Technical Summary: Large Language Models for Detecting Cyberattacks on Smart Grid Protective Relays

1. Problem Statement

Modern digital substations rely on networked devices and real-time data exchange, introducing significant cybersecurity vulnerabilities. A critical component, the Power Transformer Current Differential Relay (TCDR), is designed to detect internal transformer faults by comparing current phasors from input and output sides. However, TCDRs are vulnerable to False Data Injection Attacks (FDIAs). Malicious actors can manipulate communicated measurements via vulnerabilities in IEC-61850 communication protocols, causing the relay to falsely trip a power transformer during normal operation. This leads to prolonged outages and potential grid instability.

The core challenge lies in distinguishing between manipulated measurements (cyberattacks) and genuine fault-induced disturbances. Existing TCDR logic cannot make this distinction. Furthermore, while previous studies have explored Large Language Models (LLMs) for smart grid applications, they have largely focused on low-dimensional data, cloud-based deployment, or textual data. There is a gap in applying LLMs to high-resolution, multivariate time-series relay measurements for local, real-time cyberattack detection without compromising the relay's dependability.

2. Methodology

The authors propose a framework that adapts compact, locally deployable LLMs to detect cyberattacks on TCDRs by textualizing multivariate time-series current measurements.

A. Data Textualization

The framework converts six-dimensional numerical current measurements (from three phases on both input and output sides of the transformer) into structured natural language prompts.

• Prompt Structure: A standard template is used to describe the "Transformer Differential Relay's current measurement vector" for each phase and side, embedding the numerical values.
• Preprocessing: Numerical values are normalized to [0, 1], rounded to three decimal places, and formatted into fixed-length strings to ensure consistent tokenization.
• Token Constraints: The input is constrained to 512 tokens per sample, a limit supported by compact models like DistilBERT, ensuring the representation fits within the model's input size while preserving temporal and spatial (input vs. output) dependencies.

B. Model Selection and Training

Instead of training models from scratch, the study employs fine-tuning of pre-trained, lightweight LLMs:

• Models: DistilBERT, GPT-2, and a Low-Rank Adaptation (LoRA) variant of DistilBERT.
• Architecture: These models utilize self-attention mechanisms to capture dependencies within the sequential data. The fine-tuning process updates a subset of parameters (including the classification layer) to learn the distinction between fault and attack patterns.
• Deployment: The models are designed to run locally on commercial hardware within the substation, eliminating the need for cloud infrastructure and ensuring data privacy.

C. Interpretability via Attention Mechanisms

A key feature of the methodology is the use of the LLM's internal self-attention scores. By projecting these scores back to the measurement domain, the framework highlights specific time-phase regions that most influenced the classification decision. This provides intrinsic interpretability, allowing operators to visualize which parts of the current waveform triggered the attack detection.

3. Key Contributions

The paper outlines three primary contributions:

1. Textualization Method: A novel approach to converting high-dimensional (192 features across 32 time steps) TCDR current waveforms into structured text prompts that fit within the token limits of compact LLMs while preserving physical relationships necessary for fault analysis.
2. Local Deployability: Demonstration that lightweight LLMs (DistilBERT, GPT-2) can be fine-tuned and deployed locally on standard commercial hardware, achieving inference times under 6 ms. This meets the strict timing requirements of protective relays without external cloud dependencies.
3. Transparent Detection: Introduction of a detection method that leverages self-attention mechanisms to provide transparent reasoning. Unlike "black-box" deep learning models, this approach allows engineers to identify the specific time steps and phases indicative of an attack.

4. Performance Evaluation and Results

The framework was evaluated using the IEEE PSRC D6 test system simulated in the OPAL-RT HYPERSIM platform, generating a dataset of approximately 50,000 labeled samples (faults and various FDIA scenarios).

A. Baseline Comparison

Under nominal conditions, the LLM-based detectors demonstrated competitive or superior performance compared to state-of-the-art Machine Learning (ML) and Deep Learning (DL) baselines (including CNN, LSTM, GRU, SVM, XGBoost, etc.):

• DistilBERT: Achieved a 97.62% cyberattack detection rate with 100% specificity (perfect fault detection accuracy) and an F1-score of 99.36%.
• GPT-2: Achieved a 97.06% detection rate.
• DistilBERT+LoRA: Achieved a 92.31% detection rate.
• Comparison: The LLMs outperformed or matched traditional DL models (e.g., CNN: 96.48%, GRU: 96.98%) and significantly outperformed simpler models like Logistic Regression (68.22%) and Naive Bayes (69.85%).

B. Robustness Evaluations

• Complex Attacks: Under combined Time-Synchronization Attacks (TSA) and FDIA, DistilBERT maintained a 97.20% detection rate, comparable to the best non-LLM baselines.
• Measurement Noise: The models were tested against additive white Gaussian noise at Signal-to-Noise Ratios (SNR) of 45 dB down to 30 dB. While DistilBERT showed some performance degradation at 30 dB (dropping to 89.61% accuracy), it remained robust at higher SNRs typical of modern substations. DistilBERT+LoRA and GPT-2 showed higher resilience to noise in this specific configuration.
• Prompt Sensitivity: An ablation study on prompt variations (phrasing, structure, and removal of semantic identifiers) showed that the models are robust to linguistic changes, maintaining accuracy above 99%. However, removing explicit domain identifiers (phase/side labels) slightly reduced recall, indicating the value of semantic context.

C. Real-Time Performance

On a commercial workstation (Intel Core i9, NVIDIA RTX 4060), the average inference time was 5.39 ms per sample. This corresponds to approximately 0.32 cycles at 60 Hz, satisfying the sub-cycle decision requirements of TCDRs.

5. Significance and Claims

The paper claims that compact, locally deployable LLMs offer a practical, interpretable, and robust solution for enhancing cyberattack detection in modern digital substations.

• Practicality: The ability to fine-tune and run these models on standard commercial hardware without cloud reliance addresses the latency and security constraints of critical infrastructure.
• Interpretability: The use of attention mechanisms provides a level of transparency not found in conventional deep learning models, fostering operator trust in automated decisions.
• Resilience: The framework effectively distinguishes between malicious manipulations and genuine physical faults, preserving the dependability of the protection system.

The authors acknowledge that while the framework enhances detection capabilities, it introduces new potential attack surfaces (e.g., adversarial machine learning, model poisoning). They emphasize the necessity of deploying these models in isolated, air-gapped networks with cryptographic authentication and adversarial robustness measures. The study concludes that while current results are promising, future work should focus on designing adversarially robust architectures and optimizing the cost-benefit trade-off of deployment.