# Fourier Singular Values-Based False Data Injection Attack Detection in AC Smart-Grids
## 3 FDIA Detection
### Proposed Detection Mechanism  
Firstly, the FFT approach reorders the input components into bit reversed sequence; after that, it makes the output transform with time decomposition. Accordingly, the main concept will be to separate the transform with N length to 2 different transforms with N/2 length with applying an inherence. The FFT is broadly used for analyzing signals. Fourier assessments separate frequency details from the spectrum and make it better and easier for analyzing. In this regard, the SVD is used to obtain singular values of the components to compare with the threshold to detect the cyber-attack.  
The value of threshold is obtained based on the experience and investigation of different cases and FDIAs on the system, as well as considering the system without attack. In this study, 1573 times, the data of systems such as voltage and current data which have been measured by sensors and exchanged data between units have been manipulated to simulate the behavior of the system after FDIAs, and also, 1394 samples in different status such as different loads, different amount of production of each units without attack were examined and tested, and then the FSVs of signals have been calculated and saved; after that, the FSVs of signals have been considered in normal and under attack conditions, to check the amount of variation of FSVs. The FSVs' values for normal conditions are between [0, 10] and when the data has been manipulated, the FSVs are changed and raised to more than 10, so if the threshold selected is more than 10, the method is able to detect the FDIAs. In this study, the threshold value for detecting FDIAs was obtained based on 2967 samples of normal and attack conditions, the threshold has been selected as 40 (more than 10 to detect FDIAs) to prevent false detection when a small noise happens to the system, and if the threshold is selected as more than 40, the small attacks cannot be detected (means that the amount of manipulating data is less than 10% amount of signal). Hence, the threshold has been selected as 40 in this study. In addition, the threshold can be set below 40 to detect small FDI attacks (between 10 to 40) but the lower the threshold value, the false detection rate has been increased and noises or small changes in signals can detect as FDI attacks. If the threshold has been selected big (more than 40), attacks in small ranges cannot be detected.  
In our proposed method, the input of FSVs comprise of 200 samples. FSV is highly sensitive for changing in the signal magnitude. In case of any cyber-attack, FSV can detect this attack. The algorithm for computing and combining the FSV scheme is shown in Figure 1. Basic data, which is mentioned in Figure 1, means the reference data for voltage, frequency and the estimated data for currents and loads. Based on the proposed method, which is illustrated in Figure 1, the current and voltage signals are gained and then are compared with the basic signals to compute the difference between retrieved signals and basic signals. In addition to compute the fast Fourier transform of the difference to obtain coefficient's matrix, this paper uses SVD method to obtain singular value of the coefficient's matrix, and finally, the obtained singular value is compared with threshold to detect the FDI attacks. If the obtained singular values of the signal (FSVs) are more than threshold, the attack is occurred; in contrast, if the FSVs are lower than threshold, the system is in normal condition.  
Figure 1: Proposed FDIA detection scheme.