Recurrent Graph Neural Network-Based Identification of Replay Attacks in Power Networks

As cyber-physical systems, power networks exchange data to ensure smooth operation. Through communication networks, the exchanged data becomes vulnerable to cyberattacks where malicious entities establish malevolent connections to falsify the data, which exploit the data integrity, leading to network instability. Machine learning-based solutions have been proposed to identify such malevolent actions, including false data injection attacks. This paper aims to (a) enhance the attack detection performance and (b) quantify the performance of non-recurrent and recurrent machine learning-based attack detection systems against multiple replay attacks that involve falsifying data via presenting normal operation patterns from previous timestamps. It turns out that capturing temporal aspects from the data using recurrent models outperforms non-recurrent models by 5-32% in accuracy (ACC). Specifically, we propose a recurrent graph neural network (RGNN) model that captures the temporal and spatial aspects of the network data. The RGNN model outperforms non-recurrent models by 14 – 32% and other recurrent models by 6 – 13% in ACC. The experiments are conducted on IEEE 14, 39, and 118-bus power networks where the model performance is enhanced (by up to 8% in ACC) in larger systems due to capturing more spatial and temporal features.