PaperlayerView exact revision on arXiv

Source-linked AI summary

Decision-Focused Learning for Cyber-Physical Risk-Aware Power Grid Operations

Ayesha Siddiqua Dina, Ebisa D. Wollega, Afzal Hossain Sohag

arXiv:2610.13853v1cs.CR

TL;DR

Intrusion-detection methods for power grids often emphasize predictive performance without accounting for the operational cost of detection errors. This paper integrates detection with power-grid optimization by converting misclassification outcomes into generator-level risk costs and iteratively reweighting features. Experiments on ICS and Sherlock report operational-cost improvements whose scaling patterns differ by dataset.

  • Problem

    Many intrusion-detection approaches optimize predictive metrics without considering the downstream operational cost of prediction errors.

    Source: §I · p. 1

  • Method

    The framework converts intrusion-detection misclassification outcomes into generator-level cyber-physical-risk costs for dispatch and iteratively reweights features using learned intrusion-detection parameters.

    Source: §I · p. 2

  • Results

    Across ICS and Sherlock, operational-cost improvement patterns depended on the dataset; the maximum ICS improvement rose from 0.00046% at α = 1 to 0.19983% at α = 50,000, while Sherlock showed no observed improvement for α ≥ 1,000.

    Source: B. ICS Dataset Results · p. 5, C. Sherlock Dataset Results · p. 5, D. Discussion · p. 6

  • Takeaways & Limitations

    The reported operational effect of cyber-risk scaling is dataset-dependent and may reflect how misclassification risk across generators interacts with dispatch constraints.

    Source: D. Discussion · p. 6

Abstract

from arXiv · show

Power grid cyber-physical security requires intrusion detection methods that account for the operational consequences of detection errors. However, the existing intrusion detection approaches primarily focus on the predictive performance of learning algorithms, while downstream operational costs are often optimized independently, which can lead to inferior operational performance. To help alleviate this problem, we propose a novel optimization-learning cyber-physical-risk-informed framework that communicates iteratively to minimize power grid operational costs. This framework translates machine learning prediction errors into power grid operational cyber-physical-risk costs. Experimental results on two power grid operation datasets, Industrial Control System (ICS) Cyber Attack and Sherlock, show that the proposed approach improves power grid operation costs compared with the traditional approach.

I. INTRODUCTION

Power-grid intrusion detection has largely emphasized predictive metrics, while comparatively less attention has been paid to how detection errors translate into operational costs. This paper proposes an optimization-informed framework that maps misclassification outcomes to generator-level cyber-physical-risk costs and iteratively reweights features.

I. INTRODUCTION

  • Many intrusion-detection approaches optimize predictive metrics without considering the downstream operational cost of prediction errors.Prior work has also placed comparatively less emphasis on how detection errors translate into operational cost –.Source: §I · p. 1
  • The framework incorporates asymmetric false-positive and false-negative penalties as generator-level cyber-physical-risk costs in power-grid operational planning.The penalties represent different operational consequences of the two error types.Source: §I · p. 2
  • An iterative feature-reweighting mechanism uses learned intrusion-detection parameters to update the feature representation for subsequent retraining.The framework integrates intrusion detection with power-grid operational optimization.Source: §I · p. 2
  • The evaluation examines detection performance and operational cost on two benchmark datasets with different grid topologies and attack scenarios.Source: §I · p. 2

II. PROBLEM FORMULATION

The formulation links cyber-physical risk and conventional generation costs to power allocation decisions, then assigns penalties to intrusion-detection errors. False-positive and false-negative costs can differ, including configurations with larger penalties for false negatives.

A. Power System Model

  • The operational model jointly considers conventional generation costs and cyber-physical security risk in dispatch decisions.It integrates intrusion detection with operational optimization to incorporate risk information into dispatch.Source: A. Power System Model · p. 2
  • Measurements pass from the physical system through communication and control infrastructure, while control commands return to the physical layer.Attacks on this information flow can compromise measurements and potentially affect subsequent grid decisions.Source: A. Power System Model · p. 2
  • The power allocation decision variable x_ij represents power supplied from generator i to load j.Source: A. Power System Model · p. 2
  • Generator operating costs and generator-to-load transmission costs are adjusted by cyber-physical risk before operational optimization.The adjusted generator costs are incorporated into the operational optimization model.Source: A. Power System Model · p. 2

B. Misclassification Cost Formulation

  • The formulation assigns operational penalties to false-positive and false-negative intrusion-detection outcomes.Undetected compromises may propagate into subsequent operational decisions,.Source: B. Misclassification Cost Formulation · p. 2
  • Different penalties apply to the possible misclassification outcomes defined by each sample’s true and predicted labels.Source: B. Misclassification Cost Formulation · p. 2
  • The framework allows asymmetric misclassification costs, including configurations that assign larger penalties to false negatives.The larger false-negative penalty represents the potentially greater operational consequences of undetected attacks.Source: B. Misclassification Cost Formulation · p. 2

C. Generator-Level Cyber-physical-Risk Aggregation

The aggregation procedure maps sample-level intrusion-detection errors to generators, totals their penalties, and normalizes the resulting generator-level costs for use in risk-adjusted operations.

C. Generator-Level Cyber-physical-Risk Aggregation

D. Cyber-Risk Cost Integration

The framework converts normalized generator-level cyber-physical risk into costs for dispatch optimization. It computes baseline costs before iteration, then updates generator costs as intrusion detection is retrained and risk estimates change.

D. Cyber-Risk Cost Integration

  • Normalized generator-level cyber-physical risk is converted into a risk cost for the operational optimization model.The scaling parameter α controls the influence of cyber-physical risk on optimization.Source: D. Cyber-Risk Cost Integration · p. 3
  • Before iteration, a baseline Logistic Regression model supplies F1-score and coefficients used to identify false positives and false negatives and compute generator-level risk costs.The baseline operating cost serves as the reference for evaluating operational-cost changes.Source: D. Cyber-Risk Cost Integration · p. 3
  • At each iteration, the IDS is retrained with feature weights from the preceding iteration to produce updated predictions and generator-level risk estimates.Those updated estimates are used to update generator operating costs.Source: D. Cyber-Risk Cost Integration · p. 3
  • Updated generator costs combine the original generator operating cost with the cyber-physical-risk penalty, raising effective costs for generators with higher penalties.The resulting costs are incorporated into the power grid operational optimization model.Source: D. Cyber-Risk Cost Integration · p. 3

E. Cyber-Risk-Aware Dispatch Optimization

The dispatch model incorporates cyber-physical-risk-adjusted generator costs and minimizes total operational cost. Generator and transmission capacities and load demand constrain the resulting dispatch.

E. Cyber-Risk-Aware Dispatch Optimization

  • Dispatch minimizes total operational cost using generator costs augmented by cyber-physical-risk penalties derived from intrusion detection outcomes.The objective accounts for potential security risks associated with individual generators.Source: E. Cyber-Risk-Aware Dispatch… · p. 3
  • Generator capacity limits, transmission-line capacity limits, and load-demand requirements constrain the dispatch solution.The formulation identifies generator capacity, generator-to-load transmission capacity, and required demand as constraints.Source: E. Cyber-Risk-Aware Dispatch… · p. 3
  • Risk penalties assign higher costs to generators associated with greater cyber-physical risk, which can influence their dispatch subject to system constraints.Source: E. Cyber-Risk-Aware Dispatch… · p. 3

F. Iterative Feature-Reweighting Learning Process

The iterative learning process uses logistic-regression feature weights to transform training data and retrain the IDS. Its predictions update generator-level risk costs and dispatch plans, with the lowest operational cost across predefined iterations retained.

F. Iterative Feature-Reweighting Learning Process

  • The proposed framework iteratively updates feature weights using logistic-regression coefficients learned in the preceding iteration.Source: F. Iterative Feature-Reweighting… · p. 3
  • The algorithm trains a baseline IDS, computes baseline cyber-physical-risk cost and Zbaseline, then repeats IDS learning, risk-cost computation, and dispatch planning.Source: F. Iterative Feature-Reweighting… · p. 4
  • Across the predefined iterations, the algorithm retains the minimum operational cost and returns its associated power-grid operational plan.Source: F. Iterative Feature-Reweighting… · p. 4
  • The IDS is first trained to produce an initial feature-weight vector, and subsequent iterations transform the training feature matrix using the preceding iteration’s weights.The transformation is element-wise, and the IDS is retrained on the transformed matrix and training labels.Source: F. Iterative Feature-Reweighting… · p. 4
  • In the implementation, logistic-regression coefficients serve as feature weights, and the IDS is retrained at each iteration to produce updated predictions.The resulting false-positive and false-negative outcomes are used to recompute generator-level risk costs for dispatch optimization.Source: F. Iterative Feature-Reweighting… · p. 4

G. Framework Algorithm

Algorithm 1 summarizes the framework’s iterative interaction between intrusion detection, generator-level risk estimation, and risk-aware dispatch optimization. It retains the lowest operational cost across the predefined iterations.

G. Framework Algorithm

III. EXPERIMENTAL SETUP

The experiments use two power-system intrusion-detection datasets and a logistic-regression/dispatch-optimization framework. Dataset preprocessing and a 100-iteration evaluation setup are described.

A. Dataset and Preprocessing

  • The ICS dataset has 78,377 samples and 128 features; Sherlock 01-Basic has 43,204 samples and 470 state features.Both datasets use binary attack labels and training-set median imputation and standardization.Source: A. Dataset and Preprocessing · p. 4

B. Experimental Configuration

  • Logistic regression performs intrusion detection, while linear programming with Gurobi optimizes dispatch using two ICS generators and seven Sherlock generators.Generator cyber-physical-risk costs are added to operating costs before dispatch.Source: B. Experimental Configuration · p. 4
  • Each parameter configuration is evaluated for 100 framework iterations using dataset-specific generator capacities, operating costs, and load demands.Source: B. Experimental Configuration · p. 4

C. Cyber-Physical Risk Hyperparameter Selection

The evaluation selects hyperparameters by minimum dispatch cost, compares detection and operational metrics against a baseline, and examines how α affects cost across both datasets.

C. Cyber-Physical Risk Hyperparameter Selection

D. Evaluation Metrics

  • The evaluation compares F1-score and total dispatch cost with a baseline lacking iterative feature reweighting; dispatch cost includes generation, transmission, and risk-adjusted operating costs.F1-score balances precision and recall under class imbalance.Source: D. Evaluation Metrics · pp. 4–5

A. Cyber-Physical-Risk Hyperparameter Sensitivity Analysis

B. ICS Dataset Results

Cost improvements differ between the ICS and Sherlock datasets, and the conclusion reports lower costs than baseline only for selected parameter configurations. The discussion identifies dataset and parameter dependence as central qualifications.

B. ICS Dataset Results

  • Across FP/FN configurations, maximum cost improvement rose from 0.00046% at α = 1 to 0.19983% at α = 50,000 as the cyber-physical-risk scaling factor increased, with limited additional improvement beyond α = 5,000.Source: B. ICS Dataset Results · p. 5

C. Sherlock Dataset Results

D. Discussion

  • Operational-cost effects depend on dataset; differing risk distributions across generators and interactions with dispatch constraints may influence the sensitivity patterns.The benchmarks also differ in system structure, feature representation, and generator-level sample assignment.Source: D. Discussion · p. 6

V. CONCLUSION

  • The conclusion reports lower operational costs than corresponding baselines for selected configurations and identifies larger benchmarks, additional detection models, and more constraints for future evaluation.Source: §V · p. 6
Loading 2610.13853v1…