Power system state estimators serve as a critical first line of defence in transmission control centres, translating raw measurements into reliable system operating conditions. However, these systems have become increasingly attractive targets for false data injection attacks (FDIAs), where adversaries manipulate sensor data to create misleading system states without triggering detection alarms. Traditional detection methods often rely on simplified DC power flow models or assume attackers possess complete system knowledge, limiting their real-world applicability.
This research advances cybersecurity by proposing a consensus-based ensemble learning framework that combines three complementary machine learning classifiers: K-nearest neighbours, support vector machines, and Gaussian naive Bayes. Rather than relying on a single algorithm, the ensemble approach uses weighted voting to aggregate predictions, significantly improving detection robustness. The method processes temporal changes across multiple time intervals, capturing attack signatures that emerge over time rather than in individual snapshots.
A key innovation involves conceptual dimensionality reduction using index-based feature selection paired with principal component analysis. This dual approach reduces computational burden while preserving critical information for attack detection. The framework operates within realistic AC power flow conditions and assumes attackers possess only partial system knowledge, making it more practically relevant than existing methods.
Validation on the IEEE 118-bus test system demonstrates detection accuracy exceeding 99%, substantially outperforming comparable approaches in the literature. The methodology successfully identifies FDIAs while minimizing false positives, critical for maintaining operator confidence in automated security systems. As cyberattacks on energy infrastructure grow increasingly sophisticated, ensemble-based detection methods offer operators a more resilient defence mechanism. Future work should evaluate performance across diverse network topologies and examine detection latency under realistic operational conditions.
