Detection of False Data Injection Attack in AGC System Based on Random Forest

Round 1

Reviewer 1 Report

The presentation of the manuscript can be improved in the following ways,
1. Acronyms should be presented with full names when they are first introduced, i.e., ACE, FDIA, EMS, RTU, etc. as readers may not be familiar with them (considering the submission is to "machines").
2. When variables are defined before an equation, we usually do not use "where" (e.g., line 178).  We usually use "Let ... be", or we define them using "where" right after the equation.
3. There are a few mismatch between the name in the subtitle and that in the paragraph - e.g., line 199 "retract attack" vs "scaling attack", line 217 "impulse attack" vs "pulse attack", and line 270 "random forest algorithm" vs "stochastic forest algorithm".  If they refer to the same "item", the same name should be used to reduce confusion.
4. The four false data injection attack models are defined unclearly - are the equations attack function or the collected AGC state variable data? Moreover, in the pulse (not Impulse as stated in the subtitle) attack, is it  really the case that the collected variable data can be zero?  The authors may refer to Coordinated False Data Injection Attacks in AGC System and Its Countermeasure (https://ieeexplore.ieee.org/stamp/stamp.jsp?arnumber=9239283) for a more proper definition of the four AGC attacks.
5. Authors should elaborate on the "apparent advantages" (line 280) and "obvious advantage" (line 286), or at least, cite appropriate references.
6. Line 298 "An example of the data is shown in Dataset D in the block diagram on the right side of Figure 1" - I suppose the data are shown on the left side, while the generated decision tree is shown on the right side?
7. Should "it is divided into" in lines 318 and 319 be replaced by another phrase, like "we proceed to"?
8. Line 326 "The real-time detected D dataset is voted by the random forest decision tree with the number of votes obtained is K, K contains various labels, ..." is confusing - is K the number of votes obtained, or is it something else that contains "various labels"?
9. What is the relationship between the compensation attacks simulated with the four attack models for AGC introduced?  And what are the relationships between over-compensating attack, positive compensation attack, negative compensation attack, damaging compensation attack, and hostile compensation attack (these terms appeared in Section 4).
10. Line 443 "Figure 3, Figure 4, and Figure 5 correspond to the frequency changes of the attack time of different intensities of false data injection." may be rephrased as "Figure 3, Figure 4, and Figure 5 show the frequency changes of the attack time correspond to different intensities of false data injection."
11. The authors should elaborate more on "Through the comparative study of machine learning methods, it can be seen that the F1-score index of the training set model obtained by the random forest algorithm is the best." (line 453), or at least, provide references.
12. Line 462 - What is the beginning of the sentence?
13. Line 464 "of which 20-time series are of one-second duration" maybe rephrased as "of which 20 time series units correspond to one second".
14. Line 496 - What do you mean by "the system is also shot, inundated at this time"?
15. Line 499 - There is no Figure 10, should it be Figure 9?
16. Line 517 - "... are detected" do you mean they are "used"?
17. Line 529 - "open-development detection" should it be "adaptive detection"? And hence, "adapts to" instead of "develops with" in line 532.
18. Line 538 - "the impact of this detection method will become worse" do you mean the "performance" and not "impact"?

There are a few more comments concerning the evaluation of the proposed approach (i.e., the experiment part).
1. I would expect a comparison of the proposed approach with existing (state-of-the-art) approaches, instead of simply evaluating the proposed approach only.
2. It is unclear to me how much data are used to train the decision trees / random forest - I suppose the trees / forest are not trained using the measurements collected in the first twenty seconds only, right? Hence, I would also expect a comparison of attack detection performance between random forests generated using different amount of training data.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

The paper presents a false data injection attack detection method in AGC system based on random forest. Following are the concerns that need to be addressed:

1.     In introduction section, clearly mention the research gap and your contribution.

2.     What are the five-dimensional state variables? These variables should be mentioned clearly.

3.     What are the advantages of your proposed method over the existing methods?

4.     How to determine the possible location of the attack?

5.     Four false data injection attack models are introduced in your manuscript, and which one has more adverse impact on AGC systems, and which one is used in your simulation? These should be clear in your paper.

6.     Your method should be compared with the existing methods in your simulation.

 

 

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 3 Report

Reading the article, I have the impression that I am moving into the world of Mark Elsberg and his book "Blackout". It is good that there are scientists in the world dealing with the subject that can protect us from Mr. Elsberg's vision.

The article is well written, although I do have a few editorial comments.

Why do some sentences in the summary end with a semicolon instead of a full stop (dot)? The note applies not only to the summary, e.g. the sentence in lines: 33-36, 469-475.

There is no explanation what the abbreviation ACE stands for (first occurrence in line 69). Similarly FDIAs (first occurrence in line 86), SMOTE (line 108), SVM, KNN (line 113), EMS (line 167), RTU (line 167), CART (line 289).

Line 154: "The TBC control mode has two crucial advantages: First,..." - Should there be a colon here? The word First is capitalized.

Line 165: The quantities in formula (1) are not explained. I don't really know what B stands for.

Line 199: Is "retract attack" some kind of "scaling attack"? In the sentence preceding section 2.4.1, "retract attack" does not appear.

Line 208: There is a dot missing at the end of the sentence.

Line 217: In line 198 we have "pulse attacks". There is "impulse attack". Which form is correct?

Is formula (5) correct?   y(t) + Lr x t ?

Line 289: "...CART node splitting algorithm, Finally, it uses voting algorithm..." - Since "Finally" is capitalized, there should be a dot before it.

Line 317: "...datasets D1, D2, Respectively." - should be "respectively".

Line 446:  "...ACE signal will exceed the limit, The enormous change of ACE signal..." - I think there should be a dot before "The".

Line 462: "set at the 20th second to actively apply ACE signal..." - The beginning of a sentence with a capital letter. Maybe some part of the sentence is missing here?

Line 499: Should be Figure 9.

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 1 Report

The authors have mostly addressed my concerns.

One minor issue is that symbols should be properly introduced, e.g., \delta f and \delta P_{tie} in line 174 should be stated explicitly in line 172.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

No comments.

Author Response

Dear Reviewers:

Thank you for the time and effort you put into reviewing our manuscript entitled ”Detection of False Data Injection Attack in AGC System Based on Random Forest” (ID: machines-2115496).

We appreciate for your warm work earnestly, and hope that will meet with approval.

Once again, thank you very much for your comments and suggestions.

Your sincerity,
Xinran Zhang
2022/12/30