GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection
- 1The Zhongshan Power Supply Bureau, Guangdong Power Grid Company Limited, Zhongshan, Guangdong, The People’s Republic of China
- 2Shandong University of Technology, Zibo, Shandong, The People’s Republic of China
Abstract
Driven by the advancement of information technology, the transformation of traditional power grids toward intelligence has rendered power systems more vulnerable to cybersecurity risks arising from greater openness and connectivity. Smart grid communication networks exhibit high heterogeneity, diverse protocols, and strict real-time constraints. Existing intrusion detection systems suffer from two key limitations: neglect of spatiotemporal dependencies in network traffic, which hinders the modeling of complex attack evolution, and absence of a unified detection framework with cross-scenario generalization capability. To overcome these limitations, this study develops GT-PNID, a graph-temporal network-based intrusion detection model designed for grid communication networks. The model utilizes a sliding-window dynamic graph construction mechanism to transform heterogeneous traffic into spatiotemporal graph structures. Subsequently, graph convolutional layers are applied to extract local spatial features, while a multilayer Transformer is introduced to model long-range temporal dependencies, followed by graph-level feature fusion for joint spatiotemporal representation. Experiments on CICIDS2017 and NSL-KDD datasets demonstrate that accuracy and F1-scores exceed 99.98%, while the model’s parameter count (424,478) and per-sample inference time (0.09 ms) are substantially lower than mainstream methods, confirming its superior detection capability, lightweight efficiency, and cross-dataset generalization potential for smart grid security.
Related
- Transformer-aided guard: A hybrid spatio-temporal framework for confidence-aware intrusion detection in cyber-physical systems
- A temperature-adaptive logit-standardized knowledge distillation for lightweight network intrusion detection
- A lightweight privacy-aware federated vision transformer for tomato leaf disease classification
- Lightweight frequency-aware hybrid vision transformer for fine-grained plant disease recognition
- MaxCAT-Net: Hybrid Transformer-Based Skin Lesion Classification and Lightweight Segmentation with Calibration and Cross-Dataset Validation
BibTeX
@article{zhou2026gtpnid,
title = {{GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection}},
author = {Heng Zhou and Mianting Wu and Weixiong Chen and Qiang Zhou},
journal = {PLOS One},
year = {2026},
month = nov,
doi = {10.1371/journal.pone.0360854},
url = {https://doi.org/10.1371/journal.pone.0360854},
note = {CC BY 4.0},
}
RIS
TY - JOUR
TI - GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection
AU - Heng Zhou
AU - Mianting Wu
AU - Weixiong Chen
AU - Qiang Zhou
PY - 2026
DA - 2026/11/06
JO - PLOS One
DO - 10.1371/journal.pone.0360854
UR - https://doi.org/10.1371/journal.pone.0360854
AB - Driven by the advancement of information technology, the transformation of traditional power grids toward intelligence has rendered power systems more vulnerable to cybersecurity risks arising from greater openness and connectivity. Smart grid communication networks exhibit high heterogeneity, diverse protocols, and strict real-time constraints. Existing intrusion detection systems suffer from two key limitations: neglect of spatiotemporal dependencies in network traffic, which hinders the modeling of complex attack evolution, and absence of a unified detection framework with cross-scenario generalization capability. To overcome these limitations, this study develops GT-PNID, a graph-temporal network-based intrusion detection model designed for grid communication networks. The model utilizes a sliding-window dynamic graph construction mechanism to transform heterogeneous traffic into spatiotemporal graph structures. Subsequently, graph convolutional layers are applied to extract local spatial features, while a multilayer Transformer is introduced to model long-range temporal dependencies, followed by graph-level feature fusion for joint spatiotemporal representation. Experiments on CICIDS2017 and NSL-KDD datasets demonstrate that accuracy and F1-scores exceed 99.98%, while the model’s parameter count (424,478) and per-sample inference time (0.09 ms) are substantially lower than mainstream methods, confirming its superior detection capability, lightweight efficiency, and cross-dataset generalization potential for smart grid security.
SN - 1932-6203
ER -