Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching

Abstract

Trustworthy anomaly detection in power-grid dispatching requires alerts that are traceable to operational knowledge while satisfying real-time constraints. Existing data-driven detectors do not naturally encode behavioral rules, whereas placing a large language model (LLM) in the online decision loop introduces latency and nondeterministic outputs. We propose K-TRACE-CP, an offline-heavy, online-light framework that represents source-linked behavioral knowledge as numerical prototypes and transfers this supervision to a lightweight attribute-dynamic physical-graph expert. A separately trained cyber–physical expert models 470 process variables and 80 label-agnostic communication features, and threshold-normalized fusion combines their anomaly scores. At inference, the framework retrieves ranked, source-linked behavioral candidates for each alert without LLM calls. On an event-group-held-out split of Sherlock 01-Basic, K-TRACE-CP achieves 0.974±0.012 attack-window recall, 0.914±0.009 average precision, and an F1 score of 0.813±0.009 over three seeds. All four distinct held-out attack events are detected, corresponding to an event recall of 1.000 with an exact 95% confidence interval of 0.398–1.000. A non-overlapping-window evaluation retains 0.973±0.016 recall and 0.903±0.010 average precision. The controlled prototype-ranking experiment achieves Hit@1 of 0.954±0.023, supporting family-level behavioral retrieval. The primary Sherlock evaluation uses manually compiled prototypes, while an independent physical-testbed experiment evaluates few-shot LLM-compiled knowledge in downstream graph training. The complete 127,386-trainable-parameter online path requires a median of 1.412 ms per sample on an RTX 3060. These results support source-grounded, computationally lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings.