Advancing Cyber-Attack Detection in Power Systems: A Comparative Study of Machine Learning and Graph Neural Network Approaches

TL;DR

This study compares machine learning, autoencoder, and graph neural network methods for detecting and localizing cyber-attacks on power system sensor data, finding GNNs generally outperform others but face challenges in complex attack scenarios.

Contribution

It provides a comparative analysis of GNNs, ML, and deep learning for cyber-attack detection and localization in power systems, highlighting GNNs' superior performance.

Findings

GNNs outperform k-means and autoencoders in detection accuracy.

GNNs can localize attacks effectively in simple scenarios.

Complex attack combinations pose challenges for GNN localization.

Abstract

This paper explores the detection and localization of cyber-attacks on time-series measurements data in power systems, focusing on comparing conventional machine learning (ML) like k-means, deep learning method like autoencoder, and graph neural network (GNN)-based techniques. We assess the detection accuracy of these approaches and their potential to pinpoint the locations of specific sensor measurements under attack. Given the demonstrated success of GNNs in other time-series anomaly detection applications, we aim to evaluate their performance within the context of power systems cyber-attacks on sensor measurements. Utilizing the IEEE 68-bus system, we simulated four types of false data attacks, including scaling attacks, additive attacks, and their combinations, to test the selected approaches. Our results indicate that GNN-based methods outperform k-means and autoencoder in detection. Additionally, GNNs show promise in accurately localizing attacks for simple scenarios, although they still face challenges in more complex cases, especially ones that involve combinations of scaling and additive attacks.