Abstract: In order to accurately detect the cascading failures across space (CFAS) caused by cyber attacks in grid cyber-physical systems (GCPS), a station-level early warning method for CFAS is proposed based on attack gain and cost principle (AGCP). Firstly, the working principle of CFAS early warning is discussed according to the evolution mechanism of CFAS, and a mathematical model of CFAS early warning is established. And then, a station-level CFAS detection method is proposed based on the integration of misuse detection and anomaly detection. Finally, to verify the effectiveness of the proposed CFAS early warning method, a variety of CFAS are simulated in a CEPRI-36 bus GCPS simulation environment, and the early warning is given by using the proposed CFAS early warning method.