An Attack Traceability Method for Power <scp>IoT</scp> Terminals Based on Dynamic Causal Graph

ABSTRACT As key smart grid edge nodes, power IoT terminal security directly impacts power network stability. However, traditional traceability techniques face sample imbalance, graph scale expansion, and computational delay. Thus, this paper proposes an attack traceability method for power IoT terminals based on dynamic causal graph. Firstly, residual generative adversarial networks generate synthetic attack data meeting timing and logic constraints to alleviate real attack sample scarcity; Secondly, a dynamic graph convolution causal reinforcement mechanism is designed—combining mutual information and attention weights to optimize attack traceability graph topology, reducing computational complexity while improving path inference accuracy; Finally, multi‐level graph distillation transfers knowledge from complex graph attention networks to lightweight graph isomorphism networks, enabling efficient attack traceability in resource‐constrained environments. Experiments show this method significantly boosts detection accuracy with few samples, outperforms traditional methods in cross‐domain attack traceability accuracy, and cuts model computational overhead sharply, making it suitable for edge device deployment.