SG-StackSecure: An intelligent and robust stacking ensemble model for smart grid intrusion detection

IF 4.6 3区工程技术 Q1 COMPUTER SCIENCE, INFORMATION SYSTEMS

International Journal of Critical Infrastructure Protection Pub Date : 2026-03-01 Epub Date: 2025-12-03 DOI:10.1016/j.ijcip.2025.100816

Muhammad Mobeen Aslam , Umar Saleem , Usman Ahmed , Weilin Li , Wenjie Liu

{"title":"SG-StackSecure: An intelligent and robust stacking ensemble model for smart grid intrusion detection","authors":"Muhammad Mobeen Aslam , Umar Saleem , Usman Ahmed , Weilin Li , Wenjie Liu","doi":"10.1016/j.ijcip.2025.100816","DOIUrl":null,"url":null,"abstract":"<div><div>The integration of advanced Information and Communication Technologies (ICTs) and Internet of Things (IoT) devices into traditional power infrastructure has significantly improved efficiency, reliability, and remote controllability. However, this integration has also introduced cybersecurity challenges, particularly in Supervisory Control and Data Acquisition (SCADA) systems. To address these emerging threats with real-time, scalable, and interpretable detection, this study presents a SG-StackSecure, a novel stacked ensemble framework for Smart Grids (SGs) intrusion detection. The framework combines Random Forest, XGBoost, and LightGBM as base learners, and Logistic Regression serving as the metaclassifier. It also used a Random Forest-based feature selection mechanism to enhance detection while reducing model dimensionality. SG-StackSecure model was trained and validated on the power system industrial control system (ICS) cyberattack datasets using 10-fold stratified cross-validation, achieving an average accuracy of 99.15% ± 0.18% and F1-scores of 0.9912 (binary classification) and 99.07% ± 0.29% and 0.9907 (three-class classification). SG-StackSecure achieves up to 8.67% higher accuracy, 96.16% reduction in feature selection time, and 89.34% reduction in training time as compared to state-of-the-art models. SG-StackSecure was also evaluated for its real-time deployment feasibility through model compression and stress testing under high-load scenarios. These results, along with a survey of SHAP and LIME for expert usability, underscore SG-StackSecure's robustness, scalability, and practical applicability for securing critical power infrastructures against evolving cyber-physical threats.</div><div>© Elsevier Inc. All rights reserved.</div></div>","PeriodicalId":49057,"journal":{"name":"International Journal of Critical Infrastructure Protection","volume":"52 ","pages":"Article 100816"},"PeriodicalIF":4.6000,"publicationDate":"2026-03-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"International Journal of Critical Infrastructure Protection","FirstCategoryId":"5","ListUrlMain":"https://www.sciencedirect.com/science/article/pii/S1874548225000770","RegionNum":3,"RegionCategory":"工程技术","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"2025/12/3 0:00:00","PubModel":"Epub","JCR":"Q1","JCRName":"COMPUTER SCIENCE, INFORMATION SYSTEMS","Score":null,"Total":0}

引用次数: 0

Abstract

The integration of advanced Information and Communication Technologies (ICTs) and Internet of Things (IoT) devices into traditional power infrastructure has significantly improved efficiency, reliability, and remote controllability. However, this integration has also introduced cybersecurity challenges, particularly in Supervisory Control and Data Acquisition (SCADA) systems. To address these emerging threats with real-time, scalable, and interpretable detection, this study presents a SG-StackSecure, a novel stacked ensemble framework for Smart Grids (SGs) intrusion detection. The framework combines Random Forest, XGBoost, and LightGBM as base learners, and Logistic Regression serving as the metaclassifier. It also used a Random Forest-based feature selection mechanism to enhance detection while reducing model dimensionality. SG-StackSecure model was trained and validated on the power system industrial control system (ICS) cyberattack datasets using 10-fold stratified cross-validation, achieving an average accuracy of 99.15% ± 0.18% and F1-scores of 0.9912 (binary classification) and 99.07% ± 0.29% and 0.9907 (three-class classification). SG-StackSecure achieves up to 8.67% higher accuracy, 96.16% reduction in feature selection time, and 89.34% reduction in training time as compared to state-of-the-art models. SG-StackSecure was also evaluated for its real-time deployment feasibility through model compression and stress testing under high-load scenarios. These results, along with a survey of SHAP and LIME for expert usability, underscore SG-StackSecure's robustness, scalability, and practical applicability for securing critical power infrastructures against evolving cyber-physical threats.

查看原文本刊更多论文

SG-StackSecure：一种用于智能电网入侵检测的智能鲁棒堆栈集成模型

先进的信息通信技术（ict）和物联网（IoT）设备与传统电力基础设施的融合，大大提高了效率、可靠性和远程可控性。然而，这种集成也带来了网络安全挑战，特别是在监控和数据采集（SCADA）系统中。为了通过实时、可扩展和可解释的检测来解决这些新出现的威胁，本研究提出了SG-StackSecure，这是一种用于智能电网（SGs）入侵检测的新型堆叠集成框架。该框架结合了Random Forest、XGBoost和LightGBM作为基础学习器，以及Logistic Regression作为元分类器。它还使用基于随机森林的特征选择机制来增强检测，同时降低模型维数。SG-StackSecure模型在电力系统工业控制系统（ICS）网络攻击数据集上进行10次分层交叉验证，平均准确率为99.15%±0.18%，f1得分为0.9912（二分类），平均准确率为99.07%±0.29%，f1得分为0.9907（三分类）。与最先进的模型相比，SG-StackSecure的准确率提高了8.67%，特征选择时间减少了96.16%，训练时间减少了89.34%。SG-StackSecure还通过模型压缩和高负载场景下的压力测试评估了其实时部署的可行性。这些结果，以及对SHAP和LIME专家可用性的调查，强调了SG-StackSecure在保护关键电力基础设施免受不断发展的网络物理威胁方面的稳健性、可扩展性和实用性。©Elsevier Inc.版权所有。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

International Journal of Critical Infrastructure Protection COMPUTER SCIENCE, INFORMATION SYSTEMS-ENGINEERING, MULTIDISCIPLINARY

CiteScore

8.90

自引率

5.60%

发文量

审稿时长

>12 weeks

期刊介绍： The International Journal of Critical Infrastructure Protection (IJCIP) was launched in 2008, with the primary aim of publishing scholarly papers of the highest quality in all areas of critical infrastructure protection. Of particular interest are articles that weave science, technology, law and policy to craft sophisticated yet practical solutions for securing assets in the various critical infrastructure sectors. These critical infrastructure sectors include: information technology, telecommunications, energy, banking and finance, transportation systems, chemicals, critical manufacturing, agriculture and food, defense industrial base, public health and health care, national monuments and icons, drinking water and water treatment systems, commercial facilities, dams, emergency services, nuclear reactors, materials and waste, postal and shipping, and government facilities. Protecting and ensuring the continuity of operation of critical infrastructure assets are vital to national security, public health and safety, economic vitality, and societal wellbeing. The scope of the journal includes, but is not limited to: 1. Analysis of security challenges that are unique or common to the various infrastructure sectors. 2. Identification of core security principles and techniques that can be applied to critical infrastructure protection. 3. Elucidation of the dependencies and interdependencies existing between infrastructure sectors and techniques for mitigating the devastating effects of cascading failures. 4. Creation of sophisticated, yet practical, solutions, for critical infrastructure protection that involve mathematical, scientific and engineering techniques, economic and social science methods, and/or legal and public policy constructs.