Coupled Defense for Smart Grids: Federated Passive Reconnaissance Detection and Physics-Guided PMU Attack Recovery
Loading...
Date
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Smart grids have evolved into tightly coupled cyber-physical systems exposed to two distinct threat classes: passive reconnaissance, where an adversary silently intercepts communication-layer traffic without injection, and active measurement manipulation, where PMU measurements are deliberately corrupted to distort the perceived system state. This thesis develops cybersecurity solutions for both threats within a coordinated defense framework. On the passive side, it introduces a literature grounded synthetic benchmark for receive-only reconnaissance over a tiered HAN/NAN/WAN smart-grid topology, and builds a federated spatiotemporal graph detector that combines a graph convolutional network with a bidirectional gated recurrent unit (GCN-BiGRU) and is trained via FedProx. This detector identifies weak eavesdropping signatures without centralizing raw telemetry, achieving attack F1-scores of 0.949 and 0.937 at the per-timestep and per-sequence levels, respectively. On the active side, an integrated three-stage pipeline is proposed for the IEEE 68-bus GridSTAGE system. A multiscale topology-aware anomaly detector operating on graph-structured phasor measurement unit (PMU) windows identifies attacks early, with 95.5% of step attacks and 96.0% of poisoning attacks detected within 0.5 seconds of onset. A bus-level localization stage then identifies the spatial support of the disturbance, followed by a physics-guided repair stage that reconstructs corrupted voltage magnitude, voltage angle, and frequency measurements through an alternating weighted least-squares projection enforcing network topology consistency, temporal smoothness, and angle-frequency coupling. This stage achieves mean absolute error improvements of approximately 99% for frequency and 97% for voltage magnitude. Together, these contributions move smart-grid cybersecurity beyond isolated detection toward coordinated, recovery-oriented defense.
Description
Release date : 2027-05-11.