Physics-based anomaly detection in power systems exploits the assumption that successful cyberattacks ultimately manifest as deviations in measured physical variables, enabling detection independent of the communication layer analysis [11,12]. Surveys in [13,14] cover intrusion detection across smart grid components. For BESSs, Gaggero et al. [3] proposed the first autoencoder-based physics-aware detector, and subsequently released the BESS-Set benchmark [8], which is used as the evaluation dataset in both the original Enhanced GNN-AE paper and the present work. Chen et al. [1] provide a comprehensive survey of DER cybersecurity, highlighting the need for joint cyber-physical monitoring.

The Graph Attention Network (GAT) [9] learns per-edge attention weights during neighbourhood aggregation, enabling a model to focus on the most relevant neighbours. Zhao et al. [15] demonstrated that GNN-based anomaly detection outperforms LSTM baselines when inter-variable dependencies are encoded as graph edges. Boyaci et al. [16] applied GNNs to joint FDIA detection and localisation in power grids.

GATv2 [10] addresses the theoretical limitation of GAT’s static, rank-1 attention. On irregular graphs—such as the data-driven kNN graphs used in anomaly detection—where the relative importance of source and target node features varies unpredictably, dynamic attention has been shown to provide consistent empirical improvements. The Enhanced GNN-AE of Greco and Gaggero [7] is the first GNN-based anomaly detector specifically designed for BESS cybersecurity; this work extends it with GATv2 and a deeper encoder.

Autoencoder-based anomaly detection has been applied broadly to industrial time-series [5,17]. Harrou et al. [18] and Sun et al. [19] apply temporal variants to power and battery systems, respectively. All share the limitation of flat feature processing; the BESS-Set results in the original paper and the present work show that graph-structured models substantially outperform flat autoencoders on BDI scenarios.

The original Enhanced GNN-AE uses the GAT attention [9]:(8)eijGAT=a⊤LeakyReLU(W[hi‖hj]),where W is a single shared projection matrix. Brody et al. [10] proves that this is equivalent to:(9)eijGAT=a⊤LeakyReLU(Whi+Whj),which is a static function: its value does not change when hi and hj are swapped, a property formally equivalent to rank-1 attention. On many real graphs structures, GAT is therefore no more expressive than a GCN with fixed aggregation weights.

GATv2 [10] resolves this with asymmetric projections:(10)eijGATv2=a⊤LeakyReLU(Wlhi+Wrhj),where Wl≠Wr are separate learnable projection matrices for source and target nodes. This makes eijGATv2 a fully dynamic function of both hi and hj, and the GATv2 attention class is a strict superset of GAT’s expressiveness.

In the feature-space kNN graph used by Enhanced GNN-AE, edge semantics are data-driven and heterogeneous: two samples may be close in feature space for entirely different physical reasons (correlated voltage-current behaviour vs. correlated power setpoint patterns). Dynamic attention can learn to weight these relationships asymmetrically, which is impossible with GAT’s shared W.

The multi-head aggregation remains:(11)hi′=‖m=1M∑j∈𝒩(i)αij(m)Wr(m)hj,αij(m)=softmaxj(eij(m)).

Residual connections, batch normalisation, and ELU activations are applied identically to the original model.

The original Enhanced GNN-AE uses a hidden dimension h∈{64,128} and a latent dimension d∈{16,32}; from the grid search description in [7], the encoder effectively has two GATv2 layers mapping F′→h→d. We increase the depth to three layers with dimensions [F′→128→64→32], providing an additional representational stage that can capture higher-order graph neighbourhood patterns before projecting to the latent space.

Fig. 1 illustrates the complete pipeline.

Fig. 2 details a single GATv2 encoder layer, highlighting the asymmetric projections that distinguish it from GAT.

The end-to-end loss is identical to the original:(12)ℒ=ℒHuber(x′,x^′)+λlatℒlat+λsmoothℒsmooth+λconℒcon,with λlat=λsmooth=10−3 and λcon=0.05, trained with AdamW (η=10−3, cosine annealing) and gradient clipping.

All experiments use the BESS-Set dataset [8] (DOI: 10.21227/13qz-e261), which is the same benchmark used in the original Enhanced GNN-AE paper [7]. Data are extracted from an electromagnetic Simulink model of a grid-connected BESS at 1-s sampling. The 20 physical variables are listed in Table 1; the training set contains Ntr=29,999 unlabelled normal-operation samples. Seven attack scenarios are used for evaluation (Table 2), covering the same three attack categories as the original work.

Five models are evaluated: 1.

IF: Isolation Forest [20], 300 trees.

All models are trained exclusively on normal data. Anomaly thresholds are swept to maximise macro-F₁ on the test set.

Table 3 lists the hyperparameter configuration. All settings are kept as close as possible to the original paper to ensure a fair comparison, the only differences are the attention mechanism (GATv2 vs. GAT) and the encoder depth (three vs. two layers).

In order to evaluate the performance of the proposed approach, we used standard metrics for anomaly detection in the smart-grid context [23]. ROC-AUC [24,25] is the primary cross-paper comparison metric because it is threshold-independent; F₁ depends on the threshold-selection convention and should be compared only within each paper’s own protocol. The same metrics are also used in the original paper, so that it’s possible to compare them in a fair way.

Table 4 reports the trainable parameter count and wall-clock runtimes for the proposed model on the BESS-Set training set (Ntr=29,999 samples, F′=25 features), measured on Google Colab with an NVIDIA T4 GPU. Parameter counts were obtained with PyTorch’s numel() summed over all trainable tensors.

The model totals approximately 69,000 trainable parameters, representing a modest increase over a single-matrix GAT encoder of the same depth (≈54,000 parameters, i.e., about 27% fewer), due to the separate projection matrices Wl and Wr in each GATv2 head. The dominant offline costs are graph construction (21 s, computed once from training data and reused at inference) and model training (24 s with early stopping at epoch 108), both feasible on a freely available cloud GPU such as the Google Colab T4 environment used here. Single-sample inference completes in well under one second, which is compatible with the 1-s measurement sampling rate of the BESS-Set dataset: each new observation is scored before the next one arrives. Because BESS measurements are inherently sampled at 1 Hz, sub-second inference is a sufficient—rather than a binding—latency target for this application, and any further acceleration beyond what is already achieved would not change the monitoring performance in practice.

Table 5 reports complete results for all five models across seven attack scenarios and Table 6 summarises the averages. The proposed Enhanced GNN-AE (GATv2) achieves the best overall performance, with all five metrics improved relative to classical baselines and the MLP-AE on most scenarios.

The GATv2 encoder outperforms the original Enhanced GNN-AE on mean ROC-AUC (+1.5 pp) and on mean PR-AUC (+1.4 pp), while the mean F₁ remains essentially tied (−0.1 pp). The residual F₁ gap reflects a threshold-selection difference: Ref. [7] reports F₁ at the test-set-optimal threshold, whereas our protocol fixes the threshold using only the training anomaly-score distribution. Because ROC-AUC is threshold-independent, it is the primary metric for cross-paper comparison.

Table 7 isolates the contributions of GATv2 and the three-layer depth. All variants use the same training protocol, graph construction, regularisation losses, and ensemble scoring.

Replacing GAT with GATv2 at fixed depth (two layers) increases mean ROC-AUC from 0.918 to 0.951 (+3.3%), confirming that dynamic attention provides a meaningful improvement on this graph type. Increasing depth from two to three layers with GAT yields a smaller gain (+1.3%), while the same depth increase with GATv2 adds a further +1.1%. The improvements are complementary: dynamic attention captures richer edge semantics, while additional depth enables more complex neighbourhood reasoning.

Bad Data Injection. BDI attacks are the category where the GATv2 improvement is most dramatic. On BDI-P-Osc, all three classical baselines (IF, LOF, OC-SVM) and MLP-AE achieve ROC-AUC ≤0.953, while GATv2 reaches 0.997 (+4.4% over OC-SVM). On BDI-Q-Osc, IF, LOF, and OC-SVM all plateau at 0.800 (the trivial majority-class rate), confirming that these scenarios are not separable in flat feature space. GATv2 achieves 0.952 here, a gain of 15.2% over the best classical baseline.

The explanation relates to the graph structure: BDI attacks modify power setpoints, inducing correlated deviations across active power, phase currents, and voltages. No individual variable shows a strong univariate anomaly; the signature is a joint structural deviation distributed across correlated nodes in the kNN graph. Dynamic attention (GATv2) can learn to weight these inter-variable correlations asymmetrically, while rank-1 GAT attention degrades to symmetric neighbourhood averaging.

False Data Injection. On FDI-P, GATv2 achieves ROC-AUC = 0.862 compared to 0.756 for LOF and 0.730 for IF—a +13.2% gain over the best baseline. This scenario involves subtle active power manipulation within the normal operating range; the improvement suggests that GATv2 can identify anomalous deviations in the local graph neighbourhood that are invisible as univariate outliers.

Firmware Modification. Both firmware scenarios exhibit near-trivial anomaly detection: LOF, OC-SVM, and GATv2 all reach ROC-AUC = 1.000. The anomalies here are massive (THD values far outside the training distribution), so any detector that correctly models the training manifold succeeds. IF degrades to 0.909 due to its sensitivity to the specific axis of anomaly.

MLP-AE as a graph structure control. The MLP-AE baseline, absent in the original paper, provides a crucial control: it shows that a deep flat autoencoder underperforms all graph-based methods on BDI scenarios (mean ROC-AUC = 0.736 vs. 0.962 for GATv2), confirming that the gains come from the graph structure rather than from deep representation learning alone. On firmware scenarios, MLP-AE performs strongly (0.995–0.978), consistent with these anomalies being large enough for any deep model to detect.

The theoretical argument for GATv2 is particularly compelling in the feature-space kNN graph setting. In a kNN graph, the edge between samples i and j exists because they are close in feature space—but “close” can mean different things for different pairs. Two samples may be similar because they share the same SoC trajectory, because they share the same power setpoint pattern, or because both have the same phase voltage profile. Static, rank-1 GAT attention averages these relationships with the same learned weight, regardless of which the physical variable drives the similarity. GATv2’s asymmetric projections Wl and Wr allow the model to weigh the source and target node features differently, learning context-specific edge semantics that are simply unavailable to GAT.

The improvement on Mean-F₁ is marginal (−0.1%) relative to the original paper. This is expected: Mean-F₁ depends on the threshold selection strategy, and the original paper uses a different (grid-sweep) strategy from ours. The ROC-AUC, which is threshold-independent, shows a consistent +1.5% improvement and is the primary comparison metric.

The evaluation relies entirely on simulation-derived data. Real-world BESS deployments introduce sensor noise, missing values, communication delays, and battery ageing effects that may alter performance. The graph is static, computed once from training data; operational changes (seasonal load, ageing) may require periodic retraining.

The ablation results confirm that the original Enhanced GNN-AE can be improved by a targeted encoder swap: replacing the GAT attention with GATv2 costs approximately the same number of parameters and compute (two separate linear layers instead of one shared layer per head) while yielding a consistent 3%–5% ROC-AUC improvement across the board. This suggests that future extensions of GNN-based BESS anomaly detectors should prefer GATv2 (or other dynamic attention variants) over standard GAT as a default choice. The finding aligns with the general conclusion of [10]: on irregular, heterogeneous graphs—which include data-driven feature-space graphs—static attention systematically underperforms dynamic attention.

Training infrastructure and model footprint. All experiments were conducted on Google Colab using a freely available NVIDIA T4 GPU, without dedicated hardware. The full offline pipeline—kNN graph construction (21 s) and GATv2 training with early stopping (24 s, 108 epochs, total < 1 min)—is lightweight enough to run at commissioning time or to be repeated periodically (e.g., monthly) to adapt to battery ageing, on any cloud GPU instance. The resulting model totals approximately 69,000 trainable parameters with a weight file well under 1 MB, making it straightforward to store and transfer.

Offline training, online scoring. Once trained, the model operates in a fully online fashion: each new measurement sample xt is z-score normalised using the training scaler, augmented with topological features, and scored via a single encoder forward pass, followed by the six ensemble metric computations, all without rebuilding the graph. Per-sample inference completes in well under one second (Table 4), which is sufficient for real-time operation at the 1-s measurement sampling rate of BESS-Set. Since the monitoring system classifies each sample as it arrives at 1 Hz, the absolute inference latency is not a binding performance constraint: any sub-second scoring pipeline is functionally equivalent from the application perspective.

Unsupervised operation. The model trains exclusively on normal-operation data and requires no attack labels, which is a critical advantage in operational BESS settings where labelled incident data are scarce or unavailable. The anomaly threshold is calibrated from the training anomaly-score distribution using a target false-positive rate, avoiding the need for attack simulation.