  We describe defense mechanisms designed to detect sophisticated grid attacks
involving both physical actions (including load modification) and sensor output
alteration, with the latter performed in a sparse manner and also so as to take
into account grid response mechanisms (secondary response). The attacks aim to
be both undetectable even under a full AC power flow model, and to hide
equipment overload. We demonstrate that such attacks, while perhaps difficult
to implement, nevertheless are easily computed even on systems with a large
number of installed sensors, and can, in a static setting, successfuly hide
large line overloads. Furthermore an attacker that understands the ongoing
stochastic nature of sensor signals can extend the attack so as to remain
effective for a nontrivial time period. To counteract such "ideal" or "perfect"
attacks, we demonstrate a set of data-driven stochastic techniques to thwart
the attacker and detect that an attack has taken place.
