Resilience-Oriented Cyber Risk Recognition in Smart Grid Communication Infrastructures

Abstract

Cloud-native applications rely on large-scale microservice communication, where abnormal service-to-service traffic may indicate lateral movement, API abuse, misconfiguration, or compromised containers. Existing intrusion detection approaches are often designed for traditional network environments and may not capture the dynamic traffic behavior of containerized systems. This study proposes an interpretable ensemble learning model for anomaly detection in cloud-native microservice traffic. The framework combines XGBoost, Extra Trees, and Gradient Boosting classifiers to detect abnormal service communication patterns, while SHAP analysis is used to interpret service-level feature contributions. Experiments are performed on a Kubernetes-based testbed containing 126 microservices and 3.4 million service flow records generated under normal workloads and attack scenarios, including API flooding, privilege escalation attempts, abnormal east-west traffic, and container scanning. After feature extraction, 39 service-level features are retained, including request frequency, response latency variance, failed request ratio, inter-service connection density, port diversity, and abnormal destination concentration. The proposed model achieves 98.05% accuracy, 97.22% F1-score, and 98.73% AUC in binary anomaly detection. For multi-class attack identification, it obtains a macro-F1 of 95.84%, outperforming a CNN-LSTM baseline by 2.63%. SHAP interpretation shows that failed request ratio, sudden increases in east-west traffic, service call entropy, and response-time instability are the most important indicators of microservice anomalies. The findings demonstrate that explainable ensemble learning can improve both detection performance and operational interpretability in cloud-native security monitoring