An intelligent multi-layer framework for attack conduction, detection and reconstruction in the smart grid with renewable energies

The rapid proliferation of renewable energy sources (RESs) has enhanced operational flexibility but intensified cybersecurity concerns in modern power systems. In this work, we investigate how attackers can exploit the increased variability introduced by RESs to orchestrate false data injection attacks (FDIAs). First, we propose a targeted attack strategy based on Jensen–Shannon divergence (JSD) and the Kolmogorov–Smirnov (KS) test. This two-stage procedure identifies measurements that exhibit minimal distributional shifts after RES integration. False data are then injected into these stable measurements, blending seamlessly into the expanded measurement space and increasing attack stealth. Second, we develop a customized hybrid deep learning model, combining Convolutional Neural Networks (CNNs) and Long Short-Term Memory (LSTM) units to capture both spatial correlations and temporal dynamics in power system measurements. This design explicitly addresses concept drift arising from fluctuating load and generation profiles, ensuring persistent detection accuracy. Third, we integrate an Autoencoder (AE)–based reconstruction mechanism to repair compromised measurements upon detection, mitigating denial-of-service (DoS) scenarios that could result from discarding suspect data. Our evaluations on the IEEE 14-bus and 118-bus systems, using real-world load profiles, confirm that the JSD–KS approach boosts attack stealth while the CNN–LSTM–AE pipeline achieves robust detection and recovery. Our experiments on the IEEE 14-bus and 118-bus systems demonstrate F1-score gains of up to 3% over the strongest CLSTM baseline under traditional FDIA scenarios, and up to 13% under our intelligent FDIA, while also reducing AE reconstruction RMSE by approximately 6%–7%. This integrated strategy offers a multi-layered defense against evolving cyber threats in renewable-rich smart grids. • Intelligent FDIA strategy exploits RES variability using JSD-KS tests for stealthier attacks. • Hybrid CNN–LSTM model provides robust FDIA detection, adapting to concept drift in RES-rich grids. • Autoencoder-based reconstruction restores compromised measurements, preventing denial-of-service scenarios. • Proposed framework significantly outperforms baselines in detecting stealthy FDIAs and ensuring grid continuity.