Bayesian Regression for Robust Power Grid State
Estimation Following a Cyber-Physical Attack
Saleh Soltan, Prateek Mittal, H. Vincent Poor
Department of Electrical Engineering
Princeton University, Princeton, NJ
Emails: {ssoltan,pmittal,poor}@princeton.edu

Abstract—Improving the power grid’s security against cyberphysical attacks has been a major challenge for the power
grid operators since the cyber attack on the Ukrainian gridin Dec. 2016. In order to partly address this challenge, we
study the problem of power grid state estimation following suchan attack. We assume that an adversary attacks an area by
disconnecting some lines within the attacked area and blocking
the measurements coming from inside the attacked area fromreaching the control center in order to mask the failed lines.
The objective is to use the phase angle measurements before andpartial measurements after the attack to detect the failed lines.
Despite recent efforts, there is no method that is both efficientand robust for estimating the state of the grid after such an
attack in practical noisy settings. In this work, we provide sucha method using Bayesian regression. Bayessian regression allows
us to determine the probability that each line is failed, instead of
a 0-1 hard decision on the status of the lines. These probabilities
reflect the uncertainty in the detection, depending on the noiselevel. We show that these probabilities can further be used to limit
the search space and significantly improve the running time ofthe existing brute force search methods for failed lines detection.

I. I NTRODUCTION
In this paper, we provide a novel application of Bayesiandata analysis for power grid state estimation. By the state of
the grid, we mean both its topological and operational states.
We focus on the state estimation following a cyber-physicalattack that has gained a lot of attention [1], [2], [3], [4], [5]since the Dec. 2016 cyber attack on the Ukrainian grid [6].
Although, here, we mainly focus on the scenarios caused byattacks, similar scenarios can result from natural disasters or
the lack of enough measurement devices. So the provided
methods have broad applicability for grid state estimation.
We follow [1] and assume that an adversary attacks anarea by disconnecting some lines within the attacked area andblocking the measurements coming from inside the attacked
area from reaching the control center in order to mask the
failed lines. The objective is to use the phase angle measurements before and partial measurements after the attack
to detect the failed lines. Detecting failed lines is necessary
for obtaining a correct understanding of the grid topology andestimating the power flows on the lines after the attack.
This problem is thoroughly studied in [1] in the noise-freeand low-noise settings. However, the previous work provides
little insight on how to deal with the noisy measurements andThis work is supported by DARPA RADICS under contract #FA-8750-16C-0054. We also thank Ghazal Fazelnia for her helpful insights and comments.

inconsistency in power supply/demand. In this work, we adapt
the convex relaxation of the failed lines detection problem
provided in [1] and use Bayesian regression [7] to detect
failed lines probabilistically based on noisy measurements.
We follow the Bayesian Regression with Automatic Relevance
Determination (ARD) model provided in [8]. The Bayesian
approach provides the probability that each line is failed,instead of 0-1 hard decision on the status of the lines, whichreflects the uncertainty in the detection caused by the noise.
These probabilities can further be used in two ways: (i)turn them into 0-1 hard decisions by considering a probability
threshold p and detect all lines with probability of being
failed greater than p as failed, and (ii) use them to limit the
search space in the Brute Force Search (BFS) type methods
by considering only lines with the high probability of being
failed. We numerically compare these two approaches withthe method provided in [1] as well as the BFS based methods
provided in [9], [10], in the IEEE 300-bus system. We showthat the second approach provides accuracy similar to (andsometimes better than) the BFS method but in an exponentiallyfaster running time (e.g., in an attacked area with 15 lines, itruns 40 times faster). Hence, by combining the probabilities
obtained by the Bayesian regression with the BFS, it reaches
a sweet spot in accuracy and efficiency.
II. M ODEL AND P RELIMINARIES
A. DC Power Flow Model
We use the linearized DC power flow model, which is
widely used as an approximation for the non-linear AC power
flow model in studying vulnerabilities of power grids. We
represent the power grid by a connected undirected graph
G = (V, E) where V = {1, 2, . . . , n} and E = {e1 , . . . , em }are the set of nodes and edges corresponding to the buses andtransmission lines, respectively. Each edge ei = {u, v} ∈ E
is characterized by its reactance xuv = xvu = xei .
Given the power supply/demand vector p~ ∈ R|V | and thereactance values, a power flow is a solution f~ ∈ R|E| and θ~ ∈R|V | of: Aθ~ = p~ and BDt θ~ = f~, where D ∈ {−1, 0, 1}|V |×|E|
is the incidence matrix of G defined as,
if ej is not incident to node i,0dij = 1
if ej is coming out of node i,−1 if ej is going into node i,B := diag([1/xe1 , 1/xe2 , . . . , 1/xem ]) is a diagonal matrix
with diagonal entries equal to the inverse of the reactancevalues, and A ∈ R|V |×|V | is the admittance matrix of G
defined as A := DBDT .
Notation. If X, Y are two subgraphs of G, AX|Y denotes
the submatrix of A with rows from X and columns from Y .
For any matrix C, CT denotes its transpose and C+ denotesits
a vector ~y , k~y k1 :=PnMoore-Penrose pseudo-inverse.PFor
n
2 1/2
|y
|
is
its
l
-norm,k~yk:=(
is its l2 -norm,
i
1
2
i=1
i=1 yi )and supp(~y ) := {i|yi 6= 0} is its support.
B. The Attack Model
We follow [1] and assume that an adversary attacks an area
H = (VH , EH ) (representing a subgraph of G) by disconnecting some lines within the attacked area, referred to as
failed lines and denoted by F , and blocking the measurements
coming from inside the attacked area to mask the status of thelines in H. Hence, after the attack, the phase angles of thenodes and the status of the lines in H become unavailable
to the control center. The objective is to use the phase angle
measurements before and partial measurements after the attack
to detect the failed lines. Detecting failed lines is necessary
for obtaining a correct understanding of the grid topology andestimating the power flows on the lines after the attack, andfor executing an effective control algorithm (e.g., power grid
intentional islanding or load shedding) in order to stop theinitial attack from affecting the entire grid through cascade of
failures and causing a major blackout.
We use the prime symbol (0 ) to denote the values after anattack. For example A0 and θ~ 0 denote the admittance matrix
and phase angle of the nodes after the attack. We denote thecomplement of the attacked area H by H̄ = G\H. θ~ H andθ~ H̄ are the vectors of phase angles of the nodes in H and H̄,respectively. Without loss of generality, we also assume that
EH = {e1 , e2 , . . . , e|EH | }.
Using this notation, we assume that the control center
receives T noisy measurements θ~ (1) , θ~ (2) , . . . , θ~ (T ) for thephase angles of the nodes
in0 the grid before
the attack, and T
0
0
(T )
(1)
(2)
noisy measurements θ~ H̄ , θ~ H̄ , . . . , θ~ H̄ for the phase anglesof the nodes outside of the attacked area after the attack. The T
measurements are from different but very close time intervals(e.g., within microseconds). The measurements after the attack
are assumed to be associated with the time that the system has
been stabilized after the attack.
The noise corresponds to the measurement noise as well as
fluctuations in the supply/demand vector p~. We assume thateach measurement θ~ (i) = θ~ + ~e, in which ~e ∼ N (0, βI) has amultivariate Gaussian distribution with a zero mean and a diagonal covariance matrix βI, and Aθ~ = p~. We
assume the same0(i)for the measurements after the attack, θ~ H̄ = θ~ 0H̄ + ~eH̄ , inwhich ~eH̄ ∼ N (0, βIH̄ ), and A0 θ~ 0 = p~. To measure the noiselevel, we define the Signal to Noise Ratio (SNR) basedon thepphase angles before the attack as 20 log10 (kθ~ k2 / |V |β).
One way of using the T measurements is P
to take averageof these vectors. Hence, we define θ~ (µ) := ( i θ~ (i) )/T and0
P 0 (i)(µ)θ~ H̄ := ( i θ~ H̄ )/T .

C. Bayesian Regression
Given a data set D = {X, Y}, with X = [~x1 , . . . , ~xn ] ∈Rd×n and Y = [y1 , . . . , yn ] ∈ Rn×1 , in linear regression,
we are interested in finding a vector w~ ∈ Rd that minimizes
Tkw~ X−Yk2 . Such a vector w~ determines the relation between
in the input vectors X and outputs Y.
The linear regression provides very little information on
the uncertainties in the computed vector w,~ specially when
Y is noisy. One way of overcoming this issue is by adapting
the Bayesian approach to regression [7]. In the Bayesian
regression, instead of finding the maximum likelihood estimate
for a vector w~ that describes the relationship between the
inputs and the outputs, we are interested in computing aprobability distribution on all possible vectors w~ that describe
this relationship. This can be done by computing the posterior
distribution on w
~ using Bayes’ rule, by assuming a priordistribution on w
~ and an appropriate model for the way output
data is related to the input. Due to the space constraints, forfurther details on Bayesian Regression see [7, Section 3.3].
Some sparsity constraints on the coefficients, as in the Lasso
regression [7], can also be obtained in Bayesian regression byappropriate choice of the prior for the coefficients. In particular, in this paper, we follow the Bayesian Regression with
Automatic Relevance Determination (ARD) model provided
in [8]. This model assumes a linear relation between inputs~x and outputs y, and constant-variance Gaussian noise, suchthat the likelihood is given by τ 1/2  τ
exp − (y−w
~ T ~x)2 ,P(y|~x, w,~ τ ) = N (y|w
~ T ~x, τ −1 ) =2π
2−1and the prior on w,~ τ
is conjugate normal inverse-gammaP(w,~ τ |~α) = N w|0,
~ (τ diag(~α))−1 Gam(τ |a0 , b0 ),where diag(~α) is a diagonal matrix with entries given byvector α~ = [α1 , . . . , αd ]. The entries ofQα
~ are independentand the hyper-prior is given by P(α) = i Gam(αi |c0 , d0 ).
Under this model, analytically computation of the posterior
distribution P(w,~ τ, α~ |D) is intractable. Hence, in [8] the
Variational Inference approach is used to approximate theposterior distribution (for further details on how to computew~ n , Vn , an , bn see [8])
Q(w,
~ τ)

= N (w|~w~ n , τ −1 Vn )Gam(τ |an , bn ).

(1)

In Section IV, we use this model to detect the failed lines
after an attack as described in the previous subsection.
III. D ETECTION M ETHODS
The problem of failed lines detection using partial phaseangle measurements is NP-hard in general [11]. However,in special cases, it is possible to efficiently solve this problem. In this section, we provide an overview of the twomain approaches to failed lines detection using phase angle
measurements. In recent years, some efforts have been madeto apply learning algorithms to this problem, such as [12].
However, since detection using these methods is limited to thestate of the grid that they are trained on, they are not generalenough to fit into the scope of this paper.

A. Brute Force Search
The classical approach to the failed lines detection problem
is the Brute Force Search (BFS) [9], [10]. The BFS based
methods consider all possible set of failed lines and returnthe set with the maximum likelihood, based on the observed
measurements.
Assume M is the set of all admittance matrices associatedwith the graphs that can be obtained by removing any numberof lines in EH from the graph G. One way of finding the setof failed lines is by searching the entire space of matrices M
to find a matrix C that minimizes the following0(µ)

min k(C+ Aθ~ (µ) )H̄ − θ~ H̄ k2 .

C∈M

(2)

To see why (2) is an intuitive approach for detecting theset of failed lines, assume FC ⊆ EH is the set of lines that
their removal results in the admittance matrix C. Notice thatAθ~ (µ) ≈ p~. Therefore, C+ Aθ~ (µ) is the approximate phaseangles that we would have expected to observe if FC was theactual set of failed lines. By comparing the expected phaseangle of the nodes outside of the attacked area (C+ Aθ~ (µ) )H̄0(µ)
with the average of the observed phase angles θ~ H̄ , one cancheck how much the guessed set of failed lines FC is consistent
with the observed data.
Despite the simplicity and effectiveness of the BFS based
methods, however, their running time grow exponentially with
the number of lines in the attacked area. This makes theminapplicable to the scenarios that require fast decision making
in order to localize the attack and reduce its consequences. In
Section V, we numerically investigate the limitations of the
BFS based methods.
B. Convex Optimization
Another approach to the failed lines detection problem is to
use topological properties of the grid in order to find the failed
lines more efficiently for certain topologies. Such methods andtheir connection to the topology of the grid were first fully
explored in [1]. However, similar approaches were first studiedin [13] without making the connection to the topology.
It is proved in [1] that under some conditions on the
topology of the attacked area, the optimal solution ~t ∈ R|EH |and ~z ∈ R|VH | of the following convex optimization problem
is such that supp(~t) = {i|ei ∈ F } and ~z = θ~ 0H :min k~tk1 + λ s.t.

(3)

~
t,~
z ,

0

(µ)
(µ)
(µ)
kAH|H (θ~ H − ~z) + AH|H̄ (θ~ H̄ − θ~ H̄ ) − DH ~tk2 ≤ 
(µ)

(µ)

0

(µ)

kAH̄|H (θ~ H − ~z) + AH̄|H̄ (θ~ H̄ − θ~ H̄ )k2 ≤ .
Therefore, by solving (3) the nonzero elements of ~t reveal thefailed lines. It can be shown that in this case, if ei = {j, k} ∈F , then ti ≈ −ajk (θj0 − θk0 ) which is the amount of the power
flow that the line ei would have carried if it was not failed.
When the noise is low, it is shown in [1] that (3) can
detect the failed lines very well. However, as the noise level

increases, the detection based on the solution to (3) produces
false negatives and false positives. The main challenge here isto determine the weight λ that makes the solution space smallenough to contain only the actual solution. In Section V, wenumerically investigate the limitations of this method as well.
The main goal of this paper is to extend the idea of the optimization (3) and make it more robust to noisy measurements.
In the next section, we show that why Bayesian regression isa suitable option for this purpose.
IV. BAYESIAN R EGRESSION FOR FAILED L INE D ETECTION
In order to provide a robust method for failed lines detection, we use Bayesian regression, which is more suitable for
dealing with uncertainties.
To see how Bayesian regression can be used here, recall
that the key in (3) is that once it is solved, the failed lines canbe detected by looking for the nonzero elements of vector ~t.
Now if the phase angle measurements are noisy, all we needto compute is the probability that each element of vector ~t isnonzero in the optimal solution. And this is where Bayesian
regression can be used. Recall the regression notation from
Subsection II-C and define
#
"
0
T

(i)
(j) T
(i)
AH|H θ~ H + AH|H̄ (θ~ H̄ − θ~ H̄ )AH|H DH
(i,j)
,Y
:=
X:=
0
(i)
(i)
(j) ,
AH̄|H 0
AH̄|H θ~ + AH̄|H̄ (θ~ − θ~ )
H

(i,j)

H̄

th

H̄

where Yis the output vector using the i phase angle
measurement before that attack and j th phase angle measurement after the attack. In regression, we want to find the vectorw~ such that for any 1 ≤ k ≤ |V | and any 1 ≤ i, j ≤ T :
(i,j)
yk
≈ w
~ T xk . Notice that in this setting, the first |VH |elements of w
~ are associated with vector ~z in (3) and thelast |EH | elements are associate with vector ~t.
To find a posterior distribution on w,~ we use the Bayesian
regression model with ARD introduced in [8] and summarizedin Subsection II-C. As we mentioned in Subsection II-C, theprior distribution on w
~ and the structure in this model is suchthat it promotes sparsity in w
~ which can play the role of k~tk1
minimizer in (3). Hence, this model can be considered as a
Bayesian approach for solving (3).
Once the posterior distribution on w
~ is computed as in (1),it can be used to estimate the phase angles of the nodes inside
the attacked area and compute the probability that each line isfailed. Define ~z to be the first |VH | elements of the posteriormean vector w~ n . It provides the maximum likelihood estimate
for the phase angles of the nodes inside the attacked area.
Also define ~t = [t1 , . . . , t|EH | ]T to be last |EH | entries ofvector w,~ µ~ to be the last |EH | entries of the posterior mean
vector w~ n , and Σ to be the submatirx of matrix Vn associatedwith its last |EH | rows and columns. Then according to
the model, P(~t|τ ) = N (~µ, τ −1 Σ). Moreover, τ can befurther approximated by its posterior mean an /bn to obtain
P(~t) ≈ N (~µ, bn /an Σ). Using this, we can approximate theprobability that each line is failed by computing the probability
that |ti | is greater than γ > 0. Hence, since Σ is diagonal,
1 1  µi − γ, (4)P(ei ∈ F ) ≈ P(|ti | ≥ γ) ≈ − erf p
2 2
2bn /an Σii

1 The threshold γ should be selected based on the active power nominal
value. Here, based on the IEEE test system, the nominal value is 100M W
which makes the 0.1 threshold in per unit, equal to 10M W .

0.5

CVX
Bayes
Bayes+BFS
BFS
Real

0
187 188 191 205 207 219 220 221 239 190 215 217 193 214 367

Line Number(b) Low Noise
1

0.5

CVX
Bayes
Bayes+BFS
BFS
Real

0
187 191 219 205 220 217 188 221 207 239 193 215 190 214 367

Line Number(c) High Noise
Running Time (s)In this section, we compare the two Bayesian regression
based methods for failed lines detection, introduced in theprevious section, with the methods described in Section III.
We assume T = 10 noisy measurements before and after theattack. In the BFS optimization (2), we limit the search to theset of failed lines of size at most 5. In the convex optimization(3), we set λ = 1000 and refer to the solution obtained by thismethod by CVX. Finally, we set p = 0.9999 as the thresholdprobability in Bayes, and k = 7 in Bayes+BFS.
Fig. 1 depicts an attack example and the detected failed
lines using different methods. In this example, as depicted
in Fig. 1(a), the phase angle measurements from the attacked
area, shown by red filled nodes, are blocked and 3 lines, shownby red dashed lines, are failed. Figs. 1(b) and 1(c) compare
the probability that each line is failed, computed by different
methods, under low and high noise levels. Each color bar
indicates the probability that a particular method assigns to aline. Since all the methods except Bayes make hard decisions,the probabilities they provide are either 0 or 1. Therefore, inthese figures, the lines are ordered based on the probabilities
obtained by the Bayes method.
When the noise level is low, as can be seen in Fig. 1(b), all
the four methods can detect the failed lines accurately. Whenthe noise level is high, however, all the methods except theBayes+BFS result in a false positive or a false negatives, orboth in their detections. For example, CVX misses failed line
193 and incorrectly detects line 221. Bayes with p = 0.9999
threshold also misses failed line 193. The interesting result,however, is that BFS method incorrectly detects additional line
193 as failed. On the other hand, Bayes+BFS by focusing only
on the lines with high probability of being failed, avoids thisfalse extra detection and detects all the failed lines correctly.
Fig. 1(d) shows the running times of these methods. As we
mentioned in Section III and can be seen in this figure, theBFS method is significantly slower than other methods which

Probability

V. N UMERICAL R ESULTS(a) Attack Scenario
1

Probability

where erf(.) is the Gaussian error function. Here, we selectγ = 0.1, which means that we are interested in detecting theentries of ~t that can get a substantial value.1
Once the probabilities are computed using (4), there are two
ways to turn these probabilities into hard decisions:(i) Consider a probability threshold p and detect all lines
with probability of being failed greater than p as failed
and use the probability values as the confidence in thedetection. We refer to this method in Section V as Bayes.
(ii) Use the probabilities to sort the lines and only use the
top k lines as the set of lines that are most probable tobe failed in the search space of the BFS optimization (2).
This significantly reduces the running time of the BFS
method by keeping the size of the search space constantas the size of the attacked area increases. We refer to thismethod in Section V as Bayes+BFS.

CVX
Bayes
Bayes+BFS
BFS

80
60

85.88

40
20
0

0.44

0.23

1.98

(d) Running Times
Fig. 1: An example of an attack and the failed lines detection using
different methods. (a) The attacked area shown by red filled nodes
and three failed lines shown by red dotted lines in the IEEE 300-bus
system, (b) the probability that each line is failed as computed bydifferent methods when the noise is low (SNR = 42.8dB), (c) the
probability that each line is failed as computed by different methods
when the noise is high (SNR = 3.7dB), (d) running times.

make it unsuitable for practical purposes. While CVX method
is very fast, it may provide less accuracy as the noise level
increases. The Bayes method is the fastest among the four andby combining it with the BFS, as in Bayes+BFS, it reaches
the sweet spot in accuracy and efficiency.
To further investigate these observations, we performed
more simulations under different attack scenarios (e.g., different number of failed lines and different noise levels). The
results are presented in Fig. 2. As can be seen, the results are
consistent with the results that we presented in Fig. 1. While
all the methods perform very well when the noise level is low,

CVX
Bayes
Bayes+BFS
BFS

3

2

1

0
-20

0

20

40

0.3

15000
CVX
Bayes
Bayes+BFS
BFS

0.25
0.2
0.15
0.1
0.05
0
-20

60

0

SNR (dB)

CVX
Bayes
Bayes+BFS
BFS

0.3
0.2
0.1
0
-20

0

20

40

2

1
0.5
0

Avg. Num. of False Negatives

Avg. Num. of False Positives

60(d) |F | = 3
CVX
Bayes
Bayes+BFS
BFS

0.4

0.2

20

40

SNR (dB)(c) |F | = 3

0

20

40

60

5
CVX
Bayes
Bayes+BFS
BFS

4
3
2

5000

0
0

10

20

30

40

these tools have a vast potential and can be applied for power
grid state estimation not only during an attack but also during
the daily operation of the grid. Providing a general frameworkfor power grid state estimation using Bayesian Regression ispart of our future work.
Finally, in this work, we used the linearized DC power
flows to describe the state of the grid. However, the provided
methods can also be extended to the AC power flows using
the extension of the optimization (3) to the AC power flowsthat is provided in a recent work [14]. Moreover, they canbe extended to the case where there is false data injection
instead of data blocking, using similar methods to ones in [11].
Exploring these directions are also part of our future work.
R EFERENCES

1
0
-20

10000

Fig. 3: The relationship between the running times of different
methods and the number of lines in H.

1.5

0
-20

CVX
Bayes
Bayes+BF
BFS

Number of Lines in H

CVX
Bayes
Bayes+BFS
BFS

2.5

60

0.8

0
-20

60

3

SNR (dB)

0.640(b) |F | = 1
Avg. Num. of False Negatives

Avg. Num. of False Positives(a) |F | = 1

0.4

20

SNR (dB)

0.6
0.5

Running Time (s)Avg. Num. of False Negatives

Avg. Num. of False Positives

4

0

20

SNR (dB)

SNR (dB)(e) |F | = 5(f) |F | = 5

40

60

Fig. 2: The average number of false positives and negatives using
different detection methods under different SNR values and different
number of failed lines.

the BFS and Bayes+BFS perform better than the CVX and theBayes, specially in the number of false negatives.
Finally, to show the main disadvantage of the BFS method
more clearly, in Fig. 3, we compared the running times ofthe four methods as the number of lines in the attacked area
increases. As can be seen, while the running times of the CVX,
Bayes, and Bayes+BFS remain constant as the number of lines
increases, the BFS method significantly slows down. Hence,Figs. 2 and 3 confirm the results we observed in Fig. 1 thatthe Bayes+BFS provides an accuracy level similar to BFS in
significantly lower running time.
VI. C ONCLUSION
In this work, we provided a new method based on Bayesian
regression for power grid state estimation following a cyberphysical attack. We numerically showed that the method thatuses Bayesian regression to find the set of lines with thehighest probability of being failed and performs a limited BFS
on that small set of lines, reaches a sweet spot in terms ofaccuracy and efficiency.
Our work is one of the first works in applying Bayesian data
analysis tools for power grid state estimation. We believe that

[1] S. Soltan, M. Yannakakis, and G. Zussman, “Power grid state estimation
following a joint cyber and physical attack,” to appear in IEEE Trans.
Control Netw. Syst., 2017.
[2] A. Ashok, M. Govindarasu, and J. Wang, “Cyber-physical attackresilient wide-area monitoring, protection, and control for the power
grid,” Proc. IEEE, vol. 105, no. 7, pp. 1389–1407, 2017.
[3] Z. Li, M. Shahidehpour, A. Alabdulwahab, and A. Abusorrah, “Bilevel
model for analyzing coordinated cyber-physical attacks on power systems,” IEEE Trans. Smart Grid, vol. 7, no. 5, pp. 2260–2272, 2016.
[4] R. Deng, P. Zhuang, and H. Liang, “CCPA: Coordinated cyber-physicalattacks and countermeasures in smart grid,” IEEE Trans. Smart Grid,
vol. 8, no. 5, pp. 2420–2430, 2017.
[5] J. Zhang and L. Sankar, “Physical system consequences of unobservablestate-and-topology cyber-physical attacks,” IEEE Trans. Smart Grid,
vol. 7, no. 4, 2016.
[6] “Analysis of the cyber attack on the Ukrainian power grid,” Mar.
2016, http://www.nerc.com/pa/CI/ESISAC/Documents/E-ISAC SANS
Ukraine DUC 18Mar2016.pdf.
[7] C. M. Bishop, Pattern recognition and machine learning. springer,
2006.
[8] J. Drugowitsch, “Variational bayesian inference for linear and logistic
regression,” arXiv preprint arXiv:1310.5438v3, 2017.
[9] J. E. Tate and T. J. Overbye, “Line outage detection using phasor angle
measurements,” IEEE Trans. Power Syst., vol. 23, no. 4, pp. 1644–1652,
2008.
[10] Y. Zhao, A. Goldsmith, and H. V. Poor, “On PMU location selection
for line outage detection in wide-area transmission networks,” in Proc.
IEEE PES-GM’12, July 2012.
[11] S. Soltan, M. Yannakakis, and G. Zussman, “REACT to cyber attacks
on power grids,” arXiv preprint arXiv:1709.06934, Sept. 2017.
[12] M. Garcia, T. Catanach, S. Vander Wiel, R. Bent, and E. Lawrence,“Line outage localization using phasor measurement data in transientstate,” IEEE Trans. Power Syst., vol. 31, no. 4, pp. 3019–3027, 2016.
[13] H. Zhu and G. B. Giannakis, “Sparse overcomplete representations for
efficient identification of power line outages,” IEEE Trans. Power Syst.,
vol. 27, no. 4, pp. 2215–2224, 2012.
[14] S. Soltan and G. Zussman, “EXPOSE the line failures following a cyberphysical attack on the power grid,” arXiv preprint arXiv:1709.07399,
Sept. 2017.