Cyberattack Detection and Classification Using New Custom Filter Design and Explainable-Deep Learning in Cyber-Physical Systems

This paper presents a novel explainable Intrusion Detection System (IDS), for the detection and classification of attacks in cyber-physical systems (CPS). The presented approach uses only cyber data to detect attacks at the cyber layer before they reach the physical layer, thus preventing physical damage to the grid's assets. To enhance the attack's feature representation in both time and frequency simultaneously, a set of new wavelet filters are designed and integrated with the dual-tree complex wavelet transform (DT-CWT). This enables the vectorized representation of attack features instead of only the scalar representation as in the case of real transforms, which results in information loss. Furthermore, to address the lack of interpretability of existing IDS methods, this work integrates eXplainable Artificial Intelligence (XAI) with Convolutional Neural Networks (CNN) to highlight the important regions in the time-frequency spectrograms that influence the attack classifications' decisions. This makes the model used transparent and more trustworthy. Using the XAI explanations, a new feature analysis technique, namely the XAI-Multiple Attribute Analysis Technique (XAI-MAAT), is proposed to numerically quantify the important features used for classification. The proposed approach has been tested in real-time using OPAL-RT on two IEEE test systems and the results have shown that it can achieve a detection accuracy of up to 99.54%, an increase of up to 60.93% over existing methods. The novel XAI-MAAT technique reveals that the time between sequential messages and the message status numbers are the most important features to classify the attacks at the cyber layer.