Decision-Focused Learning for Cyber-Physical Risk-Aware Power Grid Operations

arXiv:2610.13853v1 [cs.CR] 9 Oct 2026

Decision-Focused Learning for Cyber-Physical Risk-Aware Power Grid Operations Afzal Hossain Sohag

Ayesha S. Dina

Ebisa D. Wollega

Department of Computer Science Florida Polytechnic University Lakeland, FL, USA asohag3061@floridapoly.edu

Department of Computer Science Florida Polytechnic University Lakeland, FL, USA adina@floridapoly.edu

Department of Industrial Engineering Florida Polytechnic University Lakeland, FL, USA ewollega@floridapoly.edu

Abstract—Power grid cyber-physical security requires intrusion detection methods that account for the operational consequences of detection errors. However, the existing intrusion detection approaches primarily focus on the predictive performance of learning algorithms, while downstream operational costs are often optimized independently, which can lead to inferior operational performance. To help alleviate this problem, we propose a novel optimization-learning cyber-physical-riskinformed framework that communicates iteratively to minimize power grid operational costs. This framework translates machine learning prediction errors into power grid operational cyberphysical-risk costs. Experimental results on two power grid operation datasets, Industrial Control System (ICS) Cyber Attack and Sherlock, show that the proposed approach improves power grid operation costs compared with the traditional approach. Index Terms—Intrusion Detection, Decision-Focused Learning, Cyber-Physical-Risk, Power Grid Operations. This work has been submitted to the IEEE for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

I. I NTRODUCTION Modern power systems are evolving into highly interconnected smart grids that integrate communication, automation, distributed energy resources, and real-time monitoring. The increased deployment of sensors, smart meters, supervisory control and data acquisition (SCADA) systems, and intelligent control devices has significantly improved operational efficiency, reliability, and energy management capabilities. However, this digitalization also introduces security challenges because power grid operation increasingly depends on communication networks and cyber-physical interactions [1], [2]. Unlike conventional isolated power systems, power grids continuously exchange operational information among generators, substations, control centers, and consumers. This interconnection increases exposure to cyber-physical threats such as false data injection (FDI), denial-of-service (DoS), malware, and communication tampering [3], [4]. Existing studies have shown that attackers can manipulate sensor measurements or communication signals to disrupt state estimation, destabilize system operation, and interfere with economic dispatch procedures [3], [5], [6]. Such intrusions can cause poor operational decisions, financial losses, cascading failures, and service interruptions. Among these threats, FDI attacks are a major

cybersecurity risk in modern smart grids [3], [4]. Because operational decisions rely on accurate state estimation and real-time measurements, compromised data can directly affect generator scheduling, load balancing, and grid optimization. To mitigate these risks, several cyber-physical security solutions have been proposed, including intrusion detection systems (IDSs), anomaly detection, encryption, and secure communication architectures [1], [2], [4]. Machine learningbased intrusion detection approaches can identify complex attack patterns and abnormal behaviors in cyber-physical environments, including suspicious measurements in substation communication systems [7]–[10]. Existing studies have investigated supervised learning, unsupervised learning, and process-aware intrusion detection methods for detecting cyberphysical attacks in power grid systems [7], [8], [11]. Although these approaches have demonstrated promising detection performance, many existing methods primarily optimize predictive metrics such as accuracy, recall, precision, and F1score without considering the downstream operational cost of prediction errors on power system decision-making. Significant research has also been conducted on resilient economic dispatch, robust optimization, and secure operational planning under attacks and uncertain operating conditions [6], [12]. Integrity and FDI attacks can destabilize dispatch decisions and disrupt electricity market operation [3], [5], [6]. Robust optimization approaches have been proposed to improve reliability and robustness in power systems [12]. However, existing studies have investigated cyber-physical attack detection and resilient economic dispatch, with comparatively less emphasis on how detection errors translate into operational cost [13]–[15]. Decision-focused learning framework integrates machine learning with downstream optimization objectives [16]–[19]. Unlike traditional predict-then-optimize pipelines, these approaches directly optimize decision quality rather than prediction accuracy alone. Although decision-focused learning has shown promise in operational optimization, limited research has integrated cyber-physical-risk-aware intrusion detection, and power grid operations optimization. To address these limitations, this paper proposes a cyberphysical-risk-aware intrusion detection and power grid opti-

mization framework for cyber-physical power systems. The proposed framework integrates machine learning-based intrusion detection with power grid operational optimization by transforming intrusion detection misclassification outcomes into generator-level cyber-physical-risk costs that guide power grid operational planning. Unlike traditional intrusion detection systems that primarily evaluate predictive performance, the proposed framework incorporates asymmetric misclassification penalties to represent the different operational consequences of false positives and false negatives within the power grid optimization. The framework is evaluated on two benchmark cyberphysical power-system datasets to examine the relationship between intrusion detection performance and operational cost. The main contributions of this work are summarized as follows: Development of an optimization-informed cyberphysical-risk framework that integrates machine learning-based intrusion detection with power grid operational optimization. • Transformation of intrusion detection misclassification outcomes into generator-level cyber-physical-risk costs for power grid operational optimization. • Development of an iterative feature-reweighting mechanism that uses learned IDS parameters to update the feature representation for subsequent IDS retraining. • An evaluation of intrusion detection performance and operational cost on two benchmark cyber-physical powersystem datasets with different grid topologies and attack scenarios.

•

II. P ROBLEM F ORMULATION A. Power System Model The proposed framework considers a cyber-physical power system in which operational decisions are jointly influenced by conventional generation costs and cyber-physical security risk. Building on prior work on cyberattack-resilient economic dispatch and power-system optimization [6], [12], [14], the framework integrates machine learning-based intrusion detection with operational optimization to incorporate cyberphysical-risk information into dispatch decisions. Fig. 1 illustrates the cyber-physical interaction between the communication and control infrastructure and the physical power system. Operational measurements are transmitted from the physical layer through the communication network to the control system, while control commands are returned to the physical layer. Cyber-physical attacks targeting this information flow can compromise operational measurements and potentially affect subsequent power grid decisions. Let G denote the set of generators and L denote the set of system loads. The power allocation decision variable is defined as xij ≥ 0,

∀i ∈ G, j ∈ L

(1)

Fig. 1. Cyber-physical power system architecture illustrating the cyberphysical interaction underlying the research problem.

where xij represents the amount of power supplied from generator i to load j. Each generator is associated with an operating cost Ci , and each generator-to-load line has an associated transmission cost Tij . During the iterative framework, generator operating costs are adjusted according to the cyber-physical risk estimated from intrusion detection outcomes. The resulting cyber-physical-risk-adjusted generator costs are subsequently incorporated into the power grid operational optimization model presented in Section II-E. B. Misclassification Cost Formulation The proposed framework incorporates intrusion detection outcomes into the power-grid operational optimization process by assigning operational penalties to different types of prediction errors. False-positive (FP) and false-negative(FN) outcomes can have different consequences in cyber-physical power systems, particularly because undetected compromises may propagate into subsequent operational decisions [20], [21]. Let yk denote the true label of sample k, and let ŷk denote the predicted label generated by the intrusion detection model. Instead of treating all prediction errors equally, different penalties are assigned to the possible misclassification outcomes:   CF N , yk = 1 and ŷk = 0 ck = CF P , yk = 0 and ŷk = 1 (2)   0, otherwise where CF N and CF P represent the false-negative and falsepositive penalties, respectively. The framework allows asymmetric misclassification costs, with configurations assigning a larger penalty to false negatives to represent the potentially greater operational consequences of undetected attacks. C. Generator-Level Cyber-physical-Risk Aggregation Each sample k is assigned to a generator g(k) ∈ G based on the scenario-to-generator mapping defined during dataset preprocessing. This mapping enables intrusion detection outcomes to be linked to individual generators and allows

sample-level misclassification penalties to be aggregated into generator-level misclassification costs. The total misclassification cost associated with generator i is computed as X Mi = ck (3) k:g(k)=i

where Mi represents the total misclassification cost associated with generator i. To obtain comparable cyber-physical-risk contributions across generators, the aggregated costs are normalized as M̃i = P

Mi i∈G Mi

(4)

where M̃i denotes the normalized cyber-physical-risk contribution associated with generator i. The normalized values are subsequently used to compute the cyber-risk-adjusted operating costs presented in the following subsection. D. Cyber-Risk Cost Integration The normalized cyber-physical-risk associated with each generator is transformed into a cyber-physical-risk cost that can be incorporated into the power grid operational optimization model: Cirisk,t = α · M̃i

(5)

where α is a scaling parameter controlling the influence of cyber-physical risk on power grid operational optimization. Cirisk,t represents the generator-level cyber-physical-risk cost computed during iteration t of the learning step. Before initiating the iterative learning process, the generator-level cyber-physical-risk costs are computed using the baseline intrusion detection model. For each hyperparameter configuration, a baseline Logistic Regression model is first trained to obtain the baseline F1-score and model coefficients, which are then used to identify false-positive and false-negative samples and compute the corresponding generator-level cyber-physical-risk costs. The corresponding baseline generator operating cost is defined as Cibaseline = Ci + Cirisk,0

(6)

Cirisk,0

where denotes the baseline generator-level cyberphysical-risk cost. This baseline cost serves as the reference for evaluating operational-cost changes during the iterative framework. Using these baseline effective generator costs in the dispatch optimization model, the resulting objective value is denoted by Z baseline . During each iteration, the intrusion detection model is retrained using feature weights derived from the logistic regression coefficients of the preceding iteration, producing updated predictions and generator-level cyber-physical-risk estimates. Consequently, the generator operating cost is updated as Cinew = Ci + Cirisk,t

(7)

where Ci denotes the original operating cost of generator i. The updated generator costs are subsequently incorporated into the power grid operational optimization model, increasing the effective operating cost of generators with higher cyberphysical-risk penalties. E. Cyber-Risk-Aware Dispatch Optimization The proposed framework integrates cyber-physical-risk information into the dispatch optimization model by augmenting the generator cost with cyber-physical-risk penalties derived from intrusion detection outcomes. The objective is to minimize the total operational cost while accounting for potential cyber-physical-security risks associated with individual generators. The cyber-physical-risk-adjusted generator cost Cinew , defined in (7), is incorporated into the dispatch optimization problem. Using the adjusted generator cost, the dispatch optimization problem is formulated as: XX Z = min (Cinew + Tij ) xij (8) i∈G j∈L

subject to the following constraints. Generator capacity constraints ensure that the total power supplied by each generator does not exceed its maximum generation capability: X xij ≤ GenCapi , ∀i ∈ G (9) j∈L

where GenCapi denotes the capacity limit of generator i. Transmission capacity constraints limit the amount of power that can be transmitted through each generator-load connection: xij ≤ LineCapij ,

∀i ∈ G, j ∈ L

(10)

where LineCapij represents the transmission capacity between generator i and load j. Load demand constraints ensure that system demand is satisfied: X xij ≥ Dj , ∀j ∈ L (11) i∈G

where Dj denotes the demand requirement of load j. By incorporating cyber-physical-risk penalties into the objective function, the proposed framework assigns higher costs to generators associated with greater cyber-physical risk, which can influence their dispatch subject to the system constraints. F. Iterative Feature-Reweighting Learning Process The proposed framework iteratively updates feature weights using the logistic regression coefficients learned in the previous iteration. Let w(t) denote the feature-weight vector obtained from the intrusion detection model at iteration t. The baseline IDS

Algorithm 1 Optimization-Learning Cyber-Physical-RiskInformed Framework 1: Input: Dataset D = (X, y), generator assignments g, power grid parameters, α, CF P , CF N 2: Train baseline IDS and obtain coefficient vector w (0) 3: Compute baseline cyber-physical-risk cost and obtain Z baseline 4: Initialize feature weights w ← w (0) ; Z best ← Z baseline 5: for t = 1, . . . , T do 6: Learn IDS using X(t) and y; obtain coefficient vector w(t) (t) 7: Estimate ŷk and compute ck 8: Compute Mi , M̃i , and Cirisk,t 9: Compute Cinew (t) 10: Obtain Z (t) and dispatch plan xij (t) 11: Update feature weights w ← w 12: Z best ← min{Z best , Z (t) } 13: end for 14: return Power grid operational plan associated with Z best

is first trained, producing the initial feature-weight vector w(0) . At each subsequent iteration, the training feature matrix is transformed using the feature weights obtained from the previous iteration: X(t) = X ⊙ w(t−1) ,

(12)

where X denotes the original training feature matrix and ⊙ represents element-wise multiplication. The IDS is then retrained using the transformed feature matrix X(t) and training labels y:   w(t) = IDS X(t) , y . (13) In the proposed implementation, the IDS is realized using logistic regression, and w(t) corresponds to its learned coefficient vector. For each iteration, the retrained IDS generates (t) predictions ŷk , which are used to determine false-positive and false-negative outcomes. These outcomes are used to recompute generator-level cyber-physical-risk costs, which are incorporated into the dispatch optimization. G. Framework Algorithm The overall workflow of the proposed framework is summarized in Algorithm 1. The algorithm shows the iterative interaction between intrusion detection, generator-level cyber-physical-risk estimation, and cyber-physical-risk-aware dispatch optimization. The minimum operational cost across the predefined iterations is retained as Z best . III. E XPERIMENTAL S ETUP A. Dataset and Preprocessing We evaluate the proposed framework on the ICS Power System Dataset [22] and the Sherlock 01-Basic dataset [11]. The

TABLE I E XPERIMENTAL PARAMETERS Parameter Baseline Learning Iterations Optimization-Learning Framework Iterations False Negative Cost (CF N ) False Positive Cost (CF P ) Cyber-Risk Scaling (α) Optimization Solver

Value 2000 100 Tuned Tuned Tuned Gurobi

ICS dataset comprises 78,377 samples with 128 input features. Scenario identifiers are converted into binary benign/attack labels, and samples are assigned to two generator groups using the scenario-based generator mapping. Missing values are replaced using feature-wise median imputation, followed by standardization using statistics fitted on the training set. The Sherlock 01-Basic dataset contains 43,204 samples with 470 state features representing grid measurements and states with binary attack labels. Missing values are imputed using training-set medians, followed by training-set standardization. For generator-level cyber-physical-risk aggregation, each sample is assigned to the generator with the maximum standardized active-power measurement. B. Experimental Configuration The intrusion detection component learns through logistic regression, while the cyber-physical-risk-aware economic dispatch is optimized using a linear programming formulation via the Gurobi optimizer [23]. Power generator cyber-physicalrisk costs are added to the operating costs before dispatch. The dispatch model uses two generators for the ICS dataset, and seven assigned generators for the Sherlock dataset. A grid search was conducted over the predefined values of α, CF P , and CF N to evaluate their effects on operational cost. Each parameter configuration is evaluated for 100 framework iterations. Dataset-specific generator capacities, operating costs, and load demands are configured according to the respective experimental models. The experimental parameters are summarized in Table I. C. Cyber-Physical Risk Hyperparameter Selection Three hyperparameters were tuned: the cyber-physical-risk scaling factor (α), the false-positive cost (CF P ), and the falsenegative cost (CF N ). An exhaustive grid search was performed over predefined candidate values. Each parameter configuration was evaluated using the same 100-iteration framework, and the configuration yielding the minimum operational dispatch cost was selected as the final setting, which power grid operators can use for decision making. D. Evaluation Metrics The proposed framework was evaluated from both intrusion detection and power-system operation perspectives. Intrusion detection performance was measured using the F1-score, which provides a balanced assessment of precision and recall under class-imbalanced conditions.

Baseline Cost 1e5

α = 100 (a)

Operational Cost

1.205

ICS

1e5

α = 1, 000

1e6

(b)

3.21

1.204

3.20

1.203

3.19

1.202

3.18 FP=1 FN=1

FP=5 FN=1000

1e5

α=1

FP=50 FN=1000

FP=1 FN=1

FP=5 FN=1000

1e5

α = 10

Operational Cost

(f)

9.090670

9.11020

9.090665

9.11015

9.090660

9.11010 FP=1 FN=1

FP=5 FN=1000

FP=50 FN=1000

α = 10, 000

2.33

1e7

(c)

1.120

2.31

1.115

2.30

1.110 FP=1 FN=1

FP=5 FN=1000

1e5

α = 50

FP=50 FN=1000

FP=50 FN=1000

FP=1 FN=1

FP=5 FN=1000

1e5

α = 100

FP=50 FN=1000

(h) 9.3055 9.3050

9.081

FP=5 FN=1000

(d)

(g)

9.083 9.082

FP=1 FN=1

α = 50, 000

1.125

2.32

FP=50 FN=1000

(e)

Sherlock

Best Cost

9.3045 FP=1 FN=1

FP=5 FN=1000

FP=50 FN=1000

FP=1 FN=1

FP=5 FN=1000

FP=50 FN=1000

Fig. 2. Sensitivity of operational cost to the cyber-physical-risk scaling parameter α for the ICS dataset (top row) and Sherlock dataset (bottom row). Dashed lines represent the baseline cost, while solid lines represent the minimum cost obtained during the iterative process.

TABLE II C OST I MPROVEMENT ACROSS FP/FN C ONFIGURATIONS α 1 10 50 100 1,000 5,000 10,000 50,000

ICS (%) 0.00046 0.00448 0.01803 0.03734 0.14001 0.18529 0.19309 0.19983

Sherlock (%) 0.00076 0.00754 0.01654 0.07376 0.00000 0.00000 0.00000 0.00000

Operational performance was evaluated using the total dispatch cost obtained from the cyber-physical-risk-aware optimization model, incorporating generation, transmission, and cyber-physical-risk-adjusted operating costs. Since operational cost is the primary objective of the framework, the configuration with the minimum operational dispatch cost was selected during hyperparameter tuning. The model baseline performs intrusion detection and cyber-physical-risk cost computation economic dispatch without iterative feature reweighting. Its effectiveness was assessed by comparing the F1-score and operational dispatch cost to the proposed cyber-physical-riskinformed optimization-learning framework. IV. R ESULTS AND D ISCUSSION

false-negative misclassification costs on operational dispatch cost. For each hyperparameter configuration, the minimum operational cost observed over the 100 framework iterations was compared with its corresponding baseline cost. Figure 2 illustrates the sensitivity of operational cost to α for the ICS and Sherlock datasets. The top row presents the ICS results, while the bottom row presents the Sherlock results. For each α value, the baseline and minimum operational costs are compared for three representative FP/FN configurations. For the ICS dataset, cost improvement increases with α, but the additional gains become limited beyond α = 5,000. For the Sherlock dataset, the maximum cost improvement increases up to α = 100, while no improvement is observed for α ≥ 1,000. These results indicate that the effect of cyber-risk scaling depends on the dataset and misclassification-cost configuration. The results show that the effect of α on operational cost varies across datasets and FP/FN cost configurations. B. ICS Dataset Results Table II summarizes the maximum cost improvement obtained across the FP/FN configurations for each α. The improvement increased from 0.00046% at α = 1 to 0.19983% at α = 50,000. However, the additional improvement became limited beyond α = 5,000, indicating diminishing gains from further increasing the cyber-physical-risk scaling factor.

A. Cyber-Physical-Risk Hyperparameter Sensitivity Analysis

C. Sherlock Dataset Results

A sensitivity analysis was conducted to examine the effects of the cyber-risk scaling parameter α and the false-positive and

As shown in Table II, the maximum cost improvement increased from 0.00076% at α = 1 to 0.07376% at α = 100.

No cost improvement was observed for α ≥ 1,000 across the evaluated FP/FN configurations. D. Discussion The experiments show that the effect of cyber-physical-riskaware iterative feature reweighting on operational cost depends on the underlying dataset. For the ICS dataset, increasing α continued to improve the minimum observed operational cost, although the incremental gains became smaller at higher values. In contrast, the Sherlock dataset showed increasing improvement up to α = 100, followed by no observed improvement for α ≥ 1,000. These differences indicate that the operational effect of cyber-risk scaling is dataset-dependent and may be influenced by the distribution of misclassification risk across generators and its interaction with the dispatch constraints. The two benchmarks differ in system structure, feature representation, and generator-level sample assignment, which may contribute to the different sensitivity patterns observed in the experiments. Overall, the results demonstrate that iterative feature reweighting can produce lower operational dispatch costs than the corresponding baseline for selected parameter configurations, while F1-score provides a complementary measure of intrusion detection performance. V. C ONCLUSION This paper presented an optimization-informed cyberphysical-risk framework that integrates machine learningbased intrusion detection with power grid operational optimization through iterative feature reweighting. The proposed approach transforms intrusion detection misclassification outcomes into generator-level cyber-physical-risk costs and incorporates these costs into the operational dispatch model. Previous logistic regression weights are then used as feature weights for subsequent intrusion detection iterations, enabling iterative interaction between intrusion detection and cyber-riskaware operational optimization. The proposed framework was evaluated using the Sherlock and Industrial Control System (ICS) power-system datasets under different cyber-physicalrisk and misclassification-cost configurations. Experimental results showed that the effect of the framework on operational cost depends on the dataset and parameter configuration, with lower operational costs observed for selected configurations relative to their corresponding baselines. The hyperparameter sensitivity analysis further demonstrated different responses to the cyber-physical-risk scaling factor across the two datasets, while F1-score provided a complementary measure of intrusion detection performance. Future work will investigate the proposed framework using larger power-system benchmarks, additional intrusion detection models, and additional operational constraints to further evaluate cyber-physical-risk-aware power grid operation. R EFERENCES [1] C.-C. Sun, A. Hahn, and C.-C. Liu, “Cyber security of a power grid: State-of-the-art,” International Journal of Electrical Power & Energy Systems, vol. 99, pp. 45–56, 2018.

[2] T. Krause, R. Ernst, B. Klaer, I. Hacker, and M. Henze, “Cybersecurity in power grids: Challenges and opportunities,” Sensors, vol. 21, no. 18, p. 6225, 2021. [3] Y. Liu, P. Ning, and M. K. Reiter, “False data injection attacks against state estimation in electric power grids,” ACM Transactions on Information and System Security (TISSEC), vol. 14, no. 1, pp. 1–33, 2011. [4] Y. Yan, Y. Qian, H. Sharif, and D. Tipper, “A survey on cyber security for smart grid communications,” IEEE communications surveys & tutorials, vol. 14, no. 4, pp. 998–1010, 2012. [5] R. Tan, V. B. Krishna, D. K. Yau, and Z. Kalbarczyk, “Integrity attacks on real-time pricing in electric power grids,” ACM Transactions on Information and System Security (TISSEC), vol. 18, no. 2, pp. 1–33, 2015. [6] F. Yang, P. Kang, and X. Guan, “Distributed economic dispatch for cyber attacked smart grid based on resilient event-triggered consensus,” in 2020 59th IEEE Conference on Decision and Control (CDC). IEEE, 2020, pp. 5725–5730. [7] N. Müller, C. Ziras, and K. Heussen, “Assessment of cyber-physical intrusion detection and classification for industrial control systems,” in 2022 IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SmartGridComm). IEEE, 2022, pp. 432–438. [8] N. Sahani, R. Zhu, J.-H. Cho, and C.-C. Liu, “Machine learningbased intrusion detection for smart grid computing: A survey,” ACM Transactions on Cyber-Physical Systems, vol. 7, no. 2, pp. 1–31, 2023. [9] N. I. Haque, M. H. Shahriar, M. G. Dastgir, A. Debnath, I. Parvez, A. Sarwat, and M. A. Rahman, “Machine learning in generation, detection, and mitigation of cyberattacks in smart grid: A survey,” arXiv preprint arXiv:2010.00661, 2020. [10] S. Sourav, P. P. Biswas, V. Mohanraj, B. Chen, and D. Mashima, “Machine learning assisted bad data detection for high-throughput substation communication,” in ICC 2023-IEEE International Conference on Communications. IEEE, 2023, pp. 4131–4137. [11] E. Wagner, L. Bader, K. Wolsing, and M. Serror, “Sherlock: A dataset for process-aware intrusion detection research on power grid networks: Dataset paper,” in Proceedings of the Fifteenth ACM Conference on Data and Application Security and Privacy, 2024, pp. 419–424. [12] X. Sun, T. Terlaky, M. Anjos, and S. Ahmed, “Robust optimization in electric power systems,” Advances and Trends in Optimization with Engineering Applications, pp. 357–365, 2017. [13] X. Li, J. Yang, D. Du, Z. Zhou, K. Li, and L. Wu, “Resilient distributed economic dispatch for cyber–physical power systems considering carbon emissions trading and false data injection attacks,” Energy, vol. 332, p. 136881, 2025. [14] C. Huang, J. Wang, S. Deng, and D. Yue, “Real-time distributed economic dispatch scheme of grid-connected microgrid considering cyberattacks,” IET Renewable Power Generation, vol. 14, no. 14, pp. 2750–2758, 2020. [15] P. Wlazlo, A. Sahu, Z. Mao, H. Huang, A. Goulart, K. Davis, and S. Zonouz, “Man-in-the-middle attacks and defence in a power system cyber-physical testbed,” IET Cyber-Physical Systems: Theory & Applications, vol. 6, no. 3, pp. 164–177, 2021. [16] A. N. Elmachtoub and P. Grigas, “Smart “predict, then optimize”,” Management Science, vol. 68, no. 1, pp. 9–26, 2022. [17] P. Donti, B. Amos, and J. Z. Kolter, “Task-based end-to-end model learning in stochastic optimization,” Advances in neural information processing systems, vol. 30, 2017. [18] D. Bertsimas and N. Kallus, “From predictive to prescriptive analytics,” Management Science, vol. 66, no. 3, pp. 1025–1044, 2020. [19] J. Mandi, J. Kotary, S. Berden, M. Mulamba, V. Bucarey, T. Guns, and F. Fioretto, “Decision-focused learning: Foundations, state of the art, benchmark and future opportunities,” Journal of Artificial Intelligence Research, vol. 80, pp. 1623–1701, 2024. [20] W. Ding, M. Xu, Y. Huang, and P. Zhao, “Cyber risks of pmu networks with observation errors: Assessment and mitigation,” Reliability Engineering & System Safety, vol. 198, p. 106873, 2020. [21] C. Elkan, “The foundations of cost-sensitive learning,” in International joint conference on artificial intelligence, vol. 17, no. 1. Lawrence Erlbaum Associates Ltd, 2001, pp. 973–978. [22] S. Pan, T. Morris, and U. Adhikari, “Developing a hybrid intrusion detection system using data mining for power systems,” IEEE Transactions on Smart Grid, vol. 6, no. 6, pp. 3104–3113, 2015.

[23] Gurobi Optimization, LLC, “Gurobi Optimizer Reference Manual,” 2026. [Online]. Available: https://www.gurobi.com

Related documents

• Decision-Focused Learning for Cyber-Physical Risk-Aware Power Grid Operations#1298349
• Prediction-based attack detection and mitigation mechanism in power system.#138602
• Machine Learning for Intelligent Data Analysis and Automation in Cybersecurity: Current and Future Prospects#1108078
• Artificial Intelligence in Cybersecurity: Revolutionizing Threat Detection and Response#731966
• Detection of disturbances and cyber-attacks in smart grids using explainable machine learning.#1183