CuSum-Based Change Detection of False Data Injection Attacks in DC Microgrids

In cyber-physical dc microgrids, observer-based methods are widely used for state estimation and attack detection. However, certain false data injection attacks (FDIAs) targeting communicated signals can remain stealthy to observers, pre serving closed-loop stability while shifting the system operating point and degrading performance. This paper addresses the detection of such observer-stealthy FDIAs in dc microgrids. Specifically, unknown-input observers are designed to estimate communicated signals exchanged over cyber links, and pre- and post-change models are derived from the resulting estimation error dynamics under nominal operation and FDIA. Then a model-based Ergodic CuSum detector is developed to detect FDIAs that bypass observer detection. To overcome the limitation of requiring prior knowledge of the attack magnitude, a data driven online gradient ascent (OGA) Csum algorithm is further proposed. The OGA-CuSum detector recursively estimates the post-change mean directly from system observations, enabling adaptive detection of unknown and time-varying FDIA without assuming a fixed change parameter. The effectiveness and real time feasibility of the proposed framework are validated through simulation and hardware-in-the-loop experiments, demonstrating reliable detection of observer-stealthy FDIA in dc microgrids.