标题： 基于大型语言模型的可解释性网络攻击检测框架在自动发电控制系统的应用 显示英文标题

标题： Large Language Model-Based Framework for Explainable Cyberattack Detection in Automatic Generation Control Systems

摘要： 随着智能电网的数字化程度不断提高，操作效率得到了提升，但也引入了新的网络安全漏洞，例如针对自动发电控制（AGC）系统的虚假数据注入攻击（FDIAs）。 虽然机器学习（ML）和深度学习（DL）模型在检测此类攻击方面显示出潜力，但其决策过程的不透明性限制了操作员的信任和实际应用。 本文提出了一种混合框架，将轻量级基于ML的攻击检测与由大型语言模型（LLMs）生成的自然语言解释相结合。 如LightGBM等分类器在仅0.004秒的推理延迟下实现了高达95.13%的攻击检测准确率。 在检测到网络攻击时，系统会调用LLMs，包括GPT-3.5 Turbo、GPT-4 Turbo和GPT-4o mini，以生成可读的人类解释。 在100个测试样本上进行评估，GPT-4o mini在20次提示的情况下，在识别攻击目标方面达到了93%的准确率，估计攻击幅度的平均绝对误差为0.075 pu，并且估计攻击开始时间的平均绝对误差（MAE）为2.19秒。 这些结果表明，所提出的框架在实时检测与可解释的高保真解释之间实现了有效的平衡，解决了智能电网网络安全中可操作AI的关键需求。 显示英文摘要

摘要： The increasing digitization of smart grids has improved operational efficiency but also introduced new cybersecurity vulnerabilities, such as False Data Injection Attacks (FDIAs) targeting Automatic Generation Control (AGC) systems. While machine learning (ML) and deep learning (DL) models have shown promise in detecting such attacks, their opaque decision-making limits operator trust and real-world applicability. This paper proposes a hybrid framework that integrates lightweight ML-based attack detection with natural language explanations generated by Large Language Models (LLMs). Classifiers such as LightGBM achieve up to 95.13% attack detection accuracy with only 0.004 s inference latency. Upon detecting a cyberattack, the system invokes LLMs, including GPT-3.5 Turbo, GPT-4 Turbo, and GPT-4o mini, to generate human-readable explanation of the event. Evaluated on 100 test samples, GPT-4o mini with 20-shot prompting achieved 93% accuracy in identifying the attack target, a mean absolute error of 0.075 pu in estimating attack magnitude, and 2.19 seconds mean absolute error (MAE) in estimating attack onset. These results demonstrate that the proposed framework effectively balances real-time detection with interpretable, high-fidelity explanations, addressing a critical need for actionable AI in smart grid cybersecurity.