Detection and Defense Against False Data Injection Attacks for Secure Energy Management in Hybrid Electric Ships

Resilient control and Markov-enhanced hybrid multi-feature intrusion detection for cyber-physical wind farms under SCADA delays and coordinated cyber-attacks

A Markov-enhanced hybrid IDS that integrates physics-based modeling, data-driven anomaly detection, and statistical sequence analysis to secure a two-turbine cyber-physical wind farm, offering an analytically scalable architectural path toward more secure renewable energy infrastructures, while larger-farm empirical validation remains future work.

AI-Driven Secure Load Frequency Control of Renewable Energy and Electric Vehicle Integrated Power Systems

The increasing integration of renewable energy sources (RES) and electric vehicles (EVs) has transformed modern power systems into complex cyber-physical networks. While these advancements enhance sustainability and flexibility, they introduce vulnerabilities to cyber-attacks such as false data injection and denial-of-service attacks. Load Frequency Control (LFC), a critical mechanism for maintaining system stability, is particularly susceptible due to its reliance on communication networks. This paper proposes an AI-based framework for real-time cyber-attack detection and mitigation in LFC systems. The proposed approach integrates a deep learning-based anomaly detection model with an adaptive control strategy to ensure resilient frequency regulation. Simulation results demonstrate improved detection accuracy (96.8%) and reduced frequency deviation compared to conventional methods. The framework effectively balances robustness and computational efficiency, making it suitable for next-generation smart grids.

Distributed adaptive resilient control for AC microgrids against false data injection attacks on state information

In AC microgrids interconnected through a flexible DC system, false data injection attacks (FDIAs) targeting the control process of AC/DC converters may cause state deviations and even loss of synchronization among microgrids. To address these issues, this article proposes a distributed adaptive resilient restoration strategy. First, the FDIA mechanism model is established to characterize the effects of random and unbounded attack signals on distributed control. Second, a distributed secondary voltage and frequency control framework is developed based on consensus theory. The local adaptive compensation mechanism is further incorporated to enable coordinated correction and restoration of the voltage magnitude and frequency of AC microgrids. Finally, case studies are conducted on a multi-terminal AC system interconnected through a flexible DC network. Simulation results demonstrate that the proposed strategy effectively suppresses FDIA-induced state deviations and limits cross-regional disturbance propagation. It also restores voltage and frequency to stable operating conditions in real time, thereby enhancing coordinated stability and cyber resilience under various FDIA scenarios.

Cyber-Resilient Directional Overcurrent Relays in Distribution Systems Under Data Scarcity

A statistically defensible machine learning pipeline for FDIA detection and resilience evaluation in renewable smart grids

False data injection attacks represent a serious cyber-physical security challenge for modern smart grids because falsified measurements can affect state estimation, energy management, and operational decision-making. While various machine learning-based FDIA detection methods have been investigated in literature, many studies report biased results from leakage-prone experiments without rigorous statistical analysis. In this paper, a framework of leakage-safe and physics-informed machine learning for FDIA detection and operational cyber-resilience of renewable smart grids is proposed. The leakage-safe paired normal/attack dataset was constructed using CAISO-derived IEEE 118-bus simulation scenarios integrated with renewable and EMS-related variables. Metadata fields, including scenario ID, sample type, target label, attack severity, and number of attacked buses, were excluded from the model input feature matrix. The framework combines bus-level measurements, grid statistics, physics residual features, and indicators of renewable and EMS and tests Logistic Regression, Random Forest, Extra Trees, HistGradientBoosting, and XGBoost models. The proposed XGBoost model achieved 93.47% accuracy, 93.35% F1-score, 0.9813 ROC-AUC, and 0.9847 PR-AUC on the leakage-safe grouped test set. The repeated grouped split validation indicated good stability with a mean accuracy of 93.81% ± 0.10%. Holm-corrected McNemar tests indicated statistically significant paired-prediction differences between XGBoost and HistGBM, RF, and ET, while the difference between XGBoost and Logistic Regression was not statistically significant. Ablation study, bootstrap confidence intervals, attack severity analysis, and cyber-resilience index provide additional support for evaluation transparency. The results support the feasibility of leakage-safe machine-learning evaluation for FDIA detection under the simulated renewable smart-grid setting.

Hierarchical Sensor-Spoofing Defence Framework for Networked DC Microgrids via Cyber-Physical Coordination

In parallel to the cyber attack that manipulates the reference points of distributed energy resources (DERs) by maliciously accessing the remote monitoring and control system, the vulnerability of voltage/current sensors to electromagnetic interference (EMI) in the physical domain has been widely discussed. Existing research efforts against sensor spoofing attacks can be classified into physical prevention and cyber detection/mitigation. These defence methods each have strengths and weaknesses in balancing cost, security, and performance in a single DER, yet systematic research on their multi-layer efficient coordination across DERs remains limited. Towards this end, this paper proposes a hierarchical framework to detect and mitigate sensor spoofing attacks in networked microgrids (NMGs) via {multi-layer cyber-physical coordination}. It requires only to deploy physical prevention technologies at critical points, i.e., the local points of common coupling (PCC) of MGs, such that cyber detection/mitigation algorithms can be adopted based on the secured sensor readings to counter sensor spoofing attacks in DERs. The framework employs an MG-DER coordinated proactive detection scheme to strategically trigger parameter perturbations, under which the intelligent sensor spoofing attacks can be {effectively} disclosed. Afterwards, mitigation schemes based on MG-DER coordination are activated to recursively and accurately estimate sensor biases. Experiments on a cyber-physical DC NMG testbed confirm the framework's effectiveness across diverse attack scenarios.