A reproducible evaluation framework for benchmarking machine learning and hybrid ensemble models in power system anomaly detection

The increasing digitalization of smart grids has substantially improved monitoring capabilities, but it has also heightened exposure to cyber-physical threats, including cyberattacks, equipment failures, voltage disturbances, harmonic distortions, and gradual operational drifts. Addressing these challenges requires robust, accurate, and interpretable anomaly detection frameworks capable of handling complex, nonlinear, and high-dimensional power system data. This study develops a comparative evaluation framework using measurements of voltage, current, load, frequency, power factor, and Total Harmonic Distortion (THD). Within this framework, five machine learning models Random Forest, Logistic Regression, Support Vector Machine with a Radial Basis Function kernel (SVM-RBF), K-Nearest Neighbors (KNN), and Gradient Boosting are evaluated under identical conditions. In addition, two hybrid ensemble approaches, Voting Hybrid and Stacking Hybrid, are incorporated to improve classification performance. The experimental results show that all models achieve high performance, with Gradient Boosting reaching an accuracy of 0.9962. However, the hybrid models provide the highest overall results, where the Voting Hybrid model achieves an accuracy of 0.9989 and the Stacking Hybrid model reaches 0.9994. These findings should be interpreted within the scope of the proposed evaluation framework, where multiple models are systematically benchmarked under identical conditions rather than introducing a single superior model. The models successfully detect both abrupt anomalies, such as cyber-induced spikes and voltage sags, and more subtle patterns, including gradual drift behaviors. To improve interpretability and support practical deployment, the framework integrates SHapley Additive exPlanations (SHAP) and Local Interpretable Model-Agnostic Explanations (LIME), providing insights into both global and instance-level feature contributions. Overall, the primary contribution of this study is the development of a unified and reproducible evaluation framework that enables fair comparison, interpretability, and systematic benchmarking of anomaly detection models in cyber-physical power systems.