## 2 Theoretical Background
### Communication Layer
#### 2.5.2 False Data Injection (FDI) Attack Simulation  
False Data Injection Attacks in the communication layer occur when the adversary accesses the network layer and either manipulates the data within a packet or transmits wrong data packets. This subsequently affects the behavior of the packets in the network layer. Thus, FDI attacks have the capability to increase the inter-arrival time and transmission delay at the network level. Using these performance metrics, FDI attacks in the IEEE 118-bus system are emulated in the communication network based on the M/M/c queue, where \(c\geq 1\). The SimComponents and SimPy libraries are used to emulate packet generation, transmission, and FDI attacks in the communication layer. The implementation of this cyber-attack is summarized in Algorithm 2. This scenario is demonstrated by generating the inter-arrival times and transmission delay of normal and malicious packet samples using the SimPy environment. The start time is appended to the sample measurements for synchronization between the network layer and the power system layer. The packet generator function is utilized to send normal or malicious packets with a fixed inter-arrival time distribution and packet size distribution for the sample buses. In addition, the switch port is simulated with exponential packet inter-arrival times and exponentially distributed packet sizes by setting the port rate and queue limits. The port rate of false data injections is set to be lower than the normal traffic, while the queue limit of false data injections is set to be higher than the normal traffic. The implementation of FDI attacks in Algorithm 2 is done based on the presence of normal and attacked buses in the generated bus list for the IEEE 118-bus system. Considering the bus list, if a normal bus is detected, the switch port parameters for the port rate and queue limit are set to values of 10,000 and 100,000, respectively. The packet generator is used to generate the normal packets with exponential inter-arrival times and exponentially distributed packet sizes. Similarly, if a malicious bus is detected, the switch port parameters for the port rate and queue limit are assigned values of 30 and 10,000,000, respectively. Moreover, the packet generator generates malicious packets with exponential inter-arrival times and exponentially distributed packet sizes. The packet sink records the inter-arrival times and transmission delays and appends the values of each time measurement to a CSV file, which is utilized by the ML model in real-time. The experiment is conducted for 21,600 packet samples. Figure 3a,b represent the statistics of the transmission delay and inter-arrival time of 21,600 samples taken for 691 measurements, respectively. The generated values for the packet transmission delay and inter-arrival time are exponentially distributed. Figure 2: Histogram for sink interarrival times. ```
1:Initialize transmission delay \((TD)\) array, inter-arrival time \((IAT)\) array, switch function variables; port_rate_normal, queue_limit_normal, port_rate_malicious, queue_limit-malicious
2:for all samples do
3: Append \(Index\) & \(CurrentTime\) to \(IAT\) array, \(TD\) array
4:ifAn attack sample is detectedthen
5: Create Attack Bus List packets sink
6: Setup switch port using \(port\_rate\_malicious\),
7: queue_limit_malicious
8: Simulate malicious traffic
9: Append \(IAT\) & \(TD\) values to arrays
10:else
11:
12: Create the packets generator and packets sink
13: Setup switch port using \(port\_rate\_normal\),
14: queue_limit_normal
15: Simulate normal traffic
16: Append \(IAT\) & \(TD\) values to arrays
17:endif
18: Create IAT CSV File
19: Create TD CSV File
20:endfor
```  
**Algorithm 2** False Data Injection Attack  
Figure 3: 21,600 samples taken for 691 measurements. (**a**) Statistics measurements for transmission delay. (**b**) Statistics measurements for Inter-arrival time. Figure 4a,b are the plots for the transmission delay and inter-arrival time of 21,600 samples taken for the 690 th normal traffic measurement.