Transformer is All You Need: Attention-Based Anomaly Detection and Classification in Inverter-Rich Power Systems

A.P. Sakis Meliopoulos; Emad Abukhousa; Saman Zonouz

REVIEW 4 major objections 6 minor 18 references

The paper claims that a physics-based estimator and a Transformer classifier, evaluated on identical inverter-grid waveforms, complement each other: the estimator detects all five anomalies in under 2 ms, and the Transformer gives a correct

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 04:51 UTC pith:7NKP22I7

load-bearing objection A useful side-by-side evaluation of fast physics-based detection vs slower Transformer classification on identical EMT streams, but the reported Transformer latencies are flattered by an 8.33 ms non-causal smoothing look-ahead that the paper acknowledges but does not correct. the 4 major comments →

arxiv 2607.13537 v1 pith:7NKP22I7 submitted 2026-07-15 eess.SY cs.SY

Transformer is All You Need: Attention-Based Anomaly Detection and Classification in Inverter-Rich Power Systems

Emad Abukhousa , Saman Zonouz , A.P. Sakis Meliopoulos This is my paper

classification eess.SY cs.SY

keywords cyber-physical securitydeep learningDL-XformerDynamic State Estimation-Based Protectioninverter-based resourcesIEC 61850measurement-domain attackssmart grids

verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to establish that fast physics-based anomaly detection and slower, semantically richer deep-learning classification are complementary rather than competing for protecting inverter-rich power grids. On identical high-fidelity electromagnetic-transient streaming measurements from a simulated microgrid, a dynamic-state-estimation relay detects every one of five faults and measurement attacks in under 2 ms (mean 0.756 ms), while an attention-based Transformer classifies the same events in 2.5–50.4 ms (mean 13.46 ms) with 97.47% held-out accuracy and correct final labels for all five events. The authors argue this latency–diagnosis tradeoff motivates a layered protection architecture: DSE-EBP as the fast trigger, DL-Xformer as the diagnostic layer that names the fault type or attack and points to the corrupted measurement. A careful reader would care because measurement-domain cyberattacks that respect IEC 61850 protocols are precisely the cases where fast detection alone does not tell the operator what is wrong.

Core claim

On identical streaming measurements from an inverter-rich distribution grid, the paper establishes a complementary latency–diagnosis tradeoff: DSE-EBP, a protection relaying method based on weighted least-squares state estimation, detects every one of five anomalies (three physical faults and two measurement-domain attacks) in 0.417–1.660 ms (mean 0.756 ms) by observing a sharp rise in a chi-square model-measurement residual, while DL-Xformer, a multi-head attention Transformer operating on 50-sample windows of the same 14-channel sampled values, classifies the same events in 2.50–50.42 ms (mean 13.46 ms) with 97.47% held-out accuracy and correct final labels in all five cases. The slowest c

What carries the argument

Two parallel branches on the same stream. (1) DL-Xformer: multi-head scaled dot-product attention over 50-sample windows of 14 synchronized current/voltage channels sampled at 4.8 kHz from upstream and downstream merging units; sinusoidal positional encoding; four stacked attention blocks; one-cycle centered moving-average smoothing; confidence-gated output (τ=0.60). (2) DSE-EBP: physics-based model of the protected zone; weighted least-squares residual produces a chi-square statistic ξ(t) whose rise collapses a confidence level CL(t); an area-integrated trip logic (T_r=100 ms, T_d=40 ms) issues a trip. The two branches are evaluated side-by-side; the measured gap between DSE-EBP detection t

Load-bearing premise

The entire comparison rests on the assumption that the simulated electromagnetic-transient waveforms, including the fixed attack magnitudes, faithfully represent real IEC 61850 substation sampled-value streams, so that the measured latencies and accuracies transfer from simulation to field.

What would settle it

Run the same five-event streaming sequence on a real-time digital simulator or controller-hardware-in-the-loop rig with merging units and physically injected CT/PT ratio changes and GPS spoofing; if DSE-EBP's detection time rises above a few milliseconds, or DL-Xformer's final classification of the CT attack under residual oscillation is wrong, the claimed complementarity is a simulator property rather than a grid property.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

A layered protection architecture can use DSE-EBP as the primary fast trigger while DL-Xformer provides fault-type and attack-type labels plus attacked-measurement localization.
DL-Xformer's 13.46 ms mean classification time stays within one 60 Hz cycle for most events, suggesting it could support sub-cycle diagnostic functions despite not meeting deterministic two-to-three-cycle protection requirements.
The CT-attack stress case shows that even under residual post-fault oscillation, a stable correct final classification can emerge despite reduced event-window accuracy, so event-window accuracy alone understates diagnostic reliability.
Measurement-level attribution indicates the model learns physically meaningful spatial relationships without explicit physics supervision, offering an interpretable alarm channel for operators.
DSE-EBP's detection times (mean 0.756 ms) sit within the 2–5 ms window before inverter over-current shutdown, supporting its role for ultra-fast detection in IBR-dominated systems.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

If validated in controller-hardware-in-the-loop tests, the DSE-EBP trigger could gate DL-Xformer's inference, reducing compute and false-positive labels during normal operation while preserving fast detection.
The attribution finding suggests a testable extension: retrain DL-Xformer with synthetic attacks at variable magnitudes and locations; if attribution shifts to the true attacked channel under all magnitudes, localization robustness would be established beyond the fixed-magnitude setting.
The 50.42 ms worst case hints at a hybrid decision rule: use DSE-EBP's residual to pre-segment events, then let DL-Xformer classify only the segment after residual settles, potentially improving event-window accuracy for stacked events.
Since the centered smoothing filter introduces 8.33 ms look-ahead, a causal variant would lengthen effective classification latency; quantifying that tradeoff is a direct next step before field deployment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Desk Editor's Note

A useful side-by-side evaluation of fast physics-based detection vs slower Transformer classification on identical EMT streams, but the reported Transformer latencies are flattered by an 8.33 ms non-causal smoothing look-ahead that the paper acknowledges but does not correct.

read the letter

I read the paper with attention to the latency claims. The core result is real: DSE-EBP detects all five events in under 2 ms while the Transformer classifier takes ~13.5 ms on average, on identical simulated EMT streams. But the 13.46 ms mean and 2.50 ms minimum are understated by up to 8.33 ms because the classifier uses a centered moving-average smoother (Eq. 9) with N_half=40 at 4.8 kHz. A decision at time t has seen data through t+8.33 ms, so the mean is really ~21.8 ms and the fastest event is really ~10.8 ms. The paper explicitly acknowledges this in Section IV and says a causal trailing-window implementation is needed for relay-grade deployment, but it does not adjust the reported classification times or the event-window accuracy. That is an internal measurement inconsistency, not just a field-fidelity caveat.

What is new: a clean side-by-side comparison of a physics-based protection method and an attention-based classifier on the same 4.8 kHz streams, with detection and classification times separated. The evaluation design is honest: five events including a deliberately hard CT attack under residual DLG oscillation, confidence-gated abstention, and measurement-level attribution showing the model keys on the attacked channels. The dataset is from the authors' prior work and appears to be open (T4Tech). Held-out accuracy 97.47% and the stable-final-classification behavior are plausible. The qualitative conclusion—fast physics detection plus slower semantic diagnosis motivates a layered architecture—is well supported.

The main soft spot is the timing inconsistency above. There are also smaller gaps: no per-event numerical table with classwise accuracy (only two zoomed figures), no sensitivity analysis for the confidence threshold or window length, and no non-attention ML baseline in this paper (the authors cite their own latency-aware benchmark [14] that apparently contains one). The stress case is simulation-based with fixed attack magnitudes, and the authors say so; that limits transfer to field IEC 61850 substations, but it is a stated limitation, not a hidden one. The paper leans on the authors' prior work for the dataset and DSE-EBP, which is acceptable but means the independent contribution is the comparison itself.

Overall, the central design and qualitative conclusion hold up. The quantitative latency comparison needs correction or at least explicit reporting of both causal and look-ahead-adjusted numbers. I would send this to peer review: the topic matters, the comparison is useful, and a good referee will force the timing fix and per-event tables. I would cite the paper for the layered-protection architecture and the evaluation framework, but not for the latency numbers as given.

Referee Report

4 major / 6 minor

Summary. The paper evaluates DL-Xformer, a Transformer-based classifier, side-by-side with DSE-EBP on identical high-fidelity EMT streaming measurements from an IBR-rich microgrid. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults, and six measurement-domain attacks (CT/PT ratio manipulation, GPS spoofing), sampled at 4.8 kHz from two merging units. On a 6-second streaming sequence with five 200-ms events, DSE-EBP detects all anomalies in 0.417–1.660 ms (mean 0.756 ms), while DL-Xformer classifies the same events in 2.50–50.42 ms (mean 13.46 ms), with 97.47% held-out window accuracy. A deliberate stress case—a CT ratio attack introduced under residual DLG oscillation—yields 76.1% event-window accuracy but a correct stable final classification. The paper also presents measurement-level feature attribution for the CT attack and argues for a layered protection architecture combining fast physics-based detection with richer data-driven diagnosis.

Significance. The main value of the paper is a side-by-side, streaming, confidence-gated comparison of a physics-based protection method and a learned classifier on the same waveforms, with explicit attention to classification latency, event-window accuracy, and attribution. The public dataset/code reference [13] and the deliberate stress case are strengths that help reproducibility and interpretation. If the latency numbers are interpreted causally, the paper provides a useful benchmark for the latency–specificity tradeoff in IBR-rich protection. However, the headline quantitative comparison is currently weakened by the non-causal centered smoothing in the DL-Xformer pipeline, which makes the reported classification times understated. The simulation-only nature of the testbed is clearly acknowledged and is acceptable for a comparative benchmark, though it limits direct field-transfer claims.

major comments (4)

[§II-E, Eq. (9); §II-G; §III-B; Abstract] The reported DL-Xformer classification times are not causal latencies. The centered moving-average filter in Eq. (9) uses N_half = 40 future samples at f_s = 4.8 kHz, i.e., T_smooth = 8.33 ms of look-ahead. The classification time defined in §II-G and reported as 2.50–50.42 ms (mean 13.46 ms) therefore measures decisions made with access to future data; for example, the 2.50 ms minimum uses information through 10.83 ms after onset, and the mean becomes approximately 21.79 ms when the look-ahead is charged. This directly affects the headline comparison with DSE-EBP and the '17.8 times larger' claim. The paper acknowledges the look-ahead at the end of §II-E and in §IV, but does not adjust the reported numbers or the abstract/conclusion. The same issue may inflate the event-window accuracy, since labels assigned to samples near the end of an event window can use data beyond the window. The
[§III-B and Fig. 3] No per-event numerical table is provided. The text gives aggregate ranges and means (DSE-EBP 0.417–1.660 ms, mean 0.756 ms; DL-Xformer 2.50–50.42 ms, mean 13.46 ms), and Fig. 3 shows per-event classification time and event-window accuracy, but the reader cannot verify per-event DSE-EBP detection times or cross-check the CT stress-case numbers against a stable final label. Given that the central claim is a quantitative latency comparison, a table listing, for each of the five events, DSE-EBP detection time, DL-Xformer classification time (raw and causal-adjusted if the centered filter is kept), event-window accuracy, and the stable final classification would materially support the paper's conclusions.
[§II-G] The definitions of the two latency metrics rely on 'sustained' behavior that is never quantified. DSE-EBP detection time is 'the first sustained rise in the plotted chi-square statistic with confidence collapse below 80%', and DL-Xformer classification time is 'the first sustained correct class label after confidence gating.' Without a concrete criterion—for example, a required number of consecutive samples or a minimum dwell time—the reported times are not precisely reproducible and cannot be audited against the raw data. Please state the exact rule used to determine 'sustained' for both methods.
[§III-E and Fig. 6] Measurement-level feature attribution is listed as a contribution and is used to argue the model learns physically meaningful spatial relationships, but the attribution method is not described. The text reports 'measurement-level feature-attribution scores' without stating whether these are attention weights, gradients, integrated gradients, Shapley values, or another technique, nor how the scores are aggregated over the sliding windows. Without this information, the attribution result in Fig. 6 cannot be reproduced or interpreted. Please add the attribution procedure and, if possible, a brief validation of its stability across windows and seeds.

minor comments (6)

[Abstract and Conclusion] The abstract and conclusion repeat the non-causal DL-Xformer classification times without the caveat stated in §II-E and §IV. After the causal-correction issue is addressed, these passages should be updated to avoid overstating the speed advantage.
[Title] The title 'Transformer is All You Need' overclaims relative to the paper's own conclusion, which is that a layered architecture combining DSE-EBP and DL-Xformer is needed. A more neutral title such as 'Attention-Based Classification Compared with Dynamic State Estimation-Based Protection' would better match the content.
[Fig. 2 caption] The caption says 'both systems detect all five anomalies,' but DL-Xformer is a classifier that emits a label after confidence gating; it does not detect anomalies in the same sense as DSE-EBP. Suggest rewording to 'both systems respond to all five anomalies' or similar.
[§II-B] The attack magnitudes, durations, and injection points for the CT/PT ratio manipulation and GPS spoofing classes are not given. Since the paper acknowledges fixed attack magnitudes as a limitation, it would be useful to state the specific values used and to note whether the streaming sequence uses the same magnitudes as the training set.
[§II-D] The statement that any observed performance difference is 'attributable solely to the method' is too strong because the two branches use different output types and, as noted above, DL-Xformer uses future data while DSE-EBP is causal. After the causal correction, this sentence should be qualified.
[References] Reference [18] for WinIGS is not formatted consistently with the other references and the URL is incomplete in appearance. Please check the citation format and the accessibility of the URL.

Circularity Check

0 steps flagged

No circular derivation: the paper is an empirical benchmark with reproducible prior-work citations; disclosed look-ahead in the smoother and simulation-based fidelity are validity limitations, not circularity.

full rationale

I walked the paper's claimed derivation chain. The paper does not derive a first-principles result from an assumption that equals the conclusion; it reports (i) held-out classifier accuracy (Sec. III-A), (ii) streaming detection/classification latencies (Sec. III-B), and (iii) a side-by-side benchmark of DL-Xformer and DSE-EBP on the same EMT streams. The training data are taken from the authors' prior dataset [12], [13], but that dataset is released with code, and the streaming evaluation explicitly uses waveforms not used in training (Sec. II-C), so the reported accuracy and latencies are not fitted to the test stream. DSE-EBP is cited from [15]-[17] with stated parameters (T_r=100 ms, T_d=40 ms, k=1.0) and is not tuned to the five events; its detection-time definition (Sec. II-G) is a measurement convention, not a derived prediction. Equations (9)-(10) and (14)-(15) are definitions of smoothing, confidence gating, and area-based tripping, and do not transform inputs into outputs by construction. I specifically considered the manuscript's own limitation statements: the centered smoothing filter in Eq. (9) introduces 8.33 ms of look-ahead and requires a causal trailing-window implementation for relay-grade deployment (Sec. II-E), and the evaluation is simulation-based with fixed attack magnitudes (Sec. IV). These are real validity/interpretation concerns for the latency comparison and field transfer, but they are not circularity: no claim reduces to its inputs by definition, and no load-bearing result is supported only by a self-citation that is itself unverified. The self-citations to the dataset, benchmark framework, and DSE-EBP are references to reproducible or externally established prior work, not circular argumentative links.

Axiom & Free-Parameter Ledger

6 free parameters · 5 axioms · 0 invented entities

The paper introduces no new physical entities, forces, or dimensions. Its free parameters are design choices: tau = 0.60 gating threshold, L = 50 window, DSE-EBP relay settings (T_r = 100 ms, T_d = 40 ms, k = 1.0), plus the arbitrary 18-class numbering. All are stated in the paper but none is derived from first principles or given a sensitivity analysis. The two domain assumptions that carry the most weight are testbed fidelity (WinIGS) and the DSE-EBP protected-zone model being correct enough that residual rise means anomaly.

free parameters (6)

Confidence threshold tau = 0.60
Chosen by hand for the confidence-gated decision rule (Eq. 10). No sensitivity analysis; the reported classification times and event-window accuracies depend on it.
Window length L = 50 samples (10.42 ms)
Selected to provide sub-cycle responsiveness; shorter than one 60 Hz cycle. Affects features available to the classifier and hence latency/accuracy.
DSE-EBP trip threshold T_d = 40 ms
Relay parameter in Eq. 15; the ~40 ms trip delay is a direct consequence of this chosen value, not a measured property of the grid.
DSE-EBP reset window T_r = 100 ms
Relay parameter in Eq. 14; affects area accumulation and trip timing.
Desensitization factor k = 1.0
Appears in Eq. 12; chosen without justification; scales the chi-square statistic and hence the detection time.
18-class mapping class indices = Table I (e.g., class 4, 8 for CT attacks)
Class numbering is arbitrary but the taxonomy structure (gaps at 4, 8, 12, 13, 16, 17) is a modeling choice that affects the classifier output space.

axioms (5)

domain assumption Scaled dot-product attention is a suitable inductive bias for power-system waveform windows of <1 cycle
The entire DL-Xformer branch presupposes, and the paper aims to test, that attention-based temporal modeling can classify these windows. Invoked in Section II-E.
domain assumption The protected zone is adequately represented by the DSE-EBP model so that chi-square residual rises on attacks and faults
DSE-EBP's detection claims rest on model-measurement consistency testing (Eq. 11-13); if the model is wrong in the field, residuals rise for benign reasons. Invoked in Section II-F.
domain assumption WinIGS EMT simulations reproduce the relevant physics of IBR fault currents and measurement attacks
All data are simulation-generated; the authors state in Section IV that controller-hardware-in-the-loop and RTDS studies are needed before field deployment.
domain assumption MU23 and MU32 sampled values at 4.8 kHz are synchronous and consistent with IEC 61850 process-bus streams
The 14-dimensional feature vector (Eq. 1) assumes synchronized upstream/downstream merging-unit measurements; field synchronization is exactly what GPS/PTP attacks undermine.
standard math Standard backpropagation/Adam training of the Transformer converges to a good classifier
No formal learning-theoretic guarantee is given; standard practice.

pith-pipeline@v1.3.0-alltime-deepseek · 7597 in / 10072 out tokens · 83280 ms · 2026-08-02T04:51:37.102355+00:00 · methodology

0 comments

read the original abstract

Inverter-based resources and IEC 61850 process-bus measurements introduce new protection challenges, including nontraditional fault behavior and measurement-domain cyber-physical attacks. This paper evaluates DL-Xformer, an attention-based Transformer classifier for multi-class fault and cyberattack diagnosis, side-by-side with Dynamic State Estimation-Based Protection (DSE-EBP) on identical high-fidelity electromagnetic-transient (EMT) streaming measurements from an IBR-rich power grid. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults, and six measurement-domain attacks, including CT/PT ratio manipulation and GPS spoofing, sampled at 4.8 kHz from synchronized upstream and downstream merging units. DSE-EBP detects all streaming anomalies in 0.417-1.660 ms, with a mean detection time of 0.756 ms, while DL-Xformer classifies the same events in 2.50-50.42 ms, with a mean classification time of 13.46 ms. The longest delay occurs in a deliberate stress case where a CT ratio attack is introduced while residual oscillations from a preceding DLG fault have not fully settled; the event-window accuracy drops to 76.1 %, but the stable final classification remains correct. Measurement-level feature attribution shows that the DL-Xformer decision is driven by physically meaningful current and voltage channels at the attacked measurement location. Together, the two methods motivate a layered protection architecture for next-generation inverter-dominated smart grids.

Figures

Figures reproduced from arXiv: 2607.13537 by A.P. Sakis Meliopoulos, Emad Abukhousa, Saman Zonouz.

**Figure 1.** Figure 1: EMT-modeled inverter-rich microgrid testbed generated in WinIGS. deployment [14]. The present work narrows the focus to the Transformer family and evaluates whether attention-based temporal modeling can provide reliable multi-class diagnosis, confidence behavior, and measurement-level attribution when compared side-by-side with DSE-EBP on identical highfidelity EMT streams. In parallel, DSE-EBP provides … view at source ↗

**Figure 2.** Figure 2: Full five-event streaming evaluation side-by-side. Top: raw MU23/MU32 measurements. Middle: DL-Xformer confidence and predicted class. Bottom: DSE-EBP observed chi-square statistic ξ(t) (plotted as χ 2 ), confidence level CL(t), and trip decision. Both systems detect all five anomalies. III. RESULTS A. Full Streaming Evaluation [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗

**Figure 4.** Figure 4: Case A: DLG AC–N fault at 3.0 s. later, creating the most challenging classification condition in the evaluation. D. Zoomed Case B: CT Attack Under Residual Oscillation [PITH_FULL_IMAGE:figures/full_fig_p005_4.png] view at source ↗

**Figure 6.** Figure 6: shows measurement-level feature-attribution scores for the CT attack case. Dominant attribution weights concentrate on MU32 phase-current channels (I32,a, I32,b, I32,c) and MU32 voltage channels—the physically attacked measurement signals. MU23 measurements, which are not manipulated in this scenario, receive significantly lower attribution. The MU32 neutral-current channel contributes as secondary contex… view at source ↗

discussion (0)

Reference graph

Works this paper leans on

18 extracted references · 1 linked inside Pith

[1]

Fault current contribution from synchronous machine and inverter based distributed generation,

N. Nimpitiwan, G. T. Heydt, R. Ayyanar, and S. Suryanarayanan, “Fault current contribution from synchronous machine and inverter based distributed generation,”IEEE Transactions on Power Delivery, vol. 22, no. 1, pp. 634–641, 2007

2007
[2]

Influence of inverter-based resources on microgrid protection: Part 1: Microgrids in radial distribution systems,

M. J. Reno, S. Brahma, A. Bidram, and M. E. Ropp, “Influence of inverter-based resources on microgrid protection: Part 1: Microgrids in radial distribution systems,”IEEE Power and Energy Magazine, vol. 19, no. 3, pp. 36–46, 2021

2021
[3]

Protection challenges under bulk penetration of renewable energy resources in power systems: A review,

V . Telukunta, J. Pradhan, A. Agrawal, M. Singh, and S. G. Srivani, “Protection challenges under bulk penetration of renewable energy resources in power systems: A review,”CSEE Journal of Power and Energy Systems, vol. 3, no. 4, pp. 365–379, Dec. 2017

2017
[4]

1,200 MW fault induced solar photovoltaic resource interruption disturbance report — Blue Cut Fire event,

NERC/WECC Joint Task Force, “1,200 MW fault induced solar photovoltaic resource interruption disturbance report — Blue Cut Fire event,” North American Electric Reliability Corporation, At- lanta, GA, Tech. Rep., Jun. 2017, event Analysis Report. Available: https://www.nerc.com/

2017
[5]

Attacking IEC 61850 substations by targeting the PTP protocol,

A. Akbarzadehet al., “Attacking IEC 61850 substations by targeting the PTP protocol,”Electronics, vol. 12, no. 12, p. 2596, 2023

2023
[6]

A detection and mitigation model for PTP delay attack in an IEC 61850 substation,

B. Moussa, M. Debbabi, and C. Assi, “A detection and mitigation model for PTP delay attack in an IEC 61850 substation,”IEEE Transactions on Smart Grid, vol. 9, no. 5, pp. 3954–3965, Sep. 2018

2018
[7]

Detection and mitigation of GPS spoofing attacks on phasor measurement units using deep learning,

A. S. Musleh, G. Chen, and Z. Y . Dong, “Detection and mitigation of GPS spoofing attacks on phasor measurement units using deep learning,” International Journal of Electrical Power & Energy Systems, vol. 127, p. 106635, 2021

2021
[8]

Machine learning for power system dis- turbance and cyber-attack discrimination,

R. C. Borges Hinket al., “Machine learning for power system dis- turbance and cyber-attack discrimination,” inProc. 7th International Symposium on Resilient Control Systems (ISRCS), 2014, pp. 1–8

2014
[9]

A deep learning-based cyberattack detection system for transmission protective relays,

Y . M. Khawet al., “A deep learning-based cyberattack detection system for transmission protective relays,”IEEE Transactions on Smart Grid, vol. 12, no. 3, pp. 2554–2565, May 2021

2021
[10]

Deep learning based relay for online fault detection, classification, and fault location in a grid-connected microgrid,

B. Royet al., “Deep learning based relay for online fault detection, classification, and fault location in a grid-connected microgrid,”IEEE Access, vol. 11, pp. 62 677–62 693, 2023

2023
[11]

A scoping review of machine learning applications in power system protection and disturbance management,

J. Oelhafet al., “A scoping review of machine learning applications in power system protection and disturbance management,”International Journal of Electrical Power & Energy Systems, vol. 172, p. 111257, 2025

2025
[12]

The wisdom of the crowd: High-fidelity clas- sification of cyber-attacks and faults in power systems using ensemble and machine learning,

E. Abukhousa, S. S. F. Syed Afroz, F. Alsaeed, A. Qwbaiban, S. Zonouz, and A. P. S. Meliopoulos, “The wisdom of the crowd: High-fidelity clas- sification of cyber-attacks and faults in power systems using ensemble and machine learning,” inProc. IEEE PES Conf. Innovative Smart Grid Technologies – Middle East (ISGT Middle East), Dubai, UAE, 2025, pp. 1–6, a...

Pith/arXiv arXiv 2025
[13]

T4Tech: Open dataset and code for power sys- tem fault and cyber-attack classification,

E. Abukhousa, “T4Tech: Open dataset and code for power sys- tem fault and cyber-attack classification,” GitHub, 2025, available: https://github.com/Emadeddin/T4Tech. Accessed: August 28, 2025

2025
[14]

Latency-aware deep learning benchmark for real-time cyber-physical attack and fault classification in inverter-dominated power grids,

E. Abukhousa, S. Zonouz, and A. P. S. Meliopoulos, “Latency-aware deep learning benchmark for real-time cyber-physical attack and fault classification in inverter-dominated power grids,” inProc. IEEE PES Transmission & Distribution Conference and Exposition (T&D 2026), Chicago, IL, USA, 2026, accepted. Conference: https://ieeet-d.org/

2026
[15]

Setting-less protection: Feasibility study,

A. P. S. Meliopoulos, G. J. Cokkinides, Z. Tan, S. Choi, Y . Lee, and P. Myrda, “Setting-less protection: Feasibility study,” inProc. 46th Hawaii International Conference on System Sciences (HICSS), Wailea, HI, USA, 2013, pp. 2345–2353

2013
[16]

Dynamic state estimation-based protection: Status and promise,

A. P. S. Meliopoulos, G. J. Cokkinides, P. Myrda, Y . Liu, R. Fan, L. Sun, R. Huang, and Z. Tan, “Dynamic state estimation-based protection: Status and promise,”IEEE Transactions on Power Delivery, vol. 32, no. 1, pp. 320–330, Feb. 2017

2017
[17]

Centralized dynamic state estimation algorithm for detecting and distinguishing faults and cyber attacks in power systems,

E. Abukhousa, S. S. F. Syed Afroz, F. Alsaeed, A. Qwbaiban, and A. P. S. Meliopoulos, “Centralized dynamic state estimation algorithm for detecting and distinguishing faults and cyber attacks in power systems,” inProc. IEEE Power & Energy Society General Meeting (PESGM), Austin, TX, USA, 2025, pp. 1–5. [18]WinIGS Integrated Grounding System Analysis for W...

2025
[19]

Attention is all you need,

A. Vaswaniet al., “Attention is all you need,” inAdvances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017

2017

[1] [1]

Fault current contribution from synchronous machine and inverter based distributed generation,

N. Nimpitiwan, G. T. Heydt, R. Ayyanar, and S. Suryanarayanan, “Fault current contribution from synchronous machine and inverter based distributed generation,”IEEE Transactions on Power Delivery, vol. 22, no. 1, pp. 634–641, 2007

2007

[2] [2]

Influence of inverter-based resources on microgrid protection: Part 1: Microgrids in radial distribution systems,

M. J. Reno, S. Brahma, A. Bidram, and M. E. Ropp, “Influence of inverter-based resources on microgrid protection: Part 1: Microgrids in radial distribution systems,”IEEE Power and Energy Magazine, vol. 19, no. 3, pp. 36–46, 2021

2021

[3] [3]

Protection challenges under bulk penetration of renewable energy resources in power systems: A review,

V . Telukunta, J. Pradhan, A. Agrawal, M. Singh, and S. G. Srivani, “Protection challenges under bulk penetration of renewable energy resources in power systems: A review,”CSEE Journal of Power and Energy Systems, vol. 3, no. 4, pp. 365–379, Dec. 2017

2017

[4] [4]

1,200 MW fault induced solar photovoltaic resource interruption disturbance report — Blue Cut Fire event,

NERC/WECC Joint Task Force, “1,200 MW fault induced solar photovoltaic resource interruption disturbance report — Blue Cut Fire event,” North American Electric Reliability Corporation, At- lanta, GA, Tech. Rep., Jun. 2017, event Analysis Report. Available: https://www.nerc.com/

2017

[5] [5]

Attacking IEC 61850 substations by targeting the PTP protocol,

A. Akbarzadehet al., “Attacking IEC 61850 substations by targeting the PTP protocol,”Electronics, vol. 12, no. 12, p. 2596, 2023

2023

[6] [6]

A detection and mitigation model for PTP delay attack in an IEC 61850 substation,

B. Moussa, M. Debbabi, and C. Assi, “A detection and mitigation model for PTP delay attack in an IEC 61850 substation,”IEEE Transactions on Smart Grid, vol. 9, no. 5, pp. 3954–3965, Sep. 2018

2018

[7] [7]

Detection and mitigation of GPS spoofing attacks on phasor measurement units using deep learning,

A. S. Musleh, G. Chen, and Z. Y . Dong, “Detection and mitigation of GPS spoofing attacks on phasor measurement units using deep learning,” International Journal of Electrical Power & Energy Systems, vol. 127, p. 106635, 2021

2021

[8] [8]

Machine learning for power system dis- turbance and cyber-attack discrimination,

R. C. Borges Hinket al., “Machine learning for power system dis- turbance and cyber-attack discrimination,” inProc. 7th International Symposium on Resilient Control Systems (ISRCS), 2014, pp. 1–8

2014

[9] [9]

A deep learning-based cyberattack detection system for transmission protective relays,

Y . M. Khawet al., “A deep learning-based cyberattack detection system for transmission protective relays,”IEEE Transactions on Smart Grid, vol. 12, no. 3, pp. 2554–2565, May 2021

2021

[10] [10]

Deep learning based relay for online fault detection, classification, and fault location in a grid-connected microgrid,

B. Royet al., “Deep learning based relay for online fault detection, classification, and fault location in a grid-connected microgrid,”IEEE Access, vol. 11, pp. 62 677–62 693, 2023

2023

[11] [11]

A scoping review of machine learning applications in power system protection and disturbance management,

J. Oelhafet al., “A scoping review of machine learning applications in power system protection and disturbance management,”International Journal of Electrical Power & Energy Systems, vol. 172, p. 111257, 2025

2025

[12] [12]

The wisdom of the crowd: High-fidelity clas- sification of cyber-attacks and faults in power systems using ensemble and machine learning,

E. Abukhousa, S. S. F. Syed Afroz, F. Alsaeed, A. Qwbaiban, S. Zonouz, and A. P. S. Meliopoulos, “The wisdom of the crowd: High-fidelity clas- sification of cyber-attacks and faults in power systems using ensemble and machine learning,” inProc. IEEE PES Conf. Innovative Smart Grid Technologies – Middle East (ISGT Middle East), Dubai, UAE, 2025, pp. 1–6, a...

Pith/arXiv arXiv 2025

[13] [13]

T4Tech: Open dataset and code for power sys- tem fault and cyber-attack classification,

E. Abukhousa, “T4Tech: Open dataset and code for power sys- tem fault and cyber-attack classification,” GitHub, 2025, available: https://github.com/Emadeddin/T4Tech. Accessed: August 28, 2025

2025

[14] [14]

Latency-aware deep learning benchmark for real-time cyber-physical attack and fault classification in inverter-dominated power grids,

E. Abukhousa, S. Zonouz, and A. P. S. Meliopoulos, “Latency-aware deep learning benchmark for real-time cyber-physical attack and fault classification in inverter-dominated power grids,” inProc. IEEE PES Transmission & Distribution Conference and Exposition (T&D 2026), Chicago, IL, USA, 2026, accepted. Conference: https://ieeet-d.org/

2026

[15] [15]

Setting-less protection: Feasibility study,

A. P. S. Meliopoulos, G. J. Cokkinides, Z. Tan, S. Choi, Y . Lee, and P. Myrda, “Setting-less protection: Feasibility study,” inProc. 46th Hawaii International Conference on System Sciences (HICSS), Wailea, HI, USA, 2013, pp. 2345–2353

2013

[16] [16]

Dynamic state estimation-based protection: Status and promise,

A. P. S. Meliopoulos, G. J. Cokkinides, P. Myrda, Y . Liu, R. Fan, L. Sun, R. Huang, and Z. Tan, “Dynamic state estimation-based protection: Status and promise,”IEEE Transactions on Power Delivery, vol. 32, no. 1, pp. 320–330, Feb. 2017

2017

[17] [17]

Centralized dynamic state estimation algorithm for detecting and distinguishing faults and cyber attacks in power systems,

E. Abukhousa, S. S. F. Syed Afroz, F. Alsaeed, A. Qwbaiban, and A. P. S. Meliopoulos, “Centralized dynamic state estimation algorithm for detecting and distinguishing faults and cyber attacks in power systems,” inProc. IEEE Power & Energy Society General Meeting (PESGM), Austin, TX, USA, 2025, pp. 1–5. [18]WinIGS Integrated Grounding System Analysis for W...

2025

[18] [19]

Attention is all you need,

A. Vaswaniet al., “Attention is all you need,” inAdvances in Neural Information Processing Systems (NeurIPS), vol. 30, 2017

2017