# Dataset Description

## 📁 Data Description
The dataset for this competition consists of several CSV files containing simulated, labeled cyber-physical data derived from the DERSec DER Simulator. This data captures the real-time operational and electrical characteristics of Distributed Energy Resources (DERs) operating under both normal and anomalous conditions.

## Data Files Provided 📂
You will be provided with four key CSV files:

- **train.csv**: The primary dataset for model training (2,363,137 rows × 739 columns)
- **test.csv**: The feature set used for generating predictions (1,012,774 rows × 738 columns)
- **sample_submission.csv**: A template showing the correct format for your submission file. Your final predictions for the test.csv data must match this format.

## Feature Set (Input Variables) 📈
The columns in train.csv and test.csv represent the cyber-physical state of the DER simulator at a specific moment in time. The dataset contains **737 features** covering:

- **Cyber (Interoperability) Data**: Settings and commands related to the SunSpec Modbus (e.g., maximum power limits, reactive power commands, register values).
- **Physical (Electrical) Data**: Real-time AC and DC measurements (e.g., voltage, current, real power, reactive power, power factor).
- **Control Parameters**: Values associated with advanced grid-support functions, such as Volt-Var curve points, Volt-Watt parameters, and Frequency-Droop settings.
- **Time/Index Column**: A unique identifier (Id) to correlate measurements.

## Anomaly Types 🔐

**Good/Normal data** represent the DER operating over a range of irradiance, grid voltage, and grid frequency values with different control modes enabled.

**Bad/Anomaly data** represent a range of cyberattacks on the system:
- **Bad Commands**: Directly issuing commands outside of IEEE 1547-2018 ranges of adjustability
- **Protocol Anomalies**: Bad enum or bitfield values
- **Missing Data**: Missing SunSpec Modbus data
- **Data Falsification**: Manipulated reported SunSpec values

The malicious control and data falsification is performed using **machine-in-the-middle attacks** on the SunSpec communications channel between the DERMS and DER.

### Attack Diagram
```
Distributed Energy Resource  <-- Switch --> DER
Management System (DERMS)          |
                                   v
                               Adversary
```

## Target Variable (Output) 🏷️
The target variable for this binary classification challenge is contained within train.csv and is represented by a single column (Label).

| Target Value | Data Type | Description |
|--------------|-----------|-------------|
| 0 | Integer | Good/Normal: Indicates secure, compliant DER operation. |
| 1 | Integer | Bad/Anomaly: Indicates a cyber-physical anomaly or security breach. |

Your model's primary task is to accurately predict this binary state for the data in test.csv.

## Submission File Format 📝
Your submission must be a CSV file with exactly two columns, matching the format of sample_submission.csv:

- **Id**: The unique identifier for each row from the test.csv file.
- **Label**: Your model's predicted probability (a float between 0 and 1) that the observation belongs to class 1 (Bad/Anomaly).

### Example Submission Format
```csv
Id,Label
313994,0.358885
899738,0.989644
2975655,0.261438
...
```

### Scoring Process
1. You submit **probabilities** (0.0 to 1.0)
2. Kaggle converts to binary predictions using a threshold (typically 0.5)
3. F2 score is calculated: F2 = 5 × (precision × recall) / (4 × precision + recall)
4. **Higher is better** (max score = 1.0)

**Note**: The F2 metric heavily favors **recall** (detecting anomalies) over precision. With beta=2, recall is weighted 4x more than precision, making it critical to catch as many anomalies as possible, even at the cost of some false positives.