PSO-optimized Graph Neural Networks for ransomware detection in smart grids

The digitalization of smart grids has expanded their attack surface, making them prime targets for ransomware, an emerging yet underexplored threat compared to false data injection or denial of service attacks. Conventional intrusion detection systems often fail to recognize ransomware due to its adaptive behavior and ability to hide within complex grid topologies. Graph Neural Networks (GNNs) offer promise for modeling power network structures and capturing spatio-temporal dependencies, but their performance is highly sensitive to hyperparameter and feature choices. This paper presents a novel PSO-optimized GNN framework for ransomware detection in smart grids. Particle Swarm Optimization (PSO) is employed for joint optimization of GNN hyperparameters and feature subset selection, offering an efficient balance between convergence speed and global search capability. The model is evaluated on ransomware scenarios simulated using the IEEE 68-bus test system, where perturbations are designed to mimic realistic ransomware effects such as delayed sensor reporting and corrupted communication data. Experimental results show that PSO-GNN achieves 97.8% accuracy, an F1-score of 0.96, and an AUC of 0.98, while reducing detection latency compared with baseline GNN and traditional machine learning models. These results validate the model’s effectiveness in improving ransomware detection within smart grids, providing a robust and efficient approach for safeguarding critical infrastructure.