Discrimination of Power System Disturbance and Cyber-Attacks through Machine Learning and Explainable Artificial Intelligence

This chapter explores power system disturbances and cyber-attacks using various machine learning (ML) models/algorithms. These algorithms can differentiate between natural attacks and harmful disturbances by leveraging the non-linear, intricate connections among power system measurements. To alleviate the responsibility of a power system operator in ascertaining if a disturbance stems from an intentional act, this study seeks to pinpoint the most effective ML model that is precise in classification and can provide trustworthy decision support. The framework for the power system utilized in this assessment consists of a sophisticated combination of network monitoring tools and Syslog systems. The whole work is done in a Python environment. The Extra Trees Classifier (ETC) demonstrated the best results with an Accuracy of 0.97, Precision of 0.98, Recall of 0.95, and an F1-score of 0.96. The findings support the notion that ML is a highly effective and dependable method for identifying and differentiating disturbances and attacks. The SHapley Additive exPlanations (SHAP) and Local Interpretable Model-agnostic Explanations (LIME) methods from explainable artificial intelligence (XAI) are implemented for ETC, Random Forest and Light GBM classifiers. With the LIME method, the 50th instance is predicted to have an attack with 100% confidence. This research is vital for enhancing the cybersecurity resilience of modern power systems, particularly against stealthy and sophisticated attacks.