  A machine learning-based detection framework is proposed to detect a class of
cyber-attacks that redistribute loads by modifying measurements. The detection
framework consists of a multi-output support vector regression (SVR) load
predictor that predicts loads by exploiting both spatial and temporal
correlations, and a subsequent support vector machine (SVM) attack detector to
determine the existence of load redistribution (LR) attacks utilizing loads
predicted by the SVR predictor. Historical load data for training the SVR are
obtained from the publicly available PJM zonal loads and are mapped to the IEEE
30-bus system. The SVM is trained using normal data and randomly created LR
attacks, and is tested against both random and intelligently designed LR
attacks. The results show that the proposed detection framework can effectively
detect LR attacks. Moreover, attack mitigation can be achieved by using the SVR
predicted loads to re-dispatch generations.
