Attention-Enhanced Graph Filtering for False Data Injection Attack Detection and Localization

TL;DR

This paper introduces a novel graph filtering and Transformer-based framework for detecting and localizing false data injection attacks in power grids, leveraging topology-aware features and long-range dependencies for improved accuracy.

Contribution

It combines ARMA graph filters with an Encoder-Only Transformer to enhance FDIA detection and localization in power systems, addressing limitations of previous methods.

Findings

High detection accuracy on IEEE 14- and 300-bus systems

Effective exploitation of grid topology and state information

Robustness to spectral changes and local dependencies

Abstract

The increasing deployment of Internet-of-Things (IoT)-enabled measurement devices in modern power systems has expanded the cyberattack surface of the grid. As a result, this critical infrastructure is increasingly exposed to cyberattacks, including false data injection attacks (FDIAs) that compromise measurement integrity and threaten reliable system operation. Existing FDIA detection methods primarily exploit spatial correlations and network topology using graph-based learning; however, these approaches often rely on high-dimensional representations and shallow classifiers, limiting their ability to capture local structural dependencies and global contextual relationships. Moreover, naively incorporating Transformer architectures can result in overly deep models that struggle to model localized grid dynamics. This paper proposes a joint FDIA detection and localization framework that integrates auto-regressive moving average (ARMA) graph convolutional filters with an Encoder-Only Transformer architecture. The ARMA-based graph filters provide robust, topology-aware feature extraction and adaptability to abrupt spectral changes, while the Transformer encoder leverages self-attention to capture long-range dependencies among grid elements without sacrificing essential local context. The proposed method is evaluated using real-world load data from the New York Independent System Operator (NYISO) applied to the IEEE 14- and 300-bus systems. Numerical results demonstrate that the proposed model effectively exploits both the state and topology of the power grid, achieving high accuracy in detecting FDIA events and localizing compromised nodes.