Explainable Federated Learning for Privacy-Preserving Cyberattack Detection and Resilient Energy Management in Distributed Smart Grids

Abstract

Distributed smart grids (feeders, microgrids and substations operated by different parties) generate the telemetry that could train cyberattack detectors, but the parties cannot pool it: it reveals customers and operations, and regulation forbids its transfer. Federated learning (FL) trains a shared detector without moving the data, differential privacy bounds what the shared model reveals, and explainable AI (XAI) tells an operator why an alarm was raised, which an energy-management system must know before it acts. This article designs a data-driven analytics framework that joins the three and evaluates it on a transparent simulation testbed: twelve heterogeneous grid clients; five attack classes (false-data injection, replay, denial of service, scaling and command injection) injected into 15-minute telemetry windows; and six training schemes (local, centralised, FedAvg, FedProx, FedAvg with record-level differential privacy, and robust aggregation under model-poisoning clients). On each client's own attack mix the schemes were within 0.03 AUROC of one another and local models were as good as any; on attacks a client had not seen, the federated and central detectors held their quality (AUROC 0.87–0.88) while local models fell to 0.74, with FedProx the better federated scheme under heterogeneity. Record-level differential privacy at single-digit ε erased all but the strongest attack signature with 700 windows per client; one poisoning client in twelve destroyed plain averaging while the coordinate-wise median withstood three. At cost-tuned thresholds federation saved 3.3 thousand per client-year over local detection on unseen attacks (positive in 71% of economic draws) and lost 6.6 thousand on seen ones; the attack rate and damage drive the value, poisoners and privacy noise reverse it. Shapley explanations of the federated and centralised detectors agree (rank correlation 0.72–0.79) and a four-rule surrogate reproduces 96% of the federated detector's decisions. All inputs are stylised with stated ranges; the testbed and results file accompany the article.