The present application provides a system for malicious control detection in power grids. The system includes at least one node configured to detect power grid parameters for each power phase and generate a signal indicative of time-series sensor measurements for each power phase. A controller in communication with the node may be configured to receive from the at least one node, the respective signals, extract at least one feature from the respective signals, provide the at least one feature as an input to a deep-learning model, receive an output from the deep-learning model indicative of a relationship between the power grid parameters and a node health associated with the at least one node, generate a status tag associated with the at least one node based at least in part on the output, wherein the status tag is normal or malicious, and generate a status signal indicative of the status tag.