On the Role of Re-Descending M-estimators in
Resilient Anomaly Detection for Smart Living CPS
Sahar Abedzadeh, Shameek Bhattacharjee
Department of Computer Science, Western Michigan University, Kalamazoo, USA
E-mail: sahar.abedzadeh@wmich.edu, shameek.bhattacharjee@wmich.edu

Abstract—Anomaly-based attack detection methods that relyon learning the benign profile of operation are commonly used for
identifying data falsification attacks and faults in cyber-physicalsystems. However, most works do not assume the presence of
attacks while training the anomaly detectors- and their impact
on eventual anomaly detection performance during the test set.
Some robust learning methods overcompensate mitigation whichleads to increased false positives in the absence of attacks/threats
during training. To achieve this balance, this paper proposesa framework to enhance the robustness of previous anomaly
detection frameworks in smart living applications, by introducing
three profound design changes for threshold learning of timeseries anomaly detectors:(1) Tukey biweight loss function insteadof square loss function (2) adding quantile weights to regression
errors of Tukey (3) modifying the definition of empirical costfunction from MSE to the harmonic mean of quantile weighted
Tukey losses. We show that these changes mitigate performancedegradation in anomaly detectors caused by untargeted poisoning
attacks during training- while is simultaneously able to prevent
false alarms in the absence of such training set attacks. We
evaluate our work using a proof of concept that uses state-ofthe-art anomaly detection in smart living CPS that detects false
data injection in smart metering.
Index Terms—Explainable Machine Learning, Smart Living
CPS, Resilient AI/ML, Data Poisoning attacks.

I. I NTRODUCTION
Data poisoning attacks [1] are recognized as a significant
threat to all machine learning (ML) tasks - where an attacker
injects false data as inputs while training an ML model. Thisdegrades the accuracy of predictive outcomes made by the MLmodel during the test set.
On the other hand, many smart living CPS applications
use anomaly based attack detection frameworks to detect false
data injection attacks. These methods operate by learning the
profile of benign operation via an anomaly detection metriccalculated from CPS sensor data. Then it learns boundariesof the anomaly metric. Such learnt boundaries act detection
thresholds and hence form the attack detection criterion thatis used in test set. Presence of any attack in the test set is
expected to cause the anomaly detection metric to violate thelearned thresholds of the anomaly detection metric. Naturally,
it is clear that unknown attacks already present while training
such anomaly detectors, will skew the anomaly detection
metric and consequently the learnt detection thresholds.
Current research efforts on data poisoning have predominantly focused on advanced data poisoning attack strategies
that bypass popular deep learning methods and standard
learning methods [6, 7] and industrial CPS [15]. Research in

mitigation of even simple data poisoning attacks in the context
of smart living CPS, has been limited. In this paper, we investigate how to mitigate impact of simple poisoning attacks on
the accuracy of anomaly based attack detectors in smart living
CPS, while not sacrificing false alarm performance, without
making any parametric assumptions on the data/attacks.
A. Motivation and Research Gaps in Smart Living CPS
A series of previous works [2, 4, 5] had laid a foundation
for a unified science of anomaly based detection of attacks
and emergency events in smart living CPS. Specifically, in [2]the CPS sensor data is collected from smart meters and thegoal was to detect presence of organized data falsification (e.g.
electricity theft). Similarly, in [5], the same overall approach isapplied to detect emergency events in a smart transportation
network by learning the profile of benign behavior derived
from speed data collected from road side sensors.
All the above works in anomaly detection for smart living
CPS follows the following unified recipe: (1) First, a latent
space embedding method transforms the raw CPS sensor data
into a time series latent space (in a lower dimension) thatserves as an anomaly detection metric; (2) Second, regression
based learning is used that takes the latent space as its training
data inputs and learns the best fit boundaries of the latent spacethat specify the thresholds of benign operation. (3) Third,
the latent space contains mathematical properties that show
deviations beyond the learnt thresholds under attacks [4, 2] orunsafe events [5] in the test set, hence detecting the threats.
The particular challenge in smart living CPS, unlike industrial
CPS, is the reduction of false alarms since benign fluctuationsin the aggregate data patterns are more common due to humanbehaviors which are more random.
Additionally, fundamentals of machine learning assume thattraining and test set data come from the same distribution.
Thus learning the thresholds of the latent space accurately
requires training on data gathered from the live deployment of
CPS sensors. However, attacks may be already present in thelive deployment of CPS sensors from which anomaly detectors
learn benign profile of operation. Hence, the latent space willbe altered and the inputs to the threshold learner (which arepoints in the latent space) are altered; which in turn alters thethresholds of the anomaly detector.
Due to the altered thresholds, there is a degradation in the
missed detection (actual attacks in the test set go undetected)
or the false alarms (benign samples in the test set are er-roneously inferred as attacks) depending on the direction ofchange. We justify the above claim later in Sec. III-B with acase study on a state of the art anomaly detection framework
applied to smart metering infrastructure. We find that simple
data falsification attacks during training that does not require
any advanced knowledge by an adversary ensure that data
falsification attacks go undetected in the test set, due to thebiasing of learnt anomaly detection thresholds. Hence, we needto introduce modifications to the basic design of time series
anomaly detection frameworks for smart living CPS.
One method in [3] offers one of the first mitigation techniques against data poisoning attacks using two robust Mestimators (Huber and Cauchy Loss) that replaces the traditional L2 or L1 norm used in regression techniques that learn abest fit threshold from the points in the latent space. However,as we prove later (See Sec. III-D), we observed that while
the Cauchy loss function mitigates the impact of undetectedattacks, it also leads to increased false alarms, when there wasno poisoning attack (which is the most probable scenario).
In contrast, Huber loss function has a lower false alarms in
the event of no poisoning during training, but was poor in
mitigating impact of undetected attacks caused by poisoning
attacks. Thus, we need a framework that mitigates impact ofdata poisoning attacks without increasing the base rate false
alarms (i.e, false alarms that happen if there was no poisoning).

hour, and for the i-th house, the power consumption reportedby the i-th smart meter is denoted as P i (t). Now, we give abackground of the anomaly detection method being poisoned.

B. Contributions

The works [2, 4], proved that the time series of harmonic
to the arithmetic mean ratios from multiple smart meters(in general distributed CPS sensors [5, 4]) in a microgrid isinvariant under benign conditions. Specifically, the ratio is tobe calculated over strategic spatial and temporal granularity
from the distributed CPS sensing devices such co-variance ofdata from individual meters (and in general CPS sensors) is
maximized. Mathematically, the invariant is defined as:

To mitigate the impact of poisoning on anomaly detection
performance, we propose an integrated approach of learning the thresholds of the time series latent space by threedesign changes (1) Tukey biweight loss function instead ofsquare loss function (2) adding quantile weights to regression
errors of Tukey (3) modifying the definition of empiricalcost function from the traditional MSE/MAE to the harmonicmean of quantile weighted Tukey losses. We also explain therole of each of three design changes in the mitigation thatgives explain-ability to our methods’ success compared toexisting approaches. We show that this combined approach
operates effectively under varying strength, scale, and durationlevels of training data contamination caused by data poisoning
attacks. We assess the security performance using two NIST
recommended CPS metrics: (a) Undetected Attack’s Impact,(b) Expected Time between False alarms. We prove that our
method outperforms existing methods in both metrics andprovide ablation studies to show contribution of each designchange on the performance.
II. BACKGROUND AND P RELIMINARIES
Although our work is generic, we show one applicationin the context of an anomaly based data falsification attack
detector for smart metering infrastructure to bride the gap
between theory and practice. We use real datasets [8] from
200 meters from a Texas Microgrid and the anomaly detection
model under attack is proposed in [2].
Smart meters deployed on houses collect power consumption data, which corresponds to raw CPS sensor data. For t-th

A. Anomaly Detection Problem Specification
The poisoned model under question is a start of the art
time series anomaly detection method for smart living CPS
proposed in a series of previous works [2, 4].
Our choice of this method is justified by the following: (1)most recent theoretical advance in time series level anomaly
detection technique that can detect very low data falsification
margins and also emergency events; (2) the method generalizes
to different CPS/IoT domains such as and Smart Transportation Systems [5], Phasor Measurement Units [4]; (3) follows
the latest National Institute of Standards and Technology(NIST) specified guidelines on CPS security [13];For enabling a unified understanding we discuss poisoned
framework in 3 phases: (1) Time Series Representation Learning that produces a time series latent space from raw timeseries data during training; (2) Learning of Thresholds from
Latent Space; (3) Anomaly Detection Criterion. Dividing theframework in this way, will allow researchers to apply thiswork for other methods which might use a different time series
anomaly detection metric.
B. Time Series Representation LearningPW
HM (t)Qr (T ) = Pt=1W
t=1 AM (t)(1)

where HM (t) and AM (t) are harmonic and arithmetic meanof power consumption P i (t) from all smart meters in a microgrid at time slot t with a box-cox transformation. The temporal
granularity is a time window T of length W slots (hours).
In the case of AMI, the previous work found W = 24hours and the granularity included the whole solar village of
200 houses due to its small size. Hence for a typical year, therange of T ∈ {1, 365}.
1) Safe Margins: Safe margins quantify an expected upperand lower bound of the anomaly detection metric at any timerwindow T . The µQ (T ) is defined as the cumulative weighted
time average of ratios observed on the T -th window acrossmultiple years. The σr denote the standard deviation of theprobability distribution of Qr (T ) samples in the training set.
The upper and lower safe margin is a neighborhood aroundr
the expected value µQ (T ), controlled by a scalar factor κ ofthe standard deviation (σr )- mathematically written as:rΓhigh (T ) = µQ (T ) + κσrΓlow (T ) = µQr(T ) − κσr

(2)
(3)

where Γhigh (T ) is the upper safe margin and the Γlow (T ) is
the lower safe margin.
2) Stateless and Stateful Residuals: Stateless residuals∇(T ) keep track of the difference between the safe margin andthe ratio sample Qr (T ). Mathematically, this is represented as: = Qr (T ) − Γhigh (T ),= Qr (T ) − Γlow (T ),∇(T ) :
 = 0,if
if

Qr (T ) > Γhigh (T );Qr (T ) < Γlow (T );otherwise;(4)

The corresponding stateful residual are obtained from thestateless residuals by keeping the cumulative sum of thestateless residuals ∇(T ) over a sliding window of length F .
At any T , the stateful residual is given by:
RU C(T ) =

T
X

∇(j)

(5)

j=T −F S

Thus, the vector of RU C(T ) values for a year will have
365 entries which can be either zero, positive or negative
depending on the patterns on how stateless residuals evolve
over time during the training set.
3) Threshold Learning from regression errors: The positive
RU C(T ) values (denoted by the set RU C + (T )) form thetraining data input points from which the optimal upper
threshold (τmax ) is learnt. Similarly, the negative RU C(T )values RU C − (T ) form the input training data points fromwhich the best lower threshold (τmin ) is learnt.
Let each training data point in each of the above sets be
represented as ri+ ∈ RU C + (T ) and ri− ∈ RU C − (T ).
The threshold learning problem is a regression problem with
only the bias parameter as the unknown, because we need tofit a straight line to the sets RU C + (T ) and RU C − (T )to find a time invariant threshold that will be used to raise athreat alarm in the deployment/test set.
In this regression problem, the unknown parameter search
space (hypothesis space) are denoted by τ + and τ − , for
the upper and lower thresholds respectively. For example, τ +denote the set of all the candidate upper thresholds for learningτmax . Now we discuss terminologies of regression analysis:
Regression Error si : The regression error is the difference
between a training data point and a parameter candidate(candidate threshold)(si = ri − τ̂ ). For each candidate, aregression error value can be calculated for all training data
points. In linear regression, positive and negative error values
do not have unequal weights.
Loss Function: The loss function is a mathematical transformation that represents how each error value contributes to thegoodness of the candidate model parameter. Therefore, w.r.t.
one candidate model parameter and one training data point,
there is one loss value. For example, linear regression uses
squares of the regression errors (L2 norm) as loss function.
Empirical Risk (Cost) Function It is an equation that maps
the goodness of a candidate parameter across all training data
points (observations) in the training data. Typically, it is theaverage/mean of the loss function values over all training data
points. In linear regression, the empirical risk is called meansquared error. The candidate parameter that has the minimum
empirical risk is the optimal learning answer. Hence, this typeof regression is known as ordinary least squares regression.
However, in [2] the authors incorporated unequal weightingof positive and negative regression errors into the loss function.
Furthermore, it used an L1 norm (absolute errors) instead of an
L2 norm (squared errors) in its definition of the empirical loss
function. Algorithm 1, summarizes the learning of thresholds
as proposed in [2]. In Algorithm 1, the regression error
is the τ − RU C(T ). Notice, that, unlike linear regression,
the regression errors get unequal weights and the weighted
regression errors are stored separately in C and P.
Algorithm 1 Calculate τmax
for RU C + (T ), τ + do
if (RU C + (T ) < τ + ) then++cost+ : |τ −RU2 C (T )|C ← cost+
else
penalty + = |RU C + (T ) − τ + |2
P ← penalty +end ifend forPP++
τmax = arg minτ + N1+
C cost −P penalty4) Detection Criterion: The RU C(T test ) is the invariant
in the test set. If it is violates the upper and lower thresholds,
it indicates an attack.
∈ [τmin , τmax ] No Attack;test
RU C(T):(6)̸∈ [τmin , τmax ], Attack Inferred;
Using the above detection criterion, [2] showed that under
different attacks and faults, the RU C(T test ) metric violates
the learnt thresholds.
III. T HREAT M ODEL AND C HALLENGES
Poisoning attacks in this context aim to bias the learning of
the latent space thresholds. This enables false data injection
attacks to evade detection during testing (known as integrity
violation in adversarial machine learning). False data injection
from smart meters are well documented [2] and can happen
due to vulnerability in hall sensors, magnetic, or optical ports
or vulnerabilities in PLC communications.
Naturally, this can only happen when the attacks during
training cause widening of the true thresholds (upper thresholdincreases and lower threshold decreases). Secondly, the attack
goal dictates the need for two threat models; one for the
training to alter the learning outputs- and another for the test
set- to escape detection of attacks launched in the test set.
A. Training Phase Threat Model(p)

Poisoning Attack Strength δavg is the average margin of data
falsified from one CPS sensing endpoint (e.g. smart meter)(p)during training. The δavg is a variable in our attack simulationto accommodate varying intents/capabilities of attackers.
(p)
Poisoning Attack Scale ρmal is the total fraction of CPS
sensing devices from which data is falsified during the training.

(p)In our simulation, the variable ρmal represents different attack
budgets and capabilities of adversaries. Powerful adversaries(p)
who can afford higher ρmal and vice-versa.
Poisoning Attack Type specifies the manner in which data isfalsified from its original value Pti . The attack type determines
the direction of change in the RU C(T ). The paper [2], reports
several possibilities of data falsification in a smart metering
infrastructure; including additive, deductive, camouflage, etc.
Most attack types create a decrease in the ratios and hence
the RU C(T ) samples decrease, which will cause the lower
thresholds to widen significantly as shown in Sec. III-B.
Poisoning Duration: specifies the duration of the poisoning
attack- which influences the number of poisoned/biased points
given to the learning model. This is kept as a variable toemulate different possibilities beyond defender’s control.
B. Impact of Training Phase Data Falsification Attacks
We select a deductive poisoning attack type which falsify(p)data by reducing the original readings; where Pti −δt , where(p)(p)δt ∈ [δmin , δmax ] and the expected value of δt samples(p)converge to the strategic training attack strength δavg and this(p)falsification occurs from a ρmal fraction of total smart meters.
Study cited in [2], showed evidence that the most common
attack on smart meters is the deductive attack which lead toorganized electricity theft. Certain faults and network errors
causes data drops [2], which behaves mathematically similar
to deductive attacks, where the subset of meters show zero
values. The above proves that this threat model is credible foranalyzing bias caused in training anomaly detectors.
Figs. 1 shows the effect of a simple deductive attack withp
= 200, ρpmal = 0.3 for 1 month while training a model
δavg
from a live deployment of smart meters on the RU C(T ). Since
the ratio and the RU C(T ) drops, more negative RUCs are triggered in the RU C − (T ). This biases the learning of the τmin(See). More negative RUCs trigger a lower τmin . In general,
for most anomaly detection metrics (including RU C(T )), the(p)(p)
higher the ρmal and δavg , the larger the deviations in the metricand hence more serious the strength of poisoning. However, if(p)δavg is very high then there can be obvious changes in the
RU C(T ) space. Furthermore, the benign changes (see 50100) makes threshold learning essential. Counter-intuitively,
the learnt upper threshold also increases after the poisoning
attack. This surprise is caused due to the design of the safe
margins Γhigh (T ) and Γlow (T ), which was done to lower false
alarms in the original method. Hence, we need robust learningfor both thresholds. Furthermore, note the clustering based
approaches to detect possible points are not unified because
the number of clusters that will be formed a-priori is unknown(p)(p)
and entirely depends on the values of ρmal and δavg and there
could be multiple such combinations used by an adversary.
From the above, we conclude that the learning of thresholds
are poisoned in both directions. This is an interesting development because a single poisoning attack type (i.e. deductive)
during the training can influence both the upper threshold andlower thresholds as shown in Fig. 1. This allows for evasionof attacks during the test set.

Fig. 1. Latent Space RU C(T ) with Benign and Poisoned

C. Test Phase Threat Model
The test set’s threat model mirrors similar perturbation fromsmart meters because the adversary goals is to escape thedetection of data falsification in the test set. We distinguish(e)between training and test set attacks by using two terms: δavg
(e)(indicating attack strength for evasion) and ρmal (indicating
attack scale for evasion) in the test set, which correspond theattack that just bypasses the threshold and remains undetected.
D. Challenges of Resilient ML in Smart Living
The paper [3], proposed two robust regression algorithms(Cauchy loss, Huber loss) for learning the anomaly detection
threshold to mitigate poisoning attacks. However, we observedsome limitations in these works and methods which follow
a similar approach. The expected time between consecutive
false alarms ETF A is a NIST recommended metric [13, 12]
for evaluating time series anomaly detection in CPS. A larger
ETF A is better indicating less frequent false alarms.
One disadvantage of employing Cauchy loss is that if
poisoning attacks are not present, then the false alarm performance becomes very poor. Table I, shows the ETF A in units ofdays for the previous work [3] with the same dataset. We cansee that compared to all other loss functions such as Huber,
L1, and L2 losses, the Cauchy loss has low ETF A even though
it gives the most mitigation in the presence of poisoning.
Because benign data in smart living CPS is unpredictable due
to human behavioral randomness (Fig. 1), false alarm cannot
be sacrificed in fear of poisoning attacks.
TABLE IE XPECTED T IME B ETWEEN FALSE A LARMS FOR P REVIOUS W ORKS
Empirical Loss
L1
L2
CauchyHuber

ETF A in Days
364.0
364.0
115.5
313.84Note that the absence of attacks are much more likely thanpresence of attacks (base rate fallacy), which makes this problem even bigger. However, in cases where poisoning attacks do
occur, the Cauchy loss function is most effective at mitigating
the attack [3]. This highlights the first engineering challenge:
we need a compromise between the mitigating the attack whenpresent without increasing false alarm frequency- which existing works do not handle. The second engineering challenge
which is not handled in [3] is it does not take into accountthe poisoning duration as a parameter into its poisoning threat
model. As we show later, poisoning duration negatively affects
the detection performance in test set regardless of loss function
choice; and therefore require additional safeguards.

IV. M ITIGATION U NDER P OISONING ATTACKS
Here we give the details of our method, starting withtheoretical intuition followed by the different design changes
we propose resilient learning of time series anomaly detection
thresholds.
M-estimation In robust statistical learning, M-estimation is
the practice of replacing the well known L2 and L1 loss, witha special class of functions known as M-estimators. Formally,
let regression errors for each of the i-th training data
P point2
be denoted P
as si = ri − τ̂ , the loss function ofi si isreplaced by i M (si ), where M (si ) belongs to class of M estimators [14], and the optimal estimate of τ (τopt ) is:N1 X
M (si , τ̂ )(7)
τopt = arg minτ̂
N i=1
where τ̂ is a candidate parameter or the hypothesis space.
Influence Function (IF) [14] corresponds to the first orderpartial derivative of an M-estimator function with respect tothe regression errors (which is a function of the data input).
Therefore by chain rule, IF quantifies the extent of variationin the estimator when the sample points during the training
are perturbed. Formally, IF is defined as:
X ∂(M (si ))ψ(si ) =(8)∂sii
where si = ri − τ̂ is directly affected by the perturbation ofri . To test how sensitive the learning is to poisoning attacks,
one can compare how much the loss function changes when
the input data is altered during training. This is where theInfluence function comes in — it helps us compare the rateof change in the influence function of various M-estimators.
Redescending M-estimators: Redescending M-estimators
have influence functions ψ(si ) which are non-decreasing forlower values of regression errors si , but start to decrease as
the regression errors increase. It satisfies the following key
property: ψ(si ) = 0 ∀ si , |si | > βt , and 0 < βt < ∞is referred to as the minimum rejection point. Formally,the ψredescending (si ) < ψnon−redescending (si ) for larger si ,which happen due to outlying points in the inputs to the learner( the effect of data poisoning).
Among the three re-descending M-estimators (Hampel,
Tukey, Andrew’s sine), we hypothesize to use the TukeyLambda Bi-Weight estimator because of the following: Hampel’s three-part function features three distinct rejection points
but the poisoning scales, strengths, and durations are beyond defender’s control and can take any value. Therefore,
the idea of 3 distinct rejection points is in-appropriate andapplicable only under abrupt short lived changes like thosedue to noise. In contrast, Tukey’s biweight function offers asmoother transition between penalizing inliers and outliers.
This means that while outliers receive higher penalties thaninliers, the shift from less penalized inliers to more penalized
outliers is gradual, unlike Hampel’s function, which has lesssmooth transitions. Andrews’ sine function [19], exhibits highefficiency only with Gaussian distribution which violate thenature of the both the raw data and latent space in smart
living CPS. Considering these factors, qualitatively, we choose

Tukey’s biweight function as the best among the others. Next
section, we give quantitative evidence of Tukey’s benefit.
A. Tukey Lambda Loss as Resilient Estimator
Tukey Lambda biweight or bisquare loss function [17] forregression is defined by the following:( β2 
si 2 3t
if |si | <= βt ;6 1 − (1 − ( βt ) )MT ukey (si ) =2βtotherwise.
6(9)
where s is the regression error between i-th data point andithe candidate parameter (i.e., τ + or τ − ) and the βt is ascaling parameter corresponding to Tukey Loss that controls
the degree of descent in IF and minimum rejection point.
For each |si | ≤ βt , the loss function is a truncated quadratic
function, starting from zero at s = 0 and reaching a maximum
β2
value of 6t at s = βt . Any si > βt , the constant does not
β2change 6t ensuring that MT ukey (si ) remains bounded as si
increases due to poisoning attackers. By taking the derivativeof Eqn 9, the IF of Tukey loss is given by:
( 
2
s2i
if |si | <= βt ;
s
1
−
2
i
βt
IFT ukey (si ) =(10)0otherwise
Fig. 2, shows that IFHuber is non-redescending, while
IFCauchy is weakly redescending, while Tukey is strongly
redescending. For small regression errors, IFT ukey ≈IFHuber . Additionally, for large regression errors, IFT ukey <IFCauchy < IFHuber . To conclude, while IFCauchy begins to diminish the influence of large regression errors(caused by poisoning or faults), the IFT ukey < IFCauchy <IFHuber property makes Tukey the best estimator underpoisoning attacks followed by Cauchy and Huber respectively.
However, medium regression errors are typically caused by benign fluctuations in the latent
space common in smart living
applications. However, for somemedium regression errors, we
IFT ukey ≥ IFCauchy , which indicates that the Tukey loss allows
Fig. 2. Influence Function: Hu- the estimator to be influenced;
which should lead to false alarmber, Cauchy and Tukey
reduction in the absence of poisoning attacks. The false alarm benefit can be further enhanced
by replacing si in Eqn. 9 with λsi where λ is a weight (line
5 and line 12 in Algorithm 2), which we discuss in Sec. IV-C
that describes how the design changes are merged.
B. Resilient Empirical Risk (Cost) Function
Note that as poisoning duration increases, the optimal estimate is going to get biased regardless of loss function choice;since loss functions only specify goodness of fit per training
input point not across all training points. As the number of
poisoned points increases with increasing poisoning duration,
small drifts in losses incurred per point (even for the mostrobust loss functions) add up, creating an inevitable change inthe optimal estimate.

To enhance resilience against longer duration poisoning
attacks, we propose a modification: using the harmonic meanof quantile Tukey losses instead of the usual mean of losses
across all training points. Formally, the new ERF is:


N
(11)
ERFHM = P
1
RU C(T ) Ls

where Ls denotes the quantile Tukey loss incurred per training
point (this appears in Line-18 in Algorithm 2), N is thenumber of training input points in the latent space. For
example, N − represents cardinality of the RU C − (T ) andthe corresponding loss are denoted as Ls− . The process oflearning is identical for the τmax and hence we do not rewrite Algorithm 2 separately for learning τmax .
Now we explain why this modification will improve mitigation under increasing poisoning duration. Note that, arithmetic
mean of the loss function values:

1 X
Ls
(12)
ERFAM =N
RU C(T )is a Schur convex function (increases exponentially). In contrast, the harmonic mean of loss function values (i.e. Eqn. 11 isa Schur concave function (increases approximately logarithmically) [18]. Since Schur concave function grows at a lesser ratewith additive drifts (caused by larger loss values of outlying
points) for the same loss function ERFHM < ERFAM . This
results in lower rate of change in the ERF for each parameterchoice τ in Eqn. 11. Hence, as poisoning duration increases,
the harmonic mean of quantile Tukey losses must be better.
Note, due to Schur concave nature of our modified empirical risk, our objective changes from seeking the typicalglobal minima to identifying the global maxima (line 18 in
Algorithm 2); hence we need to replace the last line from thetypical argmin to argmax, to find the optimal estimate.
Trade-offs: While using Eqn. 11 as ERF in Algorithm 2
offers robustness, the Eqn. 11 is not smooth and differentiable(See Fig. 3(a)), making efficient gradient descent/ascent technique not applicable. Hence, one needs to either use simulated
annealing or a brute force approach to find the maxima.
In contrast, the usual arithmetic mean of losses (SeeFig. 3(b)) as an empirical risk function, gradient descentapplies well. To conclude, the mitigation comes at the cost of
performance. However, for this framework there is only one
parameter to learn, the search space is over a reduced latent
space, and parameter needs to be learnt only once. Hence,a brute force approach to find the exact global maxima in
Algorithm 2 is implemented. In future, we will implement
simulated annealing to report any performance difference.
C. Final Learning Algorithm with Quantile Weighted Tukey
Here we merge the tukey biweight, quantile weighted regression errors and robust ERFHM into one (Algorithm 2).
We introduce two weights (i.e., λhigh and λlow ) to the si
before it is passed to the Tukey loss, such that λhigh > λlow .
This can be verified from line 5 and line 12 in Algorithm 2.
The Lines 2-9, tackle the outer points, while 10-16 tackle
inner points relative a candidate choice τ − . The λlow weight(a)(b)
Fig. 3. Empirical Risk with Quantile Tukey: (a) ERFHM (b) ERFAM .
(p)(p)
Both figures correspond to ρmal = 0.40, δavg = 200, poisoning duration 6months, poisoning attack type deductive, hypothesis space is τ − . Note thatthe maxima of ERFHM is achieved for τ − = −0.23, while the minima of
traditional ERFAM is achieved at τ − = −0.32. This proves that ERFAM
is less robust due more negative threshold under attacks

Algorithm 2 Empirical Risk Function as Harmonic Mean of(hmtu)
Quantile Tukey losses(τmin )1: for RU C − (T ), τ − do2:
if (RU C − (T ) < τ − ) then3:
S − : |τ − − RU C − (T )|4:
if (S − ≤ βt )then 

5:
6:
7:
8:
9:
10:
11:
12:

L s− :

2
βt
6

1− 1−

s− λhigh
βt

else
β2
Ls− : 6t
end ifelse
S − : |RU C − (T ) − τ − |if (S − ≤ βt )then L s− :

2
βt
6

1− 1−

s− λlowβt

2 3 

2  3 

13:
else
β2
14:
Ls− : 6t
15:
end if16:
end if
17: end for
N−P
1
RU C − (T ) L −s(hmtu)= arg maxτ −18: τmin!

corresponds to regression errors of inner points relative to τ − ,and λhigh corresponds to regression errors of outer points. Thisfurther adds to the balance between false alarms and limiting
impacts of poisoning attacks. Finally, line 18 implements our
ERFHM in Eqn. 11. Note however, that for learning of the
hmtu, the definition of outer and inner points
upper threshold τmax
get switched due to the sign change in RU C + (T ). We need
to be careful about how the quantile weights are describedcompared to previous works on this problem [3]. Therefore,
for RU C + < τ+ , the line 5, of Algorithm 2 will be replacedby λlow instead, and the line 12 will be replaced by λhigh ,unlike Algorithm 2.
D. Learning Hyperparameters
Now we describe the hyperparameters selection βt , λlow
λhigh over a cross validation dataset. We split the dataset
from the 2016 dataset into partition of four month of crossvalidation. The rest of the 8 months of 2016 was set aside fortesting. Among the 4 months, we have 2 months of benign and2 months of various attacks. Hence, we have different pairs ofbenign and attack realizations in the cross validation set. We
jointly measure the false alarms and the missed detection overthe benign and attack portions respectively, by trying different
values of the hyper-parameters. We pick the hyperparameters
according to the following:arg minβ + ,βt− (wmd M D + wf a F A)t

(13)

We maintained a fixed weight assignment of wf a = 0.7 and
wmd = 0.3. This choice is substantiated that the reduction offalse alarms at the very least, twice as important.
The βt+ and βt− is 0.0009, λhigh = 0.8 and λlow = 0.2. The
hyperparameters, βc , βh , in Cauchy and Huber Losses were
evaluated in [3], we adopt those values directly for comparison
with our work.
E. Security Evaluation Metrics
Here we elaborate the two main security evaluation metrics.
Impact of Undetected Attack: This metric quantifies mitigation by measuring the impact of an undetected attack on
the utility after implementing both our attack and defense
strategies [13]. To determine the daily impact of an undetectedattack, we quantify the lost revenue in relation to the unit priceof electricity, denoted as RR. This calculation is expressed as:
RR = (δavg ∗ M ∗ η ∗ E)/1000(14)

here, η = 24 represents the number of daily reports, E =$0.12 stands for the average cost of electricity per unit (KWHour) in the USA, δavg signifies the margin of false data intest set, M denotes the number of compromised smart metersin the test set. The impact of an undetected attack is:
Impact = RR ∗ Tdetect(15)

where Tdetect refers to the time duration in days between thestart and end of the undetected attack within the test set. A
smaller impact signifies superior performance.
For mitigation performance, we report the I in the test set
in the presence of optimal evasion attacks measured over a 90day period. Optimal evasion attack is a data falsification thatjust evades the poisoned threshold and hence is the stealthiest
possible attack. The lesser the I, the better is the mitigation.
Expected Time between Consecutive False Alarms: The
expected time between two false alarms, denoted as ETF A
is a metric recommended by recent NIST [13] recommended
metric for time series anomaly detection:P
ETF A =ηF A TBF A

ηF A − 1

attacks and any gross data errors. Further, experimental details
on extraction of RU C(T ) can be found in [2].
The smart meter data are partitioned into three segments fortraining, cross-validation, and testing purposes. The training
dataset comprises all records from 2014 and 2015, following
the approach outlined in prior research [3] to ensure fair
performance evaluation. The remaining records from 2016 are
split into two subsets for cross-validation and testing. For
cross-validation, all records from the first three months of2016 are utilized, while the data from the subsequent ninemonths of year 2016, constitute the testing dataset. The learned
hyperparameters for proposed method are βt+ = 0.0009 and
βt− = 0.0009. To extend poisoning duration, we introduce
variations in the duration of deductive attack types in the
training dataset, categorizing them into three distinct periods:
2 months (8.33% poisoned samples), 4 months, and 6 months(25% poisoned samples). We also vary the poisoning strength(p)
per smart meter δavg from 50W to 400W (above 400W most
methods can detect attacks) and the poisoning scale ρmal(p)varying from 20% to 70% of the meters compromised. We
report performance averaged over all possibilites.

(16)

where ηF A represents the number of false alarms and the
TBF A is the time interval between any two consecutive false
alarms. In the case of a single false alarm, this equation does
not apply, and instead, ETF A is 364, reflecting the expectationof another false alarm occurring within a year. Note, the higher
the ETf a the better it is, (i.e. less frequent false alarms).
For false alarm performance, we report ETf a for 9 monthsof 2016 (i.e., the test set), when there no poisoning attacks
during the training set and no evasion attacks in the test set.
V. E XPERIMENTAL R ESULTS
We validate our work using the data collected from the
Pecan Street Project with 200 houses [8] from a solar microgrid. Amongst the different datasets available, the texas dataset
shows most variations and data errors [2], which motivatedus to pick this dataset. Unlike in [2, 3], we did not do any
data cleaning for this paper, so we can test mitigation of bothFig. 4. Average Impact of undetected attacks over Varying Poisoning(p)(p)
Durations Averaged over all (δavg , ρmal ) pairs: Proposed vs. Previous Works

A. Impact Mitigation Performance Under Poisoning
The Fig.4 illustrates the average impact of undetected attack(p)(p)
in the test set, (averaged over all δavg and ρmal ) of our
proposed approach; as compared to existing works that use
quantile weighted versions of cauchy and huber losses andthe ERF is arithmetic mean of such losses. Note that attack
is undetected means we implemented an attack that will not
exceed the learnt threshold - assumes adversary with complete
knowledge. From Fig. 4 we can easily infer that proposed
method has the lowest impact of undetected attack regardlessof the increasing poisoning duration.
B. Base Rate False Alarm Performance
Table II, gives the expected time between false alarms fordifferent design choices in the event that there are no poisoning attacks in the training; no data falsification in the test set;
and utility uses our design as compared to others. We see thatour proposed approach gives ETf a of 241 days. In contrast,
we see that regular Tukey that does not use quantile regression
errors give a poorer false alarm performance with 201.34
days between any two false alarms. This shows specificallythe benefit of incorporating quantile regression errors rather

than regular errors. Additionally, the quantile Cauchy is theworst giving on average 116.52 days gap between two false
alarms, and quantile Huber gives 233.65 days which is theworse than our proposed approach - but huber is least robust
under poisoning. This proves that our method mitigates impactof undetected attack without sacrificing base rate false alarm
performance. Note the difference in the numbers comparedto [3] is due to the use of uncleaned data in our paper.
TABLE II
BASE R ATE E XPECTED T IME BETWEEN FALSE A LARMS : C OMPARISON
Empirical Loss
Harmonic Mean of Quantile Tukey Loss - Proposed
Arithmetic Mean of Quantile Tukey Loss
Arithmetic Mean of Regular Tukey Losses [17]Arithmetic Mean of Quantile Cauchy Loss [3]Arithmetic Mean of Quantile L1 Loss [3]Arithmetic Mean of Quantile Huber Loss [3]

ET
fa
241.0
232.16201.34116.52239.01233.65

C. Mitigation Sensitivity Analysis with Ablation Studies
Here, we show how mitigation performance is affectedby varying poisoning strength and scales keeping the same
poisoning duration of 4 months. Fig. 5(a) shows impact of
three different loss function for each poisoning strength value,(p)(averaged over all corresponding ρmal varying between 20%
and 70%). As the poisoning strength increases, Cauchy’s andHuber’s performance in terms of undetected attack impact
increases while for the proposed approach. This is true for(p)Fig. 5(b) which shows sensitivity over varying ρmal (each(p)
averaged over all possible δavg ).

(a)(b)
Fig. 5. Average Mitigation Performance with poisoning duration of 4 months:(p)(a) varying poisoning strength (averaged over all possible ρmal ); (b) varying(p)(p)
poisoning scale ρmal (averaged over all possible δavg ). The Figures are
generated by using proposed ERFHM same for varying loss functions
to show the individual benefit of loss function choice.

Fig. 6. Average Impact Mitigation over varying poisoning durations. generated by keeping the same loss function (i.e. Tukey) to show the individual
benefit of the proposed ERFHM into our design

Fig. 6 shows only the difference made by the difficult to
optimize empirical risk function, while keeping everything elsein Algorithm 2 same. We observe that our modified empiricalrisk (light blue bars) gives a much lower impact of undetectedattack, compared to the use of arithmetic mean of quantile
weighted Tukey losses (dark blue bars). This proves that theperformance trade-off for using our proposed robust empiricalrisk ERFHM is worth it; as the poisoning duration increases,
the benefit of ERFHM over ERFAM become more apparent.
D. Conclusion
In this paper, we enhanced the robustness of anomaly based
attack detection methods in smart living CPS against training
set (simple poisoning) attacks of various scales, strengths,
and durations. Our framework contained three design changes
compared to the usual practice of learning the thresholds (i) quantile regression errors, (ii) Tukey Bi-weight as loss
function, (iii) harmonic mean of Tukey loss as empirical riskfunction. We found that combining the three proposed designchanges in the learning the threshold of time series anomaly
detectors, it is possible to mitigate both impact of poisoning
attacks as well as base rate false alarms (in the absence of
poisoning) without a priori assumptions on attack capabilities.
Furthermore, also offered explanations of why our design
choices improved performance and also did not make any
assumptions about optimal attacks.
Acknowledgements:Research was supported by US National Science Foundation CNS-2030611.
R EFERENCES[1] A. E. Cinà, K. Grosse, A. Demontis, B. Biggio, F. Roli, M. Pelillo, “Machine
Learning Security against Data Poisoning: Are We There Yet?”, arXiv preprint
arXiv:2204.05986,2022.
[2] S. Bhattacharjee, S.K. Das, “Detection and Forensics against Stealthy Data
Falsification in Smart Metering Infrastructure”, IEEE Trans. of Dependable andSecure Computing, Vol. 18, Jan. 2021.
[3] S., Bhattacharjee, M. J., Islam, S., Abedzadeh. ”Robust anomaly based attack
detection in smart grids under data poisoning attacks”, ACM AsiaCCS Workshop
on Cyber-Physical System Security, pp. 3-14. May. 2022.
[4] P. Roy, S. Bhattacharjee, S. Abedzadeh and S. K. Das, “Noise Resilient Learning
for Attack Detection in Smart Grid PMU Infrastructure,” IEEE Transactions on
Dependable and Secure Computing, 2022.
[5] J. Islam et al., “Anomaly based Incident Detection in Large Scale Smart
Transportation Systems,” 2022 ACM/IEEE 13th International Conference on
Cyber-Physical Systems (ICCPS), 2022, pp. 215-224.
[6] J. Steinhardt, P. W. Koh, P. Liang. “Certified Defenses for Data Poisoning
Attacks”, . Advances in neural information processing systems, 30, 2017[7] M. A. Ramirez , S.K. Kim , H. A. Hamadi , E. Damiani , Young-Ji Byon , T. Y.
Kim , C. S. Cho and C. Y. Yeun, “Poisoning attacks and defenses on artificial
intelligence: A survey.”, arXiv preprint arXiv:2202.10276, 2022
[8] [Online] Pecan Street Project Dataset https://www.pecanstreet.org/[9] G. Shevlyakova, S. Morgenthalerb, A. Shurygin., “Redescending M-estimators”,
Journal of Statistical Planning and Inference, pp.2906-2917. No. 10, 2008.
[10] D. M. Khan, M. Ali, Z. Ahmad, S. Manzoor, and S. Hussain., “A New Efficient
Redescending M-Estimator for Robust Fitting of Linear Regression Models in the
Presence of Outliers”, Mathematical Problems in Engineering, pp. 1-11, 2021
[11] P. Roy, S. Bhattacharjee, S.K. Das, “Real Time Stream Mining based Attack
Detection in Distribution Level PMUs”, IEEE GLOBECOM, Dec. 2020.
[12] D. Urbina, J. Giraldo, A. A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal,
R. Candell, H. Sandberg, “Limiting the Impact of Stealthy Attacks on Industrial
Control Systems” ACM CCS, 2016.
[13] D. Urbina, J. Giraldo, A. A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal,
J. Ruths, R. Candell, H. Sandberg, “Survey and New Directions for PhysicsBased Attack Detection in Cyber-Physical Systems”, ACM Computing Surveys,
Vol. 51(10), 2018.
[14] P. Huber, E. Ronchetti, “Robust Statistics”, Wiley Probability and Statistics, ISBN
978-0470129906, Feb. 2009.
[15] A. Ghafouri, Y. Vorobeychik, X. Koutsoukos, “Adversarial Regression for Detecting Attacks in Cyber-Physical Systems” IJCAI, 2018.
[16] X. Li, Q. Lu, Y. Dong and D. Tao, “Robust Subspace Clustering by Cauchy Loss
Function,” IEEE Transactions on Neural Networks and Learning Systems, Vol.
30(7), pp. 2067-2078, 2019.
[17] S. Beatriz, S. Aelst. “Advantages of M-estimators of location for fuzzy numbers
based on Tukey’s biweight loss function.” Intl. Journal of Approximate Reasoning. Vol.93. pp.219-237. 2018.
[18] P. S. Bullen: Handbook of Means and Their Inequalities. Dordrecht, Netherlands:
Kluwer, 2003, pp. 175-177.
[19] D. F. Andrews: A robust method for multiple linear regression. Technometrics,
16(4), pp.523-531