# Model-Agnostic Algorithm for Real-Time Attack Identification in Power Grid using Koopman Modes

arXiv: https://arxiv.org/abs/2007.11717 · HTML: https://mlsanity.com/paper/2007.11717/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 22 Jul 2020.

## Built on by (most cited first, 4 of 4)

- [Online Real-time Learning of Dynamical Systems from Noisy Streaming Data: A Koopman Operator Approach](https://mlsanity.com/paper/2212.05259/) (2022)
- [Learning Invariant Subspaces of Koopman Operators--Part 1: A Methodology for Demonstrating a Dictionary's Approximate Subspace Invariance](https://mlsanity.com/paper/2212.07358/) (2022)
- [KoopAGRU: A Koopman-based Anomaly Detection in Time-Series using Gated Recurrent Units](https://mlsanity.com/paper/2501.17976/) (2025)
- [Power Interpretable Causal ODE Networks: A Unified Model for Explainable Anomaly Detection and Root Cause Analysis in Power Systems](https://mlsanity.com/paper/2602.12592/) (2026)

## Abstract (arXiv)

Malicious activities on measurements from sensors like Phasor Measurement Units (PMUs) can mislead the control center operator into taking wrong control actions resulting in disruption of operation, financial losses, and equipment damage. In particular, false data attacks initiated during power systems transients caused due to abrupt changes in load and generation can fool the conventional model-based detection methods relying on thresholds comparison to trigger an anomaly. In this paper, we propose a Koopman mode decomposition (KMD) based algorithm to detect and identify false data attacks in real-time. The Koopman modes (KMs) are capable of capturing the nonlinear modes of oscillation in the transient dynamics of the power networks and reveal the spatial embedding of both natural and anomalous modes of oscillations in the sensor measurements. The Koopman-based spatio-temporal nonlinear modal analysis is used to filter out the false data injected by an attacker. The performance of the algorithm is illustrated on the IEEE 68-bus test system using synthetic attack scenarios generated on GridSTAGE, a recently developed multivariate spatio-temporal data generation framework for simulation of adversarial scenarios in cyber-physical power systems.