Systems and Methods for Malicious Attack Detection in Phasor Measurement Unit Data

A method for determining whether a power system is encountering a malicious attack is provided. The method comprises: receiving a plurality of first phasor measurement unit (PMU) measurements from a plurality of PMUs of the power system; determining a plurality of expected PMU measurements associated with a future time period based on an optimization algorithm that uses differences between a plurality of consecutive predictive entries and the plurality of first PMU measurements; receiving, from the plurality of PMUs, a plurality of second PMU measurements associated with the future time period; determining whether the power system is encountering the malicious attack based on comparing the plurality of expected PMU measurements with the plurality of second PMU measurements; and executing an action based on whether the power system is encountering the malicious attack.