An Intelligent Cybersecurity Framework for IoT-Based Smart Grid Systems

Learned anomaly detectors for smart grid telemetry read every sensing node through one model, so an attacker who controls a few smart meters, relays or process sensors can hide a real event, raise false alarms, or inject false data without being pointed at. This paper presents TALLY, a three-layer detection framework in which the number of compromised nodes that can be tolerated is a design parameter with a proof. Every channel is scored by an ensemble of small predictors that each read one block of other nodes, plus a predictor of the channel’s own past; the blocks partition the other nodes, so a compromised node can corrupt at most one member of every honest channel’s ensemble, and an order statistic of the member residuals is provably confined between two honest order statistics. Thresholds calibrated on attack-free data at a guarded rank keep honest nodes from being flagged, a quorum keeps the compromised nodes from raising an alarm on their own, and a per-window certificate states when an alarm survives every compromise of the tolerated size. We evaluate ten detectors with three seeds on a real power generation testbed with labelled attacks, a relay testbed, and a distribution feeder driven by real customer demand with coordinated load surges, against gradient, gradient-free and nominal-value attacks that adapt to the defence. On the feeder the tolerant design is the best detector we measured; on the generation testbed tolerating four compromised tags costs five points of area under the curve against an untolerant predictor; every joint baseline reaches a false-alarm rate near one under a single compromised node while the framework stays within its bound; no certified alarm was removed by any attack; and the cases where the framework is weaker, or where no detector works, are reported with their numbers.