On The Efficacy of Physics-Informed Context-Based Anomaly Detection for Power Systems

Hybrid operational-consistency frameworks combine rule-based consistency checks with supervised learners (e.g., decision trees, XGBoost, CNN-LSTM, DNNs), using operational rules either as a first-stage filter or as additional features to improve the robustness of data-driven classifiers.

“On the other side, hybrid frameworks combine these rule-based consistency checks with supervised learners such as decision trees, XGBoost, CNN-LSTM, and DNNs, using operational rules either as a first-stage filter or as additional features to improve the robustness of data-driven classifiers [112-114,117,118].”

Because operational-consistency-based detectors focus on physical and logical feasibility rather than specific attack signatures, they can flag previously unseen attacks that violate process interlocks, causal relationships, or power-balance constraints.

“Because they focus on physical and logical feasibility rather than on specific attack signatures, they can flag previously unseen attacks that nevertheless violate process interlocks, causal relationships, or power-balance constraints [113,114,117,118].”

The dataset distribution for operational-consistency-oriented methods shows evaluation across a relatively diverse set of CPS domains, including water-treatment testbeds (SWaT, WADI), vehicle OBD-II datasets, and power-system simulations.

“Finally, the dataset distribution shows that operational-consistency-oriented methods are evaluated across a relatively diverse set of CPS domains, including water-treatment testbeds (SWaT, WADI), vehicle OBD-II datasets, and power-system simulations [111-118].”

By checking whether actuator commands, sensor responses, and event sequences are physically feasible and logically consistent, operational-consistency-based methods can detect cyber-physical attacks and stealthy manipulations that only slightly perturb statistical patterns but induce clear inconsistencies with process and control laws (e.g., false data injection, command and control tampering, re

“By checking whether actuator commands, sensor responses, and event sequences are physically feasible and logically consistent. they can detect cyber-physical attacks and stealthy manipulations that only slightly perturb statistical patterns but induce clear inconsistencies with process and control laws-such as false data injection, command and control tampering, replay, ramp-style stealth attacks,”

Operational-consistency-based methods explicitly encode process constraints, control logic, and admissible state transitions, and treat violations of such rules as primary anomaly cues, unlike purely data-driven prediction-residual or reconstruction-error approaches.

“First, unlike purely data-driven prediction-residual or reconstruction-error approaches, these methods explicitly encode process constraints, control logic, and admissible state transitions, and treat violations of such rules as primary anomaly cues [111-118].”