{
  "abstract": "Trustworthy anomaly detection in power-grid dispatching requires alerts that are traceable to operational knowledge while satisfying real-time constraints. Existing data-driven detectors do not naturally encode behavioral rules, whereas placing a large language model (LLM) in the online decision loop introduces latency and nondeterministic outputs. We propose K-TRACE-CP, an offline-heavy, online-light framework that represents source-linked behavioral knowledge as numerical prototypes and transfers this supervision to a lightweight attribute-dynamic physical-graph expert. A separately trained cyber–physical expert models 470 process variables and 80 label-agnostic communication features, and threshold-normalized fusion combines their anomaly scores. At inference, the framework retrieves ranked, source-linked behavioral candidates for each alert without LLM calls. On an event-group-held-out split of Sherlock 01-Basic, K-TRACE-CP achieves 0.974±0.012 attack-window recall, 0.914±0.009 average precision, and an F1 score of 0.813±0.009 over three seeds. All four distinct held-out attack events are detected, corresponding to an event recall of 1.000 with an exact 95% confidence interval of 0.398–1.000. A non-overlapping-window evaluation retains 0.973±0.016 recall and 0.903±0.010 average precision. The controlled prototype-ranking experiment achieves Hit@1 of 0.954±0.023, supporting family-level behavioral retrieval. The primary Sherlock evaluation uses manually compiled prototypes, while an independent physical-testbed experiment evaluates few-shot LLM-compiled knowledge in downstream graph training. The complete 127,386-trainable-parameter online path requires a median of 1.412 ms per sample on an RTX 3060. These results support source-grounded, computationally lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings.",
  "abstract_shown": true,
  "affiliations": [
    "State Grid Electric Power Research Institute/NARI Group Corporation, Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China",
    "School of Cyber Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China"
  ],
  "article_type": null,
  "arxiv": null,
  "author_total": 7,
  "authors": [
    {
      "affs": [
        0
      ],
      "name": "Zhengning Pang"
    },
    {
      "affs": [
        0
      ],
      "name": "Minghui Gao"
    },
    {
      "affs": [
        0
      ],
      "name": "Yong Han"
    },
    {
      "affs": [
        0
      ],
      "name": "Qi Wang"
    },
    {
      "affs": [
        0
      ],
      "name": "Weilong Yan"
    },
    {
      "affs": [
        1
      ],
      "name": "Sirui Yao",
      "orcid": "0009-0009-3194-0816"
    },
    {
      "affs": [
        1
      ],
      "name": "Peng Gao",
      "orcid": "0000-0001-6331-9383"
    }
  ],
  "bibtex": "https://research.draconitic.com/paper/159ds5bx4kvp4.bib",
  "cited_by": 0,
  "doi": "10.3390/math14203688",
  "fulltext_url": null,
  "id": "159ds5bx4kvp4",
  "issns": [
    "2227-7390"
  ],
  "landing_url": "https://www.mdpi.com/2227-7390/14/20/3688",
  "language": null,
  "licence": "CC-BY-4.0",
  "licence_label": "CC BY 4.0",
  "licence_source": "article",
  "licence_url": "https://creativecommons.org/licenses/by/4.0/",
  "metadata_licence": null,
  "native_subjects": [
    [
      "openalex",
      "2207|Smart Grid Security and Resilience"
    ]
  ],
  "openalex": "W7221546728",
  "pdf_url": null,
  "pmcid": null,
  "pmid": null,
  "published": "2026-10-11",
  "publisher": "MDPI AG",
  "ris": "https://research.draconitic.com/paper/159ds5bx4kvp4.ris",
  "sources": [
    {
      "first_seen": "2026-10-30T12:18:29Z",
      "native_id": "10.3390/math14203688",
      "source": "crossref",
      "url": "https://www.mdpi.com/2227-7390/14/20/3688"
    }
  ],
  "subjects": [
    {
      "field": "mathematics",
      "origin": "issn:2227-7390",
      "subfield": "general"
    }
  ],
  "title": "Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching",
  "title_text": "Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching",
  "type": "peer-reviewed",
  "updated_at": "2026-10-30T12:18:29Z",
  "url": "https://research.draconitic.com/paper/159ds5bx4kvp4",
  "venue": "Mathematics",
  "versions": []
}