Model-based graph reinforcement learning for robust cyber-attack defense in active distribution systems with high DER penetration

Abstract This paper presents a model-based graph reinforcement learning (MBGRL) framework for defending active distribution systems with high penetrations of distributed energy resources (DERs) against cyber-physical threats, particularly false data injection attacks (FDIAs). The proposed approach integrates a learned power-flow surrogate model with a graph neural network (GNN) policy to accelerate convergence, reduce simulator dependence, and capture the spatial structure of distribution networks. Adversarial scenario training further enhances robustness under coordinated load-altering attacks, DER-setpoint tampering, and combined multi-vector FDIAs. Evaluated on the IEEE-123 bus system, the MBGRL framework demonstrates significant improvements over existing methods: it reduces simulator interactions by 54% and training time by more than 60%, while achieving superior operational resilience—lowering voltage violations to 5 (compared with 12 for SAC and 18 for MPC) and reducing active-power losses to 89 kW (compared with 102 kW for SAC and 111 kW for MPC). Although incorporating the surrogate model and GNN introduces additional modeling complexity, MBGRL delivers higher sample efficiency, improves robustness to cyber intrusion, scales effectively with network size, and enables interpretable decision-making. The attention-based GNN structure highlights influential buses during control actions, supporting operator transparency. These results identify MBGRL as a practical and scalable defense strategy for modern DER-rich distribution grids facing evolving cyber-attack risks.