Detection of disturbances and cyber-attacks in smart grids using explainable machine learning.

Area of Science:

• Electrical Engineering
• Computer Science
• Cybersecurity

Background:

• Modern power systems face escalating risks from natural disruptions and sophisticated cyberattacks.
• Existing detection methods inadequately address the interconnected nature of physical failures and cyber intrusions.
• The need for robust, unified detection strategies is critical for grid stability and security.

Purpose of the Study:

• To develop a heterogeneous, data-driven framework for unified disturbance and intrusion detection in power systems.
• To leverage time-synchronized measurements for enhanced detection capabilities.
• To improve the trustworthiness and decision-making in high-stakes power grid operations.

Main Methods:

• Utilized time-synchronized measurements for unified detection.
• Implemented advanced pre-processing and multi-strategy feature selection.
• Employed ensemble machine learning models optimized with Optuna.
• Applied permutation SHAP for enhanced model explainability and feature contribution insights.

Main Results:

• The proposed framework demonstrated superior performance across 37 event scenarios in binary, three-class, and multi-class settings.
• Achieved precision, recall, F1-score, accuracy, and specificity exceeding 96% with optimal models.
• Attained an average performance exceeding 93% across aggregated datasets.
• Provided interpretable insights into feature contributions for threat detection.

Conclusions:

• The framework offers an effective and practical solution for improving smart grid awareness and resilience.
• It presents a scalable and interpretable approach to counter evolving cyber-physical threats.
• The unified detection strategy significantly enhances the security and stability of modern power systems.