Interpretable Detector Secure Against Stealthy False Power Consumption Attacks

Machine learning (ML) anomaly detectors are commonly used to identify cyber-attacks on smart power grids because they can detect new (i.e., zero-day) attacks by classifying deviations from normal patterns as anomalies. Deeplearning-based anomaly detectors offer superior performance but are highly sensitive to the selection of threshold values for defining anomalies. Conversely, traditional (or shallow-based) detectors avoid this threshold sensitivity but often underperform, particularly when dealing with complex interdependent data. Moreover, like all ML models, these detectors are vulnerable to adversarial evasion attacks, where adversaries make small and subtle manipulations to false data to evade detection. To address these issues, we propose a robust hybrid-based anomaly detector that combines the strengths of both deep and shallow-based and is trained using explanations derived from power consumption readings rather than the raw readings themselves. This hybrid approach not only mitigates threshold sensitivity and improves performance but also enhances robustness against white-box evasion attacks. Additionally, we introduce an interpretability method using occlusion sensitivity, which helps explain how a classification decision is made for an input power consumption sample, thereby increasing trust, reliability, and understanding of various attack patterns.