Cyber-Physical Windowed Feature Learning for Unsupervised Anomaly Detection in Smart Grid Substations

Advances in monitoring and control technologies have made modern electric substations more efficient but also more vulnerable to cyber–physical threats. This study investigates anomaly detection by fusing network and load signatures on an automated substation testbed. Network traffic and electrical load variations were captured under three regimes: normal (no load), reasonable load (1–10 A), and overload (11–14 A) using a Chroma programmable AC electronic load device. Cyber features extracted from Common Industrial Protocol (CIP) communications were integrated with physical current measurements and aggregated into fixed temporal windows (5s, 1s, and 0.1s) to evaluate the role of granularity in anomaly detection. The performances of five unsupervised models, including Elliptic Envelope, Local Outlier Factor (LOF), One-Class SVM, MLP Autoencoder, and Isolation Forest models, were compared based on detection rate (DR), false alarm rate (FAR), accuracy, F1-score, AUROC, and AUPRC. Results indicate that window size has a great impact on detection performance, and that 1s window size offers the best compromise between sensitivity and stability. Isolation Forest consistently showed high-recall and low-false-alarm rates, while LOF and Elliptic Envelope were unstable. The above results indicate that the proposed windowed fused feature learning (WFFL) solutions, that include Isolation Forest, are effective in identifying operational anomalies using both digital and physical features.