# Machine Learning-Based Cyberattack Detection and Identification for Automatic Generation Control Systems Considering Nonlinearities

arXiv: https://arxiv.org/abs/2504.09363 · HTML: https://mlsanity.com/paper/2504.09363/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 3 of its 18 references that are in the map.
- First posted on arXiv 12 Apr 2025.

## Builds on (most cited first, 3 of 3)

- [Unmasking Covert Intrusions: Detection of Fault-Masking Cyberattacks on Differential Protection Systems](https://mlsanity.com/paper/2409.04242/) (2024)
- [An Online Detection Framework for Cyber Attacks on Automatic Generation Control](https://mlsanity.com/paper/1712.06417/) (2017)
- [Learning-Based Detection of Malicious Volt-VAr Control Parameters in Smart Inverters](https://mlsanity.com/paper/2309.10304/) (2023)

## Built on by (most cited first, 1 of 1)

- [Glass-Box Deep Learning for FDIA Detection in Nonlinear Automatic Generation Control: A Kolmogorov-Arnold Network Approach](https://mlsanity.com/paper/2509.05259/) (2025)

## Abstract (arXiv)

Automatic generation control (AGC) systems play a crucial role in maintaining system frequency across power grids. However, AGC systems' reliance on communicated measurements exposes them to false data injection attacks (FDIAs), which can compromise the overall system stability. This paper proposes a machine learning (ML)-based detection framework that identifies FDIAs and determines the compromised measurements. The approach utilizes an ML model trained offline to accurately detect attacks and classify the manipulated signals based on a comprehensive set of statistical and time-series features extracted from AGC measurements before and after disturbances. For the proposed approach, we compare the performance of several powerful ML algorithms. Our results demonstrate the efficacy of the proposed method in detecting FDIAs while maintaining a low false alarm rate, with an F1-score of up to 99.98%, outperforming existing approaches.