$ through majority-vote based aggregation of
$\hat{g}^{t}_{k}$ for all $K$ such that $\hat{g}_{MV}$ =
$sign\left(\displaystyle\sum^{K}_{k=1}\hat{g}^{t}_{k}\right)$. Update new
model parameters $Z^{t+1}$ such that $Z^{t+1}$ = $Z^{t}-\eta^{t}\hat{g}_{MV}$.
Send $Z^{t+1}$ to each $k$.

Algorithm 1 Gradient Quantization Mechanism

Therefore, to further improve the communication efficiency of our proposed
framework, we propose the use of a gradient quantization approach to reduce
the communication bandwidth through the approximation of gradients to low-
precision values. Specifically, we leverage the use of the DP-SIGNSGD [15]
algorithm whereby after local model training, each SCADA sub-system, $k$
performs a zero-mean normalization of its local gradient, $g^{t}_{k}$, such
that $\bar{g}^{t}_{k}=g^{t}_{k}-\mu^{t}_{k}$ in order to make the one-bit
quantized outputs from all $K$ uniformly distributed. Each $k$ then compresses
its local normalized gradient $\bar{g}^{t}_{k}$ by utilizing a one-bit
differentially-private quantizer which simply takes the sign of
$\bar{g}^{t}_{k}$, such that $\hat{g}^{t}_{k}=dpsign(\bar{g}^{t}_{k})$. Each
SCADA sub-systems then sends its quantized gradients, $\hat{g}^{t}_{k}$ to the
control centre instead of its actual local gradient $g^{t}_{k}$. On the other
hand, to attain a one-bit compressed global gradient estimate, the control
centre applies a majority-vote based aggregation method as detailed in [36] to
takes the sign of the summation of the one-bit local gradients such that
$\hat{g}_{MV}=sign\left(\displaystyle\sum^{K}_{k=1}\hat{g}^{t}_{k}\right)$.
Following the estimation of $\hat{g}_{MV}$, the control centre updates the new
weight parameters of the model as $Z^{t+1}=Z^{t}-\eta^{t}\hat{g}_{MV}$ where
$\eta^{t}\in(0,1)$ is the learning rate of the SGD algorithm. This gradient
quantization technique combined with majority-voting for model updates
aggregation, as presented in Algorithm 1 reduces the byte size of the gradient
updates exchanged between the SCADA sub-systems and the control centre to
enhance communication efficiency.

###  3.4 Federated Learning Framework

As illustrated in Figure 1, we consider an FL scenario whereby a a control
centre is connected to $K$ SCADA sub-systems via a communication systems (such
as the IEC 61850 protocol). In our proposed framework, we assume that the data
communication protocol between the SCADA sub-system and the control center is
secure and trustworthy. The primary objective of of the FL scenario is to
collaboratively train the global DAE model accross the different SCADA sub-
systems using their own local dataset without having to upload sensitive power
related data to the control centre. Each SCADA-subsystem dataset is acquired
from multiple IEDs present within the respective power grid system zone. Let
$D_{k}=\\{a_{k}^{i},b_{k}^{i}\\}^{N_{k}}_{i=1}$ be the training dataset for a
particular SCADA-subsystem $k\in[K]$ where $N_{k}=|D_{k}|$ is the number of
data points for each $D_{k}$. It is important to note that the data
distributions are Non-IID, as with a real-world cyber attack detection
scenario. Therefore, the objective function $f_{k}$ for a shared global DAE
model parameter $Z\in\mathbb{R}^{M}$ can be defined as
$f_{k}(Z)=\dfrac{1}{N_{k}}\displaystyle\sum_{i=1}^{N_{k}}\ell\left(\\{a_{k}^{i},b_{k}^{i}\\};Z\right)$,
where $\ell(.):\mathbb{R}^{M}\times\mathbb{R}\rightarrow\mathbb{R}$ is the
loss to be optimized for the data point $\left(a_{k}^{i},b_{k}^{i}\right)$.
Furthermore, the global objective function $F$ over all the distributed $K$
datasets is defined as
$F(Z)=\displaystyle\sum_{k=1}^{K}\dfrac{N_{k}}{N}f_{k}(Z)$ which is the sum of
the local loss functions for each $k$, where $N$ is the total data points for
training.

Input: learning rate $\eta$, one-bit quantizer $sign(.)$, $K$ SCADA sub-
systems, Local training set $D_{k}$ for $k\in[1,K]$ Initialize common
unanimous model parameter $Z_{0}$.

for  _each communication round $t$ in $T_{cl}\in(1,n)$_ do

Control Centre:

Obtain gradient $\hat{g}^{t}_{k}$ from each SCADA sub- system $k$. Compute new
gradient $\hat{g}_{MV}$ through majority-vote based aggregation of
$\hat{g}^{t}_{k}$ for all $K$ such that $\hat{g}_{MV}$ =
$sign\left(\displaystyle\sum^{K}_{k=1}\hat{g}^{t}_{k}\right)$. Update new
model parameters $Z^{t+1}$ such that $Z^{t+1}$ = $Z^{t}-\eta^{t}\hat{g}_{MV}$.
Send $Z^{t+1}$ to each $k$.

SCADA Sub-System:

for  _each $k\in[K]$_ do

Compute local gradient $g^{t}_{k}=\nabla f_{k}(Z^{t})$ using $D_{k}$. Compute
normalized gradient $\bar{g}^{t}_{k}=g^{t}_{k}-\mu^{t}_{k}$. Compute quantized
gradient $\hat{g}^{t}_{k}=dpsign$ $(\bar{g}^{t}_{k})$. Update
$\hat{g}^{t}_{k}$ to control centre. end

end

Algorithm 2 Proposed FL Framework

During a specific $t^{th}$ communication round, our proposed FL framework
detailed in Algorithm 2 consists of five specific implementation phases as in
the following: 1) Downlink Communication: The control centre distributes the
global DAE model parameter $Z^{t}$ to all $K$ SCADA-subsystems. For the sake
of this work, we assume a secure latency and error-free communication whereby
all $K$ SCADA-subsystems receive the correct initialized model parameter
$Z^{t}$ at similar time. 2) Local Model Training: Each SCADA-subsystem $k$ for
$k\in[K]$ computes a local gradient $g^{t}_{k}=\nabla f_{k}(Z^{t})$ using its
local training dataset $D_{k}\in[K]$ and $Z^{t}$. 3) Gradient Quantization:
Each $k\in[K]$ performs a zero-mean normalization of its local gradient
$g^{t}_{k}$ such that $\bar{g}^{t}_{k}=g^{t}_{k}-\mu^{t}_{k}$. The normalized
gradient $\bar{g}^{t}_{k}$ is then quantized using DP-SIGNSGD as detailed in
Section 3.3 and Algorithm 1 such that
$\hat{g}^{t}_{k}=dpsign(\bar{g}^{t}_{k})$. 4) Uplink Communication: Each
SCADA-subsystem $k$ for $k\in[K]$ updates its locally-computed one-bit
quantized gradient to the control centre over the wireless communication
protocol. 5) Model Aggregation: Once the control centre receives
$\hat{g}^{t}_{k}$ from each $k\in[K]$, it performs a majority-vote based
aggregation and summation of all the one-bit $\hat{g}^{t}_{k}$ to obtain the
global gradient estimate $\hat{g}_{MV}$. The control centre then updates the
new weight parameter $Z^{t+1}$ to each SCADA-subsystem $k\in[K]$.

##  4 Experimental Results and Discussions

The cyber attack detection performance of each individual SCADA sub-system is
directly correlated to the overall performance of our proposed framework, as
discussed in Section 3. Thus, in this section, we evaluate the performance of
our proposed architecture in terms of cyber attack detection performance, and
communication efficiency.

###  4.1 Dataset and Feature Space Preparation

We evaluate our proposed architecture using the Mississippi State University
and Oak Ridge National Laboratory Power System Attack (MSU-ORNL PS) Dataset
[37]. It consists of 128 features and 1 target marker variable with data logs
collected from four Phasor Measurement Units (PMUs). A Real-Time Digital
Simulator (RTDS) was used to simulate the power system scenario implementation
and data generation within a hardware-in-the-loop test bed configuration. Each
PMU collected real-time synchrophasor measurement data which includes
frequency, current phase angle, current phase magnitude, voltage phase angles,
voltage phase magnitude, etc. at a rate of 120 samples per second. For this
research, based on the dataset, we assume that an adversary is able to
penetrate the power grid zones and launch cyber attacks from within the
operational network of each power grid zones. The dataset consists of 15 data
files which are binary classes whereby scenarios of Astem disturbances (marked
as Natural Events) and power systems cyber attacks (marked as Attack Events)
have been simulated. The cyberattacks include FDI attack and tripping command
injection attack, as used in [37].

To deal with missing values present within the dataset (which may be a result
of SCADA communication failure [38]), we use a traditional machine learning-
based K-Nearest Neighbour (KNN) missing value imputation to avoid information
loss instead of downsampling. Detection performance typically depends on the
appropriate selection of the basis of the feature space. Therefore, we apply
Principal Component Analysis (PCA) algorithm to cull out some features of the
data that are difficult to reconstruct such that the remaining features can be
represented through a compressed low-dimensional knowledge representation with
minimal reconstruction error. A basis of 100 features is determined. Next, we
normalize the input data into the range of (0,1) to accelerate model
convergence. Lastly, we sample 30% of the dataset for testing the accuracy of
the global FDI detection model while the remaining training data is divided
amongst distributed power grid zones for FL local model training.

###  4.2 Attack Detection Performance

Figure 3: Comparison of the average performance of five deep learning attack detection models over the fifteen data files of the dataset. The results demonstrate the superiority of our proposed framework in attack detection over fifteen data files.  Figure 4: Comparison of the average performance of proposed DAE model vs other traditional machine learning models over the fifteen data files of the dataset. Similarly, the results demonstrate the superiority of our proposed framework in attack detection over fifteen data files. Figure 5: Comparison of the average performance of four other deep learning attack detection models against our proposed approach over the whole dataset based on the percentage accuracy, precision, recall and F-Score metrics. The results demonstrate the superiority of our proposed framework in attack detection over the whole dataset.  Figure 6: Comparison of the average performance of four traditional machine learning attack detection models against our proposed approach over the whole dataset based on accuracy, precision, recall and F-Score metrics. The results demonstrate the superiority of our proposed framework in attack detection over the whole dataset.  Metric Learning Model | Proposed Approach | CNN | LSTM | RNN | RBM
---|---|---|---|---|---
Accuracy (%) | 94.8 | 90.3 | 81.3 | 75.3 | 79.3
Precision (%) | 92.7 | 91.8 | 78.5 | 73.5 | 78.2
Recall (%) | 92.8 | 90.9 | 78.1 | 73.0 | 77.7
F-Score (%) | 93.6 | 91.1 | 79.2 | 73.2 | 77.9
Table 1: Comparison of the average attack detection performance of various deep learning models to our proposed DAE over the whole dataset. We compare our proposed DAE model to CNN, LSTM, RNN and RBM models, all of which are trained in a FL setup. It was found that our proposed approach outperforms all competing models in terms of attack detection performance.  Metric Learning Model | Proposed Approach | LR | RF | NB | SVM
---|---|---|---|---|---
Accuracy (%) | 94.8 | 73.3 | 79.9 | 69.7 | 75.3
Precision (%) | 92.7 | 73.1 | 79.3 | 68.1 | 75.4
Recall (%) | 92.8 | 72.7 | 78.9 | 69.2 | 74.9
F-Score (%) | 93.6 | 72.9 | 79.2 | 70.0 | 75.1
Table 2: Comparison of the average attack detection performance of different
traditional machine learning models to our proposed DAE over the whole
dataset. We compare our proposed FL framework to centralized LR, RF, NB and
SVM traditional machine learning models. The results demonstrate the
superiority of our proposed framework in attack detection.

We evaluated the attack detection performance of our proposed FedDiSC
framework to four other popular models used in SG cyber attack detection
namely Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM),
Recurrent Neural Network (RNN) and Restricted Blotzmann Machine (RBM). All the
competing models are trained in similar FL-based set-up and configuration. We
evaluate these models on the MSU-ORNL dataset described in Section 4.1.
Initially, we train the FL models on the training sets and we evaluate and
compare the accuracy of the global models after training on the MSU-ORNL PS
test sets. In Figure 3, the experimental validations reveal that the proposed
DAE model achieves superior accuracy over all 15 data files. For instance, the
accuracy of our proposed DAE model on data1 is 94.8% as compared to the CNN
model which is 89.9% or the LSTM model which is 81.5%. Similarly, for data15,
the DAE model outperforms the RBM model by 13.6% and the RNN model by 19.9%.
This shows that our proposed DAE model has improved robustness to different
power grid related datasets which is due to the fact that FL enables learning
of features from multiple SCADA subsystems, thereby resulting in improved
robustness of the model. Furthermore, we compare the average attack
performance of the global DAE model over the test sets as presented in Table 1
and Figure 5 using four classification metrics namely accuracy, precision,
recall and F-Score. From the experimental results, we observe that the our
proposed model outperforms the other competing ones in all three metrics. For
example, the precision of the DAE model is superior to that of the competing
CNN, LSTM, RNN and RBM by 0.9%, 14.2%, 19.2% and 14.5% respectively. Likewise,
the recall of our proposed model outshines those of the rivalling models by
1.9%, 14.7%, 19.8% and 15.1% respectively while the F-Score of our proposed
model is superior to that of the aforementioned ones by 2.5%, 14.4%, 20.4% and
15.7% respectively.

Furthermore, we evaluated the attack detection performance of our proposed
approach to that of four popular traditional machine learning-based models
that have been used in previous literature namely, Logistic Regression (LR),
Random Forest (RF), Naive Bayes (NB) and Support Vector Machine (SVM). Among
those competing models, only our proposed model is trained in a federated
learning set-up while the remainder are centralized ones. In Figure 4, we
evaluated the accuracy of our proposed global DAE model against four different
centralized traditional machine learning models over all 15 data files. For
example, the accuracy of our proposed model on data1 is 94.8% as compared to
the LR model which is 72.9% or the NB model which is 69.4%. Similarly, for
data 15, the accuracy of our proposed model outshines that of RF and SVM by
12.9% and 10.0% respectively. The experimental results, as depicted in Table 2
and Figure 6, we observe that our proposed approach results in the highest
attack detection performance as compared to the other rivalling traditional
machine learning models. For instance, our proposed FL approach achieves
higher precision compared to LR, RF, NB and SVM by 19.6%, 13.4%, 24.6% and
17.3% respectively. This may be due to the fact that deep learning algorithms
are superior to the performance of traditional machine learning models as they
try to learn high-level features from data in an incremental manner and
improve with larger datasets. On the other hand, our experimental validations
reveal that Naive Bayes has the worst overall performance amongst all the
models used for comparison purposes and achieved an attack detection accuracy
of merely 69.7%.

Lastly, we compare the results of our proposed FL-based cyber attack detection
framework against that of state-of-the-art literature within this topic. The
authors in [39] developed a hybrid intrusion detection system using common
paths mining algorithm and evaluated their proposed approach on similar
dataset. They achieved an overall average accuracy of 73.43% while our
proposed framework had an accuracy level of 94.8%. Similarly, in comparison
with [40], we achieved improved accuracy of cyber-attack detection. Therefore,
we can conclude that our proposed FL framework for cyber attack and power
system disturbance discrimination achieves sufficient detection accuracy as
compared to other deep learning models whilst guaranteeing privacy of
sensitive power grid related information and being computationally efficient.

###  4.3 Computational Efficiency of Our Proposed Approach

Subsequently, we evaluate the computation efficiency achieved by the gradient
compression approach utilized in our proposed FDI attack detection framework
as detailed in Section 3.3. Specifically, we contrast the training time of the
models, between the proposed FL framework with Gradient Quantization (GQ) and
the traditional FL approach without GQ. We use similar models with similar
hyper-parameters for comparison within both setups such that the training time
of the models can be used to estimate the computational efficiency of our
proposed approach. In Figure 7, we provide a comparison of the computational
efficiency between the proposed FL framework with GQ scheme and traditional FL
approach without the GQ scheme using different models. As depicted in Figure
7, we note that for all the models compared, the training time of the models
decrease whenever our proposed FL framework with GQ scheme is utilized.
Specifically, it can be highlighted that the training time for our GQ-based FL
approach is around 40% less than the traditional FL framework without GQ. This
is due to the fact that the privacy-preserving GQ scheme utilized in our
proposed FL framework decreases the byte size of the gradients shared during
the control centre and SCADA subsystem to one-bit without compromising the
accuracy of detection of the model as discussed in Section 4.2.

###  4.4 Summary of Findings

Figure 7: Training time comparison between proposed FL framework with gradient
quantization scheme and traditional FL approach without gradient quantization
scheme. The results of our proposed framework demonstrate a 40% decrease in
training time in comparison against other approaches.

In this study, we have focused on the detection of FDI attacks in SGs with the
assumption that the SG is partitioned into $N$ number of zones where
$N\in\mathbb{R}^{+}$. Specifically, we proposed an FL-based cyber attack
detection approach using a deep auto-encoder model for power systems
disturbance and cyber attack discrimination. We evaluated our proposed
approach using the MSU-ORNL PS dataset. As presented in Section 4.2, we
observe that our proposed FL-based DAE approach achieves the best overall
detection performance on the dataset as compared to other models trained in
similar fashion. In addition, we evaluated our work against centralized
machine learning models which reveals that our proposed framework is superior
in discriminating cyber attacks against power system faults. Similarly, a
brief comparison against state-of-the-art reveals comparable performance which
validates the real-world application of our proposed method for cyber attack
detection. Furthermore, we improve the communication efficiency of the
proposed FL architecture with a differentially private SIGNSGD-based gradient
quantization scheme that conforms to the privacy-preserving nature of FL. The
results, as illustrated in Figure 7 highlight a 40% decrease in training time
of the proposed framework as compared to a traditional FL detection model.
Therefore, we can conclude that our proposed framework provides sufficient
detection accuracy while improving the overall communication efficiency for
FDI attack detection.

While sufficient model performance is vital metric for effective FDI attack
detection and has been achieved in our work, it is worth discussing that our
proposed approach significantly differs from previous works as we also take
into account the security and privacy of sensitive power related information.
We restrict the training of models to only edge-based SCADA sub-systems on
their local datasets which eliminates the need of data sharing to the control
centre and raw data access by unauthorized attackers. Furthermore, the use of
a privacy-preserving gradient quantization scheme complemented with
differential privacy tackles the severe deep gradient leakage drawback
suffered by FL algorithms. Adversaries are unable to get access to the raw
gradients of the models shared during training and are thus, unable to extract
sensitive power related information or even reconstruct the raw training data
[11]. Therefore, we believe that our proposed privacy-preserving
communication-efficient framework is practical for real-world SG attack
detection applications.

##  5 Conclusion

Throughout this manuscript, we propose a novel communication efficient and
privacy-preserving on-device federated learning-based intrusion detection
approach for power systems disturbance and cyberattack discrimination in smart
grids. First, we propose a federated learning-based framework that enables
power sensing devices to collaboratively train the intrusion detection model
without requiring the need for data sharing which tackles the problem of data
privacy. Second, we propose a representation learning-based auto-encoder for
accurate discrimination between natural power disturbances and cyberattack
events. We extensively evaluate the performance of our proposed model on a
popular binary power system dataset and compare it to several other machine
learning/deep learning algorithms. The experimental results show that the
auto-encoder model achieves superior accuracy over other methods on this
particular dataset. Lastly, we propose the use of a sign-based gradient
quantization scheme to enhance the communication efficiency of our proposed
federated learning framework. The experimental findings show that this
gradient quantization mechanism decreases the training time by nearly 40%,
proving that quantized gradients improve communication efficiency.

In future work, we aim to improve the robustness of the power system intrusion
detection models by leveraging ensembled learning methods. Furthermore, we
will focus on researching techniques to improve the security of our federated
learning framework, as one of our previous works [11] highlights that
federated learning frameworks are vulnerable to byzantine attacks.

## References

  * [1] Muhammad Akbar Husnoo, Adnan Anwar, Nasser Hosseinzadeh, Shama Naz Islam, Abdun Naser Mahmood, and Robin Doss.  False data injection threats in active distribution systems: A comprehensive survey, 2021.
  * [2] Muhammad Akbar Husnoo, Adnan Anwar, Nasser Hosseinzadeh, Shama Naz Islam, Abdun Naser Mahmood, and Robin Doss.  Fedrep: Towards horizontal federated load forecasting for retail energy providers, 2022.
  * [3] Po-Yu Chen, Shusen Yang, Julie A. McCann, Jie Lin, and Xinyu Yang.  Detection of false data injection attacks in smart-grid systems.  IEEE Communications Magazine, 53(2):206–213, 2015.
  * [4] Raymond C. Borges Hink, Justin M. Beaver, Mark A. Buckner, Tommy Morris, Uttam Adhikari, and Shengyi Pan.  Machine learning for power system disturbance and cyber-attack discrimination.  In 2014 7th International Symposium on Resilient Control Systems (ISRCS), pages 1–8, 2014.
  * [5] Haftu Tasew Reda, Adnan Anwar, and Abdun Mahmood.  Comprehensive survey and taxonomies of false data injection attacks in smart grids: attack models, targets, and impacts.  Renewable and Sustainable Energy Reviews, 163:112423, Jul 2022.
  * [6] Adnan Anwar and Abdun Naser Mahmood.  Anomaly detection in electric network database of smart grid: Graph matching approach.  Electric Power Systems Research, 133:51–62, Apr 2016.
  * [7] Mohammad Esmalifalak, Lanchao Liu, Nam Nguyen, Rong Zheng, and Zhu Han.  Detecting stealthy false data injection using machine learning in smart grid.  IEEE Systems Journal, 11(3):1644–1652, 2017.
  * [8] Adnan Anwar, Abdun Naser Mahmood, and Zubair Shah.  A data-driven approach to distinguish cyber-attacks from physical faults in a smart grid.  In Proceedings of the 24th ACM International on Conference on Information and Knowledge Management, CIKM ’15, page 1811–1814, New York, NY, USA, 2015. Association for Computing Machinery.
  * [9] Lei Wei, Donghuai Gao, and Cheng Luo.  False data injection attacks detection with deep belief networks in smart grid.  In 2018 Chinese Automation Congress (CAC), pages 2621–2625, 2018\.
  * [10] Thusitha Dayaratne, Mahsa Salehi, Carsten Rudolph, and Ariel Liebman.  False data injection attack detection for secure distributed demand response in smart grids.  In 2022 52nd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), pages 367–380, 2022.
  * [11] Muhammad Akbar Husnoo, Adnan Anwar, Nasser Hosseinzadeh, Shama Naz Islam, Abdun Naser Mahmood, and Robin Doss.  A secure federated learning framework for residential short term load forecasting, 2022.
  * [12] Liang Zhao, Jiaming Li, Qi Li, and Fangyu Li.  A federated learning framework for detecting false data injection attacks in solar farms.  IEEE Transactions on Power Electronics, 37(3):2496–2501, 2022.
  * [13] Wen-Ting Lin, Guo Chen, and Yuhan Huang.  Incentive edge-based federated learning for false data injection attack detection on power grid state estimation: A novel mechanism design approach.  Applied Energy, 314, 2022.
  * [14] Yang Li, Xinhao Wei, Yuanzheng Li, Zhaoyang Dong, and Mohammad Shahidehpour.  Detection of false data injection attacks in smart grid: A secure federated deep learning approach.  IEEE Transactions on Smart Grid, 13(6):4862–4872, 2022.
  * [15] Lingjuan Lyu.  Dp-signsgd: When efficiency meets privacy and robustness, 2021.
  * [16] Seyed Hossein Majidi, Shahrzad Hadayeghparast, and Hadis Karimipour.  Fdi attack detection using extra trees algorithm and deep learning algorithm-autoencoder in smart grid.  International Journal of Critical Infrastructure Protection, 37:100508, Jul 2022.
  * [17] Zubair Md. Fadlullah, Mostafa M. Fouda, Nei Kato, Xuemin Shen, and Yousuke Nozaki.  An early warning system against malicious activities for smart grid communications.  IEEE Network, 25(5):50–55, 2011.
  * [18] B M Ruhul Amin, Adnan Anwar, and M. J. Hossain.  Distinguishing between cyber injection and faults using machine learning algorithms.  In 2018 IEEE Region Ten Symposium (Tensymp), pages 19–24, 2018\.
  * [19] Jinping Hao, Robert J. Piechocki, Dritan Kaleshi, Woon Hau Chin, and Zhong Fan.  Sparse malicious false data injection attacks and defense mechanisms in smart grids.  IEEE Transactions on Industrial Informatics, 11(5):1–12, 2015.
  * [20] Can Yang, Yong Wang, Yuhao Zhou, Jiongming Ruan, and Wei Liu.  False data injection attacks detection in power system using machine learning method.  Journal of Computer and Communications, 06(11):276–286, 2018.
  * [21] Ajit Kumar, Neetesh Saxena, and Bong Jun Choi.  Machine learning algorithm for detection of false data injection attack in power system.  In 2021 International Conference on Information Networking (ICOIN), pages 385–390, 2021.
  * [22] Adnan Anwar, Abdun Mahmood, Biplob Ray, Md Apel Mahmud, and Zahir Tari.  Machine learning to ensure data integrity in power system topological network database.  Electronics, 9(4):693, Apr 2020.
  * [23] Xiangyu Niu, Jiangnan Li, Jinyuan Sun, and Kevin Tomsovic.  Dynamic detection of false data injection attack in smart grid using deep learning.  In 2019 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), pages 1–6, 2019.
  * [24] Shuoyao Wang, Suzhi Bi, and Ying-Jun Angela Zhang.  Locational detection of the false data injection attack in a smart grid: A multilabel classification approach.  IEEE Internet of Things Journal, 7(9):8218–8227, 2020.
  * [25] Yufeng Wang, Zhihao Zhang, Jianhua Ma, and Qun Jin.  Kfrnn: An effective false data injection attack detection in smart grid based on kalman filter and recurrent neural network.  IEEE Internet of Things Journal, 9(9):6893–6904, 2022.
  * [26] Kübra Bitirgen and Ümmühan Başaran Filik.  A hybrid deep learning model for discrimination of physical disturbance and cyber-attack detection in smart grid.  International Journal of Critical Infrastructure Protection, 40:100582, Mar 2023.
  * [27] H. Brendan McMahan, Eider Moore, Daniel Ramage, Seth Hampson, and Blaise Agüera y Arcas.  Communication-efficient learning of deep networks from decentralized data, 2016.
  * [28] Afaf Taïk and Soumaya Cherkaoui.  Electrical load forecasting using edge computing and federated learning.  In ICC 2020 - 2020 IEEE International Conference on Communications (ICC), pages 1–6, 2020.
  * [29] Venkatesh Venkataramanan, Sridevi Kaza, and Anuradha M. Annaswamy.  Der forecast using privacy preserving federated learning.  IEEE Internet of Things Journal, pages 1–1, 2022.
  * [30] Nastaran Gholizadeh and Petr Musilek.  Federated learning with hyperparameter-based clustering for electrical load forecasting.  Internet of Things, 17:100470, Mar 2022.
  * [31] Yang Yang, Zijin Wang, Shangrui Zhao, and Jinran Wu.  An integrated federated learning algorithm for short-term load forecasting.  Electric Power Systems Research, 214:108830, Jan 2023.
  * [32] Mi Wen, Rong Xie, Kejie Lu, Liangliang Wang, and Kai Zhang.  Feddetect: A novel privacy-preserving federated learning framework for energy theft detection in smart grid.  IEEE Internet of Things Journal, 9(8):6069–6080, 2022.
  * [33] Muhammad Mansoor Ashraf, Muhammad Waqas, Ghulam Abbas, Thar Baker, Ziaul Haq Abbas, and Hisham Alasmary.  Feddp: A privacy-protecting theft detection scheme in smart grids using federated learning.  Energies, 15(17):6241, Aug 2022.
  * [34] Chong Zhou and Randy C. Paffenroth.  Anomaly detection with robust deep autoencoders.  KDD ’17, page 665–674, New York, NY, USA, 2017. Association for Computing Machinery.
  * [35] Sascha Lange and Martin Riedmiller.  Deep auto-encoder neural networks in reinforcement learning.  In The 2010 International Joint Conference on Neural Networks (IJCNN), pages 1–8, 2010.
  * [36] Jeremy Bernstein, Yu-Xiang Wang, Kamyar Azizzadenesheli, and Animashree Anandkumar.  signSGD: Compressed optimisation for non-convex problems.  In Jennifer Dy and Andreas Krause, editors, Proceedings of the 35th International Conference on Machine Learning, volume 80, pages 560–569. PMLR, 2018.
  * [37] Uttam Adhikari, Shengyi Pan, Tommy Morris, Raymond Borges, and Justin Beaver.
  * [38] Adnan Anwar, Abdun Naser Mahmood, and Mark Pickering.  Data-Driven Stealthy Injection Attacks on Smart Grid with Incomplete Measurements, volume 9650, page 180–192.  Springer International Publishing, Cham, 2016.
  * [39] Shengyi Pan, Thomas Morris, and Uttam Adhikari.  Developing a hybrid intrusion detection system using data mining for power systems.  IEEE Transactions on Smart Grid, 6(6):3104–3113, 2015.
  * [40] Shengyi Pan, Thomas Morris, and Uttam Adhikari.  Classification of disturbances and cyber-attacks in power systems using heterogeneous time-synchronized data.  IEEE Transactions on Industrial Informatics, 11(3):650–662, 2015\.