Federated Learning for Real-Time Anomaly Detection in Smart Grids

Thesis Abstract

This study addresses the rising need for secure, scalable, and timely detection of anomalies in contemporary smart grids, where conventional centralized anomaly detection systems struggle with latency, privacy concerns, and single-point-of-failure risks. Federated learning (FL) is proposed as a decentralized machine learning paradigm that preserves data locality while enabling collaborative model training across distributed grid sensors, edge devices, and microgrids. The aim is to develop and evaluate a real-time anomaly detection framework that leverages FL to achieve high detection accuracy, low false alarm rates, and robust resilience against data heterogeneity and adversarial conditions. Specific objectives include (1) designing a federated anomaly detection architecture suitable for heterogeneous smart grid environments; (2) integrating privacy-preserving techniques and robust aggregation methods to mitigate data skew and poisoning attacks; (3) evaluating performance under varying network conditions, device participation, and attack scenarios; (4) comparing FL-based detectors with centralized and distributed non-federated baselines; and (5) providing implementable guidelines for deployment in utility-scale grids. The methodology adopts a mixed-methods approach with a primarily quantitative focus grounded in experimental evaluation. A multi-site grid testbed comprising ten distributed energy resources (DERs), twelve flexible loads, and a central control hub will be simulated with realistic communication constraints using the GridSim and ns-3 integrative environment. The population includes data streams from Phasor Measurement Units (PMUs), smart meters, and inverter controls, totaling approximately 2 terabytes of historical and synthetic high-frequency data (sampling at 1 Hz to 1 kHz). A stratified sampling strategy will select 200 devices across five geographic clusters to form the federated learning participants. The data collection will utilize existing labeled datasets for cyber-physical anomalies augmented with synthetic attack injections to represent false data injection, replay attacks, and timing spoofing. Instruments include a suite of locally trainable anomaly detectors (autoencoders, one-class SVMs, and gated recurrent units) embedded on edge devices and a secure aggregation protocol based on Federated Averaging with Byzantine-resilient mechanisms (Krum/Trimmed Mean) and differential privacy guarantees. Validity and reliability will be established through cross-validation across time windows and holdout scenarios, with model calibration evaluated via ROC-AUC, precision-recall, and F1 scores, alongside latency metrics for real-time operation. Data analysis will entail federated model aggregation performance comparisons against centralized baselines and non-federated distributed detectors, employing paired t-tests and non-parametric equivalents to ascertain statistical significance. The study will also conduct sensitivity analyses to assess the impact of non-IID data distributions, varying participation rates, and communication delays. A theoretical framework drawing on the Supervisory Control and Data Acquisition (SCADA) security model and the Information-Theoretic Privacy paradigm will guide the integration of privacy-preserving components and threat models. The conceptual model will illustrate relationships among data heterogeneity, local detector architectures, aggregation schemes, and detection performance under real-time constraints. Expected findings include (i) FL-based detectors achieving near-parity with centralized models in detection accuracy while significantly reducing data exposure and bandwidth usage; (ii) enhanced robustness to heterogeneous data sources and asynchronous participation; (iii) improved resilience to data poisoning through robust aggregation and anomaly-aware aggregation weights; and (iv) demonstrable latency reductions enabling real-time responses (<100 ms) for critical events. The study anticipates that carefully chosen local models and aggregation strategies will outperform non-FL baselines in privacy-preserving scenarios, while maintaining interpretable outputs for operators. The contribution to knowledge lies in (a) advancing a scalable, privacy-preserving FL framework for real-time grid anomaly detection; (b) providing empirical benchmarks for FL-based cyber-physical security in smart grids; and (c) delivering deployment-ready guidelines for utilities, including parameter settings for participation, learning rates, and privacy budgets. The main conclusion is that federated learning can deliver effective real-time anomaly detection in smart grids without compromising data privacy or operational resilience, given appropriate system design and robust aggregation. Recommendations include adopting Byzantine-resilient FL protocols, deploying edge-accelerated inference for latency-critical alerts, and integrating continuous adversarial testing. Further research should explore adaptive participation schemes, reinforcement learning-driven detector personalization, and co-design of secure communication protocols with grid control software.