Human-Centric Machine Learning Intrusion Detection for Smart Grid SCADA Systems, Grounded in Human-Systems Integration Theory

Abstract

Protecting Smart Grid SCADA systems, a vital component of U.S. critical infrastructure demands technical rigor and human-centered design to ensure real-world effectiveness. While prior work has delved into technical performance in threat detection, achieving high accuracy and low false positive rates (FPRs), few studies have systematically evaluated how operator interaction and cognitive load influence actual detection and response workflows. The 2015 Ukraine power grid attack, which disabled electricity for approximately 230,000 residents for several hours and revealed that operators struggled to interpret legacy alarms under duress, underscores the necessity of integrating human factors into machine learning-based intrusion detection systems (ML-IDS). This study develops and evaluates a human-centric ML-IDS pipeline that embeds explainability and interface design principles from Human-Systems Integration (HSI) theory. By comparing standard ML models (Random Forest, XGBoost, SVM) with equivalent models augmented by HSI-guided dashboards, we demonstrate that operators using the human-centric pipeline achieved a 28% reduction in FPR compared to baseline ML-IDS outputs, translating to approximately 7 fewer false alarms per 100 alerts, reducing operator alert fatigue and improving average response times by nearly 20 seconds per incident (mean reduction = 19.8 s, SD = 4.2 s, N = 12). Usability metrics further support these findings: the System Usability Scale (SUS) score of 76.2 (above the 68 thresholds for above-average systems) indicates strong operator acceptance, while a NASA-TLX score of 39.4 (approximately 20 points below the 60–70 range observed in traditional IDS interfaces) suggests substantially reduced cognitive workload. These results confirm our hypotheses: H1, that HSI-informed interfaces improve detection effectiveness, and H2, that reduced cognitive load correlates with lower false alarm rates. We conclude that embedding human-centric design into ML-IDS not only maintains high accuracy (0.96 vs. 0.94 for baseline) but materially enhances operational readiness by aligning technical outputs with real-world human decision-making processes.