DL-Xformer detects grid cyberattacks with 18-class taxonomy in 13ms
New transformer model classifies 18 fault and attack types in inverter-rich power grids
Inverter-based resources and IEC 61850 process-bus measurements have introduced new protection challenges for power grids, including nontraditional fault behavior and measurement-domain cyberattacks. To address these, Abukhousa, Zonouz, and Meliopoulos from Georgia Tech evaluate DL-Xformer—an attention-based transformer classifier—side-by-side with Dynamic State Estimation-Based Protection (DSE-EBP) on identical high-fidelity electromagnetic-transient (EMT) streaming measurements from an inverter-rich power system. The evaluation uses an 18-class taxonomy covering normal operation, 11 physical faults (e.g., DLG), and six measurement-domain attacks (CT/PT ratio manipulation, GPS spoofing). Data is sampled at 4.8 kHz from synchronized upstream and downstream merging units.
Results show DSE-EBP detects all streaming anomalies in 0.417–1.660 ms (mean 0.756 ms), while DL-Xformer classifies the same events in 2.50–50.42 ms (mean 13.46 ms). In a deliberate stress case—a CT ratio attack introduced while residual oscillations from a preceding DLG fault haven't fully settled—the event-window accuracy drops to 76.1%, but the stable final classification remains correct. Measurement-level feature attribution confirms DL-Xformer's decisions are driven by physically meaningful current and voltage channels at the attacked location. The two methods together motivate a layered protection architecture for next-generation inverter-dominated smart grids, combining fast detection with accurate classification.
- DL-Xformer classifies 11 physical faults and 6 cyberattacks in 13.46 ms mean time, while DSE-EBP detects anomalies in 0.756 ms—complementary speeds for layered protection
- Under a stress case with overlapping CT ratio attack and residual DLG oscillations, event-window accuracy drops to 76.1% but final classification remains correct
- Feature attribution shows decisions driven by physically meaningful current/voltage channels at the attacked measurement location, ensuring interpretability
Why It Matters
Combining fast detection with transformer-based classification enables real-time, resilient grid protection against both physical faults and stealthy cyberattacks.