An Explainable Ai Framework for Multi-Class Attack Classification in Mqtt-Coap-Based Hybrid Energy Monitoring Networks

Abstract

Hybrid renewable-energy microgrids communicate through lightweight MQTT and CoAP links, exposing network traffic and sensor measurements to cyberattacks. This study presents an explainable framework for multi-class attack classification using reproducible message-level co-simulation of a photovoltaic–wind–diesel–battery microgrid. The simulation incorporates exact power balance, eleven sensors, six attack families, and five categories of challenging benign events. The dataset contains 86,400 thirty-second windows spanning 30 days, including 878 attack bursts. Sixty-eight features combine traffic statistics with energy-consistency residuals calibrated during a clean commissioning interval. Evaluation uses chronological partitioning, a purge gap, and block-bootstrap confidence intervals. Among seven classifiers, boosted trees with a five-window lag achieve a macro-F1 of 0.913 (95% confidence interval: 0.893–0.927), Matthews correlation coefficient of 0.907, accuracy of 0.978, and macro-averaged ROC-AUC of 0.974 on seven unseen days. Random partitioning inflates false-data-injection F1 by up to 13 percentage points. All bursts across five network-visible attack classes are detected, with class F1 scores of 0.93–0.98 and a 1.2% false-alarm rate on normal windows. However, window-level detection rates for false-data injection fall to 81% for bias attacks, 65% for ramp attacks, and at most 10% for energy-balance-preserving attacks. Halving attack intensity reduces macro-F1 by five percentage points, while transfer to a second site produces a twelve-point reduction before local adaptation. TreeSHAP explanations demonstrate faithfulness and stability, with deletion AUC of 0.22 versus 0.51 for random rankings, top-five overlap of 0.89, and approximately one-millisecond computation per window. These simulation-based findings highlight both classification effectiveness and limitations under stealthy attacks and site changes; code and data are released for replication.