Abstract
The increasing sophistication of cyber-physical attacks on power grid infrastructure necessitates advanced security monitoring systems capable of real-time threat detection and causal analysis. Graph Neural Networks (GNNs) excel at modeling interconnected systems by capturing complex topological relationships, making them ideal for analyzing power grid dynamics where electrical components exhibit intricate spatial dependencies. Pre-trained Language Models (PLMs) leverage contextual understanding from vast text corpora to process unstructured security logs that traditional rule-based systems cannot handle effectively. Hypothesis: We hypothesize that synergistic integration of GNNs and PLMs through multimodal fusion can significantly enhance power grid security alert generation by simultaneously leveraging topological relationships and semantic understanding of security events. Methods: This paper presents a novel framework that synergistically integrates Graph Neural Networks (GNNs) and Pre-trained Language Models (PLMs) to enable intelligent causal reasoning for power grid security alert generation. Our approach introduces three key innovations: (1) a multimodal fusion architecture processing both structured grid topology and unstructured security logs, (2) spatial-temporal GNNs with multi-scale attention mechanisms, and (3) enhanced causal reasoning with domain constraints. The framework employs spatial-temporal GNNs to capture evolving grid dynamics, while domain-adapted PLMs analyze log streams to extract security-relevant patterns. A sophisticated causal reasoning module based on structural causal models identifies root causes through enhanced PC algorithms with domain constraints. Experiments: Extensive evaluation on PowerGraph benchmark and real-world security datasets validates the framework across diverse attack scenarios. Ablation studies demonstrate the effectiveness of multi-scale attention mechanisms, showing 8.4% F1 score decrease when removed. Attention visualization reveals successful capture of local component interactions, regional patterns, and global cascading pathways. Findings: Results demonstrate an F1 score of 0.956, representing 12.3% improvement over state-of-the-art methods. The system maintains sub-second response times for grids up to 2,000 buses while providing interpretable alerts with 91.8% causal accuracy. Multi-scale attention mechanisms achieve a 23% improvement in cascade failure prediction accuracy.
References
A. Varbella, K. Amara, B. Gjorgiev, M. El-Assady, G. Sansavini, PowerGraph: A power grid benchmark dataset for graph neural networks, Advances in Neural Information Processing Systems 37 (2024) 110784–110804.
Y. Zhang, P.M. Karve, S. Mahadevan, Graph neural networks for power grid operational risk assessment under evolving unit commitment, Applied Energy 380 (2025) 124793.
S. Ghamizi, A. Bojchevski, A. Ma, J. Cao, Safepowergraph: Safety-aware evaluation of graph neural networks for transmission power grids, arXiv preprint arXiv:2407.12421 (2024).
Y. Zhang, P.M. Karve, S. Mahadevan, Graph neural networks for power grid operational risk assessment under evolving grid topology, arXiv preprint arXiv:2405.07343 (2024).
Y. Wang, J. Peng, J. Zhang, R. Yi, Y. Wang, C. Wang, Multimodal industrial anomaly detection via hybrid fusion, Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2023, pp. 8032–8041.
Liu, C., Yang, X., Li, M., Tong, T., Yin, L. and Jiang, Y. 2025. A Deep Reinforcement Learning Framework for Attack-Fault Tree Analysis and Security Assessment in Power Systems. Journal of Cyber Security and Mobility. 14, 03 (Aug. 2025), 531–552.
R.K. Jha, Strengthening smart grid cybersecurity: An in-depth investigation into the fusion of machine learning and natural language processing, Journal of Trends in Computer Science and Smart Technology 5(3) (2023) 284–301.
A. Zaboli, S.L. Choi, T.-J. Song, J. Hong, Chatgpt and other large language models for cybersecurity of smart grid applications, 2024 IEEE Power & Energy Society General Meeting (PESGM), IEEE, 2024, pp. 1–5.
W. Liao, B. Bak-Jensen, J.R. Pillai, Y. Wang, Y. Wang, A review of graph neural networks and their applications in power systems, Journal of Modern Power Systems and Clean Energy 10(2) (2021) 345–360.
B. Achaal, M. Adda, M. Berger, H. Ibrahim, A. Awde, Study of smart grid cyber-security, examining architectures, communication networks, cyber-attacks, countermeasure techniques, and challenges, Cybersecurity 7(1) (2024) 10.
J. Duan, Deep learning anomaly detection in AI-powered intelligent power distribution systems, Frontiers in Energy Research 12 (2024) 1364456.
J. Zhang, H. Bu, H. Wen, Y. Liu, H. Fei, R. Xi, L. Li, Y. Yang, H. Zhu, D. Meng, When LLMs meet cybersecurity: A systematic literature review, Cybersecurity 8(1) (2025) 55.
M. Xu, J. Fan, X. Huang, C. Zhou, J. Kang, D. Niyato, S. Mao, Z. Han, K.-Y. Lam, Forewarned is forearmed: A survey on large language model-based agents in autonomous cyberattacks, arXiv preprint arXiv:2505.12786 (2025).
S. Jin, False data injection attack against smart power grid based on incomplete network information, Electric Power Systems Research 230 (2024) 110294.
Y. Hu, F. Zou, J. Han, X. Sun, Y. Wang, Llm-tikg: Threat intelligence knowledge graph construction utilizing large language model, Computers & Security 145 (2024) 103999.
Z. Zhao, H. Bai, J. Zhang, Y. Zhang, S. Xu, Z. Lin, R. Timofte, L. Van Gool, Cddfuse: Correlation-driven dual-branch feature decomposition for multi-modality image fusion, Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2023, pp. 5906–5916.
A.V. Malarkkan, D. Wang, Y. Fu, Multi-view Causal Graph Fusion Based Anomaly Detection in Cyber-Physical Infrastructures, Proceedings of the 33rd ACM International Conference on Information and Knowledge Management, 2024, pp. 4760–4767.
M. Taghizadeh, K. Khayambashi, M.A. Hasnat, N. Alemazkoor, Multi-fidelity graph neural networks for efficient power flow analysis under high-dimensional demand and renewable generation uncertainty, Electric Power Systems Research 237 (2024) 111014.
Z. Zhou, Multimodal Fusion Anomaly Detection Model for Agricultural Wireless Sensors, Engineering Reports 6(12) (2024) e13021.
Y. Song, G. Chen, H. Zhang, Constraint learning-based optimal power dispatch for active distribution networks with extremely imbalanced data, CSEE Journal of Power and Energy Systems 10(1) (2023) 51–65.
F. He, Z. Sun, H. Fan, Deagle: An SMT-based verifier for multi-threaded programs (competition contribution), International Conference on Tools and Algorithms for the Construction and Analysis of Systems, Springer, 2022, pp. 424–428.
G. Li, J.J. Jung, Deep learning for anomaly detection in multivariate time series: Approaches, applications, and challenges, Information Fusion 91 (2023) 93–102.
Y.-C. Yu, T.-H. Chiang, C.-W. Tsai, C.-M. Huang, W.-K. Tsao, Primus: A pioneering collection of open-source datasets for cybersecurity LLM training, arXiv preprint arXiv:2502.11191 (2025).
S. Pan, L. Luo, Y. Wang, C. Chen, J. Wang, X. Wu, Unifying large language models and knowledge graphs: A roadmap, IEEE Transactions on Knowledge and Data Engineering 36(7) (2024) 3580–3599.
Kristić, K. (2022). Critical Infrastructure Protection in Cyberspace. How to deal with uncertainties in increasingly complex environment? (The new cartography of risk and crises), 172.
Xu, H., Wang, S., Li, N., Wang, K., Zhao, Y., Chen, K., … and Wang, H. (2024). Large language models for cyber security: A systematic literature review. ACM Transactions on Software Engineering and Methodology.
Panayiotou, G., Magnani, M. and Pinaud, B. (2024). Current challenges in multilayer network engineering. Applied Network Science, 9(1), 75.
Karlsen, E., Luo, X., Zincir-Heywood, N. and Heywood, M. (2024). Benchmarking large language models for log analysis, security, and interpretation. Journal of Network and Systems Management, 32(3), 59.
Khemani, B., Patil, S., Kotecha, K. and Tanwar, S. (2024). A review of graph neural networks: concepts, architectures, techniques, challenges, datasets, applications, and future directions. Journal of Big Data, 11(1), 18.
Purves, T., Kyriakopoulos, K. G., Jenkins, S., Phillips, I. and Dudman, T. (2024). Causally aware reinforcement learning agents for autonomous cyber defence. Knowledge-Based Systems, 304, 112521.
Wu, Y., Zang, Z., Zou, X., Luo, W., Bai, N., Xiang, Y. … and Dong, W. (2025). Graph attention and Kolmogorov–Arnold network based smart grids intrusion detection. Scientific Reports, 15(1), 8648.
Dong, J., Hao, M., Ding, F., Chen, S., Wu, J., Zhuo, J. and Jiang, D. (2025). A Novel Multimodal Data Fusion Framework: Enhancing Prediction and Understanding of Inter-State Cyberattacks. Big Data and Cognitive Computing, 9(3), 63.
Hu, L., Liu, Z., Zhao, Z., Hou, L., Nie, L. and Li, J. (2023). A survey of knowledge enhanced pre-trained language models. IEEE Transactions on Knowledge and Data Engineering, 36(4), 1413–1430.
Hosseinzadeh, R. and Sadeghzadeh, M. (2025). Attention Mechanisms in Transformers: A General Survey. Journal of AI and Data Mining, 13(3), 359–368.
Zanga, A., Ozkirimli, E. and Stella, F. (2022). A survey on causal discovery: theory and practice. International Journal of Approximate Reasoning, 151, 101–129.
Li, S. and Tang, H. (2024). Multimodal alignment and fusion: A survey. arXiv preprint arXiv:2411.17040.
Abdelkader, S., Amissah, J., Kinga, S., Mugerwa, G., Emmanuel, E., Mansour, D. E. A., … and Prokop, L. (2024). Securing modern power systems: Implementing comprehensive strategies to enhance resilience and reliability against cyber-attacks. Results in engineering, 23, 102647.
Salim, M. M., El Azzaoui, A., Deng, X. and Park, J. H. (2024). FL-CTIF: A federated learning based CTI framework based on information fusion for secure IIoT. Information Fusion, 102, 102074.
Kheddar, H. (2025). Transformers and large language models for efficient intrusion detection systems: A comprehensive survey. Information Fusion, 103347.
This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.
Copyright (c) 2026 Journal of Cyber Security and Mobility