Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching
- 1State Grid Electric Power Research Institute/NARI Group Corporation, Nanjing NARI Information and Communication Technology Co., Ltd., Nanjing 211106, China
- 2School of Cyber Science and Engineering, Nanjing University of Science and Technology, Nanjing 210094, China
Abstract
Trustworthy anomaly detection in power-grid dispatching requires alerts that are traceable to operational knowledge while satisfying real-time constraints. Existing data-driven detectors do not naturally encode behavioral rules, whereas placing a large language model (LLM) in the online decision loop introduces latency and nondeterministic outputs. We propose K-TRACE-CP, an offline-heavy, online-light framework that represents source-linked behavioral knowledge as numerical prototypes and transfers this supervision to a lightweight attribute-dynamic physical-graph expert. A separately trained cyber–physical expert models 470 process variables and 80 label-agnostic communication features, and threshold-normalized fusion combines their anomaly scores. At inference, the framework retrieves ranked, source-linked behavioral candidates for each alert without LLM calls. On an event-group-held-out split of Sherlock 01-Basic, K-TRACE-CP achieves 0.974±0.012 attack-window recall, 0.914±0.009 average precision, and an F1 score of 0.813±0.009 over three seeds. All four distinct held-out attack events are detected, corresponding to an event recall of 1.000 with an exact 95% confidence interval of 0.398–1.000. A non-overlapping-window evaluation retains 0.973±0.016 recall and 0.903±0.010 average precision. The controlled prototype-ranking experiment achieves Hit@1 of 0.954±0.023, supporting family-level behavioral retrieval. The primary Sherlock evaluation uses manually compiled prototypes, while an independent physical-testbed experiment evaluates few-shot LLM-compiled knowledge in downstream graph training. The complete 127,386-trainable-parameter online path requires a median of 1.412 ms per sample on an RTX 3060. These results support source-grounded, computationally lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings.
Related
- Personalized Federated Learning through Global Knowledge Distillation and Local Head Adaptation
- A Statistical Perspective on Knowledge Distillation: Foundations, Classical Methods, and Large Language Model Extensions
- HintKD: Hint Knowledge Distillation for Bandwidth-Constrained Cloud-Edge Inference
- Limited detection of Gulf War illness-like behavioral phenotypes in Charles River male Sprague-Dawley rats across multiple chemical and stress exposure paradigms
- Common Randomness: A Key Enabler of Trustworthy 6G Communication Systems
BibTeX
@article{pang2026behavioral,
title = {{Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching}},
author = {Zhengning Pang and Minghui Gao and Yong Han and Qi Wang and Weilong Yan and Sirui Yao and Peng Gao},
journal = {Mathematics},
year = {2026},
month = oct,
doi = {10.3390/math14203688},
url = {https://www.mdpi.com/2227-7390/14/20/3688},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - Behavioral Knowledge Distillation for Dynamic Graph Anomaly Detection in Trustworthy Power Grid Dispatching
AU - Zhengning Pang
AU - Minghui Gao
AU - Yong Han
AU - Qi Wang
AU - Weilong Yan
AU - Sirui Yao
AU - Peng Gao
PY - 2026
DA - 2026/10/11
JO - Mathematics
DO - 10.3390/math14203688
UR - https://www.mdpi.com/2227-7390/14/20/3688
AB - Trustworthy anomaly detection in power-grid dispatching requires alerts that are traceable to operational knowledge while satisfying real-time constraints. Existing data-driven detectors do not naturally encode behavioral rules, whereas placing a large language model (LLM) in the online decision loop introduces latency and nondeterministic outputs. We propose K-TRACE-CP, an offline-heavy, online-light framework that represents source-linked behavioral knowledge as numerical prototypes and transfers this supervision to a lightweight attribute-dynamic physical-graph expert. A separately trained cyber–physical expert models 470 process variables and 80 label-agnostic communication features, and threshold-normalized fusion combines their anomaly scores. At inference, the framework retrieves ranked, source-linked behavioral candidates for each alert without LLM calls. On an event-group-held-out split of Sherlock 01-Basic, K-TRACE-CP achieves 0.974±0.012 attack-window recall, 0.914±0.009 average precision, and an F1 score of 0.813±0.009 over three seeds. All four distinct held-out attack events are detected, corresponding to an event recall of 1.000 with an exact 95% confidence interval of 0.398–1.000. A non-overlapping-window evaluation retains 0.973±0.016 recall and 0.903±0.010 average precision. The controlled prototype-ranking experiment achieves Hit@1 of 0.954±0.023, supporting family-level behavioral retrieval. The primary Sherlock evaluation uses manually compiled prototypes, while an independent physical-testbed experiment evaluates few-shot LLM-compiled knowledge in downstream graph training. The complete 127,386-trainable-parameter online path requires a median of 1.412 ms per sample on an RTX 3060. These results support source-grounded, computationally lightweight anomaly detection and offline behavioral-knowledge transfer in the evaluated simulated and laboratory settings.
SN - 2227-7390
ER -