DSTG-Former: A Graph-Transformer for Intrusion Detection in DNP3 Smart Grids

Abstract

The Distributed Network Protocol 3 (DNP3) remains the dominant communication standard in modern smart grids, yet it lacks intrinsic security, exposing supervisory control and data acquisition (SCADA) infrastructures to protocol-specific cyberattacks.Conventional intrusion detection systems (IDSs) rely on flow-level statistics, discarding protocol semantics, physical topology and temporal evolution.This paper proposes the Domain-informed Spatial-Temporal Graph-transFormer (DSTG-Former), operating directly on raw DNP3 payloads extracted through deep packet inspection (DPI).Packets are mapped onto a topology-aware communication graph whose vertices are the devices identified from DNP3 link-layer addresses and whose edges carry standardized 64-byte payloads; an edgeconditioned graph neural network (EC-GNN) learns spatial dependencies per snapshot and a transformer encoder with attentive readout models dependencies across twenty-snapshot sequences.On 725,708 window sequences from the public DNP3 Intrusion Detection Dataset, spanning nine attack categories and normal polling, DSTG-Former attains 98.71% accuracy, 94.59% macro F1-score and 0.9992 macro one-versus-rest area under the receiver operating characteristic curve (AUC) under the stratified window-level partition, and 97.84% accuracy and 89.19% macro F1score under a stricter partition whose training and test packets are provably disjoint.An ablation identifies the recovered topology and the edge-conditioned branch as decisive, and controls against a rule-based detector, masked inputs and four baselines retrained on the same partitions isolate the contribution of the learned representation.