HSL‐CFS: Hybrid stacked learning with cooperative feature selection for cyberattack detection in smart grids

Abstract

An effective method for detecting cyberattacks is essential to the security of smart grids (SGs). In SGs, data from both cyber and physical domains can support attack detection. However, existing works insufficiently consider the heterogeneity, high dimensionality, and cross‐domain correlations of multi‐source data, affecting model generalization, stability, and detection accuracy. To address these limitations, this paper proposes a hybrid stacked learning method with cooperative feature selection (HSL‐CFS). First, a cooperative feature selection approach is proposed for feature extraction from multi‐source heterogeneous data. An embedded method with adaptive threshold adjustment and a wrapper method with dynamic bidirectional search extract key features from complementary perspectives, and their feature sets are merged via set union to output representative features. Second, a hybrid stacked model combining Extreme Random Trees (ET) and an improved Convolutional Neural Network (CNN) is proposed. The CNN is enhanced with Euclidean‐norm regularization (L2 regularization) and Squeeze‐and‐Excitation (SE) block attention mechanism to mitigate overfitting and recalibrate channel responses. Furthermore, probability alignment calibrates base classifier outputs before stacking, enabling better capture of complementary patterns in SGs cyber‐physical data. Experimental results show that HSL‐CFS selects fewer features and achieves enhanced stability, generalization and accuracy, outperforming existing methods on the selected dataset.