Semi-Supervised Domain-Adversarial Training for Intrusion Detection against False Data Injection in the Smart Grid

The smart grid faces with increasingly sophisticated cyber-physical threats, against which machine learning (ML)-based intrusion detection systems have become a powerful and promising solution to smart grid security monitoring. However, many ML algorithms presume that training and testing data follow the same or similar data distributions, which may not hold in the dynamic time-varying systems like the smart grid. As operating points may change dramatically over time, the resulting data distribution shifts could lead to degraded detection performance and delayed incidence responses. To address this challenge, this paper proposes a semi-supervised framework based on domain-adversarial training to transfer the knowledge of known attack incidences to detect returning threats at different hours and load patterns. Using normal operation data of the ISO New England grids, the proposed framework leverages adversarial training to adapt learned models against new attacks launched at different times of the day. Effectiveness of the proposed detection framework is evaluated against the well-studied false data injection attacks synthesized on the IEEE 30-bus system, and the results demonstrated the superiority of the framework against persistent threats recurring in the highly dynamic smart grid.