An edge intelligent threat perception and adaptive defense system based on a multimodal large model is proposed in this paper to address the industrial control protocol vulnerabilities (such as IEC 61850 penetration) and collaborative attacks from multiple heterogeneous threats (APT attacks, physical intrusions, data tampering) caused by the surge of edge nodes in the power Internet of Things. Innovatively constructing a closed-loop framework of ‘‘cross modal perception attack chain deduction dynamic defense’’: designing a lightweight Transformer SNN hybrid model, integrating network traffic, sensor data, and video surveillance through cross modal alignment loss fusion, to solve semantic ambiguity of heterogeneous data; Using Pulse Neural Network Temporal Plasticity (STDP) to achieve unsupervised attack pattern learning; Combine reinforcement learning to generate defense strategies and validate them through digital sandbox simulations. Tests in real power environments have shown that the system's F1 score for detecting APT attacks, physical intrusions, and data tampering reaches 96.8%–98.2%, which is an improvement of ≥ 14.7% compared to traditional methods; The response delay has been reduced to 85–210 ms (efficiency improved by 90%), and energy consumption of edge inference is only 0.8 mJ/time. The system has been deployed on the ‘‘AI Super Brain Locomotive’’ platform, providing real-time active defense capabilities for substations and promoting the evolution of power safety paradigm from rule matching to intelligent decision-making.