Attentional LSTM-ensemble architecture for intrusion detection in smart grids

Area of Science:

• Cybersecurity
• Artificial Intelligence
• Energy Systems

Background:

• Smart grids are increasingly vulnerable to cyberattacks due to interconnected infrastructure.
• Intrusions can disrupt operations, compromise data, and cause widespread power outages.
• Existing detection methods struggle with complex attack patterns and imbalanced data.

Purpose of the Study:

• To develop a robust and scalable intrusion detection system for smart grids.
• To enhance the detection of minority attack classes in imbalanced datasets.
• To combine temporal feature extraction with ensemble classification for improved accuracy and interpretability.

Main Methods:

• Utilized a Long Short-Term Memory (LSTM) network with an attention mechanism for temporal-saliency feature extraction.
• Employed an ensemble of gradient-boosting classifiers (XGBoost, LightGBM, CatBoost) for classification.
• Applied Synthetic Minority Oversampling Technique (SMOTE) and focal loss to address class imbalance.

Main Results:

• Achieved 79.8% average cross-validation accuracy and 75.67% overall test accuracy in the baseline configuration.
• Improved minority attack-class recall from 1.43% to 64.3% and PR-AUC from 0.2884 to 0.791 after imbalance mitigation.
• Obtained an ROC-AUC of 0.928 for both classes in the balanced configuration, demonstrating effective minority class detection.

Conclusions:

• The integrated framework shows significant potential for developing effective, scalable, and interpretable intrusion detection systems.
• Strategic combination of temporal modeling, attention mechanisms, and ensemble diversity is crucial for smart grid security.
• Targeted imbalance mitigation techniques are vital for improving the detection of low-frequency cyberattacks.