A. Sakis Meliopoulos

Emad Abukhousa, Saman Zonouz, A. P. Sakis Meliopoulos

Inverter-based resources and IEC 61850 process-bus measurements introduce new protection challenges, including nontraditional fault behavior and measurement-domain cyber-physical attacks. This paper evaluates DL-Xformer, an attention-based Transformer classifier for multi-class fault and cyberattack diagnosis, side-by-side with Dynamic State Estimation-Based Protection (DSE-EBP) on identical high-fidelity electromagnetic-transient (EMT) streaming measurements from an IBR-rich power grid. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults, and six measurement-domain attacks, including CT/PT ratio manipulation and GPS spoofing, sampled at 4.8 kHz from synchronized upstream and downstream merging units. DSE-EBP detects all streaming anomalies in 0.417-1.660 ms, with a mean detection time of 0.756 ms, while DL-Xformer classifies the same events in 2.50-50.42 ms, with a mean classification time of 13.46 ms. The longest delay occurs in a deliberate stress case where a CT ratio attack is introduced while residual oscillations from a preceding DLG fault have not fully settled; the event-window accuracy drops to 76.1 %, but the stable final classification remains correct. Measurement-level feature attribution shows that the DL-Xformer decision is driven by physically meaningful current and voltage channels at the attacked measurement location. Together, the two methods motivate a layered protection architecture for next-generation inverter-dominated smart grids.

Emad Abukhousa, Saman Zonouz, A. P. Sakis Meliopoulos

This work introduces a latency-aware benchmarking framework for evaluating deep learning models in power system anomaly detection using high-fidelity, time-domain signals generated from an industry-grade electromagnetic transient simulator. Eight neural network architectures, ranging from MLPs to Transformers, were systematically evaluated on streaming datasets representing both physical faults and cyber-attacks in inverter-dominated networks. All models successfully classified two representative multi-event sequences in real time with sub-cycle response times below 15 ms. However, although classification decisions occurred within one cycle, the end-to-end inference latency consistently exceeded three cycles, ranging from 50 to 90 ms. These results highlight a critical gap between algorithmic capability and protection-grade deployment, pointing to the need for further optimization and hardware acceleration. The findings establish a reproducible benchmark for sub-cycle anomaly detection and provide guidance for transitioning machine learning methods from research prototypes to real-world protection applications.