## 4 Case Study  
The presented bi-level model was validated using the \(IEEE\) 118-bus system. By using the MATLAB package MATPOWER [31], 21,600 samples (i.e., one day's worth) of measurements were generated with Gaussian noise based on a common daily load profile that contains temporal information of a power system's changing state. The measurement set includes real and reactive power flows, power injections, and all voltage magnitudes, resulting in 712 measurements with Global Redundancy Level (GRL = \(m/N\)) of 3.029, which relates the number of measurements (\(m\)) to the number of states (\(N\)) to be estimated. Measurement' standard deviations are considered as 1% of their absolute values. For optimization, Gurobi solver [32] is used for solving the bi-level model. All simulations are conducted on a personal Apple Mac computer: macOS High Sierra 32 GB RAM 1876 MHz DDR3, 4 GHz Intel Core i7. Towards validation, five independent 100 Monte Carlo simulations were conducted for a selected sample. In each simulation, a line is selected randomly to have cyber-attacks, modeled as FDI in model parameters, i.e, \(g_{km}\), \(b_{km}\), and \(b_{km}^{th}\). The size of the cyber-attacks is drawn from a uniform distribution between \(\pm 5\%\) and \(\pm 40\%\) of their actual values. The optimization framework presented in Section 3.3 and Figure 1 is conducted after each attack. Case study results are presented in Figure 2. Figure 2 shows that the absolute error after correcting line parameters is less than an order of 3. To further evaluate the accuracy and performance of the presented bi-level model, around 20% of the samples (out of 21,600) are selected randomly to be compromised with parameter cyber-attacks. Each of those samples, a random line is selected to have a FDI parameter attack. The attack is in the same range as those performed for the aforementioned simulations. The confusion matrix for the SE output using \(\chi^{2}\) test as a detection method is illustrated in Table 1. The \(\chi^{2}\) threshold is calculated based on two parameters: number of  
Figure 1: Flowchart of the inclusion of the proposed framework. measurements and confidence level. In this test, the number of measurements is 712 and the confidence level is chosen to be 95% [19]. As seen, a substantial amount of samples were not detected by \(\chi^{2}\) test. Meanwhile, the presented bi-level model was executed after each SE run. All anomaly samples were not only detected, but also corrected in a single optimization run. Observed errors in correction were similar to the results shown in Figure 2. The execution time of the proposed model was monitored for all anomaly samples. On average, for 170 lines, the total execution time was 0.3964 s with a standard deviation of 0.0533 s. It is worth mentioning that these reported statistics are without using parallel computation. Hence, a lower execution time could be achieved with parallelism. The \(CME^{N}\) methodology presented in [30] for parameter attack processing, which is the composed measurement error \(CME\) in its normalized form, is also explored in the comparative test case scenarios. An anomaly sample is selected and the resulted \(CME^{N}\) of the measurements were listed in a descending order based on their absolute values for a threshold value of 3. In this sample, the underlying true attack is on line connecting bus 94 and bus 95. The result is shown in Table 2. Based on the strategy presented in [30], the attack is characterized as a parameter attack. However, not a specific line is determined \begin{table}
\begin{tabular}{c c c c} \hline \hline  & & \multicolumn{3}{c}{**Prediction Outcome**} \\ \cline{3-4}  & & **Normal** & **Anomaly** \\ \cline{3-4}  & & 17336 & 0 \\ \cline{3-4}  & & sample & sample \\ \cline{3-4}  & & 3252 & 1012 \\ \cline{3-4}  & & sample & sample \\ \cline{3-4}  & & Normal & Anomaly \\ \hline \hline \end{tabular}
\end{table} 
Table 1: SE performance result for parameter attack detection \(\chi^{2}\) test [19]. Figure 2: Absolute error in log scale.