PaperlayerView exact revision on arXiv

Source-linked AI summary

Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks

Damilola Popoola, Souradeep Bhattacharya, Manimaran Govindarasu

arXiv:2609.12305v1cs.CRcs.AIcs.LG

TL;DR

Opaque anomaly-detection models make it difficult for SOC analysts to interpret and trust security decisions, and explanations alone may not verify model reasoning. ExCYDER combines LightGBM decision rules with SHAP attributions to check their consistency. It reports high detection performance alongside measured verification consistency and per-alert SHAP latency.

  • Problem

    Black-box anomaly-detection models limit SOC analysts’ ability to interpret security decisions, and post-hoc explanations may not align with model behavior.

    Source: §I · p. 1

  • Method

    ExCYDER combines LightGBM decision rules with SHAP feature attributions and checks their alignment for each aggregated alert.

    Source: C. Cloud-Level Verification · p. 3

  • Results

    LightGBM achieved more than 99 percent Precision, Recall, and F1 score with a 0.51 percent False Negative Rate; average rule–SHAP consistency was 44.6%, and SHAP computation took 14.5 ms per alert.

    Source: C. Results and Discussion · pp. 4–5

  • Takeaways & Limitations

    The authors report that consistency-driven verification distinguishes coherent from inconsistent alerts while preserving classifier reliability and supporting transparent, audit-ready SOC triage.

    Source: C. Results and Discussion · p. 5, §V · p. 5

    Evaluation of real-time performance, latency, and scalability in operational DER networks under production conditions remains future work.

    Source: §I · p. 1, §V · p. 5

Abstract

from arXiv · show

The rapid growth of Distributed Energy Resources (DERs) has significantly expanded the cyber attack surface of modern power grids. Furthermore, increasing sophistication in attack techniques demands anomaly detection systems (ADS) that are accurate, interpretable, and reliable to support DER cybersecurity. While ML-based ADS provide strong detection capabilities, their black-box nature reduces operator trust and limits Security Operation Center's (SOC) ability to effectively interpret alerts and respond, highlighting the need for explainable Artificial Intelligence (XAI) to ensure transparency and operational confidence. This paper presents an XAI-based anomaly detection framework tailored for DER networks (ExCYDER). The proposed framework uses a self-verifying mechanism that validates ADS alerts to ensure trustworthy decision-making. ExCYDER combines LightGBM with SHAP to check whether each model decision aligns with its feature-attribution evidence, allowing the system to confirm that its internal reasoning is consistent and reliable. Experiments on a realistic DNP3 dataset achieved over 98% detection accuracy, an average rule--SHAP consistency of 44.6%, a SHAP latency of 14.5 ms per alert, and a confidence deviation within 5%, demonstrating stable verification behavior with minimal computational overhead. The framework distinguished between coherent and inconsistent alerts without compromising detection accuracy, demonstrating that integrated verification within XAI-based ADS enhances interpretability, auditability, and operational robustness for DER-focused SOCs.

I. INTRODUCTION

DER growth expands the attack surface of power grids, while opaque anomaly-detection models leave SOC analysts without clear, justifiable explanations. ExCYDER addresses this gap with explainability-driven verification and a testbed evaluation on realistic DER datasets.

I. INTRODUCTION

  • DER interconnection expands the attack surface and introduces cybersecurity challenges for critical energy infrastructure.The paper identifies traditional fixed, perimeter-based defenses as increasingly ineffective against adaptive cyber threats.Source: §I · p. 1
  • Black-box anomaly-detection models create a trust deficit because SOC analysts need clear, justifiable explanations for security decisions.Source: §I · p. 1
  • ExCYDER combines ensemble-based anomaly detection with explainability-driven rule–feature consistency checks to support transparent, auditable SOC investigations.The framework is evaluated in a real-time testbed using realistic DER datasets.Source: §I · p. 1

II. BACKGROUND ON DER CYBERSECURITY

The described DER communication architecture has three tiers, with edge devices hosting anomaly detection and telemetry exchange. ExCYDER’s workflow moves from edge detection and alert aggregation to cloud verification and visualization.

II. BACKGROUND ON DER CYBERSECURITY

  • The DER architecture comprises DER clients and devices, an edge intelligence layer, and a utility and aggregator layer.The utility and aggregator layer coordinates distributed assets through the DER Management System.Source: A. DER Communication Architecture · p. 1
  • ExCYDER’s workflow moves from edge-based anomaly detection and alert aggregation to cloud-level verification, correlation, and visualization.Source: Figure 1 · p. 2
  • Protocols including DNP3, Modbus, IEC 61850, and IEEE 2030.5 support interoperability but have weak or absent authentication and encryption.Source: A. DER Communication Architecture · p. 2

B. Cybersecurity Challenges

DER protocols and interconnected assets face cybersecurity threats, while opaque or post-hoc-only anomaly-detection approaches leave SOC analysts without sufficiently reliable explanations. The related work motivates verification of explanation consistency alongside detection and interpretability.

B. Cybersecurity Challenges

  • DER interconnection and protocols without built-in cryptographic safeguards expose devices to replay, spoofing, denial-of-service, and data-manipulation threats.Fragmented alerts and opaque ML models hinder timely detection and verification within SOCs.Source: B. Cybersecurity Challenges · p. 2

C. Need for Explainability in ML based Anomaly Detection

D. Related Work

  • Traditional statistical and threshold-based approaches often struggle with modern DER data streams, while ML and DL methods can identify subtle attack patterns.Source: D. Related Work · p. 2
  • Energy-system XAI methods such as LIME and SHAP support transparency and debugging, but cited applications do not verify internal reasoning consistency.The text identifies this gap as limiting rapid, reliable interpretation in SOC environments.Source: D. Related Work · p. 2

III. PROPOSED METHODOLOGY

ExCYDER is designed for DER-specific SOC operations and combines ensemble-based anomaly detection with self-verifying explainability. Its edge-cloud workflow separates near-device alert generation from cloud aggregation, verification, and visualization.

III. PROPOSED METHODOLOGY

  • ExCYDER integrates ensemble-based anomaly detection with a self-verifying explainability mechanism that validates model decisions through consistency analysis.Source: §III · pp. 2–3
  • The edge intelligence layer performs real-time anomaly detection and alert generation near DER devices.Source: §III · p. 3
  • The cloud intelligence layer aggregates, verifies, and visualizes alerts to support analyst interpretation and situational intelligence.Source: §III · p. 3

A. ML Based Anomaly Detection

ExCYDER adopts an ML anomaly-detection pipeline and combines LightGBM decision rules with SHAP attributions to assess whether explanations align with model logic.

A. ML Based Anomaly Detection

  • The ML-based ADS preprocesses data through label encoding, feature selection, Min–Max normalization, and SMOTE balancing before a 70%/30% training-test split.Source: A. ML Based Anomaly Detection · p. 3

B. Model Explainability using SHAP and Decision Rules

C. Cloud-Level Verification

At the cloud layer, ExCYDER cross-checks model decision paths against SHAP attributions and assigns each alert a consistency score. A threshold determines whether alerts are verified or sent for analyst review.

  • Each aggregated alert is checked by comparing the model’s rule-based decision path with its corresponding SHAP feature attributions.Source: C. Cloud-Level Verification · p. 3
  • The consistency metric combines Overlap, Direction, and Coverage to measure agreement between decision rules and SHAP attributions.Overlap measures shared features, Direction checks whether SHAP contributions follow rule-inequality trends, and Coverage quantifies SHAP importance explained by shared features.Source: C. Cloud-Level Verification · p. 3
  • Rule extraction, SHAP attribution, consistency computation, and confidence blending precede threshold-based alert labeling.Alerts meeting threshold θ are labeled verified; others are flagged for additional analyst review.Source: C. Cloud-Level Verification · p. 3

IV. EXPERIMENTAL EVALUATION

The evaluation setup simulated DER communications across virtual devices, edge inference, and cloud verification, with alert batches presented on an SOC dashboard.

A. Experimental Setup

  • Three virtual DER devices replayed labeled DNP3 traffic in real time to ExCYDER’s edge anomaly-detection module.The setup used Python 3.13 on an Apple M4 system with 16 GB RAM and macOS 15.5.Source: A. Experimental Setup · p. 3
  • The edge layer performed local inference and sent aggregated alerts as JSON batches to the cloud every 60 seconds.The cloud processed each batch on the same interval for verification and visualization.Source: A. Experimental Setup · p. 3
  • The SOC dashboard displayed verified alerts with classifications, adjusted confidence values, and consistency scores.Source: A. Experimental Setup · p. 3

B. DER Dataset

The study uses a labeled DNP3 dataset collected in a DER network environment, covering normal traffic and five representative attack classes.

  • The Iowa State University DER DNP3 dataset provides labeled communication records collected from a DER network environment.Source: B. DER Dataset · p. 4
  • Its six traffic classes are Benign Traffic, Denial of Service, Remote Terminal Attack, Scanning Attack, DNP3 Stealthy Attack, and Replay Attack.Source: B. DER Dataset · p. 4
  • The labels distinguish routine behavior from malicious activity for supervised training and evaluation of the anomaly-detection system.Source: B. DER Dataset · p. 4

C. Results and Discussion

LightGBM detection, SHAP-based explanation, alert verification, and runtime measurements were evaluated in a simulated DER communication setting. The results report high classifier performance alongside moderate rule–SHAP alignment and bounded verification overhead.

C. Results and Discussion

  • The evaluation simulated 250 DER communication samples over 7 minutes, including 121 malicious events across DNP3 Stealthy, DoS, and Replay scenarios.The samples were aggregated into seven JSON batches using a 60-second edge batching interval.Source: C. Results and Discussion · p. 4
  • Fig. 4 identifies FWD Init Win Bytes, Dst Port, and Bwd Packets/s as influential features; its DoS path illustrates thresholds leading to classification.The authors interpret these patterns as meaningful traffic behaviors rather than spurious correlations.Source: Figure 4 · p. 4, C. Results and Discussion · p. 5
  • More than 99 percent Precision, Recall, and F1 score, with a 0.51 percent False Negative Rate, were reported for LightGBM.LightGBM was adopted as ExCYDER’s operational anomaly detector.Source: C. Results and Discussion · pp. 4–5
  • 44.6% average consistency accompanied a 54.5% verification success rate; 45.5% of alerts below the 50% threshold were filtered, confidence deviation stayed within ±5%, and SHAP took 14.5 ms per alert.The authors describe the average alignment as moderate and the computation time as feasible for near-real-time SOC contexts.Source: C. Results and Discussion · p. 5
  • Average ingest latency stayed below 10 s, CPU utilization below 70%, and resident memory below 900 MB during runtime; reruns synchronized with the 60-second aggregation cycle.The authors report no performance degradation during continuous SOC operation.Source: C. Results and Discussion · p. 5

V. CONCLUSION

ExCYDER integrates high-accuracy ML detection with interpretable, verifiable reasoning for DER-focused SOC environments. The authors conclude that this supports audit-ready intelligence and transparent triage, while identifying operational deployment and operator-integrated interfaces as future work.

V. CONCLUSION

  • ExCYDER combines rule-based reasoning, SHAP feature attribution, and consistency-driven verification to integrate ML detection with interpretable and verifiable reasoning for DER-focused SOCs.The conclusion characterizes the resulting intelligence as actionable and audit-ready.Source: §V · p. 5
  • The internal validation mechanism reduces redundant or low-confidence alerts and supports transparent triage and analyst trust in automated decision support.Source: §V · p. 5
  • Future work includes real-time deployment in operational DER networks and interactive interfaces integrating operator expertise with AI-driven insights.The proposed deployment evaluation would examine performance, latency, and scalability under production conditions.Source: §V · p. 5
Loading 2609.12305v1…