Distinguishing noise from low-amplitude false data in cyber-resilient rolling energy management of smart distribution networks

• Real-time energy management is proposed for distribution grid with local generation and storage. • The model performs rolling optimization using the latest network data for adaptive scheduling. • All measurements and transmitted data are affected by noise and low-magnitude false data injection. • Innovative residual-current-based indices, including magnitude- and angle-based measures, are defined. • The proposed indices can accurately distinguish noise from low-amplitude falsified data. This paper proposes a real-time energy management optimization model for active distribution networks. In this model, the active distribution network connected to distributed energy resources exchanges data iteratively with a centralized energy management and control system at each time interval. Network-level parameters, including bus voltages and active and reactive power injections, are measured and sent to the central control system, where data are analyzed for variation, validation, noise detection, and cyberattack identification. Based on this analysis, the system performs rolling optimization for upcoming time-intervals and sends updated operational schedules back to the network, ensuring that generation units and controllable loads operate according to the newest optimal plan. As a result, the optimization of grid performance is carried out at every time interval, and the grid along with local generation–consumption resources are scheduled to operate according to the latest changes in grid parameters such as prices and power loads. Such adaptive scheduling guarantees both optimal and robust performance across all upcoming time periods. During data exchange, measurements may be corrupted by noise or falsified by stealthy false data injection (FDI) attacks with amplitudes close to measurement noise (low-magnitude FDI), making them difficult to detect. To address this challenge, several indices are proposed, including the Bus Current Imbalance Index (BCII), the Residual Current Magnitude Index (RCMI), and the Residual Current Angle Index (RCAI), which can effectively distinguish between noisy and falsified data while identifying the location, start time, and duration of cyberattacks. The results indicate that under varying input parameters such as electricity price, solar irradiance, and network load, the rolling optimization updates schedules and provides an optimal plan for upcoming hours. For example, at hour 6, the diesel generator schedule is adjusted for hours 6–24, and at hour 15, a new schedule is set for hours 15–24. Similarly, the battery plan is updated throughout the day; discharging initially scheduled at hours 17 and 19 is shifted to hours 18 and 19. These operational adjustments impacts operational cost. At hour 6 the total cost rises by 153.34%, whereas at hour 20 the total cost drops by 30.26%. The results also show that the model effectively detects small-magnitude FDI attacks under noise, with amplitudes equal to or 1–3 times the noise. Sensitivity analysis confirms that the proposed index consistently detects attacks under noise levels ranging from 1% to 5%.