In short, while the combined deployment of distributed renewable energy sources and intelligent control in smart power grids has improved their efficiency, risks in cyberspace have also increased. To address the deficiencies in reactive intrusion detection and traditional protection methods, this paper proposes a distributed intelligent defense framework that integrates GNN, reinforcement learning and federated transfer learning. Multimodal states are formed by topology, communication actions and logic semantic meanings, and PPO is used by people to generate adaptive defence policies. Knowledge distillation also transfers the cloud-side capacities to a lightweight edge agent. Experiments conducted on a simulated cyber-physical power grid show that the framework can achieve 94% operational stability and is therefore 3-5% better than the baseline method. It has also reduced the number of model parameters by approximately 68%, maintained inference delay time under 20ms, and decreased communication cost expenditure by 42%. The above results show that this framework can provide support for active, expandable and privacy-preserving network protection in intelligent power grids.
