Traditional intrusion detection systems(IDS)usually rely on single machine learning models and struggle to achieve both efficient attack detection and precise classification simultaneously. To solve this problem

this paper proposes a two-stage intrusion detection method(XGBoost-TLV) tailored for smart grids. This approach is tightly coupled with the hierarchical characteristics of the process layer

bay layer

and station control layer of smart substations. In the first stage

targeting the massive real-time data stream processing requirements and resource-constrained characteristics of the process layer

the lightweight and efficient XGBoost model is deployed at the edge to achieve high-efficiency preliminary anomaly filtering(>99% normal traffic)

significantly reducing the computational burden on higher levels. In the second stage

focusing on the critical requirement for precise attack detection at the bay layer

TabNet-LightGBM voting (TLV)combining attentive interpretable tabular learning(TabNet) and light gradient boosting machine(LightGBM) is constructed to achieve precise classification of malicious traffic at the upper level. Experimental results show that the proposed method achieves an F1 score of 92.23%

demonstrating good potential in smart grid cyber security.