Data-driven detection of financially motivated cyber attacks in the energy market

Alsharif, Ghadeer Obaid (2026) Data-driven detection of financially motivated cyber attacks in the energy market. PhD thesis, University of Glasgow.

Abstract

The increasing integration of information and communication technologies into modern power systems has enhanced operational efficiency while simultaneously exposing electricity markets to sophisticated cyber threats. Among these, financially motivated False Data Injection Attacks (FDIAs) targeting Locational Marginal Prices (LMPs) pose significant risks to market integrity, economic fairness, and grid stability. Unlike operational disruptions, stealthy LMP manipulation aims to preserve statistical normality while inducing economically advantageous distortions, thereby evading conventional residual-based bad data detection mechanisms. Existing defense strategies remain limited, often relying on stationarity assumptions, trusted infrastructure, or low-dimensional settings that are inconsistent with real-world electricity markets. This thesis develops a comprehensive data-driven framework for detecting stealthy and economically motivated cyber-attacks in wholesale electricity markets. First, a physics-consistent synthetic benchmarking framework (SMLT) is constructed to systematically model and reproduce stealthy LMP manipulation scenarios under varying attack intensities and knowledge assumptions. The dataset enables quantitative characterization of statistical, temporal, and spatial signatures of manipulation, providing a controlled foundation for evaluating detection methods. Second, an incremental, unsupervised change-point detection framework is proposed for near–real-time monitoring of streaming LMP signals. The method balances detection sensitivity, false alarm stability, and bounded delay within short market settlement intervals. Third, to address the inherent non-stationarity of electricity markets, a drift-aware anomaly detection framework is introduced that integrates concept drift detection with adaptive anomaly scoring, enabling robust discrimination between natural regime shifts and adversarial manipulation. Finally, spatial dependencies among nodal prices are modeled using graph signal processing techniques, allowing physics-informed dimensionality reduction, scalable monitoring, and anomaly localization with quantifiable spatial accuracy. Extensive evaluation on both synthetic and real-world market datasets demonstrates that the proposed framework achieves improved detection robustness, reduced false positives, controlled detection delay, and enhanced scalability compared to existing baselines. By jointly addressing stealthiness, non-stationarity, real-time constraints, and spatial structure, this thesis advances the state of the art in energy market cybersecurity and establishes a principled foundation for adaptive, data-driven protection against financially motivated cyber-attacks in electricity markets.

• Item Type: Thesis (PhD)
• Qualification Level: Doctoral
• Subjects: Q Science > QA Mathematics > QA75 Electronic computers. Computer science
• Colleges/Schools: College of Science and Engineering > School of Computing Science
• Supervisor's Name: Anagnostopoulos, Dr. Christos and Bryson, Dr. Kevin
• Date of Award: 2026
• Depositing User: Theses Team
• Unique ID: glathesis:2026-86071
• Copyright: Copyright of this thesis is held by the author.
• Date Deposited: 24 Jun 2026 15:32
• Last Modified: 24 Jun 2026 15:37
• Thesis DOI: 10.5525/gla.thesis.86071
• URI: https://theses.gla.ac.uk/id/eprint/86071

Related URLs

• Article DOI
• Article DOI
• Article DOI
• Article DOI