Cyber Intrusion Detection in Protective Relays Using Deep Learning Attention-Based Models

The increasing digitalization of modern substations has improved operational efficiency while simultaneously exposing protection schemes in digital substations to sophisticated cyber threats. This paper proposes an attention-based deep learning (DL) framework for enhancing the cybersecurity of transformer differential relays (TDRs), a highly critical yet vulnerable smart grid protective relay. Leveraging the DL transformer architecture, the proposed model is trained offline to distinguish manipulated TDR measurements from those corresponding to legitimate faults. It utilizes self-attention mechanisms to effectively capture temporal dependencies and complex correlations within the six-phase current measurements of the TDR, providing a robust layer of security against cyberattacks based solely on the TDR measurements. Experimental results demonstrate that the proposed Transformer-based model (1) achieves superior attack detection accuracy and lower false alarm rates compared to existing solutions, (2) does not deprive the TDR of its speed merit, and (3) has explainable predictions. These findings highlight the potential of attention-based architectures for developing intelligent cyber-resilient protective relays in smart grids.