Context-Aware Evasion of PMU-Based Intrusion Detection Systems in Wide-Area Control
Conference
Asif, M, Mali, P, Paudyal, S et al. (2026). Context-Aware Evasion of PMU-Based Intrusion Detection Systems in Wide-Area Control
. 2017 IEEE POWER & ENERGY SOCIETY GENERAL MEETING, 10.1109/PESGM58988.2026.11693404
Asif, M, Mali, P, Paudyal, S et al. (2026). Context-Aware Evasion of PMU-Based Intrusion Detection Systems in Wide-Area Control
. 2017 IEEE POWER & ENERGY SOCIETY GENERAL MEETING, 10.1109/PESGM58988.2026.11693404
Phasor measurement units (PMUs) improve wide-area control by providing synchronized, high-rate measurements for grid awareness. Recent learning-based intrusion detection on PMU streams includes recurrent and convolutional models, and more recent adversarially trained GAN-LSTM detectors that report stronger robustness under gradient tests and PMU-specific patterns. However, existing work focuses largely on gradient-based and white-box scenarios, and rarely evaluates an adaptive black-box adversary that updates inputs using only detector scores while keeping changes small, physically plausible, and within reporting latency. To address this gap, we model evasion as a query-based black-box problem with limited feedback and adopt reinforcement learning (RL) to learn a context-aware attack policy when gradients are not available and the objective must balance higher detector output with small, temporally smooth changes. In particular, we use proximal policy optimization (PPO) with an eight-parameter grouped-action policy that adjusts four PMU feature groups via one rescaling level and one sign-control level per group. Validation on the IEEE 118-bus system, having a GAN-LSTM detector with simulation on OPAL-RT, shows that the learned policy increases the fraction of attacks classified as benign from about 5% to about 95% at a median-benign threshold while keeping perturbations modest and smooth.
