Whale Optimization Algorithm-trained Artificial Neural Network Article 2022

ORIGINAL ARTICLE
A whale optimization algorithm-trained artificial neural network
for smart grid cyber intrusion detection
Lida Haghnegahdar 1 • Yong Wang 1
Received: 6 April 2019 / Accepted: 19 August 2019
Ó Springer-Verlag London Ltd., part of Springer Nature 2019
Abstract
The smart grid is a revolutionary, intelligent, next-generation power system. Due to its cyber infrastructure nature, it must
be able to accurately and detect potential cyber-attacks and take appropriate actions in a timely manner. This paper creates
a new intrusion detection model, which is able to classify the binary-class, triple-class, and multi-class cyber-attacks and
power-system incidents. The intrusion detection model is based on a whale optimization algorithm (WOA)-trained artificial
neural network (ANN). The WOA is applied to initialize and adjust the weight vector of the ANN to achieve the minimum
mean square error. The proposed WOA-ANN model can address the challenges of attacks, failure prediction, and failure
detection in a power system. We utilize the Mississippi State University and Oak Ridge National Laboratory databases of
power-system attacks to demonstrate the proposed model and show the experimental results. The WOA is able to train the
ANN to find the optimal weights. We compare the proposed model with other commonly used classifiers. The comparison
results show the superiority of the proposed WOA-ANN model.
Keywords Smart grid  Cyber-attack  Whale optimization algorithm (WOA)  Artificial neural network (ANN)
1 Introduction
The smart grid is a complex system that combines com-
putation technologies, advanced communication, and
recognition in the existing power systems. The smart grid
employs intelligent control applications and requires uti-
lizing fast, secure, high-quality, and error-free data [1]. The
smart grid is still developing, but as a cyber-physical sys-
tem and critical infrastructure, it is subject to risks of
misoperations, which occur when intruders inject bad,
false, or malicious data [2]. Large-scale smart grid
deployment has made cyber-security a critical challenge
for power systems operators. Nowadays, a power system
can be vulnerable to cyber penetration due to the wide-
spread use of the high-speed networks and key cyber-
physical equipment [3, 4]. Traditional attack detection
tools have difficulty in processing such high-speed, high-
volume data generated by these large-scale power systems.
An effective and resilient cyber-security system is still
needed to address these emerging challenges while effi-
ciently detecting malicious data in the network [5–7].
Data intrusion attacks are the most common types of
cyber-attacks that threaten the security of the power grid.
Generally, there are three major data intrusion attacks:
false data injection (FDI) attacks, load redistribution (LR)
attacks, and denial of service (DoS) attacks [8, 9]. Cyber
attackers use these attacks to manipulate the communicated
data for operations control of the power systems in order to
interrupt the safe operations of the power grid, gain
financial advantage, or even damage the power grid’s
physical structure [10, 11]. Effective detection and sepa-
ration of the abnormal data from the normal data are a
major requirement of modern intrusion detection systems
(IDS) [12]. An IDS maintains data availability while pro-
tecting the confidentiality and integrity of the network
against potential attacks [13, 14]. The intrusion detection
model is the core of the IDS. If the intrusion detection
model is unreliable or ineffective, it can cause significant
disasters that impact both consumers and utilities [15, 16].
The intrusion detection model deals with the engineering
& Yong Wang
[e-mail]
1 Department of Systems Science and Industrial Engineering,
Binghamton University, 4400 Vestal Pkwy E,
Binghamton, NY 13902, USA
123
Neural Computing and Applications
https://doi.org/10.1007/s00521-019-04453-w (0123456789().,-volV)(0123456789().,-volV)

problems that are unknown, nonlinear, and associated with
noise. To solve these problems, the intrusion detection
model is required to achieve reliable, robust, and cost-ef-
fective solutions.
Various studies have been conducted on developing
intrusion detection models for the power systems, and the
following summarizes the related literature.
Kosut et al. [17–19] described several strategies and
counteractions for malicious data attacks on control cen-
ters. They presented a minimum-residue-energy heuristic
to find small, but highly damaging attacks [18, 20]. Qin
et al. [21] and Yang et al. [22] studied detectable, but
unidentifiable attacks. Vukovic et al. [23] considered the
combined power flow model with the supervisory control
and data acquisition (SCADA) communication structure
model and presented algorithms for improving attack
detection and system security metrics. A defensive
scheme based on the optimal phasor measurement unit
(PMU) placement has been applied in [24, 25]. Reference
[26] suggested countermeasures against unobservable
attacks. It assumes the known and secure PMUs are suffi-
cient to disable attacks.
Cyber-attacks might appear as natural events. Therefore,
discriminating between malicious and non-malicious data
in the communication system is difficult and challenging.
Pan et al. [27] proposed distinguishing between distur-
bances and cyber-attacks because a cyber-attack may
appear as a disturbance, or conversely a disturbance may
appear as a cyber-attack. This causes misclassification and
results in improper actions and other negative impacts on
the power system [28]. Many data-mining methods have
been identified to classify and group labels of power-sys-
tem disturbances. For example, Ref. [22] developed a bad-
data detection algorithm to operate on the defined bad-data
scenarios. However, there are some limitations on the
proposed algorithms and they can classify only some
specific types of disturbances and attacks. For instance,
some new research focused on multiagent systems under
DoS attacks to investigate the adverse impact of distributed
DoS attacks from multiple adversaries [29]. Resilient
cooperative event-triggered control and scheduling of the
controller are considered in the presence of DoS attacks
[30].
In the intrusion detection applications, the size of the
feature set may greatly affect the speed and accuracy of the
detection process. A larger number of features may not
always lead to better performance because more features
require larger memory, longer processing time, and
potentially a higher noise-to-signal ratio. Gupta et al. [5]
and Hink et al. [31] demonstrated the importance of feature
selection to fast intrusion detection in a network with heavy
information traffic. A feature selection approach was pro-
posed in [32] to identify the optimal and smallest set of
features that leads to high accuracy with timely and
expected classification results. Another intrusion detection
model [33] that can provide high detection reliability is
also based on feature selection. Their model showed a low
false positive (FP) rate and high true positive (TP) rate in
comparison with the other feature selection methods.
The artificial neural network (ANN) is commonly used
as a classifier in machine learning due to its simplicity and
effectiveness. It has also been applied in intrusion detection
models for power systems [34]. The training of the ANN is
still a challenging problem. Slow convergence and local
optima are difficult to address by the traditional training
algorithms. One latest trend is to train the ANN using
nature-inspired meta-heuristic algorithms that mimic bio-
logical or physical phenomena to find the best weights and
biases for the problems [35]. Examples include the moth-
flame optimization (MFO) algorithm [36] and the gray
wolf optimization (GWO) algorithm [37].
In this paper, we propose to create an intrusion detection
model using an ANN that is trained with the whale opti-
mization algorithm (WOA). This model is referred to as
WOA-ANN. Typically, ANN structures and their neuron
arrangements can be divided into three types: feed-back-
wards, feed-forwards, and self-organizing maps. A multi-
layer perceptron (MLP) is a feed-forward neural network
that transforms the inputs into outputs by using the hidden
layer. Here, the back-propagation algorithm has been used
as the supervised learning pattern to train the network.
WOA, which is a swarm-based intelligent search method
[38], is used to overcome the slow convergence problem
and the ‘‘local minima’’ trap associated with ANN while
identifying the attacks. WOA is able to explore and esti-
mate the detected neighborhood space of the global opti-
mum and is recognized as an efficient and capable
algorithm to solve the optimization problems. In order to
overcome the difficulties that are associated with the
learning approach in neural network, we used a WOA
algorithm as a trainer for a feed-forward neural network.
Since it is a gradient-free and flexible mechanism, which is
able for local-optima avoidance, it has been proved that
this algorithm is able to solve a wide range of optimization
problems and outperform the other existing algorithms in
training MLPs. According to the proved results in the lit-
erature, we selected WOA to train the artificial neural
network for smart grid cyber intrusion detection in this
paper.
The mean-square error (MSE), which will be minimized
by the WOA, and the best weights will be acquired to use
in the ANN. Different statistical measures including
accuracy, precision, recall, and the F1 score are used to
evaluate the WOA-ANN model’s performance. Finally, the
proposed WOA-ANN model is compared with other
intrusion detection models that use Mississippi State
Neural Computing and Applications
123

University (MSU) and Oak Ridge National Laboratory
(ORNL) databases of power-system attacks. WOA-ANN
can make a better perception for most of the cases and
determine the difference between different classes of
unknown entities in the large-scale power-system intrusion
datasets.
The rest of this paper is arranged as follows: Sect. 2
presents the WOA-ANN-based intrusion detection model.
Section 3 describes the power-system architecture and the
datasets used in this paper. Section 4 presents the experi-
mental results and the performance analysis of the WOA-
ANN algorithm. Conclusions and future work are discussed
in Sect. 5.
2 Intrusion detection modeling using WOA-
ANN
2.1 ANN
The ANN is a popular classification modeling tool that is
inspired by the biological neurons’ activities in human
brains [39, 40]. ANN behaves differently from traditional
classification methods because it dynamically generates
relationships by learning from training inputs, while tra-
ditional classifications behave based on predefined rela-
tions. The ANN classification process includes two phases:
the training phase (during which the weights and biases are
updated through the training data) and the testing phase
(during which the classification accuracy is assessed with
the testing data) [41–43]. The input weight summation is
calculated using
S j ¼ Xm
i¼1
Ii wij þ bj ð1Þ
where I i is the input variable; w ij is the connection weight
between the input node i and the hidden node j; bj is the
bias of the hidden node j. The following sigmoid activation
function is used to calculate the output for each hidden
layer node:
f j ¼ 1
1 þ eS j ð2Þ
The final output of each node k in the output layer of the
network is calculated using
^O k ¼ Xh
j¼1
f j wjk þ bk ð3Þ
where wjk is the connection weight between hidden node j
and the output node k and bk is the bias of the output node
k.
2.2 WOA
The WOA is a nature-inspired population-based novel
stochastic optimization technique that was recently devel-
oped. The WOA uses a set of search agents to find the best
solution to an optimization problem [38]. The WOA imi-
tates the behaviors of humpback whales when they hunt
prey through a strategy called bubble-net hunting. The
WOA includes three general steps: encircling prey, bubble-
net attacking, and searching around best prey. WOA
achieved advantageous performance compared to other
well-known meta-heuristic methods such as GWO and
PSO [35, 44] in some benchmark testing.
Humpback whales use the bubble-net mechanism to
circle around prey and hunt them [37]. The whales enclose
the prey, such as fishes, and then try to update their posi-
tions to find the optimum solution. The main mathematical
part of the WOA is shown in Eqs. (4) and (5).
X t þ 1ð Þ ¼ X tð Þ  A  C  X tð Þ  X tð Þj j if p\0:5 ð4Þ
X t þ 1ð Þ ¼ C  X tð Þ  X tð Þj j  e bl cos 2ptð Þ
þ X tð Þ if p  0:5 ð5Þ
where X is a vector of all the whales’ positions; t is the
time or iteration index; X* is the best solution found so far;
A ¼ 2a  r  að Þ; C ¼ 2  r; a is a coefficient vector that
linearly decreases from 2 to 0 over the course of iterations;
r is a random vector whose values are between 0 and 1; b is
a constant value that defines the shape of the logarithmic
spiral depending on the particular path and in this paper its
value is set to 1; l is a random number between - 1 and 1;
p is a random number between 0 and 1 and is used to
switch between (4) and (5) in updating the whales’ posi-
tions; in Eqs. (4) and (5), the probabilities are 50% and
50%; it means during the optimization process, whales
select either path randomly with an equal chance. During
the bubble-net phase, the random value for A is [- 1, 1],
but in the searching phase, the random value of vector A
can be greater than 1 or less than 1. The searching mech-
anism is shown in Eq. (6)
X t þ 1ð Þ ¼ Xrand  A  C  Xrand  X tð Þj j ð6Þ
This random search mechanism with the value of |A|
greater than one emphasizes the searching operation and
enforces the WOA algorithm to perform a global search.
Random solutions are created at the beginning of the
WOA searching process. Then, these solutions are updated
iteration by iteration using the algorithm in Table 1. The
search will go on until a predefined maximum number of
iterations has been reached.
Neural Computing and Applications
123

2.3 The ANN structure
We implemented two MLP networks in this paper. Each
MLP includes an input layer, a hidden layer, and an output
layer. The general structure of the MLP networks is shown
in Fig. 1. The numbers of input, hidden, and output nodes
are m, h, and k, respectively. These numbers are different
for binary, triple-, and multi-class problems. The training
process of the MLP is shown in Fig. 2. It takes the inputs
and generates the outputs based on the existing weights and
biases. The calculated output from the feed-forward path is
compared with the target outcome using the loss function.
Then, in the traditional MLP network, we used the
Levenberg–Marquardt back-propagation algorithm [45] to
update the weights and biases for the next iteration. In our
proposed MLP network, we use the WOA to update the
weights for the next iteration.
2.4 Proposed WOA-ANN
In this part, the WOA algorithm is applied to train the ANN
to classify the attacks from normal events in the power
system. In the proposed WOA-ANN framework, each
search agent is initialized to optimize a candidate neural
network. An MLP network contains vectors of weights and
biases that identify the relationships between the input
layer and the hidden layer as well as the hidden layer and
Table 1 The general WOA
algorithm STARTimport datainitialize the locations of the whale population Xcompute the fitness of each whaleinitialize a and r, calculate A and Cinitialize X* as the best hunter whale's locationinitialize t = 1while t ≤ max iterations dofor each hunting whale doif p < 0.5if |A| < 1update the current hunting whale's location using (4)else if |A| ≥ 1randomly select another search agentupdate the current hunting whale's location using (6)end ifelse if p ≥ 0.5update the current hunting whale's location using (5)end ifend forupdate X* if there is a better solutiont = t +1end whileoutput X*END
Fig. 1 General structure of the MLP network
Neural Computing and Applications
123