Robust Anomaly based Attack Detection in Smart Grids under
Data Poisoning Attacks
Shameek Bhattacharjee

Mohammad Jaminur Islam

Sahar Abedzadeh

Western Michigan University
Kalamazoo, MI, USA
shameek.bhattacharjee@wmich.edu

Western Michigan University
Kalamazoo, MI, USA
mohammadjaminur.islam@wmich.
edu

Western Michigan University
Kalamazoo, , MI, USA
sahar.abedzadeh@wmich.edu

ABSTRACT1

Anomaly-based attack detection methods are often used to detect
data integrity or data falsification attacks in advanced metering
infrastructure (AMI) of smart grids. However, there is a lack ofstudies on the effect of data poisoning attacks against the anomaly based attack detectors that depend on some form of machinelearning. In this paper, we introduce some data poisoning attack
strategies against anomaly-based attack detectors in smart metering infrastructure and show its impact. Specifically, we proposea whitebox and black box approach to poisoning attacks. Then,
we propose modifications to improve the robustness of previous
anomaly detection algorithms by modifying certain design choices
for learning the thresholds for the anomaly detector. Specifically,
we offer theoretical insights and experimental proof to explain why
and when they mitigate data poisoning. These design choices include both the regression type and the loss function choice. We
measure attack mitigation performance with two NIST specified
metrics for CPS systems in the test set using a real smart metering
dataset. Finally, we offer recommendations on energy utility’s best
anomaly detector design choices under varying attack parameters.

Data falsification attacks have been widely studied in the Internetof Things (IoT) telemetry and Cyber Physical System (CPS) domains. The objective of data falsification attacks is to disrupt theoperational accuracy and functioning of an IoT/CPS application. To
detect such attacks, artificial intelligence (AI), Machine Learning(ML), and statistics based anomaly detection approaches have beendeveloped [1, 5, 11, 12].
In contrast, the discipline of adversarial ML deals with attacks
that are analogous to data falsification attacks but designed specifically to exploit weaknesses in an ML/AI-based framework [7, 14]. In
adversarial ML, attacks are broadly categorized as Evasion and Poisoning. Adversarial attacks launched during the test/deployment
phase are called evasion attacks, while adversarial attacks launchedduring the training phase are known as poisoning attacks. Evasionattacks prevent correction classification of a specific input during
the testing phase. In contrast, the poisoning attacks perturbs inputs
during the training phase which prevents accurate parameter learning. As a result, the framework learns a wrong model that negatively
affects the intended performance of the ML/AI framework.
To design an adversarial attack, an adversary may have exact
knowledge of the ML technique and data points (White Box Approach); or may not know the model and/or all datapoints, but
can observe outputs from an algorithm (Black Box Approach). The
White Box approach specifies the worst-case possibility which applies to insider attacks or by an advanced persistent threat actor
that gains system privileges to obtain full access to a utility’s cyberinfrastructure. Such the mode of entry for full system control
was used in the Ukraine Power Grid Attack [20].
There have been enough theoretical advances in evaluating vulnerabilities of ML models against adversarial attacks that are applied in the context of computer vision and image processing algorithms [7, 9]. Additionally, there exist practical works on adversarial
attacks that target spam email detection [14] and various theoretical studies on attacks and defenses [16]. However, there is a lack ofstudies on adversarial learning in the context of smart grids. Thereis one work on adversarial machine learning which discusses smart
grid but in the context of differential privacy [13]. For poisoning
attack and defense in a general regression setting, [16] proposes
an adversarial poisoning technique to craft extra points into an
existing dataset to bias the prediction in a classical linear regression
problem. Such an approach works in an open setting, but does notwork in a smart grid since all meters need to physically registered
to a utility. Some works [17] have offered game theoretic defenses
for theoretical regression problems for an rational adversary.

CCS CONCEPTS• Mathematics of computing → Regression analysis; • Computing methodologies → Machine learning; • Security andprivacy; • Hardware → Smart grid;

KEYWORDS
Anomaly Detection; Smart Grid; Data Poisoning Attack; Adversarial
Machine Learning; Time Series; Interpretable ML based Security

ACM Reference Format:
Shameek Bhattacharjee, Mohammad Jaminur Islam, and Sahar Abedzadeh.
2022. Robust Anomaly based Attack Detection in Smart Grids under Data
Poisoning Attacks. In Proceedings of the 8th ACM Cyber-Physical System
Security Workshop (CPSS ’22), May 30, 2022, Nagasaki, Japan. ACM, , USA,12 pages. https://doi.org/10.1145/3494107.3522778
Permission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for components of this work owned by others than ACM
must be honored. Abstracting with credit is permitted. To copy otherwise, or republish,
to post on servers or to redistribute to lists, requires prior specific permission and/or afee. Request permissions from permissions@acm.org.
CPSS ’22, May 30, 2022, Nagasaki, Japan© 2022 Association for Computing Machinery.
ACM ISBN 978-1-4503-9176-4/22/05. . . $15.00
https://doi.org/10.1145/3494107.3522778

INTRODUCTION

Motivation Most of the existing work in AMI domain focuses on
strategies to disrupt operations. However, there is a lack of works
that specifically focus on adversarial poisoning attacks that target
the machine learning aspect of anomaly based data integrity attack
detectors. Therefore, we think there is a need for focusing on strategies that target ML approaches for data integrity attack detection in
AMI. Furthermore, we could not find works that establish the effects
of poisoning attacks on AMIs’ data integrity protection or quantify
the resilience of existing frameworks under such poisoning attacks.
Finally, we could not find appropriate mitigation approaches underpoisoning attacks in an AMI setting.
Dissecting an ML-based anomaly detection approach into different aspects (regression type choice, loss function choice, thresholdlearning) can help us analyze the explainability of a vulnerability
and a mitigation countermeasure. In this work, we were motivated
to examine how these aspects affect performance degradation underdata poisoning attacks. Thereafter, we analyze how lessons fromrobust statistics and robust optimization can be applied in the context of AMI to offer mitigation and improve the dependability of
the anomaly detector against such attacks. In [16], the attack in aregression setting was done by adding extra points to the training
set and defense involved limiting the inclusion of these extra points
in the learning. However, in our case time is a invariant design
feature, so adding extra points for poisoning is not feasible.
Contributions First, we devise a fast gradient value inspired
adversarial data poisoning (FGAV) attack that perturbs inputs to thethreshold learning of the best performing anomaly based detector
in AMI under a white-box assumption.
Second, we implement a more plausible smart meter level poisoning (RSL) which does not assume exact knowledge of the anomaly
detector or model information. Third, we compare the effectivenessof FGAV attack and RSL attack under a previous anomaly-based
data integrity attack detector using two metrics: (a) Impact of Undetected Attack (b) Expected Time between two false alarms.
Fourth, we propose modifications for robust learning of anomaly
detection thresholds by integrating weighted regression with robust
loss functions into a single approach, and show mitigation underboth FGAV and RSL based poisoning attacks.
Finally, we provide a insight on the security performance against
poisoning attacks with respect to (i) the effect of regression type (ii)the effect of loss function choice under varying attack variables. In
particular, we found that the Cauchy-Lorentzian Loss function performs better than the more well-known Huber Loss, Mean Square
Error Loss (L2), Mean Absolute Error Loss (L1) and that a weighted
quantile regression is better in false alarm performance.

2

BACKGROUND AND PRELIMINARIESThe AMI consists of the smart meters deployed on houses thatcollect power consumption data periodically. For any hour 𝑡, andfor the 𝑖-th house, the power consumption reported by the 𝑖-th
smart meter is denoted as 𝑃 𝑖 (𝑡). Now we discuss the details of theanomaly detection.

2.1

Anomaly Detection Problem Specification

The model being poisoned is a time series anomaly detection
method proposed in a series of previous works [1, 2, 5]. We chose

this time series anomaly detection technique due to the following
reasons: (1) most recent theoretical work in time series microgrid
level anomaly detection technique that can detect very low data falsification margins without sacrificing false alarms; (2) the method
has been shown to generalize to other CPS/IoT domains such as Phasor Measurement Units [4] and Smart Transportation Systems [6];(3) follows the latest National Institute of Standards and Technology(NIST) specified metrics [12] (such as impact of undetected attacks
and expected time between false alarms) for evaluation; (4) While
many anomaly detection methods in industrial CPS, use the idea
of pairwise comparison of positive covariance structure [11] forinvariant design, the pairwise co-variance calculations are expensive for large community-scale smart living CPS (such as AMI). The
method in [1] proposed a lightweight equivalent of the same principle. Furthermore, the chosen framework’s metric shows uniquedeviation signatures under different data integrity attack types, that
help reconstruct attack type, attack strategy, and attack severity [2].
The goal of the anomaly detection framework was to detect anincidence of orchestrated data falsification and omission attacks
in a smart grid advanced metering infrastructure. In contrast, thegoal of the poisoning attacks is usually to alter the training data
to degrade the performance of the anomaly detection model in
two ways: (1) Integrity Violation that increases missed detection of
attacks (2) Availability Violation that increases false alarm rate of
the anomaly detector. In this paper, we only investigate integrity
violation as the goal of the poisoning attack.
While our poisoning attack is shown against a particular technique proposed in [1], it generalizes to other time series anomaly
detection methods which utilize some form of regression-basedlearning to obtain the anomaly detection thresholds. This generality is apparent from the shared design similarities among various
time series-based anomaly detection approaches.
To relate the contribution in a generic way, and yet experience
the practical effectiveness of a specific framework and a specificapplication, we describe the anomaly detection technique [1], under
the umbrella of the following overarching aspects: (1) Anomaly
detection metric (2) Residuals of a Time Series (3) Learning ofThresholds from Residuals (4) Anomaly Detection Criterion.

2.2

Time Series Anomaly Detection Method

2.2.1 Anomaly detection Metric. The main anomaly detection
metric is the time series of harmonic to the arithmetic mean ratio
from multiple smart meters (proposed in [1, 2, 4, 6]). For achieving
in-variance in the time series of the metric under benign conditions,the ratio is calculated over a strategic spatial and temporal granularity under Box-Cox transformations such that positive co-variancein a micro-grid of individual meters are maximized. Mathematically,
the base invariant metric is defined as:
Í𝑊
𝐻 𝑀 (𝑡 )𝑄 𝑟 (𝑇 ) = Í𝑡𝑊=1
𝑡 =1 𝐴𝑀 (𝑡 )(1)where 𝐻𝑀 (𝑡) and 𝐴𝑀 (𝑡) are harmonic and arithmetic mean ofpower consumption 𝑃 𝑖 (𝑡) from all smart meters in a micro-grid attime slot 𝑡 with a box cox transformation. Each spatial cluster maintains the above ratio metric. The temporal granularity is indexed
by a time window 𝑇 of length 𝑊 time slots (hours).

In the case of AMI, the previous work found 𝑊 = 24 hours andthe granularity included the whole solar village of 200 houses due
to its small size. Hence for a typical year, the range of 𝑇 ∈ {1, 365}.
The same method runs in a decentralized manner for each spatial
cluster. Hence, for the purpose of this paper, there is only one spatial
cluster i.e., a small solar village forming a micro-grid of 200 houses.
Table 1: Table of Notations
Notation
T

𝜏
𝜏𝑚𝑎𝑥
𝜏𝑚𝑖𝑛
𝑡
𝜖
𝐹
𝛼
𝜂𝑅

MeaningTime Window
candidate threshold parameter
upper model output thresholdlower model output thresholdtime slot (smallest time granularity)
Perturbation Margin
Time Frame
No. of Inputs Perturbed
No. of Residual Points

2.2.2 Safe Margins. Safe margins quantify an expected upperand lower bound of the anomaly detection metric at any time
window 𝑇 . Let the expected value of the ratio metric at the 𝑇 -th𝑟𝑟time window be 𝜇𝑄 (𝑇 ). The 𝜇𝑄 (𝑇 ) is defined as the cumulative
weighted time average of ratios observed on the𝑇 -th window acrossmultiple years (non-parametric statistic). In contrast, let 𝜎𝑟 denotethe standard deviation of the probability distribution of 𝑄 𝑟 (𝑇 ) samples in the training set (parametric statistic). The upper and lower𝑟safe margin is a neighborhood around the expected value 𝜇𝑄 (𝑇 ),that is controlled by a scalar factor 𝜅 of the standard deviation (𝜎𝑟 )of the distribution of the ratio metric. Mathematically, this is:
𝑟

(2)

𝑟

(3)

Γℎ𝑖𝑔ℎ (𝑇 ) = 𝜇𝑄 (𝑇 ) + 𝜅𝜎𝑟Γ𝑙𝑜𝑤 (𝑇 ) = 𝜇𝑄 (𝑇 ) − 𝜅𝜎𝑟where Γℎ𝑖𝑔ℎ (𝑇 ) is the upper safe margin and the Γ𝑙𝑜𝑤 (𝑇 ) is thelower safe margin. The conceptual details of why this is helpful canbe found in [1].
2.2.3 Residuals. The idea of residuals is important for balancing
missed detection and false alarms in time series anomaly detection.
Residuals keep track of the difference between the safe margins
and the sample 𝑄 𝑟 (𝑇 ). Residual at any time window, ∇(𝑇 ) equals 0,
if 𝑄 𝑟 (𝑇 ) is within the upper and lower safe margins and non-zero
when outside the safe margins. A 𝑄 𝑟 (𝑇 ) larger than the Γℎ𝑖𝑔ℎ (𝑇 )(outside the upper safe margin) gives a positive ∇(𝑇 ); while 𝑄 𝑟 (𝑇 )lesser than the Γℎ𝑖𝑔ℎ (𝑇 ) (outside lower safe margin) gives a negative∇(𝑇 ). Mathematically, this is represented as:∇(𝑇 ) :𝑟
 = 𝑄 (𝑇 ) − Γℎ𝑖𝑔ℎ (𝑇 ),= 𝑄 𝑟 (𝑇 ) − Γ𝑙𝑜𝑤 (𝑇 ), = 0,
if 𝑄 𝑟 (𝑇 ) > Γℎ𝑖𝑔ℎ (𝑇 );if 𝑄 𝑟 (𝑇 ) < Γ𝑙𝑜𝑤 (𝑇 );otherwise;(4)

The ∇(𝑇 ) are known as stateless residual [11], while residuals thatmaintain a history/time memory of residuals are known as statefulresiduals. The corresponding stateful residuals are obtained fromthe stateless residuals by keeping the cumulative sum of the stateless residual ∇(𝑇 ) over a sliding window of length 𝐹 . At any time
𝑇 , the stateful residual is given by:
𝑅𝑈 𝐶 (𝑇 ) =

𝑇
∑︁

∇( 𝑗)

(5)

𝑗 =𝑇 −𝐹 𝑆

Thus, the vector of 𝑅𝑈𝐶 (𝑇 ) values for a year will have 365 entries
which can be either zero, positive or negative depending on thepatterns on how stateless residuals evolve overtime during thetraining set without any attacks.

2.2.4 Threshold Learning from Residuals. Using the positive
𝑅𝑈𝐶 (𝑇 ) values (denoted by 𝑅𝑈𝐶 + (𝑇 )) as the training data points,
the best upper threshold (𝜏𝑚𝑎𝑥 ) is found. Similarly, all the negative
𝑅𝑈𝐶 − (𝑇 ) values are used as training data points for finding thebest lower threshold (𝜏𝑚𝑖𝑛 ).
Setting a threshold, each from a set of discrete 𝑅𝑈 𝐶 + (𝑇 ) and
𝑅𝑈𝐶 − (𝑇 ) points is similar to fitting a straight line to the set ofpoints; hence the threshold learning problem can be viewed asa regression problem. Since the threshold is time-invariant the
regression problem reduces to finding the bias term (the unknown
model parameter). The model parameter search space for the upperand lower thresholds are denoted by 𝜏 + and 𝜏 − respectively. Below
we introduce some terminology related to regression analysis forthe sake of completeness and understanding:
Error: In regression problems, the error is the difference between
a model parameter candidate (candidate threshold) and a training
data point. For each candidate model parameter, an error value canbe calculated for any given training data point. In linear regression,
positive and negative errors do not have unequal weights, and theerror is usually the absolute difference.
Loss Function: The loss function is a mathematical transformation that represents how each error value contributes to the goodness of the candidate model parameter. For example, linear regression uses squares of the errors (𝐿2 norm) as the loss function.
Therefore, with respect to one candidate model parameter and one
training data point, there is one loss value.
Empirical Risk Function It is an equation that maps the goodnessof a candidate parameter across all training data points (observations) in the training data. Typically, it is the average/mean of theloss function values overall training data points. In linear regression, the empirical risk is called mean squared error. Since regression
involves finding the best function that best approximates the data,
the model parameter candidate that has the minimum empiricalrisk is the optimal answer. Hence, this type of regression is known
as ordinary least squares regression.
However, [1] weighted positive and negative errors contribute
unequally to the loss function. Furthermore, it used an 𝐿1 norm (absolute errors) instead of an 𝐿2 norm (squared errors) in its definitionof the empirical loss function.
Algorithm 1, summarizes the basic framework for learning ofthresholds as proposed in [1]. In Algorithm 1, the residual is the𝜏 − 𝑅𝑈𝐶 (𝑇 ). Notice, that, unlike linear regression, the residuals get
unequal weights and the weighted residuals are stored separately
in C and P.
Algorithm 1 Calculate 𝜏𝑚𝑎𝑥
for 𝑅𝑈 𝐶 + (𝑇 ), 𝜏 + do
if (𝑅𝑈 𝐶 + (𝑇 ) < 𝜏 + ) then++𝑐𝑜𝑠𝑡 + : |𝜏 −𝑅𝑈2𝐶 (𝑇 ) |+C ← 𝑐𝑜𝑠𝑡
else
𝑝𝑒𝑛𝑎𝑙𝑡 𝑦 + = |𝑅𝑈 𝐶 + (𝑇 ) − 𝜏 + |2
P ← 𝑝𝑒𝑛𝑎𝑙𝑡 𝑦 +end ifend forÍÍ𝜏𝑚𝑎𝑥 = arg min𝜏 + C 𝑐𝑜𝑠𝑡 + − P 𝑝𝑒𝑛𝑎𝑙𝑡 𝑦 +2.2.5 Detection Criterion. The 𝑅𝑈𝐶 (𝑇 𝑡𝑒𝑠𝑡 ) is the invariant in
the test set. If it is violates the upper and lower thresholds, it indicates an attack.
∈ [𝜏𝑚𝑖𝑛 , 𝜏𝑚𝑎𝑥 ] No Attack;
𝑅𝑈 𝐶 (𝑇 𝑡𝑒𝑠𝑡 ) :(6)∉ [𝜏𝑚𝑖𝑛 , 𝜏𝑚𝑎𝑥 ], Attack Inferred;
Using this [1, 2] showed that small margin additive attacks show
increase in the 𝑅𝑈 𝐶 (𝑇 𝑡𝑒𝑠𝑡 ) violating the upper threshold 𝜏𝑚𝑎𝑥 . For
all other attack types of deductive and camouflage it was shownthat the 𝑅𝑈 𝐶 (𝑇 𝑡𝑒𝑠𝑡 ) decreases violating the lower threshold 𝜏𝑚𝑖𝑛 .

3

THREAT MODEL

The main goal of poisoning attacks is to affect the learning accuracyof the detector during the training phase in such a way, that it allows
false data injection to easily escape detection when launched in
the test set; i.e., the adversary violates the integrity of the anomalybased attack detector.
Naturally, this can only happen when the training attacks resultin the widening of the true thresholds (upper threshold increases
and lower threshold decreases). Secondly, the nature of adversarial
goal dictates means the need for two threat models; one each oftraining and test set.

3.1

Training Phase Threat Model

Perturbation Data Type In this paper, we compare the effects ofdata poisoning attacks on two data types:(1) Perturbation of Residuals: the adversary directly perturbs theresiduals’ set 𝑅𝑈 𝐶 (𝑇 ) which are direct inputs to the learning algorithm that learns the thresholds. This corresponds to the FGAV
attack shown later(2) Perturbation of Raw Data from Meters: the adversary injects
false data during the training phase from a subset of smart meters, which is shown as RSL attack later.
3.1.1 Perturbation of Residuals. To change residuals directly,
the adversary needs access to either (1) servers on which residual
calculation happens; (2) database where the residuals are stored;
and perturb them ‘before’ the learning of thresholds is invoked.
The storage over a long time is commonly required since a large
set of residuals is needed to accurately train the threshold learningmodel to generalize in the test set.
Perturbation Margin is the per residual change that is either
added (for upper threshold) or subtracted to an input (for lower
threshold), such that 0 < 𝜖 < 𝜖𝑚𝑎𝑥 , 𝜖 ∈ IR+ . The perturbation
parameter is upper bounded by 𝜖𝑚𝑎𝑥 which is the extremum of thebenign 𝑅𝑈 𝐶 (𝑇 ) distribution. This is motivated by making sure thatthe change is not out of distribution and thus imperceptible.
Fraction of Points Perturbed is the maximum no. of residual
inputs that an adversary could afford to change whose upper boundis 𝜌𝑚𝑎𝑥 . Intuitively, if 𝜌𝑚𝑎𝑥 is low, the 𝜖 needs to be higher for astrong impact, and vice-versa.
Perturbation Strategy deals with which data points to selectand in what order to introduce the perturbation given a 𝜌𝑚𝑎𝑥 and𝜖. An ‘adversarial example’ by definition is one that does not havea random strategy of point selection, but one that uses the working
weaknesses of the learning algorithm involved.

3.1.2 Perturbation of Meter Level Raw Data. It is not necessarythat a utility will only face attacks from optimal adversaries. To
poison the training process, an attacker can introduce false data
directly from the smart meters randomly, by compromising a subset
of smart meters (attack scale) and introducing some margin of false
data ( attack strength) per smart meter.
(𝑝)Training attack Strength denoted by 𝛿𝑎𝑣𝑔 is the per meter average(𝑝)margin of false data injected during training. 𝛿𝑎𝑣𝑔 is kept as avariable to check the sensitivity of the performance degradation of
the anomaly detector.
(𝑝)Training attack Scale denoted by 𝜌𝑚𝑎𝑙 is the total fraction ofmeters used by an adversary to launch the meter level training datapoisoning. The 𝜌𝑚𝑎𝑙 is kept as a variable to check the sensitivity ofthe performance degradation of the anomaly detector.
Training Attack Type denotes how the data is falsified from its
original value 𝑃𝑡𝑖 which can be either additive, deductive. Intuitively,(𝑝)

additive increases the data 𝑃𝑡𝑖 + 𝛿𝑡(𝑝)

the data such that 𝑃𝑡𝑖 − 𝛿𝑡(𝑝)expected value of 𝛿𝑡while deductive decreases(𝑝), where 𝛿𝑡∈ [𝛿𝑚𝑖𝑛 , 𝛿𝑚𝑎𝑥 ] and thesamples converge to the strategic training(𝑝)attack strength 𝛿𝑎𝑣𝑔 .
While there are other attack types reported [1], in the context
of poisoning to violate the integrity of the attack detector, only
deductive and additive are enough. This is because it is known that
small-scale additive attacks create a deviation of the residuals in theupper threshold by influencing the 𝑅𝑈𝐶 + (𝑇 ) while any deductive
attack creates deviation in the lower threshold by influencing the
𝑅𝑈𝐶 − (𝑇 ). Hence, any other attack type is an overkill when thegoal is achieved by a simple attack type that does not require any
coordination among compromised smart meters.

3.2

Test Phase Threat Model

The test set threat model is identical to the perturbation from meterlevel because the whole idea is to not let the utility detect data
falsification from smart meters. Hence, we refrain from elaborating this section, but only using different notations to distinguish(𝑒)between training and test set attacks by using two terms 𝛿𝑎𝑣𝑔 (de(𝑒)noting attack strength used for evasion) and 𝜌𝑚𝑎𝑙 (denoting attack
strength used for evasion) in the test set. The above is true regardless of whether the residuals were perturbed or raw meter data was
perturbed during poisoning.
The proposed contribution is divided into parts (1) Data Poisoning Attack Strategy (2) Robust Learning for Mitigation of Poisoning

4

POISONING ATTACKS STRATEGIESIn this section, we first discuss the FGAV attack followed the RSL
attack.

4.1

FGAV Data Poisoning Attack

The FGAV is inspired by the Fast gradient sign method that has
been shown to work well on fooling image classifiers. However,this does not apply in this setting directly, but we modified theconceptual idea of FGSM and adapted it to the strategy that applies
to this grid problem.

Original Fast Gradient Sign Method: Goodfellow et. al. proposed a very efficient and generic way of producing adversarial
examples to fool image classifiers that use deep neural learning
frameworks to infer a wrong image class. The mathematical equation that describes the FGSM is given as:′𝑥 = 𝑥 + 𝜖.𝑠𝑖𝑔𝑛 ( ∇𝑥 𝐿 (𝑥, 𝑦))(7)′where 𝑥 is a falsified pixel intensity, and the original pixel intensity
is 𝑥 is modified by the perturbation 𝜖. Whether the modification
should be additive or deductive is dictated by the sign of the gradient(∇) of the loss function 𝐿 with respect to the 𝑥 given that the actual
output was 𝑦.
The original FGSM method cannot be applied in our context due
to the following observations:(1) it does not specify a pixel selection
criterion and does this for each pixel (input). The original FGSM
just optimizes which direction an input should change. However, it
does not provide any procedure to select which are the best points
to perturb, given an upper bound on the number of perturbation
points. (2) In this case, the perturbation sign cannot be arbitrary. For
missed detection increase, the perturbation sign should be positive
for 𝑅𝑈 𝐶 + (𝑇 ) inputs and negative for 𝑅𝑈𝐶 − (𝑇 ). Note that, the FGAV
needs to be implemented after most training data inputs are collected
put the threshold learning has not yet happened.
Fast Gradient Absolute Value (FGAV): Let the vector of input
residual values (RUC) be denoted as:
𝑿 𝑹𝑼 𝑪 = ⟨𝑥𝑟𝑢𝑐 (𝑖)⟩, ∀ 𝑥𝑟𝑢𝑐 (𝑖) → R. Each element in 𝑿 𝑹𝑼 𝑪
is indexed by the set 𝑖 ∈ {1, · · · , 𝑅} that uniquely identifies a residual point, such that 𝑅 is the total no. of non-zero residuals recorded.
For each 𝑥𝑟𝑢𝑐 (𝑖), we calculate the gradient with respect to theloss function 𝐿 in the Algorithm 1 (which learns the thresholdfrom residuals). This yields the following vector of gradient values∇𝑿 𝑹𝑼 𝑪 = ⟨∇𝑥𝑟𝑢𝑐 (𝑖) ⟩where∇𝑥𝑟𝑢𝑐 (𝑖) =𝜕𝐿→R𝜕𝑥𝑟𝑢𝑐 (𝑖)Each element in the vector ∇𝑿 𝑹𝑼 𝑪 denoted by ∇𝑥𝑟𝑢𝑐 (𝑖) holds
the signed derivative of the loss function with respect to the 𝑖-th
residual point. Subsequently, we apply absolute value operation
element-wise on ∇𝑿 𝑹𝑼 𝑪 and then sort its elements in decreasingorder to get the following(𝒔𝒐𝒓 𝒕)∇𝑿
𝒔𝒐𝒓 𝒕where ∇𝑿

𝑹𝑼 𝑪

(𝑠)

(𝑠)

(𝑠)

(𝑠)

= ⟨∇1 , · · · ∇ 𝑗 , · · · ∇𝑅 ⟩= ⟨∇ 𝑗 ⟩(𝑠𝑜𝑟𝑡 )
3: ∇𝑋𝑅𝑈 𝐶 ← 𝑑𝑒𝑠𝑐𝑒𝑛𝑑𝑖𝑛𝑔𝑂𝑟𝑑𝑒𝑟𝑂 𝑓 𝑆𝑖𝑔𝑛𝑒𝑑𝑉 𝑎𝑙𝑢𝑒 (∇𝑋𝑅𝑈 𝐶 )4: while (𝜏𝑐𝑢𝑟 < 𝜏𝑡𝑎𝑟𝑔𝑒𝑡 ) 𝑎𝑛𝑑 |𝑋 𝐴𝑡𝑡𝑎𝑐𝑘𝑒𝑑 | < 𝜌𝑚𝑎𝑥 do
𝑅𝑈 𝐶
5:𝑥𝑟𝑢𝑐 (𝑖) ← 𝑔𝑒𝑡𝑀𝑎𝑝𝑝𝑒𝑑𝑅𝑈𝐶𝐵𝑦𝐺𝑟𝑎𝑑𝑖𝑒𝑛𝑡 (∇𝑥𝑟𝑢𝑐 ( 𝑗))𝑎𝑡𝑡𝑎𝑐𝑘𝑒𝑑 (𝑖) ← 𝑥
6:𝑥𝑟𝑢𝑐
𝑟𝑢𝑐 (𝑖) + 𝜖
7:
𝑋𝑅𝑈 𝐶 ← (𝑋𝑅𝑈 𝐶 − 𝑥𝑟𝑢𝑐 (𝑖))Ð 𝑎𝑡𝑡𝑎𝑐𝑘𝑒𝑑
8:
𝑋𝑅𝑈 𝐶 ← (𝑋𝑅𝑈 𝐶 𝑥𝑟𝑢𝑐
(𝑖))
Í
9:
𝜏𝑐𝑢𝑟 : arg min𝜏 𝑅1 𝑅 𝐿(𝑋𝑅𝑈 𝐶 , 𝜏)
10: end while

Algorithm 3 FGAV Poisoning including Zero RUCs
Input 𝜏𝑡𝑎𝑟𝑔𝑒𝑡 , 𝑋𝑅𝑈 𝐶 , 𝐿, 𝜖𝐴𝑡𝑡𝑎𝑐𝑘𝑒𝑑
Output 𝑋𝑅𝑈 𝐶
1: for 𝑥𝑟𝑢𝑐 (𝑖) in 𝑋𝑅𝑈 𝐶 do
2:
if 𝑥𝑟𝑢𝑐 (𝑖) is Zero then3:
𝑥𝑟𝑢𝑐 (𝑖) ← 𝑥𝑟𝑢𝑐 (𝑖) + 𝑁 (𝜇, 𝜎)
4:
end if
5: end for
6: Call Algorithm 2
the adversaries’ objective is integrity violation of the anomaly detec𝑎𝑡𝑡𝑎𝑐𝑘𝑒𝑑
tor; such that 𝑥𝑟𝑢𝑐(𝑖) = 𝑥𝑟𝑢𝑐 (𝑖) +𝜖. When the adversaries’ objective is availability violation of the anomaly detector then the pertur𝑎𝑡𝑡𝑎𝑐𝑘𝑒𝑑
bation margin is deducted by 𝜖 such that 𝑥𝑟𝑢𝑐(𝑖) = 𝑥𝑟𝑢𝑐 (𝑖) − 𝜖.
Stopping Criterion The above selection and perturbation continue until either the target is reached (in the case of targetedpoisoning) or the 𝜌𝑚𝑎𝑥 limit is reached. The whole process discussed above is summarized in Algorithm 2. The Figs. 1(a) and 1(b)show the effect of FGAV attack on the optimal value of 𝜏𝑚𝑖𝑛 forhigh and low value of 𝜌𝑚𝑎𝑥 respectively.

(8)

(𝑠)

∀ ∇ 𝑗 → R and each element in(𝒔𝒐𝒓 𝒕)(𝒔𝒐𝒓 𝒕)∇𝑿
is index by the set 𝑗. We can view 𝑿 𝑹𝑼 𝑪 and ∇𝑿
𝑹𝑼 𝑪
𝑹𝑼 𝑪
as a mapping between an input set indexed by 𝑖 and an output set
indexed by 𝑗 such that 𝑓 : 𝑖 → 𝑗, where 𝑓 is bijective. Therefore
the inverse mapping 𝑓 −1 : 𝑗 → 𝑖 exists.
𝑹𝑼 𝑪

Algorithm 2 Points Selection to Violate Integrity
Input 𝜏𝑡𝑎𝑟𝑔𝑒𝑡 , 𝑋𝑅𝑈 𝐶 , 𝐿, 𝜖𝐴𝑡𝑡𝑎𝑐𝑘𝑒𝑑
Output 𝑋𝑅𝑈𝐶
1: 𝜏𝑐𝑢𝑟 : arg min𝜏 𝐿(𝑋𝑅𝑈 𝐶 , 𝜏)𝜕𝐿
2: ∇𝑋𝑅𝑈 𝐶 ← 𝜕𝑋
𝑅𝑈 𝐶

(a)

Figure 1: FGAV Poisoning Effect : (a) High 𝜌𝑚𝑎𝑥 (b) Low 𝜌𝑚𝑎𝑥

4.2
Residual Point Selection: With the above mapping, in FGAV, theadversary selects the 𝑖−th residual point (co-domain in the inverse
mapping) for injecting perturbation in the order that corresponds
to the elements in the sorted gradient vector indexed by the set 𝑗(𝒔𝒐𝒓 𝒕)(domain in the inverse mapping) which is the ∇𝑿.
𝑹𝑼 𝑪
Perturbation per Residual: To each 𝑖 − 𝑡ℎ residual point picked, theperturbation margin 𝜖 is added to its original value 𝑥𝑟𝑢𝑐 (𝑖), when(b)

Smart Meter Level Random Poisoning (RSL)

Random smart meter level poisoning gives adversaries a different
advantage. It is more practical, since it can be launched anytime andthe adversaries only need access to a set of CPS sensing endpoints(i.e. smart meters in our case) and no other knowledge.
Figs. 2(a) and 2(b) show the effect of meter level data poisoning on
the ratio metric and eventual thresholds. Fig. 2(a) indicates that theratio drops under a deductive poisoning attack. Hence, intuitively,

(a)

(b)

Figure 2: RSL attack effect on (a) Ratio (b) Thresholds
more negative RUCs will be triggered in the 𝑅𝑈𝐶 − (𝑇 ) set due tothe decreased ratio samples. This biases the learning of the 𝜏𝑚𝑖𝑛 .
More negative RUCs trigger a lower learnt 𝜏𝑚𝑖𝑛 .
Counter-intuitively though, we also see that the learnt upper
threshold 𝜏𝑚𝑎𝑥 also increases after the RSL poisoning attack, evenas the ratio deviated in the direction of the lower threshold (SeeFig 2(b)). This surprise is caused due to the design of the safe margins Γℎ𝑖𝑔ℎ (𝑇 ) and Γ𝑙𝑜𝑤 (𝑇 ), which was done to lower false alarmsin the original method. The ratio drop due to poisoning causes𝑟the calculated 𝜇𝑄 (𝑇 ) to be lower for the attack life time. Since𝑟Γℎ𝑖𝑔ℎ (𝑇 ) directly depends on the 𝜇𝑄 (𝑇 ), the Γℎ𝑖𝑔ℎ (𝑇 ) samples arealso lowered significantly for the attack life time. However, we
kept the attack life time of about 3 months of a given year. Thismeans that in the other year, the ratio samples 𝑄 𝑟 (𝑇 ) remain unperturbed and therefore a higher value compared to decreased ratio
during the attack. Therefore, the ∇(𝑇 ) gives a very high value for𝑄 𝑟 (𝑇 ) − Γℎ𝑖𝑔ℎ (𝑇 ). Since the RSL attack is consecutive, the 𝑅𝑈𝐶 + (𝑇 )values that is a cumulative sum of the ∇(𝑇 ) also increases significantly for the duration of the poisoning attack. Since increased
𝑅𝑈 𝐶 + (𝑇 ) are inputs to the learning of 𝜏𝑚𝑎𝑥 , the upper threshold isalso widens in the positive direction.
From the above, we conclude that the learning of thresholds arepoisoned in both directions. This is an interesting development
because a single poisoning attack type (i.e. deductive) during thetraining can influence both the upper threshold and lower thresholds as shown in Fig. 2(b). This allows for evasion of all attack types
and margins during the test set.

5

MITIGATION UNDER POISONING ATTACKSIn this section, first we give a theoretical intuition of robust learning
under poisoning attacks that include M-estimation and influencefunction. Second, we give theoretical reasoning of our choice ofM-estimator for designing robust empirical loss function by relating
robustness to poisoning with influence function. Third, we propose
a robust learning algorithm for thresholds using M-estimator. Finally, we discuss the learning of hyper-parameters of the robust
learning algorithms. The robust learning mitigates the impact ofthe poisoning attack and it is in invariant of the poisoning attack.

5.1

Theoretical Intuition

We need to design a threshold learning approach that mitigates thelevel of bias induced in the estimate of the standard limits, as a resultof the poisoning attacks. In ordinary L2 regression, the empiricalÍloss function is 𝑖 𝑠𝑖2 , where 𝑖-th is any training data-point 𝑥𝑖 (RUC
in our case), the 𝑠𝑖 is the error residual between the data point anda given candidate estimate 𝑠𝑖 = |𝑥𝑖 − 𝜏 |. The goal is to pick thatcandidate parameter that minimizes the empirical loss function.
To assess the vulnerability of the threshold learning to poisoning
attacks, we require the rate of change in the empirical loss function(estimator) due to a small perturbation in the input data. Any designchange in the learning that triggers a lesser rate of change in theempirical loss function for the same input perturbation, will allow
a more robust estimate of the parameter being learned.
M-Estimator In theoretical robust statistics, the idea of a designchange manifests itself by changing the definition of the loss function. Specifically, this means replacing the empirical loss functionÍÍ
of 𝑖 𝑠𝑖2 in classical regression with 𝑖 𝑀 (𝑠𝑖 ), where 𝑀 (𝑠𝑖 ) is a
special function class known as 𝑀-estimator [15]. These special
functions could be anything depending on the requirement, suchthat formally, we are solving the following𝜏𝑜𝑝𝑡 = arg min
𝜏ˆ

𝑁
 ∑︁

ˆ
𝑀 (𝑠𝑖 , 𝜏)



(9)

𝑖=1

where 𝜏ˆ is the candidate parameter, the 𝜏𝑜𝑝𝑡 is the optimal estimate.
Influence Function (IF) [15] is the derivative of the empiricalloss function (with M-estimators) with respect to the sample inputs.
This influence function gives theoretical insights into measuring
the change in the estimator when sample points (training sample)
are perturbed. Formally, this is defined as:∑︁ 𝜕(𝑀 (𝑠𝑖 ))

(10)
𝜕𝑠𝑖
where 𝑠𝑖 is directly affected by the perturbation of 𝑥𝑖 .
In our paper, we choose two special functions to replace inthe generic M-estimator form; (1) the Huber Loss and the (2)Cauchy/Lorentzian Loss and then analyze their influence functions
compared to L1 and L2 used in regular regression.
𝐼𝐹 =

𝑖

5.2

Robust Loss Function as M-estimator(1) Huber Loss [15] for regression is defined by the following theoretical expression:( 2𝑠
if |𝑠 | <= 𝛽ℎ ;2𝑀ℎ𝑢𝑏𝑒𝑟 (𝑠𝑖 ) =(11)𝛽ℎ2otherwise.
𝛽ℎ |𝑠 | − 2
where 𝑠 denotes the error between the data point and the candidate
parameter, and 𝛽 (ℎ) is the scaling hyperparameter under a Huber
Loss. The Huber loss is a combination of 𝐿1 and 𝐿2 norms as evident from the two conditional equations. For smaller errors, 𝑠 < 𝛽contribute a squared error to empirical loss, while large errors areproportional to the absolute error to the eventual empirical loss.
This causes the Huber loss function to grow quadratically for errors
smaller than 𝛽, and linearly for errors bigger than 𝛽.
(2) Cauchy-Lorentzian Loss [18] is a less well-known loss function
whose mathematical expression is defined as: 𝑠 2
𝑀𝑐𝑎𝑢𝑐ℎ𝑦 (𝑠𝑖 ) = 𝛽𝑐2 log 1 +(12)𝛽𝑐where 𝑠 denotes the corresponding error and the 𝛽𝑐 is the scaling
hyper parameter under Cauchy Loss. Note that Eqn. 12 is a scaled
𝐿2 norm. Since Huber loss has linear growth for large residuals
compared to Cauchy, common logic would suggest using a Huberloss over Cauchy loss for robustness. However, we found a counterintuitive theoretical and experimental result in this case study,
where Cauchy was found to be the better against poisoning attacks.
Now we explain why using Huber and Cauchy for thresholdlearning instead of MSE makes sense under poisoning attacks.
Influence Function Numerical Analysis The Cauchy and Huber
losses are twice-differentiable, symmetric, positive definite. Therefore, by taking the derivative of Cauchy and Huber loss function,
we have the following expressions:𝑠𝑖
if |𝑠𝑖 | ≤ 𝛽ℎ ;𝐼 𝐹𝐻𝑢𝑏𝑒𝑟 =(13)
𝛽ℎ 𝑠𝑔𝑛(𝑠𝑖 ) otherwise.
𝛽 2 (𝑠𝑖 )𝐼 𝐹𝐶𝑎𝑢𝑐ℎ𝑦 = 2𝑐(14)
𝛽𝑐 + 𝑠𝑖 2
Now we use a pictorial description with an illustration in
Figs. 3(a) and 3(b), to explain a key theoretical insight, which plots
the influence function (in y-axis) for varying perturbation strengths
on the RUC set (on the x-axis). We plotted the influence function for
the L2, Huber, and Cauchy using varying perturbations to examine
the rate of change of the influence function in Fig. 3(b). The green
dotted line is the L2 or the MSE loss used in ordinary least squares.
We can see that the rate of change of the IF for L2 is much higher
compared to the other two lines 𝐼 𝐹ℎ𝑢𝑏𝑒𝑟 (blue dotted) and 𝐼 𝐹𝑐𝑎𝑢𝑐ℎ𝑦(orange dotted). Since both 𝐼 𝐹ℎ𝑢𝑏𝑒𝑟 and 𝐼 𝐹𝑐𝑎𝑢𝑐ℎ𝑦 change at a much
lower rate than L2, the difference between them is visually unclear
in Fig. 3(b). Therefore, we redraw just the influence functions of
Huber and Cauchy loss as M-estimator separately in Fig. 3(a). A keyobservation from Fig. 3(a) is at least for this numerical snapshot, theinfluence function of Cauchy changes at a slower rate comparedto the more well-known Huber loss in robust statistics. From thistheoretical insight, we expect that Cauchy will perform better interms of robustness against poisoning attacks compared to Huber
and L2 loss. This we will verify extensively in the test set.

(a)

(b)

Figure 3: Influence Function versus Residual Perturbation(a) Cauchy and Huber IF (b) Cauchy, Huber and 𝐿2 IF

5.3

Robust Learning for Mitigation of Poisoning

Now we propose a modified quantile weighted regression and regular (unweighted) regression with robust loss functions Cauchy and
Huber for learning of the thresholds to mitigate the influence of
poisoning attacks, such that we have 4 new algorithms (a) Quantile
Weighted Regression with Huber Loss (Algorithm 4) (b) Quantile
Weighted Regression with Cauchy Loss (Algorithm 5) (c) Classical (Unweighted) Regression with Cauchy Loss (Algorithm 6); (d)Classical (Unweighted) Regression with Huber Loss (Algorithm 7).

For the algorithms, we only write the pseudocode for learning
the upper threshold 𝜏𝑚𝑎𝑥 . This is because the same process applies
for the learning 𝜏𝑚𝑖𝑛 . For learning 𝜏𝑚𝑖𝑛 everything in the algorithm
is the same except, it runs with inputs 𝑅𝑈𝐶 − (𝑇 ) and parameter 𝜏 − .
For the optimal learning of 𝜏𝑚𝑎𝑥 , the input training samples are
𝑅𝑈𝐶 + (𝑇 ) and the candidate parameter search space is 𝜏 + for eachalgorithm. We start with explaining algorithm 4, which is basedon Huber loss and uses a modified quantile weighted regression(to handle heteroskedasticity). We know that the error is the difference 𝜏 + − 𝑅𝑈𝐶𝑖+ (𝑇 ). The notion of quantile regression mandates
different weights to the errors depending on whether the candidate parameter fit is greater or lesser than the input points. We felt
this is necessary to reduce false alarms because the distribution of
RUC samples is not Gaussian which violates the basic theoreticalassumption of the ordinary least squares regression.
(ℎ)

Algorithm 4 Quantile Weighted with Huber loss (𝜏𝑚𝑎𝑥 )for 𝑅𝑈𝐶 + (𝑇 ), 𝜏 + do
if (𝑅𝑈𝐶 + (𝑇 ) < 𝜏 + ) then𝑆 + : |𝜏 + − 𝑅𝑈𝐶 + (𝑇 )|𝜆𝑐
if (𝑆 + <= 𝛽ℎ ) then
(𝑆 + ) 2 
𝐿𝑠 + :2else(𝛽 ) 2 
𝐿𝑠 + : 𝛽ℎ 𝑆 + − 2ℎend ifelse
𝑆 + : |𝑅𝑈𝐶 + (𝑇 ) − 𝜏 + |𝜆𝑝if (𝑆 + <= 𝛽ℎ ) then
(𝑆 + ) 2 
𝐿𝑠 + :2else(𝛽 ) 2 
𝐿𝑠 + : 𝛽ℎ 𝑆 + − 2ℎend ifend ifend forÍ(ℎ)
𝜏𝑚𝑎𝑥 = arg min𝜏 + 𝑅𝑈 𝐶 + (𝑇 ) |𝐿𝑠 + |We select one candidate 𝜏 + for the upper threshold, then compare whether it is greater or lesser than each point in the set
𝑅𝑈𝐶 + (𝑇 ). If any 𝑅𝑈𝐶 + (𝑇 ) < 𝜏 + , we give it a 𝜆𝑐 weight and calculate the corresponding weighted error denoted as 𝑆 + , otherwise (i.e
𝑅𝑈𝐶 + (𝑇 ) ≥ 𝜏 + ), we give the error a 𝜆𝑝 weight, such that 𝜆𝑝 > 𝜆𝑐 .
To embedding the Huber estimator, for each weighted error 𝑆 + ,we calculate a loss value 𝐿𝑠+ according to the Huber loss depending on whether 𝑆 + is greater or lesser than 𝛽ℎ . Note that, by theabove procedure, we now have an 𝐿𝑠 value for each training data
point in the set 𝑅𝑈𝐶 + (𝑇 ) for a fixed 𝜏 + . Then, the empirical loss
value for a single candidate 𝜏 + is the sum of 𝐿𝑠 values created overeach entry in the set 𝑅𝑈𝐶 + (𝑇 ), which is denoted in the algorithms
Í
as 𝑅𝑈 𝐶 + (𝑇 ) 𝐿𝑠+ . Now each candidate 𝜏 + will generate a uniqueÍ
𝐿𝑠+ . The final optimal estimate is the one 𝜏 + that has the
𝑅𝑈 𝐶 + (𝑇 ) Íminimum 𝑅𝑈 𝐶 + (𝑇 ) 𝐿𝑠+ which is the last line of the algorithm 4.
In a similar manner, we have described algorithm 5, which uses
a Cauchy loss instead of Huber keeping everything else the same.
Therefore, the only thing that is different is the calculation of 𝐿𝑠+from the weighted error 𝑆 + . This is dictated by how Cauchy loss(𝑐)For all results, we kept 𝑤 𝑓 𝑎 = 0.7 and 𝑤𝑚𝑑 = 0.3. The weightassignment is reasoned by the fact that reducing the false alarm is
at least more than half as important. We minimize the joint false
alarm (FA) and missed detection rate (MD) in the cross validation
sets. We use a random search, to find the approximate best choicesof the hyperparameter. We consider this as one potential weakness
in the paper which we will seek to improve in our future work with
an efficient hyper-parameter search technique.

Algorithm 5 Quantile Weighted with Cauchy loss (𝜏𝑚𝑎𝑥 )for 𝑅𝑈 𝐶 + (𝑇 ), 𝜏 + do
if (𝑅𝑈 𝐶 + (𝑇 ) < 𝜏 + ) then𝑆 + : |𝜏 + − 𝑅𝑈𝐶 + (𝑇 )|𝜆𝑐
 + 2
𝐿𝑠 + : (𝛽 𝑐+ ) 2 log 1 + 𝑆𝛽 +𝑐else
𝑆 + : |𝑅𝑈 𝐶 + (𝑇 ) − 𝜏 + |𝜆𝑝 + 2
𝐿𝑠 + : (𝛽 𝑐+ ) 2 log 1 + 𝑆𝛽 +𝑐
end ifend forÍ(ℎ)
𝜏𝑚𝑎𝑥 = arg min𝜏 + 𝑅𝑈 𝐶 + (𝑇 ) 𝐿𝑠 +5.5

mandates the transformation of the residual into a loss value. The(𝑐)
optimal answer is denoted 𝜏𝑚𝑎𝑥 , indicating that the used loss function was Cauchy for learning the threshold.
For the case where there is no asymmetric weights given to theerrors, Algorithms 6 and 7 have been re-written for Cauchy and
Huber respectively using a similar logic. Note that, in each case, weare only learning the bias parameter without the slope, since wewant a fixed time-independent threshold for flagging an anomaly.

Security Evaluation Metrics

Here we explain the two main security evaluation metrics.
Impact of Undetected Attack (I): The effectiveness of integrity
violation is quantified through the impact of the undetected attackon the utility after using our attack and defense [12]. To calculate theimpact of undetected attack per day, we use lost revenue in termsof the unit price of electricity denoted by 𝑅𝑅 which is calculated as:
𝑅𝑅 = (𝛿𝑎𝑣𝑔 ∗ 𝑀 ∗ 𝜂 ∗ 𝐸)/1000(16)

where the 𝜂 = 24 is the number of reports per day, 𝐸 = $0.12 is theaverage per unit (KW-Hour) cost of electricity in USA, 𝛿𝑎𝑣𝑔 is themargin of false data in test set, 𝑀 is the number of compromised
smart meters in the test set. The impact of undetected attack is:
𝐼𝑚𝑝𝑎𝑐𝑡 = 𝑅𝑅 ∗ 𝑇𝑑𝑒𝑡𝑒𝑐𝑡(17)

𝑇𝑑𝑒𝑡𝑒𝑐𝑡 is the time difference between attack start and end of test
set in days. The lesser the impact, the better the performance.
Expected Time between Consecutive False Alarms: The expected
time between two false alarms 𝐸𝑇𝐹 𝐴 is a recent NIST [12] recommended metric for time series anomaly detection:(𝑐)

Algorithm 6 Regular Regression with Cauchy loss (𝜏𝑚𝑎𝑥 )for 𝑅𝑈 𝐶 + (𝑇 ), 𝜏 + do

𝑆 + : |𝜏 + − 𝑅𝑈 𝐶 + (𝑇 ) | + 2
𝐿𝑠 + : (𝛽 𝑐+ ) 2 log 1 + 𝑆 +𝛽𝑐Í

end forÍ(𝑐 )𝜏𝑚𝑎𝑥 = arg min𝜏 + 𝑅𝑈 𝐶 + (𝑇 ) log 𝐿𝑠 +𝐸𝑇𝐹 𝐴 =

(𝑐)for 𝑅𝑈 𝐶 + (𝑇 ), 𝜏 + do
if (𝑆 + <= 𝛽ℎ ) then
(𝑆 + ) 2 
𝐿𝑠 + :
2(ℎ)

𝜏𝑚𝑎𝑥 = arg min𝜏 +5.46(𝛽ℎ ) 2 
2

𝐿𝑠 + : 𝛽ℎ 𝑆 + −end ifend forÍ

𝑅𝑈 𝐶 + (𝑇 ) |𝐿𝑠 + |Learning Hyperparameters

Now we discuss about selection of the scaling hyperparameterof the loss functions, 𝛽𝑐 , 𝛽ℎ , the hyperparameter of the weighted
quantile regressor namely 𝜆𝑐 and 𝜆𝑝 over a cross validation set. The
search space of 𝛽𝑐 and 𝛽ℎ is bounded between 0 and the extremum
in the set of 𝑆 + or 𝑆 − and the 1 > 𝜆𝑝 > 𝜆𝑐 > 0.
We partitioned the 2016 dataset’s first three months and used
several values of 𝛽 scaling hyperparameter whose feasible range isdictated by the feasible range of errors (i.e. |𝑅𝑈𝐶 − 𝜏 |) as discussed
in the previous subsection. We tried several combinations of 𝛽 ineach partition and picked the best one in each partition by using
the following objective in Eqn. 15 and then took the average.
arg min (𝑤𝑚𝑑 𝑀𝐷 + 𝑤𝑓 𝑎 𝐹𝐴)
𝛽𝑐+ ,𝛽𝑐− ,𝜆𝑐 ,𝜆𝑝(18)

where 𝜂 𝐹𝐴 is the number of false alarms and the 𝑇𝐵𝐹𝐴 is the time
gap between any pair of consecutive false alarms. If there is one
false alarm, then this equation does not exist, and instead of 𝐸𝑇𝐹 𝐴
is 364. The logic is that another false alarm is likely to be seen in ayear. The lesser the 𝐸𝑇𝑓 𝑎 , the worse is the performance.

Algorithm 7 Regular Regression with Huber loss (𝜏𝑚𝑎𝑥 )else𝜂 𝐹 𝐴 𝑇𝐵𝐹 𝐴

𝜂𝐹 𝐴 − 1(15)

EXPERIMENTAL EVALUATION

For the experimental evaluation, a real AMI (Advanced Metering Infrastructure) data set from the Pecan Street project [19] containing
power consumption records for 200 smart meters for three years(2014,2015,2016) is used. These smart meters records are divided
into three parts for training, cross-validation, and testing. The training data contains all the records from the years 2014 and 2015 as
was the case in previous work [1] to keep a fair performance. The
remaining records from the year of 2016 data are divided into twoparts for cross-validation and testing. From the year 2016, all therecords within the first three months are used for cross-validation
the remaining records from the later 9 months are used as thetest set. The hyperparameter 𝛽𝑐 and 𝛽ℎ are learned through crossvalidation which are equal to 0.0002 and 0.0001 respectively.
Rest of this section is divided into two subsections: 1) RSL 2)
FGAV. Under RSL, for each loss function and regression type, wemeasure the performance in terms of an Impact of Undetected
Attack as a function of the following attack variables: 1) Poisoning𝑝𝑡𝑒 3) Attack
Attack Strength 𝛿𝑎𝑣𝑔 ; 2) Evasion Attack Strength 𝛿𝑎𝑣𝑔
Scale 𝜌𝑚𝑎𝑙 and offer conclusions.

Similarly, under FGAV, the performance for different loss function and regression type in terms of Impact of Undetected attack ismeasured considering the following variables: 1) Poisoning Margin
𝑡𝑒 and 3) Attack Scale 𝛼𝜖 2) Evasion Attack Strength 𝛿𝑎𝑣𝑔
𝑚𝑎𝑥 , 𝜌𝑚𝑎𝑙 .
We also compare the expected time between false alarms for different methods. Additionally, we report the expected time between
two false alarms when there are no poisoning attacks at all.

Next we vary the evasion strength to assess performance. In
Fig. 4(b), we observe that across various evasion attack strengths,
the QC is lower in impact than all other loss function choices. The(𝑝)poisoning attack strength is 𝛿𝑎𝑣𝑔 = 200 and scale is 𝜌𝑚𝑎𝑙 = 0.50 for
Fig. 4(b).

Table 2: Acronyms for Design Choices
Acronym
QC
QH
NQC
NQH
L1
L2

6.1

Regression
Quantile
Quantile
Regular
Regular
Quantile
Quantile

Loss Function
CauchyHuber
Cauchy
Huber
MAE
MSE

Experimental Validation under RSL
Poisoning

RSL Poisoning Implementation Details: For RSL poisoning attack,𝑝

we varied poisoning margin 𝛿𝑎𝑣𝑔 between 50 − 300 and varied𝑝𝜌𝑚𝑎𝑙 between 20%-70% and the RSL attack duration was between
1st Apr-30th June, 2014.
RSL Evasion Implementation Details: To investigate performance inthe test set, we crafted attacks with varying percentage of meters(𝑡𝑒)𝑡𝑒 . The combinations
𝜌𝑚𝑎𝑙 , and varying data perturbation margin 𝛿𝑎𝑣𝑔
were selected such that none of the attacks violate the learned
standard limit to get the impact of an undetected attack. In the test(𝑡𝑒)𝑡𝑒 between 10-400,
set, we varied 𝜌𝑚𝑎𝑙 between 20%-70%, and 𝛿𝑎𝑣𝑔
which cover a wide range of attack intensities.
To remove bias in performance, we launched evasion attacks
on three distinct time frames in the year 2016, each of length 90
days separately. The reported IMPACT (USD) in every result is theaverage impact of undetected attack per 90 day frame, across threeattack time frames.
Performance evaluation of Robustness: For comparative performance evaluation, we compare all loss function choices with 2groupings (a) within quantile weighted regression and (b) within
unweighted regression. We pick the best performing loss function
from each group and then compare their performance to finallyconclude which loss function type and what regression type is mostrobust for a given attack.
The performance is measured in terms of the mean impact of
undetected attack per 90 days (𝐼 ) (when there is an evasion attackin the test set) and the expected time between false alarms (𝐸𝑇𝑓 𝑎 )(when there is no attack throughout the test set).
The impact of an undetected attack is affected by two things;(i) the poisoning attack strength (ii) the evasion attack strength
required to remain undetected. Therefore, we use the above two
attack parameters to measure the sensitivity of the impact of undetected attacks across various loss functions and regression choices.
6.1.1 Impact Within Quantile Regression Group: Here, we discuss the loss function choices but with the asymmetric weighingof positive versus negative residuals. Fig. 4(a), indicates that across(𝑝)
all possible poisoning attack strengths 𝛿𝑎𝑣𝑔 , the QC is either equal
to or lower in attack impact across all loss function choices. The(𝑡𝑒)evasion attack strength used is 𝛿𝑎𝑣𝑔 = 100 and scale is 𝜌𝑚𝑎𝑙 = 0.60.

(a)

(b)

Figure 4: Impacts under Quantile Regression:(a) Varying Poisoning Attack Strength (b) Varying Evasion Attack Strength
6.1.2 Within Ordinary Regression Group: Here, we discuss theloss function choices but with no weighing difference between
positive versus negative residuals. Fig. 5(a), indicates that across(𝑝)
all possible poisoning attack strengths 𝛿𝑎𝑣𝑔 , the NQC (unweighted
Cauchy Loss) is either equal to or lower in impact than NQH . The(𝑡𝑒)evasion attack strength is 𝛿𝑎𝑣𝑔 = 150 and scale is 𝜌𝑚𝑎𝑙 = 0.40. In
contrast, Fig. 5(b), indicates that across all possible evasion strengths(𝑡𝑒)𝛿𝑎𝑣𝑔 , the NQC either is lower in impact than NQH. The poisoning(𝑝)

attack strength is 𝛿𝑎𝑣𝑔 = 200 and scale is 𝜌𝑚𝑎𝑙 = 0.50 for this figure.

(a)

(b)

Figure 5: Impacts under Ordinary Regression: (a) Varying Poisoning Attack Strength (b) Varying Evasion Attack Strength
6.1.3 Final Performance and Recommendation: We compare thewinning loss function under quantile regression and regular regression and compare it here. We find that the regular version of Cauchy
is better in terms of minimizing the impact of an undetected attack.
However, this comes at a cost of increased false alarms.

(a)

(b)

Figure 6: Quantile versus Regular Regression with Cauchy
Loss: (a) Poisoning Strength (b) Evasion Strength
Fig. 6(a) shows that the impact of NQC is either equal or lower𝑝than the impact of QC for varying poisoning strength 𝛿𝑎𝑣𝑔 for a𝑡𝑒 = 150 and 𝜌
representative evasion attack with 𝛿𝑎𝑣𝑔
𝑚𝑎𝑙 = 0.30. Similarly, Fig. 6(b), shows either equal or lower impact as performancefor NQC than the impact of QC for varying evasion attack for a𝑝representative poisoning attack with 𝛿𝑎𝑣𝑔 = 130 and 𝜌𝑚𝑎𝑙 = 0.50.
The results clearly indicates that NQC loss function outperforms
all other loss functions in terms impact of undetected.

6.1.4 Effect of Varying Attack Scale: Our intention, here is to
double-check whether and how the previous conclusions are affected by changing attack scale. We want to check whether any andhow the above conclusions are changed if you change the 𝜌𝑚𝑎𝑙 .

(a)

(b)

Figure 7: Impact versus Attack Scale: (a) QR (b) NQR
Fig. 7(a), shows that the QC is either equal to or lower in impact than all other loss functions.Similarly,Fig. 7(b), shows that the
NQC is either equal to or lower in impact than NQH. For both(𝑝)
Fig 7(a),Fig. 7(b), the poisoning attack strength is 𝛿𝑎𝑣𝑔 = 100𝑊 andthat exploits the transformed low-dimensional input from a timeseries to replicate poisoning similar in principal with image attacks.
FGAV Evasion Implementation Details: To investigate performancein the test set, we crafted attacks following the similar process used
for RSL evasion attack implementation described in 6.1.
Performance evaluation of Robustness: The comparative robustnessof different loss functions depends on the impact of undetected 𝐼
and the expected time between false alarm 𝐸𝑇𝑓 𝑎 just like the RSL
scheme. However, here the impact of undetected attack is affectedby two things; (i) the poisoning attack strength (𝜖) (ii) the evasion
𝑡𝑒 ). We show the robustness for three different
attack strength (𝛿𝑎𝑣𝑔
poisoning attack scales which depends on the number of perturbed
residual inputs 𝛼𝑚𝑎𝑥 .
6.2.1 Small number perturbations (SS):. In this section, the performances in terms of the impact of undetected are measured andcompared when the number of inputs that can be perturbed by theadversary is bounded by a small number.
Impact vs Poisoning Strength (𝜖): Fig 8(a) is showing that the
impact of QC is either equal to or lower than the impact of all otherloss functions. Similarly, Fig. 8(b), is showing that the impact of
NQC is either equal to or lower in impact than NQH. For Fig 8(a),𝑡𝑒 = 100, andthe parameters have values such as 𝛼𝑚𝑎𝑥 = 4, 𝛿𝑎𝑣𝑔
𝜌𝑚𝑎𝑙 = 0.30. Also, In Fig. 8(b), the parameters have values such as
𝑡𝑒 = 80, and 𝜌
𝛼𝑚𝑎𝑥 = 4, 𝛿𝑎𝑣𝑔
𝑚𝑎𝑙 = 0.30

(𝑡𝑒)the evasion strength is 𝛿𝑎𝑣𝑔 = 120𝑊 .
6.1.5 Expected Time Between False Alarm (RSL). To measure theexpected time between false alarms, we used the annual base rateof false alarms with no attacks throughout the year of 2016 in thetest set. This is because it is worst in total absence of any attack.
Table 3 presents the expected time between false alarm for different
loss functions in the presence of RSL poisoning attack.
(a)
Empirical Loss

𝐸𝑇𝑓 𝑎

L1
L2
QC
QH
NQC
NQH

334.29364.65115.21
313.84103.53253.01

Table 3: Expected Time between False Alarm: RSL Poisoning(b)

Figure 8: (SS): Impact 𝐼 vs 𝜖: (a) Quantile Regression (b) Unweighted Regression
𝑒 : This section presents how the perImpact versus Evasion 𝛿𝑎𝑣𝑔

formances of each of the loss functions are affected for varying
evasion attack for fix poisoning strength.

Conclusion We conclude that Cauchy is the best loss function
from the perspective of impact mitigation when poisoning happens.
The non-quantile version of Cauchy is better in terms of minimizing
the impact of undetected attacks but is worse in terms of false alarm
performance (103 days) compared to the Quantile version of Cauchy(115 days). The conclusions match with the theoretical intuition.

6.2

Experimental Validation under FGAV
Poisoning

FGAV Poisoning Implementation Details: In the FGAV poisoning attack scheme, we applied perturbation 𝜖, (bounded by the maximum
RUC value in the training set) and the number of perturbed points
bounded by 𝛼𝑚𝑎𝑥 . We introduce perturbation according to Algorithm 2 for Small Scale (SS) and Medium Scale (MS) Perturbation
and Algorithm 3 for Large Scale (LS) perturbation, where scale depends on the value of 𝛼𝑚𝑎𝑥 . This is a time agnostic attack scheme

(a)

(b)

Figure 9: SS: Impact 𝐼 vs Evasion Strength (a) All Quantile
Regression (b) Ordinary Regression
Fig 9(a) is showing that the impact of QC is either equal toor lower than the impact of all other loss functions. Similarly,
Fig. 9(b), is showing that the impact of NQC is either equal toor lower in impact than NQH. For both Fig 9(a),Fig. 9(b), the parameters have values such as 𝛼𝑚𝑎𝑥 = 4,𝜖 = 0.0156, and 𝜌𝑚𝑎𝑙 = 0.60
Quantile Vs Non-Quantile: Here,the winner of the quantile loss

functions and the winner of the non-quantile loss function are compared to get the ultimate winner in terms of impact of undetected.

(a)other loss functions. Similarly, Fig. 12(b), is showing that the impact of NQC is either equal to or lower in impact than NQH.
For both Fig 12(a),Fig. 12(b), the parameters have values such as
𝛼𝑚𝑎𝑥 = 12,𝜖 = 0.00485, and 𝜌𝑚𝑎𝑙 = 0.30
Quantile versus Non-Quantile Here, the winner of the quantile
loss functions and the winner of the non-quantile loss functions
are compared to get the ultimate winner in terms of the impact of
undetected.

(b)

Figure 10: SS: Quantile versus Regular Regression with
Cauchy Loss (a) Poisoning Attack(b) Evasion attack
Fig 10(a) shows that impact of NQC is either equal or lower
𝑡𝑒 = 70,
than the impact of QC for varying 𝜖 with evasion attack 𝛿𝑎𝑣𝑔
𝛼𝑚𝑎𝑥 = 4, and 𝜌𝑚𝑎𝑙 = 0.40. Similarly, Fig 10(b) indicates that the
impact of NQC is either equal or lower than the impact of QC forvarying evasion attack with 𝛼𝑚𝑎𝑥 = 4,𝜖 = 0.00060 and 𝜌𝑚𝑎𝑙 = 0.40.
6.2.2 Medium number perturbations (MS):. We measure performance for different loss functions in terms of impact when theadversary has access to more input points that he can exploit to
introduce perturbation than Case 1.
Impact vs Poisoning Strength (𝜖): Fig 11(a) is showing that the
impact of QC is either equal to or lower than the impact of all otherloss functions. Similarly, Fig. 11(b), is showing that the impact of
NQC is either equal to or lower in impact than NQH. For Fig 11(a),𝑡𝑒 = 90, andthe parameters have values such as 𝛼𝑚𝑎𝑥 = 10, 𝛿𝑎𝑣𝑔
𝜌𝑚𝑎𝑙 = 0.30. Also, In Fig. 11(b), the parameters have values such as
𝑡𝑒 = 80, and 𝜌
𝛼𝑚𝑎𝑥 = 16, 𝛿𝑎𝑣𝑔
𝑚𝑎𝑙 = 0.40

(a)

(a)

(b)

Figure 13: MS: Impact of Quantile versus Regular Regression
with Cauchy Loss (a) Poisoning Attack (b) Evasion attack
Fig 13(a) shows that impact of NQC is either equal or lower
𝑡𝑒 = 80,than the impact of QC for varying 𝜖 with evasion attack 𝛿𝑎𝑣𝑔
𝛼𝑚𝑎𝑥 = 16, and 𝜌𝑚𝑎𝑙 = 0.40. Similarly, Fig 13(b) indicates that the
impact of NQC is either equal or lower than the impact of QC forvarying evasion attack with 𝛼𝑚𝑎𝑥 = 16,𝜖 = 0.0036 and 𝜌𝑚𝑎𝑙 = 0.30.
6.2.3 Large number perturbations (LS):. In this section the performance, when an adversary can perturb a large number of input
points utilizes Algorithm 3 of the FGAV attack.
Impact vs Poisoning Strength (𝜖): Fig 14(a) is showing that the
impact of QC is either equal to or lower than the impact of all otherloss functions. Similarly, Fig. 14(b), is showing that the impact of
NQC is either equal to or lower in impact than NQH. For Fig 14(a),𝑡𝑒 = 60, andthe parameters have values such as 𝛼𝑚𝑎𝑥 = 32, 𝛿𝑎𝑣𝑔
𝜌𝑚𝑎𝑙 = 0.40. Also, In Fig. 14(b), the parameters have values such as
𝑡𝑒 = 20, and 𝜌
𝛼𝑚𝑎𝑥 = 28, 𝛿𝑎𝑣𝑔
𝑚𝑎𝑙 = 0.20(b)Figure 11: (MS:) Impact 𝐼 for varying poisoning 𝜖 (a) Quantile
Regression (b) Ordinary Regression
𝑒 : Fig 12(a) is showing that the imImpact versus Evasion 𝛿𝑎𝑣𝑔
(a)

(b)

Figure 14: (LS): Impact 𝐼 vs poisoning strength 𝜖 (a) All Quantile Regression (b) Ordinary Regression
𝑒 : This section will show the comImpact versus Evasion 𝛿𝑎𝑣𝑔

(a)

(b)

Figure 12: MS: Impact 𝐼 for Evasion Strength (a) All Quantile
Regression (b) Ordinary Regression
pact of QC is either equal to or lower than the impact of allpared performances under varying evasion attack. Fig 15(a) is showing that the impact of QC is either equal to or lower than the impactof all other loss functions. Similarly, Fig. 15(b), is showing that the
impact of NQC is either equal to or lower in impact than NQH.
For both Fig 15(a),Fig. 15(b), the parameters have values such as
𝛼𝑚𝑎𝑥 = 32, 𝜖 = 0.00035, and 𝜌𝑚𝑎𝑙 = 0.40
Quantile versus Regular Here, the winner of the quantile loss
functions and the winner of the non-quantile loss function arecompared to get the ultimate winner in terms of the impact.

Empirical Loss

𝐸𝑇𝑓 𝑎

L1
L2
QC
QH
NQC
NQH

364.0
364.0
45.5
364.0
45.5
45.5

Table 5: False Alarm Performance: No Poisoning Attacks

(a)

7

(b)

Figure 15: LS: Impact vs Evasion Strength for loss functions(a) All Quantile Regression (b) Ordinary Regression

(a)

(b)

Figure 16: LS: Quantile vs Regular Regression with Cauchy
Loss across (a) Poisoning Strength (b) Evasion Strength
Fig 16(a) shows that impact of NQC is either equal or lower
𝑡𝑒 = 20,than the impact of QC for varying 𝜖 with evasion attack 𝛿𝑎𝑣𝑔
𝛼𝑚𝑎𝑥 = 40, and 𝜌𝑚𝑎𝑙 = 0.20. Similarly, Fig 16(b) indicates that the
impact of NQC is either equal or lower than the impact of QC forvarying evasion attack with 𝛼𝑚𝑎𝑥 = 32,𝜖 = 0.00060 and 𝜌𝑚𝑎𝑙 = 0.40.
Considering the similarity in each cases,it is evident that NQC is
recommended in terms of the impact of undetected performances.
6.2.4 Expected Time Between False Alarm for FGAV:. Table 4shows the effective time between false alarm for different methods
in the presence of FGAV poisoning attack.
Empirical Loss

Avg.𝐸𝑇

L1
L2
QC
QH
NQC
NQH

337.47364.35247.66309.66244.36257.09

𝑓𝑎

SS 𝐸𝑇

𝑓𝑎

MS 𝐸𝑇

364.20364.44304.02364.02303.93304.00364.20364.42304.02304.02257.95287.67

𝑓𝑎

LS 𝐸𝑇

𝑓𝑎

340.10364.30258.43303.70257.95258.43

Table 4: False Alarm Performance: FGAV Poisoning

6.3

Expected Time between False Alarm
without Poisoning

Table 5 shows the expected time between false alarm results when
there is no poisoning; and also there is no evasion attack during
testing. It shows that the use of robust loss function comes with aprice of increased false alarm. The base rate probability of occurrence of a poisoning attack is not high. Therefore, while deploying
a model with robust loss function this trade-off must be considered
and the weights during the cross validation may be tuned according
to the needs of a provider.
Conclusions on FGAV: We find similar patterns as RSL. The
cauchy non-quantile is best in terms of impact robustness. The
use of non-quantile causes slightly worse false alarm performancefor all FGAV cases, which matches with our theoretical intuition.

CONCLUSIONSIn this paper, we showed two ways of poisoning anomaly-based attack detectors for smart metering infrastructure and compared theireffects. The use of L1 norm instead of the L2 norm (i.e., OLS regression) for threshold learning, gives some protective effect against
FGAV. This is because the L1 norm induces an effect called gradientshattering which does not allow the calculation of accurate gradients. We verified this in the experimental section where we showedthat the impact of poisoning attacks for L2 norm is greater than L1
norm. We proposed threshold learning for anomaly detection withrobust loss function under quantile and unweighted regression. We
analyzed security performance with impact of undetected attacks
and expected time between false alarms. For impact robustness, wefound that the Cauchy is the better loss function choice than more
known Huber loss. Accounting for base rate expected time between
false alarms, we found that the quantile weighted regression is abetter choice than regular regression.
Acknowledgements: The research was supported by USA’s
NSF grants, OAC-2017289 and SATC-2030611.

REFERENCES[1] S. Bhattacharjee, S.K. Das, “Detection and Forensics against Stealthy Data Falsification in
Smart Metering Infrastructure", IEEE Trans. of Dependable and Secure Computing, Vol. 18, Jan.
2021.
[2] S. Bhattacharjee, P. Madhavarapu, S. Silvestri, S. K. Das, “Attack Context Embedded Data
Driven Trust Diagnostics in Smart Metering Infrastructure" ACM Transactions on Privacy andSecurity, Apr. 2021.
[3] D. Urbina, J. Giraldo, A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal, J. Ruths, R. Candelland H. Sandberg, “Limiting the Impact of Stealthy Attacks on Industrial Control Systems",
ACM CCS), pp. 1092-1105, 2016.
[4] P. Roy, S. Bhattacharjee, S.K. Das, “Real Time Stream Mining based Attack Detection inDistribution Level PMUs for Smart Grid", IEEE Globecomm 2020.
[5] S. Bhattacharjee, A. Thakur, S.K. Das, “Towards Fast and Semi-Supervised Identification of
Smart Meters launching Data Falsification", ACM Asia CCS, 2018.
[6] M. Wilbur, A. Dubey, B. Leao, S. Bhattacharjee, “A Decentralized Approach For Real Time
Anomaly Detection In Transportation Networks , IEEE SMARTCOMP), 2019[7] I. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples",ICLR, 2015.
[8] A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” ICLR 2017.
[9] F. Tramer, A. Kurakin, N. Papernot, I. Goodfellow, D. Boneh, P. McDaniel, “Ensemble adversarial
training: Attacks and defenses," ICLR 2018.
[10] P. Roy, S. Bhattacharjee, S.K. Das, “Real Time Stream Mining based Attack Detection inDistribution Level PMUs", IEEE GLOBECOM, Dec. 2020.
[11] D. Urbina, J. Giraldo, A. A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal, R. Candell, H.
Sandberg, “Limiting the Impact of Stealthy Attacks on Industrial Control Systems" ACM CCS,
2016.
[12] D. Urbina, J. Giraldo, A. A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal, J. Ruths, R. Candell, H.
Sandberg, “Survey and New Directions for Physics-Based Attack Detection in Cyber-Physical
Systems", ACM Computing Surveys, Vol. 51(10), 2018.
[13] G. Jiraldo, A. Cardenas, “ Adversarial Classification under Differential Privacy", NDSS, 2020.
[14] N. Dalvi P. Domingos, M. Mausam, S. Sanghai, D. Verma “Adversarial Classification" ACM
SIGKDD, 2004.
[15] P. Huber, E. Ronchetti, “Robust Statistics", Wiley Probability and Statistics, ISBN 978-0470129906,
Feb. 2009.
[16] M. Jaglieski, A. Oprea, C. Liu, C. Rotaru, B. Li, “Manipulating Machine Learning: Poisoning
Attacks and Countermeasures for Regression Learning", IEEE S & P Oakland, 2018.
[17] A. Ghafouri, Y. Vorobeychik, X. Koutsoukos, “Adversarial Regression for Detecting Attacks in
Cyber-Physical Systems" IJCAI, 2018.
[18] X. Li, Q. Lu, Y. Dong and D. Tao, “Robust Subspace Clustering by Cauchy Loss Function," IEEE
Transactions on Neural Networks and Learning Systems, Vol. 30(7), pp. 2067-2078, 2019.
[19] [Online] Pecan Street Project Dataset https://www.pecanstreet.org/[20] [Online] https://www.globalsign.com/en/blog/cyber-autopsy-series-ukranian-power-gridattack-makes-history