Abstract
The digital revolution in power systems has increased their complexity and interconnectivity, thereby exacerbating the risk of cyberattacks. To protect critical power infrastructure, there is an urgent need for an advanced intrusion detection system capable of capturing the intricate interactions within smart grids. Although traditional graph neural network (GNN)-based methods have exhibited substantial potential, they primarily rely on network data (e.g., IP addresses and ports) to construct the graph structure, failing to adequately integrate physical data from power grid devices. Moreover, these methods typically employ fixed activation functions in downstream deep networks, which limits the accurate representation of complex nonlinear attack patterns, thereby reducing detection accuracy. To address these challenges, this paper introduces GraphKAN, a novel intrusion detection framework that leverages graph attention network (GAT) and Kolmogorov-Arnold network (KAN) to enhance detection precision in smart grids. GraphKAN firstly constructs a graph-structured representation with power devices, information technology devices, and communication network devices as nodes, and integrates the physical connections and logical dependencies among infrastructure elements as edges, providing a comprehensive view of device interactions. Furthermore, the GAT module utilizes multi-head attention mechanisms to dynamically allocate node weights, extracting global features that encompass both feature information and interaction patterns. The KAN introduces learnable activation functions based on parameterized B-splines, enhancing the nonlinear expression of the global features extracted by GAT and significantly improving the detection accuracy of complex attack patterns. Experiments conducted on datasets obtained from Mississippi State University and Oak Ridge National Laboratory demonstrate that GraphKAN achieves detection accuracies of 97.63%, 98.66%, and 99.04% for binary, ternary, and 37-class intrusion detection tasks, respectively. These results represent substantial improvements over state-of-the-art models, including GA-RBF-SVM, BGWO-EC, and Net_Stack, with accuracy gains of 5.73%, 0.89%, and 3.52%, respectively. The findings underscore the efficacy of GraphKAN in enhancing intrusion detection accuracy in smart grids and its robust performance in complex attack scenarios.