1

Quickest Detection of False Data Injection Attacks

in Smart Grid with Dynamic Models
Samrat Nath∗ , Student Member, IEEE, Israel Akingeneye†, Member, IEEE,
Jingxian Wu∗ , Senior Member, IEEE, and Zhu Han‡ , Fellow, IEEE

Abstract—A quickest intrusion detection algorithm is proposed control and data acquisition (SCADA) system of Iran’s Natanz
to detect false data injection attacks (FDIA) in smart grids with nuclear fuel-enrichment facility was attacked by a Stuxnet
time-varying dynamic models. The quickest detection algorithm worm in July 2010 [3]. An adversary can launch cyber-attacks
aims at minimizing the worst-case detection delays of cyber-
attacks, subject to an upper bound of the false alarm rate. by compromising the measurement results obtained by the
Since power grid state transitions could be caused by either SCADA system or phasor measurement units (PMUs), such
cyber-attacks or sudden change in loads or grid configurations, as the power injected into different buses or power flowing
we propose to distinguish between FDIA and sudden system into the lines between the buses. False data injected in the
change by using a time-varying dynamic model, which can measurement results will affect the real-time control of grid
accurately capture the dynamic state transitions due to changes
in system configurations. A dynamic state estimation algorithm operations, thus cause significant damages to power grids. A
is developed to estimate and track the time-varying and non- comprehensive review of false data injection attack (FDIA)
stationary power grid states. The quickest detection algorithm against modern power systems is given in [4]. To improve
is developed by analyzing the statistical properties of dynamic the cyber-security of smart grids, it is critical to ensure
state estimations, such that the algorithm minimizes the worst- the integrity and confidentiality of the intelligent electronic
case detection delay while accurately distinguishing FDIA from
sudden system changes. A Markov-chain-based analytical model devices (IEDs) in the network such as smart meters, RTUs,
is used to identify the detector’s parameter and quantify its PMUs through hardware or software hardening [5]. Tamper-
performance. Simulation results demonstrate that the proposed proof hardware platforms can reduce avenues for FDIA.
algorithm can accurately detect and remove false data injections A large number of algorithms have been developed to detect
or system faults with minimum delays. The proposed algorithm various forms of cyber-attacks in smart grids [6]–[10]. Most
can be implemented to harden intelligent electronic devices or
supervisory control and data acquisition systems to improve their methods assume a static system model, where the system is in
resilience to cyber-attacks or system faults, thus improving the steady state and its measurements are quasi-static over time.
cyber-security of smart grids. However, in reality, the state of a power system varies with
Index Terms—False data injection, cyber-attack, dynamic state time due to the dynamic nature of system loads [11]. So, state
estimation, dynamic load change, power system. estimation and FDIA detection algorithms require a dynamic
model to track the time evolution of the system states, which
can be utilized to detect and replace corrupted measurements
I. I NTRODUCTION
in the system. A dynamic state estimator can capture the
A smart grid is a combination of electrical power infras- system transients due to sudden system changes in a faster
tructure, smart meters, and a network of computers [1]. It and more accurate manner compared to its static counterpart.
uses information technologies to make intelligent decisions This is possible because of the dynamic state estimator’s
about the control and state of electrical power systems. Com- ability of using past state estimations to predict future state
pared to conventional power grids, smart grid is more robust of the system one step ahead. A mismatch between newly
and efficient due to the advancement in system monitoring, collected measurements and their predicted values indicates
energy management, and operation control. However, due that there have been sudden changes in the system such
to its dependence on cyber-infrastructure, a smart grid is as loss of a large load, changes in network configurations,
prone to cyber-attacks [1]. Cyber-attacks can be performed system faults, or malicious attacks that have modified some
by hacking into the communication network of smart grids, system measurements. It is vital to detect and identify these
or by remotely accessing the remote terminal units (RTUs) attacks as soon as possible in order to replace the corrupted
installed at the substations [2]. For example, the supervisory measurements before they are processed by the state estimator.
∗ S. Nath and J. Wu are with the Department of Electrical Engineering,
Dynamic state estimation is important for the control and
University of Arkansas, Fayetteville, AR 72701 USA. † I. Akingeneye is operations of a power grid [11]–[17]. Dynamic state estima-
with Intel Corporation, San Diego, CA 92131, USA. ‡ Z. Han is with the tion in many existing works is performed by using different
Department of Electrical and Computer Engineering, University of Houston, versions of an extended Kalman filter (EKF) to filter pre-
Houston, TX 77204 USA, and also with the Department of Computer Science
and Engineering, Kyung Hee University, Seoul, South Korea, 446-701. Cor- dicted state variables [11]–[13]. In [16], FDIA is detected by
responding author: Jingxian Wu ([email protected]) This work was supported tracking the dynamics of measurement variations in terms of
in part by the U.S. Department of Energy under Grant DE-OE0000779, by the Kullback-Leibler divergence [18] between two probability
the National Science Foundation under Grant ECCS-1711087, and by US
MURI AFOSR MURI 18RT0073, NSF CNS-1717454, CNS-1731424, CNS- distributions under normal and abnormal conditions. In [17],
1702850, CNS-1646607. an online FDIA detection method is developed by analyzing
Digital Object Identifier: 10.1109/JESTPE.2019.2936587

2168-6785 c 2019 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission.
See http://www.ieee.org/publications standards/publications/rights/index.html for more information.
 2

temporally consecutive estimated system states using wavelet a locally linear but globally non-linear dynamic state model
transform and deep neural network, which can effectively to represent the dynamic state transitions in power grids. The
capture deviations in temporal data correlations of state vectors dynamic state evolution of the power grid is estimated and
due to FDIA scenarios. Most works utilize the estimation tracked by using an EKF-based dynamic state estimator, which
residual, which is the difference between the newly collected estimates the current state by using both current measurements
measurements and their corresponding predictions, to test the and predictions from past states. A sudden system change
presence of FDIA. If the residual magnitude exceeds a certain will affect the dynamic state transitions on all buses based on
threshold, a flag is raised indicating that either there is a sud- the physical model of the grid, and such state transitions can
den system change or FDIA. FDIA is distinguished from sud- be accurately estimated by the dynamic state estimator based
den system changes by analyzing correlated measurements in on SCADA or PMU measurements. On the contrary, FDIA
the location near the abnormality. In [11], if the measurements or system faults might violate the dynamic state transitions
from neighboring buses fail the detection test simultaneously, determined by the model, and this may result in large residuals
a sudden change is declared. But, such a method might not be in estimation. Thus the employment of the dynamic state
effective if false data are simultaneously injected into several models can help distinguish FDIA from sudden system change.
neighboring buses with correlated measurements. This may The quickest intrusion detection algorithm is developed by
lead to a mischaracterization of the attacks as sudden changes. analyzing the statistical properties of the results obtained from
Most existing FDIA detection methods are developed to dynamic state estimations. The problem is formulated as a hy-
improve detection accuracy, with little or no attention given pothesis test performed on the residuals between the estimated
to detection delay. Detection delay is defined as the time and actual measurements. Since the false data attack vector
difference between the launch and detection of a cyber- is unknown at the detector, we propose a new normalized
attack. Reducing detection delay is critical for improving Rao-CUSUM test, which summarizes the unknown statistics
cybersecurity [19]. A lower detection delay can shorten the of post-attack distributions by using a normalized Rao test
response time so that remedial actions can be taken in a timely statistic. Simulation results show that the normalization of
manner to significantly reduce the damages and economic Rao test statistic yields significantly lower FAR compared
losses caused by cyber-attacks. Detection delay can be reduced to un-normalized Rao test statistic under the same detection
by employing algorithms from the quickest change detection delay. The design parameter of the test is identified by using a
(QCD) framework [20], which aims at minimizing the average Markov-chain based model of the test statistics through offline
or worst-case detection delays while ensuring high detection calculations. Once FDIA is detected, corrupted measurements
accuracy. One of the most commonly used QCD procedure are identified and replaced with their predicted values to ensure
is the cumulative sum (CUSUM) procedure [20], [21]. It has normal operations of the grid.
been shown in [22], [23] that the CUSUM algorithm is asymp- To summarize, this work has two main contributions. First,
totically optimum, that is, it can asymptotically minimize the detection algorithm aims at minimizing the worst-case
the worst-case detection delay (WDD) when the false alarm detection delay of FDIA while ensuring high detection accu-
rate goes to 0. However, implementation of CUSUM requires racy. The quickest detection algorithm is developed by using
knowledge of the exact statistical distribution of the mea- a new normalized Rao-CUSUM test that can accurately detect
surement under attack, which is usually unknown in practical FDIA in a timely manner. Second, with a dynamic model and
applications [24]. An adaptive Rao-CUSUM test is proposed dynamic state estimations, the quickest detection algorithm can
in [6] for false data detection in smart grid, where the unknown distinguish state transitions caused by FDIA from those caused
distribution of data under attack is summarized by using the by sudden system change, thus ensure the normal operations
Rao test statistic [25]. In [19], an orthogonal matching pursuit of the grid under both conditions.
CUSUM (OMP-CUSUM) algorithm is proposed to identify The remainder of this paper is organized as follows. Section
the buses under attack while minimizing the detection delay. II describes the system model and problem formulation. The
Both [6] and [19] are developed under highly simplified linear dynamic model and dynamic state estimation are presented in
static system models and they cannot capture the time-varying Section III. In Section IV, we develop the quickest detection
transient of power grids. algorithm by analyzing the statistical properties of the results
In this paper, we develop a quickest intrusion detection from dynamic state estimations. In Section V, a Markov-chain-
algorithm for detecting FDIA in smart grids by using dynamic based model is introduced to analytically evaluate the proposed
state estimations. This algorithm can be used to harden IEDs, false data detector. Simulation results are given in Section VI,
PMUs, or SCADA system to improve their resilience to cyber- and Section VII concludes this paper.
attacks or system faults. The detection method is designed
to minimize the worst-case detection delay of FDIA subject II. S YSTEM M ODEL
to an upper bound of the false alarm rate, which is defined A power system with N buses is considered. Without loss of
as the probability of falsely detecting an FDIA while the generality, the first bus is assumed to be the reference. Define
system is under normal operating conditions. One of the main the set of buses connected to bus i as Xi with cardinality
challenges faced by FDIA detection is to distinguish power ci = |Xi |. Denote the active and reactive power injections
grid state changes caused by FDIA from those caused by into bus i as Pi and Qi , respectively. Similarly, the active and
a sudden system change, such as sudden load changes on reactive power flows from bus i to bus j are denoted Pij and
certain buses. To address this challenge, we propose to use Qij , respectively, ∀ j ∈ Xi .
 3

The power system collects measurements of both active and Combining (3)-(5) yields
reactive power flows on different buses. The measurements
x̃k+1 = Fk xk + Gk , (6)
are collected in such a way that the system becomes ob-
servable, i.e. all the state variables can be determined from where
the measurements. There are many optimal approaches for Fk = α(1 + β)In ,
sensor placement in order to make the system completely
observable through collected measurements [26]. The power Gk = (1 + β)(1 − α)x̃k − βa′k−1 + (1 − β)b′k−1 .
system provides a total of m = m1 + m2 + 1 measurements, The time-varying linear dynamic model in (2) can then be
where m1 = 2N is P the number of active and reactive power obtained by adding a zero mean Gaussian noise wk to (6) to
N
injections, m2 = i=1 |Xi | is the number of active and account for model uncertainties.
reactive power flows. In addition to the power measurements, The proposed dynamic state estimator contains two steps:
the measurement of the voltage magnitude at the reference state forecasting and state estimation.
bus is also available. Define the measurement vector as z =
[z1 , z2 , · · · , zm ]T ∈ Rm×1 , where (·)T is the matrix transpose A. State Forecasting
operator and R is the set of real numbers. One main advantage of the dynamic state estimator is its
Define the state vector as x = [x1 , x2 , . . . , xn ]T ∈ Rn×1 ability to use past state estimates to predict future system
for n = 2N − 1, where the first N − 1 elements of x are the states. Let x̂k be the estimated state vector at time k and Σk its
voltage angles of N − 1 non-reference buses and the last N error covariance matrix. The predicted state vector x̃k+1 and
elements are the voltage magnitudes of N buses. its error covariance matrix Mk+1 at time k can be obtained
The relationship between the measurement vector zk and by performing the conditional expectation on (2) as follows
the state vector xk , at an instant of time k is expressed as
x̃k+1 = E [xk+1 | xk = x̂k ] = Fk x̂k + Gk , (7)
zk = h(xk ) + ek , (1) h
T
i
Mk+1 = E (xk+1 − x̃k+1 ) (xk+1 − x̃k+1 ) | xk = x̂k
where h(xk ) = [h1 (xk ), . . . , hm (xk )]T is a nonlinear function = Fk Σk Fk + Qk , (8)
between the measurement vector zk and the system state
vector xk , and ek ∈ Rm×1 is the measurement error vector where E [.] is the expectation operator.
at the sampling instant k. As shown in [11], we assume that
the measurement noise ek is zero-mean Gaussian distributed B. State Estimation
with covariance matrix Rk . The state estimation, also known as state filtering, seeks to
Based on the observations in (1), the state estimator can estimate the state at time k + 1 by using both the predicated
obtain an estimate x̂k of the state variable xk . The state state vector, x̃k+1 , obtained at the preceding step k, and the
estimation results can be used to facilitate the detection of newly received measurement vector zk+1 at time k+1. During
FDIA or system faults. this stage, a new estimate x̂k+1 along with its error covariance
matrix Σk+1 are obtained at time k + 1 by minimizing the
III. DYNAMIC S TATE E STIMATION objective function
In this section, we present a dynamic state estimation 1 T
J (xk+1 ) = [zk+1 − h(xk+1 )] R−1 k+1 [zk+1 − h(xk+1 )]
algorithm, which relies on previous estimates to predict future 2
states of the system. The predicted states can, in turn, be used 1 h
T
i
+ (xk+1 − x̃k+1 ) M−1 k+1 (xk+1 − x̃k+1 ) . (9)
by the system operator for timely anomaly detection and other 2
control decisions such as economic dispatch. The estimate x̂k+1 that minimizes the objective function in (9)
Consider the following state transition model, which de- can be obtained through an iterative extended Kalman filter
scribes the time behavior of the state vector, as (EKF) [11] as

xk+1 = Fk xk + Gk + wk , (2) x(i+1) = x(i) + Σ(i) {HT (x(i) )R−1 [z − h(x(i) )]

− M−1 [x(i) − x̃]}, (10)
where Fk ∈ Rn×n is a non-zero diagonal matrix, Gk ∈ Rn×1
is a non-zero column vector, and wk ∈ Rn×1 is a white where i denotes the iteration counter, H(x) = ∂h(x)
∂x is the
Gaussian noise vector with 0 mean and covariance matrix Qk . Jacobian matrix, and
The parameters Fk and Gk can be identified according h i−1
to the Holt’s exponential smoothing method [11]. The Holt’s Σ(i) = HT (x(i) )R−1 H(x(i) ) + M−1 . (11)
method performs smoothing over an original time series with It should be noted that the subscript k + 1 was omitted in
two smoothing parameters, α and β, with values between 0 (10) and (11) for simplicity. The proof for (10) is given in
and 1. Denote the predicted state vector at time k as x̃k . The Appendix A.
Holt’s method is expressed as One main benefit of the state forecasting stage is to provide
x̃k+1 = a′k + b′k , (3) the initial states to the iterative EKF algorithm in (10). Thus,
the convergence of the EKF algorithm partly depends on the
a′k = αxk + (1 − α)x̃k , (4)
accuracy of the forecast state vector. A high state forecasting
b′k = β a′k − a′k−1 + (1 − β)b′k−1 .
 
(5) accuracy leads to a faster convergence of the EKF algorithm.
 4

IV. FALSE DATA D ETECTION AND I DENTIFICATION all buses based on the physical model of the system. On the
The problems of detecting false data injections in the other hand, FDIA will only affect the measurements on a few
measurement vector and identifying the buses under attack buses. Thus we propose to distinguish between sudden load
are studied in this section. change and FDIA by analyzing the statistical correlations of
Results of the dynamic state estimation will be used in signals from different buses.
the detection and identification of FDIA. To facilitate the
development of the FDIA detection algorithm, let the initial A. Formulation of the Hypothesis Test
guess x(i) = x̃ at time k + 1 and by performing only one Define the null hypothesis H0 , which corresponds to the
iteration in (10), the estimated state vector is approximated as measurements without false data at time k + 1, and the alter-
native hypothesis H1 , which corresponds to the measurements
x̂k+1 = x̃k+1 + Kk+1 vk+1 , (12)
with false data at time k + 1, as
where
H0 : zk+1 = h(xk+1 ) + ek+1 ,
vk+1 = zk+1 − h(x̃k+1 ) (13) H1 : zk+1 = h(xk+1 ) + ek+1 + a, (19)
is the residual vector, where a is a vector of false data injected in the measurements.
Kk+1 = Σk+1 H T
(x̃k+1 )R−1 (14) From (13), (17), and (19), the hypothesis test on the residual
k+1
vector vk+1 can be written as
is the gain matrix, and
H0 : vk+1 = H(x̃k+1 )(xk+1 − x̃k+1 ) + ek+1 ,
−1 −1
Σk+1 = HT (x̃k+1 )R−1
 
k+1 H(x̃k+1 ) + Mk+1 . (15) H1 : vk+1 = H(x̃k+1 )(xk+1 − x̃k+1 ) + ek+1 + a. (20)
To facilitate analysis, write the Taylor series expansion of The residual vector vk+1 under the null hypothesis H0 is
h(xk+1 ) around a linearization point x̃k+1 as generally assumed to be a zero mean Gaussian vector [11] and
h(xk+1 ) = h(x̃k+1 ) + H(x̃k+1 )(xk+1 − x̃k+1 ), (16) [14]. With the dynamic state estimator presented in this paper,
the covariance matrix Sk+1 of the residual vector is given
where H(x̃k+1 ) = ∂h(x)
∂x |x=x̃k+1 .
in (18). Assuming that the attack vector a is a deterministic
The higher order terms of (16) are omitted by assuming that vector, under the alternate hypothesis H1 , vk+1 is Gaussian
the difference (xk+1 − x̃k+1 ) is very small. with mean a and covariance matrix Sk+1 .
Combining (1), (13), and (16) gives As in (18), the elements in zk+1 are correlated based on the
physical model of the power grid. To simplify the analysis, we
vk+1 = H(x̃k+1 )(xk+1 − x̃k+1 ) + ek+1 . (17) propose to perform a whitening transformation on vk+1 . The
The covariance matrix, Sk+1 , of the residual vector, vk+1 , covariance matrix of the residual vector can be decomposed as
can then be calculated as Sk+1 = UTk+1 Dk+1 Uk+1 , where Dk+1 is a diagonal matrix
with the eigenvalues of Sk+1 on its main diagonal and Uk+1
Sk+1 = H(x̃k+1 )Mk+1 HT (x̃k+1 ) + Rk+1 . (18) is the corresponding orthonormal eigenvector matrix at time
Based on (12), the estimated state vector x̂k+1 is a func- instant k + 1. The whitening transformation of the residual
tion the residual vector vk+1 , the difference between newly vector vk+1 is v̄k+1 = Wk+1 vk+1 , where the whitening
− 21
received measurements at time k + 1 and its corresponding matrix Wk+1 = Dk+1 Uk+1 . With the whitening operator,
predictions h(x̃k+1 ). The newly received measurement vector it can be easily shown that the covariance matrix of v̄k+1 is
zk+1 may deviate from its predicated value h(x̃k+1 ). This Im , which is an m × m identity matrix.
mismatch between the measured and predicted measurements Following the Gaussian distribution of vk+1 given in (20),
may be a result of several factors: a sudden change in the the hypothesis test on v̄k+1 is
system’s operating point due to a loss of a large load [12],
H0 : v̄k+1 = Wk+1 vk+1 ∼ N (0, Im ),
system faults such as sensor failure or line-to-ground faults,
or false data injections in the measurements. The change in H1 : v̄k+1 = Wk+1 vk+1 ∼ N (µ, Im ), (21)
the system’s operating point is considered as a normal event. where µ = Wk+1 a.
However, presence of false data injections is abnormal and
can be very harmful to the system. Hence, it is vital to B. Proposed False Data Detector
distinguish between state changes due to sudden load change
A QCD-based false data detection method is proposed in
or FDIA, such that false data injections can be detected and
this section to detect cyber-attacks. We assume that the false
removed from the measurements zk+1 before performing state
data is injected at a random time τ , and the attack was detected
estimations.
at time τ̂ . Based on the design criteria of quickest change
We propose a new quickest change detection method by
detection, the problem can be formulated as
analyzing the statistical properties of the residual vector vk+1 .
The design criterion of the quickest change detection algorithm (P1) minimize WDD = sup Ek [(τ̂ − k)+ ]
is to minimize the worst-case detection delay, subject to the k

constraint on an upper-bound of the false alarm rate. Specif- 1

subject to FAR = ≤ ζ.
ically, a sudden load change will affect the measurements on E∞ [τ̂ ]
 5

where WDD is the worst-case detection delay, FAR is the Under the null hypothesis H0 , the Rao test statistic follows
false alarm rate, (a)+ = a if a ≥ 0 and 0 otherwise, Ek is Chi-square distribution, that is, Y (v̄k ) ∼ χ2m , where m is
the expectation assuming the attack becomes active at τ = k, the degree-of-freedom corresponding to the dimension of the
and E∞ denotes the expectation when there is no attack. The measurement vector. If we directly replace the LLR Lk in
solution of the problem is a quickest detection algorithm in that (23) with the Rao test statistic Y (v̄k ) in the CUSUM test
it aims at minimizing the worst-case detection delay, subject defined in (22), the CUSUM test statistic Ck will increase
to an upper bound of the false alarm rate. monotonically under both the null and alternative hypothesis
The above problem can be solved by using the well-known because Y (v̄k ) ≥ 0. This is undesirable for CUSUM because
CUSUM algorithm [21] it is a threshold test. To address this issue, we introduce a
normalized version of the test statistic in (26) with respect to
τ̂ = inf{k ≥ 1|Ck ≥ A}, (22) the mean and √ standard deviation of Y (v̄k ) under H0 , which
where A is a threshold obtained by the FAR upper bound ζ, are, m and 2m, respectively. Based on the normalized test
statistic, we propose a new detection rule as follows.
Ck+1 = max(0, Ck + Lk ), (23)
Definition 1. (Normalized Rao-CUSUM Detector) Given a
and Lk = log f1 (v̄k )
is the log-likelihood ratio (LLR), with whitened residual vector v̄k+1 = Wk+1 vk+1 at time k + 1 ,
f0 (v̄k )
f1 (v̄k ) and f0 (v̄k ) being the probability density functions an FDIA is detected at time τ̂ with
(pdfs) associated with hypotheses H1 and H0 , respectively. τ̂ = inf{k ≥ 1|Tk ≥ A}, (27)
The CUSUM algorithm is the asymptotically optimum solu-
tion to (P1) because it can asymptotically minimize the WDD where

Y (v̄k+1 ) − m

when the FAR goes to 0 [22], [23]. Tk+1 = max 0, Tk + √ > A, (28)
Under the assumption that v̄k is Gaussian distributed, the 2m
LLR can be calculated as with T0 = 0. The threshold A is determined by the FAR upper
1 bound ζ.
Lk = aT WkT v̄k − aT WkT Wk a. (24)
2 The normalized Rao-CUSUM detector is developed by
The calculation of the LLR Lk requires the knowledge of modifying the asymptotically optimum GLRT-CUSUM de-
the attack vector a, which is unknown at the detector. Thus tector to balance the tradeoff between complexity and per-
we cannot directly apply the CUSUM algorithm. In order to formance. The proposed normalized Rao-CUSUM algorithm
resolve the unknown parameters, the detection method in [23] might have a bit higher WDD than the GLRT-CUSUM algo-
utilizes the generalized likelihood ratio test (GLRT) approach rithm, but offers much lower complexity.
by replacing the unknown parameter with the maximum like- It should be noted that the above test can distinguish be-
lihood estimation (MLE) as tween sudden load change from FDIA because the formulation
Xk of the null hypothesis H0 includes sudden load change as
τ̂ = inf{k ≥ 1| max sup Li ≥ A}. (25) a special case. In case of a sudden load change, the system
1≤t≤k a i=t
dynamics still follow the physical model of the power grid. As
This approach is proven to be asymptotically optimal in a result, the residual vector can still be modeled as zero-mean
terms of minimum detection delay [27]. However, the test Gaussian distributed with covariance matrix Sk+1 . Yet this is
statistic cannot be computed recursively as the CUSUM test, no longer true when there is false data injected into the power
because GLRT needs to compute every unknown element of grid, which is modeled as the alternative hypothesis H1 . Since
a for each observation at sampling time 1 ≤ t ≤ k. In other the test in Definition 1 is designed to distinguish between the
words, GLRT needs to store the observations and perform null and alternative hypothesis by minimizing the worst-case
MLE of a at every sampling instant. As a result, this approach detection delay, it is able to distinguish between load change
has very high complexity, and it might not be feasible for real- and FDIA. On the other hand, system faults, such as sensor
time FDIA detection in power grids. failures or line faults, will also cause the measurements to
A low-complexity adaptive-CUSUM algorithm is proposed deviate from those predicted by the physical model of the
in [6] based on Rao test [25], which is asymptotically equiv- system. In that case, the proposed algorithm will be able
alent to the GLRT test [28]. The Rao test statistic can be to detect the presence of sensor failures or system faults.
computed by taking the derivative of Lk with respect to the However, it will not be able to differentiate FDIA from sensor
unknown parameter a evaluated around the region of interests. failures or system faults. Thus the algorithm will treat FDIA,
In our case, the region of interest is considered to be around sensor failure, or other system faults in a similar manner.
zero because the hypothesis H0 has zero mean. According to In case false data are detected, we can identify the buses
(21), the statistic [25] of the Rao test for detection at time k under attack by using the power of the residuals at different
can be written as follows: buses. That is, if the residual power or amplitude on a given
∂Lk T  ∂Lk bus is above a certain threshold, then it is considered that
= v̄kT v̄k , (26)
 −1
Y (v̄k ) = a=0
I (a) a=0 a=0 the corresponding bus is under attack. Similar to [11], the
∂a ∂a
amplitude test can be expressed as
where I(a) is the Fisher information matrix [18]. The proof
for (26) is given in Appendix B. |vk+1 (i)| > γσSi , (29)
 6

A
where |vk+1 (i)| is the absolute value of the i-th element of where ∆ = M−1 and M represents the total number of
vk+1 , σSi is the standard deviation of the i-th element of vk+1 , transitions from 0 to the state that has the value greater than
and γ defines the limit of confidence. If a bus is detected as the threshold A.
under attack, we replace the estimated states with the predicted It can be easily observed from (28) that the sequence
states to ensure the normal operations of the power grid. exhibits the property of a first-order Markov chain, where the
The normalized Rao-CUSUM detector proposed in Defini- future state Tk+1 at time index k + 1 depends only on the
tion 1 is a simple threshold test, and the test statistic Tk can be current state Tk , but not on past states [29].
recursively calculated based on (28). As a result, the proposed The transition probabilities of the Markov chain under H0
test has low complexity and can be easily implemented. The for the proposed algorithm from state Ui at k to state Uj at
implementation of the detector in (27) requires a threshold A, k + 1 can be described as
which in turn depends on the FAR upper bound ζ. In the next
section, we will provide a theoretical guideline for choosing Pij = P (Tk+1 ∈ Uj |Tk ∈ Ui ). (30)
the threshold value A in terms of FAR with the help of a
Markov-chain-based analytical model. The transition probability Pij can be computed numerically
using Monte-Carlo simulations according to the distribution of
v̄ under the null hypothesis H0 . The values of the transition
C. Computation Complexity Analysis probabilities are uniquely determined by the threshold A and
In this subsection, we study the effects of the size of system the number of discretization levels M . Since the calculations
on the computation complexity of the proposed algorithm. The of the transition probabilities are performed offline, we can
size of the system can be defined by two parameters: achieve arbitrary precision of the transition probability by
• The dimension of state vector: n = 2N − 1, where N is increasing the number of Mote-Carlo trials without affecting
the number of buses in the system, the complexity of the online portion of the algorithm. As a
• The dimension of measurement vector: m, which depends result, we can establish a very accurate numerical relationship
on the number of buses and lines. between A and the transition probabilities.
Define the transition probability matrix (TPM) P as an
It is easily observed that m > n. To determine the effect of size
(M + 1) × (M + 1) matrix with the (i, j)-th element being
of the system on the performance, we present the complexity
Pi−1,j−1 . It is clear that P is a Markov matrix, that is, all
analysis of the proposed algorithm in a single sampling instant
elements of P are non-negative and the sum of each row vector
k with respect to these two parameters separately.
is 1. The steady-state probability πj of each state Uj can be
The proposed algorithm has two stages: 1) false data determined by
detection and 2) dynamic state estimation. With respect to
m, computation in stage 1 is dominated by the eigenvalue XM
πj = Pij πi , ∀ j ∈ {0, · · · , M }, (31)
decomposition process which has a cubic complexity O(m3 ), i=0
and stage 2 is dominated by the matrix inversion of Rk which XM
πj = 1. (32)
also has a cubic complexity O(m3 ). So, total complexity of j=0
the proposed algorithm scales cubically with m as O(m3 ).
The transition probability of the Markov chain can be
With respect to n, stage 2 computation is dominated by the
written in a matrix format as
computations of Mk in (8) and Σk in (11), both of which
have a cubic complexity O(n3 ). Comparatively, complexity
PT π = π (33)
of stage 1 scales quadratically with n. So, total complexity of
the proposed algorithm scales cubically with n as O(n3 ). where π = [π0 , π1 , · · · , πM ]T . The steady-state probability
vector π can then be obtained by finding the eigenvector
V. M ARKOV- CHAIN - BASED A NALYTICAL M ODEL corresponding to the eigenvalue 1 of the TPM P. Since P
is a Markov matrix, it always has an eigenvalue of 1.
In this section, we present a Markov-chain-based model to
The steady-state probability can be used to calculate the
analyze the proposed false data detector. The Markov-chain-
FAR, which can be equivalently evaluated as the probability
based model provides theoretical guidelines on the choice of
that Tk crosses the threshold A when there is no attack in the
the detection threshold in (27) based on the FAR upper bound.
network. As in [29], the FAR can be equivalently calculated
For a given FAR upper bound, we can obtain the optimum
as the steady-state probability πM , that is, the probability that
detection threshold by using offline Monte-Carlo simulations.
Tk stays at state UM under the null hypothesis
Once the optimum threshold is obtained offline, the online
normalized Rao-CUSUM detector can then be performed to FAR = πM . (34)
detect FDIA or system faults in real time.
To facilitate analysis, R+ ∪ 0 is discretized into a finite set Since πM is determined by the eigenvector of P, which in
of intervals representing the states {U0 , U1 , · · · , UM } such as turn depends on the choice of threshold A, there is an optimum
threshold value for a given FAR. Enabled by the Markov-chain
U0 = 0, U1 = (0, ∆], U2 = (∆, 2∆],
model, we can numerically obtain a very accurate estimate of
U3 = (2∆, 3∆], ······ , UM = (A, +∞), the optimum threshold based on the FAR.
 7

103
Rao-Cusum
Proposed

WDD

102

101
10-3 10-2
FAR
Fig. 2. Single Line Diagram Two Area System [31].
Fig. 1. Performance analysis of the proposed algorithm in comparison with
Rao-CUSUM test [6].
-16
corrupt
original
-16.4
VI. S IMULATION R ESULTS estimated
predicted
In this section, we present numerical simulations results to -16.8

P14 (p.u.)
illustrate the performance of the proposed algorithm. The first -17.2
subsection demonstrates the performance in terms of FAR and
WDD using simulated data. The second subsection presents -17.6

numerical results based on simulations of the 13-bus system

-18
using MATLAB Power System Toolbox (PST v3.0) [30], [31].
-18.4
0 0.2 0.4 0.6 0.8 1
A. WDD v.s. FAR Time (seconds)

Fig. 1 shows the tradeoff between WDD and FAR of the Fig. 3. The real power at bus 14 vs time t with false data at 0.25 ≤ t < 0.6,
proposed algorithm and the Rao-CUSUM test presented in load change at t = 0.6, and the detector in (28).
[6]. In the simulation, the data are generated by following
the model in (21) with m = 55 and µ = [1, 1, 0, · · · , 0]. The
false data injection time τ follows discrete uniform distribution and reactive power measurements. The matrix Qk = 10−6 In
between [1, 100]. Every point on the curves is obtained by is kept constant at every sampling time k. The parameters
averaging over 10, 000 Monte-Carlo trials. For a given FAR, Fk and Gk are obtained according to the Holt’s exponential
the corresponding threshold A is chosen by following the smoothing method with α = 0.95 and β = 0.001 [11].
Markov-chain analysis in Section V. As expected, the WDD The sampling rate in our simulation is set as ∆t = 0.01
is a decreasing function of the FAR. The proposed detection seconds. Thus the k-th time index corresponds to a time value
algorithm outperforms the Rao-CUSUM test used in [6]. At of t = k∆t seconds. In order to evaluate the performance of
FAR = 10−2 , the WDD of the proposed algorithm and the the proposed detector, two scenarios are simulated: false data
Rao-CUSUM test is 42 and 95 samples, respectively. and sudden load change conditions. The false data condition
is simulated by injecting errors of −1.5 and 1 p.u. into the
active power measurements at buses 13 and 14, respectively,
B. FDIA Detection in Power Systems during a time period 0.25 ≤ t < 0.6 seconds unless specified
In this section, we present the simulation results performed otherwise. The sudden load change condition is simulated by
on a 13-bus system with two areas as shown in Fig. 2. Bus 1 cutting the active power injection of bus 4 by 1 p.u at t = 0.6
is used as the reference bus. The measurement vector consists seconds. In each of the following figures, every point on the
of m = 55 components: the voltage magnitude of bus 1, curves is obtained by averaging over 1, 000 Monte-Carlo trials.
the active and reactive power injections at all 13 buses, the Fig. 3 shows the active power at bus 14 with false data
active and reactive power flows at all 14 lines. The state vector injected into the active power measurements at buses 13 and
consists of n = 25 components: the voltage magnitudes at all 14. In addition, the active power injection of bus 4 is cut by
13 buses and the phase angles at the 12 non-reference buses. 1 p.u. at t = 0.6 seconds to simulate sudden load change.
Using MATLAB Power System Toolbox (PST v3.0), the The threshold of the proposed detector is set at A = 200,
system dynamics is simulated by increasing the active load at which corresponds to FAR of 2.5 × 10−5 according to the
bus 4 by 0.5 per unit (p.u.) and the resulting measurement and Markov-chain analysis. Once an FDIA is detected, the residual
state vectors are considered as the true values of the system. amplitudes are compared to a threshold as in (29) to identify
The noisy measurement vector ek in (1) is obtained by adding the buses under attack, with α = 3.5 used in this paper. The
a zero mean Gaussian noise with a diagonal covariance matrix measurements at the buses under attack are then replaced with
Rk to each of the true measurements. The noise variances, their predicted values. When there is no attack, the power
which are the diagonal elements of Rk , are 10−5 for the calculated from the estimated states is almost identical to its
voltage magnitude of reference bus and 10−6 for the active actual value. When false data is injected between 0.25 ≤ t <
 8

0.99 -16.5
predicted

Vmag. (p.u)
corrupt
estimated estimated
0.985 original predicted
original
-17
0.98

P14 (p.u.)
0 0.2 0.4 0.6 0.8 1
Time (seconds)
-34
Vang. (degrees)

-17.5

-36 predicted
estimated
original
-38
0 0.2 0.4 0.6 0.8 1 -18
0 0.2 0.4 0.6 0.8 1
Time (seconds)
Time (seconds)

Fig. 4. The voltage magnitude (top) and phase angle (bottom) at bus 13 vs Fig. 5. The real power at bus 14 vs time t with false data at 0.25 ≤ t < 0.6
time t with false data at 0.25 ≤ t < 0.6, load change at t = 0.6, and the and the detector in [11].
detector in (28).

-8.8
original
0.6 seconds, the proposed detector successfully detects the -9 estimated
presence of FDIA and replaces the corrupted measurement -9.2
predicted

with the predicted values. In this case, the power calculated by

-9.4
using state estimation is slightly different from its true value,

P4 (p.u.)
-9.6 -9.9
with a difference less than 0.33%. When there is a sudden
-10
change at t = 0.6 seconds, the detector correctly recognizes -9.8
-10.1
it as a normal operating condition and achieves correct state -10
-10.2
estimates. In addition, there is a one sample lag between the -10.2
0.59 0.6 0.61

predicted value and the actual value. -10.4

Fig. 4 shows the voltage magnitude (top) and phase angle 0.5 1 1.5 2
Time (seconds)
(bottom) at bus 13 under the same configuration of Fig. 3. The
voltage amplitude and phase are estimated with high accuracy Fig. 6. The real power at bus 4 vs time t with false data at 0.25 ≤ t < 0.6,
despite the presence of FDIA, mainly because the false data load change at t = 0.6, and the detector in (28).
are correctly identified and replaced with predicted values. In
addition, the state estimator correctly adapts to the dynamic
1.02
change at t = 0.6 seconds. predicted
Vmag. (p.u.)

1.01 estimated
Fig. 5 shows the performance of an existing residual- original
1
based detector that was proposed in [11], under the same
configuration as in Fig. 3. Since the false data are injected 0.99
0.5 1 1.5 2
into the correlated measurements of adjacent buses 13 and 14, Time (seconds)
the detector in [11] is unable to distinguish the false data from 20
Vang. (degrees)

predicted
the sudden changes in the system. The FDIA is erroneously estimated
detected as a sudden change. As a result, during the FDIA, 0 original

the power calculated from the estimated and predicted states

-20
deviate significantly from its actual value. The performance of 0.5 1 1.5 2
Time (seconds)
the estimator yields in an estimation error of as high as 0.7
p.u at t = 0.25 seconds.
Fig. 7. The voltage magnitude (top) and phase angle (bottom) at bus 4 vs
To further illustrate the ability of the proposed detector to time t with false data at 0.25 ≤ t < 0.6, load change at t = 0.6, and the
distinguish between FDIA and sudden change, Fig. 6 shows detector in (28).
the active power measurement at bus 4. The active load at
bus 4 is increased by 0.5 p.u. at t = 0.6 seconds. The load
change caused a gradual change of the active power. Since the at bus 4 are estimated with high accuracy.
load change affects power measurements on all buses based The proposed algorithm assumes that the topology of the
on the physical model of the power grid, the proposed detector system remains unchanged. However, in the event of a system
successfully recognizes it as a load change instead of FDIA. fault, the topology of the system might change. As a result,
Thus the dynamic state estimator can accurately track and the proposed algorithm will detect the deviation of system’s
estimate the state change caused by the load change. The behavior due to system fault in a similar manner as FDIA
power calculated from the estimated states is almost identical detection. To further illustrate the performance of proposed
to its original value. Again a one sample lag is observed algorithm under system faults, Fig. 8 shows the active power
between the predicted value and actual value. Similarly, in at bus 14 under the influence of a single line-to-ground fault,
Fig. 7, the voltage magnitude (top) and phase angle (bottom) which is applied to the line connecting bus 3 and bus 101 at
 9

-10
The minimum point x̂ of J(x) is calculated by solving
original

-12
estimated
predicted
g(x̂) = 0. (36)

-14
Given the non-linearity of (35), (36) is solved by iterative
P14 (p.u.)

methods such as the Newton-Raphson method.

-16 The Taylor series expansion of g(x) for x = x(0) + ∆x is

∂g(x)
-18
g(x) = g(x(0) ) + | (0) ∆x , (37)
∂x x=x
-20
0 0.2 0.4 0.6 0.8 1 where x(0) is the initial point and
Time (seconds)

∂g(x) ′
Fig. 8. The real power at bus 14 with single line-to-ground fault at the line = g (x) = HT (x)R−1 H(x) + M−1 , (38)
connecting bus 3 and bus 101 during 0.2 ≤ t ≤ 0.4. ∂x

where H(x) = ∂h(x)∂x .

t = 0.2 seconds. The fault is cleared at bus 3 at t = 0.35 According to the Newton-Raphson method, by setting (37)
seconds and at bus 101 at t = 0.4 seconds. It can be to zero, the increment ∆x is obtained as
observed that throughout the duration of the line-to-ground h ′ i−1
fault, the proposed algorithm detects the fault and replace ∆x = − g (x(0) ) g(x(0) ). (39)
the measurement value by using the predicted values. Thus
the algorithm can detect the presence of fault, but it cannot Thus,
differentiate fault from cyber-attacks.
x = x(0) − Σ(0) g(x(0) ), (40)
VII. C ONCLUSION
where
A quickest intrusion detection algorithm has been developed h ′ i−1 h i−1
for the detection and removal of false data injected into smart Σ(0) = g (x(0) ) = HT (x(0) )R−1 H(x(0) ) + M−1 .
grids. The algorithm was developed to minimize the worst-
(41)
case detection delay subject to an upper bound of false alarm
rate. To distinguish between FDIA and sudden system change, Combining (35), (40), and (41) at the (i + 1)-th iteration with
a time-varying dynamic model was used to represent the an initial point x(i) = x(i+1) −∆x , the (i+1)-th point becomes
dynamic state transitions. A dynamic state estimator was then
developed to estimate and track the time-varying and non- x(i+1) = x(i) + Σ(i) {HT (x(i) )R−1 [z − h(x(i) )]
stationary state transitions. Based on the statistical properties
of the state estimation results, a new normalized Rao-CUSUM − M−1 (x(i) − x̃)}. (42)
detector was developed to minimize the detection delay of
This completes the proof.
FDIA while separating FDIA from sudden system changes.
Unlike existing algorithms that rely on measurement correla-
tion to discriminate false data from sudden system changes, the A PPENDIX B
proposed algorithm can detect any false data including those P ROOF OF (26)
injected into correlated measurements. Simulation results have
shown that the proposed algorithm can accurately and timely Combining the definition of LLR in (24) with the hypothe-
detect and remove FDIA. In addition, the algorithm can also ses in (21), we obtain
detect system faults such as sensor failures or line outages.
However, it cannot differentiate system faults from FDIA. The ∂Lk
= WkT v̄k − WkT Wk a. (43)
algorithm can be used to harden IEDs or SCADA systems to ∂a
improve the security and resilience of smart grids. Next, substituting the value a = 0 yields in

A PPENDIX A ∂Lk
a=0
= WkT v̄k . (44)
P ROOF OF (10) ∂a
The point x, which minimizes (9) can be obtained by Using the definition of Fisher information matrix [18], we get
calculating the first derivative of J(x) and setting it to zero.  
∂ ∂Lk

Define the first derivative of J(x) as I(a) = −E = WkT Wk . (45)
∂a ∂a
∂J (x) ∂hT (x) −1
g(x) = =− R [z − h(x)] + M−1 (x − x̃) . Combining (44) and (45) results in the Rao test statistic
∂x ∂x
(35) Y (v̄k ) = v̄kT v̄k . This completes the proof.
 10

R EFERENCES [26] X. Li, A. Scaglione, and T.-H. Chang, “Optimal sensor placement
for hybrid state estimation in smart grid,” in 2013 IEEE International
[1] S. Cui, Z. Han, S. Kar, T. T. Kim, H. V. Poor, and A. Tajer, “Coordinated Conference on Acoustics, Speech and Signal Processing, Vancouver, BC,
data-injection attack and detection in the smart grid: A detailed look Canada, May 2013.
at enriching detection solutions,” IEEE Signal Processing Magazine, [27] T. L. Lai and J. Z. Shan, “Efficient recursive algorithms for detection
vol. 29, no. 5, pp. 106–115, Sep. 2012. of abrupt changes in signals and control systems,” IEEE Transactions
[2] D. Wei, Y. Lu, M. Jafari, P. M. Skare, and K. Rohde, “Protecting smart on Automatic Control, vol. 44, no. 5, pp. 952–966, 1999.
grid automation systems against cyberattacks,” IEEE Trans. Smart Grid, [28] A. De Maio and S. Iommelli, “Coincidence of the rao test, wald test,
vol. 2, no. 4, pp. 782–795, Dec. 2011. and glrt in partially homogeneous environment,” IEEE Signal Processing
[3] R. Langner, “Stuxnet: Dissecting a cyberwarfare weapon,” IEEE Security Letters, vol. 15, pp. 385–388, Apr. 2008.
& Privacy, vol. 9, no. 3, pp. 49–51, May 2011. [29] D. Gamerman and H. F. Lopes, Markov chain Monte Carlo: stochastic
[4] G. Liang, J. Zhao, F. Luo, S. R. Weller, and Z. Y. Dong, “A review simulation for Bayesian inference. Chapman and Hall/CRC, 2006.
of false data injection attacks against modern power systems,” IEEE [30] J. H. Chow and K. W. Cheung, “A toolbox for power system dynamics
Transactions on Smart Grid, vol. 8, no. 4, pp. 1630–1638, Jul. 2017. and control engineering education and research,” IEEE transactions on
[5] A. J. McBride and A. R. McGee, “Assessing smart grid security,” Bell Power Systems, vol. 7, no. 4, pp. 1559–1564, Nov. 1992.
Labs Technical Journal, vol. 17, no. 3, pp. 87–103, Dec. 2012. [31] G. Rogers, Power system oscillations. Springer Science & Business
[6] Y. Huang, J. Tang, Y. Cheng, H. Li, K. A. Campbell, and Z. Han, “Real- Media, 2012.
time detection of false data injection in smart grid networks: an adaptive
cusum method and analysis,” IEEE Systems Journal, vol. 10, no. 2, pp.
532–543, Jun. 2016.
[7] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against
state estimation in electric power grids,” ACM Transactions on Informa-
tion and System Security, vol. 14, no. 1, pp. 13:1–13:33, May 2011.
[8] Z.-H. Yu and C. Wen-Long, “Blind false data injection attack using pca
approximation method in smart grid,” IEEE Trans. Smart Grid, vol. 6,
no. 3, pp. 1219–1226, May 2015.
[9] J. Liang, O. Kosut, and L. Sankar, “Cyber attacks on ac state estimation:
Unobservability and physical consequences,” in IEEE PES General
Meeting— Conference & Exposition. National Harbor, MD, USA:
IEEE, Jul. 2014.
[10] M. A. Rahman and H. Mohsenian-Rad, “False data injection attacks
against nonlinear state estimation in smart power grids,” in IEEE PES
General Meeting, Vancouver, BC, Canada, Jul. 2013, pp. 1–5.
[11] A. L. Da Silva, M. Do Coutto Filho, and J. De Queiroz, “State fore-
casting in electric power systems,” in IEE Proceedings C (Generation,
Transmission and Distribution), vol. 130, no. 5, Sep. 1983, pp. 237–244.
[12] M. B. Do Coutto Filho and J. C. S. de Souza, “Forecasting-aided state
estimation—part i: Panorama,” IEEE Transactions on Power Systems,
vol. 24, no. 4, pp. 1667–1677, Nov. 2009.
[13] A. Jain and N. Shivakumar, “Power system tracking and dynamic state
estimation,” in IEEE/PES Power Systems Conference and Exposition,
Seattle, WA, USA, Mar. 2009.
[14] K. Nishiya, J. Hasegawa, and T. Koike, “Dynamic state estimation
including anomaly detection and identification for power systems,” in
IEE Proceedings C (Generation, Transmission and Distribution), vol.
129, no. 5, Sep. 1982, pp. 192–198.
[15] Q. Yang, L. Chang, and W. Yu, “On false data injection attacks against
kalman filtering in power system dynamic state estimation,” Security
and Communication Networks, vol. 9, no. 9, pp. 833–849, Jun. 2016.
[16] G. Chaojun, P. Jirutitijaroen, and M. Motani, “Detecting false data
injection attacks in ac state estimation,” IEEE Transactions on Smart
Grid, vol. 6, no. 5, pp. 2476–2483, Sep. 2015.
[17] J. James, Y. Hou, and V. O. Li, “Online false data injection attack
detection with wavelet transform and deep neural networks,” IEEE
Transactions on Industrial Informatics, vol. 14, no. 7, pp. 3271–3280,
Jul. 2018.
[18] S. M. Kay, Fundamentals of statistical signal processing. Prentice Hall
PTR, 1993.
[19] I. Akingeneye and J. Wu, “Low latency detection of sparse false data
injections in smart grids,” IEEE Access, vol. 6, pp. 58 564–58 573, Oct.
2018.
[20] H. V. Poor and O. Hadjiliadis, Quickest detection. Cambridge Univer-
sity Press Cambridge, 2009, vol. 40.
[21] G. V. Moustakides et al., “Optimal stopping times for detecting changes
in distributions,” The Annals of Statistics, vol. 14, no. 4, pp. 1379–1387,
Dec. 1986.
[22] G. Lorden, “Procedures for reacting to a change in distribution,” The
Annals of Mathematical Statistics, pp. 1897–1908, 1971.
[23] T. L. Lai, “Information bounds and quick detection of parameter changes
in stochastic systems,” IEEE Transactions on Information Theory,
vol. 44, no. 7, pp. 2917–2929, Nov. 1998.
[24] S. Nath and J. Wu, “Bayesian quickest change point detection with
multiple candidates of post-change models,” in IEEE Global Conference
on Signal and Information Processing, Anaheim, CA, USA, Nov. 2018.
[25] A. De Maio, “Rao test for adaptive detection in gaussian interference
with unknown covariance matrix,” IEEE transactions on signal process-
ing, vol. 55, no. 7, pp. 3577–3584, Jul. 2007.