Causal Reasoning System for Power Grid Security Alerts Based on Graph Neural Networks and Pre-trained Language Models

The increasing sophistication of cyber-physical attacks on power grid infrastructure necessitates advanced security monitoring systems capable of real-time threat detection and causal analysis. Graph Neural Networks (GNNs) excel at modeling interconnected systems by capturing complex topological relationships, making them ideal for analyzing power grid dynamics where electrical components exhibit intricate spatial dependencies. Pre-trained Language Models (PLMs) leverage contextual understanding from vast text corpora to process unstructured security logs that traditional rule-based systems cannot handle effectively. Hypothesis: We hypothesize that synergistic integration of GNNs and PLMs through multimodal fusion can significantly enhance power grid security alert generation by simultaneously leveraging topological relationships and semantic understanding of security events. Methods: This paper presents a novel framework that synergistically integrates Graph Neural Networks (GNNs) and Pre-trained Language Models (PLMs) to enable intelligent causal reasoning for power grid security alert generation. Our approach introduces three key innovations: (1) a multimodal fusion architecture processing both structured grid topology and unstructured security logs, (2) spatial-temporal GNNs with multi-scale attention mechanisms, and (3) enhanced causal reasoning with domain constraints. The framework employs spatial-temporal GNNs to capture evolving grid dynamics, while domain-adapted PLMs analyze log streams to extract security-relevant patterns. A sophisticated causal reasoning module based on structural causal models identifies root causes through enhanced PC algorithms with domain constraints. Experiments: Extensive evaluation on PowerGraph benchmark and real-world security datasets validates the framework across diverse attack scenarios. Ablation studies demonstrate the effectiveness of multi-scale attention mechanisms, showing 8.4% F1 score decrease when removed. Attention visualization reveals successful capture of local component interactions, regional patterns, and global cascading pathways. Findings: Results demonstrate an F1 score of 0.956, representing 12.3% improvement over state-of-the-art methods. The system maintains sub-second response times for grids up to 2,000 buses while providing interpretable alerts with 91.8% causal accuracy. Multi-scale attention mechanisms achieve a 23% improvement in cascade failure prediction accuracy.