Digital twin–guided graph-transformer with meta-reinforcement learning for real-time adaptive cyber-attack mitigation in smart grids

Smart grids are rapidly changing the current face of power systems by the use of state-of-the-art sensing and communication technology and renewable energy resources to improve the efficiency, reliability and sustainability of the transmission system. However, with the growing cyber–physical connectivity, new and more advanced cyber–physical attacks are emerging, and a rules-based approach or an offline learning process is not effective to counter them. To mitigate cyber-attacks in real-time for smart grids, a digital-twin guided graph-transformer architecture with meta-reinforcement learning is proposed, namely DT-GXTNet. The architecture is designed to produce interactive graphs of the communication in intrusion-detection traffic and is based on the use of spatial–temporal attention to identify changing relationships between the components of the grid. The learned representations are incorporated into a predictive digital twin, which simulate the propagation of the attack, vulnerability analysis and prediction of future grid states for the various threats. A meta-reinforcement learning agent views mitigation as a sequential decision-making process, enabling the agent to quickly and adaptively adjust its policy to the novel and evolving attacks, as well as previously unseen attacks. Experimental testing on public smart-grid intrusion data yields a detection accuracy ranging from 98.25% to 99.1%, and precisions and recalls are between 96% and 99% with an F1-score between 96% and 99%. Another unique feature of DT-GXTNet is that it provides a much lower real-time inference latency of 22ms, a 67.6% reduction fromDL-based digital-twin baseline (68ms). In addition, ablation and prediction analyses are provided, further illustrating the complementary benefits of graph-transformer learning, digital-twin simulation, and adaptive policy optimization. DT-GXTNet is an adaptive, scalable infrastructure for overall responsive and resilient smart-grid cyber-defense.