# False Data Injection Attacks in Smart Grids:
State of the Art and Way Forward

Muhammad Irfan1§, Alireza Sadighian1§, Adeen Tanveer1, Shaikha J. Al-Naimi1,
Gabriele Oligeri1
1 Division of Information and Computing Technology
College of Science and Engineering, Hamad Bin Khalifa University
Qatar Foundation, Doha, Qatar.
_{<EMAIL_ADDRESS>
(March 2023)

###### Abstract

In the recent years, cyber-attacks to smart grids are becoming more frequent.
Among the many malicious activities that can be launched against smart grids,
False Data Injection (FDI) attacks have raised significant concerns from both
academia and industry. FDI attacks can affect the (internal) state estimation
process—critical for smart grid monitoring and control—thus being able to
bypass conventional Bad Data Detection (BDD) methods. Hence, prompt detection
and precise localization of FDI attacks is becomming of paramount importance
to ensure smart grids security and safety. Several papers recently started to
study and analyze this topic from different perspectives and address existing
challenges. Data-driven techniques and mathematical modelings are the major
ingredients of the proposed approaches.

The primary objective of this work is to provide a systematic review and
insights into FDI attacks joint detection and localization approaches
considering that other surveys mainly concentrated on the detection aspects
without detailed coverage of localization aspects. For this purpose, we select
and inspect more than forty major research contributions, while conducting a
detailed analysis of their methodology and objectives in relation to the FDI
attacks detection and localization. We provide our key findings of the
identified papers according to different criteria such as employed FDI attacks
localization techniques, utilized evaluation scenarios, investigated FDI
attack types, application scenarios, adopted methodologies and the use of
additional data. Finally, we discuss open issues and future research
directions.

###### Index Terms:

Smart Grid, False Data Injection, Detection, Localization, Machine Learning,
Deep Learning.

§§footnotetext: Both authors contributed equally to this work.

##  I Introduction

Over the last years, power systems are experiencing the migration to smart
grids, in particular with the increasing popularity of Industrial Internet-of-
Things (IIoT), which has moved to its next stage. However, this
infrastructural upgrade has introduced a number of major challenges.
Vulnerability to cyber-attacks is perhaps the most important challenge among
all others. Adversaries exploit such vulnerabilities to manipulate system
parameters and compromise the underlying infrastructure resulting into various
physical and economical damages [1]. Hence, real-time monitoring of smart
grids is essential to ensure their healthy states. This involves analyzing
continuous data-stream from various measurement devices deployed throughout
the system, which are topologically distributed and structurally interrelated.

Among the various cyber-attacks to smart-grids, False Data Injection (FDI)
raises greater concerns as advised by National Institute of Standards and
Technology (NIST) [2]. Indeed, unlike other attack types, the underlying smart
grid appears to operate as usual since the FDI attack affects the smart grid
state estimation by injecting false data. FDI attacks can be deployed to the
different layers of the smart grid, such as physical layer, communication
layer, network layer and process layer [3]. Recently emerged FDI attacks are
considered as a major challenge to smart grids state estimation as they can
bypass conventional Bad Data Detection (BDD) methods [4].

Defending against FDI attacks has received a lot of attention by researchers.
A few surveys have been devoted to detection solutions based on data-driven
algorithms and mathematical modelings. However, these works do not provide
information about FDI attacks localization. Indeed, beside detection,
identifying the location of the attack is critical in order to define and
issue effective countermeasures, and also, performing preventive actions.
Therefore, recent research has focused on the joint task of detection and
localization of FDI attacks. However, a major challenge that those solutions
encounter is related to their performance, i.e., most attack localization
methods have intrinsic difficulties locating the specific region that is
affected by the FDI attack, in particular considering real-time constraints
and accuracy requirements. Indeed, proposed solutions have high computational
complexity and are difficult to apply to large-sized smart grids.

This survey presents a detailed review of recent research on FDI attack
localization in smart grids with particular emphasis to recent challenges,
enhancements and extension methods. To this aim, we identified a comprehensive
list of papers that address this research challenge in various ways. Next, we
analyzed this list from different perspectives, such as adopted techniques,
application scenario, type of their input data, evaluation techniques, type of
their underlying power systems, etc., and present our key findings and
insights.

Contributions. The contributions of this paper are manifold. Firstly, we
identified state of the art research papers related to smart grids FDI
detection and localization. We summarize each research paper describing its
methodology, evaluation technique and future directions. Subsequently, we
identify two main categories of contributions: data-driven approaches and
mathematical modelings. We describe our findings and insights according to the
different categories, such as application scenarios, input types, adopted
techniques, and input datasets. Finally, we present the limitations and the
existing challenges in the current state of the art while providing some
future directions.

TABLE I: Comparison with the existing surveys

Author | Location Detection | FDIA Detection | Methods | Detection Rate/Accuracy | Comparison with Other Surveys | Comparative Study of Algorithms | Attackers Knowledge Levels | Covered Years
---|---|---|---|---|---|---|---|---
DL | GNN | GSP | MM | ML
Our Survey | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | Full | 2009-2023
Partial
Aoufi _et. al._ [5] | ✗ | ✔ | ✔ | ✗ | ✗ | ✔ | ✔ | ✗ | ✔ | ✗ | Full | 2009-2019
Partial
Cui _et. al._ [6] | ✗ | ✔ | ✔ | ✗ | ✗ | ✗ | ✔ | ✗ | ✗ | ✗ | - | 2013-2019
Deng _et. al._ [4] | ✗ | ✔ | ✗ | ✗ | ✔ | ✔ | ✔ | ✗ | ✗ | ✗ | Full | 2009-2014
Partial
Zero Knowledge
Guan _et. al._ [7] | ✗ | ✔ | ✗ | ✗ | ✔ | ✔ | ✔ | ✗ | ✗ | ✗ | Full | 2009-2013
Husnoo _et. al._ [8] | ✗ | ✔ | ✔ | ✔ | ✔ | ✔ | ✔ | ✗ | ✔ | ✗ | - | 2013-2021
Liang _et. al._ [9] | ✗ | ✔ | ✗ | ✗ | ✗ | ✔ | ✔ | ✗ | ✗ | ✗ | Full | 2009-2015
Musleh _et. al._ [3] | ✗ | ✔ | ✔ | ✗ | ✔ | ✔ | ✔ | ✔ | ✗ | ✔ | Full | 2011-2019
Partial
Zero Knowledge
Reda _et. al._ [10] | ✗ | ✔ | ✔ | ✗ | ✔ | ✔ | ✔ | ✗ | ✔ | ✗ | Full | 2009-2021
Partial
Zero Knowledge
Sayghe _et. al._ [11] | ✗ | ✔ | ✔ | ✗ | ✗ | ✗ | ✔ | ✔ | ✗ | ✗ | Full | 2010-2020
Partial
Zero Knowledge

Roadmap. The rest of this paper is organized as follows. Section II compares
this work with other related survey from the litterature, Section III is
dedicated to the background knowledge about smart grids and their existing
challenges, Section IV describes our review methodology introducing the list
of the selected papers and a preliminary break-down into use cases, Section V
and Section VI summarize our findings related to the data-driven and the
mathematical-modeling based approaches, respectively, Section VII summarizes
the key-findings of our survey, while Section VIII highlights open issues and
future research directions. Finally, Section IX draws some concluding remarks.

##  II Comparison with existing surveys

In this section, we identify a few related surveys covering FDI attacks
analysis. Next, we compare our work with them in terms of key contributions
and extracted insights.

Reda _et al._ in [10] provide a comprehensive review of FDI attacks detection
in smart grids. First, they provide a detailed description of different types
of FDI attacks. Next, they analyze the impacts of these attacks on the target
infrastructures. Moreover, this work studies the requirements for constructing
FDI attacks, such as minimal attack vector, attack sparsity, incomplete
parameters information, and requirements for unobservability of the system.
The covered researches in this work mainly consider partial or full knowledge
of the target system by the adversary.

In [8], Husnoo _et al._ study various FDI attacks targeting active power
distribution systems. They propose a taxonomy of FDI attacks and classify them
with respect to target components in smart grids. The authors also highlight
shortcomings of the approaches proposed in selected studies, and propose
recommendations to address them and mitigate corresponding threats.

Aoufi _et al._ in [12] present a classification of different FDI attacks
affecting State Estimation (SE), Security-Constrained Economic Dispatch
(SCED), Security-Constrained Optimal Power Flow (SCOPF), Contingency Analysis
(CA) in smart grids and discuss strategies to detect and mitigate each attack
class. Moreover, this research highlights the challenges and open research
issues related to FDI attacks including the need for more efficient and
effective detection and mitigation techniques.

Liang _et al._ in [9] study physical and economic impacts of FDI attacks and
provide defense strategies. They also investigate the theoretical basis of FDI
attack construction by highlighting four scenarios that an adversary can
leverage to construct FDI attacks: (i) incomplete information, (ii) false
topology, (iii) AC power flow model, and (iv) limited access to meters.

Guan _et al._ in [7] classify FDI attacks based on Direct Current (DC) power
model, Alternating Current (AC) power model and control system model. They
provide countermeasures for each attack class. Moreover, they discuss existing
problems in this field and provide future directions.

An FDI attack can be considered as an anomaly in a smart grid to be detected
using various data-driven (Artificial Intelligence (AI), Machine Learning (ML)
and Deep Learning (DL)) techniques. Cui _et al._ in [6] review ML-based FDI
attacks detection approaches and categorize them based on their target feature
detection scenarios into state estimation, non-technical loss and load
forecasting. Furthermore, they analyzes the issue of privacy leakage when
using ML techniques for FDI attacks detection and mitigation, and propose
potential countermeasures.

Sayghe _et al._ in [11] investigate data-driven approaches for detecting FDI
attacks targeting state estimation algorithms. The main objective of this
research is to overcome the limitations of traditional residual-based Bad Data
Detection (BDD) approaches.

Similarly but using different methods, Deng _et al._ in [4] investigate the
detection of FDI attacks targeting state estimation. For this purpose, using
mathematical and theoretical concepts, they analyze three main aspects of FDI
attacks: (i) construction, (ii) defense, and (iii) impacts. They examine
adversary perspectives in order to provide appropriate countermeasures.

El-Nasser _et al._ in [13] present a summary of research on FDI attacks
against the state estimation in smart grids. They discuss theoretical
principles of these attacks and classify these attacks based on the attacker
knowledge amount and parameters of target power systems.

Table I compares our work with existing surveys in the literature and
highlights key differences and contributions. The main shortcoming of the
above surveys is that they only concentrate on FDI attacks detection while not
focusing on FDI attacks localization. To the best of our knowledge, this work
is the first effort to conduct a comprehensive survey on FDI attacks joint
detection and localization. Our work covers all the recently published data-
driven and mathematical-modeling based approaches from deep learning and
machine learning to graph signal processing (GSP) and graph neural networks
(GNN). Moreover, our analysis compares the proposed solutions and provides
insights from various dimensions and perspectives, such as attacker knowledge
level, existing datasets, simulation environments, and future directions to
address existing challenges.

##  III Background on Smart Grids

When considering a power system, the keyword grid is associated to an
electrical system. A grid may perform some or all these four operations: (i)
Energy Generation, (ii) Energy Transmission, (iii) Energy Distribution, and
finaly, (iv) Energy control. The energy providers and consumers are connected
in a network through transmission and distribution systems depending upon the
operation. The architecture of a classical electrical power grid is shown in
Fig. 1 where the electrical energy generated at the central power plant is
delivered to end users by converting high voltage levels to lower voltage
levels.

Figure 1: Architecture of a traditional electrical power grid.

A Smart Grid is an advanced version of a power grid where the devices are
connected in order to share information among the domains defined by the
National Institute of Standards and Technologies (NIST) [14]. NIST conceptual
model (Figure 2) includes seven domains: (i) Customer, (ii) Markets, (iii)
Generation including DER, (iv) Transmission, (v) Operation, (vi) Service
Providers, (vii) Distribution. Table II shows the type of service and roles of
each domain. When we compare smart grids with traditional grids, significant
improvements, such as type of communication, energy, monitoring, power
generation, metering system, etc., can be highlighted. Table 2 presents a
brief comparison between a traditional grid and a smart grid.

TABLE II: Domains and roles/services in the smart grid conceptual model | Domain |  Services/Roles in the Domain
---|---|---
1 | Customer |  Three types of customer i- Residential, ii-Commercial, and iii- Industrial. These are the end users and may generate, manage and store the energy.
2 | Markets |  Intermediaries and participants in the power sector and other economic models that encourage activity and improve system results.
3 | Generation including DER |  The production and storage of electricity for later usage including Data Enery Resources (DER).
4 | Transmission |  The carrier of high power energy from one place to another over long distance. The may generate and store electricity.
5 | Operations |  Electricity management
6 | Service Providers |  Provide services to end customer and utilities.
7 | Distribution |  The to and from distribution of electricity to end users (customers).
TABLE III: Traditional grids versus Smart Grids | Traditional Grid | Smart Grid
---|---|---
Communication | One way | Bi-Directional
Energy | Electro-mechanical | Digital
Monitoring | Manual | Self
Power Generation | Centralized | Distributed
Control | Limited | Pervasive
Sensor | Limited | Throughout
Restoration | Manual | Self
Failure | Blackout | Adaptive and islanding
Structure | Hierarchical | Network
Customers Involvement | No | Yes
Metering System | Electro-mechanical | Advanced Metering
| (Electronic)
Figure 2: Conceptual model of a smart grid.

Smart Grids provide real time access to users’ data enabling them to control
users’ consumption patterns in an efficient way [15]. This exchange of
information brings ease to better accommodate renewable energy sources (RES),
and it improves the efficiency and reliability of their operations. However,
such an inter-dependency communication technology makes smart grids
susceptible to various types of vulnerabilities and cyber-attacks. In the
recent years, several concerns were raised on the reliability and security of
smart grids. The potential points which may be compromised are shown in Figure
3. To address these concerns, smart grids need to ensure essential security
requirements, such as data integrity, availability, confidentiality and
accountability, by all the key communication components.

Figure 3: Possible attack sources in a smart grid [16].

###  III-A Smart Grid Components

In this section, we provide a break-down of the smart grid key components.

  * -

Remote terminal units (RTU): an RTU is an electronic device that collects data
periodically from the field-level devices and sends it to the control center,
receives control commands from the control center, and transmits them to the
field-level devices. RTUs can be targeted by various FDI attacks [17][18].

  * -

Phase measurement unit (PMU): Phasor measurement units (PMUs) are devices that
are used to provide synchronized measurements of voltages and currents in
real-time. By sampling voltage and current waveforms simultaneously,
synchronization is accomplished using timing signals from the Global
Positioning System Satellite (GPS). These measurements provide information
regarding the state of the network. PMU devices can be targeted by attackers
to conduct different attacks, such as time synchronization and Data
Manipulation attacks [19][20].

  * -

Power system state estimation (PSSE): PSSE modules utilize information
provided by RTUs and PMUs to perform current operating status estimations by
statistical projections. FDI attacks on PSSEs are well studied in researches,
such as [21] [22].

  * -

Advanced metering infrastructure (AMI): AMI is an integrated system of smart
meters, communication networks, and data management systems that providing
two-way communication between utilities and customers. AMI serves as an
intermediary between consumers and utilities and is constituted of three
tiers: (i) Home Area Network (HAN) inside the customer’s home premises, (ii)
Neighbor Area Network (NAN) connects multiple HANs, and (iii) Wide Area
Network (WAN) connects NANs and HANs to utility center. Several attack types
may target AMIs, such as Collusion attacks [23][24], FDI attacks [25], and
replay attacks [26].

  * -

Advanced distribution management systems (ADMS): ADMS is a software platform
supporting the full suite of distribution management and optimization. It
provides features that automate outage restoration and enhance the performance
of the distribution grid.

  * -

Advanced transmission systems (ATS): ATS are the most advanced systems and
technologies to transfer electrical power. These systems seek to reduce losses
and costs while improving power transmission efficiency, reliability, and
sustainability. They address a variety of obstacles, such as the integration
of renewable sources, the increase of capacity, and the improvement of power
quality.

  * -

High-voltage direct current (HVDC): HVDC technology uses direct current (DC)
for providing efficient means of transmitting large amount of power over long
distances. It supports and improve the sustainability, efficiency and
reliability of power supply systems. Amir _et. al._ [27] performed analysis of
the vulnerabilities, and impact of cyberattacks on the HVDC system.

  * -

Advanced customer systems (ACS): ACS is a set of digital platforms and tools
power utilities use to engage with their customers and provide them with
personalized information about their energy usage and costs. By facilitating
more efficient and sustainable energy systems, advanced customer systems
improve the customer experience.

###  III-B State Transition

Figure 4: State transitions of a generic power systems

A typical power system can be characterized by three internal states, i.e.,
Normal, Emergency, and Restorative.

  * -

Normal: a power system is considered normal when there is no violation of
operational constraints, such as the limit of transmission line flows and
upper/lower bounds of the magnitude of the voltages [28]. A list of critical
contingencies is provided, and a normal state is treated as secure if it
follows the occurrence of each contingency. These contingencies can be due to
natural or unexpected failures to the transmission or generator outage. On the
other hand, the normal state is known as insecure where all the operating
inequality constraints and power balance at each bus are still satisfied.
Preventive measurements are taken when the system is in normal but insecure in
operating states.

  * -

Emergency: the operating conditions of a power system may change and result in
the violation of some operating constraints. At this stage, the power system
still provides power to the loads. This Emergency state needs immediate
attention to solve the underlying issue and bring the system back into its
normal state.

  * -

Restorative: the preventive measurements taken by the emergency state may
disconnect lines, loads, and other equipment to save the system from collapse.
The system starts moving toward stability by removing the operating
constraints.

Figure 4 illustrates the 3 states and the associated transitions among them in
a generic power system. Continuous monitoring of the system is required to
ensure the reliable operations of the power grids. For this purpose, all the
tasks associated with state estimation play a critical role in monitoring the
reliability of operations of the underlying system.

###  III-C False Data Injection Attacks

A large percentage of smart grid cyber-attacks are categorized under FDI
attacks. Compared to ordinary bad data attacks, FDI attacks are considered as
data integrity attacks that inject false data misleading the PSSE measurements
toward wrong states, and consequently, causing various systematic failures
[29], such as key lines overloading and load shedding. More specifically,
injected false data by an FDI attack disrupts the integrity of measurement
data and forces PSSE to converge to a wrong operating point. This state
miscalculation caused by injected data will mislead the smart grid operator
and cause systematic problems.

Once an FDI attack is detected in a smart grid, the tampered measurements
should be recovered to ensure subsequent normal operations. Unfortunately,
traditional Bad Data Detection (BDD) techniques are not able to detect and
localize modern FDI attacks and they can be easily bypassed by recent FDI
attacks [30][31]. Consequently, researchers continuously try to address such
challenges by proposing modern and high-end FDI attack detection, mitigation,
and localization approaches based on recently emerged technologies.

##  IV Review Methodology

In this section, we describe our review methodology by firstly considering the
list of papers taken into account for this survey, describing their
approaches, and analytical details. In order to identify the list of
considered papers, we used the following keywords: ”Smart Grid”, ”False Data
Injection”, ”Detection”, ”Identification” and ”Localization”. The major
sources to collect the papers were: IEEE Xplore, ACM, SCOPUS, and Web of
Science.

Table IV shows the list of the considered papers, where we report the title of
the paper, the year of the publication, the authors’ country, and finally, the
number of citations collected up to the writing of this survey. Finally, in
order to highlight the importance of the topic, Fig. 5 shows the number of FDI
attack localization papers published between 2009 and 2022. There is a
noticeable increase in the number of papers starting the year 2021 as part of
the trend involving the wide application of machine learning and deep learning
techniques to this field.

TABLE IV: Our reference list of papers Reference | Title | Year | Country | N. Citations
---|---|---|---|---
[32] |  | Locational detection of the false data injection attack in a smart grid: A multilabel classification
---
approach
2020 | CN | 55
[33] | Observer-based cyber attack detection and isolation in smart grids | 2018 | CN | 31
[34] | Detection and isolation of false data injection attacks in smart grids via nonlinear interval observer | 2019 | CN | 28
[35] |  | Joint detection and localization of stealth false data injection attacks in smart grids using graph
---
neural networks
2021 | US | 25
[36] |  | A Real-Time Attack Localization Algorithm for Large Power System Networks Using Graph-
---
Theoretic Techniques
2015 | US | 24
[37] |  | Deep learning-based multilabel classification for locational detection of false data injection attack
---
in smart grids
2022 | IN | 20
[38] | Interval observer-based detection and localization against false data injection attack in smart grids | 2020 | CN | 20
[39] |  | Dynamic GPS Spoofing Attack Detection, Localization, and Measurement Correction Exploiting
---
PMU and SCADA
2021 | IR | 14
[40] | Detection and localization of targeted attacks on fully distributed power system state estimation | 2013 | SE | 14
[41] | Detection and isolation of false data injection attack for smart grids via unknown input observers | 2019 | CN | 11
[42] | Event detection and location in electric power systems using constrained optimization | 2009 | US | 11
[43] | Integrated Cyber and Physical Anomaly Location and Classification in Power Distribution Systems | 2021 | US | 10
[44] | Detection and locating cyber and physical stresses in smart grids using graph signal processing | 2020 | US | 10
[45] |  | Physical layer attack identification and localization in cyber–physical grid: An ensemble deep
---
learning based approach
2021 | CA | 10
[46] | PDL: An efficient prediction-based false data injection attack detection and location in smart grid | 2018 | CN | 9
[47] | Attack Detection and Localization in Smart Grid with Image-based Deep Learning | 2021 | TR | 6
[48] | Deep Learning Based Covert Attack Identification for Industrial Control Systems | 2021 | US | 6
[49] | Cyber Attack Localization in Smart Grids by Graph Modulation | 2019 | IL | 4
[50] | Intrusion Detection, Measurement Correction, and Attack Localization of PMU Networks | 2021 | IR | 4
[51] | Detection, recognition, and localization of multiple attacks through event unmixing | 2013 | US | 4
[19] | Detection and Localization of PMU Time Synchronization Attacks via Graph Signal Processing | 2022 | SE | 3
[52] |  | Detecting and locating cyber and physical stresses in smart grids using the k‐nearest neighbour
---
analysis of instantaneous correlation of states
2021 | US | 2
[53] | Location of False Data Injection Attacks in Power System | 2019 | CN | 2
[54] | Locating False Data Injection Attacks on Smart Grids Using D-FACTS Devices | 2021 | CN | 1
[55] |  | A Graph Signal Processing Framework for Detecting and Locating Cyber and Physical Stresses
---
in Smart Grids
2022 | US | 1
[56] |  | Cyber-attack localisation and tolerant control for microgrid energy management system based on
---
set-membership estimation
2021 | US | 1
[57] | Adaptive Hierarchical Cyber Attack Detection and Localization in Active Distribution Systems | 2022 | US | 1
[58] |  | Characterization and Classification of Cyber Attacks in Smart Grids using Local Smoothness of
---
Graph Signals
2021 | US | 1
[59] | Infinite Impulse Response Graph Neural Networks for Cyberattack Localization in Smart Grids | 2023 | US | 1
[60] |  | Fast economic dispatch with false data injection attack in electricity-gas cyber–physical system:
---
A data-driven approach
2022 | CN | 0
[61] |  | Online Location-based Detection of False Data Injection Attacks in Smart Grid Using Deep
---
Learning
2022 | EG | 0
[62] |  | False data injection attacks detection with modified temporal multi-graph convolutional network
---
in smart grids
2022 | CN | 0
[63] | An Online Approach to Covert Attack Detection and Identification in Power Systems | 2022 | US | 0
[64] | Locational Detection of Data Integrity Attacks with Multi-Gate Mixture-of-Experts in Smart Grid | 2022 | CN | 0
[65] | A Temporal Graph Neural Network for Cyber Attack Detection and Localization in Smart Grids | 2023 | US | 0
Figure 5: Number of papers related to FDI attacks

Figure 6 shows the word-cloud generated from the considered papers. While
Attack is the most common word, as expected, other common words are Detection,
FDIA, State, Measurement, injection, etc. which are core concepts in the
framework, while concepts, such as Graph, CNN, Matrix, etc., are instantiated
depending on the scenario application.

Figure 6: WordCloud computed over the set of papers considered for this survey

We initiate our analysis by categorizing the existing works into the following
two general categories:

  * -

Mathematical modeling. This class summarizes the methods based on mathematical
and statistical estimators, e.g., Kalman filter [66]), and aiming at the
detection of known FDI attacks.

  * -

Data-driven modeling. These methods do not require prior knowledge and can
detect unknown FDI attacks [67]. They are designed based on Artificial
Intelligence (AI), Machine Learning (ML) and Deep Learning (DL) techniques.

Figure 7 illustrates these categories along with their subcategories. Table V
also summarizes this categorization, while in the following, we map the papers
to each identified category.

Figure 7: Categorization of the papers related to FDI attacks TABLE V: Use-case categories Use Cases | Papers
---|---
Data-Driven Modeling |  |  [52], [53], [19], [58], [63], [45],
---
[67], [43], [64], [68] [32], [47],
[35], [59], [65], [62], [48], [57],
[60], [69], [61], [37]
Mathematical Modeling |  |  [33], [34], [38], [40], [41], [44],
---
[46], [49], [56], [51], [55], [54],
[20], [70], [71]

##  V Data-Driven modeling

In this section, we consider the papers addressing detection and localization
of FDI attacks in smart grid using data-driven based modeling. Inspired by the
recent advances in machine learning, and particularly, deep learning, these
techniques have been widely employed by researchers to propose several
solutions to identify and detect FDI attacks. Table VI lists the data-driven
models and the corresponding papers.

TABLE VI: Data-Driven Modeling Model/Technique | Papers
---|---
Classic Machine Learning Techniques |  |  [52], [53], [19], [58],
---
[63], [45], [67]
Deep Neural Networks |  |  [43], [64], [68]
---
Convolutional Neural Networks |  |  [32], [47],
---
Graph Neural Networks |  |  [35], [59], [65], [62]
---
Recurrent Neural Networks |  |  [48], [57], [60], [69]
---
Combined Deep Learning Techniques |  |  [61], [37]
---

Classic machine learning techniques are always the first data-driven approach
to analyze the complexity of detecting and localizing cyber-attacks in smart
grid environments. Hasnat _et al._ in [52] utilize k‐nearest neighbour (kNN)
classifiers to detect cyber-attacks in smart grids in a real-time mode. For
this purpose, they detect and localize the anomalies by correlating patterns
generated from power system buses leveraging correlation matrices. This matrix
is an input to the KNN classifier for various cyber-attack detection. Jiang
_et al._ in [53] propose a FDI attack detection and localization approach
based on an ensemble tree based modeling, i.e., eXtreme Gradient Boosting
(XGBoost) classifiers. In addition, they introduce a dimension extension model
to record measurements corresponding locations. Shereen _et al._ in [19]
utilize Graph Signal Processing (GSP) and Random Forests (RF) classifiers that
leverage GSP features to detect and localize Time Synchronization Attacks
(TSAs) against Phasor Measurement Units (PMUs). Hasnat _et al._ in [58] study
various cyber-attacks in smart grids and analyze them based on the local
smoothness of their graph signals. Accordingly, they extract a group of local
smoothness features to feed a neural network (NN) classifier. The results of
the NN are used to characterise cyber-attacks and define corresponding
profiles. Li _et al._ in [63] present a real-time covert attacks detection and
localization approaches for smart grids based on the Sparse Group Lasso (SGL)
algorithm. The underlying smart grid constitutes from multiple regional
control centers (RCCs) vulnerable to covert attacks, and an independent system
operator (ISO). The authors extend the proposed approach from linear to
nonlinear system setups with relaxation. Sakhnini _et al._ in [45] use an
ensemble of machine learning techniques combining multiple classifiers (i.e.
Decision Trees, Random Forest, feed-forward ANN) to propose an approach to
detect and localize attacks in the smart grids’ physical layer. In the
proposed model, for attack localization, they use the chi-square metric to
formulate attacks to specific features or measurements so that security
experts can start mitigation process. Similarly, Hallaji _et al._ in [67]
introduce a dynamic data-driven approach, called unobservable threat modelling
using least-squares fitting (ORIGIN), helping power systems state estimations
when they are under unobservable FDI attack. This approach relies on ensemble
machine learning classifiers having 3 main phases: (i) FDI attacks detection
based on observed and learned historical patterns, (ii) classification based
extracted features to determine the type of attacks, (iii) retrieving control
signals.

Deep Neural Network (DNN) has also being considered by researchers for
detecting and localizing FDI attacks. Ganjkhani _et al._ in [43] used a fine-
tuned DNN as a multi-class classifier to address the problem of localizing
faults and cyber-attacks while being able to classify power system states and
identify potential anomalies. The proposed solution (FALCON) adopts outage
information issued by protection relays and fault indicators (FI) as DNN input
features. Fan _et al._ in [64] use DNNs to propose an FDI attack detection and
localization approach formulated as a multi-task classification problem. For
this purpose, they design a multi-gate mixture-of-experts (LD-MMoE) scheme
considered as a multi-task classifier. The author believe that compared to the
state-of-the-art approaches, this model is more computational-friendly as the
number of trainable parameters are lower. A novel ac FDIA detection approach
covering recent ac FDIA patterns is presented in [68]. The proposed approach
in addition to capturing spatial data features in the system state, it
considers the temporal data correlation of the consecutive system states to
identify adversarial patterns and activities. For this purpose, they build an
intelligent FDIA detection system by employing discrete wavelet transform
(DWT) algorithm for extracting the system state features in a given time slot
and deep neural network (DNN) technique for analyzing the temporal-spatial
characteristics of the data sequences (i.e. constructing a recurrent neural
network, RNN).

Convolutional Neural Networks (CNN) have been widely used by researchers to
propose various FDI attacks detection and localization approaches. Wang _et
al._ in [32] introduce deep-learning-based localization and detection
architecture (DLLD) that concatenates a CNN with a standard BDD used to filter
low quality data. In the proposed architecture, the CNN model is a multi-label
classifier aims to detect and locate abnormal behaviors and inconsistencies
injected by FDI attacks. Inspired by recent advances in image processing,
Mohammadpourfard _et al._ in [47] proposed a CNN based 2-stage framework for
FDI attacks detection and localization. First, using Gramian Angular Field
(GAF) and Recurrence Plot (RP), they encode temporal states of power systems
into 2D images. Next, a fine-tuned CNN is used as a multi-label classifier to
identify anomalies and corresponding locations.

Considering the inherent graph structure of power systems that may not be
modeled efficiently in the Euclidean space, graph neural networks (GNN) have
been used in a number of power systems FDI attack detection and localization
projects. In [35], Boyaci _et al._ proposed a GNN based power grid FDI attack
detection and localization approach that adopts the auto-regressive moving
average (ARMA) type graph filters (GFs) to identify presence and location of
inconsistencies. In [59], Boyaci _et al._ utilize Infinite Impulse Response
(IIR) Graph Neural Networks (GNN) to detect and localize cyberattacks at the
bus level. For this purpose, they compare IIR and FIR GFs and the results show
that IIR GFs more accurately approximate the desired filter response.
Haghshenas _et al._ in [65] introduce a Temporal GNN (TGNN) based framework
for FDI attacks detection and localization in smart grids. In the proposed
framework, the topological information of the underlying system are formulated
into a GNN for abnormal measurements identification purpose, and temporal
information at each bus of the underlying power system are formulated into a
Gated Recurrent Unit (GRU). Based on their simulation results on the IEEE 118
bus system, they believe that the proposed framework is able to detect and
localize FDI and ramp attacks with high accuracy. Han _et al._ in [62] present
a FDI attack detection and localization method called modified temporal multi-
graph convolutional network (MTMCN) that is a graph-theory based deep learning
method. To feed this method, bus and branch related data are transformed into
graph structured data representing topological data relationships. These
information are correlated to build deep learning model’s features and
characteristics serving as a multi-label classifier.

Recurrent neural networks (RNN) are used to capture the temporal correlations
among system states. This capability of RNN has attracted researchers to use
it for FDI attacks profiling. Li _et al._ in [48] propose a hybrid data-driven
approach that combines an autoencoder as a system status features extractor, a
RNN to define system normal operation profile over time, and a DNN as a
classifier to detect covert attacks presence and localize them. This hybrid
framework by taking into account the spatial and temporal behavior of the
underlying system, tries to reduce false alarm rate. In [57], Li _et al._
propose an adaptive hierarchical FDI attack detection and localization
approach for power grid systems. The FDI attack detection task is performed by
a Multi-layer Long Short-Term Memory Network (MLSTM). The FDI attack
localization is a two-phase task that first, the FDI attack sub-regions are
estimated, and next, to localize the FDI attack, the attack presence within
the estimated sub-regions is calculated. Gao _et al._ in [60] present a data-
driven approach incorporating a residual network (ResNet) and attention LSTM
(ALSTM) in order to build a multi-label classifier for real-time FDI attacks
locational detection (i.e. outlier locations of modified measurements by FDI
attacks) in electricity-gas cyber–physical systems (EGCPS). The proposed
system captures temporal data of measurements to detect and localize FDI
attacks. Furthermore, they utilize a fast Dynamic Time Wrapping (DTW) for
recovering tempered measurements. Jevtic _et al._ in [69] present a RNN based
approach for detecting FDI attacks in Automatic Generation Controls (AGC). By
analyzing historical data along with Area Control Error (ACE) data, an LSTM
based neural network model is built and trained in order to predict ACEs. Any
difference between the predicted ACEs and real ACE data reveals potential FDI
attacks.

Combining, concatenating or incorporating different data-driven models into a
single FDI attack detection and localization system is another strategy
utilized by researchers. Hegazy _et al._ in [61], first conduct a comparative
and analytical study of various deep-learning based FDI attack localization
approaches (e.g., CNN, LSTM, Bi-LSTM, CNN-LSTM) to represent their
capabilities locating compromised measurements. Next, they propose a mixed
model concatenating a multi-feature CNN (MCNN) and a LSTM models, called MCNN-
LSTM, that analyzes multi-variate time-series measurements to detect and
localize FDI attacks. Their results show that the proposed approach
outperforms other deep learning models in term of resilience, scalability,
complexity and prediction time. Similarly, Mukherjee1 _et al._ in [37]
conducted an analytical comparison among different machine learning and deep
learning models, such as CNN, CNN-LSTM, CNN-GRU and KNN, for locational
detection of structured and unstructured FDI attacks in smart grids. Based on
their results, they believe that the conventional CNN model as an model-free
multi-label classifier, outperforms other models in detecting inconsistencies
caused by FDI attacks.

##  VI Mathematical modeling

This section describes FDI attack detection and localization approaches based
on mathematical modeling. Graph theory and statistical analysis are the two
main sub-categories. In the following, we describe the research works of both
sub-categories. Table VII lists the mathematical models and the corresponding
papers.

A FDI attack detection and compensation approach based on simultaneous input
and state estimation is proposed in [20] for Automatic Generation Control
(AGC) systems. In this approach, FDIA signal is considered as unknown input so
that its value gets estimated for compensating the attack effect. Kalman
filter [66] is used for this purpose. The main benefits of this approach are:
(i) it does not enforce any hardware upgrade or modification to the control
center, (ii) no additional communication channel is needed compared to
competitors. The authors to guarantee the decision accuracy of the AGC control
center, for both the AGC system state and the adversarial signal calculate
minimum variance unbiased estimate. Formal proofs are provided to ensure the
stability of the AGC system after injecting the attack mitigation algorithm.
Similarly, A FDI attack detection and isolation approach for large-scale smart
grids is proposed in [34]. The authors, first, define a group of non-linear
interval observers trying to accurately estimate interval state of the system.
Next, an interval residual-based detection metric to address the pre-computed
threshold shortcomings is proposed. Once the interval residuals seems
abnormal, an appropriate alarm is issued accordingly. Moreover, to isolate the
sensors injecting FDIA, a matrix-based isolation algorithm is introduced and
integrated to the control centers. In [38], Luo _et al._ try to detect and
localize FDI attacks based on a series of interval observers. FDI attack
localization is performed by analyzing the measurement data of corresponding
sensors located in different areas of the system. Hence, each interval
observer is responsible for both detection and localization tasks. Smith _et
al._ in [42] explain that nonlinear constrained optimization (NLCO) can be
used to estimate smart grids states from limited number of collected
measurements. This can be used to detect and localize any anomaly (e.g., line
outages, generator trips, load shedding, etc.) within the system. Wang _et
al._ in [34] try to detect and isolate FDI attacks based on the unknown input
(UI) interval observer. For this purpose, they design UI interval observers
based on the physical dynamics of the underlying system. Next, they use the
interval residuals of all areas to identify FDI attacks. For exceptional
cases, when a FDI attack remains undetectable, a local matrix-based algorithm
is developed to perform final judgments by combining observable cases. Shi _et
al._ in [46] propose prediction-based FDIA detection and location scheme (PDL)
modeling power systems states as a multi-variate time-series predictable by
vector autoregressive processes (VAR). Accordingly, a time-varying and non-
diagonal matrix is prepared for analyzing states consistencies over time, and
detecting potential anomalies (e.g., FDI attacks). After detecting and
localizing anomalies, their values can be replace with corrected values for
calibration purposes. Qiu _et al._ in [56] utilize set-membership estimation
(SME) to detect and localize cyberattacks by calculating ellipsoidal estimates
of the affected system states. Furthermore, they have designed a model
predictive control (MPC) to compute optimal control sequences and improve
system tolerance against cyberattacks. Wang _et al._ in [51] present ”event
unmixing” conceptual framework for online and temporal analysis (i.e.
detection and localization) of cyberattacks in smart grids. By collecting
temporal stamps to build a overcomplete dictionary, they characterise abnormal
activities over time. Using this framework, they try to identify the type of
cyberattacks, failure locations and failure start time. These information
helps to efficiently localize and mitigate cyberattacks.

In [33], Luo _et al._ use real-time measurements to propose an state observer-
based unknown attack detection and isolation approach. The main novelty of
this work is integrating graph theory to large scale smart grids aiming to
partition the system into a number of areas and identify sparse and dense
ones. For this purpose, they design an observation matrix to extract the
corresponding relation between the state observer residual and the smart grid
inputs. Next, using the graph-theoretic algorithm, they calculate the
asymmetric weighted Laplacian. Another graph-theoretic approach using real-
time synchrophasor measurements is proposed in [36] to localize cyber-attacks,
such as Denial of Service (DoS), flooding, jamming of communication links,
etc., in large-scale power systems. Leveraging physical topology of a smart
grid, by dividing it into a set of areas or clusters, they use the phasor
measurement data information to identify the area that a particular attack
enters and isolate the attack. They compare the identified localization
characteristics with a list of transfer function residues. Hasnat _et al._ in
[44] utilize graph signal processing (GSP) as smart grids measurement data
analysis and representation. They analyze cyberattacks (e.g., FDI, DoS, data-
replay, etc.) impacts on smart grids in the graph vertex domain, the graph-
frequency domain and combined vertex-frequency domain of signals. Next, based
on the effects of attacks on the graph Fourier transform (GFT), they propose
different GSP techniques for detecting and localizing attacks. similarly,
Drayer _et al._ in [49] consider a power system as a graph where nodes
represent buses and edges represent transmission lines. By analyzing
smoothness of graph states, they try to detect and localize FDI attacks.

TABLE VII: MATHEMATICAL MODELING Model/Technique | Papers
---|---
Statistical Analysis |  |  [34], [38], [42], [34], [46], [66]
---
Graph Theory |  |  [33], [36], [44], [49]
---

##  VII Summary analysis and key findings

This section discusses the major findings of our analysis from different
perspectives, such as the localization techniques, evaluation scenarios,
adversary’s knowledge level, result analysis, and finally, the investigated
FDI attacks considered by the identified relevant works.

###  VII-A Localization Techniques

TABLE VIII: FDI Attacks Localization Techniques Localization Technique | Papers
---|---
Classic Machine Learning |  |  [32], [50], [57], [52], [58], [53], [58]
---
Deep Learning |  |  [32], [37], [43], [47], [48], [62], [61],
---
[64], [68]
Graph Neural Networks |  |  [35], [59], [65]
---
Set-Membership Estimation |  | [56]
---
Sparse Group Lasso | [63]
Chi-Square | [45]
Graph Signal Processing |  [19], [44], [55]
Matrix Based |  |  [72], [38], [46], [51]
---
Observer Based Residual |  |  [33], [41]
---

It is important to highlight the key differences/similarities found in the
literature to locate an FDI attack or the region under the attack. In this
section, we summarize the methodologies adopted by researchers to locate the
node under an FDI attack.

Considering that the main focus of this survey is FDI attacks localization, we
have listed the techniques utilized in the selected papers for localizing FDI
attacks in Table VIII. These techniques play an important role in particular
when we want to control and mitigate FDI attacks.

As Table VIII shows, the majority of FDI attack localization researches employ
advanced data-driven approaches revealing the direction and trend of this
research area toward these approaches as also supported by Table IV. In this
direction, the localization of the FDI attacks is mainly considered as a
multi-label classification task or a multi-cluster clustering task.

###  VII-B Evaluation Scenario

Various evaluation methodologies, such as statistical-based [35][51],
simulation based [49][64], emulation based [45], real test-bed based [65][67]
etc., have been considered to evaluate the proposed methodologies in the
reviewed papers.

A comprehensive dataset can facilitate and accelerate the evaluation process.
Such data can either be taken directly from smart grids or derived
synthetically. As of infrastructure privacy and confidentiality, very limited
ground truth datasets are publicly available, e.g., New York Independent
System Operator (NYISO) [73]. Consequently, in most cases, the data is
generated via simulations using various tools and platforms. Table IX shows
the list of existing datasets and tools for data generation.

TABLE IX: Adopted datasets Input | Papers
---|---
Data Generated by MATPOWER |  |  [32], [59], [37], [44],
---
[46], [47], [48], [55],
[52], [53], [19], [59],
[58], [74], [65], [60],
[61], [62], [63], [64],
[70], [71]
Data Generated by MATLAB |  [38], [43]
Data from DigSilent Power Factory111https://www.digsilent.de/en/powerfactory.html | [68]
NYISO Load Profile222https://www.nyiso.com/load-data |  [59], [52], [58], [69]
Simulated frequency disturbance data | [51]
Simulated Waveform Data of IEEE-37 bus | [57]
| Oak Ridge National333https://www.ornl.gov/
---
Laboratories simulated dataset
| [45]
---
PMU data | [67]

From the simulation point of view, Table XII reports the most popular
simulators considered in the literature, i.e.,
MATPOWER444https://matpower.org, MATLAB
simulink555https://www.mathworks.com/products/simulink.html, Power System
Simulator for Engineering
(PSS/E)666https://www.siemens.com/global/en/products/energy/grid-
software/planning/pss-software/pss-e.html, MATLAB YALMIP [75], or custom
simulations. Moreover, the power system components from which the data is
collected play an important role. The data can be read from different sources,
such as a Phase Measurement Unit (PMU), a smart meter, a Frequency Disturbance
Recorder (FDR), digital relays, etc. There is actually no best-practice since,
in general, the sampling rate of a PMU is greater than that of a smart meter,
i.e. data is collected with higher resolution, but reduced processing speed.
Additionally, a smart meter can record basic amplitude whereas PMU gives phase
information too.

We now considered two reference scenarios, which are the result of the
analysis of the paper considering the aforementioned tools.

  1. 1.

IEEE case studies: most of the studies utilize standard IEEE-X system models
for their experiments and evaluating their approaches. X represents the number
of buses indicating the overall complexity of the power system. Table X
compares such standards in terms of number of lines, number of generators and
number of busses while Table XI matches the standards to the corresponding
papers. IEEE-14 and IEEE-118 are the two most popular standards utilized by
researchers.

  2. 2.

Other case studies: beside the IEEE-X bus systems, there have been custom test
cases examined by Luo _et al._ in [33] employed Two-Area Kundur System as a
baseline with two areas and extended it to 180-generators with 10-areas.

TABLE X: IEEE Standard Bus System Comparison IEEE-X Bus System | No. of Lines/Branches | No. of Generators | No. of Slack Buses | No. of Generator Buses | No. of Load Buses
---|---|---|---|---|---
14 | 20 | 5 | 1 | 4 | 9
30 | 41 | 6 | 1 | 5 | 24
39 | 46 | 10 | 1 | 9 | 29
57 | 80 | 7 | 1 | 6 | 50
118 | 186 | 54 | 1 | 53 | 64
300 | 411 | 69 | 1 | 68 | 231
TABLE XI: Evaluation Scenario Power System | Papers
---|---
IEEE-14 |  |  [32], [37], [46], [49], [50], [48], [53], [19],
---
[54], [61], [62], [63], [64], [70]
IEEE-37 | [57]
IEEE-39 | [19]
IEEE-57 |  [35], [47]
IEEE-118 |  |  [68], [32], [35], [37], [40], [47], [55], [52],
---
[59], [58], [65], [61], [62], [64]
IEEE-143 | [43]
IEEE-300 |  |  [68], [35], [59]
---
Two-Area Kundur | [33]
TABLE XII: Simulators Environment | Papers
---|---
MATPOWER |  |  [32], [37], [46], [49], [50], [48], [53], [19],
---
[54], [61], [62], [63], [64], [70], [59]
MATLAB-Simulink | [57]
PSS/E | [19]
MATLAB YALMIP777https://yalmip.github.io/ | [56]

###  VII-C Adversary knowledge

Adversary knowledge is constituted by a set of information that can be
exploited to increase the effectiveness of the attack. Such knowledge can be
any information about the smart grid infrastructure, components, and
operations. Adversary knowledge can be categorized into two levels [11]: (i)
full knowledge about the underlying infrastructure of the system, (ii) limited
knowledge about the underlying infrastructure of the system. It is hard for an
attacker to access full knowledge regarding the target smart grid system [48]
[37]. These limitations are the result of (i) power subsystems being
geographically far from each other, restricting the attacker from collecting
information for all subsystems, (ii) system parameters being kept confidential
and highly secure, (iii) limitation on financial or instrument support, making
it very challenging for attackers to access the target system’s measurements.
Consequently, an attacker with limited system knowledge can generate stealthy
attacks by min-cut problem [61].

Table XIII shows the adversary knowledge levels and associated papers. We did
not find any paper at black-box level with zero knowledge of the underlying
system. Most of the reviewed articles considered the traditional bad data
detection mechanism as their baseline for the generation of the attack
vectors.

TABLE XIII: The knowledge of the adversary Knowledge Level | Papers
---|---
Full Knowledge |  |  [56], [48], [57], [53], [59],
---
[65], [61], [63], [64], [68]
Limited Knowledge |  |  [32], [33], [35], [37], [40], [41],
---
[50], [19], [68], [20], [67]

###  VII-D Result Analysis

Machine learning-based algorithms employ several key metrics to measure their
performance. These evaluation metrics vary based on the problem under study
and should be carefully selected in order to provide maximum insights. Some
popular classification metrics include Accuracy, Precision, F1-Score, Recall,
and Area Under the Curve (AUC), explained in the following:

  * -

Accuracy: Accuracy is the most common parameter while evaluating performance.
It is a fraction of the total number of correct predictions over the total
number of samples. It is defined as:

$Accuracy=\frac{TP+TN}{TP+TN+FP+FN}$ (1)

where TP stands for true positive, FP for false positive, TN for true
negative, and FN for false negative.

  * -

Precision: Precision is used to measure a model’s capacity to avoid FP. It is
a fraction of TP and all positive predictions:

$Precision=\frac{TP}{TP+FP}$ (2)

  * -

Recall: It is a fraction of TP measuring the percentage of true positives out
of all actual positive instances:

$Recall=\frac{TP}{TP+FN}$ (3)

  * -

F1-Score: F1-score represents the balanced harmonic mean of precision and
recall, serving as a metric for the model’s overall performance. Its purpose
is to ensure that precision and recall are considered equally:

$F1_{score}=2\times\frac{Precision\times Recall}{Precision+Recall}$ (4)

  * -

AUC: AUC is a widely used evaluation metric in binary classification tasks
that gauges the model’s efficacy in discriminating between positive and
negative instances:

$AUC=\frac{S_{p}-n_{p}(n_{n}+1)/2}{n_{p}\times n_{n}}$ (5)

where $S_{p}$, $n_{n}$, and $n_{p}$ denote the sum of classified samples as
positive, negative samples, and positive samples, respectively.

Our survey spans over several IEEE standard bus systems. We list the results
of the selected studies based on various evaluation metrics and their utilized
standard bus systems in Table XIV. As of using different datasets (not
publicly available) and evaluation setups, we cannot perform a fair and
complete comparison among all the selected works based on their results.
However, there are cases adopting the same datasets, such as [32], [64], to
conduct their evaluations. As mentioned previously, the main shortcoming of
the most of these researches is the lack of evaluation within real
environments or based on ground truth datasets.

TABLE XIV: Performance summary in terms of evaluation Metrics and detection
time

|  | Article | Metrics
---|---|---|---
Accuracy | Precision | F1-Score | Recall | AUC | Detection Time
Localization | IEEE-14 | Wang _et. al._ [32] | 97.3 R | 99.66 | 99.75 | 99.84 | - | CNM
Mukherjee _et. al._ [37] | 94.01 R | 99.63 | 99.72 | 99.82 | - |  $<$ $\mu$ sec
Lee _et. al._ [74] | - | 99.54 | 99.53 | 99.54 | Yes | -
Shereen _et. al._ [19] | CNM | - | - | - | Yes |  $<$ milli sec
Jiang _et. al._ [53] | 96.91* | - | - | - | - | -
Li _et. al._ [54] | 100 | - | - | - | - | -
Hegazi _et. al._ [61] | 95 R | 99.43 | 99.3 | 99.64 | - | -
Han-2023 | 98.3 | 99.8 | 92.6 | 86.4 | Yes | -
Li _et. al._ [63] | CNM | CNM | CNM | CNM | - | -
Fan _et. al._ [64] | - |  $>$99 |  $>$99 |  $>$99 | Yes | -
IEEE-57 | Boyaci _et. al._ [35] | - | - | 79.53 | - | - | 2.76 milli sec
Mohammadpourfard _et. al._ [47] | - | 99 | 99 | 99 | - | -
IEEE-118 | Wang _et. al._ [32] | 93.3 R | 99.08 | 99.4 | 99.71 |  | 100 $\mu$ sec
Boyaci _et. al._ [35] | - | - | 83 | - | - | 2.81 milli sec
Mukherjee _et. al._ [37] | 93.3 R | 99.8 | 99.7 | 99.61 | - | 200 $\mu$ sec
Vukovic _et. al._ [40] | - | - | - | - | - | -
Li _et. al._ [63] | CNM | CNM | CNM | CNM | - | -
Hasnat _et. al._ [58] |  $>$90 | - | - | - | - | -
Haghshenas _et. al._ [65] |  $>$95 | - | - | - | - | 0-20 time instance
Hegazi _et. al._ [61] | 93 R | 99.93 | 99.95 | 99.96 | - | -
Han _et. al._ [62] | 96.4 | 98.9 | 83.3 | 72 | - |
Fan _et. al._ [64] | - |  $>$99 |  $>$99 |  $>$99 | Yes | -
IEEE-300 | Han _et. al._ [62] | 95.8 | 96.7 | 80.2 | 68.5 | - | -
Boyaci _et. al._ [59] | - | - | 93.33 | - | - | 2.94 milli sec
Boyaci _et. al._ [35] | - | - | 79.03 | - | - | 2.94 milli sec

CNM: Considered but not explicitly mentioned, *: Average, R: Row Accuracy or
RACC, -: did not considered

###  VII-E AC/DC Power System

While Alternating Current (AC) is suitable for distribution of power over
longer distances, Direct Current (DC) is mostly used in batteries, electric
vehicles, and low voltage power systems. As discussed earlier, the main
objective of most of the selected papers is state estimations in power systems
[32][37][41]. The complexities of a state estimation task depend on a variety
of factors. One of the main factors is when the authors choose between AC or
DC state estimations. DC estimation is simpler and gives an overview of the
underlying system. It can be used in the preliminary phase of the study to
capture the initial pictures. However, to truly replicate a power system, AC
estimation is required. AC estimation is a non-linear problem and is a
significantly complicated scenario compared to DC estimation. In terms of the
sampling time, DC systems has lower sampling rate providing more time for
attackers to compromise the system. Hence, deploying various hidden attack
vectors against DC systems is considerably easier compared to AC systems that
send faster snapshot of readings. Table XV categorizes the reviewed researches
based on the type of their analyzed system.

TABLE XV: Categorization of the papers based on AC/DC architecture System Type | Papers
---|---
AC System |  |  [33], [41], [35], [38], [42], [72], [42],
---
[41], [43], [44], [56], [51], [48], [55],
[57], [59], [65], [63], [68]
DC System |  |  [32], [37], [46], [47], [53], [19], [58],
---
[54], [60], [61], [62], [64], [45]

###  VII-F Investigated FDI Attack Types

A number of FDI attacks were studied in the reviewed studies to investigate
the resilience of proposed approaches in the presence of an adversary. Each
FDI attack has different features and profile. In the following, we describe
the investigated FDI attacks. Table XVI lists the investigated FDI attacks and
corresponding papers.

####  VII-F1 Ramp Attack

Ramp attacks cause power instability and equipment damages [34]. In these
attacks, the attacker aims to evade the attack detection from linear-
prediction-based models by introducing bad data to the smart grid data stream.
Linear detection models fail to detect ramp attacks due to their gradual
increase in nature. A successful ramp attack can cause significant financial
and operational damages.

####  VII-F2 Replay Attack

A replay attack, sometimes called a data replay attack, in which an adversary
observes and records the data stream from smart grids meters and re-injects
these measurements later to disrupt the system [52].

####  VII-F3 Covert Attack

A covert attack is a type of FDI attack that can bypass the traditional BDD
systems and remains unobservable for an extended time period to deteriorate
the normal operation of the smart grids [48].

####  VII-F4 Denial of Service Attack

Denial of Service (DoS) attacks cause smart grids services and measurements
unavailability which lead to the unobservability of the underlying system.
Overall, DoS attacks deteriorate the normal operation of smart grids.

####  VII-F5 Delay Attack

A delay attack is carried out by the adversary to introduce non-synchronous
behavior in the time-stamped measurements. Mathematically it can be
represented as $c(t)=x(n_{A},t-t_{d})$ where $c(t)$ is corrupted measurement
delayed by the amount of time $t_{d}$ and $n_{A}$ is the bus instance under
attack. Time Synchronization Attack (TSA) is considered as a delay attack
against synchronized PMU devices to change the phase angles of the
measurements [19].

####  VII-F6 Random FDI Attack

A random attack is an attack in which an attacker tries to find attack vectors
leading the underlying smart grid controllers and operators to mis-estimate
the state of the system [31].

TABLE XVI: Types of FDI Attacks FDI Attack Type | Papers
---|---
Covert Attack |  [33][41][38][63]
Ramp Attack |  [72][52][65][76]
DoS Attack |  [44][56] [52][55][58]
Replay Attack |  [35][43][44][55][52][58]
Delay Attack |  [55][58]
Time Synchronization Attack | [19]
Random Attack | [41]

##  VIII Open issues and research directions

In this section, we describe current research challenges and possible future
directions about the detection and localization of FDI attacks in smart grid.
We believe that the following topics worth more investigation as future
research directions in this field.

  * -

Ground truth datasets. Measurements from real world scenarios are extremely
difficult to set-up due to privacy constraints and data confidentiality of
critical infrastructures. While simulations provide a quick and easy to
achieve test-bed for FDI cybersecurity attacks, they might not be the perfect
representation of the system—this being true in particular for smart grid
environments.

  * -

Real-world smart grid environments. One of the best but expensive option is
testing the proposed approach in a real-world environment, considering real
constraints, noise and real FDI cyber-attacks. A real world deployment
involving a real smart-grid can definitely improve the robustness of the
findings along with enhancing its efficiency and performance.

  * -

Scalability. Current approaches focus on specific, small scale, simulated
scenarios. We highlight the importance of testing the proposed approaches in
more complex and large-scale smart grids. This will improve robustness,
scalability and comprehensiveness of FDI attack detection and localization
approaches.

  * -

High-end FDI attacks: FDI attacks might exploit recent advances on ML and AI,
in particular, resorting to adversarial machine learning, i.e., generating
attack patterns that are specifically designed to be undetected to AI-based
detection algorithm.

  * -

Real-time analysis. Detecting, localizing and mitigating FDI attacks in real-
time is becoming of great importance in order to reduce the adversary’s
advantage of performing malicious activities during the (stealthy) period of
persistence of the adversary inside the smart grid ICT infrastructure. Hence,
moving from offline to online detection and localization should be taken into
account when designing new approaches.

  * -

Dataset quality improvement. Dataset quality is of paramount importance to
ensure model robustness and reliability. For data-driven models, training,
evaluation and testing datasets need to be significantly well-elaborated.
Dataset require to be up-to-date including new FDI attacks, while addressing
imbalanced data and normalization, thus improving model quality (higher
accuracy, precision and recall).

  * -

Differentiating cyber from physical. Designing a model for detecting,
localizing and distinguishing cyber from physical attacks is becoming more and
more a priority due to the different countermeasures required for the defense
[52]. For example, a PMU generating faulty measurements should be treated in a
completely way from a compromised PMU. For this purpose, a group of criteria
should be defined and continuously updated to ensure more accurate
discrimination.

  * -

Anomaly detection. Many contributions from the literature dealing with FDI
detection and localization are related to anomaly detection, i.e., the attack
pattern is treated as an anomaly respect to a previously generated ground
truth. Anomaly detection techniques focusing on 0-day (unknown) attacks might
be considered to increase the detectability of 0-days in the domain of FDI
attacks.

  * -

Data correlation from various sources. Correlating data from different
sources, such as network data, topology information, and PMU characteristics,
enhances FDI attack detection and localization to efficiently extract
information for location detection of the attacks, thus increasing the overall
performance of the mitigation activities.

  * -

False positive and false negative. Reducing false positive and false negative
can significantly improve the reliability and effectiveness of FDI attack
detection and localization approaches in real-world environments. For data-
driven models, this can be partially achieved by improving the training,
evaluation and testing data quality. Data correlation also can ensure more
precised and accurate detection and localization.

  * -

Graph signal processing (GSP) methods. Potential improvements on GSP methods
involve: (i) investigating the effect of various noises on their performance,
(ii) applying GSP methods to dynamic graphs enabling them to detect and
localize the group of FDI attacks causing changes in the network topology,
(iii) using graph signal characteristics and vertex attributes as features in
data-driven modelings, (iv) improving vertex-frequency energy distribution
(VFED) algorithms to reduce computational complexities while enhancing
detection and localization accuracy, (v) applying VFED algorithms to smal-size
systems for stress localization.

  * -

Stress classification. Comprehensive classification and characterisation of
various stresses, and designing corresponding investigation and analysis
mechanisms ensure more accurate and reliable prevention, prediction,
detection, localization and mitigation.

  * -

Dynamic topology. FDI attacks detection and localization in dynamic topology
smart grids is another future direction to improve current approaches and keep
their coherency with advancing technologies. This requires context awareness
for the detection and localization algorithms to actively fetch underlying
system features and characteristics to adapt with changing variables.
Evaluating such approaches on multiple systems with varying topology and
characteristics will significantly enhance its adoption within such
environments.

  * -

Graphical network topology. Integrating graphical network topology into the
implemented version of current FDI attack detection and localization
approaches can be another useful and valuable future direction enhancing their
applicability and facilitating their analysis by specialists.

##  IX Conclusion

Smart grid state estimation integrity is critical for its proper operations.
Adversaries adopt various advanced techniques to affect the (cyber) internal
state, which in turn, reflects on the physical domain having a detrimental
effect on both the security and safaty of the system. Among all, FDI attacks
are the most powerful techniques for attackers to reach their objectives.
Unfortunately, conventional detection methods (e.g., residual-based methods)
are not able to detect such attacks due to recent advances on the attacker
side. While detection of such attacks is still a significant challenge, minor
effort have been devoted for localization—due to the complexity of the
problem. We investigated the current state of the art on smart grids cyber-
attacks, focusing on FDI attacks detection and localization. First, we
provided a background on smart grids architecture and current cyber-security
challenges. Next, after categorizing our list of selected papers into data-
driven and mathematical modeling categories, we described their proposed
approaches and employed techniques. Accordingly, we provided our key findings
and analytical insights regarding the employed localization techniques,
evaluation scenarios, obtained results, investigated FDI attack types, etc.
Finally, we discussed about open issues in FDI attack joint detection and
localization, and potential future research directions, while drawing some
final remarks.

## Acknowledgements

This publication was supported by NPRP grant NPRP12C-0814-190012 from the
Qatar National Research Fund (a member of Qatar Foundation). The findings
achieved herein are solely the responsibility of the authors. The authors also
thank the Qatar National Library (QNL) for supporting this research.

## References

  * [1] X. Yu and Y. Xue, “Smart grids: A cyber–physical systems perspective,” _Proceedings of the IEEE_ , vol. 104, no. 5, pp. 1058–1070, 2016.
  * [2] V. Y. Pillitteri and T. L. Brewer, “Guidelines for smart grid cybersecurity,” 2014\.
  * [3] A. S. Musleh, G. Chen, and Z. Y. Dong, “A survey on the detection algorithms for false data injection attacks in smart grids,” _IEEE Transactions on Smart Grid_ , vol. 11, no. 3, pp. 2218–2234, 2019.
  * [4] R. Deng, G. Xiao, R. Lu, H. Liang, and A. V. Vasilakos, “False data injection on state estimation in power systems—attacks, impacts, and defense: A survey,” _IEEE Transactions on Industrial Informatics_ , vol. 13, no. 2, pp. 411–423, 2016.
  * [5] S. Aoufi, A. Derhab, and M. Guerroumi, “Survey of false data injection in smart power grid: Attacks, countermeasures and challenges,” _Journal of Information Security and Applications_ , vol. 54, p. 102518, 2020.
  * [6] L. Cui, Y. Qu, L. Gao, G. Xie, and S. Yu, “Detecting false data attacks using machine learning techniques in smart grid: A survey,” _Journal of Network and Computer Applications_ , vol. 170, p. 102808, 2020.
  * [7] Z. Guan, N. Sun, Y. Xu, and T. Yang, “A comprehensive survey of false data injection in smart grid,” _International Journal of Wireless and Mobile Computing_ , vol. 8, no. 1, pp. 27–33, 2015.
  * [8] M. A. Husnoo, A. Anwar, N. Hosseinzadeh, S. N. Islam, A. N. Mahmood, and R. Doss, “False data injection threats in active distribution systems: A comprehensive survey,” _Future Generation Computer Systems_ , 2022.
  * [9] G. Liang, J. Zhao, F. Luo, S. R. Weller, and Z. Y. Dong, “A review of false data injection attacks against modern power systems,” _IEEE Transactions on Smart Grid_ , vol. 8, no. 4, pp. 1630–1638, 2016.
  * [10] H. T. Reda, A. Anwar, and A. Mahmood, “Comprehensive survey and taxonomies of false data injection attacks in smart grids: Attack models, targets, and impacts,” _Renewable and Sustainable Energy Reviews_ , vol. 163, p. 112423, 2022.
  * [11] A. Sayghe, Y. Hu, I. Zografopoulos, X. Liu, R. G. Dutta, Y. Jin, and C. Konstantinou, “Survey of machine learning methods for detecting false data injection attacks in power systems,” _IET Smart Grid_ , vol. 3, no. 5, pp. 581–595, 2020.
  * [12] S. Aoufi, A. Derhab, and M. Guerroumi, “Survey of false data injection in smart power grid: Attacks, countermeasures and challenges,” _Journal of Information Security and Applications_ , vol. 54, p. 102518, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2214212619310713
  * [13] E.-N. S. Youssef and F. Labeau, “False data injection attacks against state estimation in smart grids: Challenges and opportunities,” in _2018 IEEE Canadian Conference on Electrical & Computer Engineering (CCECE)_. IEEE, 2018, pp. 1–5.
  * [14] A. Gopstein, C. Nguyen, C. O’Fallon, N. Hastings, D. Wollman _et al._ , _NIST framework and roadmap for smart grid interoperability standards, release 4.0_. Department of Commerce. National Institute of Standards and Technology, 2021.
  * [15] A. M. Annaswamy and M. Amin, “Ieee vision for smart grid controls: 2030 and beyond,” _IEEE Vision for Smart Grid Controls: 2030 and Beyond_ , pp. 1–168, 2013.
  * [16] A. Cardenas and S. Cruz, “Cyber-physical systems security knowledge area,” _The Cyber Security Body Of Knowledge (cybok)_ , 2019.
  * [17] C. Konstantinou and M. Maniatakos, “A case study on implementing false data injection attacks against nonlinear state estimation,” in _Proceedings of the 2nd ACM workshop on cyber-physical systems security and privacy_ , 2016, pp. 81–92.
  * [18] A. Parizad and C. Hatziadoniu, “A laboratory set-up for cyber attacks simulation using protocol analyzer and rtu hardware applying semi-supervised detection algorithm,” in _2021 IEEE Texas Power and Energy Conference (TPEC)_. IEEE, 2021, pp. 1–6.
  * [19] E. Shereen, R. Ramakrishna, and G. Dán, “Detection and localization of pmu time synchronization attacks via graph signal processing,” _IEEE Transactions on Smart Grid_ , 2022.
  * [20] M. Khalaf, A. Youssef, and E. El-Saadany, “Joint detection and mitigation of false data injection attacks in agc systems,” _IEEE Transactions on Smart Grid_ , vol. 10, no. 5, pp. 4985–4995, 2018.
  * [21] M. Ganjkhani, S. N. Fallah, S. Badakhshan, S. Shamshirband, and K.-w. Chau, “A novel detection algorithm to identify false data injection attacks on power system state estimation,” _Energies_ , vol. 12, no. 11, p. 2209, 2019.
  * [22] D. An, F. Zhang, Q. Yang, and C. Zhang, “Data integrity attack in dynamic state estimation of smart grid: Attack model and countermeasures,” _IEEE Transactions on Automation Science and Engineering_ , vol. 19, no. 3, pp. 1631–1644, 2022.
  * [23] M. I. Ibrahem, M. M. Badr, M. M. Fouda, M. Mahmoud, W. Alasmary, and Z. M. Fadlullah, “Pmbfe: Efficient and privacy-preserving monitoring and billing using functional encryption for ami networks,” in _2020 international symposium on networks, computers and communications (ISNCC)_. IEEE, 2020, pp. 1–7.
  * [24] A. Alsharif, M. Nabil, M. M. Mahmoud, and M. Abdallah, “Epda: Efficient and privacy-preserving data collection and access control scheme for multi-recipient ami networks,” _IEEE Access_ , vol. 7, pp. 27 829–27 845, 2019.
  * [25] L. Na, X. Xiaohui, M. Xiaoqin, M. Xiangfu, and Y. Peisen, “Fake data injection attack detection in ami system using a hybrid method,” in _2021 IEEE Sustainable Power and Energy Conference (iSPEC)_. IEEE, 2021, pp. 2371–2376.
  * [26] N. Saxena, B. J. Choi, and S. Grijalva, “Secure and privacy-preserving concentration of metering data in ami networks,” in _2017 IEEE International Conference on Communications (ICC)_ , 2017, pp. 1–7.
  * [27] A. Gholami, M. Mousavi, A. K. Srivastava, and A. Mehrizi-Sani, “Cyber-physical vulnerability and security analysis of power grid with hvdc line,” in _2019 North American Power Symposium (NAPS)_. IEEE, 2019, pp. 1–6.
  * [28] A. Abur and A. G. Exposito, _Power system state estimation: theory and implementation_. CRC press, 2004.
  * [29] Y. Yuan, Z. Li, and K. Ren, “Modeling load redistribution attacks in power systems,” _IEEE Transactions on Smart Grid_ , vol. 2, no. 2, pp. 382–390, 2011.
  * [30] K. R. Davis, K. L. Morrow, R. Bobba, and E. Heine, “Power flow cyber attacks and perturbation-based defense,” in _2012 IEEE third international conference on smart grid communications (SmartGridComm)_. IEEE, 2012, pp. 342–347.
  * [31] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” _ACM Transactions on Information and System Security (TISSEC)_ , vol. 14, no. 1, pp. 1–33, 2011.
  * [32] S. Wang, S. Bi, and Y.-J. A. Zhang, “Locational detection of the false data injection attack in a smart grid: A multilabel classification approach,” _IEEE Internet of Things Journal_ , vol. 7, no. 9, pp. 8218–8227, 2020.
  * [33] X. Luo, Q. Yao, X. Wang, and X. Guan, “Observer-based cyber attack detection and isolation in smart grids,” _International Journal of Electrical Power & Energy Systems_, vol. 101, pp. 127–138, 2018.
  * [34] X. Wang, X. Luo, M. Zhang, Z. Jiang, and X. Guan, “Detection and isolation of false data injection attacks in smart grid via unknown input interval observer,” _IEEE Internet of Things Journal_ , vol. 7, no. 4, pp. 3214–3229, 2020.
  * [35] O. Boyaci, M. R. Narimani, K. R. Davis, M. Ismail, T. J. Overbye, and E. Serpedin, “Joint detection and localization of stealth false data injection attacks in smart grids using graph neural networks,” _IEEE Transactions on Smart Grid_ , vol. 13, no. 1, pp. 807–819, 2021.
  * [36] T. R. Nudell, S. Nabavi, and A. Chakrabortty, “A real-time attack localization algorithm for large power system networks using graph-theoretic techniques,” _IEEE Transactions on Smart Grid_ , vol. 6, no. 5, pp. 2551–2559, 2015.
  * [37] D. Mukherjee, S. Chakraborty, and S. Ghosh, “Deep learning-based multilabel classification for locational detection of false data injection attack in smart grids,” _Electrical Engineering_ , vol. 104, no. 1, pp. 259–282, 2022\.
  * [38] X. Luo, Y. Li, X. Wang, and X. Guan, “Interval observer-based detection and localization against false data injection attack in smart grids,” _IEEE Internet of Things Journal_ , vol. 8, no. 2, pp. 657–671, 2020.
  * [39] S. Siamak, M. Dehghani, and M. Mohammadi, “Dynamic gps spoofing attack detection, localization, and measurement correction exploiting pmu and scada,” _IEEE Systems Journal_ , vol. 15, no. 2, pp. 2531–2540, 2020.
  * [40] O. Vuković and G. Dán, “Detection and localization of targeted attacks on fully distributed power system state estimation,” in _2013 IEEE International Conference on Smart Grid Communications (SmartGridComm)_. IEEE, 2013, pp. 390–395.
  * [41] X. Luo, X. Wang, X. Pan, and X. Guan, “Detection and isolation of false data injection attack for smart grids via unknown input observers,” _IET Generation, Transmission & Distribution_, vol. 13, no. 8, pp. 1277–1286, 2019\.
  * [42] M. J. Smith and K. Wedeward, “Event detection and location in electric power systems using constrained optimization,” in _2009 IEEE Power & Energy Society General Meeting_. IEEE, 2009, pp. 1–6.
  * [43] M. Ganjkhani, M. Gilanifar, J. Giraldo, and M. Parvania, “Integrated cyber and physical anomaly location and classification in power distribution systems,” _IEEE Transactions on Industrial Informatics_ , vol. 17, no. 10, pp. 7040–7049, 2021.
  * [44] M. A. Hasnat and M. Rahnamay-Naeini, “Detection and locating cyber and physical stresses in smart grids using graph signal processing,” _arXiv preprint arXiv:2006.06095_ , 2020.
  * [45] J. Sakhnini, H. Karimipour, A. Dehghantanha, and R. M. Parizi, “Physical layer attack identification and localization in cyber–physical grid: An ensemble deep learning based approach,” _Physical Communication_ , vol. 47, p. 101394, 2021.
  * [46] W. Shi, Y. Wang, Q. Jin, and J. Ma, “Pdl: an efficient prediction-based false data injection attack detection and location in smart grid,” in _2018 IEEE 42nd Annual Computer Software and Applications Conference (COMPSAC)_ , vol. 2. IEEE, 2018, pp. 676–681.
  * [47] M. Mohammadpourfard, I. Genc, S. Lakshminarayana, and C. Konstantinou, “Attack detection and localization in smart grid with image-based deep learning,” in _2021 IEEE international conference on communications, control, and computing technologies for smart grids (SmartGridComm)_. IEEE, 2021, pp. 121–126.
  * [48] D. Li, P. Ramanan, N. Gebraeel, and K. Paynabar, “Deep learning based covert attack identification for industrial control systems,” in _2020 19th IEEE International Conference on Machine Learning and Applications (ICMLA)_. IEEE, 2020, pp. 438–445.
  * [49] E. Drayer and T. Routtenberg, “Cyber attack localization in smart grids by graph modulation (brief announcement),” in _International Symposium on Cyber Security Cryptography and Machine Learning_. Springer, 2019, pp. 97–100.
  * [50] Z. S. Khalafi, M. Dehghani, A. Khalili, A. Sami, N. Vafamand, and T. Dragičević, “Intrusion detection, measurement correction, and attack localization of pmu networks,” _IEEE Transactions on Industrial Electronics_ , vol. 69, no. 5, pp. 4697–4706, 2021.
  * [51] W. Wang, L. He, P. Markham, H. Qi, and Y. Liu, “Detection, recognition, and localization of multiple attacks through event unmixing,” in _2013 IEEE International Conference on Smart Grid Communications (SmartGridComm)_. IEEE, 2013, pp. 73–78.
  * [52] M. A. Hasnat and M. Rahnamay-Naeini, “Detecting and locating cyber and physical stresses in smart grids using the k-nearest neighbour analysis of instantaneous correlation of states,” _IET Smart Grid_ , vol. 4, no. 3, pp. 307–320, 2021.
  * [53] J. Jiang, J. Wu, C. Long, and S. Li, “Location of false data injection attacks in power system,” in _2019 Chinese Control Conference (CCC)_. IEEE, 2019, pp. 7473–7478.
  * [54] B. Li, Q. Du, J. Song, A. Li, and X. Ma, “Locating false data injection attacks on smart grids using d-facts devices,” in _International Conference on Service-Oriented Computing_. Springer, 2021, pp. 287–301.
  * [55] M. A. Hasnat and M. Rahnamay-Naeini, “A graph signal processing framework for detecting and locating cyber and physical stresses in smart grids,” _IEEE Transactions on Smart Grid_ , 2022.
  * [56] Q. Qiu, F. Yang, and Y. Zhu, “Cyber-attack localisation and tolerant control for microgrid energy management system based on set-membership estimation,” _International Journal of Systems Science_ , vol. 52, no. 6, pp. 1206–1222, 2021.
  * [57] Q. Li, J. Zhang, J. Zhao, J. Ye, W. Song, and F. Li, “Adaptive hierarchical cyber attack detection and localization in active distribution systems,” _IEEE Transactions on Smart Grid_ , vol. 13, no. 3, pp. 2369–2380, 2022.
  * [58] M. R.-N. Md Abul Hasnat, “Characterization and classification of cyber attacks in smart grids using local smoothness of graph signals,” vol. 2, pp. 1–6, 2021\.
  * [59] O. Boyaci, M. R. Narimani, K. Davis, and E. Serpedin, “Infinite impulse response graph neural networks for cyberattack localization in smart grids,” _arXiv preprint arXiv:2206.12527_ , 2022.
  * [60] X. Gao, X. Yang, L. Meng, and S. Wang, “Fast economic dispatch with false data injection attack in electricity-gas cyber–physical system: A data-driven approach,” _ISA transactions_ , 2022.
  * [61] H. I. Hegazy, A. S. T. Eldien, M. M. Tantawy, M. M. Fouda, and H. A. TagElDien, “Online location-based detection of false data injection attacks in smart grid using deep learning,” in _2022 IEEE International Conference on Internet of Things and Intelligence Systems (IoTaIS)_. IEEE, 2022, pp. 153–159.
  * [62] Y. Han, H. Feng, K. Li, and Q. Zhao, “False data injection attacks detection with modified temporal multi-graph convolutional network in smart grids,” _Computers & Security_, vol. 124, p. 103016, 2023.
  * [63] D. Li, N. Z. Gebraeel, K. Paynabar, and A. S. Meliopoulos, “An online approach to covert attack detection and indentification in power systems,” _IEEE Transactions on Power Systems_ , 2022.
  * [64] X. Fan, M. Zhang, H. Zeng, and C. Shen, “Locational detection of data integrity attacks with multi-gate mixture-of-experts in smart grid.”
  * [65] S. H. Haghshenas, M. A. Hasnat, and M. Naeini, “A temporal graph neural network for cyber attack detection and localization in smart grids,” _arXiv preprint arXiv:2212.03390_ , 2022.
  * [66] S. Z. Yong, M. Zhu, and E. Frazzoli, “A unified filter for simultaneous input and state estimation of linear discrete-time stochastic systems,” _Automatica_ , vol. 63, pp. 321–329, 2016.
  * [67] E. Hallaji, R. Razavi-Far, M. Wang, M. Saif, and B. Fardanesh, “A stream learning approach for real-time identification of false data injection attacks in cyber-physical power systems,” _IEEE Transactions on Information Forensics and Security_ , vol. 17, pp. 3934–3945, 2022.
  * [68] J. James, Y. Hou, and V. O. Li, “Online false data injection attack detection with wavelet transform and deep neural networks,” _IEEE Transactions on Industrial Informatics_ , vol. 14, no. 7, pp. 3271–3280, 2018.
  * [69] A. Jevtic, F. Zhang, Q. Li, and M. Ilic, “Physics-and learning-based detection and localization of false data injections in automatic generation control,” _IFAC-PapersOnLine_ , vol. 51, no. 28, pp. 702–707, 2018.
  * [70] Y. Gu, T. Liu, D. Wang, X. Guan, and Z. Xu, “Bad data detection method for smart grids based on distributed state estimation,” in _2013 IEEE International Conference on Communications (ICC)_. IEEE, 2013, pp. 4483–4487.
  * [71] S. Zonouz, K. M. Rogers, R. Berthier, R. B. Bobba, W. H. Sanders, and T. J. Overbye, “Scpse: Security-oriented cyber-physical state estimation for power grid critical infrastructures,” _IEEE Transactions on Smart Grid_ , vol. 3, no. 4, pp. 1790–1799, 2012.
  * [72] X. Wang, X. Luo, Y. Zhang, and X. Guan, “Detection and isolation of false data injection attacks in smart grids via nonlinear interval observer,” _IEEE Internet of Things Journal_ , vol. 6, no. 4, pp. 6498–6512, 2019.
  * [73] S. F. Tierney, “The new york independent system operator: A ten-year review,” _New York ISO White Paper. Boston, MA_ , 2010.
  * [74] B. Li, Q. Du, J. Song, A. Li, and X. Ma, “Locating false data injection attacks on smart grids using d-facts devices,” in _Service-Oriented Computing: 19th International Conference, ICSOC 2021, Virtual Event, November 22–25, 2021, Proceedings_. Berlin, Heidelberg: Springer-Verlag, 2021, p. 287–301.
  * [75] J. Löfberg, “Yalmip : A toolbox for modeling and optimization in matlab,” in _In Proceedings of the CACSD Conference_ , Taipei, Taiwan, 2004\.
  * [76] X. Wang, D. Shi, J. Wang, Z. Yu, and Z. Wang, “Online identification and data recovery for pmu data manipulation attack,” _IEEE Transactions on Smart Grid_ , vol. 10, no. 6, pp. 5889–5898, 2019.