Autonomous Cyber Defense for Resilient Power Grids Using Explainable Artificial Intelligence and SCADA Intelligence

The digital convergence of supervisory control and data acquisition (SCADA), operational technology, phasor measurement, and IP-based communications has increased the observability and controllability of modern power grids while enlarging their cyberattack surface. This paper develops an autonomous cyber-defense architecture that combines heterogeneous SCADA intelligence, explainable artificial intelligence (XAI), and safety-constrained response selection to detect, interpret, and contain cyber-physical threats without sacrificing grid continuity. The experimental dataset supplied for the study contains 240,000 labeled records: 120,000 normal observations and 120,000 attack observations spanning false data injection, denial-of-service/distributed denial-of-service, replay, command injection, reconnaissance, and relay/device manipulation. A 70:15:15 train-validation-test partition is used with cyber, physical, protocol, temporal, and security-context features. Across the supplied repeated-run ranges, the proposed XAI-SCADA fusion model reports 96-98% accuracy, recall, and F1-score, with a central F1 value of 97%, compared with 95% for a CNN/LSTM baseline, 93.5% for Random Forest, 92% for Support Vector Machine, and 85.5% for the signature/rule baseline when the tabulated ranges are used consistently. Attack-specific recall ranges from 93-99%. SHAP analysis identifies frequency deviation, voltage phase angle, anomalous control commands, current magnitude, and breaker-state mismatch as the strongest explanatory drivers. The supplied response timing sums to 1.40 s from detection through containment, while the recovery trajectory restores 96% of critical load within 10 s and 100% by 30 s. A normalized service-resilience index of 0.955 is obtained for autonomous defense versus 0.8875 for detection-only defense. The results support a move from passive intrusion detection toward interpretable, operationally constrained, and resilience-aware cyber defense for critical power infrastructure.