Physics and Communication-Aware Remote Terminal Unit Cyberattacks Detection and Classification for Smart Energy Grids

Paper contributions
(i) A causal feature set combining robust temporal statistics, three-phase power consistency, spatial RTU disagreement, and communication evidence;
(ii) Explicit fault-versus-cyber rules whose triggers have engineering meaning;
(iii) Stateful persistence that prevents rolling-baseline adaptation from prematurely clearing sustained events; and
(iv) An attack-wise evaluation in which every waveform and timeline explicitly identifies normal operation, the normal electrical fault, and each cyberattack.