Election-based optimization algorithm with deep learning-enabled false data injection attack detection in cyber-physical systems

1.   Introduction

Today, cyber-physical systems (CPSs) are a focal point due to the development of network communication technology, information technology (IT), control theory, and technological developments. Incessantly, the security of CPSs is considered by progressive researchers, and an increasing number of attacks against numerous CPSs are performed ^[1]. In several instances, the CPSs have been attacked through false data injection attacks (FDIA). In 2015, the "BlackEnergy" virus provoked an electricity failure of the Ukrainian power grids, and later a different version of the virus attacked a railway operation system and mining company. It is noticeable that the attacks of the CPSs have been tremendously dangerous ^[2]. Consequently, the security of CPSs will be increasingly examined by several researchers.

Nowadays, the three leading categories of attacks against CPSs are denial of service (DoS) attacks, replay attacks, and FDIA ^[3]. The FDIA interrupts execution or stability by inserting false data without identification. Thus, figuring out how to recognize the FDIA is a major exploration domain. FDIA was devised reliant on the physical information of the system, which makes it complex for traditional identification techniques to detect the attacks ^[4]. Automatically, while the information of the CPSs is changed on FDIA, the connection between the output and input should be modified and what remains between actual and ideal outputs must be altered. Various attacks are caused by different false and even collapses in every part of CPSs, such as physical parts of the system or cyber modules ^[5]. In general, two important kinds of cyberattacks are denial of service (DoS) and deception attacks. In each category of deception attacks, the target of the attacker is to cooperate with the transferred data at the sensor to decrease the data packet's integrity ^[6]. Particularly, a few varieties of deception attacks arise frequently in industrial CPSs. Such popular attacks comprise FDIAs where the produced fault data (noise) from the attacker is inserted into the communication network to reduce the data authenticity of the system ^[7], replay attacks where the prior time data packets will be stored and transmitted recurrently for preventing the submodels from accomplishing the steady-state stage, and time-delay attacks where a delay parameter is inserted into the systems for affecting instability in the system's functions ^[8]. Deep learning (DL) methods have presented significant achievements in numerous sectors namely speech identification, natural language processing (NLP), and image identification, providing effective possibilities to enhance cybersecurity in Industry 5.0 ^[9]. Transformer, CNNs, and RNN methods are among the systems that will automatically learn intricate representations and patterns in the raw data ^[10]. This ability allows DL methods to identify new and complex attacks that should be avoided by standard machine learning (ML) techniques ^[11]. Additionally, DL methods are modified to deal with the challenges related to cybersecurity datasets, like non-stationarity, noise, and imbalance ^[12]. It will be integrated with other artificial intelligence (AI) methods, namely reinforcement learning (RL) and adversarial learning, to make highly strong and adaptable attack detection models ^[13]. DL algorithms can be used to considerably increase the identification and avoidance of web-based attacks in the CPS platform.

This manuscript offers the design of an election-based optimization algorithm with a deep learning-enabled false data injection attack detection (EBODL-FDIAD) technique in the CPS environment. In the EBODL-FDIAD system, the linear scaling normalization (LSN) approach can be used to scale the input data into a useful format. Besides, the EBODL-FDIAD method performs ensemble learning classification comprising three classifiers, namely the kernel extreme learning machine (KELM), long short-term memory (LSTM), and attention-based bidirectional recurrent neural network (ABiRNN) model. For optimal hyperparameter selection of the ensemble classifiers, the EBO algorithm can be applied. The impact of the presented method, EBODL-FDIAD, lies in its widespread manner of detecting FDIA utilizing DL approaches and advanced optimizer models. By combining an ensemble of classifiers with the EBO approach for hyperparameter tuning, we can improve the model's adaptability and performance, ensuring optimum configuration to generate reliable recognition of and correct cyber threats. The extensive results highlighted that the EBODL-FDIAD technique performed well over other approaches with respect to diverse measures. The major contributions of the study are listed as follows:

● The EBODL-FDIAD methodology provides a widespread solution to FDIA detection by integrating ensemble learning and an EBO-based hyperparameter tuning model in the CPS platform. As we know it, the EBODL-FDIAD approach has never occurred in previous literature.

● Employing an ensemble model by integrating KELM, LSTM, and ABiRNN enables the model to control the unique strengths of all of the methods, enhancing complete recognition performance. The inclusion of ABiRNN presents a new model for examining graph-structured data that is most relevant for identifying difficult connections and dependencies in CPS networks.

● Deploying the EBO approach for hyperparameter tuning improves the effectiveness and efficacy of the model by automatically optimizing main parameters, decreasing the need for manual tuning, and enhancing detection accuracy.

2.   Related works

In ^[14], a modified red fox optimizer with a DL-based FDIA detection (MRFODL-FDIAD) method was developed at the cyber-physical production system (CPPS) infrastructure. This introduced MRFODL-FDIAD system primarily identifies and categorizes FDIAs at the CPPS platform. This includes a three-phase method of identification, parameter tuning, and preprocessing. For FDIA detection, the MRFODL-FDIAD method employs a multihead attention-based LSTM (MBA-LSTM) system. In ^[15], an intelligent attack detection and recognition system was developed that can categorize the attack varieties on the physical layer dependent upon the ELM algorithm. Additionally, the developed method finds the attack or false to precise features or capacities in the model to support cybersecurity experts in alleviating the effects of the attack on the communication networks.

Liu et al. ^[16] examined the identification of irregular FDIA under CPSs. Deep-RL (DRL) was implemented to make an FDIA detection. Initially, the uneven attack detection issue was labeled as a partially observable Markov decision process (POMDP) and an neural network can be employed to analyze the POMDP. At this network, sliding observation windows consisting of the offline fragment of previous data have been employed as the input. In ^[17], a graph convolutional network (GCN) algorithm was developed to identify the FDIA. This presented method examined the representational features of FDIAs by executing the graphical architecture of the power network to analyze the changing state assessment values dependent upon the network topology and identified the position of the FDIAs.

In ^[18], a testbed of the process industry was designed that was a hardware-in-the-loop environment for simulating real-time industrial manufacturing and implemented an FDIA at this infrastructure. A host improved the physical method, and the cyber product was an engineer station or real industrial controller. Then, this developed method built an effective FDIA detection system, named the DRIF. In ^[19], an FDIA detection technique dependent upon protected federated DL was developed by integrating a transformer, federated learning (FL), and Paillier cryptosystem. The transformer is a detector employed for edge nodes, examining deeply the relationship among separate electrical measures by employing the multi-class self-attention mechanism. With the help of the FL model, the technique exploits the data at every node for collaboratively training a detection system.

Fu et al. ^[20] projected an innovative attack technique called the temporal FDI (TFDI) attack. The virus created outcomes dependent upon temporal interpretations of the CPPS, and a deep Q network (DQN) architecture stimulated the attack. For example, DQN captured vectors of incessant variables as input conditions, and the developed technique is allowed to the state space explosion issue. Additionally, for implementing time-series measures as quasi-dynamic analysis, LSTM cells could be utilized as a layer of the Q network. In ^[21], an end-wise DL method was established dependent upon a huge volume of real-time sensor data. Primarily, an innovative recursive model with multi-lookback inputs was developed. An innovative learning method called recursive gradient descent (RGD) was made for the designed model for decreasing combined prediction variability. Later, a classification method dependent upon temporal convolutions through numerous channels with decay impact was developed.

Tian et al. ^[22] investigated adversarial example attacks on multi-label FDIA locational detectors and presented a common multi-label adversarial attack structure like the multi-label adversarial false data injection attack (LESSON). In ^[23], the authors analyzed the tasks of adversarial attacks against DL-based Unmanned Aerial Vehicles (UAVs) and presented two adversarial attack approaches against regression methods in UAVs. The investigations exhibited that the presented non-targeted and targeted attack models crafted imperceptible adversarial images and presented a significant attack on the navigation and control systems of UAVs. Tian et al. ^[24] examined the joint adversarial example and FDIAs (AFDIAs) to discover several attack conditions for state evaluation in power systems. If perturbations are directly added to measurements, they are more likely to be identified by BDDs. The presented approach of adding perturbations to state variables ensures that the attack is secret to BDDs. Afterward, malicious data that are stealthy to both BDDs and DL-based detectors are created.

3.   The proposed method

In the manuscript, we offer the design of an EBODL-FDIAD technique in the CPS infrastructure. The purpose of the EBODL-FDIAD technique is to enhance security in the CPS environment via the detection of FDIAs. It contains three different processes namely data preprocessing, ensemble learning, and EBO-based parameter tuning. Figure 1 demonstrates the entire procedure of the EBODL-FDIAD technique.

3.1.   Data preprocessing

At the primary level, the EBODL-FDIAD technique applies the LSN approach to be used for scaling the input data into valuable formats. The LSN is a data preprocessing method developed for improving the comparability of features within a dataset ^[25]. By converting the values of distinct features through linear scaling, LSN confirms that every feature gives proportionally to the overall analysis without being disproportionately impacted by variances in scale. This system maps the original feature values to a standardized range, normally between 0 and 1, making the data more responsive to different ML methods and statistical analyses. LSN is mainly valued in conditions where disparate scales among features could skew model efficiency, offering a robust and effectual means to standardize datasets for increased interpretability and accuracy in analytical methods.

3.2.   Ensemble learning

The EBODL-FDIAD technique performs ensemble learning classification comprising three classifiers, namely the KELM, LSTM, and ABiRNN models.

3.2.1.   KELM model

As an advanced model, KELM is proposed based on the ELM model ^[26]. The kernel function has faster learning ability and better generalization performance. ELM is a feedforward neural network that consists of a hidden layer (HL), input layers, and output layers, and it can be mathematically modeled by,

In the equation, $H$ indicates the output matrix of HL, ${w}_{l}$ shows the weight of the ${l}^{th}$ neurons in the HL, $T$ indicates the target output matrix, $\beta$ refers to the output weight, and ${b}_{l}$ shows the bias of the ${l}^{th}$ neurons in the HL. The learning algorithm of ELM is used to resolve the output weight $\beta$ using the least square model:

In Eq (3), ${H}^{+}$ denotes the generalized inverse matrix of H. Figure 2 shows the structure of the KELM model.

In KELM, the kernel function parameters $\gamma$ and regularization coefficient $C$ are introduced to enhance KELM accuracy, and the kernel function matrix can be formulated by:

Next, the least square (LS) solution of $\beta$ values of the KELM is:

According to the abovementioned equation, the output function of KELM is formulated by:

Additionally, the radial basis function (RBF) is desired as a kernel operation and its formula can be written as:

In Eq (8), $\gamma$ implies the kernel parameter.

3.2.2.   LSTM model

LSTM can be a type of RNN. LSTM is used to replace the computation of hidden states with multiple gate functions ^[27]. This allows for capturing long-term dependence in the temporal data sequence. The LSTM presents an original flow, the cell state ${m}_{t}\in {\mathbb{R}}^{n}$ revealed at the top of the cell structure than traditional RNN. LSTM can add or remove the data to the cell states. The cell state retains the LSTM memory. A 3-gating model regulates the data flow in LSTM consisting of the input gate ${i}_{t}\in {\mathbb{R}}^{n}$, the forget gate ${f}_{t}\in$ ${\mathbb{R}}^{n}$, and the output gate ${o}_{t}\in {\mathbb{R}}^{n}$. The input gate is used to adjust the level of data from the existing input ${x}_{t}$ and the prior HL ${s}_{t-1}$ is fed into the existing state. The forget gate regulates what data at the prior cell state ${m}_{t-1}$ must be retained. The output gate regulates what amount of data is passed into the existing hidden state ${s}_{t}$. The operation of this gate is given below:

with the parameters ${V}_{i},$ ${V}_{f},$ ${V}_{o}\in {\mathbb{R}}^{n\times p}$; ${W}_{i},$ ${W}_{f},$ ${W}_{o}\in {\mathbb{R}}^{n\times n}$; and ${b}_{i},$ ${b}_{f},$ ${b}_{o}$ $\in {\mathbb{R}}^{n\times 1}$. $\sigma$ refers to the sigmoid activation function.

Next, the cell state and HL are attained as follows.

The equation $\circ$ indicates the component‐wise multiplication.${V}_{m}\in {\mathbb{R}}^{n\times p}$; ${W}_{m}\in {\mathbb{R}}^{n\times n}$; and ${b}_{m}\in {\mathbb{R}}^{n\times 1}.$ $\mathrm{t}\mathrm{a}\mathrm{n}\mathrm{h}$ refers to the hyperbolic tangent function.

The LSTM training is performed by the BPTT by reducing the main function on the set of training sequences. This gradient of weight and bias is evaluated at each time step. Next, with the traditional optimization approaches (for example, stochastic gradient descent (SGD), root mean square propogation (RMSprop), or adaptive moment estimation (Adam)), the optimum parameter is attained.

3.2.3.   ABiRNN model

RNN can capture temporal patterns in the information ^[28]. Typical RNN is unidirectional, such that the input dataset is processed in a temporal sequence. The shortcoming of RNNs is that they are limited to the usage of prior context. A bidirectional recurrent neural network (BRNN) provides a solution by performing the data processing in backward and forward directions. The structure of BRNN unfolded in time for $\mathrm{t}\mathrm{h}\mathrm{e}\;T$ time step. The BRNN includes backward and forward layers. The ${h}_{t}^{f}$ forward layer can be evaluated by processing the input dataset from $t = 1, \dots, T$, and the ${h}_{t}^{b}$ backward layer can be evaluated by processing the input dataset from $t = T, \dots, 1$ with output from both layers combined using the following equations:

The output vector ${y}_{t}$ attained by processing the series of input datasets from $t = 1, \dots, T$ was later fed into the attention layer. The dimensional of the hidden layer in the backward and forward direction is 50, with the output at the time step being a 100-size vector.

Paroxysmal atrial fibrillation (PAF) takes place as an intermittent period of AF scattered with episodes of normal sinus rhythm. Therefore, a soft attention module is applied on top of BRNN such that more attention (or emphasis) is gained with a high prevalence of $\mathrm{A}\mathrm{F}$. The attention model is expressed in the following. The output from BRNN $[{y}_{1}, {y}_{2}, {y}_{T}]$ is combined into matrix $Y$, which is of $N\mathrm{x}T$ size, where $N$ denotes the size of output vector ${y}_{t}$ and $T$ refers to the length of the input series. The weight output vector ${h}_{att}$ of the attention layer is given below:

$\alpha$ refers to the weight vector calculated from matrix $y$, and the output ${h}_{att}$ is computed as a weighted sum of the output vector from BRNN (${h}_{att}$ is a 100-dimensional vector).

3.3.   Hyperparameter tuning using EBO

For choosing the optimum hyperparameter for the ensemble classifiers, the EBO algorithm can be applied. Trojovsky and Dehghani proposed EBOA as a stochastic-based optimizer ^[29]. The mathematical modeling of the optimizer is discussed below:

1) Initialization

A participant of the community makes up the EBOA, a metaheuristic approach that works in the population dynamics manner. In the EBOA population, all individuals have a different method to address the issues at hand. A matrix named as a population matrix depicts the EBOA population from a mathematical perspective.

Initial positions of individuals in the search space are randomly allocated as follows:

In Eq (20), a random integer in the range [0, 1] is $r$, and $l{b}_{j}$ and $u{b}_{j}$ are the upper and lower limits of the ${j}^{th}$ variable, correspondingly. According to the value suggested by each participant of EBO, the value for the objective function (OF) is evaluated for the problem variable. The vector shows the estimated value for the $OF$ of the problem:

In Eq (21), $OF$ refers to the objective function value of the vector of the EBOA population and $O{F}_{i}$ is the computed value of $OF$ for ${i}^{th}$ participants of EBOA. Similar to other optimization techniques, EBOA has two different stages, namely the mathematical representation and physical explanation, which are described in the following section.

2) Voting and holding elections methods (exploration stage)

Participants of EBOA vote for a candidate in the election depending upon how well‐informed they are. Their awareness may rely on how high quality the $OFs$ will be and it can be mathematically modeled as follows:

In Eq (22), ${A}_{i}$ refers to the level of awareness of ${i}^{th}$ participants and $o{F}_{best}$ and $O{F}_{worst}$ are the best and worst values of $OF$, correspondingly. In the minimization problem, there is a minimum of two people running for choice on the default assumption of EBOA that the minimal candidate number of $\left({N}_{C}\right), (\mathrm{v}\mathrm{i}\mathrm{z}., {N}_{C}\ge 2)$ is two.

The voter's responsiveness is evaluated to be a random integer for determining who gets voted for in EBOA. If the voter's information is higher than the random integer, then that voter must select the fittest candidate $\left({C}_{1}\right)$. Then, the vote will be randomly distributed among the remaining contenders. This voting procedure can be mathematically modeled as follows:

In Eq (23), ${y}_{i}$ refers to the ${i}^{th}$ voter's preference, ${C}_{1}$ denotes the top pick, and ${C}_{k}$ indicates the ${k}^{th}$ candidates, where $k$ indicates an integer selected randomly from $\left\{\mathrm{2, 3}, \dots, {N}_{C}\right\}.$

Finally, the winner is determined (leader) when each vote has been counted. Even individuals who did not vote for the leader nevertheless sensed the effect of their decisions and policies. Based on the elected leader's recommendation, participants of the EBOA are specified new roles and tasks. This leader enhances the EBOA's ability for exploration by guiding the population method to different portions of the search space.

The leader directs the EBOA process with new individuals, and each receives a new role. The positions that are generated are recognized to use, thereby increasing the worth of the goal function. The participants retain their prior status in the absence of movement. Using Eqs (24) and (25), the EBOA process for updating itself is given:

where ${X}_{i}^{new.P1}$ is a new location generated for the ${i}^{th}$ participants, ${x}_{i, j}^{new, P1}$ refers to the ${i}^{th}$ participant of ${j}^{th}$ dimensions, $O{F}_{i}^{new, P1}$ indicates the value of $OF$, $I$ shows the random integer within ^[1,2], $L$ refers to the leader, ${L}_{i}$ shows the ${j}^{th}$ dimensions, and $O{F}_{L}$ indicates the $OF$ value.

3) Raising awareness via public movement (exploitation stage)

Person awareness has a big effect on how we make decisions. A restricted search near the predicted solution might support determining the best one, to put it mathematically. Increasing the values of $OF$ makes that individual extra aware and makes them make better decisions in the upcoming choice. Eqs (26) and (27) are used for increasing the public awareness of EBOA.

where ${X}_{i}^{new.P2}$ indicates a new location for the ${i}^{th}$ population, $O{F}_{i}^{new, P2}j$ refers to the ${j}^{th}$ variable, $O{F}_{i}^{new, P2}$ refers to the value of $OF$, $R$ refers to the constant equivalent to 0.02, $t$ denotes the repetition counter, and $T$ indicates the overall performed iterations.

The fitness selection is the substantial factor impacting the effectiveness of the EBO methods. The hyperparameter selection procedure contains the solution encoding technique for evaluating the efficacy of the candidate solutions. The EBO algorithm deliberates accuracy as the important measure to develop the fitness function (FF) that can be given in equation form:

Here, FP denotes the false positive and TP means the true positive values.

4.   Experimental validation

The FDIA detection results of the EBODL-FDIAD technique are demonstrated in this section. The results were tested using two aspects: IEEE-14 and IEEE-39 standard bus systems. Table 1 reports a detailed comparison study of the EBODL-FDIAD technique under the IEEE-14 standard bus system ^[14].

Figure 3 provides a brief, comparative $acc{u}_{y}$ analysis of the EBODL-FDIAD technique on the IEEE14 standard system. The figure implies that the SVM, CNN, MSA, CDBN, and SVM-GAB techniques reported the least performance and the MRFODL-FDIAD model exhibited slightly boosted results. In addition, the results show that the EBODL-FDIAD technique gained increased values of $acc{u}_{y}$. With TRP, the EBODL-FDIAD technique offered a higher $acc{u}_{y}$ of 97.97%, whereas the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB models obtained reduced $acc{u}_{y}$ of 96.89%, 90.33%, 89.71%, 90.53%, 91.82%, and 90.82%, respectively.

Figure 4 displays a comprehensive, comparative $rec{a}_{l}$ analysis of the EBODL-FDIAD system on the IEEE14 standard system. The figure shows that the SVM, CNN, MSA, CDBN, and SVM-GAB methods described the least performance and the MRFODL-FDIAD system shows somewhat increased results. Moreover, the results revealed that the EBODL-FDIAD technique had increased values of $rec{a}_{l}$. With TRP, the EBODL-FDIAD method provided a higher $rec{a}_{l}$ of 97.85%, whereas the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB techniques acquired decreased $rec{a}_{l}$ of 96.85%, 91.80%, 92.95%, 90.48%, 92.75%, and 92.07%, respectively.

Figure 5 offers a brief, comparative $AU{C}_{score}$ analysis of the EBODL-FDIAD method on the IEEE14 standard system. The figure exhibits that the SVM, CNN, MSA, CDBN, and SVM-GAB algorithms reported decreased performance and the MRFODL-FDIAD method displays slightly boosted results. In addition, the outcomes prove that the EBODL-FDIAD method gained increased values of $AU{C}_{score}$. According to TRP, the EBODL-FDIAD system provided a greater $AU{C}_{score}$ of 98.79%, but the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB algorithms had a diminished $AU{C}_{score}$ of 97.61%, 91.86%, 90.96%, 89.89%, 93.64%, and 92.30%, respectively.

Figure 6 illustrates a wide-ranging comparison of the FNR analysis of the EBODL-FDIAD method with the IEEE14 standard system. This figure showcases that the SVM, CNN, MSA, CDBN, and SVM-GAB techniques informed poorer performance and the MRFODL-FDIAD system displayed moderately improved outcomes. Additionally, the results revealed that the EBODL-FDIAD system had higher values of FNR. With TRP, the EBODL-FDIAD system acquired an increased FNR of 2.08, however, the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB techniques had minimized FNR of 3.37, 8.43, 7.30, 9.77, 7.49, and 8.16, respectively.

The $acc{u}_{y}$ curves for training (TRA) and validation (VL) shown in Figure 7 for the EBODL-FDIAD technique on the IEEE14 standard system give valued insights into its effectiveness at varying epochs. Mainly, it can be a reliable upgrade in both TRA and TES $acc{u}_{y}$ with raised epochs, representing the proficiency of the model for learnable and recognizable patterns from TRA and TES data. The increased trends in TES $acc{u}_{y}$ underscore the model flexibility of the TRA dataset and the ability to precisely create predictions on unnoticed data, emphasizing capabilities of robust generalization.

Figure 8 displays a comprehensive overview of the TRA and TES loss values for the EBODL-FDIAD algorithm on the IEEE14 standard system at diverse epochs. The TRA loss reliably decreases as the model refines weights to diminish the classification errors under both datasets. These loss curves explain the arrangement of the model with the TRA data, emphasizing the ability to capture patterns effectually. The incessant improvement of parameters in the EBODL-FDIAD system can be significant, targeted at lessening differences between predictions and actual TRA labels.

Table 2 reports an extensive comparison outcome of the EBODL-FDIAD technique on the IEEE-39 standard bus system. Figure 9 represents a wide-ranging, comparative $acc{u}_{y}$ analysis of the EBODL-FDIAD method with the IEEE39 standard system.

This figure indicates that the SVM, CNN, MSA, CDBN, and SVM-GAB techniques described minimized performance and the MRFODL-FDIAD method shows moderately improved outcomes. Moreover, the results exhibit that the EBODL-FDIAD technique had improved values of $acc{u}_{y}$. With TRP, the EBODL-FDIAD algorithm had boosted $acc{u}_{y}$ of 98.77%, while the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB algorithms obtained decreased $acc{u}_{y}$ of 96.79%, 90.72%, 94.21%, 94.06%, 92.26%, and 91.33%, respectively.

Figure 10 illustrates a comprehensive, comparative $rec{a}_{l}$ analysis of the EBODL-FDIAD system on the IEEE39 standard system. This figure shows that the SVM, CNN, MSA, CDBN, and SVM-GAB algorithms had the least performance and the MRFODL-FDIAD system reveals somewhat improved results. Meanwhile, the results denoted that the EBODL-FDIAD method achieved greater values of $rec{a}_{l}$. With TRP, the EBODL-FDIAD method provided an increased $rec{a}_{l}$ of 98.56%, while the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB approaches acquired lessened $rec{a}_{l}$ of 97.70%, 92.03%, 91.11%, 89.51%, 94.10%, and 89.83%, respectively.

Figure 11 demonstrates an extensive, comparative $AU{C}_{score}$ analysis of the EBODL-FDIAD method with the IEEE39 standard system. This figure indicates that the SVM, CNN, MSA, CDBN, and SVM-GAB systems stated less performance and the MRFODL-FDIAD system displayed moderately boosted outcomes. Additionally, the results presented that the EBODL-FDIAD algorithm had greater values of $AU{C}_{score}$. With TRP, the EBODL-FDIAD technique offered an increased $AU{C}_{score}$ of 98.79%, whereas the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB algorithms achieved minimized $AU{C}_{score}$ of 97.98%, 96.82%, 90.72%, 93.89%, 89.89%, and 94.29%, respectively.

Figure 12 displays a brief comparison of the FNR outcomes of the EBODL-FDIAD method on the IEEE39 standard system. The figure implies that the SVM, CNN, MSA, CDBN, and SVM-GAB algorithms reported the least performance and the MRFODL-FDIAD model exhibited somewhat boosted results. Simultaneously, the results show that the EBODL-FDIAD method gained raised values of FNR. With TRP, the EBODL-FDIAD algorithm provided a higher FNR of 1.47, whereas the MRFODL-FDIAD, SVM, CNN, MSA, CDBN, and SVM-GAB techniques obtained reduced FNR of 2.55, 8.22, 9.14, 10.73, 6.13, and 10.41, respectively.

The $acc{u}_{y}$ curves for TRA and VL shown in Figure 13 for the EBODL-FDIAD algorithm with the IEEE39 standard system provide valued insights into its efficiency at various epochs. Primarily, it can be a consistent upgrade in both TRA and TES $acc{u}_{y}$ with higher epochs, representing the proficiency of the model for learnable and recognizable patterns from both TRA and TES data. The raised trends in TES $acc{u}_{y}$ underscore the model flexibility of the TRA dataset and the ability to precisely produce predictions on undetected data, underscoring capabilities of robust generalization.

Figure 14 provides an extensive outcome of the TRA and TES loss values for the EBODL-FDIAD method on the IEEE39 standard system at diverse epochs. The TRA loss is reliably minimized as the model refines weights to lessen the classification errors under both datasets. The loss curves represent the model arrangements with the data of TRA, emphasizing the ability to capture patterns successfully. The continuous improvement of parameters in the EBODL-FDIAD system can be significant, targeted at lessening variances between actual and predicted TRA labels. These accomplished outcomes ensure the enhanced performance of the EBODL-FDIAD method on the FDIA detection process.

5.   Conclusions

In this manuscript, we offered the design of an EBODL-FDIAD method in the CPS platform. The purpose of the EBODL-FDIAD algorithm was to enhance security in the CPS environment via the detection of FDIAs. It contains three different processes, namely data preprocessing, ensemble learning, and EBO-based parameter tuning. At the primary level, the EBODL-FDIAD technique applies the LSN approach, which can be used for scaling the input data into valuable formats. In addition, the EBODL-FDIAD technique performs ensemble learning classification comprising three classifiers, namely the KELM, LSTM, and ABiRNN models. For optimal hyperparameter selection of the ensemble classifiers, the EBO algorithm was applied. To validate the enriched performance of the EBODL-FDIAD method, comprehensive simulations were involved. The extensive results highlighted that the EBODL-FDIAD technique performed well over other systems for diverse measures. In future work, the EBODL-FDIAD methodology can be provided by integrating methods from adversarial ML to improve its robustness against sophisticated attacks. By actively creating adversarial examples and training the model to detect and diminish them, this model is optimum for defending against evasion and poisoning efforts by adversaries. Also, exploring the application of federated learning methods to allow collaborative training across distributed CPS platforms are additional developments of the scalability and generalization abilities of the model that can be studied, enabling more effectual recognition of FDIAs in large-scale and heterogeneous systems.

Use of AI tools declaration

The authors declare that they have not used artificial intelligence (AI) tools in the creation of this article.

Acknowledgments

The authors extend their appreciation to the Deanship of Scientific Research at King Khalid University for funding this work through a large group research project under grant number (RGP2/02/44); Princess Nourah bint Abdulrahman University Researchers Supporting Project number (PNURSP2024R384), Princess Nourah bint Abdulrahman University, Riyadh, Saudi Arabia; and Research Supporting Project number (RSPD2024R608), King Saud University, Riyadh, Saudi Arabia. The authors extend their appreciation to the Deanship of Scientific Research at Northern Border University, Arar, KSA, for funding this research work through the project number "NBU-FPEJ-2024- 2847-01". This study is partially funded by the Future University in Egypt (FUE).

Conflict of interest

The authors declare that they have no conflicts of interest.