## 4 Classifications in Cyber Attacks
### Detection and Identification Methods  
Data driven techniques using artificial intelligence (AI) were pre-owned to predict the cyber attacks on meters. An IEEE 14-bus system was coupled to New York independent system operator load data. A comparison between AI and extreme machine learning was made to identify the cyber attacks on meters. It was observed that both the techniques were able to identify the attack with high precision. In AI-based method, the actual meter readings of estimated load and measurements were compared with that of the affected meter. To the existing model, an extra load estimator was added to effectively check for the tampered meters. The historical data and log information were used to detect cyber attacks using supervised learning method. The accuracy and detection rates were 93.9% and 93.6%, respectively. The supervised learning method provided the highest accuracy and detection rates compared to the other models such as K-nearest neighbors (KNN) algorithm, Random Forest (RF) method, etc. To capture deadly cyber attacks, supervisory learning methods were applied. The proposed method was robust, although noisy data was supplied to it. This computation time was less than that of traditional principal component analysis (PCA) and could precisely identify the cyber attacks. State estimators help in safe and controlled operation of the smart grid. The hackers trap the estimators by bypassing the bad data detection (BDD) algorithms and creating a change in estimation. An accurate and computational attractive approach for false data injection attacks (FDIA) detection was proposed. For FDIA to be composed as a matrix separation problem, characteristics of the low rank for matrix measurement and the sparsity of the attack matrix were used. To solve the matrix, the algorithms proposed were traditional augmented Lagrange multipliers (ALM), double-noise dual-problem ALM (DNDP-ALM), etc. Among all the algorithms, Go Dec provided the highest computation efficiency and showed good amount of tolerance toward measurement noise. This algorithm was scalable to larger attacks. However, complexity in terms of scalability was observed in ALM, DNDP-ALM and LMaFit. By characterizing the work of the intruder in a dynamic environment, the likelihood of cyber attack is predicted. This prediction plays a crucial role to assess the vulnerability of the attack to the grid, with minimal knowledge. The model was developed based on an intruder's strategy. Based on the intruder's perspective, solution for the optimal attack policy is derived. Numerical data based on IEEE 14-bus and 30-bus systems were used to validate the algorithm. Game theory was used to implement attacker-defender model to project the power system. In this approach, the attacker chronologically identifies the critical substations to create maximum damage. However, the intruder identifies the critical substations to protect such that the system damage can be minimized. An observer-based attack prediction was proposed. The proposed framework is robust against attacks caused to the electromagnetic interference (EMI) on the hall effect sensors used in a power system. Different types of detection of attacks and solutions to such problems are proposed. Concisely, Table 3 shows a comparative analysis on detection of cyber attacks and identification techniques. \begin{table}
\begin{tabular}{c c} \hline \hline
**Attack** & **Tools Used** \\ \hline Malicious Meter Identification & AI \\ \hline Detection and Prevention & Supervised learning Algorithm \\ \hline Online Detection and Prevention & Reinforcement Learning Based Algorithm \\ \hline Detection, Prevention and Identification & Game Theory \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Comparative analysis on attacks. For monitoring purposes, state estimation, fault location and protection synchrophasor technology is used. To represent the magnitude and phase of the sinusoidal signals, synchrophasors based on electrical measurements are used.