Data-driven detection and identification of IoT-enabled load-altering attacks in power grids

Subhash Lakshminarayana, Saurav Sthapit, Hamidreza Jahangir, Carsten Maple, H. Vincent Poor

Research output: Contribution to journalArticlepeer-review

10 Scopus citations


Advances in edge computing are powering the development and deployment of Internet of Things (IoT) systems to provide advanced services and resource efficiency. However, large-scale IoT-based load-altering attacks (LAAs) can seriously impact power grid operations, such as destabilising the grid's control loops. Timely detection and identification of any compromised nodes are essential to minimise the adverse effects of these attacks on power grid operations. In this work, two data-driven algorithms are proposed to detect and identify compromised nodes and the attack parameters of the LAAs. The first method, based on the Sparse Identification of Nonlinear Dynamics approach, adopts a sparse regression framework to identify attack parameters that best describe the observed dynamics. The second method, based on physics-informed neural networks, employs neural networks to infer the attack parameters from the measurements. Both algorithms are presented utilising edge computing for deployment over decentralised architectures. Extensive simulations are performed on IEEE 6-, 14-, and 39-bus systems to verify the effectiveness of the proposed methods. Numerical results confirm that the proposed algorithms outperform existing approaches, such as those based on unscented Kalman filter, support vector machines, and neural networks (NN), and effectively detect and identify locations of attack in a timely manner.

Original languageEnglish (US)
Pages (from-to)203-218
Number of pages16
JournalIET Smart Grid
Issue number3
StatePublished - Jun 2022
Externally publishedYes

All Science Journal Classification (ASJC) codes

  • Information Systems
  • Computer Networks and Communications
  • Electrical and Electronic Engineering


Dive into the research topics of 'Data-driven detection and identification of IoT-enabled load-altering attacks in power grids'. Together they form a unique fingerprint.

Cite this