An AI-Based Supervisory Measurement Integrity Validation Layer for Cyber-Resilient AC/DC Protection in Inverter-Based Microgrids
Pith reviewed 2026-05-08 05:45 UTC · model grok-4.3
The pith
A recurrent neural network validates current measurement integrity for differential relays in inverter-based microgrids by spotting false data injection attacks.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The RNN-based measurement integrity validation scheme interprets short windows of time-synchronized multi-phase current measurements recorded during relay operation and assesses their physical consistency to distinguish genuine fault-induced trajectories from cyber-manipulated measurement streams. The scheme requires no additional sensors, auxiliary protection elements, or prior knowledge of network topology and applies to both AC and DC LCDRs without structural modification. Evaluation on an islanded inverter-based microgrid under comprehensive fault and FDIA scenarios demonstrates high detection accuracy while preserving relay dependability, with hardware-in-the-loop validation confirming
What carries the argument
Recurrent neural network trained offline on relay-available current measurements that exploits the temporal structure of differential current waveforms to assess physical consistency.
If this is right
- The scheme preserves relay dependability under FDIA conditions.
- It meets protection timing constraints for real-time use.
- The same architecture works for both AC and DC differential relays.
- No extra sensors or topology data are needed for deployment.
Where Pith is reading between the lines
- The same consistency-checking idea could be tested on other relay types that depend on communicated measurements.
- Periodic offline retraining on updated inverter control behaviors might be required if microgrid equipment changes.
- The method implies that shape and timing information in waveforms can substitute for magnitude-based detection when inverters limit fault current.
Load-bearing premise
That the temporal structure of differential current waveforms remains sufficiently informative to allow an RNN trained offline on relay-available measurements to reliably distinguish genuine faults from arbitrary FDIAs, even without network topology knowledge or additional sensors.
What would settle it
A false-data injection sequence that produces a differential current waveform whose short-term temporal pattern closely matches those seen in genuine faults, causing the RNN to classify it as valid.
Figures
read the original abstract
Line current differential relays (LCDRs) are measurement-driven relays that rely on time-synchronized multi-phase current waveforms to infer internal faults in AC and DC power networks. In inverter-based microgrids, however, the increasing reliance on digitally communicated measurements exposes LCDRs to false-data injection attacks (FDIAs), in which adversaries manipulate remote measurement streams to create protection-triggering yet physically inconsistent current trajectories. This paper addresses this emerging measurement integrity problem by introducing a measurement integrity validation scheme that operates as a supervisory instrumentation layer for modern LCDRs. The proposed scheme interprets short windows of synchronized instantaneous current measurements recorded during relay operation and assesses their physical consistency to distinguish genuine fault-induced trajectories from cyber-manipulated measurement streams. A recurrent neural network is trained offline using only relay-available current measurements and exploits the temporal structure of differential current waveforms, which remains informative in inverter-dominated systems where current magnitude is no longer a reliable observable. The method requires no additional sensors, auxiliary protection elements, or prior knowledge of network topology, and is applicable to both AC and DC LCDRs without structural modification. The proposed measurement validation scheme is evaluated on an islanded inverter-based microgrid under a comprehensive set of fault and FDIA scenarios, demonstrating high detection accuracy while preserving relay dependability. Hardware-in-the-loop validation using an OPAL-RT real-time simulator confirms that the scheme satisfies protection timing constraints and can operate in real time under realistic operating conditions.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript introduces a recurrent neural network (RNN)-based supervisory measurement integrity validation layer for line current differential relays (LCDRs) in inverter-based microgrids. The RNN processes short windows of time-synchronized instantaneous current measurements to distinguish genuine fault-induced differential current trajectories from those created by false-data injection attacks (FDIAs). The scheme requires no additional sensors, auxiliary elements, or network topology knowledge, applies to both AC and DC LCDRs, and is evaluated on an islanded microgrid under fault and FDIA scenarios with hardware-in-the-loop (HIL) testing on an OPAL-RT simulator to confirm real-time operation within protection timing constraints.
Significance. If the performance claims hold with rigorous validation, the work could meaningfully advance cyber-resilient protection for modern microgrids where inverter dominance reduces the reliability of magnitude-based fault detection. The data-driven use of temporal waveform structure from existing relay measurements, combined with explicit HIL confirmation of timing compliance, represents a practical strength that could support deployable solutions without hardware additions. The approach's claimed generality across AC/DC and lack of topology dependence would broaden its applicability if robustness is demonstrated.
major comments (3)
- Abstract: The central claim of 'high detection accuracy while preserving relay dependability' is presented without any quantitative metrics (e.g., accuracy, precision-recall, false-positive rates on faults vs. FDIAs), training dataset size, hyperparameters, or baseline comparisons. This absence leaves the primary performance assertion unsupported by evidence and is load-bearing for the paper's contribution.
- Method and evaluation description: The RNN is trained offline solely on relay-available differential current measurements without network topology, line parameters, or explicit physics-based consistency checks. The assumption that short temporal windows contain sufficient separable features to flag arbitrary FDIAs (while passing genuine faults) is unverified against adversarial mimicry, directly undermining the cyber-resilience claim as highlighted by the lack of optimized FDIA test cases.
- HIL validation section: While real-time operation on OPAL-RT is asserted, no specific timing measurements, latency distributions, or worst-case scenario results are referenced to confirm that the supervisory layer meets protection timing constraints under the full set of scenarios.
Simulated Author's Rebuttal
We thank the referee for the constructive and detailed feedback. The comments highlight opportunities to strengthen the presentation of quantitative results, clarify the method's assumptions, and provide more explicit HIL timing data. We address each major comment below and will revise the manuscript to incorporate the suggested improvements while preserving the core contribution of a topology-independent RNN supervisory layer using only existing relay measurements.
read point-by-point responses
-
Referee: Abstract: The central claim of 'high detection accuracy while preserving relay dependability' is presented without any quantitative metrics (e.g., accuracy, precision-recall, false-positive rates on faults vs. FDIAs), training dataset size, hyperparameters, or baseline comparisons. This absence leaves the primary performance assertion unsupported by evidence and is load-bearing for the paper's contribution.
Authors: We agree that the abstract would be strengthened by including key quantitative results. The full evaluation in Section V reports specific performance figures (detection accuracy, false-positive rates on genuine faults, and comparisons to threshold-based baselines) along with training set size and hyperparameters. In the revised version we will condense these into the abstract to directly support the central claim without exceeding length limits. revision: yes
-
Referee: Method and evaluation description: The RNN is trained offline solely on relay-available differential current measurements without network topology, line parameters, or explicit physics-based consistency checks. The assumption that short temporal windows contain sufficient separable features to flag arbitrary FDIAs (while passing genuine faults) is unverified against adversarial mimicry, directly undermining the cyber-resilience claim as highlighted by the lack of optimized FDIA test cases.
Authors: The approach deliberately avoids topology or parameter knowledge by learning temporal waveform structure directly from differential currents, which remains discriminative even when magnitude-based detection fails in inverter-dominated systems. Our evaluation covers multiple FDIA injection strategies, locations, and magnitudes. We acknowledge that the manuscript does not include tests against fully optimized adversarial FDIAs crafted to mimic fault trajectories; we will add a dedicated paragraph in the discussion section noting this limitation and outlining it as future work, while clarifying that the reported results hold for the realistic attack models considered. revision: partial
-
Referee: HIL validation section: While real-time operation on OPAL-RT is asserted, no specific timing measurements, latency distributions, or worst-case scenario results are referenced to confirm that the supervisory layer meets protection timing constraints under the full set of scenarios.
Authors: We agree that explicit timing data would better substantiate the real-time claim. The HIL experiments on the OPAL-RT platform include measured execution latencies for the RNN inference step across all tested scenarios. In the revised manuscript we will report average and worst-case latencies, latency distributions, and confirmation that these remain well within the protection timing windows for both AC and DC LCDRs. revision: yes
Circularity Check
No circularity: data-driven RNN trained on measurements without self-referential reduction
full rationale
The paper's core proposal is an offline-trained RNN that processes short windows of relay-available differential current waveforms to distinguish genuine faults from FDIAs. This is an empirical, measurement-driven classifier with no equations that define the output in terms of itself, no fitted parameters renamed as predictions, and no load-bearing self-citations or imported uniqueness theorems. The abstract and method description present the RNN as exploiting observable temporal structure in the data, with evaluation on fault/FDIA scenarios treated as external validation rather than a tautology. The derivation chain therefore remains self-contained against external benchmarks and does not reduce to its inputs by construction.
Axiom & Free-Parameter Ledger
free parameters (1)
- RNN architecture and training hyperparameters
axioms (1)
- domain assumption Temporal structure of differential current waveforms remains informative for distinguishing genuine faults from FDIAs in inverter-dominated systems where magnitude is unreliable
Reference graph
Works this paper leans on
-
[1]
False data injection attacks against state estimation in electric power grids,
Y . Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” inProc. 16th ACM Conf. Comput. Commun. Secur., Chicago, IL, USA, Nov. 2009, pp. 21–32
2009
-
[2]
How microgrid control technology is driving innovation in energy re- siliency for the department of defense,
“How microgrid control technology is driving innovation in energy re- siliency for the department of defense,” Siemens Government Technolo- gies, [Online]. Available: https://www.siemensgovt.com/insights/articles/ microgrid-control-technology-dod
-
[3]
Microgrid protection,
A. Hooshyar and R. Iravani, “Microgrid protection,”Proc. IEEE, vol. 105, no. 7, pp. 1332–1353, July 2017
2017
-
[4]
Mi- crogrid resilience: A holistic approach for assessing threats, identifying vulnerabilities, and designing corresponding mitigation strategies,
S. Mishra, K. Anderson, B. Miller, K. Boyer, and A. Warren, “Mi- crogrid resilience: A holistic approach for assessing threats, identifying vulnerabilities, and designing corresponding mitigation strategies,”Appl. Energy, vol. 264, p. 114726, Apr. 2020
2020
-
[5]
Cyber-resilient fault diagnosis in transmission lines: A substitute for distance relays under cyber-attacks,
M. Asghari, A. Ameli, J. Southgate, A. Doostmohammadi, M. Ghafouri, and M. Nasir Uddin, “Cyber-resilient fault diagnosis in transmission lines: A substitute for distance relays under cyber-attacks,”IEEE Trans. Instrum. Meas., vol. 74, pp. 1–14, 2025
2025
-
[6]
Differential frequency protection scheme based on off-nominal frequency injections for inverter-based islanded microgrids,
A. Soleimanisardoo, H. K. Karegar, and H. H. Zeineldin, “Differential frequency protection scheme based on off-nominal frequency injections for inverter-based islanded microgrids,”IEEE Trans. Smart Grid, vol. 10, no. 2, pp. 2107–2114, March 2019
2019
-
[7]
Modern line current differential protection solutions,
H. Miller, J. Burger, N. Fischer, and B. Kasztenny, “Modern line current differential protection solutions,” in63rd Annual Conf. Protective Relay Engineers, Mar. 2010, pp. 1–25
2010
-
[8]
Differential evolution-based three stage dynamic cyber-attack of cyber-physical power systems,
K.-D. Lu, Z.-G. Wu, and T. Huang, “Differential evolution-based three stage dynamic cyber-attack of cyber-physical power systems,” IEEE/ASME Transactions on Mechatronics, vol. 28, no. 2, pp. 1137– 1148, 2022
2022
-
[9]
Constrained-differential-evolution-based stealthy sparse cyber-attack and countermeasure in an ac smart grid,
K.-D. Lu and Z.-G. Wu, “Constrained-differential-evolution-based stealthy sparse cyber-attack and countermeasure in an ac smart grid,” IEEE transactions on industrial informatics, vol. 18, no. 8, pp. 5275– 5285, 2021
2021
-
[10]
A model- independent trojan attack on deep learning-based fdia detection in smart grid protection systems,
A. M. Saber, H. E. Z. Farag, A. Youssef, and D. Kundur, “A model- independent trojan attack on deep learning-based fdia detection in smart grid protection systems,”IEEE Trans. Instrum. Meas., vol. 74, pp. 1–13, 2025
2025
-
[11]
Reliable iot paradigm with ensemble machine learning for faults diagnosis of power transformers considering adversarial attacks,
M. N. Ali, M. Amer, and M. Elsisi, “Reliable iot paradigm with ensemble machine learning for faults diagnosis of power transformers considering adversarial attacks,”IEEE Trans. Instrum. Meas., 2023
2023
-
[12]
Cyber-immune line current differential relays,
A. M. Saber, A. Youssef, D. Svetinovic, H. H. Zeineldin, and E. F. El- Saadany, “Cyber-immune line current differential relays,”IEEE Trans. Ind. Inform., vol. 20, no. 3, pp. 3597–3608, March 2024
2024
-
[13]
Preventing time- synchronization attacks on synchrophasor measurements of wide-area damping controllers,
M. Zadsar, M. Ghafouri, A. Ameli, and B. Moussa, “Preventing time- synchronization attacks on synchrophasor measurements of wide-area damping controllers,”IEEE Trans. Instrum. Meas., 2023
2023
-
[14]
An adaptive penalized weighted least squared approach for detecting and mitigating cyber-attacks on dynamic state estimation,
S. Riahinia, A. Ameli, M. Ghafouri, and A. Yassine, “An adaptive penalized weighted least squared approach for detecting and mitigating cyber-attacks on dynamic state estimation,”IEEE Trans. Instrum. Meas., 2024
2024
-
[15]
Cyber resiliency enhancement of overcurrent relays in distribution systems,
S. Pola, M. Jovanovic, M. A. Azzouz, and M. Mirhassani, “Cyber resiliency enhancement of overcurrent relays in distribution systems,” IEEE Trans. Smart Grid, vol. 15, no. 4, pp. 4063–4076, 2023
2023
-
[16]
Remedial pilot main protection scheme for transmission line independent of data synchronism,
L. C. et al., “Remedial pilot main protection scheme for transmission line independent of data synchronism,”IEEE Trans. Smart Grid, vol. 10, no. 1, pp. 681–690, Jan. 2019
2019
-
[17]
A deep learning-based cyberattack detection system for transmission protective relays,
Y . M. Khaw, A. A. Jahromi, M. F. M. Arani, S. Sanner, D. Kundur, and M. Kassouf, “A deep learning-based cyberattack detection system for transmission protective relays,”IEEE Trans. Smart Grid, vol. 12, no. 3, pp. 2554–2565, May 2021
2021
-
[18]
Anomaly-based detection of cyberattacks on line current differential relays,
A. M. Saber, A. Youssef, D. Svetinovic, H. H. Zeineldin, and E. F. El-Saadany, “Anomaly-based detection of cyberattacks on line current differential relays,”IEEE Trans. Smart Grid, vol. 13, no. 6, pp. 4787– 4800, Nov. 2022. 12
2022
-
[19]
A cyber resilient protection scheme for bipolar dc microgrids using symmetrical component decom- position,
A. Pandey, S. R. Mohanty, and R. Mohanty, “A cyber resilient protection scheme for bipolar dc microgrids using symmetrical component decom- position,”IEEE Trans. Ind. Inf., vol. 20, no. 3, pp. 4481–4491, March 2024
2024
-
[20]
A cyberattack detection method for line current differential relays in medium-voltage dc microgrids,
A. Ameli, K. A. Saleh, A. Kirakosyan, E. F. El-Saadany, and M. M. A. Salama, “A cyberattack detection method for line current differential relays in medium-voltage dc microgrids,”IEEE Trans. Inf. Forensics Secur., vol. 15, pp. 3580–3594, 2020
2020
-
[21]
Resilient protection of medium voltage dc microgrids against cyber intrusion,
V . Nougain, S. Mishra, and S. S. Jena, “Resilient protection of medium voltage dc microgrids against cyber intrusion,”IEEE Trans. Power Del., vol. 37, no. 2, pp. 960–971, April 2022
2022
-
[22]
Protection of inverter-based islanded microgrids via synthetic harmonic current pattern injection,
K. Saleh, M. Allam, and A. Mehrizi-Sani, “Protection of inverter-based islanded microgrids via synthetic harmonic current pattern injection,” IEEE Trans. Power Deliv., vol. 36, no. 4, pp. 2434–2445, Aug. 2021
2021
-
[23]
Optimal active fault detection in inverter-based grids,
M. Pirani, M. Hosseinzadeh, J. A. Taylor, and B. Sinopoli, “Optimal active fault detection in inverter-based grids,”IEEE Trans. Control Syst. Technol, vol. 31, no. 3, pp. 1411–1417, May 2023
2023
-
[24]
SEL-T400L time-domain line protection,
“SEL-T400L time-domain line protection,” Schweitzer Engineering Laboratories, Inc., [Online]. Available: https://selinc.com/api/download/ 116461/
-
[25]
Centralized protection strategy for medium voltage dc microgrids,
M. Monadi, C. Gavriluta, A. Luna, J. I. Candela, and P. Rodriguez, “Centralized protection strategy for medium voltage dc microgrids,” IEEE Trans. Power Del., vol. 32, no. 1, pp. 430–440, Feb. 2017
2017
-
[26]
Saadat,Power System Analysis
H. Saadat,Power System Analysis. WCB/McGraw Hill, 1999
1999
-
[27]
On the security of public key protocols,
D. Dolev and A. C. Yao, “On the security of public key protocols,” in 22nd Annual Symp. on Found. of Comp. Science, 1981, pp. 350–357
1981
-
[28]
Vulnera- bilities and security issues in optical networks,
M. Furdek, N. Skorin-Kapov, S. Zsigmond, and L. Wosinska, “Vulnera- bilities and security issues in optical networks,” inProc. 16th Int. Conf. Transparent Opt. Netw. (ICTON), 2014, pp. 1–4
2014
-
[29]
Gradient-based learning algorithms for recurrent networks and their computational complexity,
R. J. Williams and D. Zipser, “Gradient-based learning algorithms for recurrent networks and their computational complexity,” inBackpropa- gation, 2013, pp. 433–486
2013
-
[30]
TsAI - a state-of-the-art deep learning library for time series and sequential data,
I. Oguiza, “TsAI - a state-of-the-art deep learning library for time series and sequential data,” [Online]. Available: https://github.com/ timeseriesAI/tsai
-
[31]
A gentle tutorial of recurrent neural network with error backpropagation,
G. Chen, “A gentle tutorial of recurrent neural network with error backpropagation,”arXiv preprint, vol. arXiv:1610.02583, 2016
-
[32]
A holomorphic embedding power flow algorithm for islanded hybrid ac/dc microgrids,
M. Y . Morgan, M. F. Shaaban, H. F. Sindi, and H. H. Zeineldin, “A holomorphic embedding power flow algorithm for islanded hybrid ac/dc microgrids,”IEEE Trans. Smart Grid, vol. 13, no. 3, pp. 1813–1825, May 2022
2022
-
[33]
Practical bayesian optimiza- tion of machine learning algorithms,
J. Snoek, H. Larochelle, and R. P. Adams, “Practical bayesian optimiza- tion of machine learning algorithms,” inAdv. Neural. Inf. Process. Syst. (NIPS 2012), vol. 25, Oct. 2012
2012
-
[34]
Innovative solutions improve transmission line protection,
D. Hou, A. Guzman, and J. Roberts, “Innovative solutions improve transmission line protection,” inProc. Southern African Conf. Power Syst. Protect., Midrand, South Africa, Nov. 1998, pp. 1–25
1998
-
[35]
Williamson and J
R. Williamson and J. White,Advancing Maths for AQA: Statistics 7. London, U.K.: Heinemann Educational, 2002, vol. 11
2002
-
[36]
Available: https:// wiki.opal-rt.com/display/HDGD/OP5700
“OP5700,” OPAL-RT Technologies, Inc., [Online]. Available: https:// wiki.opal-rt.com/display/HDGD/OP5700
-
[37]
A learning-based framework for detecting cyber-attacks against line current differential relays,
A. Ameli, A. Ayad, E. F. El-Saadany, M. M. A. Salama, and A. Youssef, “A learning-based framework for detecting cyber-attacks against line current differential relays,”IEEE Trans. Power Deliv., vol. 36, no. 4, pp. 2274–2286, 2021
2021
-
[38]
Cnn-based transformer model for fault detection in power system networks,
J. B. Thomas, S. G. Chaudhari, S. K. V ., and N. K. Verma, “Cnn-based transformer model for fault detection in power system networks,”IEEE Trans. Instrum. Meas., vol. 72, pp. 1–10, 2023. Ahmad Mohammad Saber(Member, IEEE) re- ceived the B.Sc. degree from Ain Shams University, Egypt, in 2016, the M.Sc. degree from Cairo Uni- versity, Egypt, in 2019, and th...
2023
-
[39]
He was the head and director of the Research Center for Cryptoeconomics in Vienna, Austria
Previously, he worked at WU Wien, Austria, TU Wien, Austria, and Lero−the Irish Software Engineering Center, Ireland. He was the head and director of the Research Center for Cryptoeconomics in Vienna, Austria. He was a visiting professor and a research affiliate at MIT and MIT Media Lab, MIT, USA. Davor has extensive experience working on complex multidis...
1999
-
[40]
He is currently a Professor with the Concordia Institute for Information Systems Engineering, Concordia Uni- versity, Montreal, Canada
He was with Nortel Networks, the Center for Applied Cryptographic Research, University of Waterloo, IBM, and also with Cairo University. He is currently a Professor with the Concordia Institute for Information Systems Engineering, Concordia Uni- versity, Montreal, Canada. He has authored over 300 referred journal and conference publications in areas relat...
2010
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.