A Novel Data Integrity Attack Detection Algorithm Based on Improved Grey Relational Analysis

False data injection (FDI) attack is the most common data integrity attack, and it is also one of the most serious threats in industrial control systems (ICSs). Although many detection approaches are developed with burgeoning research interests, the technical capability of existing detection methods is still insufficient because the stealth FDI attacks have been proven to bypass bad data detector. In this paper, a novel data analytical algorithm is proposed to identify the stealth FDI attacks in ICSs according to the correlation analysis. First, we evaluate the correlation between measurements and control variables based on an improved grey relational analysis. Then, SVM is used to classify the FDI attack according to the values of correlation. Through a reliable semi-physical simulation testbed whose virtual plant corresponds to a 330 MW boiler-turbine unit, two FDI attacks that can bypass the detection system are studied. A dataset, which contains the normal data and attack data, is created from the testbed to verify the effectiveness of the proposed algorithm. In addition, the performance of the proposed algorithm is also studied based on the new gas pipeline dataset that is collected by the distributed analytics and security institute in Mississippi State University. Such a novel algorithm, which has better accuracy and reliability, is compared with the state of the art based on the data analysis.