The smart power grid is a synergistic system that integrates diverse network components for power generation, transmission, and distribution. Its advanced metering infrastructure (AMI) enables the grid's efficient and reliable operation. Nevertheless, it is amenable to advanced cyber threats; malicious actors can compromise vulnerable meters and arbitrarily alter their readings. These orchestrated “false data injection attacks” can lead to power outages and service interruption. We propose a framework that uses measurements from trusted (secure) nodes in order to detect abnormal “spoofing” activity of other nodes, possibly tampered. Our model considers the structural similarities in the electricity consumption of AMI nodes, and exploits the spatial correlation amongst meters. To alleviate the problem's large-dimensionality aspect, the meters are clustered into classes of similar energy patterns. We evaluate our algorithms using real-world building data obtained from a large university campus.