MoE-TransDLD: A Transformer-Driven Mixture of Experts for Cyber-Attack Detection in Power Systems

The collaborative analysis of both cyber-layer and physical-layer data is crucial for improving detection accuracy and timeliness of cyber-attack. Cyber-layer features provide early indicators of attacks, while physical-layer features reflect the actual impact on the power system. To leverage this synergy, a cross-attention mechanism is introduced to generate cross-layer features to capture these cross-layer interactions. Furthermore, based on the traditional Mixture of Experts (MoE), a novel framework MoE-Transformer Dual Layers Detection (MoE-TransDLD) is proposed, which dynamically fuses multi-layer features to model cyber-physical dependencies. Specially, MoE-TransDLD assigns a dedicated expert to each layer, including a cyber-layer expert, a physical-layer expert, and a cross-layer expert, to more accurately model multi-layer data relationships in power systems. Notably, both the expert network and the gating network share a common Transformer architecture to extract global features, while maintaining corresponding independent feed-forward network (FFN), where each expert focuses on its respective domain and the gating network achieves adaptive and dynamic selection in decision making. The synthetic Texas 2000-bus model system is used as an experimental model and its physical-layer data and cyberlayer data are collected. The experimental results show that the MoE-TransDLD significantly outperforms the existing methods and achieves superior classification metrics and faster attack detection time.