{"id":"https://openalex.org/W6891906378","doi":"https://doi.org/10.48550/arxiv.2507.22239","title":"Large Language Model-Based Framework for Explainable Cyberattack Detection in Automatic Generation Control Systems","display_name":"Large Language Model-Based Framework for Explainable Cyberattack Detection in Automatic Generation Control Systems","publication_year":2025,"publication_date":"2025-07-29","ids":{"openalex":"https://openalex.org/W6891906378","doi":"https://doi.org/10.48550/arxiv.2507.22239"},"language":"en","primary_location":{"id":"doi:10.48550/arxiv.2507.22239","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2507.22239","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2507.22239","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Sharshar, Muhammad","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Sharshar, Muhammad","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Saber, Ahmad Mohammad","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Saber, Ahmad Mohammad","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Svetinovic, Davor","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Svetinovic, Davor","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Youssef, Amr M.","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Youssef, Amr M.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":null,"display_name":"Kundur, Deepa","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kundur, Deepa","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":null,"display_name":"El-Saadany, Ehab F.","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"El-Saadany, Ehab F.","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":true,"primary_topic":{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.9629999995231628,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.007199999876320362,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.004399999976158142,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5049999952316284},{"id":"https://openalex.org/keywords/smart-grid","display_name":"Smart grid","score":0.41690000891685486},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.39239999651908875},{"id":"https://openalex.org/keywords/error-detection-and-correction","display_name":"Error detection and correction","score":0.3785000145435333},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.37549999356269836},{"id":"https://openalex.org/keywords/digitization","display_name":"Digitization","score":0.34950000047683716},{"id":"https://openalex.org/keywords/sequential-probability-ratio-test","display_name":"Sequential probability ratio test","score":0.33570000529289246}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7281000018119812},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.538100004196167},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5049999952316284},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.4278999865055084},{"id":"https://openalex.org/C10558101","wikidata":"https://www.wikidata.org/wiki/Q689855","display_name":"Smart grid","level":2,"score":0.41690000891685486},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.39239999651908875},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.388700008392334},{"id":"https://openalex.org/C103088060","wikidata":"https://www.wikidata.org/wiki/Q1062839","display_name":"Error detection and correction","level":2,"score":0.3785000145435333},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.37549999356269836},{"id":"https://openalex.org/C2779308522","wikidata":"https://www.wikidata.org/wiki/Q843958","display_name":"Digitization","level":2,"score":0.34950000047683716},{"id":"https://openalex.org/C34602496","wikidata":"https://www.wikidata.org/wiki/Q2271882","display_name":"Sequential probability ratio test","level":2,"score":0.33570000529289246},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.3319999873638153},{"id":"https://openalex.org/C52622490","wikidata":"https://www.wikidata.org/wiki/Q1026626","display_name":"Feature extraction","level":2,"score":0.2939999997615814},{"id":"https://openalex.org/C17020691","wikidata":"https://www.wikidata.org/wiki/Q139677","display_name":"Operator (biology)","level":5,"score":0.2928999960422516},{"id":"https://openalex.org/C187691185","wikidata":"https://www.wikidata.org/wiki/Q2020720","display_name":"Grid","level":2,"score":0.2856000065803528},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.27230000495910645},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2639000117778778},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.25780001282691956},{"id":"https://openalex.org/C184297639","wikidata":"https://www.wikidata.org/wiki/Q177765","display_name":"Biometrics","level":2,"score":0.2549000084400177}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2507.22239","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2507.22239","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2507.22239","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2507.22239","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.7708934545516968}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"increasing":[1],"digitization":[2],"of":[3,113,138],"smart":[4,179],"grids":[5],"has":[6],"improved":[7],"operational":[8],"efficiency":[9],"but":[10],"also":[11],"introduced":[12],"new":[13],"cybersecurity":[14],"vulnerabilities,":[15],"such":[16,43,77],"as":[17,78],"False":[18],"Data":[19],"Injection":[20],"Attacks":[21],"(FDIAs)":[22],"targeting":[23],"Automatic":[24],"Generation":[25],"Control":[26],"(AGC)":[27],"systems.":[28],"While":[29],"machine":[30],"learning":[31,35],"(ML)":[32],"and":[33,51,106,145],"deep":[34],"(DL)":[36],"models":[37],"have":[38],"shown":[39],"promise":[40],"in":[41,129,141,152,178],"detecting":[42,94],"attacks,":[44],"their":[45],"opaque":[46],"decision-making":[47],"limits":[48],"operator":[49],"trust":[50],"real-world":[52],"applicability.":[53],"This":[54],"paper":[55],"proposes":[56],"a":[57,95,134,172],"hybrid":[58],"framework":[59,162],"that":[60,159],"integrates":[61],"lightweight":[62],"ML-based":[63],"attack":[64,84,132,143,154],"detection":[65,85,166],"with":[66,87,123,167],"natural":[67],"language":[68],"explanations":[69],"generated":[70],"by":[71],"Large":[72],"Language":[73],"Models":[74],"(LLMs).":[75],"Classifiers":[76],"LightGBM":[79],"achieve":[80],"up":[81],"to":[82,109],"95.13%":[83],"accuracy":[86,128],"only":[88],"0.004":[89],"s":[90],"inference":[91],"latency.":[92],"Upon":[93],"cyberattack,":[96],"the":[97,114,131,160],"system":[98],"invokes":[99],"LLMs,":[100],"including":[101],"GPT-3.5":[102],"Turbo,":[103,105],"GPT-4":[104],"GPT-4o":[107,121],"mini,":[108],"generate":[110],"human-readable":[111],"explanation":[112],"event.":[115],"Evaluated":[116],"on":[117],"100":[118],"test":[119],"samples,":[120],"mini":[122],"20-shot":[124],"prompting":[125],"achieved":[126],"93%":[127],"identifying":[130],"target,":[133],"mean":[135,148],"absolute":[136,149],"error":[137,150],"0.075":[139],"pu":[140],"estimating":[142,153],"magnitude,":[144],"2.19":[146],"seconds":[147],"(MAE)":[151],"onset.":[155],"These":[156],"results":[157],"demonstrate":[158],"proposed":[161],"effectively":[163],"balances":[164],"real-time":[165],"interpretable,":[168],"high-fidelity":[169],"explanations,":[170],"addressing":[171],"critical":[173],"need":[174],"for":[175],"actionable":[176],"AI":[177],"grid":[180],"cybersecurity.":[181]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2025-10-10T00:00:00"}