This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

Detection and Forensics against Stealthy Data
Falsification in Smart Metering Infrastructure
Shameek Bhattacharjee∗ and Sajal K. Das†
∗ Dept. of Computer Science, Western Michigan University, Kalamazoo, MI, USA† Dept. of Computer Science, Missouri University of Science and Technology, Rolla, MO, USA

Emails: shameek.bhattacharjee@wmich.edu; sdas@mst.edu

Abstract—False power consumption data injected from compromised smart meters in Advanced Metering Infrastructure(AMI) of smart grids is a threat that negatively affects bothcustomers and utilities. In particular, organized and stealthy
adversaries can launch various types of data falsification attacks
from multiple meters using smart or persistent strategies. In thispaper, we propose a real time, two tier attack detection scheme
to detect orchestrated data falsification under a sophisticatedthreat model in decentralized micro-grids. The first detectiontier monitors whether the Harmonic to Arithmetic Mean Ratio of
aggregated daily power consumption data is outside a normal
range known as safe margin. To confirm whether discrepancies
in the first detection tier is indeed an attack, the second detectiontier monitors the sum of the residuals (difference) between the
proposed ratio metric and the safe margin over a frame of multiple days. If the sum of residuals is beyond a standard limit range,
the presence of a data falsification attack is confirmed. Both the‘safe margins’ and the ‘standard limits’ are designed througha ‘system identification phase’, where the signature of proposed
metrics under normal conditions are studied using real AMI
micro-grid data sets from two different countries over multiple
years. Subsequently, we show how the proposed metrics trigger
unique signatures under various attacks which aids in attack
reconstruction and also limit the impact of persistent attacks.
Unlike metrics such as CUSUM or EWMA, the stability of the
proposed metrics under normal conditions allows successful realtime detection of various stealthy attacks with ultra-low false
alarms.
Index Terms—Statistical Anomaly Detection, Cyber-Physical
Security, Smart Grid, False Data Injection, Data Falsification.

I. I NTRODUCTION
Advanced Metering Infrastructure (AMI) is a key component of the smart grid technology, that measures data on loads
and electricity (power) consumption of customers [19]. Suchdata are measured by smart meters installed at the customer
site. The AMI data is expected to play a decisive role in theaccuracy of critical tasks such as automated billing and pricing,
demand forecast, automated demand response, load adjustments, and management of daily and critical peak shifts [33].
Therefore, the integrity of AMI data is indispensable.
Several real incidents of isolated and organized data falsification and their losses to the utilities have been reported in[31], [32]. Existing research on defense against the falsificationof power consumption data has been mostly restricted toelectricity theft, [8], [12], [15], [27] where individual meters
report lower than actual usage. Since smart meters belonging
to rogue customers reduce the actually measured reading of
power consumption, such an adversarial strategy is termed

as a deductive mode of data falsification. However, recent
works in this area [2], [20], and recent real case studies [28],have recognized the possibility of additive and camouflage
modes of data falsification as well. In additive attacks, higher
than actual power consumption can be sensed by a meter as
a byproduct of static and dynamic load altering attack [20]or hardware tampering, affecting both customers and utilities.
For camouflage attacks, the total margin of deductive attacks
is balanced by the additive attacks, such that one set ofcustomers benefit with lesser bills at other’s expense, while
ensuring that the mean aggregate power consumption from a
microgrid remains practically unchanged. Therefore, a defense
is required against all three modes of attack.
Additionally, due to the economic and civilian impacts, theAMI could be a target of powerful stealthy adversaries, suchas rival nations [9], utility insiders [32], organized crime [29]and business competitors [9], [35], who possess the ability
to compromise several smart meters (as in [32]), alter smaller
amounts of data per meter, to avoid easy detection (from proximity, consensus, or classification based detectors) while significantly impacting operations in the long-term [9], [12], [32].
Furthermore, stealthy or persistent adversaries may possesspartial knowledge of usual security mechanisms or complete
knowledge of the actual defense mechanism, thus enablingthem to employ stealthier falsification strategies. Due to theaforementioned competence, the realistic strategy space fordata falsification is much larger than what has been assumed
by existing research in this field. Nonetheless, apart from cyberattacks, false data from smart meters can be easily launchedthrough physical attacks (by physical/wireless tampering of
hardware; e.g. optical ports, rewiring etc.,) on the smart meters(as committed in 2012 Puerto Rico attack [29], [32]) or
through optical probe toolkit shown by analysts at InGaurdians
Inc. [29]. Hence, cryptography [26] or network based intrusion
detection is not enough to counter this problem.
Contributions of our work: In this paper, first we discuss
some possible stealthy strategies to launch additive, deductive
and camouflage modes of data falsification. To detect thepresence of organized data falsification attacks, we propose a
two-tier, light weight, real time, statistical anomaly detection
scheme that detects the presence and mode of various attacks.
The first tier uses a Harmonic Mean to Arithmetic Mean Ratio
metric of the aggregate power consumption data, to identify
discrepancies in the time series behavior. The second tier uses
the Sum of Residual under the Ratio Curve metric to confirm

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

whether the discrepancies in the first tier is indeed an attack ornot. The second tier is particularly relevant when the effective
margin of false data introduced by the adversary is very low
and higher detection sensitivity needs to be achieved without
degrading false alarm performance.
Subsequently, through a system identification phase, we firstestablish the ‘normal behavior’ of the two proposed metrics
under no attacks. The normal limits of Harmonic to Arithmetic
mean ratio metric is termed as a ‘Baseline Safe Margin’
and the limits of Sum of Residuals under the Ratio Curveis termed as ‘Baseline Standard Limit’. These metrics andtheir normal limits are carefully designed from real datasets,such that their values when observed under attacks, deviate
from their normal limits with a high sensitivity. Then, weestablish theoretical properties of the proposed metrics thattrigger unique signatures under each mode of attack andtype of adversarial strategy. Finally, we propose an attack
reconstruction scheme using observed changes in the direction,
sign and magnitude of the proposed metrics to associate
the signatures with different attack types that could guidesite security officers or demand control mechanisms for asuitable response. Thereafter, to mimic persistent adversaries
with complete knowledge about our defense mechanism, we
design attack strategies that will just ensure evasion. Against
such persistent adversaries, we quantify our performance by
the extent to which we limit the attacker’s impact of attack(e.g. revenue accrued per unit time), while preserving ultralow false alarm rates while accounting for base rate fallacy.
We validated our approach through experiments on real data
sets acquired from an actual AMI infrastructure from Texas,
USA (800 houses for 3 years) and Dublin, Ireland (5000
houses for 535 days). Most of the results correspond to the
Texas data due to longer duration, while Irish dataset is used
to prove the generality, scalability and sensitivity trade-offs.
Results show that our model is able to detect, decipher, andconfirm various attacks launched by stealthy and persistent
adversaries in real time across different datasets. We showthat our model is particularly robust to different fractions ofcompromised meters and very low margins of false data which
is typically a problem with existing mechanisms.
Both the proposed detection metrics are privacy nonintrusive by design, since they do not require profiling offine grained customer specific data. Both metrics are morestable invariants of power consumption across multiple AMI
datasets, which achieves high detection sensitivity and ultralow false alarms simultaneously. Existing works in this area,
do not implement novel falsification strategies, do not assume
stealthier margins of false data (≤ 400W ), do not assume wide
variation in the fractions of compromised meters (5%-70%),
do not assume persistent adversaries that have full knowledgeof defense mechanism, or do not emphasize on real time
detection. We quantified detection limits and impact resilience
to justify the improvement.
The paper is organized as: Section II discusses limitation ofrelated work, Section III discusses the threat model, Section IV
describes the dataset and the system, Sections V and VI
discusses the proposed method and its theoretical analysis
respectively, followed by experimental results in Section VII.

II. S OME L IMITATIONS OF P REVIOUS W ORKS
Existing research on data falsification from smart metering
infrastructure can be roughly classified into Classification
based detection, State Estimator based detection, and Consensus based Detection. which are confined to the study ofelectricity theft (deductive falsification).
Classification based approaches [7], [8] include multi-class
Support Vector Machines (SVM), Neural Networks, Radial
Basis Function based models. Classification based schemes
are computationally intensive, require full and fine grained
profiling of each smart meter, not scalable for real AMI sizes,
and do not provide real time detection. A comparative studyof all classification based schemes in [6] concludes that whilethese schemes require full and continuous profiling of every
customers’ energy consumption, the detection rates of most ofthese schemes are approximately 60%-70%. Moreover, only
two schemes provide a quantitative false alarm rate.
State based detection [5], [10], [13], need extra hardware
deployed at different places in the AMI and the distribution
grid for sanity checking [6]. Extra hardware required is costly
to the extent that it “has been recognized as a practical
deterrent for utility providers to use such solutions in scale asreported by [30]”. Some research proposes checking the nontechnical losses (NTL) at transformer meters. However, [6]observes that NTL values vary due to a large number of factors
other than attacks and hence also suffers from high false alarm
rates. Also, NTL approach fails to detect camouflage attacks
or additive attacks induced through load altering [2].
Consensus (Aggregate) based detection include mean aggregate outlier inspections, non-parametric measures such as
Exponential Weighted Moving (EWMA) and CUSUM Control
Chart (CUSUM) of the aggregates, and parametric measures
such as Auto Regressive Moving Average (ARMA) models,
to detect false data injection. The comparisons could be either
instantaneous or historical consensus. If the difference between
predicted consensus and the observed consensus (often called
as residual) is above a threshold, then attack is inferred. Workssuch as [15], [25], [27], use mean or median power consumptions or compare proximity of meter readings to the meanand standard deviation of power consumption. ARMA basedmodels [15] analyze each customer meter’s time series data
separately to increase accuracy, using ARMA-GLR detector.
However, in many practical cases, the consumption cannot be
accurately modeled as an ARMA process as mentioned in [8],[15], resulting in success rates of 62% only. Consensus or
Aggregate based approaches usually do not require separate
profiling of every meter, or additional hardware, hence muchless costly and feasible than the other two approaches.
Weaknesses of Consensus Methods under Stealthy Attacks:
Many aggregate or consensus based mechanisms, use nonparametric statistics like EWMA and CUSUM [13], [15]and parametric statistics like ARMA [15] to ‘smoothen’the mean power consumptions to get a stable estimatedtrend, which is compared with observed sample consensus or
per meter mean sample measurements for attack detection.
However, we observed some general difficulties with theseapproaches. Figure 1, shows arithmetic mean of the power

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

consumption from our real data set [34] for the same time
period for three different years. Note, that the mean power
consumptions readily vary over time within the same year.
Additionally, there is a large difference between the meanson the same days in successive years. Such large variations inmean consumptions create two major roadblocks. First, false
alarms or missed detections are more (depending upon thechosen weights of different statistics), due to the inherently
unstable nature of the mean consumption. Secondly, thenormal ‘residual’ difference between actually observed
sample and the ’smoothened’ mean consumption is large(above 130W from our studies), giving ample opportunities
for the adversary to induce changes in such metrics that staywithin the normal residual difference, while still accruing
substantial attack impact. As an example, for a micro-grid of
200 meters, suppose 40% of them have been compromised.
Then an average margin of false data of 325W from eachcompromised meter, introduces an average error residual of
130W in the mean. The calculation is shown in Appendix
B. In other words, it is difficult to identify such an attack
given the large legitimate variation of metrics derived frommean/median measures. However, at the same time themonetary (loss) impact of this attack is RR = 75 dollars/day.
Raw Power Usage Data (W)1800
Mean (2014)
Mean (2015)
Mean (2016)

1600
1400
1200
1000
800
600
400
0

20

40

60

80

100

Days

Fig. 1. Instability of mean power consumption

Furthermore, approaches such as [2], [8], [25], [27], thatcompare whether individual meter’s data is within the standard
deviation fail, since an average falsification margin of 325W
is much lesser than the typical standard deviation of the power
consumption datasets (≥ 400W [34], [36]). Thus in mostexisting works, assumed margins of false data ranges between
400W upto 1500W and detection rate sharply degrades tozero for margins less than 400W . Powerful and stealthy adversaries having a higher initial attack budget can compromisea larger number of meters and/or inject lower margins offalse data (below the standard deviation) per meter, to remain
undetected while gaining incremental benefits in the longterm. Hence, approaches based on proximity of data within
estimated instantaneous or historical mean and/or standard
deviation of aggregates fail under lower margins of false data.
Furthermore, reports on 2012 Puerto Rico attack [29], [32],indicated that it is possible to compromise a large fraction ofsmart meters. Finally, due to the instantaneous smootheningof the consensus measures, the danger of the instantaneous
residual difference being within the normal residual limit isincreased when attackers increase their falsification marginincrementally over each time slot. For all the above reasons,solutions from traditional sensor networks or control systems
cannot be borrowed. Given these limitations, there is a need fora real time, light weight, anomaly detection which is focusedon detecting orchestrated attacks from multiple number ofmeters particularly with lower margins of false data. This
motivates us to propose a novel scheme that provides security
forensics to detect various falsification attacks in AMI withultra low false alarms. Note that our approach while focusing
on low margins of false data, also works for higher margins.
III. T HREAT M ODEL
False power consumption data could be achieved by manipulation of (i) inputs into the meters, (ii) data at rest in
the meter, or (iii) in-flight from the meter. If an adversary
is able to capture the data collectors/hops over the meshnetwork that connects AMI with the utility, it may be easier
to intercept larger number of unique meter’s data without
physically compromising many meters.
Scope: We assume an orchestrated attack where an organizedand powerful adversary launches data falsification from several
compromised smart meters concurrently. The emphasis isespecially on adversaries that are more inclined to keep the
margin of false data smaller while having a higher number ofcompromised nodes M to affect a long-term damage while
avoiding easy detection. Since AMI is a new research area,large scale real world malicious samples are hard to find.
Therefore, we generated attack samples over our real dataset,assuming an unbounded strategy space that does not favor our
defense mechanism and shown the detection limits. Proposed
method does not intend to detect isolated uncoordinated attacks or detect isolated rogue customers, since such a problem
has been investigated by numerous previous works.
A. AMI Data Falsification Attack Modes
Let Pti (act), be the actual/authentic power consumption
measurement from a meter i at time slot t that is unknown
to the utility, while Pti is the reported power consumption
which the utility receives. Under no falsification, the reported
consumption data Pti = Pti (act) is unbiased, while underattacks Pti is biased by the following falsification modes:
Deductive: The adversary reports Pti = Pti (act) − δt , whereδmin ≤ δt ≤ δmax is a false bias, amounting to electricity
theft.
Additive: The adversary reports Pti = Pti (act)+δt . An additive
attack could be launched by a competing utility on its rival
company’s meters, inducing loss of business confidence by
the customers of the victim utility, due to higher than actual
bills. Furthermore, if a victim company participates in automated demand response, load may be changed by a Dynamic
Load Altering attack [20], causing multiple smart meters tosense/record higher than actual consumption concurrently. The
victim company ends up paying undue incentives for resultant
peak shifts. A recent report in [31], showed utilities facing
lawsuits by customers accusing unfairly high bills.
Camouflage: The adversary divides the compromised meters
into two teams equal in number, which simultaneously adopt
an additive and deductive modes of attack, respectively. Thismode favors one set customers at the expense of others.
It cannot be detected by simple mean based comparison
approaches, because no suspicion is raised due to negligible
change in the aggregate mean consumption.

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

All δt are generated randomly within an interval[δmin , δmax ]. Let δavg be the average value of δt for eachcompromised meter, termed as margin of false data, whose
magnitude depends upon the time horizon of the intended
attack and damage. Hence, δavg is part of the adversarial
strategy. All units of δavg values are in Watts and lower values
are more stealthy. For a smarter attack, the distribution of δt ∈[δmin , δmax ] should be a variant of some uniform distribution
such that the resultant change in shape of the distribution of
AMI consumption data is not very obvious [8]. Given theunimodal nature of power consumption in a residential AMI
network [2], [8], any intelligent attacker would refrain from astrategy that would make the resultant distribution multi-modal
or in general alter its shape. As an illustration, a comparison
between normally distributed and uniformly distributed δtwith the same δavg , and its effect on the resultant shapeof the distribution is depicted in the Appendix C. Note thatour detection scheme works under both cases. However, ourresults consider variants of uniformly distributed case, being
the smarter strategy.
We assume that organized adversaries compromise a certain
number M out of N smart meters, depending on a total attack
cost budget represented by T C. The fraction of compromised
nodes is ρmal = M
N . Given a microgrid of fixed N meters, we
use different values of M to study sensitivity to various attack
budget. Separately, for an adversary with a given M , we vary
N to study scalability of the proposed solution.
C. Revenue (Impact) of an (Undetected) Attacker
The attacker’s revenue per day denoted by RR, definedin terms monetary worth of electricity power (in dollars),quantifies its benefit from an attack. Revenue RR per day
in dollars is defined as:
RR =δavg × M × η × E
1000

(1)

where η is the number of reports a day, and E = $0.12 is
the average per unit (KW-Hour) cost of electricity in USA.
Additionally, we define breakeven time TBE , as the timerequired for the total cumulative revenue accrued from attacks
to match the initial total attack cost T C.
D. Stealthier Data Falsification Strategies
Unlike the existing works that assume a random noise
as falsification strategy, we assume some stealthy strategies
that may be inspired by partial knowledge of usual security
mechanisms or complete knowledge about the actual defense
mechanism.
Data Order Aware Attack: is motivated to minimize chancesof detection against mechanisms utilizing proximity (distance)of reported data from meters with historical data or consensus.
In Fig. 2, the green line corresponds to the actual power
consumption from the compromised meters. The black andred lines correspond to falsified consumption data following
a non-data order aware and a data order aware strategy undersame δavg and ρmal . Even as the same revenue is achieved
with both strategies, the chances of detection (using proximity

based mechanisms) are lesser in data order aware strategy due
closer proximity to the actual data.
4000

Power Value (W)B. Margin of False Data and Fraction of Compromised Meters

3000

2000

Malicious (Data Order Aware)Honest Data
Malicious (Not Order Aware)
Data Order Aware
closer to honest data

1000

0
0

20

40

60

80

Compromised Meter ID

Fig. 2. Illustration: Benefit of Data Order AwarenessThis strategy is implemented in the following manner: The
adversary sorts the actual power consumptions observed from(1)
its set of M compromised meters such that Pt (act) ≤(m)(M ), · · · , Pt (act), ≤ Pt (act). Then adversary generates M
random numbers for δt , sorted as δtmin ≤, · · · , ≤ δtmax . For
an additive attack, the lowest observed power consumption
data is changed with the highest δtmax , while highest observed
power consumption data is modified with lowest δtmin , and so(1)(M )on, such that Pt (act) + δtmax , · · · , Pt (act) + δtmin . For
a deductive attack, the highest observed power consumption
data is changed with the highest δtmax , while the lowest
observed power consumption data is changed with the lowest(M )(1)
δtmin . Hence, Pt (act) − δtmin , · · · , Pt (act) − δtmax . For a(1)(M )camouflage attack, the sorted Pt (act) ≤, · · · , ≤ Pt (act)is divided into two parts, and corresponding portions arechanged accordingly. This kind of attack therefore, is moreaware of the current consumption trends as seen by the meters
under adversarial control and minimizes the chances of the
final reported value to be obvious outliers and more close to
the actual power consumption distribution.
Incremental Evolving Attack: Instead of immediately falsifying data with the intended δavg , adversary incrementally
increases margin of false data by ∆q watts on every time slot,
leading upto the intended δavg . A gradual change on every
time slot causes the approaches based on instantaneous moving
averages to fail, since the average readjusts itself within thedetection threshold continuously.
Persistent Attacks: These are strategy parameter pairs of(ρmal , δavg ) for which the adversary would persist in thesystem undetected for our proposed defense mechanism. Whenthe adversary has knowledge of the exact defense mechanism
and the detection thresholds used, it can estimate (ρmal , δavg )pairs that will just ensure evasion. Axelsson et.al. [1], in his
seminal paper on intrusion detection termed this as ‘securityof the detector’, as an evaluation property that quantifies therisk, should the detection mechanism be leaked. Since theadversary never gets detected in such cases, the security of our
proposed approach is evaluated by quantifying the extent towhich we limit the impact of an undetected attack or reduce
the undetectable strategy space versus relative frequency offalse alarms. We define breakdown point, as the δavg and ρmalpair for which the proposed defense model just fails to detect
an attack and examine the RR and TBE at these breakdown
points.

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

0.07

IV. DATA S ET AND S YSTEM M ODEL D ESCRIPTION

0.06

6000

0.05

Probability

5000
4000
3000
2000

0.03
0.02
0.01

1000
0

0.04

0
0

1000

2000

3000

4000

5000

6000

Power ( Watts )

0

1000

2000

3000

4000

5000

6000

Power (Watts)(a)(b)
Fig. 4. Power Consumption (Ireland): (a) 5000 houses (b) Mixture P mix

natural logarithm scale to obtain an approximate Gaussian
distributed random variable denoted as pmix . Therefore, wedenote pit = ln(Pti + 2) as the effective power consumption
data from each i on an ln scale at any time slot t that is used by
the detection scheme. All t’s are slotted hourly in our dataset
which is usual practice as reported in several works [8], [15].
Additional results of this approximate normal mixture modelfor different months in the recent past and the QQ plot (fornormality test) is depicted in the figures in Appendix A.
The box-cox transformation serves a dual purpose. The
transformation to a lower dimensional real axis, increases relative sensitivity to the change in Harmonic Mean to Arithmetic
mean ratios because some interesting statistical properties are
more prominent in a lower dimensional real axis. Secondly,
Gaussian approximation helps in the approximation of somemathematical bounds more tractable. For Texas and Irish
data data, 67.7% and 66.9% of the samples are within thefirst standard deviation, meaning the separation among data
points are reduced. However, the transformed datasets remain
unbalanced around the mean as 64% and 69% of the samples
are on the left (i.e., lesser than) of the mean and 36% and 31%of the samples are the right (i.e., greater than) of the mean,
for Texas and Irish datasets respectively. Due to this inherent
asymmetry, more data points (even after transformation) areon the left side (i.e., less than) of the mean. This is a factor thattriggers unique signatures under attacks (see Section VI-B).

0.03

500

Frequency of Power Value

Frequency of Power Value

We utilize real AMI datasets from two sources. The firstdataset is collected from Pecan Street Project [34] consistingof 800 houses for a period of 3 years (2014, 2015, 2016) in
Texas, USA. The second dataset is taken from Ireland Social
Sciences Data Archives [36] consisting data from 5000 houses
for a period of 535 days (around 2 years) (2009-2010) from 6
regions around Dublin, Ireland. All data belong to residential
customers. Since the Irish dataset was for a limited time, alongitudinal study on it was not feasible. Hence, most of thelearning methods in this paper utilizes the first dataset. In
contrast, the second dataset is used to test the generalizable
nature, sensitivity and scalability of our proposed detection
mechanism to other AMI datasets that have a completely
different population size, climate, and habits. Unless statedexplicitly, all results by default correspond to the Texas data.
Data Distributions: Let P i denote the steady state power
consumption distribution of any meter i. Investigations onreal hourly power consumption data sets [34], from different
microgrids, shows that each P i follows an approximate log
normal distribution. Figs. 3(a) and 3(b), show the example
of data distributions for a 200 meter population from Texas.
It is observed that such log normal distributions are closely
clustered to each other such that the variation among themis not arbitrarily large, as seen in Fig. 3(a). Given thisobservation, it can be argued that the combination of theindividual log normals can be well approximated by a mixture
distribution that is also log-normal [2], as seen in Fig. 3(b),which shows the trend for the mixture distribution (P mix ) of
the power consumption of all houses. The shape indicates anapproximate lognormal distribution.
To address concerns on the generality of these observations,
we repeat the above for the Irish dataset. Fig. 4(a) refer
to power consumption distribution of individual houses in
the Ireland dataset, whose mixture distribution counterpart isshown in Fig. 4(b). The results clearly indicate that aggregate
power consumption across multiple data sets from different
regions follow a particular trend that generalizes. Hence, thevalidity of our experimental work is preserved regardless thedataset. Our findings are also corroborated by another work[21], with similar results obtained from a different data set.
Hence, it can be safely concluded that the observed trend isgeneric rather than being specific to one data set.

7000

0.025

Probability

400

300

0.02

Fig. 5. AMI: Generic System View

0.015

200

100

0

0.005

X: 925
Y: 49

0

0.01

2000

4000

Power (Watts)

6000

0

0

2000

4000

Power (Watts)

6000

(a)
(b)
Fig. 3. Power Consumption (Texas, US): (a) 200 houses (b) Mixture P mix

Box-Cox Transformation: We converted P mix into an approximate Gaussian distribution using a box cox transformation technique. Box Cox transformation techniques are used
for approximating non-normal data into a normal distribution.
Hence, all power consumption data is transformed onto a

Deployment Issues of proposed Detector: The exact topology of the AMI was not revealed by any of the projects
from where the data was collected. Hence, it was infeasible todirectly study implications of topological aspects over the proposed detection mechanism. Given an AMI system (see Fig 5),
any proposed intrusion detection module can be implemented
in a decentralized or centralized manner in an AMI network asreported in [3], and micro-grid size affects the sensitivity of theattack detection. In a decentralized implementation, a detection
module is usually deployed in either FAN (field area network

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

pt1) Harmonic to Arithmetic Mean Ratios: First, all HMt
and AMt are calculated for each time slot t, over a time
window indexed by T . Each T composed of 24 time slots,
represent each day of a year, such that T ∈ {1, · · · , 365}. At
the end of each window T (one day), the average Harmonicmean to Arithmetic mean ratio denoted by Qr (T ) is given by:
P24
HMt (T )Qr (T ) = Pt=1
∀ T ∈ {1, · · · , 365} (3)24t=1 AMt (T )P24
where 0 ≤ Qr (T ) ≤ 1, since≤t=1 HMt (T )
P24
AM
(T
),
due
to
the
well
known
Pythagorean
mean
t
t=1
inequality, HMt ≤ AMt .
1.1

1.1

1

0.9

0.9

Ratio

1

0.8

0.8

Ratio: 2014

Ratio: 2015
Ratio: 2014

0.7

Ratio: 2015

0.7
0.6

0.6
100

200

300

0

100

Days

200

300

Days

(a)
(b)
Fig. 6. Legitimate HM/AM Ratio: (a) 200 meters (b) 800 meters
1.1

µr

400
350

1

Frequency

We propose the use of daily aggregate Harmonic Mean
to Arithmetic Mean Ratios as a Tier 1 metric for anomaly
detection. Using a two year long real dataset, we first establishthat our Tier 1 metric is very stable under normal conditions,
without requiring any smoothening procedure and is scalable
for different datasets. Then, we define the normal limits of the
proposed Ratio metric (termed as Safe Margins) by empiricallystudying the ratio distribution. Subsequently, we propose thesum of residual distances between the instantaneous ratio
samples and the chosen safe margin (termed as Residual
Under the Curve (RUC)) as a Tier 2 metric for the same
two years. We derive the normal limits of the RUC metric(termed as Standard Limit) from the historical data which issimplified due to the inherent stability of these metrics. The
study of normal behavior of proposed metrics, safe margins
and standard limits under no attacks is termed as the ‘system
identification’ phase. The safe margins and standard limits act
as detection thresholds. Then, we propose a two tier attack
detection scheme. The first tier checks whether the daily aggregate Harmonic Mean to Arithmetic Mean Ratios, are within
the established safe margins. Once, there is an anomalousdeviation in the first metric, the directional deviation of thesecond metric from the standard limit is used to confirm
the presence of organized data falsification or rule it out
as a legitimate change. The two tier approach is required
to increase the detection sensitivity for low attack strengths
without increasing the false alarms.

In statistical anomaly detection, identifying the normal
behavior of the detection metric under no attacks is termed
as system identification. A more stable detection metric (i.e.
invariant) under ‘normal’ conditions is often more accurate.
We denote pt = [p1t , · · · , pNt ], as the power consumption
data on the ln scale obtained from N meters at any time slott. Let p denote the steady state mixture random variable, suchthat pt is the realization of p at time t. The harmonic mean
and arithmetic mean of pt on a particular time slot t is denotedby HMt and AMt and are defined as:
PN ipN
AMt = i=1 t(2)HMt = PN 1
N
i=1 i

Ratio

V. P ROPOSED M ETHODOLOGY

A. System Identification of Invariants

0.9

Ratio

if present) or NAN (neighborhood area network) gateway,that guards different smaller micro-grid subnets within thewhole AMI network separately, while a centralized module
is deployed in the Utility WAN gateway having a global viewof a larger size of meters. Decentralized detectors have theadvantage of more relative detection sensitivity and easierlocalization of the compromised parts of the AMI. To capture
both implementation variations, we show results for both 200
and 800 houses from Texas that mimic different implementations respectively. For Irish datasets, various subsets sizes from
200 to 4000 were studied as decentralized implementation
variants (the latest edge device DCN-3000 handles atmost
1000 houses [37]). We concluded that our detection method
is best suited as a decentralized edge solution.
The technical contribution of this paper is divided into two
sections: (a) Proposed Methodology: explaining the two-tierPythagorean mean based detection scheme; (b) Theoretical
Explanation and Properties: explaining the relationships between various Pythagorean Means (Harmonic and Arithmetic
Means) that trigger deviations in the proposed metrics ‘under various attack modes’ and formalizes them as a set ofproperties/lessons. Using lessons/properties learned from such
explanation as a basis, we justify how and why the proposed
methodology is successful in detecting stealthy attacks andprovide reasoning on the invariance of the proposed metrics
over time and across datasets. Such separation of methodology
from the theory has been done to elucidate a step by step guidewhen one intends to implement our approach.

0.8

Set 1
Set 2
Set 3
Set 4
Set 5
Set 6

0.7

0.6
0

100

200

Days

-2 σr

+2 σr

300
250
200
150
100
50

300

0
0.82

0.83

0.84

0.85

0.86

Ratio Value

0.87

0.88

(a)
(b)
Fig. 7. Irish Data (5000 meters; 6 regions): (a) Ratios (b) Ratio Distribution

Figs. 6(a) and 6(b) shows the proposed ratio metric, Qr (T ),for two different meter population sizes 200 and 800 metersrespectively; for years 2014 and 2015 from Texas, without
using any moving average smoothening mechanism. This is
in sharp contrast to the arithmetic mean trends shown earlier
in Fig. (1), that fluctuates readily for the same dataset overthe same time periods. To validate the generality of thisobservation, Fig. 7(a), shows the time series of Qr (T ) for
a completely different (Irish) dataset with 5000 meters fromsix regions. Figs. 6(a), 6(b) and 7(a) indicate that Qr (T ) is a1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

Γhigh (T ) = Qr (T ) + κrΓlow (T ) = Q (T ) − κ

(4)
(5)

Larger κ values produce wider safe margins. An obvious
approach to minimize false alarms would have been to set
the κ to maximum or minimum observed values in Qr (T )distribution. Such wide safe margin would in turn increase
missed detection for stealthier attacks having lower δavg and/or
ρmal . For example, a κ = 2sr , instead of κ = 3sr , will
have more detection sensitivity but on average about 4.5%
legitimate observed ratio samples would be outside this safe
margin, which is still an unacceptable false alarm rate for goodanomaly based intrusion detectors [1]. To bypass this problem(known as base rate fallacy), we now propose another metriccalled RUC, for the second tier which preserves increased
detection sensitivity without sacrificing false alarms.
3) Sum of Residuals between Ratio and Safe Margin:
We propose another metric that maintains, at each time window T , the sum of the residuals between the ratio curve and thechosen safe margin (denoted by RU C(T )) over a sliding frameof past FS days. To calculate RU C(T ), we first calculate∇(T ) that denotes the ‘signed residual distance’ between theobserved ratio and the safe margin by:rr= Q (T ) − Γhigh (T ), if Q (T ) > Γhigh (T );r∇(T ) : = Q (T ) − Γlow (T ), if Qr (T ) < Γlow (T );= 0,otherwise;(6)
The ∇(T ) value could be positive or negative depending onwhether the instantaneous ratio sample is above the upper safe
margin Γhigh (T ), or below the lower safe margin Γlow (T ).
The ∇(T ) is zero, if the value of the ratio observed is within[Γlow (T ), Γhigh (T )]. Given this, at any window T , we propose
to keep record of the sum of the residual distances RU C(T )over a sliding frame of the past FS days, such that:TX
RU C(T ) =∇(j)(7)
j=T −F S

Our second metric, RU C(T ) for the historical dataset(2014, 2015) is shown in Fig. 8 using a sliding frame of
F S =7 days. The sign of ∇(T ) represents direction of thechange and plays a key role in attack reconstruction as shown
later. The rationale behind keeping such a signed metric is
because for legitimate changes, even when the ratio goes outof the safe margins, it oscillates between the upper and lower
safe margins, making the RU C(T ) often closer to zero.
0.01
τmax (h)

2014
2015

0.005

RUC

highly stable metric making it suitable for anomaly detection.
Thus, it is established that legitimate changes that affect themean power consumption, does not significantly affect thedaily average ratio between HM and AM .
The reasoning behind the stability observed in the ratio samples is related to the coarse grained weak positive correlationin the daily granularity time scale and we show it later in
Section VI-A with real datasets. Another reasoning behindusing this metric for attack detection is the asymmetric growthand decay rates of harmonic means compared to arithmetic
means that are derived from the exclusive Schur-Concavity
properties of harmonic means. The proof of this and resultant
attack detection properties are derived and established in detailin Section VI-B.
Finally, it can be observed that the Qr (T ) time series show
a weak cyclo-stationarity in the sense that the mean ratio issimilar during the same window T in successive years. Further
time series smoothening may reduce jitters and false alarms,
but invariably falls into the trap of incremental evolving
attacks. Instead, we take a different approach to reduce false
alarms without sacrificing missed detection using the proposed
RUC metric as discussed later.
2) Safe Margin for Ratio Metric: The distribution of all
Qr (T ) samples for meter populations of 200 and 800 respectively for the 2 years is Gaussian distributed (See Appendix
F). The mean and standard deviation of the ratio distribution
for 200 meter case is µr = 0.917 and sr = 0.0085, with
69.57% of the ratio samples within the first standard deviationfrom µr . The percentage of ratio samples within the second
and third standard deviations are 96.03% and 98.95%. The
corresponding (µr , sr ) values for 800 meter population is(0.906, 0.007), and µr ± 2sr contains 97% of the samples.
Fig. 7(b), shows the ratio distribution for the 5000 houses
irish dataset to be similar to ratio distribution of Texas data. A
comparison between Figs. 6(a) and 6(b) show that ratio metricis less stable for lower sized meter populations. Intuitively,
detecting low margin attack signature in 200 meter population
will be more difficult. Hence, we show more results for 200
meters representing the worst case.
Defining a threshold parameter, κ ∈ (0, 3sr ], we build a‘safe margin’ as an interval around the observed instantaneous
ratio samples Qr (T ), on every time window on the historical(training) datasets. Hence, the upper and lower limits of thesafe margin boundary denoted by Γhigh (T ) and Γlow (T ) are:0

-0.005
τmin (h)

-0.01
0

100

200

Days

300

Fig. 8. Standard Limits of RUC with κ = 2sr

4) Inferring Detection Thresholds for Testing Set: Fromsystem identification, we calculate a safe margin parameterizedby κ and a ‘standard limit’ (that depends on κ) acting as thethresholds of these two metrics. Since these thresholds are
obtained from historical data, we denote them by a superscript‘h’. For any time window T c in a testing set (current), let
Qr (T h ) denote the historical value of the ratio metric on thecorresponding T -th day in the previous years. Let Qr (T h ) be
calculated as a weighted average of the ratios samples on the
T -th day in the previous years. Unlike most other schemes,
the choice of weights do not affect performance drasticallysince difference between ratios in successive years is minimal
owing to their high stability. We capture both extreme choices

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

Algorithm 1 Calculate τmax (h), τmin (h)for T, τ, y do
if (RU C(T )y < τ ) then
cmax/min : |τ −RU2 C(T )|elsepmax/min = 2|RU C(T )y − τ |end ifend forτmax/min (h) = arg minτ |c − p|

it is confirmed, that there is an organized data falsification
attack.
∈ [τmin (h), τmax (h)] No Attack;
RU C(T c ) :6∈ [τmin (h), τmax (h)], Attack Inferred;(9)
An illustration of the 2016 testing set with a camouflage attack, using a data order aware attack strategy with ρmal = 40%
and δavg = 120W in Figs. 9(a) and 9(b). The blue lines (withmarkers) show the proposed metrics in the testing set underno attacks, and the dotted lines represent the safe margins.
Observe the red lines representing metrics under attacks. The
ratio signature is not evident, which demonstrates the need forthe second tier.
0.04

0.95

HonestAttacked

0.02

0.9

RUC

Ratio

of weights in our study by giving 0.99 weight to 2015 data
and 0.01 to 2014 for 200 meter case study; and we give equal
weightage to 2014 and 2015 ratios for the 800 meter casestudy. We will verify in the results that performance is not
drastically different in either choices of weights. Hence, tosummarize the safe margin for the T -th day (of an year) in
the testing set is Qr (T h ) ± κ. For instance, if κ = 2sr , thenthe upper and lower margins are Γhigh (T c ) = Qr (T h ) + 2srand Γlow (T c ) = Qr (T h ) − 2sr .
Now, we learn a normal range for the RUC values known
as ‘standard limit’ that is independent of T . Let {RU C(T )y }denote the set of the sum of residual distances observed in y-th
(training) year, as shown in Fig. 8. Now, we need to choose anappropriate τmax (h) and τmin (h) as upper and lower thresholds from {RU C(T )y | y ∈ 1, 2}. Suppose τ represents theappropriate candidate thresholds. The appropriate thresholdsτmax (h) and τmin (h) from the set of RU C(T )y is obtainedby Algorithm 1 and marked in Fig 8 that avoids over-fitting.
The cmax/min and pmax/min are the corresponding cost andpenalty functions used for the τmax (searching among all
non-zero positive RU C(T )) and τmin (searching among all
non-zero negative values in RU C(T )). Notice, the design of
RU C(T ) is such that the search space is very small, due
to very less non-zero RU C(T ) values, which reduces thecomplexity of the search problem described via Algorithm 1.

0

Actual

0.85

Safe Margin-0.02

Attacked

0.8
20

40

Days

60

80

-0.04
20

(a)
Fig. 9. Ultra Low Camouflage (a) Ratio (b) RUC

40

Days

60

80

(b)

VI. T HEORETICAL E XPLANATION AND P ROPOSEDM ETRIC P ROPERTIESIn the previous section, we just proposed the defense
methodology, but did not understand why and how it detects
data falsification. In this section, we formalize the different
mathematical and security properties we discovered, that provides this understanding. This section first derives the genericsecurity lessons/properties and then the implications of power
consumption data falsification in AMI is concluded.
A. Why is the ratio metric a stable invariant?

B. Tier One Detector
While designing the safe margin criterion, we utilized aninterval κ from the historical ratio distribution. If the observed
ratio is outside this safe margin, we declare a suspected
anomaly. Let c denote the current (testing) year (2016 in ourcase). Then, if the observed ratio sample of the current time
window Qr (T c ) is within the interval [Qr (T h ) ± κ], thenthe situation is considered normal. If not, then an anomaly
is suspected.
∈ [Qr (T h ) ± κ] No Anomaly;
Qr (T c ) :(8)6∈ [Qr (T h ) ± κ] Anomaly Suspected;
where T c is the current time window, T h is the correspondingtime window of the prior year, Qr (T h ) is the corresponding
historical ratio value in the previous years for the same window
T , and Γhigh (T c ) and Γlow (T c ) are the safe margins at T c
day of the testing set.
C. Tier Two Detector
Given that the ratio metric was off safe limits and the
RU C(T c ) is outside the normal interval [τmin (h), τmax (h)],We provide a mathematical explanation for the invarianceobserved in ratio metric across multiple data sets over various years. Most residential households in an area tend tohave certain coarse grained shared behaviors during a typical
day although individual differences exist. Therefore, power
consumption of different households are not completely independent but intuitively should possess some weak positive
correlation. Since the Qr (T ) is a daily metric, the stabilityof proposed metrics will get captured (if its proven to berelated to the correlation) although different datasets will havedifferent mean values of Qr (T ) samples. The difference indatasets only affects the mean value of the proposed Qr (T )but not its stability over time windows within that dataset (asseen in Figs 6 & 7). Now, suppose we denote the average
difference between power consumption of any two housesin the series p1 , · · · , pN over
 a time window T (a day) asi+1i
ξ(T ) = Avg. |p− p | . Since humans exhibit a sharedroutine of habits through a typical day, the average difference
between any two meters averaged over T (equaling a day)is unlikely to be arbitrarily different from each other. In otherwords, the distribution of ξ(T ) will be weakly stationary. This

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

18

400

16

350

14

300

Frequency

12
10
8

3

2.5

250
200

2

150

x2 = 2
E

a+
A

100

y

Average DifferenceξThis article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

6

1.5

a−

+

h

50
4

H
0

50

100

150

Days

200

250

300

0
-200

0

200

400

600

Power (Watts)

800

1000

(a)
(b)
Fig. 10. Irish Dataset: (a) Average Difference ξ(T ) (b) amin valuesh−y = AM (x1,x2)
y = HM (x1,x2)

0.5

0
0

claim can be verified by Fig. 10(a) showing the time series ofξ(T ) for the Irish dataset.
Now we establish an important link between the observed
invariance of ξ(T ) and Tung’s Theorem and its corollaries [18], [16] (1975). Tung’s Theorem “proposed the theoretical upper and lower bounds on the absolute difference
between Arithmetic and Geometric Mean in any series data.”
An extension of this Theorem described ‘the upper and lower
bounds on the absolute difference between Harmonic andArithmetic Mean’ in a series data [16]. The theorem states:
Given a series a ≡ {1 ≡ a1 , · · · , aN ≡ B}, where 1
and B denote the minimum and maximum values of theseries of N numbers. Let HN and AN denote the harmonic
and arithmetic means respectively. Then, the bounds on theabsolute difference between HN and AN is given by:pp(B − 1)2≤ |AN − HN | ≤ ( (B) − (1))2
N (B + 1)

1(10)

If minimum and maximum values are amin and amax
respectively, then Eqn. 10 can be rewritten as:pp(amax − amin )2≤ |AN − HN | ≤ ( (amax ) − (amin ))2
N (amax + amin )(11)
where amax ∼ amin + (N − 1)ξ. This means that the bounds
of |AN − HN | is dependent on ξ and amin only. Since, itis evident from Figs. 10(a) and 10(b), that ξ and amin areboth stable, therefore |AN − HN | should also exhibit highstability. This explains the invariance of harmonic to arithmetic
mean ratios across multiple datasets and their subsets. We
believe that this result has broader implications and not justrestricted to smart metering infrastructure. Most cyber-physicalsystems having sensory redundancy exhibit positive correlation
while sensing some physical phenomena, under appropriate
temporal and spatial granularities. When these spatio-temporal
granularity is appropriately designed, it will enable engineers
to use our metric as an invariant for anomaly detection. The
above explanation that is backed by results from real datasetsprove that our approach is an alternative to deal with thecommon difficulty of handling shifting trends in various power
consumption datasets.
B. Establishing Effect of Pythagorean Mean Properties under
Data Falsification Attacks
The strictly Schur-Concavity property of Harmonic Meanscompared to the non-strict concavity of Arithmetic means canbe exploited to derive unique security properties/lessons under
different data falsification modes that facilitate deeper understanding of changes in the proposed metrics under attacks.

0.5

1

1.5

2

2.5

3

x1

Fig. 11. Schur Concavity

Let X = {x1 , · · · , xN }, denote a data series from N
sources (such as number of meters) each indexed as i, such thatthe mean and standard deviation of X = (µ, σ). The harmonicmean HM (X) and arithmetic mean AM (X) is defined as:N
HM (X) = PN

1i=1 xiAM (X) =

PN

i=1 x

N

i

(12)

Schur Concavity is described by the following criterion:!
(x1j − x1k )

∂y
∂y
−
x1j
x1k

≤0

∀x ∈ IRd(13)

where x1j 6= x1k . It can be verified from Fig. 11 that the y-axis
represents the range of AM and HM functions for a simple
two member data series X = (x1 , 2) where x1 ∈ {0, ∞}is the x-axis representing the domain of the AM and HM
functions. Note, that while AM is both concave and convex,
HM is strictly Schur Concave. Therefore, when a subset ofxi values in X is changed (visualize x1 getting biased fromoriginal value say x1 = 1), AM growth/decay rates are linear
as well as symmetrical for additive and deductive biases. On
the other hand, due to the exclusive Schur-Concavity property
growth or decay rates in HM are asymmetric to the rate ofchange in AM. Therefore, this asymmetry causes a change inthe ratio value of the observed HM and AM.
Additionally, we found that the increase or decrease in theratio value is also dependent on the position of the datapoint(lesser or greater) being attacked w.r.t the actual mean, themargin of false data and the mode of data falsification.
Table I, summarizes the various lessons/properties we derived
for various attack types, and margins of false data, in terms of
the effects of various attacks on the proposed ratio metric, forattacked datapoints on left (L) (lesser) or right (R) (greater) of
the actual mean. These properties are generic and not specificto the dataset, but their implications on the power consumption
dataset are explained separately later.
Now, we give a short explanation of Table I: Suppose,
sub portions of a data set generated from multiple sources
experience additive and deductive manipulation by an attack
bias ǫ. The rates of growth in HM and AM that occur
under additive attacks (denoted by ‘+’) is represented by|∆HM + | and |∆AM + |. Similarly, rates of decay in HM
and AM occurring under deductive (denoted as ‘-’) andcamouflage attacks (denoted as ‘+,-’) are represented by|∆HM + |, |∆HM +,− |, and |∆AM + |, |∆AM +,− |. The L#
denotes the observation/lesson/property number, Mode represents type of falsification, Position ‘L’ and ‘R’ denotes whether

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

TABLE IE FFECT OF D IFFERENT ATTACKS ON P YTHAGOREAN M EANS G ROWTH D ECAY R ATES

Lesson #
L1
L2
L3
L4
L5
L6
L7

Mode
Additive(+)
Additive(+)
Deductive(-)
Deductive(-)
Deductive(-)
Additive(+)
Camouflage(+,-)

Position
L
L
L
R
R
R
X

Property|∆HM + | > |∆AM + ||∆HM + | < |∆AM + ||∆HM − | > |∆AM − ||∆HM − | < |∆AM − ||∆HM − | > |∆AM − ||∆HM + | < |∆AM + ||∆HM +,− | > |∆AM +,− |the position of the attacked datapoint is on the left and rightof the true mean. The necessary and sufficient conditions
for experiencing each observation is also provided in therightmost columns. ‘X’ denotes ‘do not care’ conditions. The
statement of every property and lessons are provided in detailin Appendix D. We also provide a theoretical illustration of
how Schur concavity creates these unique properties undervarious falsification attacks in Appendix D.
To conclude, the unique properties of Pythagorean Mean’s
growth decay rates is the first reason to use Harmonic to
Arithmetic Mean ratios for attack detection. The second reason
to use HM to AM ratio is its high stability under no attacks
as established in Figs. 6(a), 6(b) and 7(a). Third, the closed
forms of Harmonic Means do not exist and only coarse approximations are possible. The approximation errors increase withincreasing number of data points and number of attacked data
points, and the entire underlying time series is not very stable.
Thus, it makes it difficult if not impossible for an adversary
to exactly back calculate a strategy to beat our method with
100% success rate.
Necessary and Sufficient Conditions for Ratio Change:
Below, we write the ‘approximation expressions’ for various
necessary and sufficient conditions listed in Table I. We verify
the accuracy of these approximation experimentally in the
results section. Theoretical verification and approximation ofbounds are provided in Appendix D and E respectively.
The approximate (average case) lower bounds are:k − (rlow) = k + (llow) =σσ
klow =
+√
M
M

r

N −M
+σ
N −1

(14)

where + and − superscripts denote additive and deductive
manipulation and l and r denote whether the bias points areon the left or right of the actual mean.
The approximate upper bounds are: k + (lhigh) =k − (rhigh) =2σ
σkhigh = max(σ ,
+√
M
M
2

r

N −M
+ 2σ)
N −1

(15)

The average conditions for deductive on the left and additiveon the right side of the mean is:+

k (lhigh) = k (rhigh) = σ
−

r

N
N −1

(16)

q
In the worst case klow > {(|xi − µ| + σ NN−1 ) + µ)} − xi ,and k(high) > |xi − µ| + σ 2 . The worst case expressions canbe used for verification purposes, when the smallest datapointin the series is additive attacked, while the highest datapoint

Ratio Effect
Increases
Decreases
Decreases
Increases
Decreases
Decreases
Decreases

Necessary
ǫ < k+ (llow)
ǫ > k+ (llow)
ǫ>0ǫ < k− (rlow)
ǫ > k− (rlow)
ǫ>0X

Sufficientǫ < k+ (lhigh)ǫ > k+ (lhigh)ǫ > k− (lhigh)ǫ < k− (rhigh)ǫ > k− (rhigh)ǫ > k+ (rhigh)X

is deductive attacked. The approximation of the above bounds
are provided in Appendix E.
Implications of Lessons on Real Consumption Dataset:
Note that Table I lists ‘general’ attack signature propertiesof the ratio metric. When applied to real power consumption
datasets and attacks, these lessons have to be surmised in therelevant context. Recall, that power consumption data set has
64% of the data points on the left side (<) of the mean and
36% are on the right (>) of the mean. Hence, on average,
the probability of attacked datapoints will be more on theleft of the true mean. From Table I, we know that attacked
data-point’s authentic position relative to the true mean, affects
growth and decay rates of HM and AM. Therefore, we predictthat experimental results will confirm to L1, L3, L4, L7 given
the focus of the paper is on lower margins of false data andmost of the authentic data is on the left of the true mean.
To conclude, HM to AM ratio should increase under additive
attacks, and decrease under deductive and camouflage attacks,
if the attacker does not know the defense mechanism and themargins of false data are lower than the standard deviation. For
higher margins of false data, a decrease in proposed metrics
is predicted for all modes of attack due to L2, L5, L6.
C. Parameters for Unbiased Security Performance Evaluation
Here, we define four metrics required for fair and unbiased
security performance evaluation and analysis of our proposed
anomaly detection technique. The following also explains why
we do not use to the traditional ROC curves for evaluation.
Time to Detection: is the difference (in days) between the startof attack and the time it was detected. This metric is applicablefor non-persistent and non-optimal attacks against our detector.
Expected Time between False Alarms E(Tf a ): For evaluating
security of proposed approach against persistent attacks, thestandard ROC curves for security evaluation are a biased
measure for three reasons: (i) False alarm rates are misleading
since it depends on the time duration of study; (ii) Low
false alarms rates in ROC curves can be misleading due
to base rate fallacy elucidated by Axelsson et. al. in his
seminal paper [1] and is not ideal for intrusion detection but
component diagnostics; (iii) It is particularly difficult to get
detection rate with ROC under persistent/undetected attacks,
since the adversary never gets detected. To prevent such a bias,
a recent work [23] showed that expected time between false
alarms versus the impact of an undetected attack averaged overvarying thresholds (κ in our case) is a more unbiased measurefor performance evaluation for intrusion detection mechanisms
under persistent attacks. If the impact of undetected attack

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

Break Even Time (TBE ): Assuming a fixed average cost of$500 to compromise a meter (from reports in a real attack [29],[32]), let the total investment of attack is T C = 500 ∗ M inTCdollars. Then, TBE = RR∗365
is the time (in number of years)
for total revenue accrued to breakeven T C invested, where
RR is the revenue accrued per day for the undetected attack.
Given a particular microgrid N , we vary M to show how ourmethods prolongs TBE under persistent attacks.

90

0.01

τmax ( h )80

2016: Testing Set

No. of False Alarms

Impact (of undetected attack) per Unit Time (I): The I =RR/24 revenue damage per hour used as a measure toquantify impact of undetected attack, where RR is attack
revenue per day as defined earlier in Sec. III (Eqn. 1). We
plot E(Tf a ) versus I for security evaluation of our method.

Attack Strength. If either δavg and/or ρmal are lowered further,clear attack signatures are not obtained in the first tier, but thesecond tier reveals the attack. We term this attack class as
Ultra Low Attack Strength. For all strategies with δavg ≥ 400,
we term them as High Attack Strength.
1) False Alarm Baseline: Fig. 12(b), shows the number offalse alarms per year for various values of κ for our testing setof 800 houses (2016 data) under no attacks. It shows just one
false alarm, while using a standard limit corresponding to κ =2sr . For such an ultra-low false alarm rate (0.27%), this κ is
known as a baseline threshold where detection sensitivity is theworst. To represent the worst detection case, the attack forensic
subsection results uses the baseline κ = 2sr . The performance
evaluation subsection shows how detection is improved further
by decreasing κ from the baseline value if more false alarms
are tolerable by an utility.
0.005

RUC

does not arbitrarily increase for higher E(Tf a ), then it isa good detection metric. Hence, we used this approach forsecurity evaluation of our method rather than the P
standard
ROC
ηF A
T
curves. However, our definition of E(Tf a ) = 1 ηF ABF A is
more unbiased than the one suggested in [23] which calculatedE(Tf a ) as an average of false alarms over the total time.

0-0.005

VII. E XPERIMENTAL E VALUATION

τmin ( h )

-0.01

70
60
50
40
30
20

κ= 2s r

100

A. Attack Forensics and Signatures
While we emphasize on results with δavg < 400W , ourmethod also works for δavg > 400 as well. Within δavg < 400,
the comparatively higher (ρmal , δavg ) pairs produce a clear
signature in the first tier itself. We term this class as Low

0

100

200

0.005

300

Days

0.01

κ

0.015

(a)
(b)
Fig. 12. False Alarm Performance(a) All κ (b) N = 800 with κ = 2sr
0.04

0.95
HonestAttacked

0.02

0.9

RUC

Ratio

A real dataset for the past 3 years (2014, 2015, 2016)
was gathered from Pecan Street Project [34] for 200 and
800 houses. We used the 2014 and 2015 datasets for system
identification, while 2016 data set was used as a testing set
for evaluation. A validation data set [36] of 5000 houses
from Ireland for 2 years (2009, 2010) was also used to provegenerality, scalability, and sensitivity. We fed the real data intoa virtual AMI, and generated various attack samples over datafrom the testing set. The experimental section is organized into(A) Attack Forensic Trends (B) Performance Evaluation (C)Comparison with existing works.
Subsection (A), shows the forensic signatures for each attack strategy, modes, and stealth levels in terms of δavg , using
a fixed threshold κ = 2sr (that gives a desired baseline false
alarm rate as shown later), and a fixed fraction of compromised
nodes (40%), to prove that the properties predicted earlier
match with the results. We consider the frame length of
F S = 7 days over which the standard limit of RU C(T ) is
calculated considering a corresponding κ = 2sr . We develop
an attack reconstruction scheme that remaps the observed
forensic signature to conclude presence and mode of attack.
Subsection (B), shows our performance by parameterizing
all ρmal , δavg , κ, and N , values to report the detection limits.
We provide the bounds of (δavg , ρmal ) pairs where our scheme
fails to detect, and quantify how our approach limits theimpact of persistent attacks. We tested over multiple attack
start points and randomized identities of compromised meters
while reporting performance to avoid sampling biases.
Subsection (C), compares our work with some existing
works under a comparable threat model with the same datasets.

Attack Starts
Safe Margin-0.02

Attacked

0.8
20

0

Honest Ratio

0.85

40

Days

60

80

-0.04
20

(a)
Fig. 13. Ultra Low Deductive (a) Ratio (b) RUC

Detected

40

Days

60

80

(b)

2) Ultra Low Attack Strength: Figs. 13(a) and 13(b) exhibit the signatures of the ratio and RUC metric, under adeductive and data order aware attack with ρmal = 40%, andmargins as low as δavg = 50W . The attack starts from the 41st
day which is depicted by a bold black dotted line. As predicted,
Fig. 13(a) shows a gradual decrease in the ratio, compared tothe original testing set’s ratio from the attack start point. But
owing to the low δavg , the deviation in the ratio signature
is not enough to confirm the attack as it closely follows the
expected ratio trend. However, the corresponding RUC plot in
Fig. 13(b) for the same scenario, reveals the confirmation ofpresence of an attack within 10 days from the start. Lack ofclear signature in the first tier ratio confirms an attack of ultra
low strength. In Fig. 13(b), the RU C(T c ) on the 50-th day
goes below the lower standard limit and is of negative sign,
which rules out the options such as additive and one sided
deductive and camouflage. Checking the directional change inthe moving average of HM and AM from the 42nd day willshow a gradual decrease in both the means. This confirms aultra low strength deductive attack. We can see that even a
margin of false data as low as 50W gets detected.
Figs. 14(a) and 14(b), exhibit the corresponding signatures
for an additive attack with ρmal = 40% and δavg = 80 with adata order aware strategy. The ratio signature follows lesson

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

Attacked

0.84
20

40

Days

0

60

80

30

40

50

60

70

80

Days

(a)
Fig. 14. Ultra Low Additive (a) Ratio (b) RUC(b)(L1) and slightly increases, on account of being additive andthe δavg being much lower than klow = 458 (calculated by
Eqn. 14) for this attack strength pair. But due to ultra low
attack strength, the first tier is not enough to confirm an attack
as seen in Fig. 14(a). However, Fig. 14(b), shows that second
tier is able to detect the attack within 6 days.
The corresponding results for camouflage attacks had already been shown earlier in Figs. 9(a) and 9(b). Note that thesignature for camouflage were more bursty due to the additiveand deductive bias components. Note that the detection took
about 5 days, which is earlier than additive owing to the higher
δavg of 125W . This is to show that time to confirmation of
attack is dependent upon the δavg value as well.
3) Low Attack Strength: Fig. 15(a), shows signatures under
additive attacks with ρmal = 40% and δavg = 200. The
δavg is less than most existing works, but the ratio metricshows a clear indication of an attack. Figs. 15(b), shows the
scenario for deductive and camouflage attack for the same
ρmal , δavg for a duration 42nd to 65th day. To show anadditional perspective, the non data order aware result is also
shown in Fig. 15(b), that proves the relative ease of detection
for non-data order aware attacks.

Ratio

Ratio

0.9
0.85
0.8

HonestAttacked

0.85

0.75

Safe Margin

20

40

Days

60

0.7
20

80

0
0.84

-0.01

0.82

0.8

0.78

0.76

Attack Started

Previous Year
This Year (No Attack)ThresholdThis Year (Deductive)

20

40

-0.03

60

80

120

140

-0.04

Deductive Attacked
No Attack

0

50

Days

100

150

(a)
(b)
Fig. 17. Irish DataSet: Deductive: (a) Ratio (b) RUC
0.9

0.025
0.88

0.02

0.86

Additive Attack
No Attack

0.015

0.84
0.82
0.8

No AttackSafe Margin
Additive Attack

0.78
0.76
100

0.01

Attack Started

0.005

Attack Started

150

200

250

0
-0.005

300

-0.01
100

150

200

250

300

Days

Days

(a)
(b)
Fig. 18. Irish DataSet: Additive: (a) Ratio (b) RUC

Qr (T h )Threshold
Deductive-DoA
Deductive
Camouflage

0.95
0.9

30

40

50

60

Days

70

0.85
0.8
0.75
0.7
20

Safe Margin
No Attack
Additive
Deductive
Camouflage

40

Days

60

80

0.92

0.94

Fig. 19. High Attack Strengths: ∆avg = 800

Ratio

Ratio

0.9

0.92

0.88

r

h

Q (T )

0.88

dq + = 2W
Safe Margin

0.86
40

Days

60

TABLE IIC ONCLUDING S ECURITY S TATE

Qr (T h )

0.86

0.9

20

100

Days

(a)
(b)
Fig. 15. Low attack strength (a) Additive (b) All Mixed
0.96

Attack Started-0.026) Validation with High Attack Strengths: Fig. 19, is an
exhibit which proves that our proposed model works forhigher attack strengths as well. In the following result theρmal = 40% and δavg = 800.

0.95

0.95

0.9

0.86

RUC

0.01

Safe Margin

0.86

RUC

0.02

Honest

0.88

Ratio

0.03

0.9

the Irish Dataset. The irish dataset did not have two fullyear’s data. Hence, we used safe margins widths from Texas
dataset onto the ratio metric of irish dataset (since variancein ratio samples were similar). Figs. 17(a) and 17(b), show
unique signatures for the Irish data set for deductive attacks(ρmal = 10%, δavg = 70W ) and Figs. 18(a) and 18(b) show
the same for additive attacks (ρmal = 20%, δavg = 100W ),that are consistent with the observations from the Texas data
set. This shows that the proposed metrics and inferred baseline
thresholds obtained from Texas Data for the RUC generalizes
well for the Irish Data set. Higher ρmal in this dataset get
more easily detected hence lower ρmal is shown. From ourexperience, the irish dataset showed more attack sensitivity.

Ratio

0.92

No AttackAttacked

Ratio

0.04

RUC

0.05

0.94

Ratio

0.96

dq (+/-) = 2W

0.84

Safe Margin

0.82
0.8
20

40

Days

60

(a)
(b)
Fig. 16. Incremental Evolving Attack: (a) Additive (b) Camouflage4) Incremental Evolving Attacks: Figs. 16(a) and 16(b),show the tier one signature with incremental evolving attacks
with 2 watts increment on every time slot upto δavg = 200W .
If we used a residual check at every time step, this strategy
would not be captured easily due to readjusting.
5) Validation with Irish Data Set: To show that our signatures reported are consistent across other data sets, wedemonstrate the deductive and additive attack signatures for

Ratio
Up
Down
Down
Down
X

Limit
OutsideOutsideOutsideOutsideInsideSign
Positive
Negative
Negative
Negative
X

HM,AM
Up, UpUp, UpDown, Down
Down, Same
X, X

Conclusion
Additive, S
Additive, N
Deductive, X
Camouflage, X
No Attack, X7) Attack Scene Reconstruction: Observing features fromthe signatures help us conclude the mode of falsification, typeof strategy employed, estimated start time of attack, time of
stoppage of attack (if any). The features are: (i) Direction(going up (increasing),down (decreasing) or same) of the ratio,
harmonic, and arithmetic mean (ii) Limits (outside or inside)of the RUC bound. (iii) Sign of RUC (positive or negative). For
example, RU C(T ) is positive and outside the τmax (h), and1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

the observed AM and HM has shown an increase, a stealthy
additive attack is confirmed. But if ratio and RU C(T ) is
negative but observed HM and AM increases, then it is anadditive attack with larger margins (δavg < klow ). Intuitively,
the rest of the conclusions can be made. S,N,X in the Table IIdenotes Stealthy, Non-Stealthy, and Don’t care.
B. Performance Limits and Security Evaluation
For different candidate thresholds of κ, we show how ourapproach restricts the impact of optimal persistent attack for agiven AMI network. Second, we study detection limits for different combinations of (ρmal , δavg ) at (known as breakdown
point) for a given AMI network that just escapes detection. We
show the adversary’s breakeven time TBE at these breakdown
points is very high. Finally, we show detection sensitivity todifferent δavg with changing microgrid sizes for a given attack
budget M and a desired false alarm rate.
Limiting Impact of Persistent Attacks: Figs. 20(a) and 20(b),depict the limiting impact of undetected attacks if the attacker
knew the threshold and detection method and remained undetected with an attack that just escapes detection. The Y-axis,
denotes the impact per unit hour (I) by the adversary, while
the X-axis denotes the expected time between false alarms.
The largest point in X-axis correspond to the E(Tf a ) values
obtained for thresholds (’standard limit’) corresponding to thebaseline safe margin κ = 2sr . As we reduce κ from thisbaseline, the expected time between two false alarms decreases
due to increasing false alarms. To show this, we decrease the κwith a step-size of 0.02 and get a unique value of E(Tf a ) and
I for every possible κ value for both additive and deductive
attacks. Figs. 20(a) and 20(b) (for deductive and additive
attacks), clearly show that as the average time between two
false alarms increases, the impact of undetected attack does notincrease significantly. At E(Tf a ) = 134, the impact is limited
to $0.58 for deductive attacks, and $0.62 dollars for additive
attacks, even when 40% of the meters had been compromised.
Similarly different lines in Figs. 20(a) and 20(b) correspondto E(Tf a ) vs I various ρmal .
1.2ρmal = 30%
ρmal = 40%
ρmal = 50%

0.8ρmal = 60%

0.6
0.4
0.2
0

20

40

ρmal = 10%
ρmal = 20%

ρmal = 20%

Impact Per Unit Time ($)

Impact Per Unit Time ($)ρmal = 10%

1

60

80

E(T fa )

100

120

1

ρmal = 30%
ρmal = 40%

0.8ρmal = 50%
ρmal = 60%

0.6

TABLE IIIB REAKDOWN P OINTS
ρmal
10
20
30
40
50
60
70

δavg
120
95
80
65
60
70
70

RR
6.9
10.9
14.6
14.9
17.2
24.1
28.2

TBE
3.9
5.0
5.5
7.3
7.9
6.7
6.7

ρmal
10
20
30
40
50
60
70

δavg
130
100
85
80
80
85
90

RR
7.4
11.5
14.6
18.4
23.0
29.3
36.2

TBE
3.6
4.7
5.5
5.9
5.9
5.5
5.2

Scalability of N versus Sensitivity to δavg : Fig. 21, shows a
3D view of sensitivity to different margins of false data under
deductive attacks, (y-axis) for various deployments of microgrid sizes N (x-axis), if the adversary has a given M for the
Irish dataset. The κ threshold required for getting one false
alarm per year changes for various values of N as shownon the z-axis. The results show that the worst case where
only 100 out 4000 meters (ρmal = 2.5%) are compromised,
the detection sensitivity limit is at δavg = 150W . At theother extreme, when 300 out 400 meters (ρmal = 75%) arecompromised, we detect the attack at 50W . Both 150W and
50W are much lower than 400W which the existing works
assume. Hence, it is a good decentralized solution for intrusion
detection since microgrid sizes usually range from 100-2000.

0.4

150
140

0.2

ρ

120
20

40

60

80

E(T fa )

100

(a)
(b)
Fig. 20. Limiting Impact of Persistent Attacks: (a) Deductive (b) Additive

Breakdown Points and Breakeven Time: For every value ofρmal , there is a corresponding δavg value on (or below) which
our detection method starts to fail. We call this (ρmal , δavg )pair as a breakdown point. Given a particular ρmal , and fullknowledge of the defense mechanism, the attacker can use
this corresponding δavg to cause maximum damage whileremaining undetected. The impact of such a strategy is studied
to quantify the time extent to which our method forces theadversary to breakeven its total cost.

mal(M)= 100ρmal (M)= 300

100

120

δ avg

1.2

From Table III(a) (left table), we observe that breakdowns
occur at a comparatively larger δavg for smaller ρmal and viceversa. However, owing to small ρmal , the impact (RR per day)is also the least. The attacker can increase the ρmal (say 70%)
and increase its daily revenue. However, at $500 as investment
per meter (from [29], [32]), it will take 6.79 years to recover
the money invested, because our method catches any δavg as
low as 70W or above on average. A high TBE depicts a levelof discouragement for adversary to continue an undetectedattack that takes 6 years to breakeven since it is forced toattack at very small δavg values to ensure evasion. Table III(a),provides a comprehensive list of the breakdown points andtheir TBE for deductive attacks. Similarly, the detection limits
for additive attacks is shown in Table III(b). Note that allthese values are for thresholds that yielded one false alarmin a year. A slight increase in tolerable false alarm rate willfurther reduce the undetectable strategy space. Note that thelargest δavg in the tables (120W ) for any ρmal is about fourtimes less than breakdown points in existing works [2], [8]which fail to provide any detection when δavg < 400 using
the same datasets.

80
60
40
20

0
0.02
0.01

κ

0

0

2000

1000

3000

4000

N

Fig. 21. Scalability and Sensitivity Performance: Irish Dataset

Discussion on some Special Cases: For additive attacks, weknow that the ratio metric increases for lower attack strengths
but decreases for higher attack strengths mainly due to rightskewness of the AMI data. Naturally, an intermediate range

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing

in δavg values exists where ratio will cease to increase andthe start to decrease for additive attacks. We term this asa cross over point. The attacker may be tempted to target
this as a potential strategy too by launching a strategy whereδavg ∼ klow thinking that the ratio will stay same. However,
we show that it is only possible to delay detection but notpossible to avoid detection for all practical purposes. Plugging
in the scenario of ρmal = 40%, N = 200, σ(2016) = 417
in the Eqn 14, we calculate the necessary condition boundklow = 458W. We attacked with δavg = 450 and δavg = 490
with several randomized combinations of ρmal and plotted
the worst case among all experimental rounds in Figs. 22(a)and 22(b). Fig. 22(b), shows that attack is detected within 45
days and 12 days after attack launch respectively. The averagetime to detection for these δavg over all experimental rounds
was ‘much lower’ at 21 days. We conclude that for additive
attacks it might be possible to delay but not escape detection
by back calculating klow and khigh , due the highly irregularsafe margin, non-existence Harmonic mean’s closed form.
0.04

0.96
0.94

RUC

Ratio

0.92
0.9
No AttackSafe Margin
δavg = 450W

0.88
0.86

40

60

No Attackδ avg = 450W

0.02

δ avg = 490W
Detected

0.01
0
-0.01
Detectedδavg = 490W

-0.02

0.84
20

0.03

80

10

Days

20

30

40

50

60

70

80

Days

(a)
(b)
Fig. 22. Worst Case δavg ∼ klow : (a) Ratio (b) RUC
105

1
0.8
CUSUM Value

True Positive rate

8

0.6
0.4

6

0.2
0

0.1

0.2

0.3

True Negative rate

0.4

4800

VIII. C ONCLUSIONS AND F UTURE W ORK
In this work, we showed that various falsification modes
such as deductive, camouflage and additive attacks launchedby organized or persistent adversaries with stealthy strategies
and ultra low attack strengths can be detected (or impacts
limited) in real time in a light weight and non privacy
intrusive manner, while having ultra-low false alarms. We
show that even if the attacker knows the mechanism andthe thresholds and stays undetected, the method inherently
forces the adversary to attack with strategies that limit the
impact of undetected attacks, making such strategies lessattractive to the adversary. In future, we will study on-off anddata omission attacks which will require a little modificationof the tier 2 detection level. We will propose a method
for identifying the meters that are injecting false power
consumption data that will be guided by the knowledge
gained from this paper, such as mode of attack, stealth level,
strategy used. Since the security properties are generic, thebroader impact of the methodology and security properties
for data falsification will be laid out.

SH no attack
SL no attack
attack4

2

00

power consumption owing to its large variations. Therefore,
the safe margin ends up being really wide due to the large
variance in the CUSUM samples caused by drifts in mean
consumption trends. Also this trends are inconsistent acrossyears which rules a historical safe margin based approach.
Therefore, CUSUM misses stealthier attacks altogether (asseen in Fig. 23(b)), although the false alarm is not poor.
More insights and supporting results are provided in the
Supplementary Results. The ROC curves of CUSUM will be
absurd therefore and hence not included.

4900

5000

(a)

5100

5200

5300

5400

5500

Time slot(b)Fig. 23. Comparison: (a) EWMA (b) CUSUM

C. Comparison with Existing Approaches:
Now we compare our work with variations of EWMA andCUSUM techniques as discussed in the Section II.
Comparison with EWMA: The EMWA fails regardless the
choice of weights and variation in thresholds of the safe
margin. The average performance of an EWMA based metricis typically performed through ROC curves. The ROC for
EWMA based approach under the given threat model is shownin Fig. 23(a). It clearly shows that as false alarm rates increase
to up-to 25%-30%, the detection rate does not increase above
50%, for most stealthier (ρmal , δavg ) pairs. For instance, anattack of ρmal = 50% and δavg = 200 is not detected by
EWMA at a threshold which ‘gives an expected time between
two false alarms of 13 days’. We detect this attack with athreshold (safe margin) that gives an expected time between
two false alarms of 134 days.
Comparison with CUSUM: The Sh and Sl correspond to
two CUSUM metrics that monitor increasing and decreasing
trends in a process variable. We concluded that this notapplicable under stealthy attacks for a process such as electric

Acknowledgements The authors would like to thank and acknowledge Mr. Aditya Thakur and Mr. Praveen Madhavarapu
for assistance with the experiments. A major portion of thework was completed at Missouri University of Science andTechnology, where Dr. Shameek Bhattacharjee was a postdoctoral research fellow during 2015-2018. The work has been
supported by the following NSF grants: CNS-1818942, CNS1545037, CNS-1545050, and DGE-1433659.
R EFERENCES[1] S. Axelsson, “The Base-rate Fallacy and the Difficulty of Intrusion Detection”,
ACM Trans. Inf. Syst. Secur., Vol. 3(3), pp. 186-2015, Aug. 2000.
[2] S. Bhattacharjee, A. Thakur, S. Silvestri, S.K. Das, “Statistical Security Incident
Forensics against Data Falsification in Smart Grid Advanced Metering Infrastructure”, ACM CODASPY, pp. 35-45, 2017.
[3] A. Cardenas, R. Berthier, R. Bobba, J. Huh, J. Jetcheva, D. Grochocki, and
W. Sanders, “A Framework for Evaluating Intrusion Detection Architectures inAdvanced Metering Infrastructures”, IEEE Trans. On Smart Grid, Vol. 5(2), pp.
906-915, Mar. 2014.
[4] T. Chan, G.Golub, R. LeVeque “Algorithms for Computing the Sample Variance:
Analysis and Recommendations”, The American Statistician, Vol. 37(3), pp. 242247, 1983.
[5] S.-C. Huang, Y.-L. Lo, and C.-N. Lu, “Non-technical loss detection using state
estimation and analysis of variance”, IEEE Trans. on Power Systems, 28(3):29592966, Aug. 2013.
[6] R. Jiang , R. Lu, Y. Wang, J. Luo, C. Shen, and X. Shen, “Energy-Theft detection
issues for advanced metering infrastructure in smart grids”, Tsinghua Science andTechnology, 19(2):105-120, April 2014.
[7] A, Jindal, A. Dua, K. Kaur, M. Singh, N. Kumar, and S. Mishra, “Decision Treeand SVM-Based Data Analytics for Theft Detection in Smart Grid” IEEE Trans.
on Industrial Informatics, Vol. 12(3), June 2016.
[8] P. Jokar, N. Arianpoo, and V. Leung, “Electricity theft detection in AMI using
customers’ consumption patterns”, IEEE Trans. on Smart Grid, 7(1):216-226, Jan.
2016.

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication. Citation information: DOI 10.1109/TDSC.2018.2889729, IEEE
Transactions on Dependable and Secure Computing[9] T. Koppel, “Lights Out: A Cyberattack, A Nation Unprepared, Surviving theAftermath”, Crown Publishers, New York, 2015.
[10] C.-H. Lo and N. Ansari, “CONSUMER: A novel hybrid intrusion detection systemfor distribution networks in smart grid”, IEEE Trans. on Emerging Topics in
Computing, 1(1):33-44, 2013.
[11] R. Lu, X. Liang, X. Li, X. Lin, and X. Shen, “EPPA: An efficient and privacypreserving aggregation scheme for secure smart grid communications,” IEEE
Trans. on Parallel and Distributed Systems 23(9):1621-1631, Sept. 2012.
[12] S. McLaughlin, D. Podkuiko, and P. McDaniel, “Energy theft in the advanced
metering infrastructure”, Proc. of Critical Information Infrastructures Security,
Springer-Verlag, pp. 176-187, Sept. 2009.
[13] S. McLaughlin, B. Holbert, S. Zonouz, and R. Berthier, “AMIDS: A multi-sensor
energy theft detection framework for advanced metering infrastructures”, IEEE
SmartGridComm, pp. 354-359, Nov. 2012.
[14] J. Nagi, K. Yap, S. Tiong, S. Ahmed, M. Mohamad, “Nontechnical Loss Detection
for Metered Customers in Power Utility Using Support Vector Machines”, IEEE
Trans. On Power Delivery, Vol. 25(2), pp. 1162-1172, 2010.
[15] D. Mashima and A. A Cardenas, “Evaluating electricity theft detectors in smart grid
networks”, Springer Intl. Workshop on Recent Advances in Intrusion Detection,
pp. 210-229, Sept. 2012.
[16] B. Meyer, “Some Inequalities for Elementary Mean Values”, AMS Mathematics ofComputation, Vol. 42, No. 165, pp. 193-194, 1984.
[17] M. Tariq and H. V. Poor, “Electricity Theft Detection and Localization in Grid-tied
Microgrids”, IEEE Transactions on Smart Grid, Vol. no. 99, 2016.
[18] S. H. Tung, “On Lower and Upper Bounds of the Difference Between theArithmetic and the Geometric Mean”, AMS Mathematics of Computation, Vol.
29, No. 131, pp. 834-836, 1975.
[19] R. Mohassel, A. Fung, F. Mohammadi, and K. Raahemifar, “A survey on advanced
metering infrastructure”, Elsevier Journal of Electrical Power & Energy Systems,
63:473-484, Dec. 2014.
[20] A. Rad and A.L. Garcia, “Distributed internet-based load altering attacks against
smart power grids”, IEEE Trans. on Smart Grids, 2(4):667-674, Dec. 2011.
[21] R. Sevlian and R. Rajagopal, “Value of aggregation in smart grids”, IEEE
SmartGridComm, pp. 714-719, Oct. 2013.
[22] Y.L. Sun, W. Yu, Z. Han, K.J. Ray Liu, “Information Theoretic Framework of
Trust Model and Evaluation for Ad Hoc Networks”,IEEE Journal on Sel. Areasin Communications, 24(2):305-317, Feb. 2006.
[23] D. Urbina, J. Giraldo, A. Cardenas, N. Tippenhauer, J. Valente, M. Faisal, J. Ruths,
R. Candell and H. Sandberg, “Limiting the Impact of Stealthy Attacks on Industrial
Control Systems”, ACM CCS, pp. 1092-1105, 2016.
[24] W. Wang and Z. Lu, “Cyber security in smart grid: Survey and challenges”,
Computer Networks, 57(5):1344-1371, Apr. 2013.
[25] E. Werley, S. Angelos, O. Saavedra, O. Cortes, and A. Souza, “Detection andidentification of abnormalities in customer consumptions in power distribution
systems”, IEEE Trans. on Power Delivery, 26(4):2436-2442, Oct. 2011.
[26] J. Xia and Y. Wang, “Secure key distribution for the smart grid”, IEEE Trans. on
Smart Grid, 3(3):1437-1443, Sept. 2012.
[27] W. Yu, D. Griffith, L. Ge, S. Bhattarai and N. Golmie, “An integrated detection
system against false data injection attacks in the Smart Grid, Security and Commun.
Networks, 8(2):91-109, Jan. 2015.
[28] [Online] (2017, Mar) Telegraph News, Available:
http://www.telegraph.co.uk/news/2017/03/06/smart-energy-meters-givingreadings-seven-times-high-study-finds/[29] [Online] (2012, Apr) Krebs on Security, Available:
http://krebsonsecurity.com/2012/04/fbi-smart-meter-hacks-likely-to-spread/[30] [Online] (2017, Jun) EPRI Product Abstract, Available:
https://www.epri.com/#/pages/product/000000000001026553/[31] [Online] (2009, Dec) NY Times, Available:
http://www.nytimes.com/2009/12/14/us/14meters.html?ref=energyenvironment& r=0[32] [Online] (2013, Feb) Maxim Integrated, Available:
https://www.maximintegrated.com/content/dam/files/design/technicaldocuments/white-papers/smart-grid-security-recent-history-demonstrates.pdf[33] [Online] (2010, July) Our Energy Policy, Available:
https://www.smartgrid.gov/files/The Smart Grid Promise DemandSide
Management 201003.pdf[34] [Online] (2018, Dec) Pecan Street Project, Available:
https://www.pecanstreet.org/[35] [Online] (2008, Dec) Energy.Gov, Available:
http://energy.gov/sites/prod/files/oeprod/DocumentsandMedia/14AMI System Security Requirements updated.pdf[36] [Online] (2018, Dec) Irish Social Science Data Archives, Available:
http://www.ucd.ie/issda/data/[37] [Online] (2014, Dec) Echelon, Available:
http://www.echelon.com/assets/blt21a75c85e69387d5/DCN-3000-SeriesDistributed-Control-Node-datasheet.pdf

Shameek Bhattacharjee is an Assistant Professor
at the Department of Computer Science at WesternMichigan University, USA. He received his Ph.D.
and M.S. from the University of Central Florida,
Orlando in 2015 and 2011 respectively and his
B.Tech from West Bengal University of Technology,
India, 2009. Between 2015-2018, he worked as a
post-doctoral researcher at the Center for Researchin Wireless Mobility and Networking (CReWMaN)at Univ. of Missouri S & T at Rolla, MO, USA,
where he is also affiliated as an Adjunct Faculty.
His current research interests include information security in cyber-physicalsystems, wireless and social networks, particularly in topics such as anomaly
detection, trust models, secure crowd-sensing, dependable decision theory.
Sajal K. Das is a professor of Computer Science andthe Daniel St. Clair Endowed Chair at the Missouri
University of Science and Technology, where he
was the Chair of Computer Science Department
during 2013-2017. His research interests include
cyber-physical security and trustworthiness, wireless sensor networks, mobile and pervasive computing, crowdsensing, cyber-physical systems and IoTs,
smart environments (e.g., smart city, smart grid andsmart health care), cloud computing, biological andsocial networks, and applied graph theory and gametheory. He has published extensively in these areas with over 700 research
articles in high quality journals and refereed conference proceedings. Dr.
Das holds 5 US patents and coauthored 4 books Smart Environments:
Technology, Protocols, and Applications (John Wiley, 2005), Handbook on
Securing Cyber-Physical Critical Infrastructure: Foundations and Challenges(Morgan Kauffman, 2012), Mobile Agents in Distributed Computing and
Networking (Wiley, 2012), and Principles of Cyber-Physical Systems: An
Interdisciplinary Approach (Cambridge University Press, 2018). His h-index
is 83 with more than 28,000 citations according to Google Scholar. He isa recipient of 10 Best Paper Awards at prestigious conferences like ACM
MobiCom and IEEE PerCom, and numerous awards for teaching, mentoring
and research including the IEEE Computer Societys Technical Achievement
Award for pioneering contributions to sensor networks and mobile computing,and University of Missouri System Presidents Award for Sustained Career
Excellence. He serves as the founding Editor-in-Chief of Elseviers Pervasiveand Mobile Computing Journal, and as Associate Editor of several journals
including the IEEE Transactions on Dependable and Secure Computing,IEEE Transactions on Mobile Computing, and ACM Transactions on Sensor
Networks. Dr. Das is an IEEE Fellow.

1545-5971 (c) 2018 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

Appendix for:
Detection and Forensics against Stealthy Data
Falsification in Smart Metering Infrastructure
Shameek Bhattacharjee and Sajal Das

0.015

0.03

October 2015
December 2015

Probability

0.025

October 2014

0.02

0.015
0.01

0.005
0

2

4
6
Power (ln(P))

8

(a)
(b)
Fig. 1. Texas Data (a) pmix for different months (b) The Q-Q Plot

II. A PPENDIX B: I MPACT OF L OWER M ARGINS OF FALSE
DATAConsider AMI micro-grid of N = 200 smart meters,
M = 80 implying ρmal = 0.4 or 40%. This scenario
is totally realistic for a powerful and organized adversary
deploying a decentralized detector. The actual aggregate power
consumption distribution has a mean and a standard deviationof µA = 1200 units and σA = 400 units, respectively. We
studied from the real data sets that the average difference
between the EWMA and the instantaneous mean is about
115W . The average upper and lower bounds are 130 and100. If the amount of additive error to be introduced in
the final mean is say Λ = 130 units, the δavg for eachmalicious node is given by δavg = Λ∗N
M = 325W . This is an
illustration that attacks with lower δavg will be rarely detected
if measures of EWMA and ARMA of the mean consumption
is used. However, their impact at the same time is quite large.
Additionally, CUSUM of the mean does not work due higherror residual due to the unstable mean power consumption.
III. A PPENDIX C: U NIFORM VS N ORMALLY D ISTRIBUTEDFALSE DATA
Figs. 2(a) and 2(b) show the difference between a normally
distributed δavg versus a uniformly distributed δavg . Note thatthe change in the shape of the distribution is obvious in thefirst case, while for the uniformly distributed false data, there
is no obvious change in the shape of the distribution. Hence,the second one might be a more stealthier choice for attack
implementation.

Additive Data

0.01

Probability

Probability

I. A PPENDIX A: DATA D ISTRIBUTION C HARACTERISTICS
Fig. 1(a), shows the sample mixture distributions on atransformed ln scale for different months. Note that theshape parameter remains similar but the location and scaleparameters of pmix keep changing. The extent of normalityof the whole transformed power consumption data on the ln
scale is shown in Fig. 1(b).

0.03
0.025
0.02

0.015

0.005

0.01

0.005
0

4

6

Power (ln (P))

8

10

0

2

4

6

Power (ln (P))

8

(a)
(b)
Fig. 2. Attack Distributions (a) Obvious Attack (b) Smarter Attack

IV. A PPENDIX D: U NDERSTANDING S ECURITY
P ROPERTIES AND S IGNATURES
We have identified the following security properties in termsof effects that various attack modes have over the Pythagoreanmeans and consequently, the proposed metrics:
When sub-portions of a data set generated from multiple
sources experience additive and deductive manipulation by abias ǫ respectively, the growth and decay rates of HM areasymmetric when compared to the growth and decay of AM .
Owing to this, the ratio of the biased HM and AM must differ
compared to non-biased ones.
Property 1: Numbers on the left side of the true mean, whenchanged with additive bias of ǫ, the HM growth rate is fasterthan the corresponding AM growth rate, under the necessary
condition that ǫ < k + (llow), and the sufficient condition that
ǫ < k + lhigh.
Lesson 1: Owing to property 1, the ratio of the biased HM
and AM increases than the ratio of original data, (i.e., Q+ (l) >Q), if the ǫ < k + (llow) holds.
Property 2: Numbers on the left side of the true mean,
when changed with additive bias of ǫ, the HM growth rateis slower than the corresponding AM growth rate, under the+necessary condition that ǫ > kllow
and sufficient condition+
ǫ > k (lhigh).
Lesson 2: Owing to property 2, the ratio of the biased HM
and AM decreases than the ratio of the original data, (i.e.
Q+ (l) < Q), if the ǫ > k + (lhigh), holds.
Property 3: Numbers on the left side of the true mean, whenchanged with deductive bias ǫ, the HM decay rate is faster thanthe corresponding AM decay rate, for the necessary condition
ǫ > 0, and sufficient condition of ǫ > k − (lhigh).
Lesson 3: Owing to property 3, the ratio of the biased HM
and AM denoted by Q− (l) is lesser than the original datum
ratio Q for the sufficient condition that ǫ > k − (lhigh).
Property 4: Numbers on the right side of the true mean,
when changed with deductive bias ǫ, the AM decay rateis faster than the corresponding HM decay rate rate, under

3.5
(a’)+

3

(a’)−

2.5

(h’)−

A’

H’

(h’)+

x2 = 2

2

E

a+

y

the necessary condition that ǫ < k − (rlow) and sufficientcondition ǫ < k − (rhigh).
Lesson 4: Owing to property 4, the ratio of the biased HM
and AM denoted by Q− (r) is greater than the original ratio
Q, provided the ǫ < k − (rlow) holds.
Property 5: Numbers on the right side of the true mean,
when changed with deductive bias ǫ, the HM decay rate isfaster than the corresponding AM decay rate, under the necessary condition that ǫ > k − (rlow) and sufficient condition
ǫ > k − (rhigh).
Lesson 5: Owing to Property 5, the biased ratio Q− (r) islesser than the original datum ratio Q, if the corresponding
conditions hold.
Property 6: Numbers on the right side of the true mean,
when changed with additive bias ǫ, the HM growth rate isslower than the corresponding AM growth rate, for necessary
condition that ǫ > 0 and sufficient condition is ǫ > k + (rhigh).
Lesson 6: Owing to property 6, the ratio of the biased HM
and AM denoted by Q+ (r) is lesser than the original datum+
ratio
q Q under the sufficient condition of ǫ > k (rhigh) =σ NN−1 .
Property 7: The corresponding rates of growth and decay in
the HM triggered by the additive and deductive biases of thesame bias margin ǫ are unequal. The HM decays at a greaterrate than it grows for the same ǫ. In contrast, the AM shows
equal growth and decay rates for additive and deductive biases
with same ǫ.
Lesson 7: Owing to property 7, the ratio of the biased HM
and AM denoted by Q+,− (l) is lesser than the original datum
ratio Q, since HM is effectively reduced, given the original
data point being biased are on the same side of the true
mean. This property helps in detecting camouflage attacks as
explained later.
Illustration of Properties: Let us illustrate the properties
using two numbers X = (x1 , x2 ). Let the standard deviationof X be σ. In Fig. 3, the x axis represents a variable say
x1 . Let us fix another variable x2 = 2, such that the actual
ordered data set is X = (x1 , 2). The y-axis represents thevalue of AM (x1 , x2 ) or HM (x1 , x2 ).
Hence, the AM function of (x1j , 2)∀j = {0, ∞} is represented by the solid blue line showing linear growth with x1 ,and is neither strictly concave or convex. On the other HM
function of (x1j , 2)∀j = {0, ∞} is represented by a dashed
red line is a strictly Schur Concave Function.
For original data set X, the AM = 1.5 and HM = 1.33
represented by points A and H in Fig. 3. Hence, their ratio
Q = HM
AM = 0.88. Now let us change one data point x1 ,(which qualifies as a subset), with addition of a small amountof bias ǫ = 0.3, mimicing an additive attack on numbers on
the left side of the true mean.
Let us now compare the resultant growth rates of HM and
AM in the biased data X + = (1 + 0.3, 2). The biased HM andAM are represented by points h+ = 1.57 and a+ = 1.65. The
additive growth of HM is denoted by ∆HM + = h+ − H =0.23. The growth of AM is denoted by ∆AM + = a+ − A =0.15. Thus, ∆HM + > ∆AM + . Therefore growth rates ofHM and AM are asymmetric and the numbers on the left ofthe mean with additive bias induces a faster rate of HM growth

a−

1.5

A
h+
H

1

h−

y = AM (x1,x2)
y = HM (x1,x2)

0.5
0
0

0.5

1

1.5

2

2.5

3

3.5

4

4.5

x1

Fig. 3. Pythagorean Asymptotes

than the corresponding AM growth. This illustrates Property
1 and Property 2.
Furthermore, using Eqns. 14 and 15 (approximate averagecase bounds in the manuscript), we calculate k + (llow) = 2.12
and k + (lhigh) = 3.535. Note that, ǫ = 0.3 < k + (llow), thebiased ratio of HM and AM Q+ = 0.95 increases comparedto the original Q = 0.888. Hence Lesson 1 is proven. If weconsider an ǫ = 3.359 > k + (lhigh). In such a case, X + =(1 + 3.359, 2), and Q+ = 0.86282147031 < 0.888. Hence,
Lesson 2 is proven.
Similarly, suppose x1 is biased with deduction of the same
bias ǫ = 0.3, such that X − = (0.7, 2). Points a− = 1.35 andh− = 1.037 correspond to the biased arithmetic and harmonicmeans respectively. Thus decay in HM and AM are given by∆HM − = h− − H = −0.303 and ∆AM − = a− − A =−0.15. Ignoring the signs which denote decay, a comparisonof corresponding rates of decay for the HM for additive anddeductive attacks proves |∆HM − | > |∆AM − |. This provesproperty 3. Note that the biased ratio of HM and AM is Q− =0.76 < Q. This proves Lesson 3, where ratio drops if points
already on the left of the true mean when reduced by a bias.
Additionally, when we compare rates of HM bias of deductivewith additive attack for the same ǫ = 0.3, it can be verified
that:|∆HM − | > |∆HM + |. However, |∆AM + | = |∆AM − |. Hence, HM decays at afaster rate than it grows for the same bias, while AM growthdecay rates are same. This proves property 7 and Lesson
7. This is an intuition behind camouflage attacks detection
signature of camouflage attacks discussed later.
Now let us see all the cases where, the number of the rightside of the mean i.e. x2 is changed with additive and deductive
bias of ǫ = 0.3. Now X + = (1, 2 + 0.3). The HM + =1.39 and AM + = 1.65. The ∆HM = 0.05 and ∆AM =0.15. Hence, HM mean grows at a slower rate than AM when
numbers on right side are changed with additive bias. Hence, it
proves property 6. Owing to the slower growth of HM, Q+ <Q, which proves Lesson 6.
Finally, x2 is changed with a deductive bias of ǫ = 0.3,
making X − (r) = (1, 2 − 0.3). Hence, the HM − = 1.259
and AM − = 1.35. The ∆HM = 0.08 and ∆AM = 0.15.
This illustrates that AM decays at a faster than HM when
numbers on right side are changed with deductive bias given
ǫ < k − (llow) = 1. Hence, property 4 is proven. As aconsequence, Q− > Q, owing to the slower growth of HM.
This proves Lesson 4. To show lesson 5, x2 needs to bechanged with a deductive bias of ǫ > k − (rlow), but this is
not a feasible strategy since 2 − k − (rlow) is negative.

x=

N
X

1
xi
N i=1

(1)

The sample variance of the actual data series is:
!
P
P
n
n
1
1
2
σ 2 = n−1 i=1 (xi − x)2 = n−1 i=1 xi 2 − 2xxi + x
"
#
Pn
1
2
2
= n−1
i=1 xi − N x
n
1 X
σ =
n − 1 i=122xi − x2!

(2)For easing the analysis, let us assume the mean x = 0 such
that,
n
X
1
σ =
xi 2
n − 1 i=12

(3)

In contrast, assuming x = 0, the sample mean of the compromised series is given by:
Pn−1
xi + (xn + δn )δn′′x = i=1=(4)NnTherefore the sample variance of the compromised
series using
!
P
2
′′ 2
n
Eqn.( 2) is σ′′2 = n1 i=1 xi − x′′
δ2

1 n
2
σ′′2 = n−1
n σ + (1 − n ) N + 2xn δn
The ratio is drops if σ′′2 > σ 2 . If we assume, xn is equal
to value of mean (= 0), the following inequality (necessary)condition should be satisfied,rn 
δn > σ(5)n−1Note that, Eqn. 5 holds only assuming xn and x to beequal to zero. For xn 6=q 0 and x 6= 0, it means thatnxn + δn > {|xn − x| + σ ( n−1) + x} However, if data isnormally distributed, the real margin of false data is closer tothe necessary condition, because the difference between any
data point and x is not arbitrarily high. Hence, the averagecase is given by,r
n δavg > σ + σ
n−1Generalizing, let M be the number of data points compromised without bias. Following the analysis in [4], it can beshown that on the average, the necessary condition is:n−M+ σ = klow
n−1

2σ
σ
δavg > max{
+√
M
M
.

r
n−M
n−1

+ 2σ, σ 2 }The theoretical sufficient condition is of little practicalsignificance given the context of our dataset. It is more relevant
for very small series data.
VI. A PPENDIX F: D ISTRIBUTION OF R ATIO M ETRICS AMPLES ACROSS M ULTIPLE DATASETS
Fig. 4(a) and Fig. 4(b), shows similarities between thestandard deviations in the ratio metric when compared to the
Irish dataset, although the mean values are different whencompared to the Irish dataset. This means that the safe margin
design works across datasets due to the high stability of theratio based metric.
100

80

100

+2 σr

µr

-2 σr

Frequency

Let us assume that actual data series from n sources is given
as: X(n) = {x1 , · · · , xn }. For ease of analysis, let us assume
that one data point say xn is compromised, with a false data of
δn added to it. Relative to the mean, the necessary condition
that creates a difference in the ratios, by triggering an increasein variance will cause a drop in the ratio. Let the compromised
data series be denoted by: X ′ (n) = {x1 , · · · , (xn +δn )}. Now
the sample mean of the actual data series is:r

The above bound is necessary but may not sufficient toeffect a ratio drop additive attacks. But if δavg below klow thenthe ratio cannot drop. This is infact established experimentallyin the paper. The ratio narrowly rises and drops around klow .
The sufficient condition is:

Frequency

V. A PPENDIX E: A PPROXIMATION OF THE B OUNDSσσ
δavg >
+√
M
M

60

40

20

0

-2 σr

µr

+2 σr

80

60

40

20

0.89

0.9

0.91

0.92

Ratio Value

0.93

0.94

0
0.87

0.88

0.89

0.9

0.91

0.92

0.93

Ratio Value(a)(b)
Fig. 4. Ratio Distribution (Texas Data): (a) 200 meters (b) 800 meters