Evaluating the Value of Topology-Aware Features for Cyber-Physical Grid Monitoring: Detection, Localization, and End-to-End Latency

Abstract

Distinguishing cyber false-data-injection attacks (FDIAs) from legitimate physical disturbances requires accurate detection, localization, and sufficiently fast end-to-end processing. We evaluate the marginal value of explicit topology-relational features across a synthetic 5-bus microgrid and standard IEEE 14-bus and 30-bus systems using deployable WLS residuals, validation-only model selection, and a matched topology-free residual-plus-prior ablation. Across 16 independent seeds, topology features are neutral on the 5-bus system on both tasks but produce small positive gaps (roughly 0.01–0.03 balanced-accuracy/top-1-accuracy points) on both detection and localization at both IEEE systems; three of the four IEEE gaps remain significant under a Bonferroni correction, one does not. Separately, pipeline profiling reduces median end-to-end latency from 42.98 ms to 16.2–17.0 ms, with p99 at 17.0–19.2 ms but rare maxima of 89.1–92.7 ms. Finally, neither feature set generalizes to a completely unseen attack type (0–1.3% recall versus 91–100% when represented in training).