Context-Driven Security Event Classification for Heterogeneous IoT Network Operations

Abstract

Smart grid communication systems rely on continuous data exchange among smart meters, substations, distributed energy resources, and control centers. Abnormal network traffic in these systems may indicate false data injection, denial-of-service attacks, unauthorized access, or compromised field devices. This study proposes an explainable ensemble learning framework for anomaly detection in smart grid communication traffic. The proposed model combines Random Forest, LightGBM, and Gradient Boosting through a weighted soft-voting mechanism to improve detection stability under imbalanced attack distributions. SHAP analysis is used to explain the contribution of flow-level and protocol-level features to each anomaly decision. Experiments are conducted on a smart grid communication dataset constructed from IEC 61850-based substation traffic and a power-system cyber-attack benchmark, containing 1.89 million labeled traffic records. After preprocessing and feature selection, 40 network features are retained, including packet inter-arrival time, flow duration, Modbus/TCP function frequency, byte transfer ratio, retransmission rate, and abnormal connection density. The proposed model achieves 98.11% accuracy, 97.36% F1-score, and 98.82% AUC in binary anomaly detection. For multi-class attack detection, it obtains a macro-F1 of 95.74% across false data injection, DoS, scanning, and unauthorized command attacks. Compared with standalone LightGBM, the ensemble model reduces the false positive rate by 14.2% and improves recall for low-frequency attack classes by 3.18%. SHAP interpretation shows that abnormal command frequency, short repetitive connections, packet timing instability, and asymmetric byte transfer are key indicators of malicious smart grid traffic. The results suggest that explainable ensemble learning can support transparent and reliable intrusion detection in smart grid communication environments