A Hybrid CWT–Transformer Method for Traffic Fingerprinting of Smart-Grid Device

Abstract

Device identification commonly relies on machine learning models using radio frequency (RF) signals, decrypted payload features or traditional statistical traffic features. However, in real-world power grid environments, complex electromagnetic interference makes the stable collection of RF signals difficult. Furthermore, non-intrusive traffic decryption is challenging to implement in engineering practice, and traditional statistical features struggle to accurately depict the highly non-stationary and bursty characteristics of power system traffic. The paper proposes a decryption-free device traffic fingerprinting method based on a Hybrid CWT-Transformer model. The model enables reliable device identification by capturing multi-scale transient patterns and long-range dependencies directly from encrypted traffic. First, the paper utilizes the Continuous Wavelet Transform (CWT) to convert session-level statistics traffic into time- frequency maps, which accurately represent the highly non-stationary and bursty nature of the device traffic. Subsequently, a Convolutional Stem (Conv Stem) extracts local patterns, and a deformable patch embedding focuses the representation on informative time–frequency regions. Finally, the paper uses a Transformer encoder to model global dependencies for device classification. Experimental results on a real-world Power IoT dataset (16 device classes) from China Southern Power Grid demonstrate that the proposed model achieves 98.50% accuracy, significantly outperforming mainstream methods in precision, recall, and F1-score.