  This paper presents a real-time non-probabilistic detection mechanism to
detect load-redistribution (LR) attacks against energy management systems
(EMSs). Prior studies have shown that certain LR attacks can bypass
conventional bad data detectors (BDDs) and remain undetectable, which implies
that presence of a reliable and intelligent detection mechanism to flag LR
attacks, is imperative. Therefore, in this study a detection mechanism to
enhance the existing BDDs is proposed based on the fundamental knowledge of the
physics laws in the electric grid. A greedy algorithm, which can optimize the
core LR attack problems, is presented to enable a fast mechanism to identify
the most sensitive locations for critical assets. The main contribution of this
detection mechanism is leveraging of power systems domain insight to identify
an underlying exploitable structure for the core problem of LR attack problems,
which enables the prediction of the attackers' behavior. Additional
contribution includes the ability to combine this approach with other detection
mechanisms to increase their likelihood of detection. The proposed approach is
applied to 2383-bus Polish test system to demonstrate the scalability of the
greedy algorithm, and it solved the attacker's problem more than 10x faster
than a traditional linear optimization approach.
