Power grid cyber-physical security requires intrusion detection methods that account for the operational consequences of detection errors. Existing intrusion detection approaches primarily focus on the predictive performance of learning algorithms, while downstream operational costs are often optimized independently, which can lead to inferior operational performance. To address this, a novel optimization-learning cyber-physical-risk-informed framework communicates iteratively to minimize power grid operational costs. The framework translates machine learning prediction errors into power grid operational cyber-physical-risk costs. Experimental results on two power grid operation datasets, Industrial Control System Cyber Attack and Sherlock, show that the proposed approach improves power grid operation costs compared with the traditional approach.

Problem statement and motivation

Modern power systems have evolved into highly interconnected smart grids that integrate communication, automation, distributed energy resources, and real-time monitoring. This digitalization improves operational efficiency, reliability, and energy management capabilities, but also introduces security challenges because power grid operation increasingly depends on communication networks and cyber-physical interactions. Cyber-physical attacks targeting this information flow can compromise operational measurements and potentially affect subsequent power grid decisions. Among these threats, false data injection attacks are a major cybersecurity risk in modern smart grids, because operational decisions rely on accurate state estimation and real-time measurements.

Existing intrusion detection systems based on machine learning can identify complex attack patterns and abnormal behaviors in cyber-physical environments. However, many such approaches primarily optimize predictive metrics such as accuracy, recall, precision, and F1-score without considering the downstream operational cost of prediction errors on power system decision-making. This predict-then-optimize pipeline can produce decisions that are suboptimal from an operational perspective, even when the intrusion detector appears effective according to standard metrics.

Significant research has been conducted on resilient economic dispatch, robust optimization, and secure operational planning under attacks and uncertain operating conditions. Integrity and false data injection attacks can destabilize dispatch decisions and disrupt electricity market operation. Robust optimization approaches have been proposed to improve reliability and robustness in power systems. However, existing studies have investigated cyber-physical attack detection and resilient economic dispatch, with comparatively less emphasis on how detection errors translate into operational cost.

Decision-focused learning framework

The proposed framework integrates machine learning-based intrusion detection with power grid operational optimization by transforming intrusion detection misclassification outcomes into generator-level cyber-physical-risk costs that guide power grid operational planning. Unlike traditional intrusion detection systems that primarily evaluate predictive performance, the proposed framework incorporates asymmetric misclassification penalties to represent the different operational consequences of false positives and false negatives within the power grid optimization.

The framework iteratively updates feature weights using the logistic regression coefficients learned in the previous iteration. At each iteration, the training feature matrix is transformed using the feature weights obtained from the previous intrusion detection model, the intrusion detection model is retrained using the transformed feature matrix, and generator-level cyber-physical-risk costs are recomputed from the updated predictions. These costs are then incorporated into the dispatch optimization problem, which minimizes total operational cost while accounting for potential cyber-physical-security risks associated with individual generators.

Key technical components include:

  • Misclassification cost formulation that assigns different penalties to false-positive and false-negative outcomes, with configurations assigning a larger penalty to false negatives to represent the potentially greater operational consequences of undetected attacks
  • Generator-level cyber-physical-risk aggregation that links intrusion detection outcomes to individual generators through scenario-to-generator mapping, enabling sample-level misclassification penalties to be aggregated into generator-level misclassification costs
  • Normalization of aggregated costs across generators to obtain comparable cyber-physical-risk contributions
  • Cyber-physical-risk cost integration that transforms normalized risk contributions into generator-level costs incorporated into the dispatch optimization model
  • Iterative feature-reweighting learning process that uses logistic regression coefficients from the previous iteration as feature weights for subsequent intrusion detection retraining

Experimental evaluation

The proposed framework was evaluated on two benchmark cyber-physical power-system datasets. The ICS Power System Dataset comprises 78,377 samples with 128 input features. The Sherlock 01-Basic dataset contains 43,204 samples with 470 state features representing grid measurements and states with binary attack labels.

Intrusion detection performance was measured using the F1-score, which provides a balanced assessment of precision and recall under class-imbalanced conditions. Operational performance was evaluated using the total dispatch cost obtained from the cyber-physical-risk-aware optimization model, incorporating generation, transmission, and cyber-physical-risk-adjusted operating costs.

Hyperparameter tuning was conducted for three parameters: the cyber-physical-risk scaling factor (α), the false-positive cost (CFFP), and the false-negative cost (CFFN). An exhaustive grid search was performed over predefined candidate values, and each parameter configuration was evaluated using 100 framework iterations. The configuration yielding the minimum operational dispatch cost was selected as the final setting.

Results on the ICS dataset show that maximum cost improvement increased from 0.00046% at α=1 to 0.19983% at α=50,000, though additional gains became limited beyond α=5,000. Results on the Sherlock dataset show that maximum cost improvement increased from 0.00076% at α=1 to 0.07376% at α=100, with no observed improvement for α≥1,000 across evaluated false-positive/false-negative configurations. These differences indicate that the operational effect of cyber-risk scaling is dataset-dependent and may be influenced by the distribution of misclassification risk across generators and its interaction with dispatch constraints.

The model baseline, which performs intrusion detection and cyber-physical-risk cost computation economic dispatch without iterative feature reweighting, was assessed by comparing the F1-score and operational dispatch cost to the proposed cyber-physical-risk-informed optimization-learning framework. The proposed approach demonstrated improved power grid operation costs compared with the traditional approach on both datasets.

Limitations and trade-offs

The effect of the framework on operational cost depends on the dataset and parameter configuration, with lower operational costs observed for selected configurations relative to their corresponding baselines. The hyperparameter sensitivity analysis demonstrated different responses to the cyber-physical-risk scaling factor across the two datasets. The two benchmarks differ in system structure, feature representation, and generator-level sample assignment, which may contribute to the different sensitivity patterns observed in the experiments. F1-score provides a complementary measure of intrusion detection performance, but the primary objective of the framework is operational cost reduction.

Future work will investigate the proposed framework using larger power-system benchmarks, additional intrusion detection models, and additional operational constraints to further evaluate cyber-physical-risk-aware power grid operation.

Practical implications

The proposed framework demonstrates that integrating intrusion detection with operational optimization through iterative feature reweighting can produce lower operational dispatch costs than the corresponding baseline for selected parameter configurations. Power grid operators can use the selected hyperparameter configurations for decision making. The approach provides a method for translating machine learning prediction errors into actionable operational risk costs, enabling more informed dispatch decisions that account for cyber-physical security considerations.