Organizations: African Institute for Mathematical Sciences (AIMS), Kigali, Rwanda. · Department of Mathematics, Rhodes University, PO Box 94, Makhanda, 6140, South Africa. · National Institute for Theoretical and Computational Sciences (NITheCS), Stellenbosch, 7600, South Africa. · Department of Mathematics, Ludwig Maximilian University of Munich, Bavaria, 80333, Germany. · Department of Engineering, University of Ferrara, Via Saragat 1, Ferrara, 44122, Italy.
Reliable anomaly detection in distributed power plant monitoring systems is essential for ensuring operational continuity and reducing maintenance costs, particularly in regions where telecom operators heavily rely on diesel generators. However, this task is challenged by extreme class imbalance, lack of interpretability, and potential fairness issues across regional clusters. In this work, we propose a supervised ML framework that integrates ensemble methods (LightGBM, XGBoost, Random Forest, CatBoost, GBDT, AdaBoost) and baseline models (Support Vector Machine, K-Nearrest Neighbors, Multilayer Perceptrons, and Logistic Regression) with advanced resampling techniques (SMOTE with Tomek Links and ENN) to address imbalance in a dataset of diesel generator operations in Cameroon. Interpretability is achieved through SHAP (SHapley Additive exPlanations), while fairness is quantified using the Disparate Impact Ratio (DIR) across operational clusters. We further evaluate model generalization using Maximum Mean Discrepancy (MMD) to capture domain shifts between regions. Experimental results show that ensemble models consistently outperform baselines, with LightGBM achieving an F1-score of 0.99 and minimal bias across clusters (DIR ≈0.95). SHAP analysis highlights fuel consumption rate and runtime per day as dominant predictors, providing actionable insights for operators. Our findings demonstrate that it is possible to balance performance, interpretability, and fairness in anomaly detection, paving the way for more equitable and explainable AI systems in industrial power management. {\color{black} Finally, beyond offline evaluation, we also discuss how the trained models can be deployed in practice for real-time monitoring. We show how containerized services can process in real-time, deliver low-latency predictions, and provide interpretable outputs for operators.
Figures & tables
Column Name
Description
CONSUMPTION HIS
The total amount of fuel consumed during a specific period before the next refuelling occurs.
CONSUMPTION_RATE
The hourly fuel consumption of the generator, measured in litres.
Cluster
The geographic locations where the generator sites are situated (cities).
CURRENT HOUR METER GE1
The current reading of the hour meter on the generator, indicating total operational hours.
Site Name
The designated name for each generator location.
EFFECTIVE_DATE_OF_VISIT
The date on which the fuel meter reading, refuelling, and other data entries are recorded.
Table 1: Description of the different features in the dataset.
Figure 1: This flowchart illustrates a data labeling process for classifying anomalies in a dataset. It evaluates conditions related to running time and fuel consumption to categorize data points into four classes: Class 1, Class 2, Class 3 (anomalies), or Class 0 (normal).
Figure 2: A visualization of generator performance anomalies across multiple clusters, highlighting instances of extended runtime (¿24 hours) and fuel overconsumption.
Figure 3: Frequency distribution of normal (Class 0) and anomalous (Classes 1-3) generator events across multiple regional clusters.
Figure 4: Feature importance from a RF classifier, showing Running time per day and consumption per day within a period as the most critical predictors for the model’s decisions.
Figure 5: Distribution of Generator Data Across Clusters: A bar chart showing a skewed distribution of samples, with MEIGANGA 1 (577) and NGOUNDERI (539) having the highest counts, followed by a gradual decline to BANYO and WAZA ( 146-166)
Figure 6: Correlation matrices for the global dataset and clusters representing high, medium, and low correlation with the target variable. (a) GLOBAL dataset, (b) BANYO (high correlation), (c) NGAOUNDERE 2 (medium correlation), (d) MAKARY (low correlation). Strong correlations ( ∣r∣≥0.4 ) are shown in white.
Figure 7: A structured methodology for training both a global models and cluster-specific models, featuring data fusion, class balancing with SMOTE, multi-algorithm training, and evaluation for accuracy, explainability (SHAP), and bias (DIR).
Metric
Formula
Description
Accuracy
TA+TN+FA+FNTA+TN
Proportion of correct predictions (true anomaly, TA , and true normal, TN ) over all predictions, including false anomaly ( FA ) and false normal ( FN ).
Precision
TA+FATA
Proportion of true anomaly predictions among all anomaly predictions, critical for minimizing false alarms in anomaly detection.
Recall
TA+FNTA
Proportion of true anomalies correctly identified, ensuring sensitivity to rare events like Class 1 (fuel misuse).
F1-Score
Precision+Recall2⋅Precision⋅Recall
Harmonic mean of precision and recall, prioritized for imbalanced datasets to balance detection of rare anomalies and false anomaly.
AUC-ROC
∫01TAR(t)dFAR(t)
Area under the curve plotting true anomaly rate ( TAR=TA+FNTA ) against false anomaly rate ( FAR=FA+TNFA ), measuring model discrimination ability.
Table 2: Evaluation Metrics and Formulas
Figure 8: Model performance metrics across Models (LR, SVM, KNN, MLP, AdaBoost, CatBoost, RF, LightGBM, XGBoost, GBDT) show variability in AUC-ROC, F1 Score, Precision, Accuracy, FPR, and Latency. The ’GLOBAL’ label represents models trained and evaluated on the full dataset with show hight performance for all models across clusters, while the other label indicates cluster-specific models.
Figure 9: This visualization reveals the generalization performance of models (GBDT, XGBoost, LightGBM, CatBoost, SVM, KNN, MLP, AdaBoost) trained on BANYO, tested across clusters. Variability in Accuracy, F1 Score, and MMD is evident, with CatBoost and LightBoost showing consistency, while KNN and MLP fluctuate, reflecting cluster adaptability.
Figure 10: The generalization performance of models (LR, RF, GBDT, LightGBM, CatBoost, SVM, KNN, MLP, and AdaBoost) trained on NGAOUNDERE 2 and evaluated across clusters. Accuracy, F1 Score, and MMD all exhibit variability; LightGBM and AdaBoost are consistent, but SVM and MLP exhibit fluctuations, which indicate regional adaptation.
Figure 11: This illustration captures the adaptability of models (RF, GBDT, XGBoost, LightGBM, CatBoost, SVM, KNN, MLP, AdaBoost) trained on MAKARY, tested across clusters. It displays fluctuations in Accuracy, F1 Score, and MMD, with RF and GBDT showing steadiness, while MLP and KNN vary, suggesting differing resilience to cluster data differences.
Figure 12: This shows models (AdaBoost, CatBoost, GBDT, KNN, LR, LightGBM, MLP, RF, SVM, XGBoost) trained on data, with Accuracy and F1 Scores (0.85-1.0) varying by cluster, and MMD (0.02-0.14) showing domain shift, where GBDT and LightGBM are most robust.
Figure 13: These visualizations show for all the models trained on the entire data, displaying mean absolute SHAP values by different classes, the most impaction feature on the output is running time per day
Figure 14: These visualizations exhibit mean absolute SHAP values per class for all models trained on the BANYO Cluster data, with running time per day being the most influential feature on the output.
Figure 15: For all models trained on the NGAOUNDERE 2 Cluster data, these visualizations show mean absolute SHAP values per class, with running time per day having the most impact on the results.
Figure 16: For every model trained on the MAKARY Cluster data, these visualizations show mean absolute SHAP values per class, with running time per day having the most impact on the results.
Feature
Occurrences
Running time per day
25
consumption perDay within a period
24
RUNNING TIME
16
CONSUMPTION HIS
14
Fuel consumed between visits Per Day
14
GENERATOR 1 CAPACITY (KVA)
13
Table 3: Running time per day and consumption per day within a period are frequently the most impact features across clusters, indicating they may be strong predictors of fuel consumption behavior.
Figure 17: Fairness evaluation for the BANYO cluster, showing high detection rates for ensemble models such as AdaBoost and XGBoost, but significant bias (DIR) for all models except SVM.
Figure 18: Performance disparity for the NGAOUNDERE 2 cluster, where ensemble models such as CatBoost and GBDT show high detection, while SVM, KNN, and MLP show less anomaly detection. And all models are some how far from fair zone
Figure 19: Performance and fairness evaluation for the MAKARY cluster, showing high detection rates for ensemble models such as AdaBoost and RF, but significant bias (DIR) with most models favoring the minority cluster.
Figure 20: Global model fairness evaluation showing inconsistent performance across clusters, with high bias against NGAOUNDERE 2 and in favor of MAKARY, while performance for BANYO and other clusters is generally within the fair zone.
Figure 21: Decision boundaries of various models, showing tree-based methods (XGBoost, LightGBM) capturing complex, local patterns while linear models (SVM, LR) form smoother, more generalized separations.
Figure 22: Model decision boundaries on the BANYO cluster vary from smooth (LR, SVM) to highly tree-based models, with misalignments in mixed areas indicating higher localized misclassification risk than the global model.
Figure 23: Models adapt variably to the cluster’s sparse, linear distributions, from smooth (LR, SVM) to fragmented (tree-based) boundaries, with overlaps in intermixed areas indicating heightened misclassification risks.
Figure 24: Models adapt to the cluster’s imbalanced, bipolar data with varying boundary complexity, from smooth to highly fragmented, resulting in minority class overlaps and heightened misclassification risks.
The rapid growth of Distributed Energy Resources (DERs) has significantly expanded the cyber attack surface of modern power grids. Furthermore, increasing sophistication in attack techniques demands anomaly detection systems (ADS) that are accurate, interpretable, and reliable to support DER cybersecurity. While ML-based ADS provide strong detection capabilities, their black-box nature reduces operator trust and limits Security Operation Center's (SOC) ability to effectively interpret alerts and respond, highlighting the need for explainable Artificial Intelligence (XAI) to ensure transparency and operational confidence. This paper presents an XAI-based anomaly detection framework tailored for DER networks (ExCYDER). The proposed framework uses a self-verifying mechanism that validates ADS alerts to ensure trustworthy decision-making. ExCYDER combines LightGBM with SHAP to check whether each model decision aligns with its feature-attribution evidence, allowing the system to confirm that its internal reasoning is consistent and reliable. Experiments on a realistic DNP3 dataset achieved over 98% detection accuracy, an average rule--SHAP consistency of 44.6%, a SHAP latency of 14.5 ms per alert, and a confidence deviation within 5%, demonstrating stable verification behavior with minimal computational overhead. The framework distinguished between coherent and inconsistent alerts without compromising detection accuracy, demonstrating that integrated verification within XAI-based ADS enhances interpretability, auditability, and operational robustness for DER-focused SOCs.
Accurate forecasting of electricity production is essential for maintaining the operational efficiency and strategic planning of energy utilities. In industrial settings, such forecasts are generated daily to ensure supply-demand balance and optimal management of production assets. However, the increasing complexity of modern power systems and data flows poses significant challenges for ensuring the reliability and consistency of these forecasts. This paper addresses the problem of anomaly detection in short-term production forecasts at EDF, formulated as identifying atypical intra-day patterns that may signal data quality issues or operational irregularities. We introduce TAMIS, a scalable and interpretable system that analyzes daily production time series to automatically detect anomalous days based on deviations from historical patterns learned from past data. Designed for human-in-the-loop workflows, TAMIS surfaces top-ranked anomalies through an automated daily newsletter, enabling efficient expert review and continuous monitoring. An extensive experimental evaluation on real-world industrial data demonstrates that TAMIS achieves the best accuracy-efficiency trade-off compared to baseline methods. To foster further research and reproducibility, we publicly release the anonymized application datasets used in our study.
Artificial Intelligence (AI)-based prospective anomaly detection methods are increasingly deployed in high-dimensional and nonlinear settings. Among these approaches, AI-based statistical process monitoring (SPM) is widely used, providing a structured framework for prospective monitoring. Once an anomaly is detected, a diagnosis method is needed to identify the features driving the flagged observation away from normal behaviour. Traditional SPM diagnosis methods are typically designed for specific detection models and cannot be directly applied to AI-based methods. Model-agnostic explainable AI (XAI) offers a general framework for feature relevance explanation. However, existing methods suffer from scalability limitations or assign relevance to noise features, reducing diagnosis accuracy. We propose a scalable, baseline-referenced diagnosis method that uses both the anomalous observation and normal baseline information. We provide mathematical guarantees that under a mean-shift anomaly setting, the proposed method achieves higher faithfulness in detecting the features causing the anomaly compared to LIME. Simulation studies and a real-world case study validate the effectiveness of the proposed method and show that it generates more faithful and accurate diagnosis results for AI-based prospective anomaly detection methods.
Jiaqi Qiu, Rob Goedhart, Jannis Kurtz +1
Department of Business Analytics, Amsterdam Business School, University of Amsterdam, Amsterdam, The Netherlands