These labels were automatically added by AI and may be inaccurate. For details, see About Literature Database.
Abstract
The increasing digitization of smart grids has improved operational
efficiency but also introduced new cybersecurity vulnerabilities, such as False
Data Injection Attacks (FDIAs) targeting Automatic Generation Control (AGC)
systems. While machine learning (ML) and deep learning (DL) models have shown
promise in detecting such attacks, their opaque decision-making limits operator
trust and real-world applicability. This paper proposes a hybrid framework that
integrates lightweight ML-based attack detection with natural language
explanations generated by Large Language Models (LLMs). Classifiers such as
LightGBM achieve up to 95.13% attack detection accuracy with only 0.004 s
inference latency. Upon detecting a cyberattack, the system invokes LLMs,
including GPT-3.5 Turbo, GPT-4 Turbo, and GPT-4o mini, to generate
human-readable explanation of the event. Evaluated on 100 test samples, GPT-4o
mini with 20-shot prompting achieved 93% accuracy in identifying the attack
target, a mean absolute error of 0.075 pu in estimating attack magnitude, and
2.19 seconds mean absolute error (MAE) in estimating attack onset. These
results demonstrate that the proposed framework effectively balances real-time
detection with interpretable, high-fidelity explanations, addressing a critical
need for actionable AI in smart grid cybersecurity.