Graph-Native Attention Acceleration for Attack Detection in Cyber-Physical Systems

Abstract

Cyber-physical systems (CPSs) consist of sensors, controllers, and actuators through communication and physical interactions, making them vulnerable to attacks on measurements, control logic, and equipment operation. Graph-based attack detectors, especially graph attention models, can localize such attacks by learning edge-adaptive interactions over communication and physical interaction graphs. However, their computational cost grows rapidly with neighborhood size, and their inference latency can reach tens to hundreds of milliseconds in large-scale or densely connected graphs, delaying time-critical alarm generation. To enable real-time deployment of graph attention mechanisms for attack detection, we propose GraphGHHA, a graph-native attention acceleration layer designed as a replacement for graph attention layers in attack detection units. GraphGHHA combines (i) a graph-local sparse attention branch that is constrained by the adjacency matrix of the CPS, and (ii) a global linear mixing branch to retain system-wide information. A learnable gate combines the two branches node-wise, preserving detection accuracy under strict latency constraints. We evaluate GraphGHHA on a networked heating, ventilation, and air conditioning (HVAC) cyber-physical system under representative attack scenarios and demonstrate up to an eight-fold reduction in detection latency while maintaining high detection accuracy. These results indicate that GraphGHHA enables practical, real-time alarm generation for large-scale CPS monitoring.