A HYBRID CNN-LSTM INTRUSION DETECTION FRAMEWORK FOR CYBERSECURITY IN SMART RENEWABLE ENERGY GRIDS

As renewable energy grids increasingly integrate IoT sensors, Advanced Metering Infrastructure (AMI), and SCADA systems, they face a growing surface for cyberattacks like False Data Injection (FDI) and Denial-of-Service (DoS). The authors seek to address the limitations of traditional intrusion detection systems (IDS), which often struggle to model the temporal progression of multi-step attacks, fail to scale under skewed class distributions, and lack the generalization needed for heterogeneous network environments.

The researchers propose a hybrid deep learning architecture that integrates a Convolutional Neural Network (CNN) for spatial feature extraction with a Long Short-Term Memory (LSTM) network for temporal sequence modeling. The model is supported by a seven-step preprocessing pipeline that includes missing-value imputation, min-max normalization, and, crucially, the Synthetic Minority Oversampling Technique (SMOTE) to address class imbalance. The framework was validated against the CICIDS2017 and NSL-KDD datasets and tested for deployment feasibility on resource-constrained Intelligent Electronic Devices (IEDs) using INT8 quantization.

The hybrid CNN-LSTM model outperformed traditional machine learning classifiers (SVM, Random Forest, KNN) and standalone deep learning models (CNN, LSTM) by 2–9 percentage points across all metrics. Specifically, it achieved 98.7% accuracy and 0.995 AUC-ROC on the CICIDS2017 benchmark. Ablation studies revealed that SMOTE-based class balancing was the most significant contributor to performance, improving the F1 score by 3.7 percentage points. Furthermore, the model demonstrated high real-time inference throughput (27,800 flows/s) and low latency, confirming that it can be deployed on edge devices with less than 128MB of memory.

This study provides a practical, high-performance framework for securing critical renewable energy infrastructure. By demonstrating that a hybrid deep learning model can be both highly accurate and lightweight enough for edge deployment, the authors offer a viable path for proactive, real-time cyber defense in environments where traditional, resource-heavy security solutions are often infeasible.