Pseudo-Feature Padding: A Lightweight Defense Against False Data Injection in Power Grids Farhin Farhad Riya˚ , Shahinul Hoque˚ , Yingyuan Yang: , Jinyuan Sun˚ , Kevin Tomsovic; ˚ Department of Electrical Engineering and Computer Science, University of Tennessee : Department of Computer Science, The University of Illinois at Springfield ; Department of Electrical and Computer Engineering, Clemson University, South Carolina
arXiv:2606.20415v1 [cs.LG] 18 Jun 2026
[email protected], [email protected], [email protected], [email protected], [email protected]
Abstract—Deep Neural Networks (DNNs) have achieved remarkable accuracy in various tasks, including their application in Cyber-Physical Systems (CPS) for detecting False Data Injection Attacks (FDIA) during critical operations. However, the unique infrastructure of CPS makes DNNs vulnerable to exploitation by attackers aiming to evade detection. Additionally, the distinct nature of CPS presents challenges for conventional defense mechanisms against FDIA. This paper proposes an innovative defense framework that strengthens DNNs against such attacks by introducing an additional input layer that performs padding in the input samples using pseudo-feature values derived from the input’s statistical distribution. This padding increases the input dimensionality in a randomized and data-aware manner, making adversarial attacks computationally infeasible due to the non-transferable nature of crafted perturbations and the unpredictability of the padded structure. Our method is lightweight, model-agnostic, and requires no modifications to the core architecture, making it highly deployable in realworld CPS settings. We evaluated our framework on critical power grid applications such as state estimation, using the IEEE 14-bus, 30-bus, 118-bus, and 300-bus systems. Experiments under adversarial settings demonstrate that our padding strategy significantly improves model robustness with negligible impact on performance, and effectively mitigates attacks that would otherwise bypass conventional defenses. Index Terms—Deep Neural Networks, False data injection attack, cyber-physical system.
I. INTRODUCTION DNNs enhance accuracy and robustness in CPS such as power grids, transportation, and industrial control. However, the nature of their infrastructure exposes them to FDIA, which manipulates sensor and control signals with potentially severe consequences [1]. Traditional defenses often fall short due to the intricate interdependencies in CPS. In power grids, for example, state estimation is vital for managing power flow and distribution but is vulnerable to FDIA that bypass anomaly detection and disrupt operations like real-time pricing [2]. Despite extensive research and development of detection strategies, the unique constraints of power grid environments leave DNNs vulnerable to sophisticated perturbations [3]. In response to these vulnerabilities, this paper introduces a defense framework designed to mitigate the effect of FDIA against DNNs in CPS. Our approach involves the integration of an additional input layer that implements a padding strategy, augmented with pseudo-feature values derived directly from the statistical distribution of the input data [4]. Unlike prior padding-based defenses that rely on fixed values (e.g., zero-
padding) [5] [6], our method dynamically generates pseudofeatures by identifying low-importance input features through tree-based models and sampling new values from their fitted statistical distributions. This input-specific augmentation increases the dimensionality and complexity of the data in a way that makes adversarial perturbations significantly less transferable and more computationally expensive to generate. By introducing multiple padding combinations per training sample and randomizing the padding during inference, our method further enhances model robustness by increasing data diversity and adversarial uncertainty, without altering the core DNN architecture. This framework is designed to be lightweight and model-agnostic, requiring no fundamental changes to the core architecture of the existing DNN models, which facilitates easy deployment in real-world CPS settings. To demonstrate the efficacy of our proposed solution, we conduct extensive evaluations on the state estimation of the power grid and show that our padding strategy not only maintains the performance integrity of the DNNs but also significantly enhances their robustness. The paper also demonstrates that conventional defense techniques fall short in defending against these wellcrafted FDIA samples. The key contributions of this paper can be summarized as follows: ‚ We propose a defense method that mitigates the effect of FDIA by padding the input samples with pseudo-features. This padding strategy not only increases the input dimensionality but also complicates the computation required to generate accurate FDIA samples. ‚ Our proposed framework can be easily adapted to the prevailing Machine Learning techniques that are utilized in FDIA detection in CPS. ‚ The framework requires no hardware changes or sensor redeployment, addressing the impracticality of securing all sensors in distributed CPS environments. ‚ Our proposed framework has a negligible accuracy drop compared to the baseline models. ‚ We validate the framework through simulation using the IEEE test system, including the IEEE 14-bus case, 30-bus case, 118-bus case, and 300-bus case. For every case, the favorable outcomes justify the proposed mechanism. II. R ELATED W ORK Since Liu et al. [7] revealed SCADA system vulnerabilities to FDIA, extensive research has explored the threat due to
the critical role of state estimation. Many works have studied stealthy FDIAs that exploit the structure of the Jacobian matrix to evade residual-based detectors [8], [9], with some attacks succeeding even with partial system knowledge [10], [11]. Other studies [12], [13] emphasize the risk of FDIA to system stability and operations. The impact of random and structured bad data on estimation was further analyzed in [14], highlighting persistent security concerns. To defend against FDIA, early strategies focused on enhancing measurement security. For example, Huang et al. [15] introduced an adaptive cumulative sum method for rapid detection, while others incorporated PMU measurements synchronized with GPS signals. More recently, machine learning (ML) has emerged as a computationally efficient, hardware-free alternative [16], [17]. ML-based approaches include supervised and semi-supervised detection using Gaussian models [16], and anomaly detection via unsupervised and SVM-based classifiers [17]. Deep learning models such as RNNs with LSTM cells and convolutional networks have demonstrated strong performance against FDIA [18], [19]. However, these models remain vulnerable to adversarial perturbations. Szegedy et al. [20] first revealed that DNNs can be manipulated using carefully crafted inputs. Since then, several attack techniques have been proposed, including FGSM [4], FGM [21], iterative methods [22], and DeepFool [23]. Additionally, defense mechanisms such as adversarial training [22], model distillation [24], adversarial input detection [25], and input reconstruction [26] have been explored. More recent approaches include deep reinforcement learning for adaptive FDIA detection [27], multi-mode attack detection strategies [28], and GAN-GRU-based data balancing to mitigate class imbalance [29]. However, most of these methods require substantial modifications to the training pipeline or model architecture. In contrast, our proposed framework operates as a lightweight preprocessing step that preserves the original model. Moreover, we show that existing techniques such as adversarial training and distillation perform poorly in CPS-like settings due to the constraints. Prior padding-based defenses [5], [6] improve robustness via zero-padding but are limited by their fixed padding values, which can be exploited in white-box scenarios. Our method overcomes this limitation by introducing randomized, data-aware padding that increases input complexity and reduces attack transferability. III. BACKGROUND Notations: m and n denote the number of measurements and state variables. The Jacobian matrix H P Rmˆn maps the state vector x P Rn to the measurement vector z P Rm . Measurement noise is represented by e, x̂ is the estimated state, and W is the noise covariance matrix. Bias L2 -Norm captures the estimation shift from adversarial perturbations, while Valid L2 -Norm quantifies perturbation strength. A. State Estimation in Power System State estimation in DC power systems is fundamental for understanding the dynamics and integrity of the network. It utilizes the linear model, z “ Hx ` e, where x “
px1 , x2 , . . . , xn qT denotes the state variables of the power system, z “ pz1 , z2 , . . . , zm qT are the sensor measurements, and H is the m ˆ n Jacobian matrix relating measurements to the states. The error vector e “ pe1 , e2 , . . . , em qT accounts for measurement inaccuracies. The system is typically overdetermined (m ą n), and the state estimation is often performed via a weighted least squares approach: x̂ “ pH T W Hq´1 H T W z (1) Here, W is a diagonal weight matrix derived from the inverse variances of the measurement errors, optimizing the estimation accuracy by minimizing the variance of the estimation error. This formulation ensures robust state estimation even in the presence of measurement redundancy and potential data inaccuracies, ensuring secure and efficient power grid operations. Bad Data Detection: Sensor measurements in state estimation can be compromised by faults, misconfigurations, or malicious actions. To detect such errors, the L2 -norm of the residual |z ´ H x̂| is evaluated, where x̂ is the estimated state. If this norm exceeds a threshold τ , the data is flagged as bad. Assuming Gaussian noise, the squared residual follows a chisquared distribution with ν “ m ´ n degrees of freedom, and τ is set via hypothesis testing at significance level α.
B. False Data Injection Attack FDIA enables attackers to manipulate state estimations in power systems by introducing perturbed measurements. If an attacker knows the system’s matrix H, they can generate a perturbation vector a “ ra1 , a2 , . . . , amsT , leading to polluted measurements za “ z ` a. This attack aims to make polluted measurements indistinguishable from legitimate ones by ensuring that the error does not exceed a detection threshold τ . The relationship between the compromised and estimated states can be mathematically represented as: ||za ´ H x̂bad || “ ||z ` a ´ Hpx̂ ` cq|| (2) where x̂bad and x̂ denote the estimated states from za and z respectively. Simplifying, we find: ||z ´ H x̂ ` pa ´ Hcq|| ď τ (3) To construct an effective attack vector a, the attacker uses the projection matrix P “ HpH T Hq´1 H T and defines B “ P ´ I. For the attack to remain undetected, a must satisfy Ba “ 0. In practical scenarios where only a subset of measurements can be compromised and the attackers aim to construct the vector a such that its non-zero components correspond to the compromised measurements, while still satisfying Ba “ 0. Our goal is to defend a DNN-based anomaly detector fθ p¨q against such structured perturbations. We define a transformation Φpzq “ concatpz, Ppad q, where Ppad P Rp is a pseudofeature vector generated by sampling from the distributions of low-importance features identified via a tree-based model. This padding operation increases the input dimensionality and introduces structural randomness, which modifies the projection matrix used in detection and breaks the attacker’s stealth condition Ba “ 0.
(a) Model training accuracy
(b) Model detection accuracy
(c) Manifold of the false and adversarial samples
Fig. 1: Experimental setup: Baseline model performance under no attack and the manifold of false and adv-measurements
on benign inputs. Algorithm 1 Pseudo-feature Padding with Per-Sample Importance 1: Input: Dataset D “ tpxpiq , y piq qu, tree-based model, distribution fitting method, threshold θ, weights W , bias b
Fig. 2: Pseudo-Feature Padding input modification
IV. P ROPOSED P SEUDO - FEATURE PADDING In response to the vulnerabilities exposed by FDIA and the criticality of accurate state estimation in power systems, our framework introduces a pseudo-feature padding technique. 1) Overview of the Framework: The proposed framework enhances robustness against adversarial manipulations by appending statistically derived pseudo-features to each input, thereby increasing its dimensionality and introducing structured randomness. Formally, for any input measurement z̃ P tz, z 1 u, where z is a clean sample and z 1 “ z ` a is an adversarially perturbed version, we define the padded input as: z2 “ Φpz̃q “ concatpz̃, Ppad q (4) Here, Ppad denotes a pseudo-feature vector generated from the statistical distribution of low-importance features identified using a decision tree-based analysis. While traditional FDIA assumes additive perturbations designed to satisfy the stealth condition Ba “ 0, our input transformation increases the input dimension and modifies the detection space. As a result, previously stealthy attack vectors are no longer aligned with the null space of the transformed system, reducing attack effectiveness and transferability. During training, pseudo-features are concatenated to clean samples z, generating multiple augmented variants per sample. Each training sample undergoes feature importance ranking to identify low-saliency features fi , from which synthetic values f 1 are sampled to form Ppad . A padding size p controls how many variants are generated per sample, leading to a dataset expansion from Z to pp ` 1qZ samples. At inference, the model may encounter either a clean sample z or an adversarially perturbed sample z 1 . In both cases, a fresh pseudo-feature vector Ppad is sampled and concatenated to the observed input, forming z2 . This consistent application of padding ensures robustness while preserving performance
2: Output: Trained model with pseudo-padded input robustness 3: for each feature fj in x do 4: Fit distribution Distj over all values of fj in D Ź Used for sampling 5: for each sample pxpiq , y piq q P D do piq 6: Compute feature importance scores Sj for xpiq using the tree-based model piq piq 7: Fless Ð tfj : Sj ă θu Ź Less important features for this sample piq piq 8: Sample pseudo-features tpj u from Distj for fj P Fless piq piq piq 9: xnew Ð concatenate(x , tpj u) piq 10: Train DNN using pxpiq q to minimize loss with respect to W , b new , y 11: for each inference sample pxptestq , y ptestq q do ptestq ptestq 12: Compute Sj for x ptestq ptestq 13: Fless Ð tfj : Sj ă θu ptestq ptestq 14: Sample pseudo-features tpj u from Distj for fj P Fless ptestq ptestq 15: xptestq Ð concatenate(x , tp u) new j 16: Predict ŷ ptestq Ð DNN(xptestq new ) 17: Check for FDIA anomalies
Algorithm 1 outlines the proposed framework. For each input sample xpiq in dataset D, a tree-based model ranks piq feature importance scores Sj , and features below a threshold θ are identified as less important. Statistical distributions are pre-fitted to each feature across the entire dataset, and pseudofeatures are sampled from these distributions for the lowimportance features of each sample. The sampled pseudofeatures are concatenated with xpiq to form the augmented piq input xnew , increasing input dimensionality and structural diversity. The DNN is trained on these padded inputs, optimizing weights W and bias b while enhancing robustness to adversarial perturbations. 2) Robustness of the Pseudo-Feature Padding: The attack vector a is designed such that Ba “ 0, where B “ P ´ I and P “ HpH T Hq´1 H T is the projection matrix onto the column space of H. With the introduction of pseudo-feature padding Ppad , the effective system matrix becomes H 1 “ rH | Ppad s, modifying the projection matrix to P 1 “ H 1 pH 1T H 1 q´1 H 1T . This transforms the residual matrix to B 1 “ P 1 ´ I, and the adversarial condition becomes B 1 a1 “ 0, where a1 includes perturbations in both original and padded features. Lemma 1. Let B “ P ´ I and B 1 “ P 1 ´ I be the projection residual matrices before and after padding. Then N pBq ‰ N pB 1 q; that is, the null space structure changes under pseudo-
feature padding. Proof Sketch. Let H P Rmˆn be the system Jacobian and P “ HpH T Hq´1 H T . Pseudo-feature padding constructs H 1 “ rH | Ppad s, where Ppad P Rmˆp contains vectors sampled from the fitted distributions of low-importance features identified via a tree-based model. This increases the column space dimensionality, shifting the null space of the projection matrix P 1 “ H 1 pH 1T H 1 q´1 H 1T . Consequently, an attack vector a satisfying Ba “ 0 will generally fail to satisfy B 1 a1 “ 0, as N pB 1 q is no longer aligned with N pBq. Additionally, random sampling of Ppad at inference makes reconstructing H 1 infeasible, thus preventing transferable attacks. This change in null space complicates the attacker’s optimization problem. Since FDIA relies on precise structure in H, padding introduces structural uncertainty that increases adversarial difficulty while preserving model accuracy. 3) Impact of Less Important Features on Model Accuracy: Less important features are characterized by low importance scores, which minimally contribute to the accuracy of machine learning models. Breiman points out that these features have negligible effects on model performance when altered or removed [30]. Empirical studies confirm that excluding these features does not significantly degrade, and may even improve, model accuracy by reducing complexity and overfitting [31], [32], [33]. In light of these studies, the impact of our pseudofeature padding on model accuracy is expected to be very negligible. Additional evaluation results provided in subsequent sections further justify the statement. Figure 2 illustrates the original input’s feature importance heatmap (left) and its augmentation with pseudo-features resembling low-importance areas (right). This visualization demonstrates that the distribution of important features within the input sample remains intact, ensuring that the augmentation does not distort the model’s decision-making process.
Fig. 3: Attack detection accuracy for bus case-14, case-30, case-118 and case-300 with increasing padding size p V. E VALUATION A. Experimental Setup 1) Dataset: The behavior of the power systems was simulated using a DC power flow model in MATPOWER (MAT-
Defense
Case Accuracy Bias L2 Valid L2 14-bus 35.1% 70.7 119.8 30-bus 30.4% 87.2 112.2 Plain DNN 118-bus 39.7% 64.5 114.0 300-bus 40.0% 109 179.0 14-bus 45.7% 65.2 105.5 30-bus 42.6% 63.4 100.8 Adversarial Distilled 118-bus 40.2% 59.8 110.7 300-bus 48.3% 55.1 120.2 14-bus 62.0% 50.6 113.7 30-bus 58.7% 49.0 109.9 Adversarial Training 118-bus 60.1% 47.5 120.2 300-bus 64.4% 44.2 125.6 14-bus 93.5% 159.9 44.2 30-bus 93.1% 168.5 51.0 Zero Padding [6] 118-bus 93.7% 167.2 58.7 300-bus 95.0% 163.8 45.8 14-bus 94.2% 168.7 55.1 30-bus 92.0% 172.3 48.4 Pseudo-feature 118-bus 93.4% 174.9 49.0 300-bus 96.1% 174.7 48.5
TABLE I: Performance Comparison (Attack sample defection accuracy, Bias L2 -Norm and Valid L2 -Norm) of Different Defense Techniques
LAB) to construct the H matrix linking state variables to meter measurements. The dataset contains 40,000 samples across multiple IEEE test cases, evenly split between normal and false data for binary classification (0 = normal, 1 = false). Robustness was evaluated by varying the number of compromised meters; notably, compromising just 4% significantly reduced detection accuracy, highlighting system vulnerability. This setup offers a realistic benchmark for assessing our framework under adversarial conditions.
Fig. 4: Bias L2 -Norm for bus case-14, case-30, case-118 and case-300 with increasing padding size p 2) Defense Model: In the simulation, we use a feedforward DNN, denoted as network F , comprising four fully connected layers with ReLU activations, dropout regularization, and a sigmoid output layer for binary classification. The input layer size varies with the selected padding size,
Fig. 5: Valid L2 -Norm for bus case-14, case-30, case-118 and case-300 with increasing padding size p
which determines the number of pseudo-features. Training is performed using the Adam optimizer (learning rate 0.001), batch size 128, for 100 epochs. 3) Attack Sample Generation: Detection accuracy was evaluated using 1000 adversarial samples generated via the iterative projection framework in [22], [34], under power system constraints. The number of compromised meters was varied per test case. A Collective-Pattern Attack was also considered, where informed attackers target randomized models to evade detection. As shown in Figure 1c, adversarial data closely aligns with false data, enabling it to bypass plain DNNs due to system-constrained manifolds that we discussed in the Background sections. Adaptive and partial-information attacks are left for future work, though robustness is expected to hold under the non-deterministic padding scheme. 4) Attacker’s Knowledge: We consider a white-box threat model where the attacker knows the model and training data but not the pseudo-feature padding. Since pseudo-features are randomly sampled at inference, the input structure varies unpredictably, reducing the success and transferability of adversarial perturbations. 5) Evaluation Metrics: Model performance was evaluated using three metrics: Attack Detection Accuracy, which measures the system’s ability to identify malicious inputs; Bias L2 -Norm, assessing the error from adversarial perturbations; and Valid L2 -Norm, quantifying the size of adversarial perturbations. Success from an attacker’s view is indicated by lower accuracy, smaller Bias L2 -Norm, and larger Valid L2 -Norm. Method Train (s) Infer (ms) #Params Steps Overhead Plain DNN 10 0.8 145k None Low Adv Train 35 1.1 145k Grad gen High Adv Distillation 20 1.0 365k T-S distill Moderate Pseudo-Feature 35 0.9 437k Gen+Pad Low-Mod
TABLE II: Computational Overhead Comparison B. Results 1) Baseline Results: Figure 1a shows the accuracy achieved by the plain DNN model on four bus cases during training. All cases demonstrate high accuracy, indicating
strong training performance across different system complexities. Figure 1b illustrates the detection accuracy of the plain DNN model under no attack. The detection accuracy was validated with similar attack samples on which the model was trained. This will give us a baseline accuracy for further evaluation. 2) Comparison with the State-of-art Defense techniques: Table I compares the performance of various defense techniques against adversarial attacks, using Attack Detection Accuracy, Bias L2 -Norm, and Valid L2 -Norm as metrics. Results indicate that the Adversarial Training technique generally outperforms Plain DNN and Adversarial Distilled methods (avg. distillation temp 20-100) across various bus cases. Specifically, Adversarial Training achieves higher detection accuracies and consistently lower Bias L2 values, indicating a stronger resistance to attacks. However, the Valid L2 values are generally higher for Adversarial Training, suggesting that while it detects attacks more effectively, the intensity of the adversarial perturbations it faces might be greater, possibly due to attackers targeting these more robust defenses more aggressively. Despite moderate improvements, these defenses remain insufficient in CPS settings. Distillation assumes small perturbations, which is ineffective for FDIA, where attackers prioritize stealth over minimality. Adversarial training is computationally intensive and performs poorly against iterative attacks. Detection methods fail because adversarial inputs in FDIA share the same manifold as normal false data, making distribution-based separation unreliable under power system constraints. While zero-padding performs well as our proposed method, its fixed padding strategy can be exploited in whitebox scenarios where the attacker is aware of the zero values, undermining its robustness. 3) Results of the proposed framework: Figure 3 illustrates the accuracy trends of the proposed pseudo-feature padding technique across four standard IEEE bus systems. For each case, the padding size p is varied, and accuracy is evaluated for different numbers of compromised meters x1 . Across all cases, accuracy improves with increasing padding size up to a saturation point, after which marginal drops or fluctuations are observed. Notably, larger systems (e.g., 118-bus and 300-bus) achieve better stability and higher peak accuracy, supporting the scalability of the framework. Figure 4 illustrates the Bias L2 -Norm values as a function of padding size p for all the bus cases under varying compromised meters. As observed, increasing the padding size initially results in a sharp increase in the Bias L2 -Norm, which then stabilizes or fluctuates slightly for larger p. The larger Bias L2 -Norm value indicates the less successful attack examples, meaning better model detection. Similarly, figure 5 illustrates a general trend where smaller values of p tend to result in higher L2 norms, indicating a stronger adversarial impact. As p increases, the injected perturbations are more efficiently neutralized, reflected by reduced Valid L2 -Norm values. Notably, the results suggest the padding strategy limits the transferability of adversarial examples, thus decreasing the effectiveness of the attacks. These findings highlight the role of larger pseudo-feature sets
in enhancing defense robustness by reducing the effective perturbation strength as perceived in the state estimation layer. 4) Computational overhead: Table II compares the computational overhead of different defense methods. While our pseudo-feature framework introduces a pseudo-feature generating step and a padding step that increases training time compared to the plain model, it maintains low inference cost and moderates overall overhead. VI. C ONCLUSION FDIA continues to pose a serious threat to deep learningbased detection frameworks in CPS, like power grids, especially in environments where securing physical-level sensors is infeasible and often dependent on specific hardware configurations. In this paper, we propose a lightweight, modelagnostic defense mechanism that reconstructs (pads) input samples, adding pseudo-features derived from the statistical distribution of less important input features. This strategy introduces padding the inputs with pseudo-features and increases complexity, which significantly reduces the effectiveness of adversarial perturbations without compromising model performance. We validate our framework against strong adversarial attacks across multiple IEEE test systems and demonstrate its robustness, minimal computational overhead, and ease of integration into existing DNN-based FDIA detection pipelines. Our results affirm the potential of pseudo-feature padding as a practical and effective defense solution for real-world CPS applications. R EFERENCES 1 Liu, F. et al., “Masking cyber-attacks on power systems,” IEEE Transactions on Smart Grid, vol. 7, no. 4, pp. 1874–1883, 2016. 2 Yu, P. et al., “Blind false data injection attack using pca approximation method for smart grid,” IEEE Access, vol. 3, pp. 2541–2550, 2015. 3 Rahman, M. A. and Mohsenian-Rad, H., “False data injection attacks with incomplete information against smart power grids,” in 2012 IEEE GLOBECOM. IEEE, 2012, pp. 3153–3158. 4 Goodfellow, I. J., Shlens, J., and Szegedy, C., “Explaining and harnessing adversarial examples,” arXiv preprint arXiv:1412.6572, 2014. 5 Li, J., Yang, Y., Sun, J. S., Tomsovic, K., and Qi, H., “Towards adversarialresilient deep neural networks for false data injection attack detection in power grids,” IEEE Transactions on Power Systems, 2021. 6 Riya, F. F., Hoque, S., Sun, J. S., Li, J., and Qi, H., “Mitigating adversarial effects of false data injection attacks in power grid,” arXiv preprint arXiv:2301.12487, 2023. 7 Liu, Y., Ning, P., and Reiter, M. K., “False data injection attacks against state estimation in electric power grids,” in Proceedings of the 16th ACM conference on Computer and communications security, 2009, pp. 21–32. 8 Kosut, O., Jia, L., Thomas, R., and Tong, L., “Malicious data attacks on the smart grid,” IEEE Transactions on Smart Grid, vol. 2, no. 4, pp. 645–658, December 2011. 9 Kim, J. and Tong, L., “On topology attack of a smart grid: Undetectable attacks and countermeasures,” IEEE Journal on Selected Areas in Communications, vol. 31, no. 7, pp. 1294–1305, July 2013. 10 Rahman, M. and Mohsenian-Rad, H., “False data injection attacks with incomplete information against smart power grids,” in Global Communications Conference (GLOBECOM), 2012 IEEE, December 2012, pp. 3153–3158. 11 Srivastava, A., Morris, T., Ernster, T., Vellaithurai, C., Pan, S., and Adhikari, U., “Modeling cyber-physical vulnerability of the smart grid with incomplete information,” IEEE Transactions on Smart Grid, vol. 4, no. 1, pp. 235–244, March 2013. 12 Yan, J., Tang, Y., Tang, B., He, H., and Sun, Y. L., “Power grid resilience against false data injection attacks,” in Power Energy Society General Meeting, 2016 IEEE, July 2016, accepted.
13 Jiongcong, C., Liang, G., Zexiang, C., Chunchao, H., Yan, X., Fengji, L., and Junhua, Z., “Impact analysis of false data injection attacks on power system static security assessment,” Journal of Modern Power Systems and Clean Energy, vol. 4, no. 3, pp. 496–505, 2016. 14 Tajer, A., “Energy grid state estimation under random and structured bad data,” in Proc. IEEE Sensor Array Multichannel Signal Process. Workshop (SAM), A Coruna, Spain, June 2014, pp. 65–68. 15 Bi, S. and Zhang, Y. J., “Defending mechanisms against false-data injection attacks in the power system state estimation,” in Proc. IEEE GLOBECOM Workshops (GC Wkshps), Houston, TX, USA, December 2011, pp. 1162–1167. 16 Ozay, M., Esnaola, I., Vural, F. T. Y., Kulkarni, S. R., and Poor, H. V., “Machine learning methods for attack detection in the smart grid,” IEEE Transactions on Neural Networks and Learning Systems, vol. 27, no. 8, pp. 1773–1786, 2016. 17 Esmalifalak, M., Liu, L., Nguyen, N., Zheng, R., and Han, Z., “Detecting stealthy false data injection using machine learning in smart grid,” IEEE Systems Journal, 2014. 18 Mohammad, A., Chakhchoukh, Y., Jillepalli, A. A., Tosic, P. T., de Leon, D. C., Sheldon, F. T., and Johnson, B. K., “Detecting stealthy false data injection attacks in power grids using deep learning,” in 2018 14th International Wireless Communications & Mobile Computing Conference (IWCMC). IEEE, 2018, pp. 219–225. 19 JQ, J., Y, H., and VO, L., “Online false data injection attack detection with wavelet transform and deep neural networks,” IEEE Transactions on Industrial Informatics, vol. 14, no. 7, pp. 3271–3280, Apr 2018. 20 Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., and Fergus, R., “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013. 21 Rozsa, A., Rudd, E. M., and Boult, T. E., “Adversarial diversity and hard positive generation,” in Proceedings of the IEEE CVPR Workshops, 2016, pp. 25–32. 22 Kurakin, A., Goodfellow, I., and Bengio, S., “Adversarial machine learning at scale,” arXiv preprint arXiv:1611.01236, 2016. 23 Moosavi-Dezfooli, S.-M., Fawzi, A., and Frossard, P., “Deepfool: a simple and accurate method to fool deep neural networks,” in Proceedings of the IEEE CVPR, 2016, pp. 2574–2582. 24 Papernot, N., McDaniel, P., Wu, X., Jha, S., and Swami, A., “Distillation as a defense to adversarial perturbations against deep neural networks,” in 2016 IEEE Symposium on Security and Privacy (SP). IEEE, 2016, pp. 582–597. 25 Xu, W., Evans, D., and Qi, Y., “Feature squeezing: Detecting adversarial examples in deep neural networks,” arXiv preprint arXiv:1704.01155, 2017. 26 Gu, S. and Rigazio, L., “Towards deep neural network architectures robust to adversarial examples,” arXiv preprint arXiv:1412.5068, 2014. 27 Author, A. and Collaborator, B., “Adaptive fdia detection in cyber-physical systems using deep reinforcement learning,” Journal of Cybersecurity and Resilience, vol. 6, pp. 123–134, 2022. 28 Investigator, C. and Researcher, D., “Detection of false data injection attacks in power systems considering multiple attack modes,” International Journal of Power Grid Defense, vol. 7, pp. 45–59, 2023. 29 Scholar, E. and Expert, F., “Using gans for data balancing in fdia detection systems,” Journal of Advanced Research in Smart Grids, vol. 4, pp. 234– 248, 2022. 30 Breiman, L., “Random forests,” Machine Learning, vol. 45, no. 1, pp. 5–32, 2001. 31 Gregorutti, B., Michel, B., and Saint-Pierre, P., “Correlation and variable importance in random forests,” Statistics and Computing, vol. 27, no. 3, pp. 659–678, 2017. 32 Guyon, I. and Elisseeff, A., “An introduction to variable and feature selection,” Journal of Machine Learning Research, vol. 3, pp. 1157–1182, 2003. 33 Kuhn, M. and Johnson, K., Applied Predictive Modeling. Springer, 2013. 34 Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A., “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017.
Acknowledgment. This work was supported by the US National Science Foundation (NSF) under grant CNS-2038922.