This paper presents a large language model (LLM)-based framework for detecting cyberattacks on transformer current differential relays (TCDRs), which, if undetected, may trigger false tripping of critical transformers. The proposed approach adapts and fine-tunes compact LLMs such as DistilBERT to distinguish cyberattacks from actual faults using textualized multidimensional TCDR current measurements recorded before and after tripping. Our results demonstrate that DistilBERT detects 97.6% of cyberattacks without compromising TCDR dependability and achieves inference latency below 6 ms on a commercial workstation. Additional evaluations confirm the framework's robustness under combined time-synchronization and false-data-injection attacks, resilience to measurement noise, and stability across prompt formulation variants. Furthermore, GPT-2 and DistilBERT+LoRA achieve comparable performance, highlighting the potential of LLMs for enhancing smart grid cybersecurity. We provide the full dataset used in this study for reproducibility.

翻译：本文提出了一种基于大型语言模型（LLM）的框架，用于检测变压器电流差动继电器（TCDR）上的网络攻击。此类攻击若未被发现，可能导致关键变压器误跳闸。所提出的方法通过适配和微调紧凑型LLM（如DistilBERT），利用跳闸前后记录的多维TCDR电流测量值文本化数据，来区分网络攻击与实际故障。我们的结果表明，DistilBERT能够检测97.6%的网络攻击，且不影响TCDR的可靠性，并在商用工作站上实现低于6毫秒的推理延迟。额外评估证实了该框架在时间同步与虚假数据注入组合攻击下的鲁棒性、对测量噪声的耐受性，以及在不同提示词变体下的稳定性。此外，GPT-2和DistilBERT+LoRA模型取得了相当的性能，凸显了LLM在增强智能电网网络安全方面的潜力。我们提供了本研究中使用的完整数据集以确保可复现性。