Grid intrusion detection stops chasing F1 alone: misclassifications become generator risk costs, and dispatch cost falls
Synopsis
Misclassifications from power-grid intrusion detection are converted into generator-level cyber-physical risk costs that enter dispatch optimization, instead of optimizing detection F1 alone. Previously detection and dispatch were optimized separately, so the operational cost of detection errors never entered the decision objective. On the ICS and Sherlock grid datasets, after a grid search over false-positive, false-negative and risk-scaling parameters, some configurations produced lower minimum dispatch costs than their baselines, with the size of the improvement varying by dataset and configuration.
Interpretation
False positives and false negatives from intrusion detection are given different operational penalties and aggregated to the generator level as a cost term in the dispatch objective. Earlier intrusion detection mainly optimized predictive metrics such as accuracy, recall, precision and F1-score, while downstream operational cost was optimized separately. On the ICS grid dataset, the maximum cost improvement rose from 0.00046% at a risk-scaling value of 1 to 0.19983% at 50000, with diminishing gains beyond 50000.
The detection model and the dispatch model update in alternation: feature weights learned by the previous detection round train the next round, and detection outcomes then refresh generator risk costs. The conventional pipeline predicts first and optimizes afterward, with no feedback between detection and dispatch. Detection uses logistic regression and dispatch uses a linear program solved with Gurobi, with 100 framework iterations per parameter configuration; the ICS dataset uses two generators and the Sherlock dataset seven.
The effect of the risk-scaling parameter on dispatch cost differs by dataset, and on Sherlock the improvement disappears beyond a certain value. On ICS the cost improvement continues as the scaling parameter grows, though incremental gains shrink at high values. The two datasets differ in system structure, feature representation and generator-level sample assignment, which may explain the different sensitivity patterns.
Perspective
The results come from the ICS and Sherlock grid operation datasets, covering two grid topologies and attack scenarios, with logistic regression for detection and linear programming for dispatch. The work suits researchers and engineers working on grid cyber-physical security and decision-focused learning. Future work will evaluate the framework with larger power-system benchmarks, additional intrusion detection models and additional operational constraints.
The cost improvements are small, reaching 0.19983% on ICS, and incremental gains shrink as the risk-scaling parameter grows; on Sherlock the improvement disappears beyond a certain value. The effect depends on the dataset and on the false-positive and false-negative cost configuration, and the source of the sensitivity difference between the two datasets is not determined.