在虚拟微电网中利用LightGBM和知识蒸馏分类器进行网络攻击检测
Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers
AI总结：
本文提出了一种基于LightGBM和知识蒸馏的轻量级机器学习方法，用于在虚拟微电网中高效检测网络攻击。
摘要：
现代微电网依赖于分布式传感和通信接口，使其对影响运营连续性和设备安全的网络物理干扰日益脆弱。本文设计并实现了完整的虚拟微电网，使用MATLAB/Simulink集成异构可再生能源和二次控制器层。使用MGLib开发了结构化的网络攻击框架，将对抗性信号直接注入到二次控制路径中。多个攻击类别被模拟，包括斜坡、正弦波、加性、协调隐身和拒绝服务行为。虚拟环境用于在正常和攻击条件下生成带标签的数据集。数据集训练Light Gradient Boosting Machine（LightGBM）模型执行两项功能：检测入侵的存在（二分类）和区分攻击类型（多类分类）。多类模型达到99.72%的准确率和99.62%的F1分数，而二分类模型达到94.8%的准确率和94.3%的F1分数。知识蒸馏步骤减少了多类模型的大小，使得预测速度更快，仅以微小的性能损失。实时测试显示处理延迟约为每1000个样本54至67毫秒，证明了在微电网控制器中基于CPU的边缘部署的适用性。结果证实了基于轻量级机器学习的入侵检测方法可以提供快速、准确和高效的网络攻击检测，而无需依赖复杂的深度学习模型。主要贡献包括：（1）开发了完整的MATLAB虚拟微电网，（2）在控制层进行结构化攻击注入，（3）创建了多类带标签的数据集，（4）设计了适合实际微电网网络安全的低成本AI模型。
英文摘要：
Modern microgrids depend on distributed sensing and communication interfaces, making them increasingly vulnerable to cyber physical disturbances that threaten operational continuity and equipment safety. In this work, a complete virtual microgrid was designed and implemented in MATLAB/Simulink, integrating heterogeneous renewable sources and secondary controller layers. A structured cyberattack framework was developed using MGLib to inject adversarial signals directly into the secondary control pathways. Multiple attack classes were emulated, including ramp, sinusoidal, additive, coordinated stealth, and denial of service behaviors. The virtual environment was used to generate labeled datasets under both normal and attack conditions. The datasets trained Light Gradient Boosting Machine (LightGBM) models to perform two functions: detecting the presence of an intrusion (binary) and distinguishing among attack types (multiclass). The multiclass model attained 99.72% accuracy and a 99.62% F1 score, while the binary model attained 94.8% accuracy and a 94.3% F1 score. A knowledge-distillation step reduced the size of the multiclass model, allowing faster predictions with only a small drop in performance. Real-time tests showed a processing delay of about 54 to 67 ms per 1000 samples, demonstrating suitability for CPU-based edge deployment in microgrid controllers. The results confirm that lightweight machine learning based intrusion detection methods can provide fast, accurate, and efficient cyberattack detection without relying on complex deep learning models. Key contributions include: (1) development of a complete MATLAB-based virtual microgrid, (2) structured attack injection at the control layer, (3) creation of multiclass labeled datasets, and (4) design of low-cost AI models suitable for practical microgrid cybersecurity.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
