Detecting smart meter false data attacks using hierarchical feature clustering and incentive weighted anomaly detection

Abstract Spot pricing is often suggested as a method of increasing demand‐side flexibility in electrical power load. However, few works have considered the vulnerability of spot pricing to financial fraud via false data injection (FDI) style attacks. The authors consider attacks which aim to alter the consumer load profile to exploit intraday price dips. The authors examine an anomaly detection protocol for cyber‐attacks that seek to leverage spot prices for financial gain. In this way the authors outline a methodology for detecting attacks on industrial load smart meters. The authors first create a feature clustering model of the underlying business, segregated by business type. The authors then use these clusters to create an incentive‐weighted anomaly detection protocol for false data attacks against load profiles. This clustering‐based methodology incorporates both the load profile and spot pricing considerations for the detection of injected load profiles. To reduce false positives, the authors model incentive‐based detection, which includes knowledge of spot prices, into the anomaly tracking, enabling the methodology to account for changes in the load profile which are unlikely to be attacks.