An Investigation of Multi-Pattern Load Altering Attack Detection*

Abstract

Load-altering attack (LAA) is an important class of cyber-physical attacks against demand-side management (DSM) systems. Previous LAA studies mainly target the detection and mitigation of unique LAAs. In this paper, we consider more general LAA types by assuming that attackers can either perform random or goal-oriented LAAs against single or multiple load buses. We first make an exploration of different types of LAAs and the corresponding models, based on which we synthesize compromised power flow data and design a multi-class classification-based detector to distinguish among different LAA patterns.