A data-driven algorithm to detect false data injections targeting both frequency regulation and market operation in power systems

This paper focuses on detecting cyber-attacks targeting the Automatic Generation Control (AGC) loop and market operation. To achieve this, a new data-driven learning algorithm is proposed that ensembles various learning tools such as K-Means clustering, Synthetic Minority Oversampling Technique oversampling, and Support Vector Data Description models as the base learners. Next, this paper devises a new feature variable, EF, which generates a relatively higher value for attack scenarios than normal grid states, thus aiding the classifier in predictions with low false alarms. The proposed approach can detect a wide range of cyber-attacks, including unseen attack cases. This paper further modelled and validated the detection of profit-oriented intelligent market operation attacks, absent in most of the previous works. Such attacks project themselves within the proximity of nominal grid states, making them difficult to predict. The algorithm's performance is finally compared with other learning models, and it is found that the proposed technique has superior prediction with True Positive Rate, True Negative Rate, and Geometric Accuracy as 98.13%, 99.85%, and 98.98%, respectively.