Detection and Localization of Load Redistribution Attacks on Large Scale Systems

TL;DR

This paper introduces a scalable detection scheme for load redistribution attacks in large systems, combining statistical testing to identify and localize malicious load modifications effectively.

Contribution

It presents a novel, scalable detection method and a statistical localization technique for load redistribution attacks in large-scale systems.

Findings

Effective detection across various attack types

Scalable to large systems with consistent performance

Successful localization of attack-affected loads

Abstract

A nearest neighbor-based detection scheme against load redistribution attacks is presented. The detector is designed to scale from small to very large systems while guaranteeing consistent detection performance. Extensive testing is performed on a realistic, large scale system to evaluate the performance of the proposed detector against a wide range of attacks, from simple random noise attacks to sophisticated load redistribution attacks. The detection capability is analyzed against different attack parameters to evaluate its sensitivity. Finally, a statistical test that leverages the proposed detection algorithm is introduced to identify which loads are likely to have been maliciously modified, thus, localizing the attack subgraph. This test is based on ascribing to each load a risk measure (probability of being attacked) and then computing the best posterior likelihood that minimizes log-loss.