Empirical Evaluation of Unsupervised Anomaly Detection Paradigms for Smart Grid Cybersecurity Across Multiple Attack Scenarios

The increasing digitization of power grid infrastructure has introduced cybersecurity vulnerabilities requiring robust anomaly detection mechanisms.This study presents a large-scale empirical evaluation framework for characterizing the behavior of six unsupervised anomaly detection paradigms under diverse smart grid attack scenarios.The evaluation encompasses self-supervised contrastive learning with temporal convolutional encoders alongside established methods including Isolation Forest, One-Class Support Vector Machine, Autoencoder, Deep Support Vector Data Description, and Local Outlier Factor.Experiments were conducted across two complementary datasets comprising over 2.1 million power consumption records representing both synthetic perturbations and realistic attack scenarios with seven distinct threat types.Rather than identifying a universally optimal method, this study characterizes scenariodependent performance patterns and operational trade-offs.Results demonstrate that all evaluated paradigms achieve Area Under the Receiver Operating Characteristic Curve values exceeding 0.90 on realistic attack scenarios, with F1 scores ranging from 0.637 to 0.806 depending on method and attack characteristics.The contrastive learning paradigm achieved F1 scores of 0.449 and 0.786 on synthetic and realistic scenarios respectively.An ablation study examining temporal augmentation strategies revealed marginal performance variations, suggesting that the learning objective rather than augmentation design drives representation quality.These findings establish reproducible benchmarks, characterize the strengths and limitations of each paradigm under different deployment conditions, and provide practical guidance for selecting anomaly detection approaches based on specific operational requirements rather than aggregate performance metrics.