Graph-Based Intrusion Detection for Edge-Cloud IoT Energy Systems

The accelerated distribution of Internet of Things (IoT) devices in critical energy infrastructure, such as smart grids, creates unmatched attack surface areas available to cyberattacks. While advanced cyberattacks could be deterred by an Intrusion Detection System (IDS), traditional solutions often rely on static signature matching or naive time-series anomaly detection. Therefore, the traditional forms of IDS do not address the agile, dynamic, distributed and heterogeneous nature of IoT networks well. The current paper presents an innovative graph-theoretic intrusion detection framework designed for edge-cloud IoT energy systems. Our approach rigorously models IoT sensor communication and device interactions via dynamic temporal graphs. We apply advanced graph embeddings such as GraphSAGE and Node2Vec, to identify the complex and dynamic layers of the IoT device’s behavioral structure. We construct a sequence of temporal graphs embeddings and the other representation on temporal graphs involves training a sparse autoencoder on the temporal sequence of graph embedding to detect anomalous device behaviors that indicate potential cyberattacks, like Advanced Persistent Threats (APTs), or sophisticated spoofing of devices. The proposed hybrid IDS are capable of distributed inference on edge nodes, allowing real time low latency detection on local threats and providing centralized logging and higher level, collective analysis in the cloud. This paper presents the first combination of temporal graph modeling and hybrid edge-cloud anomaly detection for smart grid detection specifically for smart grid environments with minimal compute overhead and practically deployable solution for real-world IoT security.