⚡ electrical engineering

FDIA-Resilient Dynamic State Estimation for Distribution Networks via LSTM-Integrated RAEC-CKF

This paper proposes a resilient dynamic state estimation method for distribution networks under false data injection attacks by integrating a residual adaptive ensemble cubature Kalman filter with a long short-term memory network to detect anomalies via weighted least squares comparison and restore corrupted data through time-series prediction.

Original authors: Bao Zhen Bao, Yunfei Li, Wengen Gao, Wenlong Jiang, Jinglong Qiu

Published 2026-07-08

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Bao Zhen Bao, Yunfei Li, Wengen Gao, Wenlong Jiang, Jinglong Qiu

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a city's power grid as a massive, complex nervous system. To keep the lights on and the appliances running safely, the control center needs a perfect, real-time "body scan" of the entire network. This process is called State Estimation. It's like a doctor trying to figure out a patient's health based on vital signs like heart rate and blood pressure.

However, hackers have found a way to trick this system. They launch False Data Injection Attacks (FDIA). Think of this as a hacker sneaking into the hospital and swapping the patient's real blood pressure monitor with a fake one that shows normal numbers, even though the patient is actually in crisis. Because the fake numbers look so realistic, the hospital's standard alarms (called "Bad Data Detectors") don't go off, and the doctors (the grid operators) make dangerous decisions based on lies.

This paper proposes a new, smarter way to catch these liars and fix the data. Here is how it works, broken down into simple steps:

1. The "Two-Doctor" Checkup

The researchers realized that relying on just one way to check the grid's health is risky. So, they created a system that uses two different "doctors" to look at the same data at the same time:

Doctor WLS (The Snapshot): This doctor looks at the data right now, instantly. It's fast but doesn't remember what happened a second ago.
Doctor RAEC-CKF (The Storyteller): This doctor uses a special math filter (a Cubature Kalman Filter) that remembers the story of the grid. It knows how voltage and current usually flow over time.

The Trick: Under normal conditions, both doctors agree on the patient's health. But when a hacker injects fake data, the "Snapshot" doctor gets confused immediately, while the "Storyteller" doctor notices something is wrong because the data doesn't fit the story. By comparing the two, the system can spot the lie.

2. The "Decay" Problem (Why old methods fail)

The paper points out a flaw in previous attempts to catch these hackers. Imagine the "Storyteller" doctor is so good at guessing that, after a few seconds of fake data, it starts to believe the lie and adjusts its story to match the fake numbers. Once it does that, the difference between the two doctors disappears, and the alarm stops ringing. The hacker wins because the system thinks the attack is over, even though it's still happening.

3. The "Time-Traveling" Assistant (LSTM)

To solve this, the authors added a Long Short-Term Memory (LSTM) network. Think of the LSTM as a highly trained assistant who has memorized the grid's entire history.

The Prediction: When the system detects a lie, the LSTM steps in. It looks at the last 20 seconds of real data from the neighborhood and predicts what the numbers should be right now, ignoring the fake data the hacker sent.
The Swap: The system takes this "Time-Traveling Assistant's" prediction and swaps it with the hacker's fake data.
The Result: Now, the "Storyteller" doctor (RAEC-CKF) is working with corrected, reliable data. It never gets tricked into believing the lie, so the alarm stays loud and clear for the entire duration of the attack.

4. The "Virtual Sensor"

The paper describes the LSTM as a "Virtual Sensor." If a real sensor is broken or hacked, the Virtual Sensor acts like a ghost sensor that knows exactly what the real one would have said if it were working. This allows the grid to keep running smoothly without interruption.

The Results

The researchers tested this on a standard model of a power grid (the IEEE 33-bus system) with a simulated hacker attack.

Old Method: Caught the attack at first, but then "gave up" and stopped detecting it after a short while. It was like a smoke alarm that stops beeping after the smoke gets thick.
New Method: Caught the attack and kept the alarm blaring the whole time. It also fixed the data so accurately that the error in the grid's "body scan" dropped by more than 50%.

In Summary

This paper presents a security system for power grids that doesn't just sound the alarm; it actively fixes the broken information in real-time. By combining a "memory-based" math filter with an AI assistant that predicts the truth, the system can spot hackers, ignore their lies, and keep the power grid safe and stable.

Technical Summary: FDIA-Resilient Dynamic State Estimation via LSTM-Integrated RAEC-CKF

Problem Statement
Modern distribution networks, evolving into complex cyber-physical systems (CPS), face significant vulnerabilities to False Data Injection Attacks (FDIA). Unlike traditional bad data, FDIA vectors are carefully crafted to bypass standard Bad Data Detectors (BDD) by manipulating measurement data without triggering residual thresholds. This leads to erroneous state estimates that compromise grid monitoring, control, and dispatch decisions.

Existing solutions face three primary limitations:

Decaying Detection Signals: Conventional methods that compare static and dynamic estimates often produce a strong initial detection signal that decays over time as the filter converges to the compromised steady state, leaving the system exposed to persistent attacks.
Modular Disconnect: FDIA detection and data correction are frequently designed as separate modules, lacking a unified framework that triggers correction immediately upon detection.
Complex Noise Handling: Non-Gaussian noise, dynamic uncertainties, and stealthy attacks require adaptive solutions that do not sacrifice estimation accuracy.

Methodology
The paper proposes a unified framework integrating a Long Short-Term Memory (LSTM) network with a Residual Adaptive Ensemble Cubature Kalman Filter (RAEC-CKF) and a static Weighted Least Squares (WLS) estimator.

FDIA Detection Mechanism:
The detection strategy relies on a dual-layer approach to ensure persistence:
1. Consistency Test: It computes the Euclidean distance between the static WLS estimate ( $\hat{x}_{WLS}$ ), which reacts instantly to measurement changes, and the dynamic RAEC-CKF estimate ( $\hat{x}_{RAEC-CKF}$ ), which evolves smoothly based on temporal models. A significant bias indicates an anomaly.
2. LSTM Verification: A dedicated LSTM detector, trained on attack-free historical data, reconstructs current measurements using a sliding window of past data. If the reconstruction error exceeds a threshold, it flags a potential attack.
3. Decision Logic: An FDIA is declared if the traditional BDD condition is violated and either the consistency test or the LSTM detector triggers. This logic distinguishes FDIA from harmless load disturbances.
Data Correction and Estimation:
Upon detecting an attack on a specific node, the framework activates a correction loop:
1. LSTM Prediction: Pre-trained LSTM models predict the time-series measurements for the attacked node and its neighbors based on historical data.
2. Measurement Replacement: These predicted values replace the corrupted measurements in the input vector for the RAEC-CKF.
3. Uncertainty Scaling: To account for the inherent uncertainty of the prediction, the corresponding diagonal entries of the measurement noise covariance matrix ( $R_k$ ) are scaled by a factor $\beta > 1$ , preventing the filter from over-trusting the pseudo-measurements.
4. Continuous Operation: The RAEC-CKF continues to update the state estimate using these corrected inputs, preventing the filter from converging to a false steady state. Correction persists until the consistency test stabilizes below the threshold for a defined number of steps.

Key Contributions

Persistent Detection Strategy: The paper introduces a method that maintains a consistent detection signal throughout the duration of an attack, overcoming the "decay" problem inherent in filters that converge to compromised states.
Unified Detection-Correction Framework: It integrates detection and correction into a single coherent loop. The same LSTM module used for verification provides the corrected data, enabling real-time error correction and preventing filter divergence.
Resilient Estimation Architecture: The combination of RAEC-CKF (handling non-Gaussian noise and dynamic uncertainties) with LSTM (providing data-driven prediction) creates a robust estimator capable of operating under cyber threats.

Experimental Results
The method was validated on the IEEE 33-bus system under a single-node mutation FDIA scenario (Node 9).

Detection Performance: The proposed LSTM-RAEC-CKF achieved an F1 score of 0.9933 (99.83% accuracy, 99.33% recall). In contrast, the conventional WLS-RAEC-CKF approach (without LSTM correction) suffered from rapid signal decay, resulting in a recall of only 2.67% and an F1 score of 0.0519.
Estimation Accuracy: Under attack, the corrected method reduced voltage estimation errors by more than 50% compared to uncorrected filters.
- Average Voltage Error: 0.004430 p.u. (vs. 0.010158 p.u. for uncorrected RAEC-CKF).
- Average Phase Error: 0.272° (vs. 0.949° for uncorrected RAEC-CKF).
- The corrected estimates remained within 0.5% voltage error and 0.3° phase error throughout the attack duration.

Significance and Claims
The authors claim that this framework effectively addresses the critical limitation of detection signal decay in dynamic state estimation. By unifying detection and correction, the method ensures that distribution networks can maintain reliable state estimates and operational stability even when subjected to sophisticated, persistent cyber-attacks. The study demonstrates that integrating data-driven prediction with model-based filtering provides a practical solution for securing energy management systems against FDIA.

Limitations and Future Work
The paper acknowledges that the current LSTM models were trained and tested under identical load profiles; real-world load variations and seasonal changes may impact prediction accuracy. Additionally, the framework currently assumes the attacked node is identified; a fully automatic attack localization mechanism is not yet implemented. Future work is proposed to focus on online retraining for dynamic adaptation and extending the method to handle coordinated attacks involving denial-of-service or GPS spoofing.