Liao Xiao, Cui Wei, Zhang Min, Zhang Aiwu, Hu Pan
State Grid Information and Telecommunication Group Co., Ltd., Beijing 100029, China.
School of Automation Science and Engineering, Xi'an Jiaotong University, Xi'an 710049, China.
Sensors (Basel). 2025 Jul 5;25(13):4208. doi: 10.3390/s25134208.
The increasing sophistication of cyberattacks on smart grid infrastructure demands advanced anomaly detection and recovery systems that balance high recall rates with acceptable precision while providing reliable data restoration capabilities. This study presents an optimized two-stage anomaly detection and recovery system combining an enhanced TimerXL detector with a DeBERTa-v3-based verification and recovery mechanism. The first stage employs an optimized increment-based detection algorithm achieving 95.0% for recall and 54.8% for precision through multidimensional analysis. The second stage leverages a modified DeBERTa-v3 architecture with comprehensive 25-dimensional feature engineering per variable to verify potential anomalies, improving the precision to 95.1% while maintaining 84.1% for recall. Key innovations include (1) a balanced loss function combining focal loss (α = 0.65, γ = 1.2), Dice loss (weight = 0.5), and contrastive learning (weight = 0.03) to reduce over-rejection by 73.4%; (2) an ensemble verification strategy using multithreshold voting, achieving 91.2% accuracy; (3) optimized sample weighting prioritizing missed positives (weight = 10.0); (4) comprehensive feature extraction, including frequency domain and entropy features; and (5) integration of a generative time series model (TimER) for high-precision recovery of tampered data points. Experimental results on 2000 hourly smart grid measurements demonstrate an F1-score of 0.873 ± 0.114 for detection, representing a 51.4% improvement over ARIMA (0.576), 621% over LSTM-AE (0.121), 791% over standard Anomaly Transformer (0.098), and 904% over TimesNet (0.087). The recovery mechanism achieves remarkably precise restoration with a mean absolute error (MAE) of only 0.0055 kWh, representing a 99.91% improvement compared to traditional ARIMA models and 98.46% compared to standard Anomaly Transformer models. We also explore an alternative implementation using the Lag-LLaMA architecture, which achieves an MAE of 0.2598 kWh. The system maintains real-time capability with a 66.6 ± 7.2 ms inference time, making it suitable for operational deployment. Sensitivity analysis reveals robust performance across anomaly magnitudes (5-100 kWh), with the detection accuracy remaining above 88%.
针对智能电网基础设施的网络攻击日益复杂，这就需要先进的异常检测和恢复系统，该系统要在高召回率和可接受的精确率之间取得平衡，同时还要具备可靠的数据恢复能力。本研究提出了一种优化的两阶段异常检测和恢复系统，该系统将增强型TimerXL检测器与基于DeBERTa-v3的验证和恢复机制相结合。第一阶段采用优化的基于增量的检测算法，通过多维分析实现召回率为95.0%，精确率为54.8%。第二阶段利用改进的DeBERTa-v3架构，每个变量进行全面的25维特征工程来验证潜在异常，将精确率提高到95.1%，同时召回率保持在84.1%。关键创新点包括：（1）一种平衡损失函数，结合了焦点损失（α = 0.65，γ = 1.2）、骰子损失（权重 = 0.5）和对比学习（权重 = 0.03），将过度拒绝率降低了73.4%；（2）一种使用多阈值投票的集成验证策略，准确率达到91.2%；（3）优化样本加权，优先考虑漏报阳性（权重 = 10.0）；（4）全面的特征提取，包括频域和熵特征；（5）集成生成式时间序列模型（TimER）用于高精度恢复被篡改的数据点。对2000个每小时的智能电网测量数据进行的实验结果表明，检测的F1分数为0.873±0.114，与ARIMA（0.576）相比提高了51.4%，与LSTM-AE（0.121）相比提高了621%，与标准异常变压器（0.098）相比提高了791%，与TimesNet（0.087）相比提高了904%。恢复机制实现了非常精确的恢复，平均绝对误差（MAE）仅为0.0055千瓦时，与传统ARIMA模型相比提高了99.91%，与标准异常变压器模型相比提高了98.46%。我们还探索了使用Lag-LLaMA架构的替代实现方式，其MAE为0.2598千瓦时。该系统以66.6±7.2毫秒的推理时间保持实时能力，适合实际部署。敏感性分析表明，在异常幅度（5 - 100千瓦时）范围内性能稳健，检测准确率保持在88%以上。
