GT-PNID: A lightweight graph-temporal network integrating GCN and transformer for power network intrusion detection

Driven by the advancement of information technology, the transformation of traditional power grids toward intelligence has rendered power systems more vulnerable to cybersecurity risks arising from greater openness and connectivity. Smart grid communication networks exhibit high heterogeneity, diverse protocols, and strict real-time constraints. Existing intrusion detection systems suffer from two key limitations: neglect of spatiotemporal dependencies in network traffic, which hinders the modeling of complex attack evolution, and absence of a unified detection framework with cross-scenario generalization capability. To overcome these limitations, this study develops GT-PNID, a graph-temporal network-based intrusion detection model designed for grid communication networks. The model utilizes a sliding-window dynamic graph construction mechanism to transform heterogeneous traffic into spatiotemporal graph structures. Subsequently, graph convolutional layers are applied to extract local spatial features, while a multilayer Transformer is introduced to model long-range temporal dependencies, followed by graph-level feature fusion for joint spatiotemporal representation. Experiments on CICIDS2017 and NSL-KDD datasets demonstrate that accuracy and F1-scores exceed 99.98%, while the model's parameter count (424,478) and per-sample inference time (0.09 ms) are substantially lower than mainstream methods, confirming its superior detection capability, lightweight efficiency, and cross-dataset generalization potential for smart grid security.