BQEB SecBench: A Reproducible Cyber-Resilience Benchmark Framework for Intelligent Energy Systems

Source abstract

Cyber-physical convergence in modern power systems has expanded the attack surface available to adversaries capable of manipulating sensor data, spoofing measurements, disrupting communications, or injecting false state estimates, yet publicly available benchmark infrastructure for evaluating AI-based cyber-event detection in smart-grid settings remains scarce relative to the benchmark infrastructure available for forecasting and dispatch tasks. This paper introduces BQEB SecBench, a reproducible cyber-resilience benchmark framework extending the four-layer BQEB architecture (Data, Software, Reproducibility, Governance) established in a companion paper to a fifth, benchmark-specific layer and a new Threat Layer. SecBench targets the security-relevant fields of the BQEB-Data v1 synthetic smart-grid dataset, which have been publicly available since the dataset's release but have not, to our knowledge, been benchmarked in any prior publication. Inventory inspection of the distributed attack_class field shows severe class imbalance: of 10,512 records, 10,331 (98.28%) carry no attack label, while four documented event types — sensor fault (82), spoofing (37), denial-of-service (34), and false data injection (28) — make up the remainder. We treat this imbalance as the central design problem the framework must solve and specify four benchmark tasks, an imbalance-aware evaluation protocol built on precision-recall and threshold-independent metrics rather than accuracy, and reproducibility and governance mechanisms extending the software architecture of the companion paper. This manuscript introduces the benchmark framework and evaluation protocol; empirical model comparisons are reserved for subsequent experimental validation. No detection results, accuracy figures, or statistical claims are reported: every quantity that would depend on model execution is explicitly marked reserved for future experimental validation. We regard this disclosure as part of the framework's contribution, not a limitation to be minimized.