Detection and Mitigation of Cyberattacks Against Power Measurement Channels Using LSTM Neural Networks

In this paper a long short-term memory (LSTM) neural network (NN) is used to detect cyberattacks against power measurement channels. The detection scheme can also mitigate the attack damaging effect on the operation of the receiving energy management system. This can secure more time to finalize the detection decision, which can potentially reduce the false positive detection rate. LSTM NNs have the ability to learn the temporal behavior of a time series through correlating the distinct features in the measurement time series, i.e. the input sequence. The output of the proposed LSTM NN scheme is used to adjust the input sequence in real-time to neutralize the corrupted measurements, while allowing the detection algorithm to continue to examine the next incoming measurements. Hence, the receiving energy management system only sees the corrected signal, which improves the system performance. In contrast to other techniques in the literature that mainly exploit the spatial correlation between the measurement channels, a single series measurement channel is used to examine the LSTM NN detection capability using only the temporal features of the measurement series. Unlike most of the techniques in the literature, this technique does not need labeled data during training. The detection scheme is simulated in the MATLAB software package and tested using five different attack patterns.