Detection and Localization of Load Redistribution Attacks on Large-scale Systems

A nearest-neighbor-based detector against load redistribution attacks is presented. The detector is designed to scale from small-scale to very large-scale systems while guaranteeing consistent detection performance. Extensive testing is performed on a realistic large-scale system to evaluate the performance of the proposed detector against a wide range of attacks, from simple random noise attacks to sophisticated load redistribution attacks. The detection capability is analyzed against different attack parameters to evaluate its sensitivity. A statistical test that leverages the proposed detector is introduced to identify which loads are likely to have been maliciously modified, thus, localizing the attack subgraph. This test is based on ascribing to each load a risk measure (probability of being attacked) and then computing the best posterior likelihood that minimizes log-loss.