# Multi-Source Data Fusion for Cyberattack Detection in Power Systems

arXiv: https://arxiv.org/abs/2101.06897 · HTML: https://mlsanity.com/paper/2101.06897/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 105 references that are in the map.
- First posted on arXiv 18 Jan 2021.

## Builds on (most cited first, 6 of 6)

- [pandapower - an Open Source Python Tool for Convenient Modeling, Analysis and Optimization of Electric Power Systems](https://mlsanity.com/paper/1709.06743/) (2017)
- [Clustering Algorithms: A Comparative Approach](https://mlsanity.com/paper/1612.08388/) (2016)
- [Machine Learning Methods for Attack Detection in the Smart Grid](https://mlsanity.com/paper/1503.06468/) (2015)
- [Design and Evaluation of A Cyber-Physical Resilient Power System Testbed](https://mlsanity.com/paper/2011.13552/) (2020)
- [Generalized Contingency Analysis Based on Graph Theory and Line Outage Distribution Factor](https://mlsanity.com/paper/2007.07009/) (2020)
- [Power Systems Data Fusion based on Belief Propagation](https://mlsanity.com/paper/1705.08815/) (2017)

## Built on by (most cited first, 4 of 4)

- [Securing Time Integrity in Energy IoT Against Clock Drift and Y2K38 Failures](https://mlsanity.com/paper/2601.23147/) (2026)
- [Inter-Domain Fusion for Enhanced Intrusion Detection in Power Systems: An Evidence Theoretic and Meta-Heuristic Approach](https://mlsanity.com/paper/2111.10484/) (2021)
- [Bayesian Reinforcement Learning for Automatic Voltage Control under Cyber-Induced Uncertainty](https://mlsanity.com/paper/2305.16469/) (2023)
- [A Reinforcement Learning Engine with Reduced Action and State Space for Scalable Cyber-Physical Optimal Response](https://mlsanity.com/paper/2410.04518/) (2024)

## Abstract (arXiv)

Cyberattacks can cause a severe impact on power systems unless detected early. However, accurate and timely detection in critical infrastructure systems presents challenges, e.g., due to zero-day vulnerability exploitations and the cyber-physical nature of the system coupled with the need for high reliability and resilience of the physical system. Conventional rule-based and anomaly-based intrusion detection system (IDS) tools are insufficient for detecting zero-day cyber intrusions in the industrial control system (ICS) networks. Hence, in this work, we show that fusing information from multiple data sources can help identify cyber-induced incidents and reduce false positives. Specifically, we present how to recognize and address the barriers that can prevent the accurate use of multiple data sources for fusion-based detection. We perform multi-source data fusion for training IDS in a cyber-physical power system testbed where we collect cyber and physical side data from multiple sensors emulating real-world data sources that would be found in a utility and synthesizes these into features for algorithms to detect intrusions. Results are presented using the proposed data fusion application to infer False Data and Command injection-based Man-in- The-Middle (MiTM) attacks. Post collection, the data fusion application uses time-synchronized merge and extracts features followed by pre-processing such as imputation and encoding before training supervised, semi-supervised, and unsupervised learning models to evaluate the performance of the IDS. A major finding is the improvement of detection accuracy by fusion of features from cyber, security, and physical domains. Additionally, we observed the co-training technique performs at par with supervised learning methods when fed with our features.