FalsEye: proactive detection of false data injection attacks in smart grids using IceCube-optimised ensemble learning

Keeping the Lights On in a Digital World

Modern power grids are rapidly turning into "smart" systems that rely on constant streams of digital data to keep electricity flowing smoothly. But the same connectivity that makes them efficient also opens the door to cybercriminals who can quietly tamper with sensor readings and control signals. This paper introduces FalsEye, a new intelligent watchdog designed to spot these hidden data attacks early, so that blackouts, equipment damage, and service disruptions can be prevented before they ripple out to homes and businesses.

When Fake Data Threatens Real Power

Smart grids depend on sensors and control devices that tell operators what is happening on power lines in real time. False Data Injection Attacks (FDIAs) work by subtly altering these measurements so that the grid appears healthy when it is actually under stress, or by tricking equipment into taking the wrong actions. Real-world incidents in Ukraine and attempted attacks in the United States show that this is not a theoretical concern: carefully crafted malicious data can shut down substations and cause large-scale outages. Because actual attacks are rare compared to normal operation, and because attackers can constantly change their tactics, traditional rule-based alarms and standard machine learning tools often miss the most dangerous cases.

Why Earlier Defenses Fell Short

Researchers have tried a wide variety of methods to detect FDIAs, from statistical checks and signal-processing tricks to advanced neural networks. Many of these methods work well in controlled tests, but struggle in real grid environments. A key problem is imbalance in the data: there are far more examples of normal behavior than of attacks, so models learn to be very good at recognizing the ordinary and very bad at catching the rare and harmful. Other approaches use only a single type of model or rely on fixed settings chosen by hand, which may not adapt well when the grid changes or when attackers shift their strategies. The authors reviewed decades of prior work and found that no existing system fully combined three ingredients that are known to help: powerful model ensembles, smart balancing of rare events in the data, and systematic tuning of model settings.

Building a Smarter Watchdog

FalsEye brings these missing pieces together in one pipeline. It starts with measurements from a publicly available smart grid test system that includes both natural events and a wide range of simulated attacks. Using a technique called feature selection, the framework first picks the most informative parts of the data, such as changes in voltage, current, and frequency that tend to shift during an attack. Then it applies an adaptive oversampling method called ADASYN, which generates realistic extra examples of rare attack patterns, especially in the hardest-to-learn regions of the data space. This helps the system learn what attacks look like without overwhelming it with artificial noise.

Combining Many Minds and Fine-Tuning Them

At the heart of FalsEye is a voting ensemble that brings together several different machine learning models, including fast tree-based methods like Extra Trees, LightGBM, and CatBoost, along with more traditional classifiers. Instead of trusting any single model, the system blends their probability estimates through "soft voting," so that weak spots in one model can be covered by strengths in another. To squeeze the best performance out of these components, the authors introduce a new optimization approach inspired by how particles diffuse and freeze in ice, dubbed the IceCube Optimization (IO) algorithm. IO explores different combinations of settings for the base models, steering them toward configurations that best recognize the minority attack class. A second step, using a standard grid search, then carefully polishes these promising settings to ensure they work reliably across different slices of the data.

How Well Does It Work?

To test FalsEye, the researchers used a labeled dataset from Oak Ridge National Laboratory that mimics a real transmission network with various fault and attack scenarios. They compared FalsEye against many common machine learning models and several state-of-the-art detection schemes from recent studies. Across measures that matter most for safety—especially recall, which reflects how many actual attacks are caught—the new framework consistently came out on top. It achieved an overall accuracy of 99%, with high recall for attack cases even when attacks were extremely rare, such as one attack for every thousand normal events. The system remained stable across a range of imbalance levels, suggesting it can cope with the reality that cyberattacks are rare but potentially devastating.

What This Means for Everyday Users

FalsEye shows that by thoughtfully combining multiple learning methods, balancing scarce attack data, and carefully tuning system settings, it is possible to build a much more vigilant guard for smart grids. For non-specialists, the takeaway is simple: smarter software can make our increasingly digital power infrastructure harder to fool with fake data. If adopted and integrated into real-time monitoring, approaches like FalsEye could help keep electricity more reliable and resilient, even as cyber threats grow in number and sophistication.

Citation: Sheta, A.N., Osman, S.F., Eladl, A.A. et al. FalsEye: proactive detection of false data injection attacks in smart grids using IceCube-optimised ensemble learning. Sci Rep 16, 9093 (2026). https://doi.org/10.1038/s41598-026-38723-0

Keywords: smart grid security, false data injection, cyberattack detection, machine learning ensemble, imbalanced data