In general, the control center estimates the state through the measurement information in the monitoring and data acquisition system to ensure the safety and stability of the power grid [15]. State estimation primarily uses the redundancy of measurement data to estimate the operating state of the grid, including bus voltage, transmission line power flow, and bus power [24]. In energy management systems, state estimation can enable the functions of power flow calculation and load forecasting and the DC power model is usually used to ensure the convergence of the state estimation. The unit voltage of each node in the system is assumed to be 1, and the effect of line resistance and ground branch is ignored, the active power between bus a and bus b in the test system can be accordingly represented by the following model: (1)Pab=βa−βbXab+e where βa and βb represent voltage amplitude and voltage phase of bus a and bus b, respectively. Xab is the branch impedance and e is the measurement error. The active power injection on busbar a can be expressed as the sum of the active power flow of each adjacent branch, which can be calculated as follows: (2)Pa=∑a∈NPab+ewhere Pa represents active injection of bus a and N is the set of branches adjacent to bus a. Accordingly, the generalization can be expressed as: (3)z=Hx+ewhere z is the measurement data obtained in the SCADA system. H is the Jacobian matrix. x is the system state vector. e is the measurement error vector. The covariance matrix is diagonal when the measurement errors are assumed to be uncorrelated. Correspondingly, according to the principle of residual and least squares, the minimization objective function ℱ(x) can be calculated as follows: (4)minℱ(x)=(z−Hx)TR−1(z−Hx)where H is the weight matrix of direction-finding quantity, and the state estimator variable x can be obtained from the objective function as: (5)x~=(HTR−1H)−1HTH−1z

In order to grasp the real-time operation status of the smart power grid, the SCADA system uses intelligent terminals and other devices to collect measurement data [25]. Since these measurements are easily affected by traditional power system faults, such as equipment aging, communication failure, and noise interference, the SCADA system introduces the bad data detection (BDD) module to identify and eliminate such independent and accidental natural faults, where the constructed residual vector r in BDD module is the difference between the real direction-finding vector z~ and the estimated theoretical vector, which can be expressed as: (6)r=‖z−z~‖2=‖z−Hx~‖2

In the process of FDIA bad data detection, the Euclidean norm of the residual r is first compared with the threshold τ. If r>τ, the presence of bad data is determined and further processed by identification and correction operations. The aforementioned bad data detection process is repeated until all residual vectors meet the pre-determined criteria.

During FDIAs, false data vector a=[a1,a2,⋯,am]T is usually injected into the vector measurement data z=[z1,z2,⋯zm]T, which inevitably cause the input vector za=z+a of the state estimate to be biased from the real case [28]. Accordingly, the state variable x may be also offset, resulting in x~a=x~+c, where c=[c1,c2,⋯cn]T is the deviation of the state variable before and after the attack. If the attacker can invade the configuration information of the power system and obtain the Jacobian matrix H from the system, the attacker could construct a false data attack vector a=Hc so that bad data detection module cannot recognize it. Correspondingly, the attacked measurement vector za and residual ra can be represented as follows: (7)za=Hx~+e+Hc=H(x~+c)+e=Hx~a+e (8)ra=‖za−Hx~a‖2=‖z+a−H(x~+c)‖2=‖z−Hx~+a−Hc‖2=r

Meanwhile, since the bad data detection module may fail to detect FDIAs, the control center is likely to make wrong decision instructions according to the estimated state x [29]. It is worth noting that the attack effect of the FDIA method described above is related to the attacker’s mastery of the grid information. When the attacker can use more power grid topology information and electrical parameters, it is entirely possible for them to construct a Jacobian matrix H that is closer to the topology information of the power grid, and the constructed false data vectors are very similar to the weak fluctuation noise of the power grid. Correspondingly, the bad data detection module is highly likely to identify these FDIA attacks as general noise from the power grid, allowing them to easily bypass the detection model for effective attacks.

Our designed deep collaborative network mainly consists of two network branches. One branch is a graph convolution network based on Chebyshev polynomials, which aggregates the node information in the power grid, and adaptively adjusts the degree of attention to different nodes by introducing the spatio self-attention mechanism. Another branch is the bi-directional LSTM network, which can conduct time series modeling and long-term dependence analysis for power grid data describe the time correlation of data, and assign different weights to different time steps by introducing the temporal self-attention mechanism. The overall detection process can be described as follows. The operational data of sensors is first collected through the SCADA system, including the bus injection active power Pi and reactive power Qi, branch power flow Pij and Qij, to form the grid measurement data Z=[Pi,Qi,Pij,Qij]. Subsequently, after obtaining the power grid information, the attacker performs an FDIA attack to evade the BDD module. Furthermore, the operational data that is not detected by the BDD module is then fed into the deep collaborative network. Our deep collaborative network extracts temporal and spatial self-attention features through graph convolutional networks and bidirectional LSTM networks, respectively. Finally, spatio-temporal self-attention features are fully integrated by the deep collaborative network to make a final judgment decision. The overview of the proposed network architecture is shown in Fig. 2.

Graph convolution network (GCN) is usually used in node classification, graph classification, link prediction, and other tasks [30,31]. In general, a traditional graph convolution network only calculates the result of Chebyshev graph convolution at k=1 and λ=2. Nevertheless, since the k-order convolution operator of Chebyshev graph convolution can cover the k−1-order adjacent nodes, the general GCN can only extract the spatial correlation of the first-order adjacent nodes while ignoring the effective spatial information of high-order adjacent nodes. In order to better represent the topology characteristics of the power grid, we re-construct graph convolution network by introducing k-order Chebyshev polynomial (k≥2), which can effectively capture the spatial relationship between higher-order adjacent nodes, and realize the information dissemination and feature aggregation between nodes through the adjacency matrix. Correspondingly, the connection mode and interaction between nodes in the power grid data can be better understood.

To be specific, we model the power grid topology as an undirected graph 𝒢=(𝒱,ℰ,A), where 𝒱 represents the set of N nodes in the power grid, and ℰ is the set of branches connected between nodes. Through the connection relationship between nodes in the power grid, the adjacency matrix A∈ℛn×n of the graph can be obtained. If two bus nodes are directly connected, the corresponding element of two nodes in matrix A is 1; that is, Aij=1, otherwise Aij=0. The complete procedure for using Chebyshev graph convolution to update node information can be defined as follows: (9)X^=σ(∑k=0KβkTk(Λ~)x)where x is the input data. k is the order of Chebyshev polynomial. βk=(β1,β2,⋯,βk) is the parameter matrix of k-order Chebyshev polynomial. Tk(Λ~) is a Chebyshev polynomial function, which can be defined as follows: (10)T0(Λ~)=IT1(Λ~)=Λ~Tk(Λ~)=2Λ~Tk−1(Λ~)−Tk−2(Λ~),k≥2where I is the identity matrix and Λ~ stands for the symmetric normalized Laplace matrix, which can maintain the structural information, sparsity and positive definiteness of graph, and can be expressed as: (11)Λ~=2L~λmax−Iwhere λmax is the largest characteristic of Laplacian matrix and L~∈Rn×n is the normalized Laplace matrix, which can be calculated as: (12)L~=I−D−12AD−12where D=diag([d1,d2,⋯,dn]) is the degree matrix recording the degree of each node. Since Laplacian matrix is a positive semi-definite matrix and eigenvalues are greater than or equal to 0, each eigenvalue of L~λmax is accordingly within [0, 1], 2L~λmax eigenvalues is within [0, 2], and the eigenvalue of 2L~λmax−I is within [−1, 1]. This result can ensure that the range of independent variables of Chebyshev polynomials is limited to [−1, 1] interval, and guarantee the stability and convergence of numerical calculation in graph convolution network, thereby adapting to the properties of Chebyshev polynomials.

Although high-order Chebyshev GCN can effectively propagate information and control the propagation range, all nodes in each order polynomial only share one parameter, which makes it impossible to adaptively allocate neighbor node weights according to node differences. Therefore, we introduce the spatio self-attention mechanism to further improve its feature representation capability. The spatio self-attention mechanism can dynamically adjust the attention weight between nodes. Accordingly, the network model can accurately learn the importance of each node relationship and then pay more attention to the nodes that are crucial to FDIA detection task. The attention scoring for node i and its adjacent node j is performed through dot multiplication, and the formula is as follows: (13)eij=Q⋅KTdkwhere Q=X⋅Wq, K=X⋅Wk, and V=X⋅Wv are the queries, keys, and values obtained from the linear transformation of node feature X, respectively. Wq, Wk and Wv are learnable parameter matrices. dk stands for the feature dimension used to prevent large dot multiplication results. A^ is the auxiliary transformation matrix to facilitate the calculation of dimension matching.

Furthermore, the attention scores of all adjacent nodes of node i are normalized by using the softmax function to obtain the attention coefficient αij. Finally, the value matrix V can be weighted by the calculated node attention coefficient αij to obtain the updated feature representation of each node. (14)αij=exp⁡(eij)∑i=1Nexp⁡(eij) (15)S~at=A^σ(αijV)

When the network aggregates the node information according to k-order Chebyshev polynomials, we can multiply the elements of the attention weighting matrix and the polynomial Tk(Λ~) to adjust the weight distribution. And then focus on those vulnerable nodes: (16)T~k(Λ~)=Tk(Λ~)⊙S~at (17)X~=LeakyReLU(∑k=0KTk(Λ~)βkx)

Finally, after all node information is aggregated, each node can dynamically adjust the feature representation according to its influence in the power grid to better reflect its role in the whole detection model.

Bidirectional Long Short-Term Memory (BiLSTM) is a variant of recurrent neural networks (RNNs). Compared to traditional unidirectional LSTMs, BiLSTM can simultaneously consider both past and future information in a sequence, thus better capturing the long-term dependencies and contextual information of sequences [32]. A BiLSTM consists of two opposing LSTM layers, combining forward and backward information flow to enhance the capture of sequence data features [33]. In forward propagation, the BiLSTM can process the entire time sequence to capture past-to-present temporal information. (18)ht→=LSTM→(ht−1→,xt,ct→),t∈[1,T]while in backward propagation, it can process from the time sequence end and mainly focus on future-to-present temporal information. BiLSTM allows each time point to access contextual information, comprehensively understanding temporal dependencies. (19)ht←=LSTM←(ht+1←,xt,ct←),t∈[1,T]where xt represents the input of the current sample. ct← and ct→ represent the backward and forward cell states of the current sample. T is the length of the input time series. After processing the entire sequence, BiLSTM can ensure the output contains important features from both the beginning and end of the sequence by merging the hidden states from forward and backward propagation, which can significantly enhance the understanding and predictive accuracy of time series data. (20)htfb=δ1ht→+δ2ht←where δ1 and δ2 are the weight ratios of forward and backward hidden states. In general, a complete LSTM unit is composed of input gate, forgetting gate, output gate, and cell state [32]. The input gate that controlled by the sigmoid function can regulate the impact of the current input on the cell state. The forget gate determines the extent to which the cell state from the previous time step is forgotten, while the output gate regulates the influence of the cell state on the hidden state. The cell state is responsible for transmitting and storing long-term dependency information, and gate mechanisms control the flow and storage of information, which enable LSTM to capture long-term dependencies in sequences while maintaining gradient stability.

In view of the dynamic and complexity of the time series data involved in the FDIAs detection task, we further introduce the temporal self-attention mechanism to enhance the performance and robustness of the BiLSTM model. Our goal is to improve the model’s perception of the dynamic characteristics of time series data, so as to more accurately find the possible abnormal data, and further improve the model’s robustness. Specifically: (21)h~t=αj⊙htfb (22)Teat=Bσ(h~tVt)where αj=[α1,α2,⋯,αj] is temporal self-attention weight matrix. htfb is the forward and backward hidden state extracted by the current BiLSTM, and B is an auxiliary transformation matrix. Then, we combine the attention weight matrix of BiLSTM for weighted output to update the representation of temporal features. Through the temporal self-attention mechanism, the weight of the power grid time series data at different time points can be efficiently allocated, which helps in processing the long series data more effectively, taking into account the context dependency of the time series and the importance of different time points. Notably, a dropout layer is added at the end of the network to prevent its overfitting and improve the generalization capability of the model.

Considering the spatial correlation and temporal dependence, the features can be further fused to improve the representation capability of the features by combining self-attention and temporal self-attention features. To be specific, we use the pre-processed measurement data as the input X=[x1,x2,⋯,xn] of the network model. In the processing of spatial correlation, the topology of the power grid can be firstly obtained to construct the corresponding adjacency matrix A, and the corresponding Laplace matrix Λ~ is sequentially calculated. Then, we perform Chebyshev graph convolution by setting appropriate hyperparameters to effectively aggregate the information of adjacent nodes. (23)X~=LeakyReLU(CGCN(X)W1+b1)where LeakyReLU is nonlinear activation function, W1 is parameter matrix, and b1 is the deviation. After obtaining the spatial characteristics, we further consider the temporal characteristics of the grid measurement data. (24)Te=LeakyReLU(BiLSTM(X)W2+b2)

Finally, the spatio correlation information and temporal dependence information can be effectively fused to improve the representation capability of the features. (25)Fu=WcX~⊙WbTewhere Wc and Wb are two weighted matrices. After performing spatio-temporal feature fusion, the fused features can be fed to the full connection layer, and then output the results through the activation function to determine the normal and abnormal probability of the grid measurement data. (26)Y^=σ(WyFu+by)where Wy are weighted matrices, by is the deviation, and σ is sigmoid activation function. By combining the high-order Chebyshev graph convolution network and BiLSTM network with temporal self-attention mechanism, an efficient deep collaborative network can be integrated, which is called as CGCN-BiLSTM(Chebyshev Graph Convolution-Bidirectional Long Short-Term Memory). The complete network architecture is shown in Fig. 3.

In addition, it is necessary to construct the calculation error and back-propagation error of the loss function to guide the updating of network parameters during the training process of the neural network. In our network model, the cross entropy loss function is used to calculate the loss of the model, and the cosine annealing learning rate scheduler is also involved to dynamically adjust the learning rate and optimize the training process of the deep learning model. (27)ℒloss=−1N∑i=1N[yilog⁡(Y^i)+(1−yi)log⁡(1−Y^i)]where N is the input sequence length, yi stands for the real label (–1 or 1) of the i-th sample, and Y^i represents the prediction probability that the model belongs to the positive class for the i-th sample.

Based on the above-mentioned the spatiotemporal feature fusion model, we can build the detailed FDIA detection procedure, which can be described detailedly as follows, e.g., Algorithm 1, which can be described detailedly as follows:

Step 1: We conduct power flow calculations on the data collected from the power grid to obtain measurement data, which is then pre-processed to get input features X∈ℛN×T.

In our experiment, the load information of different regions of NYISO was utilized as the basic power gird data to generate normal measurement data. We simulated the measured data 𝒵 of the power system by power flow calculation based on this load information. Matpower toolkit was used to obtain relevant information, such as Jacobian matrix H and power grid topology, and FDIA sample sets were constructed to maximize the avoidance of BDD detection.

In order to ensure the authenticity of the experiment, we added the standard Gaussian distribution noise with a variance of 0.01 and mean value of 0, which was applied to different datasets, IEEE 14 bus system, IEEE 39 bus system, and IEEE 118 bus system, to generate experimental data with varying degrees of noise interference. Our goal is to verify that our detection model can still efficiently and accurately identify FDIA attacks under different levels of noise interference. In addition, for each bus system, we generated 15,000 groups of measurement data, including 7500 groups of FDIA data and 7500 groups of normal data. We labeled FDIA data as 1 and normal data as −1 to facilitate model detection. Correspondingly, all data samples were divided the data set into 75% training set and 25% test set for each experiment.

Moreover, in the process of model training, our network model can gradually update the weight parameters by calculating the loss value and gradient. In order to speed up the convergence speed of model training and prevent gradient explosion, we normalized the input data by the minmax function, and then adopted the exit strategy to temporarily stop the work of some neurons with a certain probability p to avoid the over-fitting of the model. All experiments were performed over Pytorch 1.7 framework with the Intel Core i9-12900hx CPU, 16GB RAM and NVIDIA GeForce RTX 4060 GPU. The power flow calculation and state estimation of power grid data were simulated using Matpower toolkit on MATLAB.

To provide sufficient performance comparison in terms of detection performance, we introduced four evaluation metrics, i.e., accuracy, precision, recall and F1 score, to give the experimental results. In general, the definition of statistical variables involved in the evaluation indicators were true negative (TN), false positive (FP), true positive (TP), and false negative (TN), respectively, which are as follows: 1) TN represents the number of correctly identified normal measurement data of the power grid as normal data, denoted as βTN. 2) FP refers to the number of errors in identifying normal measurement data of the power grid as FDIA, denoted as βFP. 3) TP stands for the number of FDIA data correctly identified as FDIA in the power grid, denoted as βTP. 4) TN means the number of times FDIA data in the power grid is incorrectly identified as normal data, denoted as βFN. Correspondingly, the calculation expressions for the four evaluation indicators are given as follows: (28)Acc=βTP+βTNβTP+βFP+βTN+βFN

Acc is the ratio of all correctly judged FDIA samples. The higher the value of Acc, the better the overall performance of the detection model. (29)Pre=βTPβTP+βFP

Pre is the ratio of real FDIA samples in the predicted FDIA samples. The larger the value of Pre, the lower the false alarm rate of the detection model and the better the detection effect. (30)Rec=βTPβTP+βFN

Rec is the ratio of correctly predicted FDIA samples in real FDIA samples. The higher the recall rate, the lower the missed detection rate of the detection model. (31)F1=2×Pre×RecPre+Rec

F1 is the harmonic average of precision and recall. The higher the F1 score, the better the overall performance of the detection model.

In this section, we conducted a series of experiments to compare the proposed scheme with existing state-of-the-art FDIA detection schemes, CNN [20], LSTM [22], GCN [24], CNN-LSTM [34] and DAMGAT [25]. In order to verify the effectiveness and reliability of the proposed FDIAs detection method, four different evaluation metrics, Accuracy, Precision, Recall, F1 score, were sequentially tested. All experiments were carried out over three standard data sets, IEEE 14 bus system, IEEE 39 bus system, and IEEE 118 bus system, to provide the experimental results. In each experiment, the input batch of all models was set to 64, and the number of training iterations was 80. The initial learning rate was set to 0.01 and adjusted using the Adam optimizer. The parameter probability of the dropout layer was initially set to 0.4. The order of Chebyshev polynomial of the proposed model is set to 3, the number of layers of LSTM is 2, and the number of layers of self-attention is 2.

The corresponding experimental results are shown in Table 1. As can be observed from this table, our scheme can obtain the best overall detection performance compared to other state-of-the-art schemes, no matter which dataset is used. To be specific, on IEEE 14 bus system, compared with the current best scheme DAMGAT [25], our scheme can obtain a significant performance gain with 3.25% for accuracy, 4.37% for precision, 1.81% for recall, and 3.02% for F1 score. For IEEE 39 bus system, our solution can achieve approximate improvements with 3.60% for accuracy, 3.67% for precision, 3.25% for recall, and 3.47% for F1 score. Similarly, for the larger scale data from the IEEE 118 bus system, our scheme can still achieve an approximate performance advantage, that is, the performance gain with 3.14% for accuracy, 2.92% for precision, 3.24% for recall, and 3.08% for F1 score. In addition, we conducted the experimental comparison of FPR (False Positive Rate) on IEEE 14, 39 and 118 bus systems, respectively, and the results are shown in Table 2. It can be seen from the data in the table that the FPR value of our model is significantly lower than that of other advanced models, indicating that the proposed method performs better in distinguishing between true and false samples.

The above experimental results demonstrated that our scheme can achieve significant performance improvements on both small-scale and large-scale datasets. In fact, this phenomenon can be easily explained by the following two reasons. Firstly, our proposed deep collaborative network combined the characteristics of the graph convolution network and Bi-LSTM to optimize the network structure, which can better adapt to different power grid structures and effectively capture the difference between the slight changes and actual FDIA attacks in the power grid, thus improving the robustness of the model to potential FDIA attacks. Secondly, the self-attention mechanism was introduced in spatiotemporal feature construction, which can further enhance the representation capability of spatiotemporal features, thereby efficiently guiding detection features to pay more attention to the differences between FDIA attack samples and normal data, resulting in a significant improvement of detection accuracy.

Furthermore, we can observe an interesting phenomenon from Table 1, that is, the overall detection performance on the IEEE 118 bus system is slightly lower than that on the IEEE 39 and IEEE 14 bus systems. To be specific, for accuracy measurement, the average reductions for IEEE 118 bus system were approximately 2.41% for IEEE 14 bus system, 1.43% for IEEE 39 bus system. For F1 score, the average reductions for IEEE 118 bus system were approximately 2.26% for IEEE 14 bus system, 1.45% for IEEE 39 bus system. This is mainly because if a bus system has a larger scale and more complex topology, it means that more system nodes and more complex power grid structures need to be processed in the FDIA attack detection process. This is inevitably more susceptible to external interference on the topology of the power grid, which can introduce more complex noise interference and lead to attack misjudgment by the detection model. Correspondingly, our proposed network model can deeply analyze and understand the behavior and interaction of each power node, which can efficiently process the spatial-temporal complexity of the power grid and make the detection model more sensitive to identify and respond to abnormal data in various power grid operations, thereby enhancing the adaptability and detection accuracy in the changing complex power grid environment.

In order to gain more insight, we further verified the applicability and robustness of the proposed detection scheme in the real power grid environment. In our experiments, a series of comparative experiments, including different attack intensities, different noise environments and different node attacks, were conducted over standard datasets from three bus systems, IEEE 14, IEEE 39 and IEEE 118 bus systems.

To further demonstrate the superiority of our proposed scheme, we performed a detailed analysis of the complexity and compared the running time of different FDIA detection schemes. To estimate the complexity of each model, we compared the training times of different detection schemes. The running time of five existing state-of-the-art FDIA detection schemes, CNN [20], LSTM [22], GCN [24], CNN-LSTM [34] and DAMGAT [25], and our proposed scheme. The experiments were performed under identical environmental conditions to ensure a fair comparison. The training time per epoch was the average of ten epochs, while the total training time was the average of three complete model training. In addition, on IEEE 14 bus system, the total maximum execution time of the model is 158.12 s; On the larger IEEE 39 bus system, this time is extended to 491.49 s; On the most complex IEEE 118 bus system, the total maximum execution time reached 1472.16 s. In the self-attention mechanism we introduce, we use linear multiplication, the time complexity is mainly with the input node, its time complexity is maintained in O(n), and the space complexity is maintained in the range of constant change, that is O(1). In addition, the computational overhead of the bi-directional LSTM network is mainly related to the input sequence length T. Its consumption mainly increases linearly with T, so the time complexity of the bi-directional LSTM network can be simplified to O(T) and the space complexity to O(T). In order to verify the feasibility of the method, we carry out experiments to detect the delay and throughput. The average detection delay of IEEE 14 bus system is 0.0034 s, and the throughput is 8245.95 samples per second. On the IEEE 39 bus system, the average detection delay is 0.0106 s and the throughput is 2621.37 samples per second. The IEEE 118 bus system has an average detection delay of 0.0312 s and a throughput of 897.83 samples per second (taking the average of the results of 20 iterations each). Different datasets were tested over the computer platform with Intel Core i9-12900hx CPU, 16 GB RAM and NVIDIA GeForce RTX 4060 GPU.

The corresponding experimental results were presented in Table 7. As can be seen from this table the average single training and total training time of our scheme were significantly lower than that of DAMGAT scheme, whichever IEEE bus system was used. Specifically, our scheme can reduce by 0.74 and 58.35 s for IEEE 14 bus system, 1.83 and 156.04 s for IEEE 39 bus system, and 8.49 and 623.72 s for IEEE 118 bus system. This is because the two-layer multi-head attention mechanism adopted by DAMGAT increases the computational complexity and leads to a long training time. Our proposed spatio-temporal self-attention mechanism simplifies the attention calculation and is more suitable for detection tasks, which significantly shortens the training time. In addition, compared to some traditional detection schemes, e.g., CNN, LSTM, our scheme got an obviously longer average single training and total training times. This is because the internal structure of traditional detection models is simpler, and their corresponding training process is thus faster. However, their feature extraction and representation capability is also correspondingly limited, which inevitably lowers their detection performance.