Heterogeneous Feature Integration for Class-Imbalanced Intrusion Detection in Grid Systems

Modern grid digitalization connects communication networks, monitoring terminals, service platforms, security devices, and operational data sources. Intrusion detection in this setting requires correlating heterogeneous security data with grid-side contextual evidence. To address class imbalance and cross-domain heterogeneity, this study proposes a heterogeneous feature group integration framework for intrusion detection with grid cybersecurity data. Four semantic feature subspaces are constructed symmetrically: network behaviour, power operation context, zone-derived communication/event topology, and system operation state, ensuring equal structural footing for subsequent modality-specific encoding. Transformer-based encoders model temporal dependencies in network, physical, and system state modalities, while a graph neural network encodes topology-related structural information. The resulting embeddings are integrated by a late fusion classifier for multiclass attack identification; the fusion process treats each feature group symmetrically at the decision level, without imposing a priori dominance among modalities. In the main run, the full model achieves an accuracy of 0.944, a macro F1 score of 0.891, a weighted F1 score of 0.937, a macro precision of 0.929, and a macro recall of 0.878. The corresponding balanced accuracy is 0.878, and the multiclass MCC is 0.924. Class-wise results show reliable performance on Benign, Scan, WebAtk, DDoS, DoS, and Backdoor classes, while Ransomware remains difficult and is frequently confused with WebAtk. Specifically, the Ransomware recall is 0.27, with most errors assigned to WebAtk. Modality analysis further indicates that modality contribution is class dependent: some feature groups have limited standalone discriminative power but provide complementary evidence after fusion. This finding highlights an inherent asymmetry in class-wise utility, which we counterbalance by employing both macro and weighted metrics, offering a symmetric evaluation lens that accounts for both minority and majority classes. These results show that grid-oriented intrusion detection benefits from decision-level integration of heterogeneous feature groups and imbalance-aware evaluation, where symmetric treatment of feature subspaces and evaluation perspectives jointly enhances robustness.