Hybrid deep learning for smart grid SCADA intrusion detection with mutual information feature selection for smart meter data analysis

Abstract

The rapid evolution of smart grid infrastructure has intensified the dependence on SCADA-based supervisory systems for real-time energy management, grid reliability monitoring, and seamless integration of renewable energy sources. However, the growing digitalization of these cyber-physical networks exposes smart meter communication channels and substation control systems to sophisticated cyberattacks that threaten grid stability, energy distribution continuity, and operational safety. This paper proposes a hybrid CNN-Transformer-BiGRU deep learning architecture for intrusion detection in smart grid SCADA networks, designed to jointly address high-dimensional temporal telemetry, severe class imbalance, and industrial measurement noise inherent in smart meter data streams. Unlike prior hybrid CNN-LSTM or CNN-Transformer designs that pair only two complementary inductive biases, the proposed architecture integrates three: (1) two 1D convolutional blocks with Swish activations and batch normalization for local temporal motif extraction; (2) a single Transformer encoder block with eight-head self-attention for global contextual dependency modeling across distributed grid nodes; and (3) a Bidirectional Gated Recurrent Unit (BiGRU) layer for bidirectional sequence representation of attack propagation patterns. A reproducible preprocessing pipeline—comprising mutual information-based dimensionality reduction to 60 features, Adaptive Synthetic Minority Oversampling (ADASYN), z-score standardization fitted only on the training partition, and F1-maximizing threshold optimization—ensures class-balanced, leakage-free training. Evaluated on 14,415 held-out samples from the Mississippi State University (MSU) power system benchmark, the proposed model achieves 88% accuracy, macro F1-score of 0.86, Matthews Correlation Coefficient (MCC) of 0.74, and ROC-AUC of 0.94, outperforming CNN-only, CNN-LSTM, and CNN-Transformer baselines under an identical preprocessing protocol by statistically significant margins (McNemar’s test, \(p < 0.001\) ). Extended ablations isolating mutual information selection, ADASYN oversampling, and threshold tuning quantify the contribution of each preprocessing stage, and five-fold stratified cross-validation reports F1 \(= 0.87 \pm 0.01\) , indicating stable generalization. Operational metrics on the held-out MSU partition—false negative rate of 9%, false alarm rate of 7%, sub-100 ms inference latency on commodity hardware, and a compact 1.5M-parameter footprint—suggest the architecture is a promising candidate for substation-edge deployment, while we explicitly note that field validation on heterogeneous live SCADA traffic remains future work.