Machine Learning Methods for Attack Detection in the Smart Grid

Mete Ozay, Iñaki Esnaola, Fatos Tunay Yarman Vural, Sanjeev R. Kulkarni, H. Vincent Poor

Research output: Contribution to journalArticlepeer-review

476 Scopus citations


Attack detection problems in the smart grid are posed as statistical learning problems for different attack scenarios in which the measurements are observed in batch or online settings. In this approach, machine learning algorithms are used to classify measurements as being either secure or attacked. An attack detection framework is provided to exploit any available prior knowledge about the system and surmount constraints arising from the sparse structure of the problem in the proposed approach. Well-known batch and online learning algorithms (supervised and semisupervised) are employed with decision- and feature-level fusion to model the attack detection problem. The relationships between statistical and geometric properties of attack vectors employed in the attack scenarios and learning algorithms are analyzed to detect unobservable attacks using statistical learning methods. The proposed algorithms are examined on various IEEE test systems. Experimental analyses show that machine learning algorithms can detect attacks with performances higher than attack detection algorithms that employ state vector estimation methods in the proposed attack detection framework.

Original languageEnglish (US)
Article number7063894
Pages (from-to)1773-1786
Number of pages14
JournalIEEE Transactions on Neural Networks and Learning Systems
Issue number8
StatePublished - Aug 2016

All Science Journal Classification (ASJC) codes

  • Software
  • Artificial Intelligence
  • Computer Networks and Communications
  • Computer Science Applications


  • Attack detection
  • classification
  • phase transition
  • smart grid security
  • sparse optimization


Dive into the research topics of 'Machine Learning Methods for Attack Detection in the Smart Grid'. Together they form a unique fingerprint.

Cite this