{"id":"https://openalex.org/W7119476558","doi":"https://doi.org/10.48550/arxiv.2601.03495","title":"Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers","display_name":"Cyberattack Detection in Virtualized Microgrids Using LightGBM and Knowledge-Distilled Classifiers","publication_year":2026,"publication_date":"2026-01-07","ids":{"openalex":"https://openalex.org/W7119476558","doi":"https://doi.org/10.48550/arxiv.2601.03495"},"language":null,"primary_location":{"id":"pmh:oai:arXiv.org:2601.03495","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2601.03495","pdf_url":"https://arxiv.org/pdf/2601.03495","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"volume":null,"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2601.03495","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5117639383","display_name":"Osasumwen Cedric Ogiesoba-Eguakun","orcid":"https://orcid.org/0009-0006-8387-058X","observed_orcids":["https://orcid.org/0009-0006-8387-058X"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ogiesoba-Eguakun, Osasumwen Cedric","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5128804454","display_name":"Suman Rath","orcid":null,"observed_orcids":[]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Rath, Suman","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10223","display_name":"Microgrid Control and Optimization","score":0.0,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/cyberattack-detection","display_name":"cyberattack detection","score":0.9710000157356262},{"id":"https://openalex.org/keywords/virtual-microgrids","display_name":"virtual microgrids","score":0.7490000128746033},{"id":"https://openalex.org/keywords/microgrid-cybersecurity","display_name":"microgrid cybersecurity","score":0.9350000023841858},{"id":"https://openalex.org/keywords/lightgbm","display_name":"LightGBM","score":0.8209999799728394},{"id":"https://openalex.org/keywords/knowledge-distillation","display_name":"knowledge distillation","score":0.9990000128746033},{"id":"https://openalex.org/keywords/intrusion-detection","display_name":"intrusion detection","score":0.7409999966621399},{"id":"https://openalex.org/keywords/secondary-control","display_name":"secondary control","score":0.7239999771118164},{"id":"https://openalex.org/keywords/attack-classification","display_name":"attack classification","score":0.5839999914169312},{"id":"https://openalex.org/keywords/edge-deployment","display_name":"edge deployment","score":0.7879999876022339},{"id":"https://openalex.org/keywords/lightweight-machine-learning","display_name":"lightweight machine learning","score":0.6269999742507935},{"id":"https://openalex.org/keywords/denial-of-service-attacks","display_name":"denial-of-service attacks","score":0.6679999828338623},{"id":"https://openalex.org/keywords/stealthy-attacks","display_name":"stealthy attacks","score":0.4480000138282776}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7161999940872192},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6581000089645386},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5776000022888184},{"id":"https://openalex.org/C38822068","wikidata":"https://www.wikidata.org/wiki/Q131406","display_name":"Denial-of-service attack","level":3,"score":0.5192999839782715},{"id":"https://openalex.org/C123860398","wikidata":"https://www.wikidata.org/wiki/Q6934605","display_name":"Multiclass classification","level":3,"score":0.5059000253677368},{"id":"https://openalex.org/C2776784348","wikidata":"https://www.wikidata.org/wiki/Q5762595","display_name":"Microgrid","level":3,"score":0.4819999933242798},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.47940000891685486},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.43560001254081726},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4162999987602234},{"id":"https://openalex.org/C95623464","wikidata":"https://www.wikidata.org/wiki/Q1096149","display_name":"Classifier (UML)","level":2,"score":0.3882000148296356},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.383899986743927},{"id":"https://openalex.org/C201307755","wikidata":"https://www.wikidata.org/wiki/Q4071928","display_name":"Cyber-attack","level":2,"score":0.3578999936580658},{"id":"https://openalex.org/C149810388","wikidata":"https://www.wikidata.org/wiki/Q5374873","display_name":"Emulation","level":2,"score":0.3531000018119812},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.3398999869823456},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.33739998936653137},{"id":"https://openalex.org/C541664917","wikidata":"https://www.wikidata.org/wiki/Q14001","display_name":"Malware","level":2,"score":0.33340001106262207},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3237000107765198},{"id":"https://openalex.org/C203479927","wikidata":"https://www.wikidata.org/wiki/Q5165939","display_name":"Controller (irrigation)","level":2,"score":0.32350000739097595},{"id":"https://openalex.org/C25344961","wikidata":"https://www.wikidata.org/wiki/Q192726","display_name":"Virtual machine","level":2,"score":0.3156000077724457},{"id":"https://openalex.org/C113863187","wikidata":"https://www.wikidata.org/wiki/Q17498","display_name":"SCADA","level":2,"score":0.30550000071525574},{"id":"https://openalex.org/C46686674","wikidata":"https://www.wikidata.org/wiki/Q466303","display_name":"Boosting (machine learning)","level":2,"score":0.30410000681877136},{"id":"https://openalex.org/C138236772","wikidata":"https://www.wikidata.org/wiki/Q25098575","display_name":"Edge device","level":3,"score":0.2809000015258789},{"id":"https://openalex.org/C48372109","wikidata":"https://www.wikidata.org/wiki/Q3913","display_name":"Binary number","level":2,"score":0.25760000944137573},{"id":"https://openalex.org/C12267149","wikidata":"https://www.wikidata.org/wiki/Q282453","display_name":"Support vector machine","level":2,"score":0.25589999556541443},{"id":"https://openalex.org/C149635348","wikidata":"https://www.wikidata.org/wiki/Q193040","display_name":"Embedded system","level":1,"score":0.25529998540878296}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2601.03495","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2601.03495","pdf_url":"https://arxiv.org/pdf/2601.03495","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2601.03495","doi":"https://doi.org/10.48550/arxiv.2601.03495","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2601.03495","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2601.03495","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2601.03495","pdf_url":"https://arxiv.org/pdf/2601.03495","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[{"display_name":"Industry, innovation and infrastructure","id":"https://metadata.un.org/sdg/9","score":0.7207000255584717}],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7119476558.pdf","grobid_xml":"https://content.openalex.org/works/W7119476558.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Modern":[0],"microgrids":[1],"depend":[2],"on":[3,208],"distributed":[4],"sensing":[5],"and":[6,21,33,41,74,91,114,126,138,202,238],"communication":[7],"interfaces,":[8],"making":[9],"them":[10],"increasingly":[11],"vulnerable":[12],"to":[13,53,84,103,172],"cyber":[14],"physical":[15],"disturbances":[16],"that":[17,190],"threaten":[18],"operational":[19],"continuity":[20],"equipment":[22],"safety.":[23],"In":[24],"this":[25],"work,":[26],"a":[27,127,139,158,166,219],"complete":[28,220],"virtual":[29,80,222],"microgrid":[30,185,248],"was":[31,49,82],"designed":[32],"implemented":[34],"in":[35,161,184],"MATLAB/Simulink,":[36],"integrating":[37],"heterogeneous":[38],"renewable":[39],"sources":[40],"secondary":[42,60],"controller":[43],"layers.":[44],"A":[45,143],"structured":[46,225],"cyberattack":[47,204],"framework":[48],"developed":[50],"using":[51],"MGLib":[52],"inject":[54],"adversarial":[55],"signals":[56],"directly":[57],"into":[58],"the":[59,108,132,147,150,229],"control":[61,230],"pathways.":[62],"Multiple":[63],"attack":[64,92,117,226],"classes":[65],"were":[66],"emulated,":[67],"including":[68],"ramp,":[69],"sinusoidal,":[70],"additive,":[71],"coordinated":[72],"stealth,":[73],"denial":[75],"of":[76,110,149,169,218,234,241],"service":[77],"behaviors.":[78],"The":[79,94,120,187],"environment":[81],"used":[83],"generate":[85],"labeled":[86,236],"datasets":[87,95],"under":[88],"both":[89],"normal":[90],"conditions.":[93],"trained":[96],"Light":[97],"Gradient":[98],"Boosting":[99],"Machine":[100],"(LightGBM)":[101],"models":[102,244],"perform":[104],"two":[105],"functions:":[106],"detecting":[107],"presence":[109],"an":[111],"intrusion":[112,195],"(binary)":[113],"distinguishing":[115],"among":[116],"types":[118],"(multiclass).":[119],"multiclass":[121,151,235],"model":[122,134],"attained":[123,135],"99.72%":[124],"accuracy":[125,137],"99.62%":[128],"F1":[129,141],"score,":[130],"while":[131],"binary":[133],"94.8%":[136],"94.3%":[140],"score.":[142],"knowledge-distillation":[144],"step":[145],"reduced":[146],"size":[148],"model,":[152],"allowing":[153],"faster":[154],"predictions":[155],"with":[156],"only":[157],"small":[159],"drop":[160],"performance.":[162],"Real-time":[163],"tests":[164],"showed":[165],"processing":[167],"delay":[168],"about":[170],"54":[171],"67":[173],"ms":[174],"per":[175],"1000":[176],"samples,":[177],"demonstrating":[178],"suitability":[179],"for":[180,246],"CPU-based":[181],"edge":[182],"deployment":[183],"controllers.":[186],"results":[188],"confirm":[189],"lightweight":[191],"machine":[192],"learning":[193,211],"based":[194],"detection":[196,205],"methods":[197],"can":[198],"provide":[199],"fast,":[200],"accurate,":[201],"efficient":[203],"without":[206],"relying":[207],"complex":[209],"deep":[210],"models.":[212],"Key":[213],"contributions":[214],"include:":[215],"(1)":[216],"development":[217],"MATLAB-based":[221],"microgrid,":[223],"(2)":[224],"injection":[227],"at":[228],"layer,":[231],"(3)":[232],"creation":[233],"datasets,":[237],"(4)":[239],"design":[240],"low-cost":[242],"AI":[243],"suitable":[245],"practical":[247],"cybersecurity.":[249]},"counts_by_year":[],"updated_date":"2026-10-16T09:59:22.235173","created_date":"2026-01-09T00:00:00"}