Robust Anomaly based Attack Detection in Smart Grids under Data Poisoning Attacks

Anomaly-based attack detection methods are often used to detect data integrity or data falsification attacks in advanced metering infrastructure (AMI) of smart grids. However, there is a lack of studies on the effect of data poisoning attacks against the anomaly based attack detectors that depend on some form of machine learning. In this paper, we introduce some data poisoning attack strategies against anomaly-based attack detectors in smart metering infrastructure and show its impact. Specifically, we propose a whitebox and black box approach to poisoning attacks. Then, we propose modifications to improve the robustness of previous anomaly detection algorithms by modifying certain design choices for learning the thresholds for the anomaly detector. Specifically, we offer theoretical insights and experimental proof to explain why and when they mitigate data poisoning. These design choices include both the regression type and the loss function choice. We measure attack mitigation performance with two NIST specified metrics for CPS systems in the test set using a real smart metering dataset. Finally, we offer recommendations on energy utility's best anomaly detector design choices under varying attack parameters.