  Complex interconnections between information technology and digital control
systems have significantly increased cybersecurity vulnerabilities in smart
grids. Cyberattacks involving data integrity can be very disruptive because of
their potential to compromise physical control by manipulating measurement
data. This is especially true in large and complex electric networks that often
rely on traditional intrusion detection systems focused on monitoring network
traffic. In this paper, we develop an online detection algorithm to detect and
localize covert attacks on smart grids. Using a network system model, we
develop a theoretical framework by characterizing a covert attack on a
generator bus in the network as sparse features in the state-estimation
residuals. We leverage such sparsity via a regularized linear regression method
to detect and localize covert attacks based on the regression coefficients. We
conduct a comprehensive numerical study on both linear and nonlinear system
models to validate our proposed method. The results show that our method
outperforms conventional methods in both detection delay and localization
accuracy.
