A survey of Graph Neural Networks for smart-grid cybersecurity

April 2026 · in-progress

This is an ongoing survey reviewing the state of graph neural network (GNN) methods applied to cybersecurity in smart grids. The grid is a natural graph — buses, lines, substations — and attacks against it exploit structure as much as signal. GNNs, which learn over that structure directly, have emerged as a promising class of models for detecting and localizing attacks like false data injection (FDI), load redistribution, and stealthy topology-based intrusions.

Scope

The survey covers roughly 100 papers from 2021 to 2026 across four threads:

Detection — binary and multi-class classifiers for attack vs. normal operation, including spectral GNNs, GAT/GCN variants, and spatiotemporal fusions (GC-LSTM, DST-GNN).
Localization — node- and edge-level identification of compromised measurements, increasingly via attention and physics-informed constraints (PING, hodge-based approaches).
Resilience and response — reinforcement-learning-augmented GNNs, load-restoration GNNs, and adversarial training as a defense layer.
Explainability — what the grid operator can actually do with a GNN’s output when every minute matters.

Status

Draft v3 is under revision. Taxonomy figure and PRISMA diagram are done; remaining work is tightening the discussion of physics-informed approaches and resolving coverage gaps in three recent FDIA-localization papers.

Why this matters

An attack on the grid is not an abstraction. The cost of a false negative is measured in outages; the cost of a false positive is measured in erroneous disconnections that can propagate. GNNs are not a silver bullet, but they are the first class of model that treats the grid as what it actually is — a graph — rather than flattening it into a vector and hoping structure re-emerges.

More detail, the PDF, and a link to the related code will land here when the draft is submitted.