Power information network attack chain identification and disaster recovery early warning mechanism based on graph neural network

Advanced multi-stage cyberattacks increasingly threaten power information networks and can disrupt both communication and physical control systems.This study proposes a graph neural network (GNN)-based architecture to detect multi-stage attack paths and provide early warnings for disaster recovery.The framework models the spatio-temporal behaviour of network devices to improve resilience and support proactive cyber defence in critical power infrastructures.Traditional intrusion detection systems often fail to capture complex spatial and temporal relationships and sequential attack patterns, leading to slow detection and limited recovery capability.To address this limitation, a spatio-temporal graph neural network (ST-GNN) framework is developed using the Kitsune network attack and HAI security datasets for comprehensive cyber-physical threat analysis.Experimental results demonstrate excellent performance with 99.98% accuracy, 99.90% precision, 99.97% recall, and an F1-score of 99.98%, with very low false positive and false negative rates.The proposed system effectively predicts multiple attack stages and significantly improves detection capability, enabling faster response and stronger protection for modern power information networks.