Work

Hybrid deep learning for smart grid SCADA intrusion detection with mutual information feature selection for smart meter data analysis

Year: 2026

Type: article

Abstract: The rapid evolution of smart grid infrastructure has intensified the dependence on SCADA-based supervisory systems for real-time energy management, grid reliability monitoring, and seamless integration of renewable energy sources. However, the growing digitalization of these cyber-physical networks exposes smart meter communication channels and substation control systems to sophisticated cyberattacks that threaten grid stability, energy distribution continuity, and operational safety. This paper proposes a hybrid CNN-Transformer-BiGRU deep learning architecture for intrusion detection in smart grid SCADA networks, designed to jointly address high-dimensional temporal telemetry, severe class imbalance, and industrial measurement noise inherent in smart meter data streams. Unlike prior hybrid CNN-LSTM or CNN-Transformer designs that pair only two complementary inductive biases, the proposed architecture integrates three: (1) two 1D convolutional blocks with Swish activations and batch normalization for local temporal motif extraction; (2) a single Transformer encoder block with eight-head self-attention for global contextual dependency modeling across distributed grid nodes; and (3) a Bidirectional Gated Recurrent Unit (BiGRU) layer for bidirectional sequence representation of attack propagation patterns. A reproducible preprocessing pipeline—comprising mutual information-based dimensionality reduction to 60 features, Adaptive Synthetic Minority Oversampling (ADASYN), z-score standardization fitted only on the training partition, and F1-maximizing threshold optimization—ensures class-balanced, leakage-free training. Evaluated on 14,415 held-out samples from the Mississippi State University (MSU) power system benchmark, the proposed model achieves 88% accuracy, macro F1-score of 0.86, Matthews Correlation Coefficient (MCC) of 0.74, and ROC-AUC of 0.94, outperforming CNN-only, CNN-LSTM, and CNN-Transformer baselines under an identical preprocessing protocol by statistically significant margins (McNemar’s test, $p < 0.001$ ). Extended ablations isolating mutual information selection, ADASYN oversampling, and threshold tuning quantify the contribution of each preprocessing stage, and five-fold stratified cross-validation reports F1 $= 0.87 \pm 0.01$ , indicating stable generalization. Operational metrics on the held-out MSU partition—false negative rate of 9%, false alarm rate of 7%, sub-100 ms inference latency on commodity hardware, and a compact 1.5M-parameter footprint—suggest the architecture is a promising candidate for substation-edge deployment, while we explicitly note that field validation on heterogeneous live SCADA traffic remains future work.

Source: Scientific Reports

DOI: 10.1038/s41598-026-70577-4