## 1 Introduction  
Power systems with high integration of information technologies are being challenged by increasing cyberhacking activities [1]. In December 2015, the Ukraine Electric Grid Hack caused almost 225,000 customers to lose power for at least 6 h [2]. During the incident, varieties of critical data of power systems were compromised by cyber attacks. As an essential component of the power system, the LFC system needs to utilize varieties of measured data to maintain the stability of system frequency. Sophisticated attackers can compromise the measured data by launching cyber attacks to force the load frequency controller to issue incorrect instructions, which can lead to unpredictable frequency fluctuation. Therefore, it is necessary to detect the compromised data as a first step to mitigate cyber attacks. The two main types of cyber attacks against power systems are false data injection (FDI) attacks and denial of service (DoS) attacks [3]. In [4], [PERSON] first studied false data injection attacks targeting static state estimation (SE). It is proved that the compromised data meeting certain rules can bypass bad data detection. It is difficult for defenders to judge whether the measured data are reliable. To protect power systems from FDI attacks, the defense strategies are studied from many aspects including impact of cyber attacks, detection schemes, and mitigation strategies. In [5], attack and defense mechanisms are discussed using the method of bad data detection. Detection method and mitigation strategy of cyber attacks on substation automation systems are studied in [6]. The impacts of cyber attacks on supervisory control and data acquisition (SCADA) systems are studied by considering different attack scenarios [7]. In [8], a dynamic state dynamics is introducedto achieve risk mitigation against FDI attacks. In [9], the isolation of FDI attacks for smart grids using state observer is studied. In [2], known-secured phasor measurement unit (PMU) measurement is used to detect malicious attacks on power grids. As for DoS attacks, the existing literature shows that the opening of communication channels can be used to achieve attacked targets [10; 11; 12]. DoS attacks can disrupt the data exchange in multi-area power systems and lead to packet losses directly. Compared with FDI attacks, DoS attacks can achieve the attacked target without maintaining concealment, which makes it important to study the mitigation strategies for DoS attacks. The strategies to suppress DoS attacks have been extensively studied. Adopting appropriate communication protocol and event-triggered control scheme can effectively mitigate the impacts of DoS attacks [13; 14]. Compared to DoS attacks, FDI attacks could easily manipulate the normal actions of a control center by compromising the data of vulnerable variables. Analysis of cyber attacks on a LFC system is different from that on other systems in power systems [15]. A LFC system, which depends on the dynamic evolution rather than general SE, is designed to maintain the active power balance of power system. As is discussed in [15], unlike static state estimation, which estimate the state of power systems once every five minutes based on the ISO/RTO standard, the control center of LFC system should generate command data once every five seconds. As a result, it is difficult for a detection scheme of cyber attacks on a LFC system to benefit from current SE-based attack detection schemes. Ref. [15] proposes FDI attack templates matching the features of load frequency control system and evaluates the attack impact from aspects in frequency fluctuation and financial settlement. In [16], the model of optimal FDI attacks on the sensors of a LFC system is proposed to guide the defense of sensor data. In [17], authors introduce a priori knowledge of FDI attacks for studying more targeted detection methods, by analyzing four attack strategies targeting frequency collapse.