Adaptive Cyber Attack Detection in Distribution Systems using Machine Learning and Spatiotemporal Patterns

The increasing sophistication of cyberattacks targeting power distribution systems has exposed vulnerabilities in conventional security practices. Most Intrusion Detection Systems (IDS) currently rely on signature-based and rule-based methods, which are ineffective against evolving threats such as False Data Injection Attacks (FDIA) and Denial-Of-Service (DoS) attacks. To address this, we propose an adaptive and intelligent cybersecurity framework leveraging Graph Neural Networks (GNNs) for spatial analysis and Long Short-Term Memory (LSTM) models for temporal sequence detection. The model processes real-time network traffic, identifies anomalies based on graph structure changes in sequential attacks, and enhances the speed of cybersecurity response. Performance evaluation using the NSL-KDD dataset with synthetic FDIA and DoS attack patterns demonstrates a detection accuracy of 94.3%, a false positive rate of 3.2%, and a detection latency of only 180 ms, outperforming traditional IDS, which have an average latency of 450ms. Additionally, the integration of Explainable AI (XAI) using SHAP values improves model interpretability, enabling security analysts to validate detections efficiently. This study highlights that combining spatial and temporal analysis in ML-based cybersecurity systems enhances accuracy, reduces false positives, and improves response times, making it a viable approach for securing power distribution infrastructure against cyber threats.