Measurement-level feature attribution shows that the DL-Xformer decision is driven by physically meaningful current and voltage channels at the attacked measurement location, which motivates a layered protection architecture for next-generation inverter-dominated smart grids.
Abstract
Inverter-based resources and IEC 61850 process-bus measurements introduce new protection challenges, including nontraditional fault behavior and measurement-domain cyber-physical attacks. This paper evaluates DL-Xformer, an attention-based Transformer classifier for multi-class fault and cyberattack diagnosis, side-by-side with Dynamic State Estimation-Based Protection (DSE-EBP) on identical high-fidelity electromagnetic-transient (EMT) streaming measurements from an IBR-rich power grid. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults, and six measurement-domain attacks, including CT/PT ratio manipulation and GPS spoofing, sampled at 4.8 kHz from synchronized upstream and downstream merging units. DSE-EBP detects all streaming anomalies in 0.417-1.660 ms, with a mean detection time of 0.756 ms, while DL-Xformer classifies the same events in 2.50-50.42 ms, with a mean classification time of 13.46 ms. The longest delay occurs in a deliberate stress case where a CT ratio attack is introduced while residual oscillations from a preceding DLG fault have not fully settled; the event-window accuracy drops to 76.1 %, but the stable final classification remains correct. Measurement-level feature attribution shows that the DL-Xformer decision is driven by physically meaningful current and voltage channels at the attacked measurement location. Together, the two methods motivate a layered protection architecture for next-generation inverter-dominated smart grids.
Experimental results on stator inter-turn faults across multiple low-load operating conditions demonstrate superior reconstruction performance compared with representative recurrent, transformer-based, and graph-based autoencoder models while maintaining computational efficiency suitable for low-latency deployment.
Chibuzo Nwabufo Okwuosa, J. Hur· IEEE Access· 0 citations
A hybrid two-stage machine learning pipeline that decouples detection from classification is proposed, and the direction of the zero-sequence signature is found to be system-dependent, motivating a learned decision boundary in place of a fixed relay threshold.
Sahil Manikshete, A. Gujarathi, Thanh Long Vu et al.· 0 citations
A practical, real-time arc fault detection system that integrates a comprehensive two-branch household dataset, lightweight handcrafted features, and classical machine learning for deployment on an STM32F407 microcontroller (MCU) and confirms its feasibility for low-cost, real-time protection devices.
Tan Tong Sy, Toan Le Duc, Dao Le Xuan et al.· E3S Web of Conferences· 0 citations
A progressive three-stage time–frequency learning framework that identifies series arc faults directly from normalized current waveforms and provides robust discrimination across unseen measurement sessions within the evaluated load categories and operating conditions is presented.
Seoyoung Jeon, Won-Kyu Choi, Sungsoo Kwon et al.· Italian National Conference...· 0 citations
As MNI becomes increasingly vulnerable to new kinds of attacks from the cyber world, accurate and timely detection of intrusions becomes a primary key to the power of cybersecurity. More complex attack patterns, complex traffic interactions within large scales are not very collaborable with the typical signature-based detection methods. A Transformer Based Network Anomaly Detection System for intelligent cyber security monitoring based on network flow analysis (NFAs) is proposed in the paper. This framework is derived from the CICIDS2017 data-set and proposes 78 of the statistical flow characteristics, where each flow characteristic impacts the behaviour of a packet, protocol, volume of traffic and temporal communication pattern. The model uses a Transformer Encoder network architecture along with multiple heads of self-attention, which provides greater understanding to deal with complex relationships between features from network traffic. LabelEncoder and StandardScaler have been applied to the columns with values that need to be encoded for categorical variables and scaled to fit the values for models training. A trained model is then applied to progress multiple different categories of cyberattacks including DDoS attacks, PortScan, Brute Force, Botnet, Web Based, etc. and different kinds of traffic, all traffic is considered benign traffic. For providing real-time predictions, confidence interval, prediction of class severity and alerts using trained model an API developed on flask to connect the trained model to a dashboard was built. The experimental results show that the Transformer-based learning could be very effective in achieving successful capturing of the network behavior and conducting realistic detection. The overall proposed system offers an intelligent, scalable and deployment-centric approach to improve the monitoring and proactive detection of threats in contemporary networks in the field of cybersecurity.
S. Nagendrudu, Shaik Mohammed Anays, F. Mahammad et al.· 2026 International Conferenc...· 0 citations
Conventional energy meters measure only total consumption and give no information about harmonic distortion or load faults. This paper presents an edge intelligence power auditor on an STM32F411 ARM Cortex-M4 that performs real-time harmonic analysis and three-state fault classification with no cloud dependency. Voltage and current are acquired using a ZMPT101B sensor and SCT-013 clamp with LM358 conditioning, sampled at 5000 Hz through the 12-bit ADC. A 1024-point CMSIS-DSP FFT extracts harmonics up to the seventh order and computes THD, RMS voltage, RMS current, and power factor. A rule-based classifier using THD, power factor, and H3/H1 ratio identifies load conditions as Healthy, Degraded, or Faulty, with the 10% THD boundary aligned with IEEE 519. Hardware testing confirmed correct classification across all three states, with THD of 1.97% healthy and 39.84% faulty. Results are shown on an SSD1306 OLED, and a relay disconnects the load on fault detection. All processing runs on-chip with no external data transmission, making the system suitable for rural, off-grid, and small-industry use.
Jenifer Vincy, Dr R Lal, Raja Singh et al.· 2026 International Conferenc...· 0 citations