Development and Evaluation of a Deep Learning Based Intrusion Detection System (IDS) for Smart Grids

Abstract

Smart grids represent a critical evolution of modern energy infrastructure, integrating digital communication, distributed control, and renewable energy sources into the conventional power network. This integration brings substantial benefits in efficiency and operational flexibility, but it also exposes electrical infrastructure to a wide range of cyber threats, including denial-of-service attacks, man-in-the-middle interception, false data injection, and protocol-specific attacks against SCADA systems. The development of effective intrusion detection systems for smart grid environments has therefore become a critical research priority. This thesis proposes an intrusion detection framework based on a Graph Attention Network applied to network traffic. The system is developed and evaluated on the ML-EdgeIIoT dataset as the primary benchmark and on the DNP3 intrusion detection dataset as a cross-protocol evaluation target. A k-nearest-neighbors similarity graph is constructed from the preprocessed flow records, and the GAT model classifies each flow into one of fifteen classes (normal traffic and fourteen specific attack types). Two iterations of the model are developed: a baseline configuration (v5) and an improved configuration (v6) incorporating cosine similarity, mutual k-NN edges, edge feature conditioning, and label smoothing. The framework is evaluated under two preprocessing protocols ,the original preprocessing described in the dataset publication and a proposed preprocessing developed in this thesis and is also extended to a federated learning configuration with five clients using the FedAvg aggregation algorithm with FedProx regularization. Under the proposed preprocessing, the system achieves macro F1 of 0.948 on ML-EdgeIIoT binary classification, with a 36% reduction in false negatives compared to the baseline, and macro F1 of 0.979 on DNP3 binary classification. Under the original preprocessing, the same model reaches near-perfect performance (F1 = 1.000 on binary), matching the published literature on this dataset. On the multi-class task under the proposed preprocessing, the framework reaches macro F1 of 0.801 on the fifteen-class formulation, rising to 0.886 under a six-class semantic grouping for ML-EdgeIIoT and 0.984 under a five-class grouping for DNP3. The federated configuration reaches macro F1 of 0.835 under Dirichlet non-IID partitioning, demonstrating that distributed training remains viable under realistic deployment conditions.