Explainable AI-Enhanced Detection of Cyber Attacks on AGC Systems with Varying RES Penetration

This study addresses the limitations of traditional methods in detecting False Data Injection Attacks (FDIA) on Automatic Generation Control (AGC) systems, particularly due to State Estimation (SE) algorithms' tolerance for measurement errors. To overcome these limitations, six machine learning algorithms are compared across different levels of Renewable Energy Source (RES) penetration. As RES levels increase, the impact of cyber-attacks becomes more pronounced, with Convolutional Neural Networks (CNN) maintaining high performance, followed closely by the Bagged Trees (BT), algorithm as the second most successful. Additionally, Explainable Artificial Intelligence (XAI) techniques, such as Shapley Additive Explanations (SHAP), are used to clarify the role of critical features, like frequency and Area Control Error (ACE), in attack detection, making the model's decision-making process more transparent for system operators. The AGC model was implemented in MATLAB/Simulink within a two-area, four-machine power system, using realistic turbine and speed governor models rather than linearized approximations. Results show that CNN and BT are highly effective in FDIA detection within high RES environments, indicating their reliability for enhancing AGC system security under realistic operational conditions. Furthermore, the interpretability provided by SHAP assists operators in understanding how critical measurements affect detection, thus building confidence in Artificial Intelligence (AI) driven protective mechanisms for modern power grids.

1. Introduction

AGC is a critical mechanism used in multi-area power systems to maintain system frequency and manage tie-line power flows. Specifically, AGC monitors the ACE, which reflects both frequency deviation (i.e., how far the system frequency is from its nominal value) and tie-line power exchange deviation between interconnected areas. By adjusting generator setpoints, the AGC ensures that each area's frequency remains close to the nominal level (e.g., 50 or 60 Hz) and that scheduled power transfers across tie-lines are upheld. The frequency and tie-line measurements obtained by the sensors are transmitted to the control center of each area via the Distributed Network Protocol (DNP3), which has vulnerabilities against cyber-attacks [1]–[2]. Attackers who use these vulnerabilities can inj ect false data into the system that will affect the operation of the AGC. Recent studies demonstrate that optimal false data injection attacks (OFDIAs) on AGC systems can bypass conventional bad data detection mechanisms, leading to significant consequences such as frequency instability or triggering protection mechanisms like load shedding relays. These attacks leverage precise manipulation of tie-line power and generator frequency measurements, highlighting vulnerabilities in existing control frameworks [3]. Although there are many studies examining the effects of cyber-attacks on the AGC system, the exploration of detection methods in the presence of high levels of RES remains limited.