Florida Polytechnic University

Misclassifications from power-grid intrusion detection are converted into generator-level cyber-physical risk costs that enter dispatch optimization, instead of optimizing detection F1 alone. Previously detection and dispatch were optimized separately, so the operational cost of detection errors never entered the decision objective. On the ICS and Sherlock grid datasets, after a grid search over false-positive, false-negative and risk-scaling parameters, some configurations produced lower minimum dispatch costs than their baselines, with the size of the improvement varying by dataset and configuration.

Misclassifications from power-grid intrusion detection are converted into generator-level cyber-physical risk costs that enter dispatch optimization, instead of optimizing detection F1 alone. Previously detection and dispatch were optimized separately, so the operational cost of detection errors never entered the decision objective. On the ICS and Sherlock grid datasets, after a grid search over false-positive, false-negative and risk-scaling parameters, some configurations produced lower minimum dispatch costs than their baselines, with the size of the improvement varying by dataset and configuration.

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.

In network intrusion detection, small language models reading raw numerical flow records often cannot separate traffic classes. SERA-IDS has an 8B model analyze only misclassified flows and turn each confusion into a structured rule carrying a behavioral description, feature conditions, class-confusion information, tool-derived confidence and provenance, admitted through a confidence gate into an experience library. At test time the library is frozen; up to five class-diverse rules are retrieved and condition-matched, lifting macro F1 from 1.94%–11.66% to 69.50%–87.66% for Llama 3.1, Phi-4:14B and Qwen2.5:7B on NF-BoT-IoT and NF-ToN-IoT, with no fine-tuning and no paid hosted inference.