# Power System Anomaly Detection and Classification Utilizing WLS-EKF State Estimation and Machine Learning

arXiv: https://arxiv.org/abs/2209.12629 · HTML: https://mlsanity.com/paper/2209.12629/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 55 references that are in the map.
- First posted on arXiv 26 Sep 2022.

## Builds on (most cited first, 6 of 6)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Macro F1 and Macro F1](https://mlsanity.com/paper/1911.03347/) (2019)
- [Maximum Relevance and Minimum Redundancy Feature Selection Methods for a Marketing Machine Learning Platform](https://mlsanity.com/paper/1908.05376/) (2019)
- [Bayesian State Estimation for Unobservable Distribution Systems via Deep Learning](https://mlsanity.com/paper/1811.02756/) (2018)
- [A Taxonomy of Cyber Defence Strategies Against False Data Attacks in Smart Grid](https://mlsanity.com/paper/2103.16085/) (2021)
- [Robust Matrix Completion State Estimation in Distribution Systems](https://mlsanity.com/paper/1902.02009/) (2019)

## Built on by (most cited first, 1 of 1)

- [Supervised Learning based Method for Condition Monitoring of Overhead Line Insulators using Leakage Current Measurement](https://mlsanity.com/paper/2407.20288/) (2024)

## Abstract (arXiv)

Power system state estimation is being faced with different types of anomalies. These might include bad data caused by gross measurement errors or communication system failures. Sudden changes in load or generation can be considered as anomaly depending on the implemented state estimation method. Additionally, considering power grid as a cyber physical system, state estimation becomes vulnerable to false data injection attacks. The existing methods for anomaly classification cannot accurately classify (discriminate between) the above mentioned three types of anomalies, especially when it comes to discrimination between sudden load changes and false data injection attacks. This paper presents a new algorithm for detecting anomaly presence, classifying the anomaly type and identifying the origin of the anomaly, i.e., measurements that contain gross errors in case of bad data, or buses associated with loads experiencing a sudden change, or state variables targeted by false data injection attack. The algorithm combines analytical and machine learning (ML) approaches. The first stage exploits an analytical approach to detect anomaly presence by combining chi2-test and anomaly detection index. The second stage utilizes ML for classification of anomaly type and identification of its origin, with particular reference to discrimination between sudden load changes and false data injection attacks. The proposed ML based method is trained to be independent of the network configuration which eliminates retraining of the algorithm after network topology changes. The results obtained by implementing the proposed algorithm on IEEE 14 bus test system demonstrate the accuracy and effectiveness of the proposed algorithm.