Identifiability-Aware, Cost-Aware Triage of Physical Faults and Measurement-Integrity Anomalies in Energy Cyber-Physical Systems.

After an anomaly is detected in an energy cyber-physical system, operators must decide whether to respond as if the process has physically failed or as if the measurements have lost integrity. These causes can require different actions, yet they may produce similar telemetry. We present a detection-gated triage framework that first applies a fixed canonical-variate detector and then uses nine physical-consistency features to distinguish physical process faults from measurement-integrity anomalies. Evaluations on the Tennessee Eastman Process and a wind-farm simulator yielded cause-attribution AUCs of 0.873 and 0.895 and end-to-end balanced accuracies of 0.805 and 0.792, respectively. Under the specified response-cost matrices, the policy reduced expected misattribution cost by 18.4% and 28.9% relative to blanket responses. Tests on real datasets show that ranking can transfer, but operating thresholds require plant-specific calibration. Exact matched sensor-fault/attack pairs give chance-level discrimination, demonstrating a fundamental boundary: measurement-only data cannot identify different causes that generate the same observations. The framework is therefore intended as an auditable triage aid, with ambiguous or out-of-distribution cases routed to review rather than treated as confirmed cyber attribution.