Self-verifying anomaly detection improves cybersecurity of energy networks
Self-Verifying Anomaly Detection using Explainable AI for Cybersecurity of DER Networks
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
The rise of distributed energy systems, like solar panels and batteries, has made power grids more vulnerable to cyberattacks. Machine learning tools can spot unusual activity but are often hard for human operators to trust or understand. The authors created a new system called ExCYDER that not only detects attacks accurately but also explains and verifies its own decisions. This makes it easier for security teams to trust alerts and respond effectively. Tests showed ExCYDER works well with low delay and high reliability.
What this means in practice
- •For energy grid security teams: Detect and verify cyberattacks on distributed energy resources with clear explanations to support incident response.
- •For industrial control system operators: Monitor industrial network anomalies using explainable models with integrated alert verification to improve trust and auditability.
Authors
Damilola Popoola, Souradeep Bhattacharya, Manimaran Govindarasu
Abstract
The rapid growth of Distributed Energy Resources (DERs) has significantly expanded the cyber attack surface of modern power grids. Furthermore, increasing sophistication in attack techniques demands anomaly detection systems (ADS) that are accurate, interpretable, and reliable to support DER cybersecurity. While ML-based ADS provide strong detection capabilities, their black-box nature reduces operator trust and limits Security Operation Center's (SOC) ability to effectively interpret alerts and respond, highlighting the need for explainable Artificial Intelligence (XAI) to ensure transparency and operational confidence. This paper presents an XAI-based anomaly detection framework tailored for DER networks (ExCYDER). The proposed framework uses a self-verifying mechanism that validates ADS alerts to ensure trustworthy decision-making. ExCYDER combines LightGBM with SHAP to check whether each model decision aligns with its feature-attribution evidence, allowing the system to confirm that its internal reasoning is consistent and reliable. Experiments on a realistic DNP3 dataset achieved over 98% detection accuracy, an average rule--SHAP consistency of 44.6%, a SHAP latency of 14.5 ms per alert, and a confidence deviation within 5%, demonstrating stable verification behavior with minimal computational overhead. The framework distinguished between coherent and inconsistent alerts without compromising detection accuracy, demonstrating that integrated verification within XAI-based ADS enhances interpretability, auditability, and operational robustness for DER-focused SOCs.