This paper studies the load frequency control (LFC) performance of a multi-area power network targeted by false data injection attacks (FDIAs). To this end, a cyberattack-resilient defense strategy consisting of the model and learning-based methods is proposed to improve the network frequency response. A strategy based on comparing the state estimation performed by the model-based observer with a threshold value is used in the presented mechanism to detect attacks. After detecting an attack, an artificial intelligence (AI) observer predicts the control signals and compares them with the observed ones. When there is a significant deviation, an event-trigger strategy blocks the observed signal and sends the predicted signal to the physical network. In the presented strategy, a model-free nonsingular terminal sliding mode control (MFNTSMC) scheme based on the ultra-local model (ULM) principle is also developed as the secondary controller to regulate the network frequency response under FDIAs. Also, a sliding mode observer is designed to estimate the unknown terms related to the ULM. The presented controller improves the finite-time convergence of the system states to the origin and inherits the intrinsic robustness of sliding mode methods. Moreover, it provides high-precision tracking under disturbances and uncertainties. An auxiliary deep policy gradient method with actor and critic neural networks is designed to enhance the controller’s dynamic efficiency. The practical implementation of the suggested strategy is assessed utilizing the Speedgoat-based real-time platform and compared with the other methods under physical limitations and FDIAs.

This paper investigates the load frequency control problem of real power systems equipped with the automatic generation control service under false data injection (FDI) attacks. The available methods either require the exact system model or extensive historical data. Moreover, they cannot distinguish load changes from cyber-attacks. To address these challenges, this paper proposes a model-free defense method comprising an observer and a detector. The observer estimates the targeted signal and compares the difference between the estimated and observed signals as the state estimation error with a predetermined threshold value. When the state estimation error exceeds the threshold value, the detector detects an attack. In this situation, the observer’s output is the state estimation error. This causes the estimated signal to be sent to the secondary controller to mitigate the attack’s effect. If the state estimation error is smaller than the threshold value, no attack has occurred on the system. In such conditions, the observed signal is sent to the secondary controller. The proposed method rebuilds the actual system output in real-time under cyber-attacks. The presented method is independent of the system’s mathematical model and historical data, and it has a simple design procedure. This method can successfully distinguish load changes from FDI attacks. Moreover, it is not dependent on the size and complexity of the power system. The simulation results on the IEEE 14-bus and 39-bus power systems in the DIgSILENT PowerFactory show that the proposed method can timely detect the attacks and completely mitigate the effects of attacks on the system’s dynamic performance. Also, the obtained false alarm and attack detection rates are zero and over 98%, respectively.

Load frequency control (LFC) application in power systems has an essential role in improving the system’s stability. However, the presence of the automatic generation control service incorporated into the LFC application, being a system dependent on communication networks, makes the LFC system susceptible to cyber threats. Falsifying measurement and control signals through communication networks, known as data integrity attacks (DIAs), can severely affect the system’s dynamic performance. This paper studies the frequency regulation issue of an interconnected power system under stealth DIAs. Accordingly, a novel identification scheme consisting of the dynamic multiplicative watermarking technique, an estimator, an anomaly detector, and a trigger mechanism is introduced to identify the DIAs. The watermarking concept is the intentional overlay of a watermark signal onto the source signal transmitted through the communication network. Achieving this requires using a specific watermarking filter, and the result is that operators gain greater flexibility in regulating the transmitted signals, which in turn provides improved signal integrity. In the proposed identification scheme, there is a multiplicative superimposition, where the watermark equalizing filter on the opposite end of the network can cancel out the impact of the watermarking, leading to the retrieval of the original signal. After identifying the attack, the proposed trigger mechanism blocks the manipulated ACE signal and submits the estimated ACE signal to the secondary controller. A model-free sliding mode control method is also implemented as the secondary frequency controller to regulate the system’s frequency under DIAs, load disturbances, and physical limitations. The Speedgoat-based real-time simulation results reveal that the developed defense method can timely identify stealth DIAs and significantly improve the system’s dynamic responses compared to the other techniques under these attacks.