Data-centric Cyber-attack Detection in Community Microgrids Using ML Techniques

Abstract

This article proposes a data-centric strategy that emphasises data preprocessing, interpretation of machine learning models' performance, improving data quality and modifying models to deal with issues identified during the iterative loop of classification model development. The framework consists of three stages: stage-1 focuses on data collection and pre-processing, followed by data quality improvement and feature extraction in stage-2, and the final stage-3 with model hyper-parameter tuning. The concept of model interpretation is added within the framework that helps to understand the learning behaviour of machine learning (ML) models. This makes the models' performance more explainable and is known as Explainable Artificial Intelligence (XAI). For stage-1, the data is generated from a simulation of cyber-attacks in CIGRE low voltage microgrid network, which is then preprocessed. In stage-2, data is augmented using ensembled Synthetic Minority Over-sampling Technique (SMOTE) and Edited Nearest Neighbour (ENN) methods, followed by feature extraction using the Boruta python package. Finally, the hyper-parameters are tuned through a Tree-structured Parzen Estimator (TPE) algorithm. A time-series transformer model is also presented for cyber-attack detection. The findings from the proposed approach demonstrate that the model's predictive performance increases with subsequent stages.