Cyber-Physical Anomaly Detection in IoT-Enabled Smart Grids Using Machine Learning and Metaheuristic Feature Optimization

2026-05-21 · Source: Machine Learning · Field: Energy & Utilities — Artificial Intelligence & Machine Learning, Cybersecurity & Data Privacy, Energy Storage & Grid Technology · Depth: Expert, quick

Summary

A new method for cyber-physical anomaly detection in IoT-enabled smart grids combines machine learning with genetic-algorithm-based feature selection. Investigating the MSU/ORNL Power System Attack Dataset, the approach aims to accurately classify malicious actions versus natural physical incidents and determine if a reduced set of PMU/IED measurements can support reliable detection. Baseline models, including logistic regression, RBF-SVM, XGBoost, Random Forest, and Extra Trees, were evaluated. Tree-based ensemble models proved most effective, with Extra Trees performing best as a full-feature baseline. The GA + Extra Trees model significantly reduced the clean PMU feature space from 112 attributes to an average of 27.4 attributes over five runs. This reduction simultaneously improved macro-F1 from 0.9118 to 0.9212 and ROC-AUC from 0.9791 to 0.9837, indicating redundancy in synchronized electrical measurements. A compact subset of phasor-based features can provide accurate and interpretable anomaly detection.

Key takeaway

For AI Security Engineers designing anomaly detection systems for smart grids, prioritize feature optimization to enhance system efficiency and accuracy. Your models can achieve higher macro-F1 and ROC-AUC scores with significantly fewer PMU attributes, reducing computational load. Consider implementing genetic algorithms with tree-based ensemble models like Extra Trees to identify critical phasor-based features, ensuring both robust detection and system interpretability. This approach streamlines data processing while improving detection reliability against cyber-physical threats.

Key insights

Optimized feature selection significantly enhances cyber-physical anomaly detection in smart grids, reducing data redundancy while improving accuracy.

Principles

• Many synchronized electrical measurements are redundant.
• Tree-based ensemble models excel in anomaly detection.
• Feature optimization improves model performance and interpretability.

Method

The method combines machine learning with genetic-algorithm-based feature selection to classify cyber-physical attacks and natural events in smart grids, using a reduced set of PMU/IED measurements.

In practice

• Apply GA for PMU feature space reduction.
• Prioritize Extra Trees for smart grid anomaly detection.
• Focus on phasor-based features for interpretability.

Topics

• Cyber-Physical Security
• Smart Grids
• Anomaly Detection
• Machine Learning
• Feature Optimization
• Genetic Algorithms
• Extra Trees Model

Best for: AI Scientist, Research Scientist, AI Security Engineer

Related on AIssential

• Improving IoT Intrusion Detection Through SMOTE-Based Oversampling and Extended Multi-Model Evaluation on Side-Channel Power Data — SMOTE-based oversampling and multi-model evaluation significantly enhance IoT intrusion detection, especially for minority attack classes.
• Conditional anomaly detection with soft harmonic functions — A new non-parametric method uses soft harmonic functions to detect conditional anomalies and mislabeling.
• Pseudo-Feature Padding: A Lightweight Defense Against False Data Injection in Power Grids — Pseudo-Feature Padding defends DNNs in CPS against FDIA by randomizing input dimensionality, making adversarial attacks computationally infeasible.
• Shapley Value-Guided Adaptive Ensemble Learning for Explainable Financial Fraud Detection with U.S. Regulatory Compliance Validation — Explainable AI models can achieve high fraud detection accuracy while meeting stringent U.S. financial regulations.
• Multi-population Diversity-guided Genetic Algorithm for Feature Selection in Network Intrusion Detection — MPDGGA improves NIDS feature selection by combining multi-population evolution with diversity-guided operators for better accuracy and feature compactness.
• Information Leakage Detection through Approximate Bayes-optimal Prediction — A new framework detects information leakage by approximating Bayes-optimal prediction to estimate mutual information.

Open in AIssential →

Editorial summary, takeaway, and curation by AIssential. Original article published by Machine Learning.