A Multiscale Approach to Cyber-Mechanical Threat Modeling for Predicting and Preventing Failures in Critical Energy Infrastructure

The increasing convergence of cyber and mechanical domains in critical energy infrastructure, including electric power grids, oil and gas pipelines, and renewable energy systems, has significantly expanded the attack surface for sophisticated cyber threats, particularly ransomware. These hybrid systems, known as cyber-mechanical systems (CMS), present complex vulnerabilities across multiple temporal and spatial scales, which are inadequately addressed by traditional security frameworks that treat cyber and physical layers in isolation. This study introduces a novel multiscale AI/ML-based framework for predictive resilience modeling and real-time anomaly detection in CMS environments. The proposed architecture integrates a Convolutional Long Short-Term Memory 3D (ConvLSTM3D) model for high-resolution spatiotemporal anomaly detection, and a Graph Neural Network (GNN) for dynamic threat propagation analysis across system hierarchies. The framework was evaluated using both synthetic simulations and the CICIDS 2017 dataset, yielding a test accuracy of 88.86%, an AUC of 0.89, and an F1-score of 0.38 in highly imbalanced ransomware detection scenarios. A simulated ransomware attack on a SCADA-controlled energy network demonstrated the model’s ability to detect threats at the micro (≤1s), meso (1s–1h), and macro (>1h) levels, with detection precision exceeding 95% for short-duration anomalies. These results confirm that modeling cyber-mechanical interactions across multiple scales significantly enhances early threat detection and supports situational awareness. Future research should explore federated learning, continual adaptation, and explainable AI to enable real-time deployment and broader generalizability. By bridging cyber-physical modeling, machine learning, and resilience engineering, this study contributes an actionable framework for safeguarding critical energy infrastructure from increasingly sophisticated and coordinated cyber threats.