Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers

TL;DR

This work tackles cyber-physical security in inverter-based microgrids by developing a high-fidelity virtual microgrid in MATLAB/Simulink and injecting structured attacks at the secondary-control interface. It trains LightGBM classifiers for binary intrusion detection and seven-class attack-type classification, achieving 94.8% and 99.72% accuracy, respectively, and demonstrates real-time, CPU-only edge deployment. Knowledge distillation compresses the multiclass detector into a lightweight student model with about a 73% reduction in inference time, enabling on-device execution. The combination of realistic cyber-physical modeling, labeled high-resolution data, and lightweight tree-based detectors provides a practical, scalable cybersecurity framework for modern microgrids with diverse DERs. The approach offers fast, accurate, and memory-efficient protection that can extend to edge-to-cloud architectures and federated settings across heterogeneous grid architectures.

Abstract

Modern microgrids depend on distributed sensing and communication interfaces, making them increasingly vulnerable to cyber physical disturbances that threaten operational continuity and equipment safety. In this work, a complete virtual microgrid was designed and implemented in MATLAB/Simulink, integrating heterogeneous renewable sources and secondary controller layers. A structured cyberattack framework was developed using MGLib to inject adversarial signals directly into the secondary control pathways. Multiple attack classes were emulated, including ramp, sinusoidal, additive, coordinated stealth, and denial of service behaviors. The virtual environment was used to generate labeled datasets under both normal and attack conditions. The datasets trained Light Gradient Boosting Machine (LightGBM) models to perform two functions: detecting the presence of an intrusion (binary) and distinguishing among attack types (multiclass). The multiclass model attained 99.72% accuracy and a 99.62% F1 score, while the binary model attained 94.8% accuracy and a 94.3% F1 score. A knowledge-distillation step reduced the size of the multiclass model, allowing faster predictions with only a small drop in performance. Real-time tests showed a processing delay of about 54 to 67 ms per 1000 samples, demonstrating suitability for CPU-based edge deployment in microgrid controllers. The results confirm that lightweight machine learning based intrusion detection methods can provide fast, accurate, and efficient cyberattack detection without relying on complex deep learning models. Key contributions include: (1) development of a complete MATLAB-based virtual microgrid, (2) structured attack injection at the control layer, (3) creation of multiclass labeled datasets, and (4) design of low-cost AI models suitable for practical microgrid cybersecurity.

Figures (9)

• Figure 1: Architecture of the 10-DG virtual AC microgrid, showing the cyber layer, distributed secondary controller ($\xi_i$, $\zeta_i$ consensus), and local P--f / Q--V droop controllers.
• Figure 2: Cascaded control architecture of an inverter-based distributed generator (DG) unit, showing secondary control inputs, droop regulation, PLL synchronization, voltage and current control loops, and PWM inverter interface.
• Figure 3: Communication Pathways of the Secondary Control Layer With the Injection Point of the Corrupted Consensus Signals.
• Figure 4: Overview of the six secondary-control cyberattack patterns applied to the consensus signal $\xi_i (t)$ and $\zeta_i(t)$.
• Figure 5: Illustration of noise and discretization effects in the virtual microgrid, showing PWM switching ripple in voltage and current signals, quantization steps from digital measurement, and small timing jitter in the consensus updates of the secondary controller.