## 1 Introduction
Considering the concealment of the FDI attack and the accuracy of the attack detection, an optimal defense strategy is studied using game theory model [18]. Ref. [3] proposes an event-triggering control strategy to mitigate the impacts of cyber attacks on a LFC. Ref. [19] proposes the resilient load frequency control considering cyber attacks and communication delay. Detection methods of cyber attacks against LFC systems should focus on dynamic features in vulnerable variables. In current literature, designing observers and using machine learning algorithms are two important methods to extract the dynamic features of variables [20; 21; 22]. In [23], the disturbance of active power is tracked using a second-order sliding mode in an LFC system. In [24], the fault signals in the LFC system are observed using the sliding mode observer. The existing methods for detecting FDI attacks on LFC systems have the following defects:  
(1) The current data-driven methods are not sufficient to detect attacks in specific conditions. The features of historical operation data are exploited based on data in multiple operating conditions. Attackers can inject false data with the features of historical data in the LFC system. For example, in one operating condition, attackers can use historical data to generate attack signals that satisfy the features of the variables in other conditions. (2) Due to the communication delay and noise, there exists a difference between the observed data and the true data. Defenders cannot set the reasonable threshold of the difference. Improper setting of threshold will lead to misjudgment. Considering that the attacker is compromising the relationship between measured data and true data, we propose a detection scheme for FDI attacks on a load frequency control system based on dual-source data of compromised variables. Different from the methods of learning the features of historical data, we measure the relationship between observed data and measured data. The relationship between the two includes the difference caused by communication delay and noise. The main contributions of the paper are three fold:  
(1) The attack detection scheme using dual-source data of compromised variables in an LFC system is proposed. Dual-source data can be used as a basis for defenders to detect false data injection attacks. (2) Based on known-secure variables in an LFC system, an observer of tie-line power is designed considering uncertainties parameters in the LFC system. With this observer, defenders can obtain dual-source data (the observed data and the measured data) to assess whether the system is compromised. (3) Considering the communication delay and noise of the dual-source data in the process of transmission to the defense center, the Siamese network is used to quantify the similarity of the dual-source data. The remainder of this paper is organized as follows: in Section 2, the dynamic modeling of a compromised load frequency control system is studied. In Section 3, we design an observer for detecting tie-line power considering uncertainties in an LFC system. The FDI attack detection for the LFC system is designed in Section 4. In Section 5, simulation and analysis are carried out. Finally, Section 6 states conclusions.