# A Stream Learning Approach for Real-Time Identification of False Data Injection Attacks in Cyber-Physical Power Systems

arXiv: https://arxiv.org/abs/2210.06729 · HTML: https://mlsanity.com/paper/2210.06729/

## Key facts

- Cited by 3 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 46 references that are in the map.
- First posted on arXiv 13 Oct 2022.

## Builds on (most cited first, 7 of 7)

- [Impacts of Bad Data on the PMU based Line Outage Detection](https://mlsanity.com/paper/1502.04236/) (2015)
- [Real-Time Detection of Hybrid and Stealthy Cyber-Attacks in Smart Grid](https://mlsanity.com/paper/1803.00128/) (2018)
- [Identification of Successive "Unobservable" Cyber Data Attacks in Power Systems Through Matrix Decomposition](https://mlsanity.com/paper/1607.04776/) (2016)
- [Secure Distributed Dynamic State Estimation in Wide-Area Smart Grids](https://mlsanity.com/paper/1902.07288/) (2019)
- [Stealthy MTD Against Unsupervised Learning-based Blind FDI Attacks in Power Systems](https://mlsanity.com/paper/2004.07004/) (2020)
- [Minimum Sparsity of Unobservable Power Network Attacks](https://mlsanity.com/paper/1610.06068/) (2016)
- [Unobservable False Data Injection Attacks against PMUs: Feasible Conditions and Multiplicative Attacks](https://mlsanity.com/paper/1806.05057/) (2018)

## Built on by (most cited first, 3 of 3)

- [Decentralized Federated Learning: A Survey on Security and Privacy](https://mlsanity.com/paper/2401.17319/) (2024)
- [Learning From High-Dimensional Cyber-Physical Data Streams for Diagnosing Faults in Smart Grids](https://mlsanity.com/paper/2303.08300/) (2023)
- [A Study on Semi-Supervised Detection of DDoS Attacks under Class Imbalance](https://mlsanity.com/paper/2506.22949/) (2025)

## Abstract (arXiv)

This paper presents a novel data-driven framework to aid in system state estimation when the power system is under unobservable false data injection attacks. The proposed framework dynamically detects and classifies false data injection attacks. Then, it retrieves the control signal using the acquired information. This process is accomplished in three main modules, with novel designs, for detection, classification, and control signal retrieval. The detection module monitors historical changes in phasor measurements and captures any deviation pattern caused by an attack on a complex plane. This approach can help to reveal characteristics of the attacks including the direction, magnitude, and ratio of the injected false data. Using this information, the signal retrieval module can easily recover the original control signal and remove the injected false data. Further information regarding the attack type can be obtained through the classifier module. The proposed ensemble learner is compatible with harsh learning conditions including the lack of labeled data, concept drift, concept evolution, recurring classes, and independence from external updates. The proposed novel classifier can dynamically learn from data and classify attacks under all these harsh learning conditions. The introduced framework is evaluated w.r.t. real-world data captured from the Central New York Power System. The obtained results indicate the efficacy and stability of the proposed framework.