Electrical power distribution company of sari, Mazandaran, Iran
10.22055/jaree.2026.51755.1293
Abstract
This study investigates and evaluates the performance and accuracy of advanced techniques for detecting concealed and stealthy cyber-attacks within the standard IEEE 33-bus distribution network. Two representative attack scenarios, Replay Attack and Slowly-Varying/Low-Amplitude Stealth Attack, were simulated in the MATLAB environment to evaluate their impact on system operation. Simulation results indicate that these attacks induce gradual deviations and disturbances in the power flow and voltage profiles of buses No. 6 and 25. To identify such anomalies, two detection mechanisms were employed: a Shannon entropy–based approach and an autoencoder neural network architecture. The evaluation outcomes demonstrate that the entropy-based method provides high sensitivity and low latency in attack identification; however, it exhibits a higher false alarm rate (FAR) in response to minor fluctuations and normal network variations. Conversely, the Autoencoder architecture significantly reduces the false alarm rate and enhances detection accuracy for stealthy and progressive attacks. Ultimately, the hybrid integration of both methods yields a substantial improvement in the overall performance of the intrusion detection system (IDS) for smart distribution networks.
Highlights
A hybrid cyberattack detection framework combining Shannon Entropy analysis and Autoencoder-based deep learning is proposed for smart distribution networks.
Replay Attack and Slowly-Varying/Low-Amplitude (SVLA) Stealth Attack scenarios are simulated and evaluated on the IEEE 33-bus distribution system.
Shannon Entropy enables rapid detection of statistical anomalies, while the Autoencoder improves the identification of subtle and stealthy cyberattacks.
The hybrid detection strategy reduces detection latency and improves attack detection performance compared with using either method individually.
The proposed approach provides accurate real-time detection with low computational requirements, making it suitable for edge-computing-based distribution network applications.
[1] P. S. Tadepalli, D. Pullaguram, and M. N. Alam, "Cyber-resilient strategy for DC microgrids against concurrent FDI and DoS attacks," IEEE Transactions on Industrial Informatics, vol. 21, no. 6, pp. 4756–4767, Jun. 2025. DOI: https://doi.org/10.1109/TII.2025.3545102
[2] S. Qiu, Z. Shao, Q. Yao, Y. Liu, H. Cui, and J. Fei, "Research on assessment of cyber attack risk conduction in distributed photovoltaic contained distribution system," in 2024 IEEE PES 16th Asia-Pacific Power and Energy Engineering Conference (APPEEC), Nanjing, China, 2024, pp. 1–5. DOI: https://doi.org/10.1109/APPEEC61255.2024.10922535
[3] S. Kivalov and I. Strelkovskaya, "Detection and prediction of DDoS cyber attacks using spline functions," in 2022 IEEE 16th International Conference on Advanced Trends in Radioelectronics, Telecommunications and Computer Engineering (TCSET), Lviv-Slavske, Ukraine, 2022, pp. 710–713. DOI: https://doi.org/10.1109/TCSET55632.2022.9766940
[4] M. A. Taher, M. Behnamfar, A. S. Khan, M. Tariq, and A. I. Sarwat, "Detecting false data injection attacks using NARX-based observers in distributed cooperative control for DC microgrid," in IECON 2024 – 50th Annual Conference of the IEEE Industrial Electronics Society, Chicago, IL, USA, 2024, pp. 1–6. DOI: https://doi.org/10.1109/IECON55916.2024.10905098
[5] A. Salehpour, I. Al-Anbagi, K.-C. Yow, and X. Cheng, "A supervised early attack detection mechanism for smart grid networks," in 2023 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT), Washington, DC, USA, 2023, pp. 1–5. DOI: https://doi.org/10.1109/ISGT51731.2023.10066351
[6] P. S. Tadepalli and D. Pullaguram, "Distributed control microgrids: Cyber-attack models, impacts and remedial strategies," IEEE Transactions on Signal and Information Processing over Networks, vol. 8, pp. 1008–1023, 2022. DOI: https://doi.org/10.1109/TSIPN.2022.3230562
[7] Z. Wang and G. Chen, "Distributed resilient energy management of island microgrids under mixed cyber-attacks," in 2023 6th International Conference on Energy, Electrical and Power Engineering (CEEPE), Guangzhou, China, 2023, pp. 509–513. DOI: https://doi.org/10.1109/CEEPE58418.2023.10166253
[8] B. M. R. Amin, S. Taghizadeh, M. S. Rahman, M. J. Hossain, V. Varadharajan, and Z. Chen, "Cyber attacks in smart grid – dynamic impacts, analyses and recommendations," IET Cyber-Physical Systems: Theory & Applications, vol. 5, no. 4, pp. 321–329, 2020. DOI: https://doi.org/10.1049/iet-cps.2019.0103
[9] X. Wu, Z. Jin, J. Zhou, K. Liu, and Z. Liu, "Against network attacks in renewable power plants: Malicious behavior defense for federated learning," Computer Networks, vol. 250, Art. no. 110577, 2024. DOI: https://doi.org/10.1016/j.comnet.2024.110577
[10] J. Dedrick, K. A. Perrin, E. Sabaghian, and P. J. Wilcoxen, "Assessing cyber attacks on local electricity markets using simulation analysis: Impacts and possible mitigations," Sustainable Energy, Grids and Networks, vol. 34, Art. no. 100993, 2023. DOI: https://doi.org/10.1016/j.segan.2023.100993
[11] P. Bereziński, B. Jasiul, and M. Szpyrka, "An entropy-based network anomaly detection method," Entropy, vol. 17, no. 4, pp. 2367–2408, 2015. DOI: https://doi.org/10.3390/e17042367
[12] M. Zhou, Z. Zhang, and L. Xie, "Permutation entropy based detection scheme of replay attacks in industrial cyber-physical systems," Journal of the Franklin Institute, vol. 358, no. 7, pp. 4058–4076, 2021. DOI: https://doi.org/10.1016/j.jfranklin.2021.02.024
[13] Y. Shen and Z. Qin, "Detection, differentiation and localization of replay attack and false data injection attack based on random matrix," Scientific Reports, vol. 14, Art. no. 2758, 2024. DOI: https://doi.org/10.1038/s41598-024-52954-z
[14] A. Barshan, S. M. A. Mohammadi, F. Abdollahi, R. Z. Davarani, and S. Esmaeili, "Local detection of replay attacks and data anomalies on PMU measurements of smart power grids via tracking critical dynamic modes," International Journal of Electrical Power & Energy Systems, vol. 159, Art. no. 110038, 2024. DOI: https://doi.org/10.1016/j.ijepes.2024.110038
[15] P. Ramanan, D. Li, and N. Gebraeel, "Blockchain-based decentralized replay attack detection for large-scale power systems," IEEE Transactions on Systems, Man, and Cybernetics: Systems, vol. 52, no. 8, pp. 4727 4739, Aug. 2022. DOI: https://doi.org/10.1109/TSMC.2021.3104087
Amiri, H. (2026). Entropy-Based and Deep Learning–Driven Detection of Stealthy Cyberattacks in Smart Distribution Networks. Journal of Applied Research in Electrical Engineering, 5(1), 1–11. https://doi.org/10.22055/jaree.2026.51755.1293
MLA
Amiri, H. "Entropy-Based and Deep Learning–Driven Detection of Stealthy Cyberattacks in Smart Distribution Networks", Journal of Applied Research in Electrical Engineering, 5, 1, 2026, 1–11. doi: 10.22055/jaree.2026.51755.1293
HARVARD
Amiri, H. (2026). 'Entropy-Based and Deep Learning–Driven Detection of Stealthy Cyberattacks in Smart Distribution Networks', Journal of Applied Research in Electrical Engineering, 5(1), pp. 1–11. doi: 10.22055/jaree.2026.51755.1293
CHICAGO
Amiri, H., "Entropy-Based and Deep Learning–Driven Detection of Stealthy Cyberattacks in Smart Distribution Networks." Journal of Applied Research in Electrical Engineering, 5 1 (2026): 1–11, doi: 10.22055/jaree.2026.51755.1293
VANCOUVER
Amiri H. Entropy-Based and Deep Learning–Driven Detection of Stealthy Cyberattacks in Smart Distribution Networks. J. Appl. Res. Electr. Eng. 2026;5(1):1–11. doi: 10.22055/jaree.2026.51755.1293
