Lightweight Machine Learning-based Intrusion Detection Under Class Imbalance in Smart Grids

Intrusion detection is crucial in smart grids, where operational traffic must be monitored at substations and edge devices with tight latency and resource limits. While machine learning (ML) is appealing for this purpose, actual implementation necessitates lowering feature dimensionality and dealing with substantially imbalanced, multiclass attack data in which infrequent but safety-critical events are underrepresented. This study systematically evaluates five ML classifiers combined with three filter-based feature selection (FS) methods—Fisher Score, Mutual Information, and ANOVA across three contemporary smart grid/ICS datasets. Filter methods are used because they are model-agnostic and compute-efficient, fitting low-footprint, low-latency deployments. We jointly assess detection under controlled multiclass imbalance and deployment-oriented efficiency (mean wall-clock training/inference time and serialized model footprint), guiding real-time, resource-constrained environments. Under varying imbalance ratios, tree-based models emerge as consistently robust, and filter-based FS maintains competitive accuracy while reducing latency and model size, supporting practical ML-based IDS in smart-grid settings. No earlier study in this domain has combined a simple, deployment-friendly filter FS with a multidataset, multiclass, controlled-imbalance evaluation, as well as end-to-end efficiency measures.