  Fast and accurate detection of cyberattacks is a key element for a
cyber-resilient power system. Recently, data-driven detectors and physics-based
Moving Target Defences (MTD) have been proposed to detect false data injection
(FDI) attacks on state estimation. However, the uncontrollable false positive
rate of the data-driven detector and the extra cost of frequent MTD usage limit
their wide applications. Few works have explored the overlap between these two
areas. To fill this gap, this paper proposes blending data-driven and
physics-based approaches to enhance the detection performance. To start, a
physics-informed data-driven attack detection and identification algorithm is
proposed. Then, an MTD protocol is triggered by the positive alarm from the
data-driven detector. The MTD is formulated as a bilevel optimisation to
robustly guarantee its effectiveness against the worst-case attack around the
identified attack vector. Meanwhile, MTD hiddenness is also improved so that
the defence cannot be detected by the attacker. To guarantee feasibility and
convergence, the convex two-stage reformulation is derived through duality and
linear matrix inequality. The simulation results verify that blending data and
physics can achieve extremely high detection rate while simultaneously reducing
the false positive rate of the data-driven detector and the extra cost of MTD.
All codes are available at https://github.com/xuwkk/DDET-MTD.
