# Survey of Load-Altering Attacks Against Power Grids: Attack Impact, Detection and Mitigation

Sajjad Maleki, Shijie Pan, Subhash Lakshminarayana, Charalambos Konstantinou

► To cite this version:

Sajjad Maleki, Shijie Pan, Subhash Lakshminarayana, Charalambos Konstantinou. Survey of Load-Altering Attacks Against Power Grids: Attack Impact, Detection and Mitigation. IEEE Open Access Journal of Power and Energy, 2025, 12, pp.220 - 234. 10.1109/OAJPE.2025.3562052. hal-05534543

HAL Id: hal-05534543

https://hal.science/hal-05534543v1

Submitted on 3 Mar 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>
# Survey of Load-Altering Attacks Against Power Grids: Attack Impact, Detection and Mitigation

Sajjad Maleki*, Student Member, IEEE, Shijie Pan*, Student Member, IEEE, Subhash Lakshminarayana Senior Member, IEEE, Charalambos Konstantinou Senior Member, IEEE

**Abstract**—The growing penetration of IoT devices in power grids despite its benefits, raises cybersecurity concerns. In particular, load-altering attacks (LAAs) targeting high-wattage IoT-controllable load devices pose serious risks to grid stability and disrupt electricity markets. This paper provides a comprehensive review of LAAs, highlighting the threat model, analyzing their impact on transmission and distribution networks, and the electricity market dynamics. We also review the detection and localization schemes for LAAs that employ either model-based or data-driven approaches, with some hybrid methods combining the strengths of both. Additionally, mitigation techniques are examined, focusing on both preventive measures, designed to thwart attack execution, and reactive methods, which aim to optimize responses to ongoing attacks. We look into the application of each study and highlight potential streams for future research.

**Index Terms**—Load-altering attacks, impact analysis, detection, localization, attack mitigation, survey.

## I. INTRODUCTION

Power grids are witnessing a rapid proliferation of smart energy appliances, such as smart electric vehicle charging stations (EVCS) and smart heat pumps. The connectivity features of these devices can be used to schedule their usage, hence offering demand flexibility (DF). For instance, in the United Kingdom (UK), the government is backing the expansion of public EV charging infrastructure to reach 300k public chargers by 2030 with an investment totaling £1.6b [1], while the capital of Saudi Arabia, Riyadh, targets towards rising the EV fleet to over 1m by 2030 [2].

However, these IoT-enabled appliances can become a serious source of security vulnerability to target the power grid. Several security issues, such as insecure authentication, lack of firmware security upgrades, etc., have already been discovered in these devices (see Section II for a detailed discussion). Overall, they can be particularly attractive targets for malicious actors due to the following factors: (i) the security standards for these devices are still in their infancy, and there is a lack of a unified approach for securing them; (ii) they are typically manufactured and installed by third parties, who may typically ignore security features/recommendations due to cost considerations; (iii) the power grid operator does not have direct control over these devices; (iv) they are operated by end-user customers who may lack security awareness.

S. Maleki is with the School of Engineering, University of Warwick, CV47AL, UK and ETIS UMR 8051, CY Cergy Paris Université, ENSEA, CNRS, F-95000, Cergy, France.

S. Lakshminarayana is with the School of Engineering, University of Warwick, Coventry, UK, CV47AL.

S. Pan and C. Konstantinou are with the Computer, Electrical and Mathematical Sciences and Engineering Division, King Abdullah University of Science and Technology, Thuwal 23955, Saudi Arabia.

<figure><img src="image_2.png" /><figcaption>Fig. 1: TV Pickup effect observed in UK power grid [8].</figcaption></figure>

<figure><img src="image_3.png" /><figcaption>Fig. 2: The concept of load-altering attacks (LAAs) and the discussed topics within this survey paper.</figcaption></figure>

One major threat emerging from these vulnerabilities is the concept of load-altering attacks (LAAs) [3]. LAAs exploit insecure, high-wattage IoT-enabled devices, such as EVCS, smart thermostats, and industrial loads, to manipulate power consumption on a large scale. By coordinating synchronized load changes, attackers can disrupt the power grid's frequency stability, induce voltage fluctuations, and, in extreme cases, cause cascading failures or blackouts. Unlike traditional cyberattacks targeting SCADA systems or distributed energy resources (DERs), LAAs manipulate end-user loads directly, which makes them harder to detect and mitigate.

The threats go beyond mere theoretical constructs. Real-world cyberattacks involving smart appliances have already been witnessed. For instance, an EVCS was hacked to display inappropriate images [4]. There have also been reports of compromising and disabling of EVCS near the Moscow region and hackers using their displays to show political messages [5]. In the UK, EV chargers from a specific vendor were pulled out of the market due to inadequate cybersecurity features in its design, with the concern that the chargers can be exploited as a means to target the power grid [6]. In December 2023, a US court-authorized operation thwarted a botnet attack targeting several small office/home office routers against a “campaign to target critical infrastructure organizations in the US” [7].

The focus of this work is large-scale compromises, such as a botnet attack targeting a large number of IoT-load devices i.e., LAAs. A popular instance is the Mirai botnet attack which at its peak targeted 600k IoT devices. A real-world illustration of synchronously turning ON/OFF a large number

<footnote>*Equal contribution. Author ordering determined by coin flip.</footnote>
of consumer electrical appliances can be observed during
the so-called “TV Pickup effect” experienced by the UK’s
power grid [8]. It refers to large-scale load surges or drops in
the load during popular football matches. During half-time
and full-time breaks, it has been observed that customers
synchronously turn on electric kettles or open their fridge
doors, the aggregate effect of which resulted in several GW of
load change, as illustrated in Fig. 1. If such events occur due
to a cyber attack, they will remain unanticipated, resulting
in grid stability risks. Table I represents a list of known
common vulnerabilities and exposures (CVE) which provide
entry points for adversaries to execute such attacks.

A. Difference From Existing Works

The topic of power grid security has attracted significant
interest from the research community in the last decade and
several survey papers have been written on this topic [9]–
[13]. A vast majority of the works focus on cyberattacks
against the power grid’s supervisory control and data acqui-
sition (SCADA) system. Notable examples include false data
injection attacks (FDI), denial of service (DoS) or time delay
attacks targeting the data communicated between power grid
sensors and the control centers, physical attacks that alter
the power grid topology (e.g., remotely opening transmission
line circuit breakers), coordinated data and physical attacks,
time synchronization attacks against phasor measurement units
(PMUs), etc. The power grid industry and policymakers have
taken note of these threats and developed security solutions
to counter them and already paved their way to form reg-
ulations/standards, such as the IEC 62351 standard which
provides security recommendations for the IEC 61850 protocol
[14]. Furthermore, in the research literature, several cyber-
physical defense solutions are proposed in existing papers,
such as strategic protection of sensors to prevent undetectable
attacks [15], machine learning (ML)-based approaches to de-
tect cyberattacks [12], and moving target defense to invalidate
attacker’s knowledge of the target system and thus making the
attacks detectable [16].

While the papers discussed before address the threats
against the bulk power grid and centralized generations and
their control loops [17]–[19]. However, with the high integra-
tion of the DER in the grids and the vulnerability of these
resources against cyberattacks, recent works have turned their
attention to studying attacks on distributed and decentralized
generations (similar to LAAs which are attacks on edge
devices which are scattered all over the grid). In [20]–[23],
the main focus is on cyberattacks targeting DERs and their
components. Reference [20] surveys the security of DERs
in both cyber and physical layers and covers the attacks
targeting DERs and their communication means while [21]
discusses vulnerabilities and cyber-resiliency of DER-based
grids. Furthermore, [22] makes a comprehensive overview on
attacks on photovoltaic systems and their mitigation methods.
The work in [23] provides an extensive survey of existing
studies on the cybersecurity of smart inverters of DERs.
Overall, these works primarily address threats that affect DER
operations, such as manipulating DER protocols or exploiting
inverter-level weaknesses to disrupt generation or storage ca-
pabilities. Unlike DER-based attacks that target the generation

and storage aspects of power systems, LAAs manipulate the
load directly through IoT-enabled smart appliances, disrupting
the balance between power supply and demand.

While DER-based attacks compromise the integrity and
control of distributed resources, LAAs exploit vulnerabilities
in consumer-side appliances, leading to fluctuations in grid
stability and potentially causing frequency deviations and
cascading failures. This distinction underscores the need for
dedicated research on LAAs, as they pose unique threats by
targeting end-user devices. To the best of our knowledge, this
work is the first comprehensive review of LAAs against power
grids.

A few recent survey papers have investigated cyber threats
from end-user devices. For instance, [24] surveys the privacy
of smart meters. However, according to the lack of a com-
prehensive review paper specifically focusing on LAAs, this
survey paper is dedicated to LAAs, targeting the end-user
smart energy appliances that are installed at the customer end
as depicted in Fig. 2.

To summarize, the contributions of this paper are as follows:

* We provide a comprehensive survey of risks due to LAAs, highlighting the threat modeling and analyzing the impact of LAAs on power grid operations as well as the impact on energy markets.

* We present a review of existing mechanisms to detect and localize LAAs, including model-based, data-driven, as well as hybrid methods.

* We provide an extensive overview of works on how to mitigate and recover from LAAs, including preventive and reactive mitigation schemes.

* Finally, we conclude the survey by presenting an overview of the future research directions in this field.

The rest of the paper is organized as follows: Section II discusses the threat modeling, Section III surveys the impact of the attack followed by studying attack detection and localization frameworks in Section IV. Section V presents the mitigation methods for LAAs and eventually, Section VI remarks on the future research and concludes the paper.

II. THREAT MODELING

Direct system-end attacks targeting the assets in the SCADA
system are the most prevalent form of cyber threats (such as
those noted in Section I). Conversely, the deployment of DERs
at the consumer level along with the large-scale deployment
of high-wattage IoT devices introduces new vulnerabilities,
enabling adversaries to orchestrate and execute remote cy-
berattacks. For instance, DERs leverage IoT technology to
synchronize their operational controls with power systems.
Notably, devices such as smart inverters are particularly prone
to cyber-threats. When compromised, these devices can inter-
fere with the functioning of the grid, disrupt the delivery of
electricity, and potentially destabilize the entire grid [25]–[27].

Unlike traditional power generation facilities, DERs are
managed by end-users and aggregators, limiting utility com-
panies’ control over electricity production. The IoT interfaces
utilized by these DERs and other high-wattage consumer
equipment are particularly vulnerable to cyberattacks due
to their complex supply chains and limited resources. Such
<table><caption>TABLE I: A list of known Common Vulnerabilities and Exposures (CVEs) related to potential LAA threats.</caption><thead><tr><th>High Wattage Device</th><th>Common Vulnerabilities and Exposures</th><th>Description</th></tr></thead><tbody><tr><td rowspan="2">EV charger</td><td>CVE-2022-0878</td><td>"Brokenwire" attack: disrupt EVCS by interfering communication between EVs and chargers.</td></tr><tr><td>CVE-2021-22774</td><td>Requiring the possibility of accessing knowledge about the charging station user account.</td></tr><tr><td rowspan="4">Air conditioner</td><td>CVE-2021-20595</td><td>Allows unauthenticated attackers to disclose the data or cause a DoS via sending crafted packets.</td></tr><tr><td>CVE-2022-24296</td><td>Provides the possibility of encrypted messages revealing to unauthorized entities.</td></tr><tr><td>CVE-2022-33322</td><td>A distant attacker can launch a script in the users' interface to expose secure data.</td></tr><tr><td>CVE-2021-20593</td><td>An exposure which enables the attacker to uncover and manipulate device configurations.</td></tr><tr><td>Heat pump</td><td>CVE-2024-22894</td><td>Provide the possibility of launching arbitrary codes for the attacker.</td></tr><tr><td rowspan="2">Inverter</td><td>CVE-2023-0808</td><td>An issue in the access point setting handler component, where manipulation of input could result in the use of a hard-coded password, potentially enabling attacks on the physical device.</td></tr><tr><td>CVE-2023-39169</td><td>Impacted devices utilize publicly-available default credentials granting administrative privileges.</td></tr><tr><td>LED TV</td><td>CVE-2023-4614</td><td>Remote attackers can execute a code on impacted installations without authentication.</td></tr></tbody></table>

vulnerabilities make them prime targets for various cyber threats. For instance, insecure remote login credentials can be leveraged to spread malware like the Mirai botnet [28]. Additionally, the process of updating firmware presents another risk for introducing malicious software [29]. Furthermore, Ghost domain name system (DNS) attacks pose a significant threat as they can redirect IoT devices to harmful DNS servers [30]. The security of electricity consumers and DERs is also compromised by the frequent use of default or weak passwords, leading to an increased risk of cyberattacks.

This paper examines the threat landscape of indirect consumer-level cyberattacks on the power system via load alternation. Such attacks are possible because DER-based inverters and IoT-based high-wattage devices have communication and control interfaces which lack the advanced cyber-defense and can be exploited with the malicious intent to destabilize the grid. Many attack vectors use a multi-layer threat model by leveraging the complexity and interconnections within the power grid. As shown in previous works [31]–[33], attacks can target one or multiple layers of the IoT-connected appliances and DERs. Adversaries may opt to infiltrate any part of the supply chain to inject stealthy trojans (i.e., malicious and deliberate modifications, consisting of a multi-layer model of attack vectors aiming to compromise, control, modify, or disable the system or leak sensitive information) into the IoT firmware/software. The attacks can be either physical (i.e., access required to extract device code) or network-based (e.g., remote over-the-air manipulation). LAAs emphasize the cross-layer propagation of such attacks which can cause significant load alteration.

## A. Attacker Model

Using IoT-related vulnerabilities, an attacker would aim to modify control and operation actions of IoT-load devices under normal conditions to actions that would harm DERs and/or distribution and transmission systems. Following this modification, the production and consumption of each DER/IoT-load are changed and, as a result, the power demand at those nodes changes. Using this mechanism, the attacker will aim to coordinate actions of compromised devices in the system to maximize the potential damage. The attack model of LAAs assumes that the attacker possesses some, but not necessarily exact, knowledge of the system design (to drive the system conditions into activating specific protection and control actions) e.g., topology, parameters of lines, buses, generators, etc, which can be obtained from publicly available

datasets (e.g., [34]–[37]), while further details can be inferred with a high accuracy [38], [39].

First, the knowledge of network topology, line parameters, bus data, generator configurations, and EVCSs can be deduced from publicly available datasets [36]. Examples include collecting locations and power ratings of EVCSs, real-time and historical usage data from EV smartphone applications, locations of generators, transmission lines, transmission substations, and their capacity from public repositories such as the U.S. Energy Information Administration, and real-time generation and demands from NYISO datasets [36]. However, some specifications like the length of lines are estimated, and may not reflect the true values. Using such gathered intelligence, [40] design an (EV-oriented) LAA which constructs the attack vector based on the grid's frequency only and still causes a destructive impact.

Secondly, topology identification methods allow attackers to deduce network structures based on observable measurements in both transmission and distribution networks [41], [42]. Specifically, in distribution networks, an attacker can deduce the network topology by accessing the nodal voltage measurements and applying signal processing/machine learning (ML) techniques such as deep neural network [43], linear discriminant analysis and regularized diagonal quadratic discriminant analysis [41], generative adversarial networks [44], and recursive grouping algorithms [45]. As distribution grids are sparsely monitored, attackers can also use measurements from advanced metering infrastructure (AMI) to derive the network topology [46], [47]. Similar signal processing/ML-based approaches can also be used to deduce the topology of transmission networks [42], [48].

Existing literature often formalizes the attack model of LAAs by co-optimizing it with the distribution system operations as given in and adopting a common cybersecurity practice, which is to conservatively assume a strong (omniscient) attacker and a weak (naive) defender (e.g., DSO) [49]–[51]. Accordingly, the omniscient attacker has full knowledge of the system, while the naive defender has no detection or defense mechanisms to respond. These assumptions lead to assessing the worst-case impact of the attack. The omniscient attacker can pursue instant and lasting effects on the power system and DERs, given oracular knowledge of the system conditions. The attacker objective can encompass: (i) reducing efficiency of DSO operations by reducing the energy and cost performance of the system, (ii) equipment damages and failures by incurring additional wear-and-tear due to violating operation limits on
equipment and intelligently triggering relay protection to cause
load shedding and blackouts, (iii) stressing the system during
extreme events (e.g., natural disasters or peak conditions) to
increase the likelihood of equipment failures.

The model considered in the works above analyzes the
worst-case impact of cyberattacks, i.e., under the assumption
of the omniscient attacker and naive defender. In practice, it is
unrealistic that an attacker can monitor every aspect of DER or
power system operation. Therefore, it is realistic to account for
the attacker's limited knowledge of actions of uncompromised
DERs and IoT-loads, and the DSO, which prevents the attacker
from precisely estimating attack impacts on the grid and from
incurring the theoretical maximum damage. The attacker's
limited knowledge (constraints) can be considered in various
manners, including:

(i) *Statistical modeling of uncompromised DERs/IoTs*: using open-source data sets, e.g., Pecan Street [52] or Tracebase data repositories [53], the attacker can construct a statistical model to describe the behavior of uncompromised devices. These repositories have sufficient data to estimate the mean and standard deviation, which can be used to parameterize the uncompromised devices via the Gaussian distribution, or more complex statistical models (e.g., to account for temporal and spatial correlations [54]). Under such statistical models, the threat model of LAAs can be reformulated into different instances of computationally tractable robust optimization models, which can be used to formalize and compare different attack objectives under various statistical assumptions, i.e., quantify realistic rather than the worst-case attack effects.

(ii) *Adversarial Modeling of the Response*: Building on statistical models, one can consider an adversarial behavior against the DSO, which renders a game-theoretic formulation for DSO-attacker interactions. This adversarial modeling can provide a realistic rather than naive grid response and can be implemented in a static or dynamic manner, where the attacker fully or partially observes the system response and modifies the attack accordingly [55]. This can determine the existence, uniqueness, and properties of the equilibrium for single/multi-stage (sequential) games using computationally scalable algorithmic game theory [56], [57].

(iii) *Learning for Partial System Observability*: The statistical and adversarial models described above, can be supported by considering the limited observability of the system by the attacker (e.g., it can only partially observe power flows, voltages, and other system parameters). In this case, the attacker's problem can be formulated via reinforcement learning (RL), where the observed nodal parameters are the environmental states and the attack damage is the reward. Using such RL frameworks can lead to continuous learning, instead of the omniscient attacker, in a multi-stage adversarial game.

## B. Attack Types

Table II categorizes LAAs based on four key criteria: feedback type, attack scope, control mechanism, and targeted system. This classification provides insight into the diverse strategies used by adversaries and their impact on grid stability and energy markets. The feedback type distinguishes between static LAAs, e.g., [63]–[67], where load modifications occur

at fixed intervals without real-time monitoring, and dynamic
LAAs, e.g., [69]–[71], where attackers adjust their actions
based on system response, making detection more challenging.
The attack scope differentiates between localized attacks,
which affect specific buses or feeders, and multi-area attacks,
which manipulate loads across multiple regions, potentially
causing widespread grid instability. The control mechanism
is classified into informed-knowledge attacks, where adver-
saries have detailed grid parameters, and limited-knowledge
attacks, where attackers rely on partial system insights, such
as frequency measurements [40]. Finally, the targeted system
classification highlights the different objectives of LAAs,
including destabilizing the transmission grid by inducing
frequency deviations and cascading failures, e.g., [69]–[71],
disrupting the distribution grid through voltage instability and
demand response manipulation [62], [72], [76], and exploiting
energy markets by artificially inflating or deflating demand for
financial gain [58], [73]–[75]. This classification framework
underscores the multifaceted nature of LAAs, providing a
deeper understanding of their potential impact on grid opera-
tions and market dynamics.

In conclusion, vulnerabilities of IoT-enabled load devices
are exacerbated due to complex supply chains and limited
security in consumer devices, allowing attackers to launch so-
phisticated and multi-layered LAAs. The attacker can leverage
partial system knowledge to modify control actions of IoT and
DER devices, potentially destabilizing the grid. Realistically,
the attacker's knowledge is constrained, making statistical,
adversarial, and RL models relevant for capturing the nuanced
threat dynamics. These models highlight that, despite the
limitations in system knowledge, attackers can still inflict
significant harm by exploiting communication and control
inter interfaces in IoT-connected devices, thereby requiring robust
cybersecurity measures at both the consumer and grid levels.

## III. ATTACK IMPACT ANALYSIS

### A. Impact on Power Grid Operation and Stability

Understanding the impact of LAAs on grid operations and
identifying the most disruptive attack points are crucial for
risk analysis. Table III summarizes the existing studies on this
topic. This table highlights the models studied, and the attack
impacts considered in each work.

1) *Mechanism of Grid Operations:* An unforeseen load surge or drop can cause frequency deviations. The primary frequency response, provided by the system's inertia and fast-acting technologies like battery storage, compensates for these deviations in the first few seconds of an incident. Secondary and tertiary frequency responses are additional components of frequency control schemes that operate more slowly and are supported by resources like automatic generation control (AGC), spinning reserves, mobile batteries, and off-grid DERs. In distribution systems, such load changes can result in voltage constraint violations. To mitigate this, devices such as shunt capacitors, batteries, flexible AC transmission system (FACTS) devices like soft open points (SOPs), circuit breakers, and DERs can be deployed. During LAAs, the adversary forces sudden, unexpected load changes, potentially disrupting either or both of the discussed equilibria.
<table><caption>TABLE II: Classification of LAAs.</caption><thead><tr><th>Criterion</th><th>Category</th><th>Description</th><th>Works</th></tr></thead><tbody><tr><td rowspan="2">Attack Scope</td><td>Localized</td><td>Attacks are designed to specifically target and disrupt a particular region, bus, or feeder within the power grid.</td><td>[36], [58]–[63]</td></tr><tr><td>Multi-area</td><td>Attacks are designed to compromise and manipulate loads across multiple locations.</td><td>[3], [27], [64]–[76]</td></tr><tr><td rowspan="2">Feedback Type</td><td>Static LAAs</td><td>Attackers alter loads once or at fixed intervals without real-time monitoring of grid response.</td><td>[3], [27], [36], [61]–[69], [72], [76]</td></tr><tr><td>Dynamic LAAs</td><td>Attackers continuously adjust loads in response to system conditions that can be measured</td><td>[60], [67]–[71]</td></tr><tr><td rowspan="2">Control Mechanism</td><td>Informed-Knowledge</td><td>Attackers possess detailed grid parameters, including load profiles, grid topologies, or system responses.</td><td>[3], [27], [36], [58]–[76]</td></tr><tr><td>Limited-Knowledge</td><td>Attackers have partial or estimated knowledge of the power system, (e.g., frequency measurements).</td><td>[40]</td></tr><tr><td rowspan="3">Targeted System</td><td>Transmission Grid</td><td>Attacks aim to destabilize grid frequency or induce cascading failures in the transmission grid.</td><td>[3], [27], [36], [59]–[61], [63]–[71], [77]</td></tr><tr><td>Distribution Grid</td><td>Attacks cause localized voltage instability or disrupt demand response programs in the distribution grid.</td><td>[62], [72], [76]</td></tr><tr><td>Energy Markets</td><td>Attacks manipulate the energy market by artificially inflating or deflating demand for financial gain.</td><td>[58], [73]–[75]</td></tr></tbody></table>

2) LAA Impact: To the best of our knowledge, the concept of LAAs was first introduced in [3]. The impact of sudden and large-scale load manipulations, referred to as static LAAs, on transmission systems was first studied using simulation-based approaches. Studies [65] and [68] demonstrated that static LAAs can disrupt the equilibrium between generation and demand, resulting in frequency safety violations. A sudden increase in demand forces the grid operator to rely on primary generator response, potentially leading to increased line power flows. Since the operator lacks control over power flow during the primary response stage, excessive power flows could cause line outages or even cascading failures. Additionally, LAAs can affect steady-state metrics such as operational costs, as operators must activate more expensive ancillary services to manage increased demand.

Not only can attacks on transmission grids cause disruption in them, but also the damage of a well-crafted LAA on the distribution system can be propagated into the transmission grid. According to [78], a naive LAA on the distribution level does not consider the settings of the circuit breaker connecting the distribution system to the transmission grid. As a result, these attacks may trigger the circuit breaker and stop the propagation of the attack impact to the transmission level. However, in an LAA with an insidious strategy, the attacker accounts for the circuit breakers' settings and confines the resulting additional active and reactive power to stop activating the circuit breaker. This results in the propagation of the attack impact in the connected upstream transmission grid.

While early studies provided valuable insights, they overlooked the impact of inherent protection measures in power systems. To address this, [61] analyzed the effects of LAAs considering protections like relays, load shedding, and N − 1 scheduling. This realistic assessment showed that despite these protections, sudden load increases could still cause outages by triggering under-frequency load shedding or forcing islanded operation. However, these measures can prevent large-scale cascading failures, highlighting trade-offs in system protection.

Recent studies have also explored how system conditions, particularly low-load and low-inertia circumstances, influence the impact of LAAs. For instance, [66] analyzed load consumption patterns across seven U.S. cities during the COVID-19 pandemic and demonstrated that LAAs targeting regions

with high load proportions have the most severe impact on frequency stability. Motivated by these findings, [27] explored the heightened vulnerability of power grids under low inertia conditions, such as those seen during the pandemic, where errors in RES forecasting can exacerbate the effects of LAAs. Their results showed that under these conditions, attackers can destabilize the system more easily, as low inertia leads to larger frequency swings which further complicates grid management for operators.

While static LAAs are concerning, dynamic LAAs (DLAAs) represent a more sophisticated and potentially more impactful form of attack. In a DLAA, an attacker repeatedly alters loads in an oscillatory manner, guided by the feedback signals from the grid. One variant, as proposed by [60], involves load changes proportional to the local frequency deviation from its nominal value, thus exacerbating the load-generation imbalance strategically. However, continuous load changes can be difficult to implement in practice. Alternately, [59] and [77] explored DLAAs where load devices are switched on and off in synchronization with inter-area oscillatory frequencies, effectively exciting oscillations and driving the system toward instability.

To further analyze both static and dynamic LAAs, [64] developed an analytical framework leveraging second-order dynamical system theory. Their study derived eigenvalue sensitivities of the grid's frequency control loop and proposed a method to identify the nodes from which the attacker could launch the most efficient DLAAs. However, many of these works focus on specific LAA scenarios, such as LAAs of defined magnitudes at specific nodes. To address the broader landscape of potential attacks, [63], [67], and [69] employed rare-event sampling techniques to evaluate the impact of LAAs across various combinations of nodes and load magnitudes. Their findings emphasize that DLAAs occurring at discrete intervals, in combination with existing protection measures, can still lead to cascading failures, rendering dynamic LAAs more disruptive than static ones.

Another emerging focus is on LAAs targeting EVCS. The work in [36] demonstrated that destabilizing EVCS-based LAAs can be executed using publicly available data, such as EVCS locations and grid demand datasets. It proposed a data-driven load manipulation strategy that shifts system
eigenvalues to a vulnerable region defined by NERC standards, without requiring real-time grid monitoring, unlike previous works [60], [79]–[81]. Sayed et al. [82] conducted a case study highlighting the significant impact of EVCS-based LAAs due to high reactive power demand compared to residential loads. [71] examined coordinated DLAAs using distributed EVCS, factoring in communication delays and countering transient energy-based methods. Their robust optimization strategy maximized attack impact by coordinating multiple EVCS nodes. [83] explored vulnerabilities in mobile apps controlling EV charging, showing through real-time testbed simulations that inadequate vehicle authentication allows remote attackers to manipulate charging operations and launch attacks.

While most papers has focused on LAAs targeting transmission networks, recent work has begun to address their impact on distribution networks. The authors in [76] identified issues like low voltage and line overloads in distribution networks due to LAAs and suggested soft open points as a mitigation strategy (discussed in Section V). Maleki et al. [62] introduced an analytical framework with closed-form expressions to quantify LAA impacts, showing that attacks at downstream nodes (e.g., leaf nodes) are most effective, and highlighted the role of voltage-dependent loads (using the ZIP model). [72] investigated the voltage profile effects of EVCS-based LAAs on distribution networks. Additionally, [78] studied the joint impact on T&D networks using a bi-level optimization model, linking attack impact to IoT penetration and strategies, and noted key metrics like energy not served and increased costs, emphasizing the need to understand T&D interplay for effective LAA risk mitigation.

## B. Impact on Energy Markets

Grid stability can be severely impacted when attackers compromise a large number of loads, resulting in significant frequency deviations and voltage fluctuations that may lead to cascading failures or blackouts. However, the risks posed by LAAs extend beyond grid performance. In addition to disrupting grid operations, LAAs can also be leveraged for economic manipulation, which has emerged as a growing concern [84]–[86]. The energy market, being a central component of financial transactions within the power system, is inherently vulnerable to exploitation by LAAs. By compromising and intentionally manipulating the demand and supply of critical loads, attackers can rapidly alter the supply-demand balance, triggering dramatic price swings and seeking economic profits.

1) *Mechanism of Energy Market:* The energy market functions as a competitive platform where electricity generators offer their production to meet demand, while electric utilities and other market participants purchase electricity through real-time and day-ahead markets. In the day-ahead market, participants submit bids during the day-ahead bid period, followed by market clearing, where bids are processed, and energy schedules are set [87]. In the intra-day market, participants refine their bids and adjust their positions in response to updated information. The real-time market focuses on real-time flexibility bids, allowing providers to adjust supply and demand [88]. It balances the gaps between day-ahead commitments and the real-time electricity supply and demand in

real time, which ensures grid stability by aligning supply with real-time demand.

Electricity pricing is a fundamental aspect of energy markets. Common pricing schemes include flat pricing, time-of-use (ToU) pricing, and real-time pricing (RTP). While flat pricing sets a constant price throughout the day, ToU pricing categorizes the day into different time periods, each with a specific price that is predetermined and announced before the operation begins [89]. In contrast, RTP adjusts electricity costs based on actual market conditions in real-time, typically on an hourly or sub-hourly basis, reflecting fluctuations in supply and demand. This approach factors in grid conditions, resource availability, and consumption changes. By exposing consumers to real-time price variations, RTP promotes flexible consumption behaviors, which enhances load management and grid stability. It is especially beneficial with the integration of RES, as it aligns consumption with periods of high generation or lower demand, ensuring efficient grid use [90].

2) *LAAs to Disrupt the Energy Market Operation:* Real-time electricity prices in energy markets are closely tied to system load demands [91], making them susceptible to manipulation through LAAs. By compromising large-scale loads, attackers can influence prices or disrupt the market [58], [73]–[75]. Understanding the impact of LAAs on the energy markets is crucial, as several studies demonstrate the feasibility of such attacks. Table IV summarizes existing research, which is further discussed below.

The manipulation of market via IoT (MaMIoT) attack, introduced in [75], leverages LAAs on high-wattage IoT botnets to affect the electricity prices in the energy market. An optimization model is proposed to solve for a stealthy and repeatable LAA, which maximizes the attack's impact. By increasing the power demand of the compromised devices, the RTPs can be intentionally increased, which in turn enables power generation utilities to gain more benefits. Results demonstrate that even with a small number of controllable bots, the attacker can significantly increase their profits while inflicting substantial financial losses on other market participants.

The authors in [73] studied how LAAs affect locational marginal prices (LMPs) in distribution systems, showing that LAAs can propagate from targeted distribution systems through the transmission system to neighboring areas. Their findings reveal that LAAs at specific loads can substantially raise electricity prices locally. Moreover, energy storage system (ESS) owners can leverage LAAs to create high-loading conditions, enabling them to sell energy at inflated prices for profit. Similarly, Barreto et al. [74] examined demand response vulnerabilities, identifying two attacker types: malicious actors aiming to damage grid equipment and selfish attackers seeking profit. Results indicate that exploiting direct load control can significantly boost attacker profits.

The work in [58] investigated the charging manipulation attacks (CMAs) against EV charging, which aims to shift the EV aggregator's demand to different periods of the day. The study delved into the impact of CMAs on aggregators' profit and performance in the day-ahead markets and real-time markets by modeling their participation in both markets. Results show that the CMAs can lead to a considerable
<table><caption>TABLE III: Overview of the existing works on the impact of LAA on power grid operation and stability.</caption><thead><tr><th></th><th>Ref</th><th>Model studied</th><th>Study type</th><th>Attack type</th><th>Analyzed impact</th></tr></thead><tbody><tr><td rowspan="10">Transmission</td><td>[3], [27], [64]</td><td>2<sup>nd</sup> order model- DC PF</td><td>Analytical</td><td>Static</td><td>Frequency instability</td></tr><tr><td>[60], [70], [71]</td><td>2<sup>nd</sup> order model- DC PF</td><td>Analytical</td><td>Dyn. - Cont. load change</td><td>Frequency instability</td></tr><tr><td>[65]</td><td>MATPOWER and PowerWorld</td><td>Simulation-based</td><td>Static</td><td>Freq. Instability, Line Failures, Inc. Op. Costs</td></tr><tr><td>[61]</td><td>PowerWorld + (N - 1) constr.</td><td>Simulation-based</td><td>Static</td><td>Freq. instab., Line overloads</td></tr><tr><td>[66]</td><td>Dyn. mode decomposition</td><td>Simulation-based</td><td>Static</td><td>Frequency instability</td></tr><tr><td>[68]</td><td>2<sup>nd</sup> order model</td><td>Simulation-based</td><td>Static+Dyn. - Cont. load change</td><td>Frequency instability</td></tr><tr><td>[63]</td><td>3<sup>rd</sup> order model</td><td>Simulation-based</td><td>Static</td><td>Load/gen. shedding, Line disc.</td></tr><tr><td>[69]</td><td>3<sup>rd</sup> order model + (N - 1) constr.</td><td>Simulation-based</td><td>Static+Dyn. - Discr. load change</td><td>Load/gen. shedding, Line disc.</td></tr><tr><td>[67]</td><td>3<sup>rd</sup> order model + (N - 1) constr.</td><td>Simulation-based</td><td>Static+Dyn. - Discr. load change</td><td>Load/generation shedding, Line disc., Cascading failure</td></tr><tr><td rowspan="7">Dist.</td><td>[36]</td><td>1<sup>st</sup> order model - DC PF approx.</td><td>Analytical</td><td>Static</td><td>Frequency instability</td></tr><tr><td>[59]</td><td>1<sup>st</sup> order model - DC PF approx.</td><td>Analytical</td><td>Inter-area switching</td><td>Frequency instability</td></tr><tr><td>[77]</td><td>1<sup>st</sup> order model - DC PF approx.</td><td>Analytical</td><td>Inter-area switching</td><td>Load shedding</td></tr><tr><td>[76]</td><td>Distflow</td><td>Analytical</td><td>Static</td><td>Voltage constr. violation</td></tr><tr><td>[62]</td><td>Lindistflow</td><td>Analytical</td><td>Static</td><td>Voltage constr. violation</td></tr><tr><td>[72]</td><td>MATPOWER model</td><td>Simulation-based</td><td>Static</td><td>Voltage constr. violation</td></tr><tr><td>T&D</td><td>[78]</td><td>Coordinated T&D model</td><td>Simulation-based</td><td>Static</td><td>Socio-economic impacts</td></tr></tbody></table>

<table><caption>TABLE IV: Literature of LAAs effect in energy market operations.</caption><thead><tr><th>Target Market</th><th>Ref</th><th>Target Devices</th></tr></thead><tbody><tr><td rowspan="2">Real-time market</td><td>[73]</td><td>MV/LV Loads</td></tr><tr><td>[74]</td><td>Flexible Loads</td></tr><tr><td rowspan="2">Day-ahead & Real-time market</td><td>[75]</td><td>High-Wattage IoT Botnets</td></tr><tr><td>[58]</td><td>EVCS</td></tr></tbody></table>

<table><caption>TABLE V: Detection and localization approaches against LAAs.</caption><thead><tr><th>Method Type</th><th>Ref</th><th>Approach</th></tr></thead><tbody><tr><td rowspan="5">Model-Based</td><td>[92]</td><td>SMO + generator phase angle</td></tr><tr><td>[50], [93]-[95]</td><td>SMO + frequency&phase angle</td></tr><tr><td>[96]</td><td>KF + frequency&phase angle</td></tr><tr><td>[97]</td><td>W-FFT&W-CC + load demand</td></tr><tr><td>[98]</td><td>TDLL + load demand</td></tr><tr><td rowspan="5">Data-Driven</td><td>[99]</td><td>LSTM + load demand</td></tr><tr><td>[100]</td><td>GAT&LSTM + load demand</td></tr><tr><td>[101]</td><td>CNN + frequency&phase angle</td></tr><tr><td>[58]</td><td>CNN + EV charging profiles</td></tr><tr><td>[80]</td><td>MILP + frequency&phase angle</td></tr><tr><td rowspan="4">Hybrid</td><td>[80]</td><td>LQR + CNN + frequency</td></tr><tr><td>[102]</td><td>SR + frequency&phase</td></tr><tr><td>[102]</td><td>PINN + frequency&phase</td></tr><tr><td></td><td></td></tr></tbody></table>

increase in the aggregated surcharge charging cost.

In conclusion, the energy market can be highly vulnerable to exploitation by LAAs, especially given the increasing reliance on wholesale electric energy pricing mechanisms like LMP. These attacks can manipulate electricity prices by artificially inflating or deflating demand, resulting in financial gains for attackers and potential market destabilization. It is essential to develop robust cybersecurity measures and prevent LAAs from manipulating energy prices.

## IV. ATTACK DETECTION AND LOCALIZATION

If a successful LAA occurs, swift detection and localization are of utmost importance to limit the damage. Table V summarizes the work in this area, classifying approaches into model-based, data-driven, and hybrid methods. Model-based approaches utilize predefined algorithms or mathematical models to detect and locate LAAs, relying on a thorough understanding of system dynamics. Data-driven approaches utilize ML algorithms to automatically capture potential relationships in the data and anomalies caused by LAAs. Hybrid approaches use a combination of the two.

### A. Model-Based Approaches

One approach to detect LAAs is to model the power network as a semi-explicit class of differential-algebraic equations (DAEs) [92] and then use a sliding mode observer (SMO) to estimate the state of the system. The observer is able to

estimate any signals representing failures to detect LAAs, with only the generator phase angles being measured. Focusing on DLAAs, [93] utilized the estimation of residual signals to detect attacks. Specifically, the power system was first modeled as state-space equations, and then a robust SMO was designed with an observer residual evaluation function. By comparing the value of this function to those observed in non-attack scenarios, the algorithm effectively identifies the DLAA.

Based on similar ideas of utilizing the observers, the sliding mode algorithm (STA) was used in the design of LAA detection while also incorporating the usage of ESS in the power system to defend against LAAs [94]. Another study utilized the linear matrix inequality (LMI) to design a bank of residual generators for functional observers to detect LAAs [95]. This approach reduces the number of observed states, making it suitable for large-scale power network calculations. The researchers in [50] designed a closed-loop SMO for the detection of closed-loop DLAAs, whose robustness is enhanced by using the $H_\infty$ performance index. A method using a low-rank Kalman filter was proposed in [96], which identifies destabilizing attacks by estimating system states and attack parameters with the rank-1 method, achieving high accuracy and computational efficiency.

Model-based approaches rely on observers or state estimators built using a state-space system model. While these methods provide strong theoretical foundations and require less data when the system is accurately modeled, the increasing integration of diverse equipment into power grids makes accurate modeling more challenging. This issue is particularly evident in large, complex grids, where developing precise state-space models requires significant effort, underscoring a key limitation of model-based approaches.

### B. Data-Driven Approaches

With the rapid advancements in artificial intelligence-based techniques in recent years, several studies have adopted ML-based methods to detect and localize LAAs. As LAA affects the load profile of the system, an intuitive method is to monitor and analyze the load data recorded by smart meters. [97] analyzed this data and showed that compromised loads can be detected by performing a fast Fourier Transform (FFT) and spectral analysis of the signals. A windowed FFT (W-FFT) and windowed cross-correlation (W-CC) were then used
<figure><img src="image_4.png" /><figcaption>Fig. 3: Comparison among model-based, data-driven and hybrid approaches.</figcaption></figure>

to detect an attack. They showed that utilizing time and frequency-domain signals could improve the performance of LAA detections.

A time-delay neural network was designed in [98], whose inputs are the power demand profiles. Results showed that the detector could precisely recognize even LAAs that activate only a small number of electric water heaters. [99] pre-processed the load demand data into a feeder loading abnormal power spectrum index. This index was then fed into a long-short-term memory (LSTM) network to detect the anomalies. Another method was proposed in [100] to detect LAAs in distribution networks by exploiting the spatial and temporal properties of the load data. A graph attention network (GAT) and LSTM were employed to capture the spatial and temporal correlations, respectively. The proposed model outperformed existing methods in detecting and localizing LAAs, demonstrating robustness against noise and outliers.

It may not always be feasible to measure every real-time load profile. Existing work suggests that the sampling rate of meters could be exploited to launch stealthy load attacks. For instance, if attackers know the meter's sampling rate, they can synchronize the switching of power circuits to occur between meter readings, leading to inaccurate power consumption calculations [103]. An alternative is to leverage the grid frequency and phase angle fluctuations monitored by PMUs installed to detect and localize LAAs. Based on this, [101] proposed the use of a convolutional neural network (CNN) classifier and reconstruction decoder to detect and localize DLAAs. The proposed method demonstrated good performance, even in the presence of noise or data loss in the measurements. Focusing on the LAAs utilizing EVCS, an unsupervised deep learning-based mechanism using CNN and EV charging profiles was proposed in [58] to detect malicious attacks.

Data-driven approaches reduce the reliance on accurate system modeling but come with their own challenges. Their effectiveness depends on the quality and representativeness of the training data, which may not fully capture all potential LAAs in real-world scenarios, limiting their feasibility. Additionally, neural networks, commonly used in these methods, face issues with interpretability, making it difficult to ensure robustness and security. Furthermore, data-driven algorithms are vulnerable to adversarial ML techniques [12], [51], [104], [105], where malicious inputs can manipulate model predictions, further undermining their reliability.

### C. Hybrid Approaches

Given the shortcomings of both data-driven and model-based methods, recent work has explored hybrid approaches

that combine the strengths of both, as illustrated in Fig. 3. These approaches integrate the automatic fitting capabilities of data-driven methods with the physical insights provided by model-based techniques, offering more balanced and effective solutions.

Inspired by the model-based approaches, [80] followed the idea of designing observers to estimate the state of the system. The power system dynamics under attacks were represented using a state-space model, which was then transformed into the frequency domain. An optimization problem constrained by the frequency domain system model was then formulated in order to localize the attacks. The authors also pointed out the feasibility of applying the approach in wide area monitoring systems (WAMS), by implementing it in a hierarchical fashion.

A hybrid physics-based deep learning mechanism for LAA detection and localization was developed in [106]. An observer based on a linear quadratic regulator (LQR) was designed to recover the states of the power system from generator frequencies, with which the pattern of load variations can be reconstructed by reversing the state-space equations. These reconstructed load patterns were then fed into a designed CNN classifier to identify whether and where the LAAs are.

Based on physics-informed ML algorithms, [102] proposed two data-driven methods for LAA detection and localization. With phase angles and frequencies as the inputs, the authors designed algorithms based on sparse identification of non-linear dynamics and a physics-informed neural network (PINN). Both algorithms incorporated the physical characteristics of the power system into the design, enabling the algorithm to operate without relying on offline training.

## V. ATTACK MITIGATION

Once detected, the destabilizing effects of LAAs need be addressed. Attack mitigation schemes can be either preventive or reactive. Preventive methods aim at deploying security reinforcements offline such that the attackers cannot launch destabilizing LAAs. For instance, reinforcing security features of load devices (e.g., adding hardware or software security features) can prevent load compromises and thus limit the attacker's ability to launch destabilizing LAAs. However, deploying these security measures may incur significant economic costs upfront. Thus, the second category of reactive methods aims to develop online mitigating measures that will enhance the ability of power grids to withstand the adverse impacts of LAAs. This could, for instance, include generator dispatch from fast-acting resources to correct the imbalance caused by LAAs. Third, hybrid approaches include a combination of offline deployments and online operation of these devices to counter the adverse effects of LAAs. Table VI summarizes the existing mitigation methods.

### A. Preventive Mitigation

To minimize the protection cost, the amount and the location of the protected load must be selected strategically. [60] proposed a non-convex pole placement optimization problem to determine the optimal load protection to ensure that the attacker cannot launch destabilizing DLAAs even if the remaining vulnerable loads are compromised. The formulation ensures that the poles of the system (modeling the power grid
<table><caption>TABLE VI: Classification of mitigation methods.</caption><thead><tr><th>Type</th><th>Grid</th><th>Ref</th><th>Defensive tool</th></tr></thead><tbody><tr><td rowspan="10">Preventive</td><td rowspan="4">Transmission</td><td>[60]</td><td>Securing loads</td></tr><tr><td>[75]</td><td>Increasing data privacy, Sharing altered data, and installing non-intrusive load monitoring algorithm</td></tr><tr><td>[107]</td><td>Robust operating points</td></tr><tr><td>[108]</td><td>Battery</td></tr><tr><td rowspan="6">Distribution</td><td>[109]</td><td>Reactive power compensation</td></tr><tr><td>[110]</td><td>Edge computing infrastructure</td></tr><tr><td>[111]</td><td>ML-based market clearing</td></tr><tr><td>[112]</td><td>Securing critical aggregators</td></tr><tr><td>[113]</td><td>EV charge/discharge</td></tr><tr><td>[114]</td><td>Frequency droop control</td></tr><tr><td rowspan="6">Reactive</td><td rowspan="4">Transmission</td><td>[115]</td><td>Load shedding</td></tr><tr><td>[116]</td><td>Communication links</td></tr><tr><td>[117]</td><td>Canceling selected bids</td></tr><tr><td>[57]</td><td>Reconfiguration</td></tr><tr><td rowspan="2">Distribution</td><td>[118]</td><td>Fraud data detection</td></tr><tr><td>[49]</td><td>Secondary frequency control</td></tr><tr><td rowspan="2">Hybrid</td><td rowspan="2">Transmission</td><td>[119]</td><td>Securing devices &amp; Optimal load management</td></tr><tr><td>[76]</td><td>Soft open points</td></tr></tbody></table>

frequency dynamics) always remain on the left half of the complex plane. The optimization is solved using a coordinated descent method. The work in [64] reformulated the load protection problem by modeling the system stability constraints using the eigenvalue sensitivity approach, which provides a linear approximation to the system's eigenvalues as a function of the attack parameters. The reformulated load protection problem becomes a simple linear programming problem, that significantly reduces the computational complexity.

Different from load protection, [107] proposed an alternative approach to ensure system stability under DLAs by finding *robust generator operating points* using two approaches. The first approach aims to find generator operating points that incur the minimum cost such that no lines are overloaded following the generator's primary frequency control response (to an LAA). In cases where this condition cannot be ensured (due to insufficient generator capacities), they propose another approach which allows temporary line overflows that can eventually be cleared using the generator's secondary control. Furthermore, they provide upper and lower bounds on the magnitude of LAA that the grid is resilient against using the proposed primary and secondary robust operating points. Distributed storage units can also act as backup units for quick dispatch or absorption of the additional power demand. [108] proposed the optimal sizing and location of battery storage units accounting for security constraints under DLAA using the Lyapunov stability theorem. The problem is formulated as a nonconvex optimization problem and solved using a two-step solution inspired by the coordinate descent method.

Game-theoretic approaches have been explored to model the strategic interactions between attackers and defenders in power grids. These interactions can be either preventive or reactive, depending on the operator's defensive strategy. For instance, when the defender anticipates a strategic attacker, preventive defenses can be designed accordingly. The work in [109] presents a zero-sum Stackelberg game, where the defender acts as the leader and the attacker as the follower. In this formulation, the attacker manipulates the reactive power set points at load buses to compromise voltage stability, while the

defender installs reactive power compensation (RPC) devices to minimize the attack's impact.

To reduce the risk of successful LAAs, [110] proposed an edge-computing infrastructure that dynamically enforces permissions for each IoT device (e.g., read and execute commands), preventing unauthorized control commands on critical devices and minimizing disruption. Edge servers near IoT devices reduce latency and enable quick responses to attacks.

While most existing studies focus on mitigating the destabilizing effects of LAAs, a few works focus on mitigating LAA impacts on the electricity market or market-based mitigation. [111] uses an LSTM-based method to capture temporal patterns the energy prices based on the import and export prices set by retailers and communicated to households. Once the LSTM is trained, a confidence interval is established based on prediction errors, and any price prediction that falls outside this range is flagged as a potential attack. [75] provides information on the most effective countermeasures against market manipulation attacks, including sharing detailed market data only with market players such as independent system operators, releasing redacted or altered versions of market data or even delaying the release of full data sets to the public. These methods limit access to historical market data and enhance data privacy. As a result, implementing real-time attacks against the market becomes difficult. Furthermore, installing non-intrusive load monitoring (NILM) at the household level can be an effective countermeasure. For example, NILM can detect the unusual operation of home appliances during the periods when the homeowner is not present. [112] proposes a mixed-integer nonlinear programming optimization problem to design an attack against the electricity market that causes the highest tariff increment and congestion issues in the network. Based on this formulation, they locate the aggregators from which the attack can be launched with the least effort and propose securing these aggregators to mitigate the attacks.

## B. Reactive Mitigation

Reactive attack mitigation refers to restorative actions following the detection of an LAA. The mitigation scheme proposed by [114] leverages the high integration of inverter-based resources (IBRs) to mitigate LAA. The main idea is to dispatch power from fast-acting IBRs to counter the imbalance caused by LAAs following attack detection (e.g., using the ML approaches listed in Section IV). This is achieved by optimizing the droop control parameters of IBRs within an economic dispatch framework. To account for the uncertainty associated with attack detection results, the authors develop a distributionally robust optimization approach.

The game-theoretic approach has also been used for reactive defense where the operator acts as a follower to mitigate the attack. In [115], the authors developed a two-player zero-sum multistage game-theoretic formulation. The attacker's action corresponds to load changes at different time instants of a DLAA, whereas the defender's action corresponds to load shedding to prevent the attack's destabilizing effects. To find the optimal sequence of actions, a minimax-q learning-based solution is proposed. However, the solution requires the knowledge of the action space of players, objective functions, and the system's dynamics.
When conventional communication media such as the in-
ternet or cellular networks are compromised during a cyber
attack, having a backup communication link can provide
essential control pathways to send mitigation commands, such
as disconnecting compromised loads. [116] explored using the
power grid frequency as an alternative communication medium
by modulating the power consumption of large grid-connected
loads or generators. For instance, a large consumer like an
aluminum smelter can be modified to act as an on-demand grid
frequency modulation transmitter at a small cost. This creates
small, controlled changes to the grid's frequency which can
be used to transmit load disconnection messages.

The flexibility provided by EVs is proposed to miti-
gate LAAs in [113]. The EV control actions (such as
charge/discharge actions) to compensate for the LAA imbal-
ance are optimized using H − 2 and H − ∞ -based robust
control techniques. The work also takes the uncertainties like
EV users’ behavior into account. The proposed scheme keeps
the system’s frequency in the stable range, thus preventing
subsequent contingencies such as line tripping or generator
relay tripping.

A Stackelberg game approach is proposed in [57] to mitigate LAAs in distribution systems, with the attacker as the leader executing LAA and network reconfiguration as a defensive action. As noted in Section III-A, in a distribution network, the location of the LAA plays a key role in determining the attack impact [62]. By network reconfiguration, the defender can potentially alter the location of the LAA within the distribution network, thus reducing the detrimental effect of the attack.

To counteract the attacks on electricity markets, [118]
propose a scheme to detect and penalize agents that manipulate
the electricity market by introducing a fraud detection tool that
compares real-time bids with historical data. Any agent (node)
identified as an adversary will incur a penalty. Furthermore,
[117] considers that the operator has historical data of the
bids submitted by the market players. Based on this when
there is an attack, they can estimate the number of devices
under attack as well as the impact of the attack. To compensate
for the impact of the attack on electricity price (which is the
increment in the price), the operator drops some of the highest-
priced bids to correct the effect of the attack.

C. *Hybrid Mitigation*

Finally, we discuss hybrid mitigation strategies that involve
jointly optimizing offline deployments and online operations.
[49] introduced a secondary frequency control approach that
operates both preventively and reactively. The preventive
method uses a model-free approach based on RL in which
the system learns various attack strategies offline and saves
the optimal defense strategies. When an attack is detected, the
algorithm matches the current scenario with the pre-trained
strategies to find the best mitigation action. This approach
actively adjusts to specific attacks and uses feedback control
to minimize system disturbances.

In [119], the work explored a game-theoretic defense that
integrates both the cyber and physical aspects of the power
grid. At the cyber layer, the attacker seeks to spread malware in
IoT devices, while the defender focuses on securing them (e.g.,
through software and firmware updates). At the physical layer,

the attacker aims to launch LAAs that maximize the impact of
the attack, while the defender counteracts it by optimal load
management and control strategies to maintain the stability of
the grid. Results show that the formulation enables the operator
to maintain the system's normal operation under the strategic
botnet attack and improve the grid's integrative resiliency at
both cyber and physical layers.

[76] proposed the use of SOPs in distribution networks that provide the flexibility of connecting different buses when required and controlling the active/reactive power flows [120]. The SOP installation is performed offline and involves solving a chance constraint optimization problem considering all possible LAA scenarios (i.e., the attack location and the magnitude of the compromised load). The SOP operation is computed in real-time following an attack by solving a second-order conic programming optimization. The objective is to minimize the grid's nodal voltage deviation from the nominal value under the power flow and SOPs operation constraints.

VI. CONCLUSIONS & FUTURE RESEARCH

LAAs pose a significant cybersecurity threat to modern power grids, exploiting IoT-enabled high-wattage consumer devices to manipulate power consumption at scale. This paper provides a comprehensive introduction to LAAs by classifying them based on various evaluation criteria, offering a deeper understanding of their forms and impact. The survey also systematically investigates the impacts of LAAs on power system operations, revealing the primary consequences: grid frequency and voltage instability, and electricity market disequilibrium. A comparative analysis of detection methodologies is conducted, encompassing model-based analytical techniques, data-driven machine-learning approaches, and hybrid detection frameworks. The mitigation framework is comprehensively evaluated through two complementary dimensions: 1) preventive security measures, including cryptographic protection mechanisms for IoT-enabled smart loads, and 2) reactive countermeasures incorporating adaptive demand-side management protocols and real-time emergency load shedding algorithms.

The evolving landscape of LAAs presents significant cy-
bersecurity risks to power systems, necessitating proactive
policy interventions, regulatory frameworks, and industry prac-
tices. The revealed vulnerability of IoT-enabled high-wattage
devices underscores the urgency for implementation of ro-
bust security measures, such as IEEE 2030.5 (Smart Energy
Profile 2.0) [121] security extensions, which provides se-
cure communication mechanisms for DERs. Moreover, recent
governmental responses highlight the importance of securing
smart appliances and demand-side response mechanisms to
prevent large-scale cyber threats. For instance, the Cyber
Resilience Act by the European Commission aims to enhance
the security of digital products by enforcing stricter cyberse-
curity requirements across the supply chain [122]. Similarly,
in the U.S., the NIST cybersecurity labeling program [123]
focuses on improving consumer awareness and incentivizing
manufacturers to implement stronger security measures in
consumer devices, contributing to the overall resilience of
energy systems. UK's smart energy security framework also
emphasizes securing demand-side response technologies and
ensuring compliance with cybersecurity standards for energy
smart appliances [124].

To effectively mitigate LAA risks, it is imperative that policymakers establish enforceable cybersecurity baselines that integrate LAA-specific threat models into existing grid security frameworks. Ensuring compliance with standardized security protocols, such as IEEE 2030.5, plays a crucial role in enhancing interoperability and protecting IoT-enabled loads from large-scale coordinated LAAs. Additionally, industry stakeholders should prioritize the deployment of advanced anomaly detection mechanisms and adaptive defense strategies to counter evolving threats. A multidisciplinary approach that combines regulatory enforcement, technological innovation, and cross-sector collaboration is essential to enhancing grid resilience against cyber-physical threats. By integrating these measures, power systems can transition toward a more secure, intelligent, and adaptive operational paradigm, effectively mitigating the impact of LAAs while maintaining system stability and reliability.

Several open research problems remain, offering fertile ground for future exploration.

(1) *Joint Cyber-Physical Risk Analysis:* Although several works have analyzed the risks associated with LAAs, there remains a gap in understanding the joint cyber-physical impacts, particularly in the context of DLAAs. Existing research has primarily focused on either cyber or physical aspects, but an integrated analysis is crucial. For example, [119] proposed a two-stage framework where they first analyzed cyber-risks using an epidemic model to track botnet propagation, followed by an examination of the physical impacts on the power grid. Future work should assess cyber-physical risks and develop optimized joint defense strategies, particularly in systems with high IoT and DER penetration.

(2) *LAA Market Manipulation and Economic Impacts:* LAAs present significant threats to energy markets by enabling attackers to manipulate market prices through changes in power demand. These attacks can lead to extreme volatility, with prices surging or plummeting based on the attacker's intent. While the feasibility of manipulating energy markets through LAAs has been demonstrated [73], the economic impacts, real-time market response mechanisms, and security protocols to ensure market integrity during and after LAAs, remain underexplored areas.

(3) *LAAs in Renewable Energy-Rich Systems:* The inherent variability and intermittency of RES make the power grid more susceptible to LAAs. For instance, an attacker could exploit periods of low RES generation by launching an LAA [27], triggering an increase in demand that the grid cannot meet due to insufficient backup from conventional generators. Similarly, during periods of high RES output, LAAs could result in overproduction, leading to instability in grid frequency and voltage. Future research should focus on integrating advanced forecasting techniques and real-time monitoring which could help grid operators maintain stability during LAAs.

(4) *Cyber-Resilient Recovery Strategies:* As demonstrated in [125], effective recovery from cyber-physical attacks like DLAAs requires the development of integrated cyber-physical recovery frameworks. The proposed cyber recovery from

DLAAs focuses on coordinating repair crews and dynamically adjusting IBR droop gains to restore stability. Future work should build upon this by exploring how similar recovery frameworks can be tailored for LAA scenarios, particularly in RES-dominated grids. Research should also investigate real-time adaptive recovery strategies that leverage ML to predict attack evolution and optimize repair and stabilization efforts.

(5) *Enhanced Detection and Mitigation via Game Theory and ML:* Given the evolving sophistication of LAA strategies, future research should focus on developing more robust detection and mitigation mechanisms. Game-theoretic approaches, as in [57], [125], [126], can model the interaction between attackers and defenders, enabling the prediction of optimal attacks and defenses. Additionally, combining game theory with ML to identify abnormal power demand patterns with physics-based models to maintain system stability presents a promising approach for enhancing LAA defense strategies.

## ACKNOWLEDGMENTS

This work has been supported in part by PhD Cofund WALL-EE project between the University of Warwick, UK and CY Cergy Paris University, France, EPSRC under Grant EP/S035362/1, and King Abdullah University of Science and Technology (KAUST) under Awards No. ORFS-2022-CRG11-5021 and No. RFS-OFP2023-5505.

## REFERENCES

[1] Tenfold expansion in chargepoints by 2030 as government drives ev revolution. [Online]. Available: https://shorturl.at/5RtIL

[2] “Saudi arabia fosters e- and h2-mobility,” https://tinyurl.com/2s3v3a97.

[3] A.-H. Mohsenian-Rad and A. Leon-Garcia, "Distributed internet-based load altering attacks against smart power grids," *IEEE Transactions on Smart Grid*, vol. 2, no. 4, pp. 667-674, 2011.

[4] BBC News. (2022) Isle of wight: Council's electric vehicle chargers hacked to show porn site. [Online]. Available: https://bbc.in/40xJ9dR

[5] R. Lemos. (2023) EV charging infrastructure offers an electric cyberattack opportunity. [Online]. Available: https://bit.ly/4fdF4A0

[6] G. Corfield. (2024) Electric car charger pulled amid warnings hackers could attack national grid. [Online]. Available: https://bit.ly/3YypPuj

[7] U.S. government disrupts botnet people's republic of china used to conceal hacking of critical infrastructure. [Online]. Available: https://bit.ly/4ecP7nB

[8] "EURO 2020 and the TV 'pick-up' effect," https://bit.ly/48wQVAUF.

[9] D. Mashima et al., "Cybersecurity for modern smart grid against emerging threats," *Foundations and Trends® in Privacy and Security*, vol. 5, no. 4, pp. 189-285, 2023.

[10] H. Zhang, B. Liu, and H. Wu, "Smart grid cyber-physical attack and defense: A review," *IEEE Access*, vol. 9, pp. 29641-29659, 2021.

[11] M. Ghiasi et al., "A comprehensive review of cyber-attacks and defense mechanisms for improving security in smart grid energy systems: Past, present and future," *Electric Power Systems Research*, vol. 215, 2023.

[12] A. Sayghe et al., "Survey of machine learning methods for detecting false data injection attacks in power systems," *IET Smart Grid*, 2020.

[13] N. Abdi, A. Albaseer, and M. Abdallah, "The role of deep learning in advancing proactive cybersecurity measures for smart grid networks: A survey," *IEEE Internet Things J.*, 2024.

[14] S. S. Hussain, T. S. Ustun, and A. Kalam, "A review of IEC 62351 security mechanisms for IEC 61850 message exchanges," *IEEE Trans. Ind. Informat.*, vol. 16, no. 9, pp. 5643-5654, 2019.

[15] T. T. Kim and H. V. Poor, "Strategic protection against data injection attacks on power grids," *IEEE Trans. Smart Grid*, 2011.

[16] S. Lakshminarayana et al., "Survey of moving target defense in power grids: Design principles, tradeoffs, and future directions," *arXiv preprint arXiv:2409.18317*, 2024.

[17] S. Sridhar and M. Govindarasu, "Model-based attack detection and mitigation for automatic generation control," *IEEE Trans. Smart Grid*, vol. 5, no. 2, pp. 580-591, 2014.
[18] R. Tan et al., "Optimal false data injection attack against automatic generation control in power grids," in 2016 ACM/IEEE 7th International Conference on Cyber-Physical Systems (ICCPS), 2016, pp. 1-10.

[19] A. Ameli et al., "Attack detection and identification for automatic generation control systems," *IEEE Trans. Power Syst.*, vol. 33, no. 5, pp. 4760-4774, 2018.

[20] I. Zografopoulos, N. D. Hatziargyriou, and C. Konstantinou, "Distributed energy resources cybersecurity outlook: Vulnerabilities, attacks, impacts, and mitigations," *IEEE Systems Journal*, vol. 17, no. 4, pp. 6695-6709, 2023.

[21] M. Liu et al., "Enhancing cyber-resiliency of DER-based smart grid: A survey," *IEEE Trans. Smart Grid*, 2024.

[22] J. Ye et al., "A review of cyber-physical security for photovoltaic systems," *IEEE Trans. Emerg. Sel. Topics Power Electron.*, 2021.

[23] Y. Li and J. Yan, "Cybersecurity of smart inverters in the smart grid: A survey," *IEEE Trans. Power Electron.*, vol. 38, no. 2, 2022.

[24] M. R. Asghar et al., "Smart meter data privacy: A survey," *IEEE Commun. Surveys Tuts.*, vol. 19, no. 4, pp. 2820-2835, 2017.

[25] I. Zografopoulos et al., "Cyber-physical energy systems security: Threat modeling, risk assessment, resources, metrics, and case studies," *IEEE Access*, vol. 9, pp. 29775-29818, 2021.

[26] A. P. Kuruvila et al., "Hardware-assisted detection of firmware attacks in inverter-based cyberphysical microgrids," *International Journal of Electrical Power & Energy Systems*, vol. 132, p. 107150, 2021.

[27] S. Lakshminarayana, J. Ospina, and C. Konstantinou, "Load-altering attacks against power grids under COVID-19 low-inertia conditions," *IEEE Open Access Journal of Power and Energy*, vol. 9, 2022.

[28] C. Kolias et al., "DDoS in the IoT: Mirai and other botnets," *Computer*, vol. 50, no. 7, pp. 80-84, 2017.

[29] A. Cui, M. Costello, and S. J. Stolfo, "When firmware modifications attack: A case study of embedded exploitation," in *NDSS*, 2013.

[30] J. Jiang et al., "Ghost domain names: Revoked yet still resolvable," in *NDSS*, 2012.

[31] D. J. S. Cardenas, A. Hahn, and C.-C. Liu, "Assessing cyber-physical risks of IoT-based energy devices in grid operations," *IEEE Access*, vol. 8, pp. 61161-61173, 2020.

[32] C. Konstantinou and M. Maniatakos, "Hardware-layer intelligence collection for smart grid embedded systems," *Journal of Hardware and Systems Security*, vol. 3, no. 2, pp. 132-146, 2019.

[33] ——, "Impact of firmware modification attacks on power systems field devices," in *IEEE SmartGridComm*, 2015, pp. 283-288.

[34] Consolidated Edison of New York, "Con Edison: Share my data. sharing services," 2018. [Online]. Available: https://www.coned.com/en/accounts-billing/share-energy-usage-data/share-my-data

[35] D. Krishnamurthy, W. Li, and L. Tesfatsion, "An 8-zone test system based on ISO New England data: Development and application," *IEEE Trans. Power Syst.*, vol. 31, no. 1, pp. 234-246, January 2016.

[36] S. Acharya, Y. Dvorkin, and R. Karri, "Public plug-in electric vehicles+ grid data: Is a new cyberattack vector viable?" *IEEE Trans. Smart Grid*, vol. 11, no. 6, pp. 5099-5113, 2020.

[37] A. Keliris et al., "Open source intelligence for energy sector cyberattacks," in *Critical Infrastructure Security and Resilience*. Springer, 2019, pp. 261-281.

[38] D. Deka, S. Backhaus, and M. Chertkov, "Learning topology of the power distribution grid with and without missing data," in *European Control Conf.*, 2016, pp. 313-320.

[39] S. Bhela, V. Kekatos, and S. Veeramachaneni, "Enhancing observability in distribution grids using smart meter data," *IEEE Trans. Smart Grid*, vol. 9, no. 6, pp. 5953-5961, November 2018.

[40] M. M. Soleymani et al., "Data-enabled modeling and pmu-based real-time localization of ev-based load-altering attacks," *IEEE Trans. Smart Grid*, 2024.

[41] C. Francis et al., "Enhancing topology identification of distribution power systems using multi-rate voltage measurements," *IEEE Trans. Ind. Appl.*, vol. 59, no. 1, pp. 412-421, 2022.

[42] S. Grotas et al., "Power systems topology and state estimation by graph blind source separation," *IEEE Trans. Signal Process.*, vol. 67, no. 8, pp. 2036-2051, 2019.

[43] H. Li et al., "Distribution grid topology and parameter estimation using deep-shallow neural network with physical consistency," *IEEE Trans. Smart Grid*, vol. 15, no. 1, pp. 655-666, 2023.

[44] H. Wu et al., "Gridtopo-gan for distribution system topology identification," *IEEE Trans. Ind. Informat.*, vol. 19, no. 4, pp. 5356-5366, 2022.

[45] S. Park, D. Deka, and M. Chertkov, "Exact topology and parameter estimation in distribution grids with minimal observability," in *Power systems computation conference (PSCC)*. IEEE, 2018, pp. 1-6.

[46] D. Liang et al., "Power flow matching-based topology identification of medium-voltage distribution networks via ami measurements," *International journal of electrical power & energy systems*, vol. 130, p. 106938, 2021.

[47] S. J. Pappu et al., "Identifying topology of low voltage distribution networks based on smart meter data," *IEEE Transactions on Smart Grid*, vol. 9, no. 5, pp. 5113-5122, 2017.

[48] X. Li, H. V. Poor, and A. Scaglione, "Blind topology identification for power systems," in *2013 IEEE International Conference on Smart Grid Communications (SmartGridComm)*. IEEE, 2013, pp. 91-96.

[49] C. Chen et al., "Load altering attack-tolerant defense strategy for load frequency control system," *Applied Energy*, vol. 280, p. 116015, 2020.

[50] J. Li, H. Li, and Q. Su, "Dynamic load altering attack detection for cyber physical power systems via sliding mode observer," *Int'l Journal of Electrical Power & Energy Systems*, vol. 153, p. 109320, 2023.

[51] E.-N. S. Youssef, F. Labeau, and M. Kassouf, "Adversarial dynamic load-altering cyberattacks against peak shaving using residential electric water heaters," *IEEE Trans. Smart Grid*, 2023.

[52] "Pecan Street Repository," 2018. [Online]. Available: http://www.peca.nstreet.org/energy/

[53] (2017) The tracebase appliance-level power consumption data set. [Online]. Available: https://github.com/areinhardt/tracebase

[54] S. Acharya et al., "Cyber insurance against cyberattacks on electric vehicle charging stations," *IEEE Trans. Smart Grid*, 2022.

[55] A. R. Hota, S. Garg, and S. Sundaram, "Fragility of the commons under prospect-theoretic risk attitudes," *Games and Economic Behavior*, vol. 98, pp. 135-164, 2016.

[56] N. Nisan et al., *Algorithmic Game Theory*. Cambridge University Press Cambridge, 2007, vol. 1.

[57] S. Maleki et al., "Distribution system reconfiguration to mitigate load altering attacks via Stackelberg games," *arXiv preprint arXiv:2407.07065*, 2024.

[58] H. Jahangir et al., "Charge manipulation attacks against smart electric vehicle charging stations and deep learning-based detection mechanisms," *IEEE Trans. Smart Grid*, 2024.

[59] E. Hammad et al., "A class of switching exploits based on inter-area oscillations," *IEEE Trans. Smart Grid*, vol. 9, no. 5, 2018.

[60] S. Amini, F. Pasqualetti, and H. Mohsenian-Rad, "Dynamic load altering attacks against power system stability: Attack models and protection schemes," *IEEE Trans. Smart Grid*, vol. 9, no. 4, 2016.

[61] B. Huang, A. A. Cardenas, and R. Baldick, "Not everything is dark and gloomy: Power grid protections against IoT demand attacks," in *Proc. USENIX Security Symposium*, Aug. 2019, pp. 1115-1132.

[62] S. Maleki et al., "The impact of load altering attacks on distribution systems with ZIP loads," in *IEEE PES General Meeting*. IEEE, 2024.

[63] M. P. Goodridge, S. Lakshminarayana, and C. Few, "Analysis of load-altering attacks against power grids: A rare-event sampling approach," in *Proc. PMAPS*, 2022, pp. 1-6.

[64] S. Lakshminarayana, S. Adhikari, and C. Maple, "Analysis of IoT-based load altering attacks against power grids using the theory of second-order dynamical systems," *IEEE Trans Smart Grid*, 2021.

[65] S. Soltan, P. Mittal, and H. V. Poor, "BlackIoT: IoT botnet of high wattage devices can disrupt the power grid," in *Proc. USENIX Security Symposium*, Aug. 2018, pp. 15-32.

[66] J. Ospina et al., "On the feasibility of load-changing attacks in power systems during the COVID-19 pandemic," *IEEE Access*, 2020.

[67] M. P. Goodridge, A. Zocca, and S. Lakshminarayana, "Analysis of cascading failures due to dynamic load-altering attacks," in *IEEE SmartGridComm*, 2023, pp. 1-6.

[68] A. Dabrowski, J. Ullrich, and E. R. Weippl, "Grid shock: Coordinated load-changing attacks on power grids: The non-smart power grid is vulnerable to cyber attacks as well," in *Proceedings of ACSAC*, 2017, pp. 303-314.

[69] M. P. Goodridge et al., "Uncovering load-altering attacks against N-1 secure power grids: A rare-event sampling approach," *IEEE Trans. Power Syst.*, 2024.

[70] J. Chen, "Enhancing cyber-physical resiliency of power grids under iot-enabled dynamic botnet attacks," in *IEEE PESGM*, 2023.

[71] F. Wei and X. Lin, "Cyber-physical attack launched from EVSE botnet," *IEEE Trans. Power Syst.*, pp. 1-12, 2023.

[72] O. G. M. Khan et al., "Impact of electric vehicles botnets on the power grid," in *EPEC*. IEEE, 2019, pp. 1-5.

[73] J. Ospina, D. M. Fobes, and R. Bent, "On the feasibility of market manipulation and energy storage arbitrage via load-altering attacks," *Energies*, vol. 16, no. 4, p. 1670, 2023.

[74] C. Barreto et al., "CPS: Market analysis of attacks against demand response in the smart grid," in *Proceedings of ACSAC*, 2014.
[75] T. Shekari et al., "MaMIoT: Manipulation of energy market leveraging high wattage IoT botnets," in Proceedings of the 2021 ACM SIGSAC Conf. on CCS, 2021, pp. 1338-1356.

[76] Z. Liu and L. Wang, "A robust strategy for leveraging soft open points to mitigate load altering attacks," IEEE Trans. Smart Grid, 2022.

[77] F. Alanazi, J. Kim, and E. Cotilla-Sanchez, "Load oscillating attacks of smart grids: Vulnerability analysis," IEEE Access, vol. 11, 2023.

[78] Y. Dvorkin and S. Garg, "IoT-enabled distributed cyber-attacks on transmission and distribution grids," in NAPS. IEEE, 2017.

[79] C. Murguia and J. Ruths, "On reachable sets of hidden CPS sensor attacks," in American Control Conf. IEEE, 2018, pp. 178-184.

[80] S. Amini et al., "Hierarchical location identification of destabilizing faults and attacks in power systems: A frequency-domain approach," IEEE Trans. Smart Grid, vol. 10, no. 2, 2017.

[81] C. Peng et al., "A survey on security communication and control for smart grids under malicious cyber attacks," IEEE Trans. Syst., Man, Cybern., Syst., vol. 49, no. 8, pp. 1554-1569, 2019.

[82] M. A. Sayed et al., "Electric vehicle attack impact on power grid operation," Int'l Journal of Electrical Power & Energy Systems, 2022.

[83] K. Sarieddine et al., "Investigating the security of EV charging mobile applications as an attack surface," ACM Trans. on CPS, 2023.

[84] Cyber.uk, "Financially motivated threats," [Online]. Available: https://tinyurl.com/mw9tww9d.

[85] A. Oliveira, "Attackers use containers for profit via trafficstealer," [Online]. Available: https://tinyurl.com/4n8e8w6z, 2023.

[86] R. Walton, "Sophisticated hackers could crash the us power grid, but money, not sabotage, is their focus," [Online]. Available: https://tinyurl.com/yck237kc, 2021.

[87] G. Liu et al., "Bidding strategy for microgrid in day-ahead market based on hybrid stochastic/robust optimization," IEEE Trans. Smart Grid, vol. 7, no. 1, pp. 227-237, 2015.

[88] Q. Wang et al., "Review of real-time electricity markets for integrating distributed energy resources and demand response," Applied Energy, vol. 138, pp. 695-706, 2015.

[89] P. Samadi et al., "Optimal real-time pricing algorithm based on utility maximization for smart grid," in IEEE SmartGridComm, 2010.

[90] H. Anand and R. Ramasubbu, "A real time pricing strategy for remote micro-grid with economic emission dispatch and stochastic renewable energy sources," Renewable Energy, vol. 127, pp. 779-789, 2018.

[91] M. Roozbehani, M. A. Dahleh, and S. K. Mitter, "Volatility of power grids under real-time pricing," IEEE Trans. Power Syst., 2012.

[92] C. Mellucci et al., "Load alteration fault detection and reconstruction in power networks modelled in semi-explicit differential algebraic equation form," in American Control Conf. IEEE, 2015.

[93] Q. Su et al., "Observer-based detection and reconstruction of dynamic load altering attack in smart grid," Journal of the Franklin Institute, vol. 358, no. 7, pp. 4013-4027, 2021.

[94] G. Rinaldi et al., "Load altering attacks detection, reconstruction and mitigation for cyber-security in smart grids with battery energy storage systems," in European Control Conf. IEEE, 2022, pp. 1541-1547.

[95] A. e Sousa, N. Messai, and N. Manamanni, "Load-altering attack detection on smart grid using functional observers," Int'l Journal of Critical Infrastructure Protection, vol. 37, p. 100518, 2022.

[96] M. Izbicki et al., "Identification of destabilizing attacks in power systems," in American Control Conf. IEEE, 2017, pp. 3424-3429.

[97] S. Amini, F. Pasqualetti, and H. Mohsenian-Rad, "Detecting dynamic load altering attacks: A data-driven time-frequency analysis," in IEEE SmartGridComm, 2015.

[98] E.-N. S. Youssef, F. Labeau, and M. Kassouf, "Detection of load-altering cyberattacks targeting peak shaving using residential electric water heaters," Energies, vol. 15, no. 20, p. 7807, 2022.

[99] A. Sawas and H. E. Farag, "Real-time detection of stealthy IoT-based cyber-attacks on power distribution systems: A novel anomaly prediction approach," Electric Power Sys. Research, vol. 223, 2023.

[100] A. Ebtia et al., "Spatial-temporal data-driven model for load altering attack detection in smart power distribution networks," IEEE Trans. Ind. Informat., 2024.

[101] H. Jahangir et al., "A deep learning-based solution for securing the power grid against load altering threats by IoT-enabled devices," IEEE IoT Journal, 2023.

[102] S. Lakshminarayana et al., "Data-driven detection and identification of IoT-enabled load-altering attacks in power grids," IET Smart Grid, vol. 5, no. 3, pp. 203-218, 2022.

[103] Y. Wu et al., "False load attack to smart meters by synchronously switching power circuits," IEEE Trans. Smart Grid, 2018.

[104] A. Sayghe, J. Zhao, and C. Konstantinou, "Evasion attacks with adversarial deep learning against power system state estimation," in PES General Meeting. IEEE, 2020, pp. 1-5.

[105] J. Tian et al., "Adversarial attack and defense methods for neural network based state estimation in smart grid," IET Renewable Power Generation, vol. 16, no. 16, pp. 3507-3518, 2022.

[106] M. A. Sayed et al., "A hybrid physics-deep learning load-altering attack detection and localization mechanism," in 4th Int'l Conf. on Smart Grid and Renewable Energy (SGRE), 2024, pp. 1-6.

[107] S. Soltan, P. Mittal, and H. V. Poor, "Protecting the grid against mad attacks," IEEE Trans. Netw. Sci. Eng., vol. 7, no. 3, 2019.

[108] A. Di Giorgio et al., "On the optimization of energy storage system placement for protecting power transmission grids against dynamic load altering attacks," in 25th MED. IEEE, 2017, pp. 986-992.

[109] L. An et al., "Robust and scalable game-theoretic security investment methods for voltage stability of power systems," in 2023 62nd IEEE Conf. on Decision and Control (CDC). IEEE, 2023, pp. 7061-7066.

[110] B. Shrestha and H. Lin, "Data-centric edge computing to defend power grids against IoT-based attacks," Computer, vol. 53, no. 5, 2020.

[111] F. Bellizio et al., "Transition to digitalized paradigms for security control and decentralized electricity market," Proceedings of the IEEE, vol. 111, no. 7, pp. 744-761, 2022.

[112] O. G. M. Khan et al., "Cyber security of market-based congestion management methods in power distribution systems," IEEE Trans. Ind. Informat., vol. 17, no. 12, pp. 8142-8153, 2021.

[113] M. A. Sayed et al., "Protecting the future grid: An electric vehicle robust mitigation scheme against load altering attacks on power grids," Applied Energy, vol. 350, p. 121769, 2023.

[114] Z. Chu et al., "Mitigating load-altering attacks against power grids using cyber-resilient economic dispatch," IEEE Trans. Smart Grid, vol. 14, no. 4, pp. 3164-3175, 2023.

[115] Y. Guo et al., "Reinforcement-learning-based dynamic defense strategy of multistage game against dynamic load altering attack," Int'l Journal of Electrical Power & Energy Systems, vol. 131, p. 107113, 2021.

[116] J. S. Götte, L. Katzir, and B. Scheuermann, "Ripples in the pond: Transmitting information through grid frequency modulation," in Proceedings of the 38th ACSAC, 2022, pp. 455-466.

[117] C. Barreto, H. Neema, and X. Koutsoukos, "Attacking electricity markets through IoT devices," Computer, vol. 53, no. 5, pp. 55-62, 2020.

[118] N. Andriopoulos, N. Kanakaris et al., "Cyber-resilient operation of iot-enabled power grid: A nodal local energy market approach," IEEE Transactions on Industrial Cyber-Physical Systems, 2024.

[119] Y. Zhao, J. Chen, and Q. Zhu, "Integrated cyber-physical resiliency for power grids under iot-enabled dynamic botnet attacks," IEEE Trans. Control Syst. Technol., 2024.

[120] X. Jiang et al., "An overview of soft open points in electricity distribution networks," IEEE Trans. Smart Grid, vol. 13, no. 3, pp. 1899-1910, 2022.

[121] D. Passos et al., "A tutorial and security overview on the iee 2030.5-2018 standard," IEEE Communications Surveys & Tutorials, 2025.

[122] European Commission, "Cyber Resilience Act," [Online]. Available: https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act, 2022.

[123] National Institute of Standards and Technology, "Cybersecurity Labeling for Consumers: Internet of Things (IoT) Devices and Software," [Online]. Available: https://shorturl.at/YmDVH, 2022.

[124] Department for Energy Security and Net Zero, "Delivering a smart and secure electricity system: the interoperability and cyber security of energy smart appliances and remote load control," [Online]. Available: https://shorturl.at/HXsDV, 2023.

[125] M. Liu, Z. Chu, and F. Teng, "Cyber recovery from dynamic load altering attacks: Linking electricity, transportation, and cyber networks," arXiv preprint arXiv:2309.03380, 2023.

[126] S. Ghosh and C. Konstantinou, "A bi-level differential game-based load frequency control with cyber-physical security," IEEE Trans. Smart Grid, vol. 15, no. 5, pp. 5151-5168, 2024.