Spatio-Temporal Graph Neural Networks for Cyberattack Detection in Battery Energy Storage Systems

The Enhanced Graph Neural Network Autoencoder (Enhanced GNN-AE), recently proposed for unsupervised cybersecurity monitoring in battery energy storage systems (BESSs), builds a multiscale $k$-nearest neighbour graph over measurement samples and learns compact latent representations via manifold-regularised training. Its spatial encoder, however, employs the original Graph Attention Network (GAT), which has been formally shown to compute a rank-1 attention function equivalent to graph convolutional networks on many graph structures. This work investigates whether replacing the GAT encoder with the strictly more expressive GATv2 formulation—which applies the attention vector after a joint, asymmetric linear transformation of source and target node features—yields measurable improvements on the BESS-Set benchmark. We additionally increase the encoder depth from two to three layers and include a flat MLP autoencoder as a fourth layer baseline to disentangle the benefit of graph structure from that of deep representation learning. Experiments across the same seven cyberattack scenarios used in the original paper demonstrate that the GATv2-based encoder achieves a mean ROC-AUC of 0.962 and a mean Best-F₁ of 0.946, compared to 0.947 and 0.947 for the original model, with the largest absolute gains on Bad Data Injection oscillation scenarios (+7.6% ROC-AUC) and on False Data Injection of active power (+13.2% ROC-AUC). The deeper encoder provides an additional average gain of 1.4% ROC-AUC. An ablation study confirms that GATv2 consistently outperforms GAT on this irregular, data-driven graph, supporting the theoretical argument that dynamic attention is better suited to feature-space kNN graphs than static rank-1 attention.