Mitigating Missing Rate and Early Cyberattack Discrimination Using Optimal Statistical Approach with Machine Learning Techniques in a Smart Grid
Open accessAbstract
In the Industry 4.0 era of smart grids, the real-world problem of blackouts and cascading failures due to cyberattacks is a significant concern and highly challenging because the existing Intrusion Detection System (IDS) falls behind in handling missing rates, response times, and detection accuracy. Addressing this problem with an early attack detection mechanism with a reduced missing rate and decreased response time is critical. The development of an Intelligent IDS is vital to the mission-critical infrastructure of a smart grid to prevent physical sabotage and processing downtime. This paper aims to develop a robust Anomaly-based IDS using a statistical approach with a machine learning classifier to discriminate cyberattacks from natural faults and man-made events to avoid blackouts and cascading failures. The novel mechanism of a statistical approach with a machine learning (SAML) classifier based on Neighborhood Component Analysis, ExtraTrees, and AdaBoost for feature extraction, bagging, and boosting, respectively, is proposed with optimal hyperparameter tuning for the early discrimination of cyberattacks from natural faults and man-made events. The proposed model is tested using the publicly available Industrial Control Systems Cyber Attack Power System (Triple Class) dataset with a three-bus/two-line transmission system from Mississippi State University and Oak Ridge National Laboratory. Furthermore, the proposed model is evaluated for scalability and generalization using the publicly accessible IEEE 14-bus and 57-bus system datasets of False Data Injection (FDI) attacks. The test results achieved higher detection accuracy, lower missing rates, decreased false alarm rates, and reduced response time compared to the existing approaches.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
By focusing on joint behavior across multiple sensors and control channels, correlation-based detectors can better separate cyber-physical attacks (which often produce inconsistent or coordinated manipulation patterns) from natural faults (which follow typical failure correlations or fault signatures).
“By focusing on joint behavior across multiple sensors and control channels, correlation-based detectors can better separate cyber-physical attacks, which often produce inconsistent or coordinated manipulation patterns, from natural faults that follow typical failure correlations or fault signatures [91,95,96,100,101].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [101]
Split into 2 atoms — 0 confirmed, 1 partially supported, 1 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Checked by a reasoning model — may be wrong.
Experimental — accuracy not yet measuredOther sensor-correlation-based models make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations.
“while others make correlations explicit through graph structures, digital twins, energy-based physics features, or multi-instance representations [94,96,99,101,104,106,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [101]
Section 4.2 (pp. 10–12) says the paper uses neighborhood components analysis to capture relationships among power-system features, including voltage and current. That supports the general point about modeling correlations, but the paper does not describe its approach as a graph structure, digital twin, energy-based physics features, or multi-instance representation. (LLM, conf=0.82)
Experimental — accuracy not yet measuredIn several sensor-correlation-based studies, domain knowledge is encoded directly (e.g., power-flow relationships in smart grids, energy-conservation laws in manufacturing rigs) so that violations of physical consistency become a primary anomaly cue.
“In several cases, domain knowledge is encoded directly-such as power-flow relationships in smart grids or energy-conservation laws in manufacturing rigs-so that violations of physical consistency become a primary anomaly cue [99,101,107].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [101]
Split into 2 atoms — 0 confirmed, 2 partially supported, 0 disputed, 0 misattributed, 0 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measuredCorrelation-based methods are particularly suitable for attacks and faults that selectively perturb a subset of variables while keeping other measurements within nominal ranges, and for scenarios where the key symptom is a collapse or distortion of inter-sensor correlation rather than a large deviation of a single signal.
“This makes them particularly suitable for attacks and faults that selectively perturb a subset of variables while keeping other measurements within nominal ranges, as well as for scenarios where the key symptom is a collapse or distortion of inter-sensor correlation rather than a large deviation of a single signal [94,96,99-101,106-108].”
From AI-Based Anomaly Detection in Industrial Control and Cyber–Physical Systems: A Data-Type-Oriented Systematic Review (2025) · cites this paper as [101]
Split into 2 atoms — 0 confirmed, 1 partially supported, 0 disputed, 0 misattributed, 1 unverifiable. Expand the claim to see per-atom verdicts.
Experimental — accuracy not yet measured
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
The citation lists haven’t been fetched yet
References 34 · Cited by 13
Research works printed but not linked: 1
- [4]4. Hemsley, K.E; Fisher, E. History of Industrial Control System Cyber Incidents. 2018. Available online: http://doi.org/10.2172/15 05628 (accessed on 10 February 2023). · DOI
- Authors
- Murugesan, N., Velu, A. N., Palaniappan, B. S., Sukumar, B., & Hossain, M. J.
- Affiliations
- Amrita Vishwa Vidyapeetham (IN)
- Department of Computer Science and Engineering, Amrita School of Computing, Amrita Vishwa Vidyapeetham, Coimbatore 641112, India
- University of Technology Sydney (AU)
- ORCID
- Venue
- Energies
- Publisher
- MDPI AG
- Published
- 2024-04-20
- Volume
- 17
- Issue
- 8
- Pages
- 1965
- ISSN
- 1996-1073 (ISSN-L)
- OpenAlex
- W4395008427
- Cited by
- 13
- References
- 34
- Citations by year
- 2026: 1 · 2025: 8 · 2024: 4
- FWCI
- 2.04
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Energies (publishedVersion, cc-by)
- RePEc: Research Papers in Economics (submittedVersion)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion)
- Griffith Research Online (submittedVersion, cc-by)
- Funders
- Amrita Ph.D. University Scholarship for Teaching Assistant (AMRITA/CBE/CPGP/02/2024/0105)
- Topics
- Physical Sciences › Engineering › Control and Systems Engineering › Smart Grid Security and Resilience
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Engineering › Electrical and Electronic Engineering › Power System Optimization and Stability
- Keywords
- smart grid cybersecurity, intrusion detection systems, anomaly-based detection, missing rate, false data injection attacks, cascading failures, blackouts, neighborhood component analysis, extra trees, AdaBoost, hyperparameter optimization, industrial control systems, transmission systems, false alarm reduction
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
