Checking DER Commands Against Grid Context Catches Credentialed Attacks Static Checks Miss

This work has been submitted to the 2027 IEEE PES General Meeting for possible publication. Copyright may be transferred without notice, after which this version may no longer be accessible.

Checking DER Commands Against Grid Context Catches Credentialed Attacks Static Checks Miss Benjamin Blakely

arXiv:2611.12703v1 [cs.CR] 9 Nov 2026

Argonne National Laboratory Lemont, IL, USA bblakely@anl.gov

Abstract—Authorization of distributed energy resource (DER) commands judges a command by who sent it and whether its value has been seen before. An attacker holding a legitimate credential who writes ordinary values passes both tests. We add a check that judges each DER write against the grid’s operating context: the bus voltages around the target, the hour, the dayahead price, system load, and irradiance, compared with what operators wrote under similar conditions in the feeder’s own benign history. We evaluate it live on the IEEE 123-bus and 8500-node feeders, driven by a measured 2024 year of price, load, and irradiance, against nine attack scenarios. A lookup trained on the same history catches none of the writes of the four scenarios that send values already familiar on the targeted device; the context check refuses 91.7% of insider-abuse writes and 64.4% of DER-aggregation writes while denying 1.28% of benign writes. In an offline test that replays recorded moments with curtailment setpoints drawn from the benign range, issued at a positive price, it refuses 47.3% and 50.5% on the two feeders, against 18.5% and 16.0% for the same check without context; live, the few setpoints tested were mostly shallow and were mostly allowed. The context check complements the lookup. Index Terms—distribution system security, distributed energy resources, authorization, zero trust, situational awareness †

I. I NTRODUCTION Coordinated manipulation of many DERs can cause instability, unnecessary protection tripping, or blackouts beyond the impact of any single compromised asset [1]–[3]. The commands involved need not look wrong. Static authorization judges a command by who sent it, what it targets, and whether its value resembles values seen before. An adversary holding a distributed energy resource management system (DERMS) credential, or an insider, can write each photovoltaic (PV) unit in a zone using the expected source and register to send a value operators routinely write, and passes every one of these tests. What such writes get wrong is the moment. Where operators curtail PV when midday solar drives the price negative, a deep This work was supported in part by the U.S. Department of Energy, Office of Cybersecurity, Energy Security, and Emergency Response (CESER), through prime contractor Iowa State University. The submitted manuscript has been created in part by UChicago Argonne, LLC, operator of Argonne National Laboratory. Argonne, a DOE Office of Science laboratory, is operated under Contract No. DE-AC02-06CH11357. The U.S. Government retains for itself, and others acting on its behalf, a paid-up nonexclusive, irrevocable worldwide license in said article to reproduce, prepare derivative works, distribute copies to the public, and perform publicly and display publicly, by or on behalf of the Government. † AI-assisted content, in this and every section marked †; see the Acknowledgment [26]–[32].

curtailment setpoint is an ordinary value on that channel, yet a control-room operator would refuse the same setpoint at noon on a day the price is positive and voltages are normal. The judgment concerns consistency between a command and the conditions it is issued in, and such a curtailment need not violate any physical limit, so safety-based command validation need not refuse it. Our authorization check makes this judgment automatically. It learns from a feeder’s benign history how operators set each device under given conditions and refuses writes whose value does not fit. Deployed in the authorization path of a Modbus testbed and compared with a lookup learned from the same history, it catches attacks the lookup misses at a fraction of the lookup’s false denials, and a pre-registered test with ablations measures whether context catches routine curtailment values issued at a positive price. II. BACKGROUND† Coordinated manipulation of many individually valid loads is an established attack class [4]–[6], and coordinated DER operation through aggregators is expected to amplify the impact of single-asset compromise [2]. Zero-trust architectures for grid and operational technology networks assess trust continuously [7]–[9], but deployed grid security is organized around perimeters and zones, as in NERC CIP-005 [10] and IEC 62443-3-3 [11]. A zone authorizes requester–target pairs, not commands under current conditions. Context-aware schemes update a requester’s trust from measurement-based intrusion alerts or the time of request [7], [12], or gate access to supervisory control (SCADA) data on conditions such as active alarms [13], and DER security analyses call for access decisions that change with grid and DER state [1]. In these, context changes requester trust or data access; it does not judge each command before it executes. Command validation executes each incoming command in a model of the current grid state and forwards it only if the predicted state is consistent and safe [14], [15], or checks received commands against local measurements [16]. These test physical consistency and safety, which a curtailment issued at the wrong price does not violate. Exogenous data has been used in detection, chiefly irradiance and weather to expose falsified DER generation readings [17], [18].

Closest in spirit, inverter measurements have been used to detect manipulated volt-VAR curves [19]; that detector judges a received curve from the inverter’s response once the curve is applied, whereas the context check decides in the authorization path before a write reaches the device. Frequent false alarms lead operators to ignore and distrust a detector [20], [21], and a false denial in an authorization path withholds a control action outright, so detection gains must be weighed against false denials. III. M ETHOD† A. Threat model The adversary controls the identity of one or more remote terminal units (RTUs) or the DERMS credential, by theft, an insider, or a firmware compromise, and issues Modbus writes under that identity through the same MTU path a legitimate command takes. Every write uses a legal function code, targets a register the identity may write, and carries a value inside the register’s range. The adversary knows the feeder’s asset inventory and can read the public day-ahead price. It cannot alter telemetry, the price feed, the policy engine, or the checks’ fitted models; false data injection on measurements is outside this study. The primary scenario is price-timed curtailment. The DERMS credential curtails every PV unit in one zone to a single fraction of nameplate. The fraction is drawn once per cell, with a fixed seed, from that cell’s own benign DERMS PV setpoints below 0.95 of nameplate in the fitting data, so the commanded value is one operators have written on that feeder. The attack waits for the first hour between 10:00 and 16:00 local standard time, with at least six simulated hours before dark, whose day-ahead price is non-negative, writes the whole zone at once, and re-asserts the setpoints four times. It removes generation the market is paying for, with a value benign operators write when the price is negative. Three send values operators also send on the targeted device. DER aggregation sets every DER in one RTU’s zone to 0 kW in three daylight windows and holds it; insider abuse sends the same setpoints as an off-cadence burst; firmware cohort curtails the DERs sharing a vulnerable firmware version across two or three zones, each through its own zone’s RTU. Regulator aggregation holds a zone’s regulators at 0.95 pu. Three open breakers (credential outage, ransomware spillover, and a long-staged intrusion with one cross-zone open), and one probes safety controllers with a read/write-multiple-registers request (function code 23), which benign traffic never sends, before writing to them. B. Testbed We use the IEEE 123-bus and IEEE 8500-node OpenDSS feeder models distributed with PowerGym [22], with DER overlays: a small feeder whose every bus is observed and a large one that is only partly observed. The 123-bus feeder has 157 buses, 25 photovoltaic DERs, 3 batteries and 7 regulators; the 8500-node feeder has 4896 buses, 20 photovoltaic DERs and 12 regulators. Telemetry reads 157 and 1000 of those

buses; the voltage register block holds 1000 buses, filled in the model’s bus order. Each feeder is cut into 5 zones: a breadthfirst tree is rooted at the substation, and subtrees whose sizes are closest to an equal share are cut off in turn, so every zone is connected. One RTU serves each zone, and a device belongs to the zone of its host bus. A power-flow simulator solves the feeder in OpenDSS and exposes DER limits, regulator setpoints, breakers and bus voltages as Modbus registers. A traffic generator issues every benign write to a master terminal unit (MTU), which asks an Open Policy Agent (OPA) policy engine whether to forward it. The policy denies by default. For each write it queries the grid-context check, a separate service, and denies the write if that service fails or does not answer in time. Attack writes enter through the same MTU, and every decision is logged. Power flow runs as a quasi-static time series in OpenDSS daily mode, with one solve per wall-clock second and simulated time running 2880 times faster than wall time on the 123-bus feeder and 960 times faster on the 8500-node feeder, whose slower solves would otherwise stretch an attack past dark. Benign roles issue commands per wall-clock second, so the 8500-node feeder carries about three times as many benign writes per simulated hour. PV ratings and loads are scaled per seed by factors drawn from [0.97, 1.03] and [0.95, 1.05]. The simulator holds a 2024 data year for the Fresno, California area at hourly resolution, indexed to local standard time so that hour 12 is near solar noon: global horizontal irradiance from the Open-Meteo historical archive [23], and the dayahead locational marginal price (LMP) at the California ISO (CAISO) ZP26 trading hub and actual CAISO system load from CAISO OASIS [24]. Irradiance scales PV output. Every feeder load follows one of the three year-long load shapes distributed with the 123-bus model, so feeder load comes from a different source year than price and irradiance. The substation voltage is offset from its standard setpoint by up to 0.02 pu, falling as normalized system load z rises. Simulated time starts on 1 April 2024, so the baseline falls in April and May, when midday prices are often negative and PV output is high against load. Attack episodes follow from May to early July on the 123-bus feeder and from May to mid-August on the 8500-node feeder; the price-timed attack fires in June on every cell, at the first positive 10:00 price after the preceding episode. C. Benign operation Seven simulated roles generate benign traffic: a DERMS writing about eight setpoints per simulated hour, a volt-VAR optimization (VVO) controller, and five human roles, among them a dispatcher with three sessions a day; human sessions start at random times at a fixed average rate. Each DERMS setpoint is the smaller of two limits. The first is an IEEE 15472018 volt-watt characteristic [25] applied to the DER’s last measured bus voltage: full output at or below 1.05 pu, falling linearly to zero at 1.09 pu, read through 0.002 pu Gaussian measurement noise. The second is a price limit: full nameplate at a non-negative LMP, and a fraction max(0, 1 + λ/50)

of nameplate at a negative LMP λ in $/MWh, so a unit is fully curtailed at −50 $/MWh. Curtailed setpoints are therefore routine in negative-price hours. The VVO controller steps a regulator when its voltage leaves [0.955, 1.045] pu, dispatcher load setpoints fall as system load rises, and other human roles open and close breakers for planned switching. Benign writes from outside the target’s zone are excluded from the falsedenial rate. Before any attack is run, each feeder’s baseline simulation must show that operators respond to these conditions, with at least a share 0.10 of DERMS setpoints below 0.95 of nameplate and a setpoint–LMP Spearman correlation of at least 0.3. Both feeders pass: 44.6% and 38.9% of setpoints are curtailed, with correlations of 0.75 and 0.82. D. Authorization checks A protocol check admits only legal function codes from the trusted network, and a role-and-zone check (the zone check) requires a recognized requester role and a target inside the requester’s zone. The grid-context check is added on top of these and applied to the write function codes. Grid context. For a write w of value vw to asset a, the check forms a feature vector xw of ten values. Five are bus voltages read from the simulator: a’s own bus, the mean, maximum and minimum over observed buses within two hops of a, and the feeder maximum. The other five describe the operating moment: the hour of day h as sin(2πh/24) and cos(2πh/24), the LMP, the CAISO system load, and the irradiance, all taken from the data year’s row for the write’s timestamp; none is computed from the write. Among the baseline writes to assets of the same type, let Nk (xw ) be the k whose features are nearest to xw in Euclidean distance after per-type standardization. The score is vj vw − median , (1) s(w) = ca j∈Nk (xw ) cj with k = 25 and ca the largest value written to a’s channel in the fitting data. The write is refused when s(w) exceeds its asset type’s threshold τ . The check therefore asks how far the value lies from what operators wrote to similar devices under similar conditions; it encodes no operator rule. Thresholds are set on held-out baseline. The neighbours are drawn from all but the last 7 baseline days, and each type’s τ starts at the 1−β quantile of its held-out scores, with β = 1%, raised until the held-out refusal rate over all types is within β; no threshold is set below 1.5 times a channel’s smallest value step, so one regulator tap never triggers a refusal. A write to an asset type with fewer than 200 baseline writes, or to an asset with no observed bus within two hops, is unmodelled and passes; a write whose own-bus voltage cannot be read is refused. Ablations. Two variants of the same check separate what each group of features contributes. The value-only variant gives every fitting write of a type the same feature vector, so its score is the distance from the median of all of that type’s baseline values; it refuses values that are rare on the

channel regardless of conditions. The voltage variant uses the five voltages and drops the five context features. Both are fitted on the same writes with the same holdout, floors, eligibility and budget as the live check, and are replayed offline over the live configuration’s traffic. Lookup. A static lookup learned from the same baseline checks familiarity. Its first test asks whether the requesting device commonly writes to the target asset: it counts writes for each device–asset pair and smooths the counts with a rank3 truncated singular value decomposition (SVD), so a pair never seen in the baseline still scores well if similar pairs are common. The second refuses a value outside the channel’s baseline range, widened by a margin. Both share the budget of 1% on the held-out week. The lookup is replayed offline, alone and with the grid-context check; the combination refuses a write if either check does. E. Protocol and metrics A cell is one feeder and seed. Each cell runs 30 simulated days of benign traffic, the baseline on which every learned check is fitted, followed by one attack episode per scenario, in an order shuffled per seed. Benign traffic continues through every episode, and the stack is not restarted between episodes, so an attack meets the state left by the episodes before it. Every attack write is labelled adversarial at the source. We run five seeds per feeder with the grid-context check live. A cell is excluded if its bus telemetry freezes or a normally energized bus stays dark in the baseline, or if it lacks exactly one labelled episode per scenario, a rule fixed before any result was read. Cells that failed through harness faults (memory, a request timeout, and a simulation rate too fast for the larger feeder) were rerun after each fault was fixed. All 5 cells of the 123-bus and 5 of the 8500-node feeder pass; they contain 11257 attack writes and 34951 benign in-zone episode writes. Let A be the attacker writes and B the benign writes the zone check allows. Detection is |{w ∈ A : w refused}|/|A|, and the false-denial rate is |{w ∈ B : w refused}|/|B|. A false denial withholds a legitimate control action, so it measures an availability cost. Rates pool writes over cells, and intervals are 95% percentile bootstrap intervals over 10000 resamples of whole cells, since episodes within a cell share a running stack and are not independent. Whether the check refuses a curtailment depends on how deep it is, and a live cell’s attack repeats a single randomly drawn value, so five cells per feeder sample only five depths. To measure the check across the full range of curtailment values operators use, the price-timed attack is also tested offline. Context features other than voltage depend only on the timestamp, so recorded moments can be replayed. Every benign PV write outside the fitting data, in daylight (irradiance at least 200 W/m2 ) and to a modelled target, becomes a probe: its value is replaced by one drawn at random from the cell’s benign PV setpoints below 0.95 of the channel maximum, and its recorded features are kept. Probes at a non-negative price are the attack; probes at a negative price, when operators curtail too, are the control and approximate an

TABLE I ATTACK WRITES REFUSED , POOLED OVER BOTH FEEDERS AND TEN CELLS , BY SCENARIO AND BY TARGET. E VERY CONFIGURATION INCLUDES THE ZONE CHECK . Scenario

Lookup

Context

Both

Insider abuse DER aggregation Firmware cohort Price-timed curtail. Regulator aggregation Credential outage Ransomware spillover Long-staged destr. Safety bypass

0.0% 0.0% 0.0% 0.0% 100.0% 88.2% 100.0% 95.0% 100.0%

91.7% 91.7% 64.4% 64.4% 56.2% 56.2% 3.9% 3.9% 84.2% 100.0% 0.0% 88.2% 0.4% 100.0% 25.0% 95.0% 100.0% 100.0%

DER/regulator writes Breaker writes Benign writes

12.0% 94.2% 16.26%

67.8% 69.5% 0.1% 94.2% 1.28% 16.83%

attacker who times to the public price. Each probe is scored by the grid-context check and both ablations. Harm is the curtailment a probe would cause, in units of nameplate: below nameplate at a non-negative price, and below the price fraction max(0, 1 + λ/50) at a negative one. A replayed probe keeps the voltages recorded before it; a real curtailment would lower them. A criterion fixed before any probe was scored requires that on each feeder, with at least 200 non-negative-price probes, the grid-context check must refuse at least 20 percentage points more of them than the value-only variant, while its false-denial rate on benign episode writes stays at or below 0.02. IV. R ESULTS† A. Detection and false denial The two learned checks catch different attacks (Table I). The lookup refuses most attack writes, including every regulator and breaker scenario, because those attacks write pairs or values the baseline never held. It refuses none of the writes of the four scenarios that send familiar values from the expected device. The grid-context check refuses most insiderabuse writes and more than half of the DER-aggregation and firmware-cohort writes. It does not model breakers, so it passes the breaker writes that make up most attack writes, and its rate over all attack writes (11.1%) mainly reflects that scenario mix. Combined, the two refuse 90.4% of attack writes (80.3%– 96.7%). The two differ more in cost. The grid-context check denies 1.28% (0.81%–1.71%) of benign in-zone writes, close to its budget, and the lookup 16.26% (13.06%–20.16%), 23.16% on the 8500-node feeder. Both were calibrated to the same budget on the held-out week; only the context check stays near it in the weeks that follow. A one-percent budget can still deny many commands on a busy feeder and is unlikely to be deployable unchanged; it serves here as a common operating point for comparing the checks, and deployment would need its own calibration. Coverage limits the context check on the partly observed feeder. On the 8500-node feeder 26.6% of attack writes to

TABLE II O FFLINE CURTAILMENT PROBES : SHARE REFUSED , AND CURTAILMENT PASSED PER ATTEMPTED WRITE IN UNITS OF NAMEPLATE . ATTACK : PROBES AT A NON - NEGATIVE PRICE , WHEN OPERATORS DO NOT CURTAIL . C ONTROL : PROBES AT A NEGATIVE PRICE , WHEN OPERATORS CURTAIL TOO . Attack

123-bus Value only Voltage Context 8500-node Value only Voltage Context

Control

Refused

Passed

Refused

Passed

18.5% 15.5% 47.3%

0.36 0.39 0.17

18.4% 13.5% 25.2%

0.13 0.16 0.12

16.0% 37.8% 50.5%

0.37 0.22 0.15

15.0% 31.8% 29.5%

0.15 0.09 0.10

DERs and regulators target a device with no observed bus within two hops; the check passes these unjudged and refuses 0.0% of them, against 84.5% of writes to modelled devices. Every device on the 123-bus feeder is modelled. B. Curtailment at a positive price Live, the grid-context check refused 6.5% of price-timed curtailment writes on the 123-bus and 0.0% on the 8500-node feeder. Each cell repeats one drawn value, and the draws were mostly shallow curtailments; on the 123-bus feeder only the deepest of the five was refused. On the 123-bus feeder the grid-context check refuses 47.3% (42.2%–52.0%) of 5037 attack probes, 28.8 points more than the value-only variant, at a false-denial rate of 1.49%. On the 8500-node feeder it refuses 50.5% (42.5%–60.4%) of 2780, a gap of 34.5 points, at 0.47%. The pre-registered criterion is met on both feeders, and the context check passes less than half the curtailment the value-only variant passes (Table II). The value-only variant refuses attack and control probes at nearly the same rate, since both draw from the same values; the context check refuses attack probes more often than control probes. At a negative price, the context check passes less curtailment than the value-only variant on both feeders, though on the 8500-node feeder the voltage-only ablation passes less still. V. D ISCUSSION† For the context check to work in practice, two conditions follow from the measurements. First, the targets must be observed: on the 8500-node feeder a quarter of value-attack writes went to devices the check could not judge, and it refused none of them. Second, the curtailment must be deep enough to stand out; live, the shallow curtailments drawn were mostly allowed, so the check reduces price-timed curtailment without stopping it. How much the non-voltage features add depends on the feeder. On the 8500-node feeder the voltage-only ablation refuses 37.8% of attack probes against the full check’s 50.5%; on the 123-bus feeder it refuses fewer than the value-only

variant, so the gain there comes from hour, price, load and irradiance together. The feeders, Modbus traffic and rule-based operators are simulated from one region’s data for one year. An attacker who could spoof telemetry or the price feed could choose the context the check judges against. VI. C ONCLUSION† Authorization by sender and familiar values misses attacks that use a legitimate credential and familiar values. Judging each write against the feeder’s operating context catches a large share of them at a false-denial rate near its one-percent budget, and, in offline replay, catches routine curtailment values issued at a positive price that a value check allows. It complements static checks, and its coverage is limited to devices the operator can observe. ACKNOWLEDGMENT Generative AI was used in every section. Anthropic Claude [26] wrote and revised the code and drafted and edited the text; OpenAI GPT [27] and Google Gemini [28] reviewed the code and manuscript; and a literature-screening tool built on those models and on Qwen [29], Granite [30], Llama [31] and BGE [32] searched and assessed related work. The author verified all AI-generated content and takes full responsibility for it. Every quantitative result was regenerated by running the code. R EFERENCES [1] J. Qi, A. Hahn, X. Lu, J. Wang, and C.-C. Liu, “Cybersecurity for distributed energy resources and smart inverters,” IET Cyber-Physical Systems: Theory & Applications, vol. 1, no. 1, pp. 28–39, Dec. 2016. [2] J. Chen, J. Yan, A. Kemmeugne, M. Kassouf, and M. Debbabi, “Cybersecurity of distributed energy resource systems in the smart grid: A survey,” Applied Energy, vol. 383, p. 125364, Apr. 2025. [3] N. Sugunaraj, S. Ram Abayankar Balaji, B. Subash Chandar et al., “Distributed Energy Resource Management System (DERMS) Cybersecurity Scenarios, Trends, and Potential Technologies: A Review,” IEEE Communications Surveys & Tutorials, vol. 28, pp. 224–277, 2026. [4] S. Amini, F. Pasqualetti, and H. Mohsenian-Rad, “Dynamic Load Altering Attacks Against Power System Stability: Attack Models and Protection Schemes,” IEEE Transactions on Smart Grid, vol. 9, no. 4, pp. 2862–2872, Jul. 2018. [5] A. Dabrowski, J. Ullrich, and E. R. Weippl, “Grid Shock: Coordinated Load-Changing Attacks on Power Grids: The Non-Smart Power Grid is Vulnerable to Cyber Attacks as Well,” in Proceedings of the 33rd Annual Computer Security Applications Conference. Orlando FL USA: ACM, Dec. 2017, pp. 303–314. [6] S. Maleki, S. Pan, S. Lakshminarayana, and C. Konstantinou, “Survey of Load-Altering Attacks Against Power Grids: Attack Impact, Detection, and Mitigation,” IEEE Open Access Journal of Power and Energy, vol. 12, pp. 220–234, 2025. [7] U. James, C. Idika, and L. Enyejo, “Zero Trust Architecture Leveraging AI-Driven Behavior Analytics for Industrial Control Systems in Energy Distribution Networks,” International Journal of Scientific Research in Computer Science, Engineering and Information Technology, vol. 9, no. 4, pp. 685–709, Jul. 2023. [8] C. Chen, J. Lan, Y. Wang et al., “Trust Assessment of Distributed Power Grid Terminals via Dual-Domain Graph Neural Networks,” Electronics, vol. 15, no. 6, p. 1211, Mar. 2026. [9] S. Kapoor, S. Kumar, and H. Vardhan, “Cyber security of OT networks: A tutorial and overview,” arXiv:2502.14017 [cs.CR], Dec. 2025. [10] North American Electric Reliability Corporation, “Cyber security – electronic security perimeter(s),” NERC, Reliability Standard CIP-0057, 2020.

[11] International Electrotechnical Commission, “Industrial communication networks – network and system security – part 3-3: System security requirements and security levels,” IEC, Geneva, Standard IEC 62443-33:2013, 2013. [12] G. Fragkos, J. Johnson, and E. E. Tsiropoulou, “Dynamic Role-Based Access Control Policy for Smart Grid Applications: An Offline Deep Reinforcement Learning Approach,” IEEE Transactions on HumanMachine Systems, vol. 52, no. 4, pp. 761–773, Aug. 2022. [13] K. Routray and P. Bera, “Context-Aware Attribute Based Access Control for Cloud-based SCADA Systems,” in Proceedings of the 1st Workshop on Enhanced Network Techniques and Technologies for the Industrial IoT to Cloud Continuum. New York NY USA: ACM, Sep. 2023, pp. 35–40. [14] D. Mashima, Y. Chen, M. M. Roomi, S. Lakshminarayana, and D. Chen, “Cybersecurity for Modern Smart Grid against Emerging Threats.” [15] J. J. Chromik, A. Remke, and B. R. Haverkort, “An integrated testbed for locally monitoring SCADA systems in smart grids,” Energy Informatics, vol. 1, no. 1, p. 56, Dec. 2018. [16] University of Illinois, University of Idaho, Iowa State University, Bonneville Power Administration, R. Nuqui, and V. R. Ramanan, “Cyber Resilient Flexible Alternating Current Transmission Systems (XFACTS),” Tech. Rep. None, 1873108, Mar. 2022. [17] V. B. Krishna, C. A. Gunter, and W. H. Sanders, “Evaluating Detectors on Optimal Attack Vectors That Enable Electricity Theft and DER Fraud,” IEEE Journal of Selected Topics in Signal Processing, vol. 12, no. 4, pp. 790–805, Aug. 2018. [18] M. Ismail, M. F. Shaaban, M. Naidu, and E. Serpedin, “Deep Learning Detection of Electricity Theft Cyber-Attacks in Renewable Distributed Generation,” IEEE Transactions on Smart Grid, vol. 11, no. 4, pp. 3428– 3437, Jul. 2020. [19] A. M. Saber, A. Youssef, D. Svetinovic, H. Zeineldin, and E. El-Saadany, “Learning-Based Detection of Malicious Volt-VAr Control Parameters in Smart Inverters,” in IECON 2023- 49th Annual Conference of the IEEE Industrial Electronics Society. Singapore, Singapore: IEEE, Oct. 2023, pp. 1–6. [20] M. L. Bransby and J. Jenkinson, “The Management of Alarm Systems,” Bransby Automation Ltd & Tekton Engineering, Tech. Rep. 166/1998, 1997. [21] K. Koistinen, K. Hellsten, J. Herttuainen, and K. K. Kaski, “SpatioTemporal Attention Graph Neural Network: Explaining Causalities With Attention,” Mar. 2026. [22] T.-H. Fan, X. Y. Lee, and Y. Wang, “PowerGym: A Reinforcement Learning Environment for Volt-Var Control in Power Distribution Systems,” in Proceedings of the 4th Annual Learning for Dynamics and Control Conference (L4DC), ser. Proceedings of Machine Learning Research, vol. 168, 2022, pp. 21–33, software: https://github.com/siemens/ powergym. [23] P. Zippenfenig, “Open-Meteo.com Weather API,” Zenodo, Dec. 2024. [24] California Independent System Operator, “OASIS: Open access sametime information system,” https://oasis.caiso.com, 2024, day-ahead LMP (PRC_LMP, node TH_ZP26_GEN-APND) and actual system load (SLD_FCST), 2024; accessed Oct. 2026. [25] IEEE Application Guide for IEEE Std 1547-2018, IEEE Standard for Interconnection and Interoperability of Distributed Energy Resources with Associated Electric Power Systems Interfaces, IEEE, 2024. [26] Anthropic, “Claude,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.anthropic.com/claude [27] OpenAI, “GPT-5,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://platform.openai.com/docs/models [28] Google DeepMind, “Gemini,” Large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://deepmind.google/ models/gemini/ [29] Qwen Team, Alibaba, “Qwen,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://github. com/QwenLM [30] IBM, “Granite,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.ibm.com/granite [31] Meta, “Llama,” Open-weight large language model family, 2026, accessed Oct. 2026. [Online]. Available: https://www.llama.com/ [32] Beijing Academy of Artificial Intelligence, “BGE embedding and reranking models,” Open-weight text embedding model family, 2026, accessed Oct. 2026. [Online]. Available: https://huggingface.co/BAAI