Optimized Two-Stage Anomaly Detection and Recovery in Smart Grid Data Using Enhanced DeBERTa-v3 Verification System.

Area of Science:

• Cybersecurity
• Smart Grid Infrastructure
• Artificial Intelligence
• Machine Learning

Background:

• Smart grid infrastructure faces increasingly sophisticated cyberattacks.
• Existing anomaly detection and recovery systems struggle to balance recall and precision.
• Reliable data restoration is crucial for operational integrity.

Purpose of the Study:

• To develop and evaluate an optimized two-stage anomaly detection and recovery system for smart grid cyberattacks.
• To enhance system performance by combining an enhanced TimerXL detector with a DeBERTa-v3-based verification and recovery mechanism.
• To achieve high recall and precision in anomaly detection while ensuring accurate data restoration.

Main Methods:

• Implemented a two-stage system: Stage 1 uses an optimized increment-based detection algorithm (95.0% recall, 54.8% precision).
• Stage 2 employs a modified DeBERTa-v3 architecture with 25-dimensional feature engineering for verification (95.1% precision, 84.1% recall).
• Utilized a balanced loss function (focal, Dice, contrastive learning), ensemble verification, optimized sample weighting, and a generative time series model (TimER) for recovery.

Main Results:

• Achieved an F1-score of 0.873 ± 0.114 for anomaly detection, significantly outperforming existing methods (e.g., ARIMA, LSTM-AE, Anomaly Transformer, TimesNet).
• The recovery mechanism demonstrated a Mean Absolute Error (MAE) of 0.0055 kWh, a 99.91% improvement over ARIMA.
• The system operates in real-time with a 66.6 ± 7.2 ms inference time and maintains robust performance across various anomaly magnitudes.

Conclusions:

• The proposed two-stage system offers a significant advancement in smart grid cybersecurity, providing superior anomaly detection and data recovery capabilities.
• The integration of DeBERTa-v3 and advanced loss functions effectively addresses the challenges of balancing recall and precision.
• The system's real-time performance and robustness make it suitable for operational deployment in protecting smart grid infrastructure.