Machine Learning to detect cyber-attacks and discriminating the types of power system disturbances - Random Forest model

Aug 3, 2026

Upload by Himbo

Research proposes a machine learning-based attack detection model for smart grids, using data and logs from Phasor Measuring Devices (PMUs) to learn system behaviors and identify potential security boundaries. The workflow includes dataset pre-processing, feature selection, model creation, and evaluation. Experiments use 15 datasets from different PMUs with relay Snort alarms and logs. Random Forest, Logistic Regression, and K-Nearest Neighbour are trained and assessed with metrics including F1-macro, recall, accuracy, and precision. Results show Random Forest achieves the best performance, reaching 90.56% accuracy for detecting power system disturbances, supporting operator decision-making.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages4

Reading Time10 min

AccessFree to download

Introduction

Literature review

Proposed approach

Dataset

Machine Learning to detect cyber-attacks and discriminating the types of power system disturbances Diane Tuyizere [dtuyizer@andrew.cmu.edu](dtuyizer@andrew.cmu.edu)[ ](dtuyizer@andrew.cmu.edu)Carnegie Mellon University Africa Kigali, Rwanda Remy Ihabwikuzo [rihabwik@andrew.cmu.edu](rihabwik@andrew.cmu.edu)[ ](rihabwik@andrew.cmu.edu)Carnegie Mellon University Africa Kigali, Rwanda arXiv :2307 .03323v 1 [ cs .LG] 6 Jul 2023 Abstract This research proposes a machine learning-based attack detection model for power systems, specifically targeting smart grids. By utilizing data and logs collected from Phasor Measuring Devices (PMUs), the model aims to learn system behaviors and effectively identify potential security boundaries. The proposed approach involves crucial stages including dataset pre-processing, feature selection, model creation, and evaluation. To validate our approach, we used a dataset used, consist of 15 separate datasets obtained from different PMUs, relay snort alarms and logs. Three machine learning models: Random Forest, Logistic Regression, and K-Nearest Neighbour were built and evaluated using various performance metrics. The findings indicate that the Random Forest model achieves the highest performance with an accuracy of 90.56% in detecting power system disturbances and has the potential in assisting operators in decision-making processes. Keywords: Machine Learning, Cyber-attack 1 Introduction Although Cyber-physical system has many advantages in areas such as power distribution grids and wastewater treatment plants, it also has some disadvantages and threats. A smart grid is an electrical grid equipped with automation, communication, and information technology systems that can monitor power flows from points of generation to points of consumption [1] . If these systems fail, it can result in massive damage or loss to people as well as the shutdown of all infrastructure. Nowadays, most businesses have regulations and policies in place to ensure their security. Phasor Measurement Units (PMUs) have been used to increase system performance as power systems become increasingly complex in their architecture [5] . It provides information that can help to make quick decisions. Hackers, on the other hand, can create a trigger that will cause the system to fail and cause significant damage to smart grids. Machine learning techniques can be used to find pattern recognition, learning abilities, and rapid identification of potential security boundaries [5]. This paper proposes a machine learning approach for detecting system behaviors by learning from historical data and relevant information. Mainly we present a machine learning-based attack detection model for power systems that can be taught using data and logs collected by PMUs. To accomplish this, the dataset was preprocessed, for model selection, 10-fold cross-validation was used to build a random forest, logistic regression, and k-Nearest neighbor models, and the results were compared using four performance metrics: f1 macro, recall, accuracy, and precision scores. Furthermore, feature selection was performed, and the results were compared to models without feature selection; the best model found was Random Forest, and finally, optimization of the best model was performed. The structure of this paper is as follows: Section 2 provides an overview of related research in the field. In Section 3, we detail our proposed approach by highlighting the conducted data processing, model building, testing various machine learning methods, and experimental results as well as discussing the findings. Lastly, Section 4 offers concluding remarks. 2 Literature review Smart grids, are vulnerable to cyber-attacks due to their reliance on automation, communication, and information technology systems [1] . Hackers target these systems to disrupt the power supply, cause damage, or gain unauthorized access to critical infrastructure. As highlighted [2

FAQs

What data sources are used to detect cyber-attacks in the proposed model?

The approach uses data and logs collected from Phasor Measuring Devices (PMUs), along with relay Snort alarms and related logs.

Which machine learning models are built and compared?

Random Forest, Logistic Regression, and K-Nearest Neighbour are constructed and evaluated using multiple performance metrics.

How well does the best model perform for detecting power system disturbances?

The Random Forest model achieves the highest accuracy, reaching 90.56% for detecting power system disturbances.

Aug 3, 2026

Upload by Himbo