Unsupervised Detection of False Data Injection Attacks in Nuclear Power Plant Time Series Using Generative Models
Book Chapter
Saripalli, J, Gangwani, P, Upadhyay, H et al. (2027). Unsupervised Detection of False Data Injection Attacks in Nuclear Power Plant Time Series Using Generative Models
. 720 LNICST 161-174. 10.1007/978-3-032-37274-1_10
Saripalli, J, Gangwani, P, Upadhyay, H et al. (2027). Unsupervised Detection of False Data Injection Attacks in Nuclear Power Plant Time Series Using Generative Models
. 720 LNICST 161-174. 10.1007/978-3-032-37274-1_10
False Data Injection (FDI) attacks are recognized among the most serious cyber threats to nuclear power plant cyber-physical systems, where manipulated sensor readings can mislead operators and delay emergency responses. Detecting FDI attacks in nuclear monitoring is challenging due to (i) the absence of labelled cyber-attack data, (ii) the complex temporal dynamics of monitored signals, and (iii) the multiple sensor subsystems that attackers may target. In this paper, we propose an unsupervised anomaly-detection framework using a sequence-aware Variational Autoencoder (Seq-VAE) based on Gated Recurrent Units and apply it in a multi-modal evaluation spanning two complementary nuclear monitoring subsystems: 52 radiation isotope dose channels and 96 reactor operational parameters from the Nuclear Power Plant Accident Database (NPPAD). Five distinct FDI attack types are simulated, including a novel Correlated Stealth attack respecting multi-sensor physical correlations. Detection is benchmarked against an LSTM (Long Short-Term Memory) Autoencoder (deep baseline) and Isolation Forest and Energy-Based Detectors (classical baselines), with thresholds set on validation data via Youden’s J statistic and frozen for test evaluation. All results are reported as mean ± standard deviation across 10 independent random seeds. The multi-modal comparison reveals systematic, modality-specific differences in detection performance: isotope dose channels are more sensitive to transient attacks, whereas reactor operational parameters are more sensitive to correlated cyber-attacks and physical accidents. These complementary strengths argue for combined multi-subsystem monitoring as a defense-in-depth strategy.
