Secure signal encoding and temporal feature extraction for multi class intrusion detection in smart grid environments

To ensure the reliability, security and operational stability of smart grid environments, real-time monitoring of electrical data is necessary. It is especially crucial that proper anomaly detection becomes the key to detecting malicious events, preventing disruption of the service, and supporting secure energy transmission. Nonetheless, traditional intrusion detection systems are typically not able to represent long-range temporal relationships, signal variations arising behind secured communication links, and attack-specific relationships, which can result in slow or inaccurate detection. To overcome these weaknesses, this paper suggests a hybrid intrusion detection system called Dilation-Gated Multi-Scale Fusion Encoding-Hierarchical Shifted Window Attention Network-Quadratic Discriminative Capsule Network (DG-MFE + H-SWANet + QDC-Net). In the proposed setting, meter readings are protected in transit by a lightweight chaotic Advanced Encryption Standard-Recursive Diffusion Embedding (AES-RDE) scheme and are decrypted by the authorized grid gateway, so detection is carried out on the recovered measurement stream and not on ciphertext. Then, DG-MFE extracts multi-scale time features, H-SWANet captures local and cross-window contextual dependencies, and QDC-Net performs classification of multi-class intrusion based on confidence. The proposed model was tested on the Smart Grid Real-Time Load Monitoring dataset, with intrusions injected into the measurements before encryption or into the ciphertext during transmission, covering false data injection, replay attack, stealth drift, binary tampering, and protocol corruption. Experimental results show that the proposed framework achieved 98.32% accuracy, 98.72% precision, 98.93% recall, 98.82% F1-score, 97.67% Matthews correlation coefficient (MCC), 99.08% specificity, 0.91% false acceptance rate (FAR), and 12.8 ms inference time, outperforming Temporal Convolutional Network (TCN), ConvNeXt-1D, Bidirectional Long Short-Term Memory (BiLSTM), Residual Attention Network-1D (RAN-1D), and Depthwise Separable Convolutional Neural Network (DSCNN) baselines. These results indicate that the proposed framework provides an effective task-specific solution for multi-class intrusion detection under the configured secure-transmission smart-grid signal modeling and synthetic attack evaluation setup.