1
Attack Context Embedded Data Driven Trust Diagnostics in
Smart Metering Infrastructure
SHAMEEK BHATTACHARJEE, Western Michigan University, USA
VENKATA PRAVEEN KUMAR MADHAVARAPU, Missouri Univ. of Science & Technology, USA
SIMONE SILVESTRI, University of Kentucky, USA
SAJAL K. DAS, Missouri University of Science and Technology, USA
Spurious power consumption data reported from compromised meters controlled by organized adversaries in
the Advanced Metering Infrastructure (AMI), may have drastic consequences on a smart grid’s operations.
While existing research on data falsification in smart grids, mostly defend against isolated electricity theft,
we introduce a taxonomy of various data falsification attack types, when smart meters are compromised byorganized or strategic rivals. To counter these attacks, we first propose a coarse grained and a fine grained
anomaly based security event detection technique that uses indicators such as deviation and directional change
in the time series of the proposed anomaly detection metrics to indicate: (i) occurrence and (ii) type of attack,(iii) attack strategy used, collectively known as ‘attack context’. Leveraging the attack context information,
we propose three attack response metrics to the inferred attack context: (a) an unbiased mean indicating arobust location parameter; (b) a median absolute deviation indicating a robust scale parameter, (c) an attack
probability time ratio metric indicating the active time horizon of attacks. Subsequently, we propose a trust
scoring model based on Kullback-Leibler (KL) divergence, that embeds the appropriate unbiased mean, medianabsolute deviation and attack probability ratio metric at runtime to produce trust scores for each smart meter.
These trust scores help classify compromised smart meters from the non-compromised ones. The embeddingof the attack context, into the trust scoring model, facilitates accurate and rapid classification of compromised
meters, even under large fractions of compromised meters, generalize across various attack strategies andmargins of false data. Using real data sets collected from two different AMIs, experimental results show thatour proposed framework has a high true positive detection rate, while the average false alarm and missed
detection rates are much lesser than 10% for most attack combinations for two different real AMI micro-griddatasets. Finally, we also establish fundamental theoretical limits of the proposed method, which will help
assess applicability of our method to other domains.
Additional Key Words and Phrases: Advanced Metering Infrastructure, Trust, Smart Grid Security, Smart
Metering, Anomaly Detection, Data Integrity, Data Falsification Attacks, Artificial Intelligence based Security
ACM Reference Format:
Shameek Bhattacharjee, Venkata Praveen Kumar Madhavarapu, Simone Silvestri, and Sajal K. Das. 2020. Attack
Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure. ACM Transactions on
Privacy and Security. 1, 1, Article 1 (October 2020), 35 pages. https://doi.org/10.1145/3426739
Authors’ addresses: Shameek Bhattacharjee, Western Michigan University, Rolla, USA, shameek.bhattacharjee@wmich.edu;
Venkata Praveen Kumar Madhavarapu, Missouri Univ. of Science & Technology, Rolla, USA, vmcx3@mst.edu; Simone
Silvestri, University of Kentucky, Lexington, USA, silvestri@cs.uky.edu; Sajal K. Das, Missouri University of Science andTechnology, Rolla, USA, sdas@mst.edu.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee
provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and thefull citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored.
Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires
prior specific permission and/or a fee. Request permissions from permissions@acm.org.
© 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM.
2471-2566/2020/10-ART1 $15.00
https://doi.org/10.1145/3426739
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:2

1

Bhattacharjee et al.

INTRODUCTION

Advanced Metering Infrastructure (AMI) is one of the basic units of the smart grid technology. AMI
collects data on loads and customer’s power consumption [20], from Smart Meters installed on thecustomer site (see Fig. 1). Such data plays a pivotal role in several critical tasks such as automatedbilling, demand response, load forecast and management [9, 20, 23].
Apart from automated billing, strategic tasks are expected to be performed by future smart grids,
based on the AMI power consumption data. For example, AMI will have implications on tasks suchas daily and critical peak shifts [8, 14, 36]. When the consumption increases beyond a critical limit,
emergency ‘peaker plants’ are currently used by most utilities for additional power generation
to meet the demand. However, such peaker plants are extremely carbon as well as cost intensive.
In the modern grid, the utility will also have the option for automated demand response where
utilities pay customers to shut certain appliances temporarily (peak shifting) to obviate the needfor additional generation [13, 35]. In general, an accurate short or long term data on loads andconsumption will aid in accurate demand response, load forecast and planned generation in the
future smart grid [1]. Therefore, the integrity of the AMI data is of utmost importance.
Defense against falsification of power consumption data from AMIs, has largely focused onelectricity theft [12, 17, 19, 30], where individual customers are primary adversaries who report lower
than actual usage for lesser bills. Since isolated smart meters belonging to rogue customers reducethe value of power consumption, we term such an adversarial attack as a Deductive mode of data
falsification. However, it has been widely acknowledged that given the cyber and interconnectednature of AMI, it could potentially be the target of organized adversaries such as cyber criminals [34],utility insiders [38], or business competitors [15]. Organized adversaries can compromise several
smart meters and then spoof false power consumption data [17] from smart meters. Organizedadversaries are more equipped to crack/leak cryptographic secrets, have a higher attack budget, andpossess the ability to simultaneously attack other elements of the grid (e.g., audit logs, transformers
meters) in order to avoid easy consistency checks on false data. Existing research does not focus on
defense against such adversaries and is only restricted to electricity theft from isolated customers
as primary adversaries. Given that electricity theft is targeted at individual customer gain, themargin of false data is usually arbitrary [12] and typically high [16] such that there is a tangible
benefit to each customer, thus facilitating easier detection.
Additionally, the goals of organized adversaries are not just restricted to monetary benefits on
the customer side. As a recent example, in Netherlands [33] a manufacturer installed a large numberof faulty smart meters (not proved whether it was erroneous or deliberate act) that reported 6
times higher than actual power consumption. We term such an attack as an Additive mode of data
falsification. For example, an additive attack may be launched by a rival utility on its competingcompany’s meters, that may induce loss of business confidence by the customers of the victim
company, due to higher bills as reported in [32]. A class action lawsuit filed against a victim utility
was reported in this case. If the utility participates in demand response, it may lose revenue fromadditive attacks for undue incentives payed to customers for induced peak shifts. Indirectly, additive
attacks can be triggered by a load altering attack(LAA) [22], thus increasing the net consumption
sensed by the smart meter. It may also be noted that adversaries may orchestrate large scale
deductive attacks to cripple the utilities with huge revenue losses [38].
Apart from the additive and deductive attacks, we argue the possibility of more complex attack
types in AMI. For example, a balancing additive and deductive attack with the same margin offalsification, could evade mean aggregate (or location parameter) based detection models. We termsuch a strategy as a Camouflage attack, which may be motivated for generating lesser bills to one
set of customers at the expense of the other set. Such attacks may stay undetected, without raising
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:3

any suspicion because the total inflow and outflow of power measured (or mean predictions) at
the transformer meters, and the total demand and reported usage remain relatively unchanged.
The attacker in such a case does not need to attack other elements in the grid (for e.g. transformer
meters) to prevent easy consistency checks. In general, random additive and deductive attacks may
simultaneously coexist in the same AMI network, when launched by different adversaries withconflicting goals. We term such a scenario as a Conflict attack, that is a mixed attack type withunequal margins of falsification for each underlying simple attack type. Apart from the four attack
types, there could be special attack strategies such as: (i) Data Omission attacks, where the data isprevented from reaching the utility (ii) On-Off attacks, where the adversary only attacks on specifichours of the day, and (iii) Data Distribution Order Aware Attacks, where the attackers ensure thatthe falsified data is more proximate to the original data distribution than usual assumed random
strategies. While, some works have explored on-off strategies [12], data omission and order aware
attacks have not gained attention. To summarize, existing defense frameworks cannot handle all of
the above falsification types and strategies simultaneously.
Contributions: In this paper, we introduce a taxonomy of multiple possible data falsification
attacks and strategies launched by organized adversaries. Then, we design two novel coarse
grained and fine grained statistical invariants (based on Pythagorean Means) of aggregate power
consumption data and learn their time series under no attacks. By exploiting knowledge of the
impacts of each attack type on these invariants, a coarse grained and a fine grained anomaly based
security event detection criterion is proposed that collectively indicates the attack context that includes‘occurrence’, ‘type’, and ‘strategy’ of different attacks. Such detection criterion with attack context
unlike existing works, better discriminate between attacks from legitimate changes and accordingly
generates the following attack responses: (i) replaces location and scale parameters with an robustmean and robust median absolute deviation respectively, (ii) calculates an attack probability time ratio
metric. Subsequently, we propose a Kullback-Leibler divergence based Relative Entropy Trust Modelthat embeds the attack responses from the attack context, in a way that identifies compromised
meters with a high detection rate in a quicker time with less false alarms. Experimental results
using real datasets from different AMIs, show that our detection technique is able to identify
compromised meters with higher detection rates in quick time while incurring lower false positives,
than recent works in the area, under various attack strategies employed by adversaries. Finally, we
perform extensive formal security analysis to show the performance limits of our model.
Novelty: Our proposed work is the first effort to establish trustworthiness in AMI against multiple
attack types and faults with coarse and fine grained attack strategies. Secondly, our focus is onorchestrated data falsification attacks devised by organized adversaries rather than just rogue
customers. Our method works well for even higher fractions of compromised meters, unlike moststatistics based methods due to the embedding of real time attack responses into the trust model.
To demonstrate detection sensitivity in terms of margin of false data, we assume the full attack
strategy space and show that detection rates are high across a wider threat landscape. Additionally,
our method’s time to detection of compromised meters is quick even under opportunistic attack
strategies that are sporadic over time domain, via attack time probability ratio embedding. Our
proposed method is light weight and gives better performance compared to the classical bad
data detection mechanisms which use expensive multi-class SVM and neural network based
training models. We also discuss about the limitations of our proposed framework under adversary’s
knowledge of our defense mechanism, which motivates the direction in which further research should
be conducted.
The rest of the paper is organized as follows. Section 2 describes the system and threat models
while Section 3 discusses the proposed framework with theoretical analysis. Section 4 includes
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:4

Bhattacharjee et al.

a special embedding method required to counter opportunistic attacks. Section 5 discusses theexperimental results and Section 6 concludes the paper.

Fig. 1. Architecture of AMI [3]2

SYSTEM AND THREAT MODELSIn this section, we discuss the network architecture of the AMI, characterize the distribution of
two real datasets, and propose the threat model for organized data falsification in AMI.
2.1

Architecture

We consider a collection of 𝑁 smart meters reporting power consumption data to a Neighborhood
Area Network (NaN) Gateway (acts as an edge computing node) periodically and independently.
𝑖 (𝑡) at the end of each
The 𝑖-th smart meter, records an actual power consumption data, say 𝑃𝑎𝑐𝑡𝑖𝑖 (𝑡), if 𝑖time slot 𝑡 (𝑡 is slotted hourly). The reported power consumption 𝑃𝑟𝑒𝑝 (𝑡) is equal to 𝑃𝑎𝑐𝑡𝑖𝑖
is not compromised. However, 𝑃𝑟𝑒𝑝 (𝑡) ≠ 𝑃𝑎𝑐𝑡 (𝑡), if 𝑖 is compromised by an adversary. We model𝑖 (𝑡) as the realizations of a random variable 𝑃 𝑖 , that denotes power consumption from the𝑃𝑎𝑐𝑡𝑖-th meter. The NaN gateway piggybacks data from each smart meter and sends it to the utility
via a Wide Area Network (WaN) Gateway that collects data from multiple such NaN gateways.
Occasionally, there is another network hierarchy known as the Field Area Network (FAN) gateway
which connects NaN and WaN and may host edge computing services. Both FaN and WaN may hostthe security monitoring mechanisms. Deploying security mechanism at the FaN is a decentralized
implementation, while deployments at the WaN is a centralized implementation. Our framework
works regardless of the implementation. The current evaluation proposed mechanism assumes adecentralized implementation given the size of the microgrid datasets. Moreover, [6] has observed
the benefits of decentralized security implementations over centralized ones.
2.2

Data Set Characterization and Transformations

To characterize the distribution of the random variable 𝑃 𝑖 from the 𝑖-th smart meter, we conductedpreliminary investigations on real power consumption data sets with 800 [40] (Texas Dataset) and5000 meters [42] (Irish Dataset) collected on an hourly basis. The Texas dataset contains data acrossthe years 2014, 2015 and 2016. Throughout the paper, data from 2014 and 2015 are used as thehistorical training set, while 2016 serves as a testing set. The Irish dataset contains approximately
535 days of data from years 2009-2010, that we use to prove the generality of our results.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

(a)

1:5

(b)

Fig. 2. Power Consumption Distribution: (a) All Houses (b) Mixture

Each home consists of one smart meter in the datasets. We observed that for each meter, thepower consumption can be approximated as a log normal distribution. We also observed that all
such log normal distributions are clustered close to each other; that is, the variance between themis not arbitrarily large. Fig. 2(a) summarizes the results from all the houses in the Texas dataset.
Thanks to this observation, we can approximate the aggregate of the individual log normals using
a mixture distribution, which is also lognormal as evident from Fig. 2(b). Let 𝑃𝑚𝑖𝑥 denote theapproximate lognormal mixture of all 𝑃 𝑖 .
Next we transform all 𝑃 𝑖 using a Box-Cox transformation technique [5] to obtain an approximate^ ,normally distributed r.v. denoted as 𝑃^𝑖 . Let 𝑃^𝑚𝑖𝑥 denote the mixture of all the 𝑃^𝑖 . Results of 𝑃𝑚𝑖𝑥
for different months is depicted in Fig. 3(a). The box-cox transformation serves a dual purpose.
First, it maps the data points to a lower portion real axis. Some interesting statistical propertiesof proposed Pythagorean Mean based invariants are more prominent in this lower-dimensional
real axis which increases the relative sensitivity of Harmonic Mean to Arithmetic mean differences
and their ratios (used for detecting anomaly) under false data injections. Below, we describe thebox-cox transformation technique and how we apply it in our context.
2.2.1 Box-Cox Transformation:. The transformation of non-normal data into approximate normal distribution can be achieved using the following method. Given any set of data-points
𝑫 = {𝐷 ( 1) , · · · , 𝐷 (𝑘) , · · · , 𝐷 (𝑛) }, where 𝑛 denotes the total number of data points in 𝑫, the box cox
transformation of 𝑫 is given by 𝒅^ = {𝑑 ( 1) (𝜆), · · · , 𝑑 (𝑘) (𝜆), · · · , 𝑑 (𝑛) (𝜆)}:((𝐷 (𝑘 ) ) 𝜆 −1
if 𝜆 ≠ 0;(𝑘)
𝜆𝑑 (𝜆) =
(1)𝑙𝑛(𝐷 (𝑘) ) if 𝜆 = 0
where 𝜆 is an appropriate transformation parameter chosen from a possible set 𝜆 ∗ ⊆ R, such that
𝜆 = argmax 𝑓 (𝑫, 𝜆 ∗ )𝜆 ∈Rwhere 𝑓 (𝑫, 𝜆 ∗ ) is the logarithm of the likelihood function given by:
" 𝑛
#
𝑛
Õ
Õ [𝑑 (𝑘) (𝜆) − 𝑑¯(𝜆)] 2𝑛𝑓 (𝐷, 𝜆) = − 𝑙𝑛
+ (𝜆 − 1)𝑙𝑛(𝑑 (𝑘) )
2
𝑛
𝑖=1
𝑖=1
such that 𝑑¯(𝜆) =

Í𝑛

𝑖=1 𝑑

(𝑘 ) (𝜆)𝑛(2)is the arithmetic mean of the transformed data.

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:6

Bhattacharjee et al.

2.2.2 Applying Transformation to the Datasets: The data from each smart meter 𝑖 (analogous to 𝐷)
is transformed onto the box cox transformed scale by using the above procedure. Thereafter, webuild the time series of the whole dataset in the box cox transformed scale as:𝑝^(𝑡) = {𝑝^1 (𝑡), · · · , 𝑝^𝑖 (𝑡), · · · , 𝑝^𝑁 (𝑡)}Probability of Power Value

where 𝑝^(𝑡) denotes the reported time series over all smart meters 𝑖 ∈ {1, 𝑁 } at each time slot. The
appropriate 𝜆 is learned from the historical training set (2014, 2015), and the same is applied tothe testing set (2016) and Irish Dataset (2010). To prove the generality of this method, we repeatedthe experiments for the Irish data set [12], and reported similar results which are included in the
preliminary version of our work [2]. The distribution for Irish dataset after box-cox transformation
After the transformation, 67% and 68% of data points fall within the first standard deviation for
the Texas and Irish data sets respectively. However, the resultant distributions as a whole are notsymmetric about the mean and 64% and 69% of the data are lesser than the mean and 36% and
31% of the data are greater than of the mean. This asymmetry is another factor that affects theobservations in the anomaly detection phase.
0.08

0.06

0.04

0.02

0
0

5

10

15

20

25

30

Boxcox (Pmix)
(a)

(b)

Fig. 3. After BoxCox: (a) Monthly Texas (b) Yearly Irish

2.3

Time and Space Domain Granularities of Detection

In this paper, for various time series and trust score calculations, we use different time domain
granularities. An hourly time granularity is referred to as a time ‘slot’ denoted by 𝑡. A daily time
granularity consisting of 24 time slots is referred to as a time ‘window’ denoted by 𝑇 . A collectionof time windows is referred to as a time ‘frame’ denoted by 𝐹 (e.g. 30 days). In this paper, theanomaly detection has two versions. The coarse-grained version runs on a daily basis (with 𝑇 )while the fine-grained version runs on an hourly basis (with 𝑡). In this paper, the Kullback-Leibler(KL) divergence based trust model assigns trust of each smart meter at the end of a frame (sayevery (a) 10 days (b) 30 days) based on evidence and observations that are collected on an hourly
basis. We assume that the whole defense framework is running in a decentralized manner, that is
deployed or hosted in an edge device such as a NaN gateway in the AMI network. In such cases,
the usual micro-grid size under observation varies between 100-1000 houses. For a larger grid, ourtrust model will also work for centralized implementations seamlessly, however, the anomaly based
security event detection will need to be decentralized as pointed out by several prior works [6].
2.4

Threat Model

Now let us introduce a detailed threat model for our framework.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:7

2.4.1 Adversary Types and Scope: In this paper, we keep the scope of threats to be a little lessspecific, since, in the real world, the defender has no control over what kind of adversary will attack
its infrastructure. A good defense model is one can capture a wider range of attacks from various
adversary types who can have various creative strategies to launch their intended attack objectives.
In this light, we divide the threat model specification into four features: data falsification attack
types, fraction of compromised meters, margins of false data, and attack strategies that specify awide threat landscape. The attack strategies are further divided into continuous and opportunistic
strategies. The paper’s core contribution (Section 3) by default considers the continuous strategies.
Thereafter, it explains the modifications required to the core contribution separately in Section 4for opportunistic attack strategies.
We assume that the organized adversary belongs to either business competitors or organizedcyber-criminals, who possess the ability to compromise several smart meters by bypassing cryptography or manipulating its sensory inputs, or utility personnel who might manipulate several
smart meters physically [38] (e.g., via optical probes [34]). False power consumption data froma meter can be achieved in the following ways: (a) manipulation of inputs to the meter [22], (b)manipulating data content in the meter [34], and (c) in-flight from the meter [18] to NaN gateway. A
meter is compromised if either the input, content, or output is modified from the actual value. The
adversary launches data falsification from multiple such compromised smart meters concurrently.
In another variation, the attacker could take control of NaN gateway where it could intercept datafrom multiple smart meters at once and launch smarter attack strategies as discussed later.
We assume attackers who may have a long or short term damage objective. Long term damage
requires evading detection easily, while still benefiting from attacks. The adversary may accept
some initial loss in the hope of avoiding easy detection and accruing incremental benefits overtime. Examples of long term adversarial objectives include monetary gains in terms of electricity
pricing and belief manipulation of learning based demand forecast models. In this case, the false
data margins are typically smaller. A short term damage, on the other hand, requires inflicting the
maximum damage in a short time, before getting detected. Examples of short term objectives include
an attacker aiming to, gain quick revenue or masquerade an illegitimate demand response event.
Due to the contrasting requirements on these two objectives, important adversarial parameterssuch as the fraction of compromised nodes 𝜌𝑚𝑎𝑙 and the margin of false data 𝛿𝑎𝑣𝑔 can readily varydepending on the nature of time deadlines associated with such objectives. In the real world, we
can encounter attackers with rational or irrational objectives, and hence it is important to explore
all combinations of 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 .
2.4.2 Data Falsification Attack Types in AMI:. We define the manner in which the actual𝑖 (𝑡) of each meter 𝑖 is modified as the mode of data falsification. We
power consumption data 𝑃𝑎𝑐𝑡
identify the following modes:
𝑖 (𝑡) = 𝑃 𝑖 (𝑡) + 𝛿 (𝑡), where 𝛿Additive: The adversary reports 𝑃𝑟𝑒𝑝𝑚𝑖𝑛 ≤ 𝛿 (𝑡) ≤ 𝛿𝑚𝑎𝑥 . This mode can𝑎𝑐𝑡lead to loss of business confidence from customers due to higher bills and masquerade a demand
peak leading to remote disconnect of customer appliances, thereby inducing utilities to pay undue
incentives.
𝑖 (𝑡) = 𝑃 𝑖 (𝑡) − 𝛿 (𝑡), where 𝛿
Deductive: The adversary reports 𝑃𝑟𝑒𝑝𝑚𝑖𝑛 ≤ 𝛿 (𝑡) ≤ 𝛿𝑚𝑎𝑥 . This mode𝑎𝑐𝑡
can lead to loss of revenue for power utility companies.
Camouflage: The adversary divides the compromised meters into two teams equal in number, which
simultaneously adopt an additive and deductive mode, respectively with an equal 𝛿 (𝑡). This modecan favor a smart meter of one power utility at the expense of others and has less impact on thestrategic decisions in the grid. It cannot be detected by mean (parametric) based anomaly detectors,
because no suspicion is raised due to negligible change in the mean power consumption.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:8

Bhattacharjee et al.

Conflict: It is a scenario where additive and deductive attacks coexist simultaneously but are notbalanced (i.e. uncoordinated). Such a scenario represents random attacks possible if there are morethan one uncoordinated adversarial teams or multiple dishonest customers acting randomly.
2.4.3 Average Margin of False Data 𝛿𝑎𝑣𝑔 . The value 𝛿 (𝑡) is generated randomly within aninterval [𝛿𝑚𝑖𝑛 , 𝛿𝑚𝑎𝑥 ], for 𝛿𝑚𝑖𝑛 , 𝛿𝑚𝑎𝑥 > 0, and accordingly added to or deducted from the actual
power consumption. Note that, arbitrarily high 𝛿𝑚𝑎𝑥 may facilitate intuitively easy detection, whilevery low 𝛿𝑚𝑎𝑥 hardly accrues any revenue. The average of 𝛿 (𝑡) is a strategic value, denoted by 𝛿𝑎𝑣𝑔
and referred to as the margin of false data. The units of 𝛿𝑎𝑣𝑔 values in this paper is in Watts.
Apart from the type of attack, the attacker chooses a strategic value of 𝛿𝑎𝑣𝑔 in the interval[𝛿𝑚𝑖𝑛 , 𝛿𝑚𝑎𝑥 ] as part of its strategic objective. The inflicted 𝛿𝑎𝑣𝑔 may be high or low dependingon the amount of damage it wants to inflict, and the short or long time horizon of the attack.
However, the attack margin 𝛿 (𝑡), maybe more in peak periods than non-peak periods, to exploit
the time-dependent pricing of electricity.
2.4.4 Attacker Budgets and Fraction of Compromised Meters. We assume that organizedadversaries compromise a certain number 𝑀 of 𝑁 smart meters based on attack budget. The fractionof compromised nodes is 𝜌𝑚𝑎𝑙 = 𝑀
𝑁 , which can be high for smaller microgrids with a small 𝑁 .
With higher 𝜌𝑚𝑎𝑙 , the adversary can afford to decrease the margin of false data (per meter) to
avoid getting intuitively and easily detected. Although the attack cost increases in these cases, theadversary may reduce the chance of detection, and look to recover the initial cost in the long term.
This is however not an option for adversaries with short term objectives. A concrete mathematicalexample of this aspect can be found in the preliminary version of this work [2].
2.4.5 Attack Strategies. Now we represent different falsification strategies of additive, deductive,
camouflage, and conflict attacks for any 𝛿𝑎𝑣𝑔 and 𝜌𝑚𝑎𝑙 . The attack strategy describes how the𝛿 (𝑡) bias values are distributed over the interval [𝛿𝑚𝑖𝑛 , 𝛿𝑚𝑎𝑥 ] as well as over the time domain. In
this paper, we study attack strategies such as (uniform random bias, data distribution order aware)that are ‘continuous’ over time, while (on-off, data omission) are opportunistic strategies that are
discontinuous and fine grained over the time domain due to their opportunistic nature.
Uniform Random Bias: Since the distribution of power consumption is unimodal, the attacker
refrains from any strategy that would make the resultant distribution multi-modal. In that sense, auniformly distributed random 𝛿 (𝑡) injected into the actual smart meter data does not change theoverall shape of the distribution but only affects its location and or scale parameters as proved inour early work [2]. Such variants of a uniform distribution over time have been adopted from [12].
Data Distribution Order Aware: We use this strategy where the adversary matches the 𝛿 (𝑡) values
with the actual consumption data recorded from its compromised set of meters. The adversary
sorts the data from its controlled meters and the false bias 𝛿 (𝑡) values from smallest to largest on
every time slot. For an additive attack, the smallest recorded value is biased with the highest value
in the set of 𝛿 (𝑡), and so on. For deductive attack, the smallest data from the meter set is biased
with smallest value in the set of 𝛿 (𝑡). For camouflage attack, since compromised meter population
is divided into 2 parts, the additive and deductive order aware strategy are implemented similarly.
Such an attack can prevent obvious outliers, which is much better than a simple uniform random
strategy, and therefore more proximate to the actual data distribution, thus making it harder todetect. Detailed implementation of the attack and proof that it follows the original data distribution
more closely is provided in Appendix A. We use this specifically for deductive attacks in the paper,𝑖 (𝑡) are lower bounded by 0. This does not allow realizing the full 𝛿
since 𝑃𝑟𝑒𝑝
𝑎𝑣𝑔 margin in theattack and too many zero values that can raise easy suspicion. Such a strategy is possible if theadversary controls some NaN gateway.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:9

On-Off: In this case, the adversary’s orchestrated attacks are distributed between OFF periods ( nofalsification is launched) and ON periods (falsification is launched) over time. Such an attack is
inspired by dynamic pricing nature of the electricity. For example, if malicious purpose is electricity
theft, the attackers launch attacks during time slots when the electricity prices are the highest.
Data Omission: The data may be prevented from reaching the NaN/FaN gateways, either (i) intentionally (omission attack) or (ii) due to accidental network failures (omission failure). An example
of an omission attack is the jamming of the wireless channels that carry the data over the meshnetwork to the edge gateway. Such omission attacks cripple data availability which affects decision
and analytics in the smart grid. Alternatively, some hops of the mesh network may fail or channels may occasionally drop some packets due to network collisions. Hence, no data reaches fromparticular meters on the concerned time slots, which is termed as an omission failure.
We use the uncleaned dataset (which contains missing data on certain times slots) to showthat we can detect such omission failures. In contrast, we simulate omission attacks by dropping
the data from 𝜌𝑚𝑎𝑙 fraction of compromised meters. We believe that omission failures tend to bevery random and infrequent, while omission attacks are likely to be more frequent. Additionally,omission attacks depend on the opportunity to thwart the communication resources, and therefore
the time between successive attacks is not necessarily periodic like an ON-OFF strategy.
2.5

Overview of the Proposed Framework

The proposed framework has three phases: (a) Anomaly-based Security Event Detection (b) Security
Event-based Attack Context and Response Generation (c) Attack Context Embedded Trust Scoring
Model. The anomaly detection phase indicates the nature of the security event in terms of theinformation such as the presence, type, strategy, and strength of the concerned data falsification
attack. Such information extracted from the security event detection aids in the calculation ofcertain attack response metrics such as an unbiased robust mean, a median absolute deviation,
and an attack probability time ratio by the attack context generation phase. Such attack response
metrics are supplied to the trust scoring model phase that calculates a linearly separable score foreach meter and uses it to identify the compromised meters launching data falsification attacks. The
embedding of the attack context based response metrics improve the accuracy of compromised
meter classification and the classification convergence times regardless of the attack types, margins,
and strategies inflicted.
The anomaly detection phase is further divided into two parts: (i) coarse grained anomaly
detection for attacks for all strategies except on-off and omission strategies; (ii) fine grained anomaly
detection for on-off and omission strategies. Note that, the coarse and fine grained anomaly detectors
run simultaneously in the framework since any attack strategy is possible in reality. While bothanomaly detection variants help to calculate the robust mean and median absolute deviation, theattack probability time ratio is relevant only for the fine grained anomaly detector. The trustmodel is further divided into three parts: (a) estimating parameters of true proximity distributions(b) estimating parameters of observed proximity distribution with appropriate attack context
embedding (c) The Kullback-Leibler Divergence calculation.
3

PROPOSED FRAMEWORK FOR DATA DRIVEN TRUST DIAGNOSTICS

In this section, we propose the coarse grained and fine grained anomaly based security event
detection scheme. The proposed event detection scheme leverage the properties of how different
data falsification types change the Pythagorean Means (such as Harmonic, Geometric, Arithmetic
Means) of an attacked time series. We propose an invariant for both coarse and fine grained
anomaly detection schemes, that is stable under no attacks. The evidence of invariant stability
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:10

Bhattacharjee et al.

is proved through two real datasets gathered from 200 from a solar village in Texas, USA [40],and 5000 smart meters in Dublin, Ireland. Then, we show how these invariants exhibit visibly
evident changes under various attacks, which forms the premise for inferring the presence of attack,type of data falsification, and the strategy used by the adversary that collectively reconstructs the
security event. Based on the nature of the security event, an attack context is generated (in theform of robust mean, median absolute deviation, attack probability time ratio). The attack context
information is forwarded to the trust based scoring model which enables accurate identification of
the compromised smart meters.
3.1

Anomaly based Security Event Detection

First, we propose the detection metric (or invariant). Second, we explain the reasoning behind thedesign of the proposed invariant. Third, we establish the normal range of the under no attacks.
Fourth, we propose the detection criterion to detect the occurrence of an orchestrated attack thatneeds a consensus (location and scale) correction. Fifth, we show how the attack type could bedetermined given the incidence of attack. Finally, we show how the knowledge of the incidenceof attack and its corresponding type is used to estimate an approximate robust mean and medianabsolute deviation (collectively called as robust consensus measures). Information on the robust
consensus measures is supplied to the entropy based trust model for improved classification thatmaximizes detection sensitivity for a wide range of 𝛿𝑎𝑣𝑔 and 𝜌𝑚𝑎𝑙 values while minimizing theincidence of false alarms.
3.1.1 Pythagorean Means. The various Pythagorean means (arithmetic, geometric and harmonicmeans) in a particular time slot 𝑡 is given by:
Í𝑁
𝐴𝑀 (𝑡) =^𝑖 (𝑡)𝑖=1 𝑝,

𝐺𝑀 (𝑡) =𝑁𝑁Ö

𝑝^𝑖 (𝑡)

 𝑁1

𝑖=1

,

𝐻 𝑀 (𝑡) = Í𝑁𝑁

1𝑖=1 𝑝^𝑖 (𝑡 )The average of all these hourly means 𝐴𝑀 (𝑡), 𝐺𝑀 (𝑡) and 𝐻 𝑀 (𝑡) over a particular day (𝑡 ∈ [1, 24])is represented by 𝐴𝑀 (𝑇 ), 𝐺𝑀 (𝑇 ), and 𝐻 𝑀 (𝑇 ) respectively where 𝑇 ∈ [1, 365]. For example,Í
𝐴𝑀 (𝑇 ) = 𝑡24=1 𝐴𝑀 (𝑡)/24) and so on. Due to the well known Pythagorean mean inequality,
𝐻𝑀 (𝑇 ) ≤ 𝐺𝑀 (𝑇 ) ≤ 𝐴𝑀 (𝑇 ) holds.
3.1.2 Proposed Coarse Grained Invariant (𝐴𝐷 (𝑇 )). From our statistical studies over two big
datasets, we discovered that the time series of the absolute difference between average daily
harmonic and arithmetic mean power consumption is an effective invariant across datasets. Theoretical reasoning behind the stability of the harmonic mean and arithmetic combination has been
extensively discussed and presented in our previous work [3]. Formally, the coarse grained invariant
is quantified by 𝐴𝐷 (𝑇 ) and is defined as:
𝐴𝐷 (𝑇 ) =𝐴𝑀 (𝑇 ) − 𝐻𝑀 (𝑇 )(3)

Eqn. 3, is designed as an anomaly detection metric for two main advantages: First, the timeseries of 𝐴𝐷 (𝑇 ) is a highly stable invariant of the aggregate power consumption, compared toother parametric and non-parametric measures that are functions of the instantaneous or historicalarithmetic mean power consumption as proved in our previous work [3]. Furthermore, our previous
work in the context of smart transportation systems [26, 28] showed that this observation of
stationarity in harmonic and arithmetic mean generalizes across application domains under careful
spatial and temporal considerations. High invariance over time or a given context is one of thedesired properties of anomaly detectors [7].
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:11

Fig. 4(a) shows the instantaneous values of 𝐴𝐷 (𝑇 ) for two different years (2014 and 2015). It
can be verified that under no attacks, the average value of 𝐴𝐷 (𝑇 ) is about 0.49 and the values are
relatively stable over time across both years. Similarly, Fig. 4(b), shows the time series of 𝐴𝐷 (𝑇 )for the portion of the Irish dataset that has a historical overlap between two years 2009-2010.
The 𝐴𝐷 (𝑇 ) of the Irish dataset is stable over history, since AD(T) on the T-th day is one year is
not arbitrarily different from the AD(T) of the corresponding T-th day in the previous year. BothFigs. 4(a) and 4(b) is in complete contrast to the Fig. 5 that shows the average arithmetic mean
𝐴𝑀 (𝑇 ) for the Texas dataset, can be seen as neither stable over time or over history. As it is wellknown that anomaly detection metrics ideally need high invariance under normal operations,we, therefore, conclude that 𝐴𝐷 (𝑇 ) a better invariant compared to any derivative of the populararithmetic mean and standard deviation. Additionally, since the values are not arbitrarily different,
the variance in the 𝐴𝐷 (𝑇 ) samples is also lesser compared to the variance in 𝐴𝑀 (𝑇 ) samples.
An elaborate theoretical explanation on the generality of the observed stability of the absolutedifference between 𝐻 𝑀 (𝑇 ) and 𝐴𝑀 (𝑇 ) across datasets is elaborated in detail in Appendix B.
3
2.8

2009
2010

AD = | HM - AM |

2.6
2.4
2.2
2
1.8
1.6
1.4
1.2
1

0

20

40

60

80

100

120

140

160

Time (Days)

(a)

(b)

Fig. 4. Time Series of proposed 𝐴𝐷 (𝑇 ): (a) Texas Dataset (b) Irish Dataset

Fig. 5. Unstable 𝐴𝑀 (𝑇 ) for Texas Dataset

3.1.3 Summary of Security Properties of Proposed 𝐴𝐷 (𝑇 ). The second advantage is that harmonic,
geometric and arithmetic mean possesses certain special mathematical properties that produce
unique changes in the time series of 𝐴𝐷 (𝑇 ), whenever data falsification occurs from a subset ofdata sources, that otherwise produced a stationary 𝐴𝐷 (𝑇 ).
While harmonic mean and geometric mean is a strictly Schur-Concave function [29], thearithmetic mean is both Schur Concave and a Schur Convex function of its arguments (the numbers
involved in the calculation of the means). Such a difference in the strictness of Schur-Concavity
property produces six unique novel properties in the context of data falsification that we had
identified. The direction of deviation depends on the skewness in the datasets, but the fact there
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:12

Bhattacharjee et al.

1.2

3.5
3.4

HonestDeductive
Additive
Camouflage
Conflict0.8

avg = 150 W
avg = 800 W
No Attack

3.2
3
Attack Started

2.8

Statistical
Anomaly

0.6
0.4

AD =| HM - AM |AD= | AM-HM |

1

2.6
2.4
2.2
2
1.8
1.6

Attack Started

1.4

0.2

1.2

50

100

150

200

250

300

350

1

0

50

Time (days)

(a)

100

150

200

250

Time (Days)(b)

Fig. 6. 𝐴𝐷 (𝑇 ) deviation under attacks (a) Texas Dataset (b) Irish Dataset

will be deviation is generic and independent of the datasets. These six properties are divided into
two-sub groups based on the direction of change in the 𝐴𝐷 (𝑇 ). The direction of change in 𝐴𝐷 (𝑇 )is dependent on whether the 𝛿𝑎𝑣𝑔 is greater or lesser than a certain threshold Γ, given a particular𝜌𝑚𝑎𝑙 , attack type, and the skewness in the data distribution. The theoretical and experimental
proof of the properties has been established in our earlier work [3]. For the sake of completeness,
we now provide a summary of these properties in harmonic and arithmetic means, that cause thedeviation in 𝐴𝐷 (𝑇 ) under attacks.
Case 1: For all attacks with 𝛿𝑎𝑣𝑔 > Γ, the following hold true:
Property 1: Under additive attacks, the harmonic mean grows slower compared to the arithmetic
mean, thus 𝐴𝐷 (𝑇 ) will increase.
Property 2: Under deductive attacks, the harmonic mean decays faster compared to the arithmetic
mean decay rate, thus 𝐴𝐷 (𝑇 ) will increase.
Property 3: Given the same 𝛿𝑎𝑣𝑔 and the same set of arguments, the decay in harmonic mean islarger for deductive attacks compared to growth in harmonic mean for additive attacks. Therefore,
in a camouflage attack with the same 𝛿𝑎𝑣𝑔 , the resultant harmonic mean will be lesser than theoriginal harmonic mean, while the arithmetic mean will not change. Thus 𝐴𝐷 (𝑇 ) will increase.
Effect on properties 1,2, and 3 on 𝐴𝐷 (𝑇 ): It is easy to conclude that all the above three properties
will cause the 𝐴𝐷 (𝑇 ) to increase after attacks compared to before attacks because the gap between
𝐻𝑀 and 𝐴𝑀 widens, so does its absolute value represented by 𝐴𝐷 (𝑇 ). This is experimentally
verified in Fig. 6(a), where attack injected after the 250-th day shows a sharp increase in the 𝐴𝐷 (𝑇 )for various attack types.
Case 2: For all attacks with 𝛿𝑎𝑣𝑔 < Γ, the above three properties are reversed and the following
hold true:
Property 4: Additive attacks will show larger growth in harmonic mean compared to arithmetic
mean growth, thus 𝐴𝐷 (𝑇 ) will experience a decrease.
Property 5: Deductive attacks will show smaller decay compared to arithmetic mean decay, thus
𝐴𝐷 (𝑇 ) will experience a decrease.
Property 6: 𝐴𝐷 (𝑇 ) will decrease if actual number of data points attacked with additive are smaller
than the actual mean. This is typically true for power consumption datasets that are right skewed,
hence the mean is shifted towards the right tail of the distribution. If such data is attacked, on
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:13

average more number of datapoints being modified will be smaller than the actual arithmetic mean.
Effect on properties 3,4, and 5 on 𝐴𝐷 (𝑇 ): It is easy to conclude that all the above three properties
will cause the 𝐴𝐷 (𝑇 ) to decrease after attacks compared to before attacks because the gap between
𝐻𝑀 and 𝐴𝑀 narrows, so does its absolute value represented by 𝐴𝐷 (𝑇 ). This is experimentally
verified in Fig. 6(b), where attack injected after the 100-th day shows a decrease in the 𝐴𝐷 (𝑇 ).
Approximation of crossover Γ: For directional switching of the proposed 𝐴𝐷 (𝑇 ), the approximate bounds on the average value of Γ and its details have been published in our earlier work [3].
The closed form of Γ is not possible due to non-existence of the closed form. However, approximation of the lower and upper bounds are given by the following The approximate (average case)lower bounds are: Γ − (𝑟𝑙𝑜𝑤) = Γ + (𝑙𝑙𝑜𝑤) =𝜎𝜎+√
Γ𝑙𝑜𝑤 =
𝑀
𝑀

r

𝑁 −𝑀
+𝜎
𝑁 −1

(4)

where + and − superscripts denote additive and deductive manipulation and 𝑙 and 𝑟 denote whether
the bias points are on the left or right of the actual mean. The approximate upper bounds are:
Γ + (𝑙ℎ𝑖𝑔ℎ) = Γ − (𝑟ℎ𝑖𝑔ℎ) =r
Γℎ𝑖𝑔ℎ = 𝑚𝑎𝑥 (𝜎 2,

2𝜎
𝜎
+√
𝑀
𝑀

𝑁 −𝑀
+ 2𝜎)
𝑁 −1

(5)

3.1.4 Identifying Normal Range of 𝐴𝐷 (𝑇 ). Let the standard deviation of the 𝐴𝐷 (𝑇 ) samples in the
training set be denoted as 𝜎𝐴𝐷 (𝑇 ) . Given that the 𝐴𝐷 (𝑇 ) metric is stable over history as evident
from earlier results, the normal range can be a residual margin around the historical values. The
margins can be a parameterized by a scalar factor 𝛾 ∈ (0, 3] of the standard deviation of the 𝐴𝐷 (𝑇 )samples, such that the upper threshold for 𝐴𝐷 (𝑇 ) at the 𝑇 -th window in the testing set i given by:
𝑡𝑒𝑠𝑡
𝐴𝐷𝑚𝑎𝑥
(𝑇 ) = 𝐴𝐷ℎ𝑖𝑠𝑡 (𝑇 ) + 𝛾𝜎𝐴𝐷 (𝑇 )and the corresponding lower threshold is:
𝑡𝑒𝑠𝑡
𝐴𝐷𝑚𝑖𝑛
(𝑇 ) = 𝐴𝐷ℎ𝑖𝑠𝑡 (𝑇 ) − 𝛾𝜎𝐴𝐷 (𝑇 )Please note that, it is possible that smaller 𝛿𝑎𝑣𝑔 (stealthy) or smaller 𝜌𝑚𝑎𝑙 values (isolated or small
scale adversaries) will not create enough deviation for the 𝐴𝐷 (𝑇 ) to fall outside the 𝐴𝐷 𝑛𝑜𝑟𝑚 ∈𝑡𝑒𝑠𝑡 , 𝐴𝐷 𝑡𝑒𝑠𝑡 ]] range. However, such smaller attacks will also not drastically affect the consensus[𝐴𝐷𝑚𝑖𝑛𝑚𝑎𝑥
measures (mean and standard deviation). As mentioned earlier, the one of the purpose of the anomaly
detection phase in our framework is to provide an unbiased instantaneous mean and median absolutedeviation to the trust model across either a high 𝜌𝑚𝑎𝑙 or 𝛿𝑎𝑣𝑔 values. Therefore, successful detectionof incidence and type of attack, is only required when attacks are strong enough to influence
𝑡𝑒𝑠𝑡 , 𝐴𝐷 𝑡𝑒𝑠𝑡 ]] isthe consensus significantly. To this end, the simple definition of 𝐴𝐷 𝑛𝑜𝑟𝑚 ∈ [𝐴𝐷𝑚𝑖𝑛𝑚𝑎𝑥sufficient. If attacks are not detected, however, at the same time they do not affect the consensus ina significant way. In such cases, the trust scoring model proposed later will be still successful indetecting the compromised meters regardless.
3.1.5 Coarse Grained Detection Criterion for Presence of Organized Data Falsification. From
Fig. 6(a), it is easy to conclude that for all attack types, the 𝐴𝐷 𝑜𝑏𝑠 is larger than the 𝐴𝐷 𝑛𝑜𝑟𝑚 learned
from the training phase. The 𝐴𝐷 𝑛𝑜𝑟𝑚 act as a safe margin for the invariant, and anything outsideof it is inferred as an orchestrated attack that needs a location and scale correction as a response.
As long as the attack continues the 𝐴𝐷 (𝑇 ) remains higher than the normal values.

𝐴𝐷 𝑜𝑏𝑠 (𝑇 ) :∈ 𝐴𝐷 𝑛𝑜𝑟𝑚> 𝐴𝐷 𝑛𝑜𝑟𝑚

No Organized Falsification ;Organized Falsification Occurred;(6)

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:14

Bhattacharjee et al.

3.1.6 Determining the Type of Data Falsification Attack. From the above, we conclude that an authentic change in the observed distribution may cause the mean consumption to increase or
decrease but 𝐴𝐷 𝑜𝑏𝑠 remains the same as compared to the historical range of values 𝐴𝐷 𝑛𝑜𝑟𝑚 =[𝐴𝐷𝑚𝑖𝑛 , 𝐴𝐷𝑚𝑎𝑥 ]. An additive attack causes both HM and AM of consumption to increase but also
causes 𝐴𝐷 𝑜𝑏𝑠 to increase compared to its normal range. This way a legitimate versus a malicious
increase in the data can be distinguished. A deductive attack causes the HM and AM of mean consumption to decrease and causes 𝐴𝐷 𝑜𝑏𝑠 to increase from the historical range. Similarly, camouflage
and conflict attacks do not have much change in the AM of the consumption but triggers a large
increase in the 𝐴𝐷 𝑜𝑏𝑠 (𝑇 ). In this way, it is possible to infer which type of data falsification has
been launched. A summary of the above discussion to determine the presence and type of attack is
given in Table 1.
Table 1. Concluding Security EventsAD
Increased
Increased
Increased
Decreased
Increased
Same

3.2

AM
Increased
Decreased
Same
Increased
AnyDon’t CareHM
Increased
Decreased
Decreased
Increased
AnyDon’t Care

GM
Increased
Decreased
Decreased
Increased
AnyDon’t Care

Conclusion
Additive
Deductive
Camouflage
Additive Low
Conflict
No AttackAttack Context Response Metrics

Given that an attack has been inferred that bias the instantaneous (hourly) consensus measures, weneed a consensus correction scheme. The knowledge of the attack type could be leveraged to unbias
the consensus measures. This is because, the manner and extent to which different instantaneousmeans such as, 𝐻 𝑀 (𝑡), 𝐺𝑀 (𝑡) and 𝐴𝑀 (𝑡) and corresponding standard deviations get biased bydifferent attack types, is unique (from Property 1,2,3 and their corollary). Alternatively, one may be
tempted to use the historical values of mean and standard deviation on the corresponding hours of
the 𝑇 -th day in the previous years. However, as already shown in Fig. 5, the mean values on thesame days on successive years vary greatly and hence historical values are not reliable. Therefore,
it is required that for a successful statistical detection, a robust mean (location consensus) and arobust measure of dispersion is calculated.
3.2.1 Estimation of Robust Mean as a Response:. For the calculation of robust mean, we need toreconstruct the actual mean from the observed mean using knowledge of how each attack typechanges these means. Additionally, the extent of change triggered in the 𝐴𝐷 (𝑇 ) metric also depends
on 𝛿𝑎𝑣𝑔 and/or 𝜌𝑚𝑎𝑙 . Hence, an adjusted robust mean helps to estimate an approximate value closer
to the original mean. Note that, the highest possible 𝛿𝑎𝑣𝑔 is lesser in deductive attacks than additive
ones because the feasible margin of deductive false data is bounded by zero. As the margins of false
data or compromised fraction increases, the observed consensus gets more and more biased. To
prevent this, we ought to have a consensus correction step. Otherwise statistics based trust models
will not be able to identify the compromised meters.
From the statistical observations, we see that the 𝐻 𝑀 (𝑡) is more proximate to the actual AM
than the observed 𝐴𝑀 (𝑡), under the effect of additive attacks, due to a slower increase in HM as
opposed to AM. However, the 𝐻 𝑀 (𝑡) itself is not a robust mean consensus, if either 𝛿𝑎𝑣𝑔 or 𝜌𝑚𝑎𝑙 islarge. Therefore, we propose to use 𝜇𝑅 (𝑡) = 𝐻 𝑀 (𝑡) −𝐴𝐷 (𝑡) as the estimated robust mean aggregate
under additive attacks, which is closer to the original instantaneous arithmetic mean. Therefore, we
deduct the 𝐴𝐷 (𝑡) since it is the index of the extra deviation caused by the attacks. As an example,
in Table 3, for additive attack 𝐻 𝑀 − 𝐴𝐷 = 7.92 − 0.76 = 7.16, which is very close the actual AM
value of 7.053.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:15

In contrast, for deductive attacks, due to 𝐻 𝑀 ≤ 𝐺𝑀 ≤ 𝐴𝑀 property, the 𝐻 𝑀 (𝑡) is even lesser
than the already biased 𝐴𝑀 (𝑡). But, 𝐺𝑀 (𝑡) + 𝐴𝐷 (𝑡) is more robust than AM for deductive attacks,
and results show that it is a good approximation to the actual mean. From the example in Table 3,
it can be verified that for deductive attack, the robust mean 𝜇𝑅 = 6.29 + 0.79 = 7.08 is closer to theactual mean 7.05. For camouflage attacks, AM is the most robust and hence 𝜇𝑅 is set as the AM. For
conflict attacks, 𝐺𝑀 is an intermediate robust choice as it shows relative stability to both partially
positive and negative outliers. The recommended mean correction for each attack type is tabulated
in Table 2.
Security Incident
Additive
Deductive
Camouflage
Conflict
No Attack

Choice of 𝜇𝑅 (𝑡 )
HM-AD
GM+AD
AM
GM
AM

Table 2. Robust Mean Responses

Parameter

ActualAdd

Deduct

Camo

Conf

AM

7.053

8.68

6.67

7.04

7.26

GM

6.860

8.35

6.29

6.65

6.89

HM

6.680

7.92

5.88

6.02

6.11

𝐴𝐷

0.373

0.76

0.79

1.02

1.15

Table 3. Attacks on Various Means in Texas Dataset

3.2.2 Estimating a Median Absolute Deviation as a response:. If the presence of an attack is discovered from the anomaly detector, then we know that the instantaneous standard deviation of theobserved data is biased. The 𝜎 (𝑡) in the testing set under attacks will increase regardless of the typeof data falsification attack (except for low additive attacks). Therefore, a directional correction of
the standard deviation is not possible like 𝜇𝑅 (𝑡) based on the attack types. While standard deviation
is a very popular measure of dispersion (scale parameter) to build proximity distributions, we argue
the use of a less common statistical measure of dispersion known as ‘Median Absolute Deviation’(MAD), which is defined as follows:
For a univariate power consumption data at any time 𝑡, 𝑝^(𝑡) = {𝑝 1 (𝑡), · · · , 𝑝 𝑖 (𝑡), · · · , 𝑝 𝑁 (𝑡)},the data’s median is defined as 𝑝˜(𝑡) = 𝑀𝑒𝑑𝑖𝑎𝑛(𝑝^(𝑡)). The median absolute deviation is defined as:
𝑀𝐴𝐷 (𝑡) = 𝑀𝑒𝑑𝑖𝑎𝑛(|𝑝 𝑖 (𝑡) − 𝑝˜(𝑡)|).
The MAD is a much more robust measure of dispersion (or more robust scale parameter) comparedto the traditional standard deviation because MAD is more robust and remains less affected due
to outliers (reducing false alarms under no attacks) and extreme values (under stronger marginattacks) compared to standard deviation. This is because measures such as standard deviation are
derived from variance which uses squares of the difference between those outlying datapoints
and the true mean. Squares produce very high values when datapoints are greater than 1, thus
causing an unwarranted increase in the standard deviation. This is the cause of increased missed
detection under attacks and increased false alarms under no attacks. Therefore, we depart from thetraditional use standard deviation for characterizing the probability distribution of the proximity
of individual smart meters data with the consensus.
The measured 𝑀𝐴𝐷 (𝑡) of the historical time slots, before the inference of orchestrated attack istherefore embedded as the robust measure of dispersion or the robust scale parameter in the trustmodel in the event of an attack indication from the anomaly detector. As shown later, the mean
correction, robust scale parameter as median absolute deviation and attack probability time ratio
embedding facilitates quick detection, this approximation works well.
Both robust mean and median absolute deviation bias correction improves results significantly
compared to the preliminary version of this work in [2]. The failure points for higher 𝛿𝑎𝑣𝑔 values
completely disappear. While, the above adjustment of mean location parameter and median absolutedeviation may not always be perfectly close to the actual mean and median deviation, our results
show that classification performance is much better under these approximate bias corrections
rather than just using the exact harmonic mean and standard deviation as the location and scaleparameters as done in our preliminary work [2].
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:16

3.3

Bhattacharjee et al.

Attack Context Embedded Relative Entropy based Trust ModelWe pursue a light weight learning approach for identifying compromised smart meters that launchdata falsification. The prior historical data set is considered as the authentic distribution of power
consumption. From the historical data set, a true proximity distribution denoted as 𝑿 𝑖 for each smart
meter is generated based on its reported consumption’s proximity to the arithmetic mean of theauthentic data set. Since the authentic historical data set is attack-free, the measure of consensus isarithmetic mean (AM), denoted by 𝜇 (𝑡) and the standard deviation is 𝜎 (𝑡).
In the observed data set under test, we define 𝜇𝑅 (𝑡) and 𝑀𝐴𝐷 𝑅 (𝑡) as the robust mean and medianabsolute deviation of the observed distribution based on the inferred security incident. In the testing
set, a current proximity distribution, denoted by 𝒀 𝑖 , for each smart meter 𝑖 is calculated based on the𝑖 (𝑡) to 𝜇 (𝑡). In the absence of a detected security
proximity of its reported consumption data 𝑝𝑟𝑒𝑝
𝑅
incident, the robust mean and median absolute deviation equals 𝜇 (𝑡) and 𝜎 (𝑡) (like in the historicalset). However, when an attack is present, the 𝜇𝑅 (𝑡) is set according to Table 2 based on the inflictedattack type and strategy. This way the attack context is embedded via the appropriate robust mean
as a response to the detected attack context. Similarly, the 𝑀𝐴𝐷 𝑅 (𝑡) is set to the historical medianabsolute deviation if there is an indication of an attack.
If the true distribution is very different from the current distribution, it is an indication that
this meter’s data is unusually different and this difference in the probability space is measured as
Kullback-Leibler divergence (also called KL Distance) which measures the relative entropy between
the two distributions. The higher the divergence between the two distributions, the more theindication of anomalous behavior. The trust of a meter is calculated at the end of the frame 𝐹 (indays). The total number of observations over the time frame is given by 𝑇 𝑆. For the relative entropy
trust model, we had time frames of length 𝐹 = 10 days and 𝐹 = 30 days. Therefore, the number oftime slots monitored in the frame of observation is 𝑇 𝑆 = 𝐹 ∗ 24.
3.3.1 True and Current Proximity Distributions as Meter Evidence:. We introduce a binary randomvariable 𝑋 𝑖 = {0, 1} for each meter 𝑖, for 𝑖 = 1, . . . , 𝑁 , which acts as a historical reference distribution.
𝑖 (𝑡) at time 𝑡 from meter 𝑖 falls within one standard deviation of
If the historical data reported 𝑝^𝑟𝑒𝑝𝑖
𝜇 (𝑡), then 𝑋 = 1, else 0. Formally,𝑖𝑋 (𝑡) =

10𝑖 (𝑡) ∈ {𝜇 (𝑡) ± 𝜎 (𝑡)};if 𝑝^𝑟𝑒𝑝otherwise(7)

where 𝑋 𝑖 (𝑡) follows a Bernoulli distribution with parameter 𝑟 , that is the probability of 𝑋 𝑖 = 1 is 𝑟 ,and the probability of 𝑋 𝑖 = 0 is 1 − 𝑟 .
ÍSuppose, 𝑆 (𝑋 ) be the variable that denotes the number of successes, that is 𝑆 (𝑋 𝑖 ) = 𝑇𝑡 =𝑆1 𝑋 𝑖 (𝑡).
Let 𝑆 (𝑋 ) = 𝑘 be the observed value of the variable for any meter 𝑖, such that number of success inÍthe true distribution is 𝑆 (𝑋 𝑖 ) = 𝑇𝑡 =𝑆1 𝑋 𝑖 (𝑡) = 𝑘.
Similarly, we have a binary random variable 𝑌 𝑖 for the current distribution of each smart meter,
such that the probability of 𝑌 = 1 is 𝑞 and the probability of 𝑌 = 0 is 1 − 𝑞. In this case, theÍnumber of successes is denoted by a variable 𝑅(𝑌 𝑖 ) = 𝑇𝑡 =𝑆1 𝑌 𝑖 (𝑡). Let 𝑅(𝑌 ) = 𝑗 denote the numberof successes for any such meter 𝑖 such that number of successes in the current distribution isÍ𝑅(𝑌 𝑖 ) = 𝑇𝑡 =𝑆1 𝑌 𝑖 (𝑡) = 𝑗. If an attack has been detected through the anomaly detection phase, thenthe robust mean 𝜇𝑅 (𝑡) and the robust standard deviation 𝜎𝑅 (𝑡) is calculated, and the 𝑌 𝑖 is calculated
based on them. In this way attack context is embedded such that 𝑌 𝑖 remains unbiased from theeffects of orchestrated attacks. However, in the absence of any detected attacks, 𝜇𝑅 (𝑡) = 𝜇 (𝑡).
Formally, the current proximity distribution is given by:
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure
𝑌 𝑖 (𝑡) =10𝑖 (𝑡) ∈ {𝜇 (𝑡) ± 𝑀𝐴𝐷 (𝑡)};if 𝑝𝑟𝑒𝑝𝑅
𝑅
otherwise

1:17

(8)

Intuitively, in absence of attacks, the distribution of 𝑌 should be very close to 𝑋 . On the contrary,
the two distributions should show a difference when an attack is present.
3.3.2 Estimating Parameters of True and Current Proximity Distributions:. Next, we need to estimate the parameters 𝑟 and 𝑞 for corresponding distributions 𝑋 𝑖 and 𝑌 𝑖 . An obvious estimate is theminimum variance unbiased estimate (frequentist), which is the sum of all successes divided by the
total number of observations 𝑇 𝑆. However, this approach may cause 𝑟 = 0, 𝑞 = 0, or 𝑟 = 1, 𝑞 = 1,
for which the relative entropy (see Eqn. 15) is undefined. Moreover, frequentist probability unbiased estimator makes sense only if there is a large set of observations [24]. However, since ourtrust model works on a shorter horizon of time (typically on a few days or monthly basis), suchapproaches are improper. Hence, we need to accommodate a Bayesian approach for estimation of 𝑟
and 𝑞, so it is theoretically sound and mathematically tractable. Since the following is true for all
meter’s 𝑖, we drop the suffix 𝑖 from the notational simplicity.
1
First, we estimate the parameter of 𝑟 . We prove that the estimated probability 𝑟 = 𝑇𝑘+
𝑆+2 , where
𝑘 is the realization of the total number of successes observed. Thus 𝑆 (𝑋 ) = 𝑘 follows a binomial
distribution with parameter 𝑟 .
Hence, the probability of observing exactly 𝑘 successes out 𝑇 𝑆 times, given the probability ofsuccess of each trial was 𝑟 , is given by, 
𝑇𝑆 𝑘
𝑃 (𝑆 (𝑋 ) = 𝑘 |𝑟 ) =𝑟 (1 − 𝑟 )𝑇 𝑆−𝑘(9)𝑘
The Bayesian posterior estimate of 𝑟 , based on prior 𝑇 𝑆 observations by Bayes theorem, is given as:
𝑃 (𝑋 (𝑇 𝑆 + 1)), 𝑆 (𝑋 ) = 𝑘)
𝑃 (𝑋 (𝑇 𝑆 + 1) = 1|𝑆 (𝑋 ) = 𝑘) =(10)
𝑃 (𝑆 (𝑋 ) = 𝑘)
The denominator is the marginal probability of 𝑃 (𝑆 (𝑋 ) = 𝑘) marginalized over all possible
outcomes of 𝑟 . Hence,∫1  𝑇𝑆 𝑘
𝑃 (𝑆 (𝑋 )) =𝑟 (1 − 𝑟 )𝑇 𝑆−𝑘 𝑓 (𝑟 )𝑑𝑟
(11)
𝑘
0

Assuming conditional independence between 𝑆 (𝑋 ), 𝑟 and 𝑋𝑖 (𝑡 + 1) of the prior and likelihood
can be solved as:∫1
𝑃 (𝑋 (𝑇 𝑆 + 1) = 1|𝑟 )𝑃 (𝑆 (𝑋 ) = 𝑘 |𝑟 )𝑑𝑟(12)
𝑃 (𝑋 (𝑇 𝑆 + 1)), 𝑆 (𝑋 ) = 𝑘) ⇒ =0

Since there is no prior information on 𝑟 , we assume a non-informative prior such that 𝑓 (𝑟 ) = 1,
for Eqn. (11) and Eqn. (12). Plugging in Eqn. (11) and Eqn. (12) into Eqn. (10), it can be shown that:
𝑃 (𝑋 (𝑇 𝑆 + 1) = 1|𝑆 (𝑋 ) = 𝑘) =Similarly,

𝑘 +1=𝑟
𝑇𝑆 + 2

(13)

𝑗 +1
(14)
𝑇𝑆 + 2
It can be verified that 𝑟, 𝑞 ≠ 0, 1. Hence, the logarithms of distributions 𝑋 𝑖 and 𝑌 𝑖 for the i-th
(𝑖 )
(𝑖 )
smart meter, (described in terms of probability parameters 𝑟 (𝑖) = 𝑘𝑇 𝑆++21 and 𝑞 (𝑖) = 𝑗𝑇 𝑆++21 ), in Eqn (15)is always defined and exist even as 𝑘 (𝑖) = 0 or 𝑗 (𝑖) = 0.
𝑞=

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:18

Bhattacharjee et al.

3.3.3 Kullback-Leibler Divergence based Scoring and Classification:. We adopt the Kullback Leibler
divergence to measure the difference between the historical distribution 𝑋 𝑖 and the observed
distribution 𝑌 𝑖 for a smart meter. Note that 𝑋 𝑖 and 𝑌 𝑖 are not consumption patterns but a trend
on proximity to the middle quartile. Subsequently, the KL distance is transformed into a trust
value between 0 and 1 by passing it through an inverse square root function that produces linearly
separable trust values between compromised and honest meters via a single threshold.
The KL distance between two distributions X and Y for a smart meter 𝑖, is given by:
𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ) = (1 − 𝑟 (𝑖) ) × 𝑙𝑛

 1 − 𝑟 (𝑖) 
1 − 𝑞 (𝑖)+ 𝑟 (𝑖) × 𝑙𝑛

 𝑟 (𝑖) 
𝑞 (𝑖)

(15)

The 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ) is a positive real value that indicates the divergence between the observed andthe historical proximity distribution. Hence, the smaller the value of 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ) the better it is interms of being trustworthy and the larger it becomes the less trustworthy it becomes since a larger
divergence indicates a mismatch between the true and observed proximity distributions. Given
this, the final trust value 𝑄 𝑖 of a smart meter 𝑖, is given by:
𝑄𝑖 =

1
p
1 + 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 )0 ≤ 𝑄𝑖 ≤ 1(16)

The rationale of Eqn. 16, is a scaling function that scales the lowest value in 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ) a trust scorethat is closest to 1 while the highest value in 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ) gets the exponentially lower trust scorewith increasing 𝐷𝑖 (𝑋 𝑖 ||𝑌 𝑖 ). The exponential nature ensures a risk aversion towards progressively
increasing distance in the probability space.
Limitation of Coarse Grained Anomaly Detection based Trust Model: Since the coarse
grained anomaly detection has an observation granularity of 24 hours, it is not suitable for detectionof opportunistic omission and on-off strategies that are discontinuous and sparsely distributed over
the time domain. Therefore, an anomaly monitoring metric with a daily time granularity such as
𝐴𝐷 (𝑇 ) will not be sensitive and fail to provide the early indication of the attack’s presence that isnecessary to embed in the attack context.
Apart from failing to identify the incidence, type, and robust consensus, there will be anotherhurdle for the subsequent pipelined trust model. Since in most of the time slots, there are no attacks
from the meters, the evidence against each meter will have reduced sensitivity when observed
over a time frame. This is because the probabilities (modeled by evidence) in information theoretic
measures (such as KL Divergence) are steady state long term measures. When observed over thetime frame, the detection of meters will be delayed due to a lesser change in evidence counts.
However, if the trust model is made aware of the incidence of such non-continuous strategies andthe approximate start and stop times of such attacks, the evidence against meters collected on thosespecific slots may be weighted as more important (while others as less important). This would
facilitate quicker classification of such meters while running the trust scoring model throughinformation theoretic measures. This is achieved by calculating the fraction of the time framethat a meter was under such attack strategies (defined later as attack probability time ratio). This
motivates the need for a fine grained anomaly detection phase that runs in parallel with coarse
grained anomaly detection metric and associated attack context embedding.
4

FORMAL SECURITY ANALYSIS

We do the theoretical analysis in terms of attack parameters to formally specify the impact of
attacks on the effectiveness of the defense method. Specifically, we assess the security level of ourmechanism by taking into account what an intelligent adversary might do to bypass the invariant
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:19

based anomaly detection and the compromised meter detection trust model. Here, we also show
closed form theoretical expressions of our observations that will help generalize our framework.
Theoretical Analysis of Deviation in 𝐴𝐷 (𝑇 ) under attacks: As a part of the theoretical security analysis of the anomaly detection phase, we provide the closed form approximate estimateddeviation in the anomaly detection metric 𝐴𝐷 (𝑇 ). This can be estimated by calculating the expected
harmonic mean and arithmetic mean, given an attack type, 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 . Below we provide anestimation of the harmonic mean followed by the arithmetic mean. Finally, we show how closely
the theoretical result from the closed form expression matches the experimental result to proveaccuracy of analysis. We also show that change in 𝐴𝐷 (𝑇 ) observed experimentally also matches
the theoretical analysis. Because our detector uses the values in a box-cox transformation domain,
we have carefully estimated it for real data values and found their box cox equivalents on thetransformed scale.
Í𝑁𝑖
𝑖=1 𝑃𝑟𝑒𝑝 (𝑡)Í24

𝑡 =1 𝑁𝑜𝑟 (𝐴𝑀𝑏𝑎 (𝑡))
(17)
𝑁
24
Similarly, 𝑁𝑜𝑟 (𝐻 𝑀𝑏𝑎 (𝑇 )) and 𝑁𝑜𝑟 (𝐺𝑀𝑏𝑎 (𝑇 )) can be calculated. For brevity, we drop the 𝑇 fromthe following analysis. Since the closed form expression of the harmonic mean does not exist,
we first estimate the new geometric mean 𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) after the attack. Then, we harness thefollowing Pythagorean equation that calculates the estimated harmonic mean from the estimatedgeometric and arithmetic means:(𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 )) 2
𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ) ≈(18)
𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 )𝑏𝑎

𝑁𝑜𝑟 (𝐴𝑀 (𝑡)) =;𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 (𝑇 ) =where 𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ) and 𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ) denote the estimated HM and AM values after an attack.
Estimation of the Geometric Mean after attack: Let 𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 ) denote the geometric meanof a power consumption data before attack in the original data domain and is defined by:
𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 ) =

𝑁
Ö

𝑖
𝑃𝑟𝑒𝑝

 𝑁1

=

p
𝑁

(𝑃 1 × 𝑃 2 · · · 𝑃 𝑀 × 𝑃 𝑀+1 · · · × 𝑃 𝑁 )

(19)

𝑖=1

Similarly, let the estimated geometric mean after additive attack from 𝜌𝑚𝑎𝑙 = 𝑀/𝑁 meter and𝛿𝑎𝑣𝑔 in the original data domain be denoted as 𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) such that:q
𝑁(20)
𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) = (𝑃 1 + 𝛿𝑎𝑣𝑔 ) × (𝑃 2 + 𝛿𝑎𝑣𝑔 ) · · · × (𝑃 𝑀 + 𝛿𝑎𝑣𝑔 ) × (𝑃 𝑀+1 ) × · · · × (𝑃 𝑁 )Now we need to convert each 𝑃 𝑖 + 𝛿𝑎𝑣𝑔 term into a multiplier of 𝑃 𝑖 . Let the ratio between the 𝛿𝑎𝑣𝑔
and the actual data from the 𝑖 − 𝑡ℎ meter before attack 𝑃 𝑖 be given by a dummy variable:
𝛼𝑖 =

𝛿𝑎𝑣𝑔
𝑃𝑖

(21)

Since 𝑃 𝑖 is a completely random physical quantity, we will need to characterize the 𝛼 variable as aproperty that is shared across datapoints under an attack.
From the studies, we know that for the power consumption distribution, most of the data points
are within the first standard deviations from the mean (say 𝑃). For the Irish and Texas dataset, more
percentage of datapoints (70%) are lesser than the mean 𝑃 compared to percentage of data points
greater than the mean (30%) on average. While the 30% values are lesser and greater than the meancancel the effect of each other on the estimation of 𝑃 𝑖 , the remaining fraction of samples represents
an imbalance factor (say ∇ = 0.40). Since these fraction of samples are lesser than the arithmetic
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:20

Bhattacharjee et al.

mean 𝑃, a corrective factor of ∇ ∗ 𝜎 should be deducted from the 𝑃 to adjust for the approximate
estimated value of a 𝑃 𝑖 . Therefore, we can re-write the 𝛼 𝑖 as:𝛿𝑎𝑣𝑔
𝛼=
𝑃 − ∇𝜎p𝑁
𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (𝑃 1 + 𝛼 .𝑃 1 ) × (𝑃 2 + 𝛼 .𝑃 2 ) · · · × (𝑃 𝑀 + 𝛼 .𝑃 𝑀 ) × (𝑃 𝑀+1 ) × · · · × (𝑃 𝑁 )p𝑁𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼)𝑃 1 × (1 + 𝛼)𝑃 2 · · · × (1 + 𝛼)𝑃 𝑀 × (𝑃 𝑀+1 ) × · · · × (𝑃 𝑁 )p𝑁𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼) 𝑀 × 𝑃 1 × 𝑃 2 · · · × 𝑃 𝑀 × (𝑃 𝑀+1 ) × · · · × (𝑃 𝑁 )p𝑁𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼) 𝜌𝑚𝑎𝑙 ∗𝑁 × 𝑃 1 × 𝑃 2 · · · × 𝑃 𝜌𝑚𝑎𝑙 ∗𝑛 × (𝑃 𝜌𝑚𝑎𝑙 ∗𝑛+1 ) × · · · × (𝑃 𝑁 )p𝑁𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼) 𝜌𝑚𝑎𝑙 ∗𝑁 × 𝑃 1 × 𝑃 2 · · · × 𝑃 𝜌𝑚𝑎𝑙 ∗𝑛 × (𝑃 𝜌𝑚𝑎𝑙 ∗𝑁 +1 ) × · · · × (𝑃 𝑁 )p𝑁𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼) 𝜌𝑚𝑎𝑙 𝑃 1 × 𝑃 2 · · · × 𝑃 𝑀 × (𝑃 𝑀+1 ) × · · · × (𝑃 𝑁 )From Eqn. 19, the above reduces to the following:
𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ (1 + 𝛼) 𝜌𝑚𝑎𝑙 𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 )𝛿𝑎𝑣𝑔  𝜌𝑚𝑎𝑙
𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) ≈ 1 +
𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 )(22)
𝑃 − ∇𝜎Plugging in the real values of 𝜎, ∇, 𝜌𝑚𝑎𝑙 , 𝛿𝑎𝑣𝑔 and 𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 ), we obtain the estimated theoreticalgeometric mean after the attack as 𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ) = 410, while the actual measured geometric mean
after the attack was recorded as 𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑥𝑝𝑎𝑎 ) = 390. This indicates that this is a reasonably close
approximation. Now the next step is to calculate 𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ) to plug it in Eqn. 18 for estimationof the new harmonic mean 𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ).
Estimation of AM after attack: Let the 𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ) denote the arithmetic mean attack after
attack. For the following estimation, assume the attack to be additive. Similarly, this method could
be used to estimate other attack types. Given the 𝜌𝑚𝑎𝑙 = 𝑀/𝑁 is the fraction of compromised
meters and 𝛿𝑎𝑣𝑔 is the average falsification margin per meter, then the estimated attacked arithmetic
mean is under additive attack is:
𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ) = 𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 ) + 𝜌𝑚𝑎𝑙 ∗ 𝛿𝑎𝑣𝑔
(23)
Estimation of HM after attack: The Eqn. 22 and Eqn. 23 can be plugged in the following:
𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ) ≈(𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 )) 2
𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 )(24)

Estimation of Box-Cox Equivalents of Means: Let the 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 (𝑇 ), 𝜆) denote the boxcox equivalent of the mean before attack in the normal scale such that:(𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 (𝑇 )) 𝜆 − 1(25)
𝜆Similarly, 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐻 𝑀 𝑏𝑎 (𝑇 ), 𝜆), and 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 (𝑇 ), 𝜆) are corresponding box-cox equivalentvalues of harmonic and arithmetic means before the attack. Similarly, the box-cox equivalent valuesof them after attack 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ), 𝜆), 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 ), 𝜆), 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ), 𝜆), can beeasily estimated.
𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 (𝑇 ), 𝜆) =Final Estimation of 𝐴𝐷 (𝑇 ) after attack: Note that the box-cox equivalent of the arithmetic
mean gives a slightly different answer compared to the arithmetic mean of data in a powertransformation scale (the experimental result). Let the difference be 𝜅 = |𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ), 𝜆) −𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 ), 𝜆)|. The estimated arithmetic, geometric, and harmonic means calculated over
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:21

box-cox transformed arguments (what our method actually implements), after the additive attack
is given by the following:
𝑒𝑠𝑎𝑎

𝐴𝑀

= 𝐴𝑀

𝑏𝑎

+ 𝜅;

𝑒𝑠𝑎𝑎

= 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 );

𝐺𝑀

𝑒𝑠𝑎𝑎

𝐻𝑀

= 𝐵𝑜𝑥 (𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ) (26)

For the estimation of arithmetic mean, the estimation of change (𝜅) will result in a closer approximation compared to direct box-cox calculation for a given 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 . Let be the value of the
𝑒𝑠𝑎𝑎
𝑒𝑠𝑎𝑎
𝐴𝐷 (𝑇 ) metric after the attack be 𝐴𝐷 𝑒𝑠𝑎𝑎 (𝑇 ) = |𝐻 𝑀
− 𝐴𝑀|. Thus, The expected deviationin the 𝐴𝐷 (𝑇 ) metric after an attack of 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 for additive attacks is given by:
𝐸 (Δ𝐴𝐷 (𝑇 )) = |𝐻 𝑀𝑏𝑎𝑏𝑎

− 𝐴𝑀 | − |𝐻 𝑀

𝑒𝑠𝑎𝑎

− 𝐴𝑀

𝑒𝑠𝑎𝑎

|

(27)

The theoretical deviation in the 𝐴𝐷 (𝑇 ) metric for a 𝜌𝑚𝑎𝑙 = 0.40 and 𝛿𝑎𝑣𝑔 = 800W is 0.553. For
the same attack the experimental result shows the change of 𝐴𝐷 (𝑇 ) to be 0.712. This indicates areasonable approximation as well as the positive magnitude of change. Additionally, the theoreticalvalue shows a increase in the 𝐴𝐷 (𝑇 ) which is also seen in the experimental result.
Table 4. Estimation Accuracy of Invariants with Irish Dataset
Parameter
𝑒𝑠𝑎𝑎
𝐴𝑀
𝑒𝑠𝑎𝑎
𝐻𝑀
𝐴𝐷 𝑒𝑠𝑎𝑎 (𝑇 )𝐸 (Δ𝐴𝐷 (𝑇 ))Experimental
14.5245
11.81132.713+0.712

Theoretical
14.25711.7032.554+0.553

Optimal Evasion 𝛿𝑎𝑣𝑔 against Anomaly Detection Invariants: For an optimal evasion of ouranomaly detection step, the adversary would want to use the maximum 𝛿𝑎𝑣𝑔 , which creates a
deviation in the invariants, that is just within the designed safe margin. In practice, since theadversary does not know the current 𝐴𝐷 (𝑇 ) value (since he cannot possibly control 100%) of themeters, he relies on the historical 𝐴𝐷 (𝑇 ), which can be possibly known the adversary through adatabase hack. Therefore, the adversary would ensure that given its attack type, and the fraction ofcompromised meters, the 𝛿𝑎𝑣𝑔 , should be such that the following condition satisfies:(28)|𝐴𝐷 𝑒𝑠𝑎𝑎 (𝑇 ) − 𝐴𝐷ℎ𝑖𝑠𝑡 (𝑇 )| < 0.75 ∗ 𝜎𝐴𝐷 (𝑇 )Specifically, expanding the Eqn. 26, we get the theoretical expected change in the statisticalinvariants as a function of the 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 (the two key variables apart from the attack type thatchanges the in-variants). Thus, the estimated optimal evasion 𝛿𝑎𝑣𝑔 can be found by the adversary
solving the following optimization problem:
𝑒𝑣𝑎𝑠𝑖𝑜𝑛𝛿𝑎𝑣𝑔= arg max 𝑓 (𝛿𝑎𝑣𝑔 )
(29)
𝛿𝑎𝑣𝑔

s.t.
where 𝑓 (𝛿𝑎𝑣𝑔) = |𝐴𝐷 𝑒𝑠𝑎𝑎 (𝑇 ) − 𝐴𝐷

Note that 𝐻 𝑀

𝑒𝑠𝑎𝑎

and 𝐴𝑀𝑓 (𝛿𝑎𝑣𝑔 ) < 0.75 × 𝜎𝐴𝐷 (𝑇 )ℎ𝑖𝑠𝑡 (𝑇 )|=|(|𝐻 𝑀

𝑒𝑠𝑎𝑎

− 𝐴𝑀

𝑒𝑠𝑎𝑎

|) − 𝐴𝐷ℎ𝑖𝑠𝑡 (𝑇 )|𝑒𝑠𝑎𝑎

are given by the following as a function of the attack:
2
𝛿𝑎𝑣𝑔 𝜌𝑚𝑎𝑙𝑏𝑎 ) !
1
+
𝑁𝑜𝑟
(𝐺𝑀
𝑒𝑠𝑎𝑎
𝑃 −∇𝜎


𝐻𝑀
= 𝐵𝑜𝑥
𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 ) + 𝜌𝑚𝑎𝑙 ∗ 𝛿𝑎𝑣𝑔




𝑒𝑠𝑎𝑎
𝑏𝑎
𝐴𝑀
= (𝐴𝑀 + |𝐵𝑜𝑥 𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 ) + (𝜌𝑚𝑎𝑙 ∗ 𝛿𝑎𝑣𝑔 ) − 𝐵𝑜𝑥 𝑁𝑜𝑟 (𝐴𝑀 𝑏𝑎 ) |)

(30)
(31)

We can see that the above equations are a function of the 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 , which formally analyses
the effect of any attack on the statistical invariants. We have proven the approximation accuracy
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:22

Bhattacharjee et al.

of our expression in Table 5 by showing how theoretical values approximate to experimental
observations.
𝜌𝑚𝑎𝑙
20
30
40
50
60

𝑒𝑣𝑎𝑠𝑖𝑜𝑛Exp. 𝛿𝑎𝑣𝑔
400
370
350
330
320

𝑒𝑣𝑎𝑠𝑖𝑜𝑛
Theo. 𝛿𝑎𝑣𝑔
380
360
330
320
300

Theo. Evasion 𝛿𝑎𝑣𝑔
380
360
330
320
300

𝜌𝑚𝑎𝑙
20
30
40
50
60

Table 5. Evasion 𝛿𝑎𝑣𝑔 : Experiment vs Theory

Current Mean
652
684
708
736
756

𝑀𝐴𝐷 𝑒𝑣𝑎𝑠𝑖𝑜𝑛 (𝑡 )
347
356
352
357
361

Table 6. Inferred MAD at Invariant Evasion Points

Formal Estimation of Robust Mean under Attacks: For robust mean closed form derivation,
we just plug in the values of 𝑁𝑜𝑟 (𝐴𝑀 𝑒𝑠𝑎𝑎 ), 𝑁𝑜𝑟 (𝐺𝑀 𝑒𝑠𝑎𝑎 , 𝑁𝑜𝑟 (𝐻 𝑀 𝑒𝑠𝑎𝑎 ) or their box-cox transformed equivalents, (expressions derived previously) and plug into the Table 2 to find the theoreticalvalue as shown below:
𝜇𝑅𝐴𝑑𝑑𝑖𝑡𝑖𝑣𝑒 (𝑡) = 𝐵𝑜𝑥 −1 (𝐻 𝑀

− 𝐴𝐷 (𝑇 )),𝜇𝑅(𝑡) = 𝐵𝑜𝑥 −1 (𝐴𝑀

𝑒𝑠𝑎𝑎



𝐶𝑎𝑚𝑜𝑢 𝑓 𝑙𝑎𝑔𝑒

where 𝐺𝑀

𝑒𝑠𝑎𝑎

= 𝐵𝑜𝑥

𝑒𝑠𝑎𝑎

𝜇𝑅𝐷𝑒𝑑𝑢𝑐𝑡𝑖𝑣𝑒 (𝑡) = 𝐵𝑜𝑥 −1 (𝐺𝑀𝐶𝑜𝑛𝑓 𝑙𝑖𝑐𝑡

),

𝜇𝑅
, and

𝑒𝑠𝑎𝑎

𝐻𝑀

+ 𝐴𝐷 (𝑇 ))

(32)

𝑒𝑠𝑎𝑎

(33)

(𝑡) = 𝐵𝑜𝑥 −1 (𝐺𝑀!
𝛿
1 + 𝑎𝑣𝑔 ) 𝜌𝑚𝑎𝑙 𝑁𝑜𝑟 (𝐺𝑀 𝑏𝑎 )
𝑃 −∇𝜎

𝑒𝑠𝑎𝑎

)



𝑒𝑠𝑎𝑎 ) 2= 𝐵𝑜𝑥 𝑁𝑁𝑜𝑟𝑜𝑟(𝐺𝑀
𝑒𝑠𝑎𝑎
(𝐴𝑀
)

The 𝐵𝑜𝑥 −1 (.) is defined as: 𝐵𝑜𝑥 −1 (𝑥) = (𝑥 ∗ 𝜆 + 1) 1/𝜆 where 𝑥 is the value in box cox scale being
𝑒𝑠𝑎𝑎
remapped and 𝜆 is the box cox transformation parameter. The 𝐴𝑀
under camouflage is thesame as the observed arithmetic mean, since it balances out the mean by virtue of its attack type.
Condition for Successfully Evading of Meter Detection: Note that, we already proved that as𝜌𝑚𝑎𝑙 increases, our invariant criterion forces the 𝛿𝑎𝑣𝑔 to be smaller. Hence, the attacker cannot
unilaterally increase one attack parameter to arbitrarily change the median absolute deviation.
Therefore, at the theoretical evasion 𝛿𝑎𝑣𝑔 , we first present, the current median absolute deviation(under attacks) by varying from the 𝜌𝑚𝑎𝑙 from 20% to 60%, as listed in Table 6.
The trust score depends on the divergence between proximity distributions 𝑋𝑖 and 𝑌𝑖 . The
adversary has to bypass the invariant based anomaly detection to ensure that the mean and medianabsolute deviation correction does not take place. Furthermore, the adversary has to make surethat the majority of it’s compromised meter readings are within the observed (biased) mean andthe median absolute deviation (MAD) range. However, on average we say that to bypassing meter
detection reliably the following condition needs to be satisfied for a given 𝜌𝑚𝑎𝑙 .
𝑏𝑦𝑝𝑎𝑠𝑠𝛿𝑎𝑣𝑔

𝑒𝑣𝑎𝑠𝑖𝑜𝑛≤ 𝑚𝑖𝑛(𝛿𝑎𝑣𝑔, 𝑀𝐴𝐷 𝑒𝑣𝑎𝑠𝑖𝑜𝑛 (𝑡)))(34)𝑒𝑣𝑎𝑠𝑖𝑜𝑛 is 330 and the MAD
Let us look at a specific example from Table 6. For 𝜌𝑚𝑎𝑙 = 40%, the 𝛿𝑎𝑣𝑔
at that evasion 𝛿𝑎𝑣𝑔 based attack is 352. The min(330,352) is 330, which is the theoretical value
to bypass the trust model. In our experiments, for 𝛿𝑎𝑣𝑔 > 330 (Fig 17), the missed detection rate
is lower than 10%, however at when 𝛿𝑎𝑣𝑔 < 330, it starts missing meters and missed detection
becomes about 30%. This is also repeated in the Texas dataset results in Fig.14 and 15, where below
330, the missed detection becomes between 30%-40% proving correctness.

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

5

1:23

SPECIAL CASE STUDY ON FINE GRAINED ANOMALY BASED TRUST MODEL

Now we propose the customized version of our trust model that can run in parallel for effective
identification under on-off or omission attack strategies. It is important to note that the fine grained
anomaly based detection will produce different responses than the coarse grained one, and therefore
will invoke an augmented and modified version of the proposed trust model in Section 3.3 withnovel embeddings of responses produced by the fine grained anomaly based security event detector.
5.1

Fine Grained Anomaly based Security Event Detection

In this subsection, we will introduce the invariant (metric) for fine grained anomaly detection,
justify the choice of invariant, establish a detection criterion for fine grained attacks, determine
attack type, strategy, start and stop times, and calculate the attack probability time ratio.
5.1.1 Proposed Invariant. We propose a more fine-grained detection metric denoted by 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡)that is computed hourly, in contrast to 𝐴𝐷 (𝑇 ) that is computed daily. The 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) is the ratio of
the absolute difference between ‘hourly’ arithmetic and harmonic means between the previous𝑡 − 1 and current time slot 𝑡. At any time slot 𝑡, the metric is defined as:
𝐴𝐷 (𝑡 − 1)
𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) =(35)
𝐴𝐷 (𝑡)
where 𝐴𝐷 (𝑡) = |𝐻 𝑀 (𝑡) − 𝐴𝑀 (𝑡)|. The time series of the proposed metric 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 for the Texas
Dataset is shown in Fig. 7(a).

(a)

(b)

Fig. 7. (a) Time Series of 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) (b) Distribution of 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡)5.1.2 Identifying Normal Range of 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡). Fig. 7(b) shows the distribution of the proposed
𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) for the historical training dataset (2014 and 2015). It can be seen that the distribution of
𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) has a mean value of 0.998 with a standard deviation of 0.1. Very few sample 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡)𝑛𝑜𝑟𝑚 ∈ [𝐴𝐷 𝑚𝑖𝑛 , 𝐴𝐷 𝑚𝑎𝑥 ] denote thevalues lie beyond the second standard deviation. Let 𝐴𝐷𝑟𝑎𝑡𝑖𝑜
𝑟𝑎𝑡𝑖𝑜
𝑟𝑎𝑡𝑖𝑜
normal range of this fine grained 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) metric.
5.1.3 Investigating Effect of Various Attacks on 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡). For deductive attacks, we had mentioned that the decay rate of Harmonic Mean is larger compared to the decay in Arithmetic
mean given the dataset. Therefore,
𝐻 𝑀 (𝑡) − 𝐻 𝑀 (𝑡 − 1) > 𝐴𝑀 (𝑡) − 𝐴𝑀 (𝑡 − 1)
Solving the above, we get,𝐻 𝑀 (𝑡 − 1) − 𝐴𝑀 (𝑡 − 1)
<1
𝐻 𝑀 (𝑡) − 𝐴𝑀 (𝑡)=⇒ 𝐴𝐷 (𝑡 − 1)/𝐴𝐷 (𝑡) < 1 =⇒ 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) < 1.
From the above, it is clear that a deductive or omission (which is a virtual deductive attack) attack
when initiated, will cause a sharp drop in the proposed 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) metric. When the attack stops,
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:24

Bhattacharjee et al.

there will be a sharp rise in the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 metric, since the harmonic mean has to increase more than
the arithmetic mean to restore the original ratio that is very stable and 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) → 1. Therefore,
the difference between 𝐻 𝑀 (𝑡) − 𝐴𝑀 (𝑡), will be much lesser compared to 𝐻 𝑀 (𝑡 − 1) − 𝐴𝑀 (𝑡 − 1).
Since the denominator decreases when the attack stops, the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡), experiences a sharp rise.
Experimental verification of this is provided in Fig. 8.
ADratio ( 2c − 1)

| FGAT |toe𝑚𝑎𝑥> 𝐴𝐷𝑟𝑎𝑡𝑖𝑜

High

Constant

Additive ON-OFF𝑚𝑖𝑛< 𝐴𝐷𝑟𝑎𝑡𝑖𝑜

High

Constant

Ded/Camo ON-OFF𝑚𝑖𝑛< 𝐴𝐷𝑟𝑎𝑡𝑖𝑜High

Varying

Omission Attack𝑚𝑖𝑛< 𝐴𝐷𝑟𝑎𝑡𝑖𝑜

SparseDon’t Care

Omission Failure

Conclusion

Table 7. Concluding Fine Grained Security Events
Fig. 8. Omission Attack Example

Similarly, for additive attacks, harmonic means have a slower growth rate compared to thearithmetic mean. Therefore,
𝐻 𝑀 (𝑡) − 𝐻 𝑀 (𝑡 − 1) < 𝐴𝑀 (𝑡) − 𝐴𝑀 (𝑡 − 1)
Solving the above, we get
𝐻 𝑀 (𝑡 − 1) − 𝐴𝑀 (𝑡 − 1)
>1
𝐻 𝑀 (𝑡) − 𝐴𝑀 (𝑡)=⇒ 𝐴𝐷 (𝑡 − 1)/𝐴𝐷 (𝑡) > 1 =⇒ 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) > 1
From the above, it is clear that for additive attacks the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) must increase when attacks
start, while for deductive and camouflage attacks the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) must decrease.
5.1.4 Detecting Incidence of Fine Grained Attacks. The following equation is similar to the coarse
grained logic for confirming presence of opportunistic fine grained attacks.
𝑛𝑜𝑟𝑚 (𝑡)} No Attack;∈ {𝐴𝐷𝑟𝑎𝑡𝑖𝑜
𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) :
(36)
𝑛𝑜𝑟𝑚
∉ {𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡)} Fine Grained Attack
5.1.5 Determining Fine Grained Attack Types and Strategies. To reconstruct the security events
under fine grained attack strategies, we first need to record the sequence of time slots where
𝑛𝑜𝑟𝑚 (𝑡)} occurred over the observed time duration, into a vector
the event 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) ∉ {𝐴𝐷𝑟𝑎𝑡𝑖𝑜
𝐹𝐺𝐴𝑇 = {𝑡 (1), 𝑡 (2), · · · , 𝑡 (𝑐), · · · , 𝑡 (𝐶)}, where 𝑐 ∈ N is the set of first C natural numbers. The
odd and even entries of the set FGAT are represented by 𝑡 (2𝑐 − 1) and 𝑡 (2𝑐) respectively and|𝐹𝐺𝐴𝑇 | is the cardinality of this set over the time frame under observation. Additionally, let thetime difference between the pairs of odd entries and even entries be 𝑡 𝑜𝑒 = |𝑡 (2𝑐 − 1) − 𝑡 (2𝑐)|.
There are three important facets to monitor. First, the set of 𝑡 𝑜𝑒 values help distinguish between
deductive ON-OFF and omission attacks having similar signatures. Second, the cardinality of|𝐹𝐺𝐴𝑇 | is important to distinguish between the possibility of omission attack versus omission failures.
Third, whether 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) corresponding to the odd entries𝑡 = 2𝑐 − 1 in FGAT are greater than𝑚𝑎𝑥 or smaller than 𝐴𝐷 𝑚𝑖𝑛 , help differentiate between additive, deductive, and camouflage
𝐴𝐷𝑟𝑎𝑡𝑖𝑜
𝑟𝑎𝑡𝑖𝑜
data falsification types.
If the 𝑡 𝑜𝑒 is constant for all odd values of 𝑐, then there is an on-off attack. Given that 𝑡 𝑜𝑒 is constant,𝑚𝑎𝑥 , it is an additive on-off attack, while an 𝐴𝐷𝑚𝑖𝑛
if 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (2𝑐 − 1) > 𝐴𝐷𝑟𝑎𝑡𝑖𝑜
𝑟𝑎𝑡𝑖𝑜 (2𝑐 − 1) < 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡),it is an deductive on-off attack. Therefore, odd entries 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (2𝑐 − 1) helps to distinguish between
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:25

additive, deductive or camouflage attacks. Since attacks are launched and stopped at periodic
intervals, the |𝐹𝐺𝐴𝑇 | will not be singleton or sparse.
If the set of 𝑡 𝑜𝑒 = |𝑡 (2𝑐 − 1) − 𝑡 (2𝑐)| consists of variable values, the |𝐹𝐺𝐴𝑇 | is not singleton or𝑚𝑖𝑛 (𝑡), it is an omission attack (deliberate). On the other hand,sparse, and 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (2𝑐 − 1) < 𝐴𝐷𝑟𝑎𝑡𝑖𝑜
if 𝑡 (2𝑐 − 1) − 𝑡 (2𝑐) consists of variable values, |𝐹𝐺𝐴𝑇 | is singleton or sparse, the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (2𝑐 − 1) <𝑚𝑖𝑛 (𝑡) is a omission failure due to non-adversarial reasons.
𝐴𝐷𝑟𝑎𝑡𝑖𝑜
The missing data from a subset of houses at any time slot 𝑡 is perceived as a deductive attack
where actual power consumption values are replaced by null values which are lesser than actual
data. This causes the harmonic mean to decay at a rate greater than compared to the decay in thearithmetic mean. Therefore, the difference between arithmetic mean and harmonic mean at timeslot 𝑡 increases compared to the previous time slot (𝑡 − 1) with no data omission. Therefore, the𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) value between time slots 𝑡 and 𝑡 − 1 experiences a sharp decrease. As long as the degreeof omission stays same the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 is restored to normal value. When omission stops there will
be another drastic change, where the harmonic mean will grow faster than the AM, such that the
𝐴𝐷 (𝑡) decreases compared to the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡 − 1) calculated with missing data. Hence, there is a
sharp drop in the proposed 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 . This can be verified from Fig. 8.
5.2

Estimation of Attack Probability Time Ratio as a Response:

Apart from the robust consensus measures, which are required for fine grained attack strategies,
we also need another additional response that needs to be embedded into the subsequent trustmodeling step. This response is known as the attack probability time ratio.
The attack probability time ratio 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 is an indicator of the fraction of time slots that thesystem was under attack over an observed time frame. For example, for an on-off attack having an
ON period of 6 hours of attack in a day, 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 = 1/4. Therefore, the fraction of time slots withno attack is (1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 ), will be automatically considered as successes even when this meter islaunching data falsification attacks. Therefore, in the probability space, these meters will not be
further apart when there are on-off attacks versus no attacks. Hence, the time to detection of suchmeters will be significantly larger. To reduce this, we need to keep track of the 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 , and embed
this information in the trust model. Such 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 can be estimated from our designed FGAT vector,
by theÍ𝐶|𝑡 (2𝑐) − 𝑡 (2𝑐 − 1)|
𝑃𝑎𝑡𝑡𝑎𝑐𝑘 = 𝑐=1
𝑇𝑆
5.3

Trust Scoring Model with Attack Probability Time Ratio Embedding

Since on-off and omission strategies are discontinuous over time, the number of failures will not be
as high compared to the case of continuous attacks in an observed time frame. This will produce
𝑞 (𝑖) values of compromised meters which are still high and therefore proximate to the parameter𝑟 in the true distribution. Hence, the time to detection convergence of meters with missing data(omission) or discontinuous falsification of data (on-off) will be time consuming, due to lack ofevident separation in the probability space, which leads to classification errors as well.
Since the fine grained anomaly detector gives an early indication on the time slots when suchon and off attack happened (from FGAT vector), a lesser weight can be given to the number ofsuccesses observed by weighing it with the fraction of duration the system is not under attack((i.e., 1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 )) in the observed frame 𝐹 . In this manner, the time to detection of these meters
could be improved. Under these opportunistic attack strategies, which are captured in the finegrained anomaly detector, the Eqn. 14 in the trust model is modified by weight to the number ofsuccesses 𝑗. This weight is (1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 ), which prevents the value of 𝑞 to be very high even when thenumber of OFF periods is large compared to the ON period of attacks over the observed time frame
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:26

Bhattacharjee et al.

containing TS windows. Hence, due to the attack context awareness, the observed distribution 𝑞
under evidence of on-off and omission attacks (from the fine grained detector) for each meter ismodified as:(1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 ) 𝑗 (𝑖) + 1(37)𝑞 (𝑖) =𝑇𝑆 + 2
Eqn. 37, can be explained by the following: Note that the 𝑞 is the probability that 𝑌 𝑖 (𝑡) = 1,
meaning the meter 𝑖 ′𝑠 reading is falling within the robust mean and median absolute deviation.
However, in an on-off attack, there are off periods, where this compromised meter’s data is likely
to achieve a value of 1. Hence, the probability of 𝑞 over a given time frame 𝑇 𝑆 is not remarkably
different from 𝑟 . Since the probability of 𝑞 is specified by the number of successes 𝑗, a discounting
factor of 1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 is required, since these 1 − 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 time was not under attacks was a part of the
OFF period. that be counted on as the FGAT vector shows evidence of orchestrated data falsification
on selective ON periods (e.g., when prices are high/demand is high, etc.,).
The value of 𝑞 is lesser compared to a value that contributes the entire observed 𝑗 towards theprobability of success. This ensures a larger difference between 𝑞 and 𝑟 in the probability space,which facilitates quick classification that is apparent even when the attacker acts honestly inmajority of the time slots. The modification by Eqn. 37 is termed as attack probability ratio timeembedding that customizes the trust model for better and quick classification of the compromised
meters.
Some Limitations of our Approach: The relative entropy based trust model detect compromised meters only if the 𝛿𝑎𝑣𝑔 is greater than the median absolute deviation of the datasets. From theEqn. 22 and Eqn., 23, it is clear that if the 𝛿𝑎𝑣𝑔 is lesser than the 𝑀𝐴𝐷, in most time instances, the 𝑌𝑖of the attacked meters will be within that deviation and therefore be labeled as one instead of zero
more frequently. Thus, there will not be a significant change in the probability of 𝑝 (𝑌𝑖 = 1) = 𝑞 in
the attacked set. Therefore the deviation between 𝑋𝑖 and 𝑌𝑖 in the probability space, will not be evident to produce a divergence that could clearly classify the malicious meters from the honest ones.
Our studies from real datasets indicate that the 𝑀𝐴𝐷 ranges between 290𝑊 − 350𝑊 . Therefore, in
our approach the missed detection errors increase 𝛿𝑎𝑣𝑔 < 300. However, the error rates are better
than existing works across datasets as shown in the comparison in Section 5.6.
Intuitively, one solution to this limitation is to introduce multinomial evidence labels for eachmeter instead of binary labels (0,1), and then calculate the distances between the distributions in
the probability space with a similar entropy measure. However, our experience showed that this is
not enough to improve classification accuracy. This motivates the need for an alternative approach,that complements the relative entropy approach, when 𝛿𝑎𝑣𝑔 < 𝑀𝐴𝐷.
6

PERFORMANCE EVALUATION

We utilized two big datasets for the performance evaluation of our proposed method. The firstdataset is an hourly power consumption dataset from PeCan Street Project [40], containing 200
and 800 houses from a solar village near Austin, Texas for years 2014, 2015, 2016. The 2014 and2015 dataset is used for learning (training), while 2016 is used a testing set. Two 90 day periods
representing two seasons in 2016 were used as a scenario under attacks to generate the malicious
dataset. The malicious data sets were generated from the real data samples that were fed with ourthreat model with various 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 . The second dataset is a power consumption dataset from5000 houses from six micro-grid regions in Dublin, Ireland [42], which was utilized to prove thescalability and generality of our proposed approach. The datasets are publicly accessible.
The experimental section is divided into four parts: (i) First, we show some results related to thefine grained anomaly detection; (ii) Second, we show supervised classification results for 200 houses
for all attack types over various 𝛿𝑎𝑣𝑔 value (iii) Third, we show unsupervised classification (using
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:27

K-means) for 200 houses. (iv) Fourth, we show a performance evaluation in terms of classification
error rates for both 800 houses and 5000 houses using unsupervised classification, to prove thaterror rates scale well for larger micro-grids and works across different combinations of 𝜌𝑚𝑎𝑙 and𝛿𝑎𝑣𝑔 for various datasets, (v) we show real time nature of detection of smart meters, (vi) a few
comparisons of our performance with existing works.

(a)

(b)

Fig. 9. (a) Data Omission Captured in Uncleaned Data (b) Deliberate Additive On-Off Attack Forensic

6.1

Fine Grained Anomaly Detection Forensics

Here we show some results on how the fine grained anomaly detection metric can detect opportunistic strategies such as Omission and On-Off.
Data Omission Strategy: Fig. 9(a), shows a result on the uncleaned real dataset with missing data. We
do not know whether this was due to an attack or a network failure. Nonetheless, this is analogous
to data omission, and our proposed fine grained anomaly detection metric 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡), can capturesuch events. Since the metric 𝐹𝐺𝐴𝑇 contains only two entries for the whole year, it is evident
that this is particular data omission is likely an isolated failure, rather than an attack. A magnified
version was shown previously in Fig. 8, to prove that the 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) first decreases (when omission
starts) and then increases (when omission stops).
On-Off Strategy: We study a small timeline of say 10 days, and start additive attacks (ON) and thenstop it (OFF), it is possible to detect the ON period of attacks with the proposed 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡) metric.
As an example, Fig. 9(b), shows an additive attack with 𝛿𝑎𝑣𝑔 = 600, which was launched from the60-th hour to the 200-th hour of this time-line. Note that, in additive attacks the harmonic mean
grows at a much slower rate compared to the growth in arithmetic mean (given a sufficiently high𝛿𝑎𝑣𝑔 ). Hence, at the 60-th slot the difference between the arithmetic mean and harmonic mean islarger than the previous time slots. There the ratio 𝐴𝐷𝑟𝑎𝑡𝑖𝑜 (𝑡), shows a sharp increase.
6.2

Effectiveness of the Anomaly based Attack Context Generation

The effectiveness of the anomaly detection step is directly related to the embedding of attack
context in the proposed trust model which in turn preserves the classification accuracy, lowers false
alarm rates and, improves time to accurate classification of the compromised meters. Therefore, theeffectiveness of the anomaly detector is demonstrated through the minimization of classification
error rates (defined as the average of missed detection and false alarm rates).
The effectiveness of the anomaly detector is also directly dependent on the value of threshold(±𝛾𝜎𝐴𝐷 (𝑇 ) ) around the historical 𝐴𝐷 (𝑇 ) value. Recall, that 𝛾 is the scalar factor that parameterizes
the threshold variation. Therefore, to demonstrate the effectiveness of anomaly detector we show
the error rates (average of missed detection and false alarms) as a function of the varying margins
of false data and variable candidate thresholds in the anomaly detector. Through this, we also
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:28

Bhattacharjee et al.

demonstrate the optimal threshold range that the anomaly detectors should use to minimize theerror rate in classification.
Effectiveness of Error Rate Minimization: We report a 0.75𝜎𝐴𝐷 (𝑇 ) as a threshold that produces minimal error rates across extreme values of 𝜌𝑚𝑎𝑙 and over all trained values 𝛿𝑎𝑣𝑔 . This study is done
because the defender has no control on the actual 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 values that will manifest. Fig. 10(a)clearly shows that a global minima for classification error rate exists for a threshold of 0.75𝜎𝐴𝐷 (𝑇 ) ,which produces minimal error rates regardless of 𝛿𝑎𝑣𝑔 among all candidate thresholds for the Irish
dataset for 𝜌𝑚𝑎𝑙 = 15% under additive attacks. Fig. 10(b) shows that the minimal error rate isachieved for the same 0.75𝜎𝐴𝐷 (𝑇 ) across all 𝛿𝑎𝑣𝑔 for different 𝜌𝑚𝑎𝑙 = 50% under a deductive attack.
50

60
50

40

40

30

30

20

20
10

10

0

0

50

40
Average Error (%)

Average Error(%)

50

40

30
30

20
10

20

0
0

10

200

100

200

300

400

Margin of False Data

500

600

7000.25

0.75

0.5

1.25

1

Scalar Factor

400

0

600

1.5

Margin of False Data

800

0.5

0.25

AD(T)

(a)

Scalar Factor

1.5

1.25

1

0.75

AD(T)

(b)

Fig. 10. Error Rate Minimization (a) Low 𝜌𝑚𝑎𝑙 = 15%; (b) High 𝜌𝑚𝑎𝑙 = 50%

1

1

0.9

0.9

0.8

0.8

0.7

0.7

Detection Rate

Detection Rate

Effectiveness of Time to Detection (TTD): Figs. 11(a) is a CDF that is a testimony of the convergencetimes to the detection rate for an additive attack with 𝜌𝑚𝑎𝑙 = 20% and 𝛿𝑎𝑣𝑔 = 600 and a data-orderaware strategy. The classification of compromised meters is not only accurate but also happens in
a very quick time. The steady state detection rate as observed from Figs. 11(a) is achieved within
2 days. Additionally, Fig. 11(b), shows the effectiveness of the probability of attack time ratio
embedding (as a result of the fine grained anomaly detector) into the trust model, and proves thatit improves the time to detection of compromised meters significantly. The Fig. 11(b), shows thecomparison between the CDF of detections with and without embedding under an on-off strategy
with an on-to-off ratio of 1 : 3. We can observe that the circled line corresponding to detection
rate without the 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 embedding approaches its steady state after atleast 10 days compared tothe blue line with the probability of attack time ratio embedding that approaches the steady state
detection rate of 90% within just 2 days.

0.6
0.5
0.4

0.6

0.4

0.3

0.3

0.2

0.2

0.1
0

With Embedding
Without Embedding

0.5

0.1
0

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

0

0

1

2

3

4

5

Time (days)

Time (Days)

(a)

(b)

6

7

8

9

10

Fig. 11. (a) TTD of Compromised Meters (b) Comparative Effectiveness of 𝑃𝑎𝑡𝑡𝑎𝑐𝑘 embedding

6.3

Supervised Classification

In this case, the threshold is obtained from a small set of training meters from the training dataset
which is then applied to the testing set with the full set of meters in test set. Later, we show how
our proposed approach performs in an unsupervised mode as well.
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1

1

0.9

0.9

0.8

0.8

Trust score

Trust Score

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

0.7

0.6

0.5

0.7

0.6
Malicious
Honest0.5

Malicious
Honest

0.4

0.4

0.3

0.3
0

5

10

15

20

25

30

35

40

0

5

10

Meter id

20

25

30

35

40

(b)

1

1
Compromised Meter
Honest Meter

0.9
Trust Score

0.9
0.8
0.7
0.6
0.5

15

Meter id(a)

Trust Score

1:29

0.8
0.7
0.6

Compromised Meter
Honest Meter

0.5
0

10

20

30

40

50

60

70

80

Smart Meter ID

(c)

0.4

0

50

100

150

200

Smart Meter ID(d)Fig. 12. Training Set: (a) Additive; (b) Deductive (c) Effect of Meter Sizes (d) Effect of Different Season

6.3.1 Training Set:. First, we use a training data set from 40 houses and use power consumption
reported in 2014 for a month. In each training case, we labeled 40% meters as compromised(𝜌𝑚𝑎𝑙 = 0.4) and alter their reported values with 𝛿𝑎𝑣𝑔 = 500𝑊 and then plotted, the corresponding
trust values. We chose intermediate values of 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 to prevent overfitting or underfitting.
We use the trust scores of these labels, to calculate a threshold that can linearly separate between
compromised and non-compromised nodes. We use a decision tree based classifier called CART
(Classification and Regression Trees) to find the supervised thresholds. The results of training foradditive and deductive attacks are shown in Figs. 12(a), 12(b). Then we studied, the effect of meter
training size by repeating this with 80 meters (See Fig. 12(c)) as well as the effect of the training
time period (seasonal change) on all meters (See Fig. 12(d)) to test the sensitivity of training forsupervised classification. The conclusion is that all thresholds are close.
6.3.2 Classification with Testing Set:. For testing illustration, we use 2016 dataset from Texas andthe attack launching period is one month. We set 𝜌𝑚𝑎𝑙 = 0.4 and 𝛿𝑎𝑣𝑔 = 600𝑊 . More resultsover completely different combinations of 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 are presented later to prove the robustness
performance. Results for additive and deductive attacks shown in Figs. 13(a) and 13(b), exhibit aclear separation between honest and compromised nodes with a false alarm rate of 1.5% in boththe cases. The missed detection rate is 5% and 8% for additive and deductive attacks, respectively.
6.4

Classification Performance Evaluation

Fig. 14(a), shows the classification error rates for a larger dataset of 800 houses in terms of missed
detections and false alarms under additive attack for the unsupervised classification approach overall possible values of 𝛿𝑎𝑣𝑔 , given a 𝜌𝑚𝑎𝑙 = 0.50. From the figure, we can conclude that the relative
entropy approach works well for most values of 𝛿𝑎𝑣𝑔 even when 50% of the nodes are compromised.
Particularly, the missed detection is higher than false alarms, which means detection rate is more ofa concern for additive attacks particularly, when 𝛿𝑎𝑣𝑔 < 400. We report 22% missed detection and
2% false alarm at 𝛿𝑎𝑣𝑔 = 400. At 𝛿𝑎𝑣𝑔 = 300, the missed detection rate increases to 39%. Therefore,
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Bhattacharjee et al.
1

1

0.9

0.9

0.8

0.8
Trust score

Trust Score

1:30

0.7

0.6

0.5

0.7

0.6

0.5
Malicious
Honest0.4

Malicious
Honest

0.4

0.3

0.3
0

20

40

60

80

100

120

140

160

180

200

220

0

20

40

60

80

Meter id

100

120

140

160

180

200

220

Meter id(a)(b)

Fig. 13. Testing Sets: (a) Additive; (b) Deductive

we experimentally verify that is methodology is not well suited for the margin of false data lesser
than the median absolute deviation of the dataset.
Fig. 14(b) shows the classification error rates in terms of missed detections and false alarms for
unsupervised classification approach over all possible values of 𝛿𝑎𝑣𝑔 , given 𝜌𝑚𝑎𝑙 = 0.50 under adeductive attack for 800 houses. This indicates the robustness of our solution across all margins offalse data under deductive attacks. The missed detection rate does not have an upper evasion pointcompared to our preliminary work [2] and other information theoretic approaches.
Fig. 15(a) and 15(b), shows the classification error rates in terms of missed detections andfalse alarms for the unsupervised classification approach over all possible values of 𝛿𝑎𝑣𝑔 , given a𝜌𝑚𝑎𝑙 = 0.20 under a camouflage and conflict attack.
0.4

0.3
False Alarm
Missed detection

False Alarm
Missed Detection

0.35

0.25

0.3

Error rate

Error Rate

0.2
0.25
0.2

0.15

0.15
0.1
0.1
0.05
0.05
0

400

600

800

1000

1200

1400

1600

1800

0

2000

400

600

800

Margin of False Data

1000

1200

1400

1600

1800

2000

Margin of False Data

(a)

(b)

Fig. 14. Error Sensitivity Analysis over 𝛿𝑎𝑣𝑔 (Texas): (a) Additive (b) Deductive
0.4

0.4

0.35

0.35
0.3

False Alarm
Misdetection
Error Rate

Error Rate

0.3
0.25
0.2
0.15

0.2
0.15

0.1

0.1

0.05

0.05

0

400

600

800

1000

1200

Margin of False Data

(a)

1400

1600

1800

2000

False Alarm
Misdetection

0.25

0

400

600

800

1000

1200

1400

1600

1800

2000

Margin of False Data(b)

Fig. 15. Error Sensitivity Analysis over 𝛿𝑎𝑣𝑔 (Texas): (a) Camouflage (b) Conflict

Figure 16(a) confirms that the error rate is within 10% for all possible fractions of compromised
nodes as high as 90%, for the additive attack. This indicates the robustness of our solution tohigher fractions of compromised nodes for additive attacks. Additionally, Figure 16(b), indicatesthe robustness of our solution to various margins of false data under deductive attacks. The missed
detection rate does not have an upper evasion point in terms of 𝜌𝑚𝑎𝑙 .
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure
0.09

1:31

0.14
False Alarm
Missed Detection

0.08

False Alarm
data1

0.12

0.07
0.1
Error Rate

Error Rate

0.06
0.05
0.04

0.08
0.06

0.03
0.04
0.02
0.02

0.01
0
10

20

30

40

50

60

70

80

0
10

90

20

30

Fraction of Compromised Meters

40

50

60

70

80

90

Fraction of Compromised Meters

(a)

(b)

Fig. 16. Error Sensitivity Analysis over 𝜌𝑚𝑎𝑙 (Texas): (a) Additive (b) Deductive

6.5

Comparisons with Existing Work and Scalability of Error Rates

Fig. 17 shows that the false alarm rate for the Irish dataset across 5000 houses is less than 2%. Additionally, the missed detection rate is below 20% for any 𝛿𝑎𝑣𝑔 ≥ 350W. Second, the Fig. 17, compares
our performance for deductive attacks with existing works in terms of missed detection (MD) andfalse alarm (FA) rates, that use techniques such as One class SVM [12], multi-class SVM [12], F-Deta(Information Theory based) [16], folded Gaussian trust [4]. The proposed approach’s performancein terms of FA and MD is shown in solid lines with season wide cross validation. From the figure, itis evident that across various margins of false data, our FA and MD rates are lowest compared tothe other approaches. Additionally, across the same chosen 𝛿𝑎𝑣𝑔 , our work remains resilient underhigh fractions of compromised meters compared to previous works.
0.55
FA Proposed
MD Proposed
FA multi-class SVM
MD multi-class SVM
FA one-class SVM
MD one-class SVM
FA F-DETA
MD F-DETA
FA folded gaussian trust
MD folded gaussian trust

0.5
0.45

Error Rate

0.4
0.35
0.3
0.25
0.2
0.15
0.1
0.05
0
200

300

400

500

600

700

800

900

1000

1100

1200

1300

1400

1500

1600

Margin of False Data

Fig. 17. Error Rate Comparison with Existing Works: Irish Dataset

Table 8, also quantifies the advantages and benefits of our framework in comparison to someof the recent works in this area, in terms of ‘other aspects’ that are not directly comparable withprevious works. These aspects include ranges of studied margin of false data 𝛿𝑎𝑣𝑔 and 𝜌𝑚𝑎𝑙 , detection
rate convergence times, applicability to multiple attack types, and both coarse and fine grained
opportunistic attack strategies. While our framework applies to all attack types, other works focus
on deductive attacks except our previous work. Therefore, the numbers for our framework in Table 8
are for deductive attacks only for a fair comparison. However, our work is much broader compared
to existing works since it addresses an umbrella of various threats simultaneously. Some entries inthe table marked NA when a concerned parameter that is not reported explicitly. Moreover, ourwork shows error sensitivity performance over both datasets.
Our framework has a much better performance over a wide attack strategy space with 𝜌𝑚𝑎𝑙
ranging from 1% to 90% and 𝛿𝑎𝑣𝑔 ranging from 300𝑊 -2000𝑊 compared to the existing works thatassume a narrower or fixed attack strategy space in terms of 𝜌𝑚𝑎𝑙 and 𝛿𝑎𝑣𝑔 . Works such as [16]reasonable missed detection rates, but assume a very high 𝛿𝑎𝑣𝑔 of above 1000W which facilitateseasier classification. The false alarm rate at only select 𝛿𝑎𝑣𝑔 is provided and the detection time is
not clear. At this assumption, our missed detection rate is less than 6% and false alarm rates are 8%
for a larger dataset of 800 meters. The work in [12] has a small 𝜌𝑚𝑎𝑙 of 0.72%, but at their assumed
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:32

Bhattacharjee et al.

𝛿𝑎𝑣𝑔 = 400𝑊 , our MD and FA rates are better for both additive and deductive attacks across lowerand higher 𝜌𝑚𝑎𝑙 values while needing the same number observations per day. Our work can also
perform classification in an unsupervised mode compared to the supervised approach with a hightraining time as reported in [12]. The upper evasion limit of high 𝛿𝑎𝑣𝑔 and 𝜌𝑚𝑎𝑙 vanishes, comparedto our preliminary work [2], due to the robust mean and median absolute deviation correction andconvergence times are preserved under omission and on-off attacks. Our recent work [10] also
showed that harmonic and arithmetic mean calculations are compatible with fully homomorphic
encryption schemes enabling privacy preserving security computations in AMI. Therefore, ourmethod unlike others will be compatible with AMI privacy requirements [31].
Table 8. Comparison with Existing Work
Parameter
False Alarm
Missed Detection
𝛿𝑎𝑣𝑔
𝜌𝑚𝑎𝑙
Attack Type
Detection Time
Opportunistic strategies

7

Proposed
1.5%-4%30%-0%
300-3000W
1% − 90%All
2-3 daysYes

CPBETD [12]
29%
24%
400W
1%
Deductive
77daysYes

ARMA [19]
33%
28%
NA
NA
Deductive
30 daysNo

Prior [2]11%8%700-800W≤ 40%
All
30 daysNo

F-Deta [16]NA
10%-36%
1000W-2000W
55%
Deductive
NA
No

CONCLUSIONS AND FUTURE WORKIn this paper, we proposed coarse and fine grained anomaly based security event detection techniquethat serves as an early indicator of the presence of organized data falsification attack, infers theattack type, and strategy inflicted, which helps to reconstruct an attack context that includes a
response metrics such as robust mean, standard deviation, attack probability time ratio, which
depend on what kind of threat has been inflicted. Based on this attack context, the relative entropy
trust model adapts itself dynamically in runtime, to produce linearly separable trust scores that canidentify the compromised meters injecting false data with higher accuracy and in near real time. In
all, we showed that our framework applies regardless of the high fraction of compromised nodes,
and across various margins of false data in an unsupervised classification mode as well with very
low time to detection of compromised meters.
In the future we will address the problem of anomaly detection and meter identification when themargin of false data, the upper and lower interval of false data is much smaller than the establishedbypass margin of false data. Such stealthy attacks are possible since every unit of electricity has avalue, which the evidential model using robust mean and median absolute deviation will not beable to detect.
Acknowledgements: The work is supported by National Science Foundation grants under award
numbers SATC-2030611, SATC 2030624, OAC-2017289, CNS-1818942, CNS-1545037, CNS-1545050,
CPS 1943035, ECCS 1936131, NIFA - 2017-67008-26145. We thank the reviewers and associate editor
for suggestions. We thank Mr Aditya Thakur for assistance with some of the experimental plots.
REFERENCES[1] V. Agate, A. Khamesi, S. Gaglio, S. Silvestri, “Enabling peer-to-peer User-Preference-Aware Energy Sharing Through Reinforcement
Learning", IEEE International Conference on Communications (ICC), 2020.
[2] S. Bhattacharjee, A. Thakur, S. Silvestri, S.K. Das, “Statistical Security Incident Forensics against Data Falsification in Smart Grid
Advanced Metering Infrastructure", ACM Conference on Data and Application Security (ACM CODASPY), pp. 35-45, Mar. 2017.
[3] S. Bhattacharjee and S.K. Das, “Detection and Forensics under Stealthy Data Falsification in Smart Metering Infrastructure”, IEEE Trans.
on Dependable and Secure Computing, Vol. 16, Dec. 2018.
[4] S. Bhattacharjee, A. Thakur, S.K. Das, “Towards Fast and Semi-Supervised Identification of Smart Meters launching Data Falsification
Attacks", ACM Asia Conference on Computer and Communications Security (ACM ASIACCS), pp. 173-185, 2018.
[5] P. Box, D. Cox, “An analysis of transformations", Journal of the Royal Statistical Society, Series B. Vol. 26 (2): pp. 211-252, 1964.
[6] A. Cardenas, R. Berthier, R. Bobba, J. Huh, J. Jetcheva, D. Grochocki, and W. Sanders, “A Framework for Evaluating Intrusion Detection
Architectures in Advanced Metering Infrastructures", IEEE Trans. On Smart Grid, Vol. 5(2), pp. 906-915, Mar. 2014.
[7] V. Chandola, A. Banerjee, V. Kumar, “Anomaly detection: A survey", ACM Computing Surveys, Vol. 41, Issue, 15, pp. 15-58, 2009.

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:33[8] S. Ciavarella, J. Y. Joo and S. Silvestri, "Managing Contingencies in Smart Grids via the Internet of Things," in IEEE Trans. on Smart
Grid, vol. 7, no. 4, pp. 2134-2141, July 2016.
[9] V. Dolce, C. Jackson, S. Silvestri, D. Baker, A. De Paola, “Social-Behavioral Aware Optimization of Energy Consumption in Smart
Homes" IEEE International Conf. on Distributed Computing in Sensor Systems (DCOSS), 2018.
[10] Y. Ishimaki, S. Bhattacharjee, H. Yamana, S.K. Das, “Towards Privacy-preserving Anomaly-based Attack Detection against Data Falsification in Smart Grid", IEEE International Conference on Communications, Control, and Computing Technologies for Smart Grids (SMARTGRIDCOMM), Nov. 2020.
[11] R. Jiang , R. Lu, Y. Wang, J. Luo, C. Shen, and X. Shen, “Energy-Theft detection issues for advanced metering infrastructure in smart
grids", Tsinghua Science and Technology, Vol. 19(2), pp. 105-120, Apr. 2014.
[12] P. Jokar, N. Arianpoo, and V. Leung, “Electricity theft detection in AMI using customers’ consumption patterns", IEEE Trans. on Smart
Grid, Vol. 7(1), pp. 216-226, Jan. 2016.
[13] A. Khamesi, S. Silvestri, D. Baker, A. De Paola, "Perceived-Value Driven Optimization of Energy Consumption in Smart Homes" ACM
Transactions on Internet of Things, Vol. 1, Issue 2, 2020.
[14] A. R. Khamesi, S. Silvestri, “Reverse Auction-based Demand Response Program: A Truthful Mutually Beneficial Mechanism", IEEE
Mobile Ad Hoc Sensor and Smart Systems (IEEE MASS), 2020.
[15] T. Koppel, “Lights Out: A Cyberattack, A Nation Unprepared, Surviving the Aftermath", Crown Publishers, New York, 2015.
[16] V. B. Krishna, K. Lee, G. A. Weaver, R. K. Iyer and W. H. Sanders, “F-DETA: A Framework for Detecting Electricity Theft Attacks in
Smart Grids," IEEE/IFIP on Dependable Systems and Networks (IEEE DSN), 2016, pp. 407-418.
[17] S. McLaughlin, D. Podkuiko, and P. McDaniel, “Energy theft in the advanced metering infrastructure", Proc. of Critical Information
Infrastructures Security, Springer-Verlag, pp. 176-187, Sept. 2009.
[18] S. McLaughlin, B. Holbert, S. Zonouz, and R. Berthier, “AMIDS: A multi-sensor energy theft detection framework for advanced metering
infrastructures", IEEE Conf. on Communications, Control, and Computing Technologies for Smart Grid Communications (SMARTGRIDCOMM), pp. 354-359, Nov. 2012.
[19] D. Mashima and A. Alvaro, “Evaluating electricity theft detectors in smart grid networks", Springer Intl. Workshop on Recent Advancesin Intrusion Detection, pp. 210-229, Sept. 2012.
[20] R. Mohassel, A. Fung, F. Mohammadi, and K. Raahemifar, “A survey on advanced metering infrastructure", Elsevier Journal of ElectricalPower & Energy Systems, 63:473-484, Dec. 2014.
[21] B. Meyer, “Some Inequalities for Elementary Mean Values", AMS Mathematics of Computation, Vol. 42, No. 165, pp. 193-194, 1984.
[22] A. Rad and A.L. Garcia, “Distributed internet-based load altering attacks against smart power grids", IEEE Trans. on Smart Grids, Vol.
2(4), pp. 667-674, Dec. 2011.
[23] E. Shin, A. R. Khamesi, Z. Bahr, S. Silvestri, D. A. Baker, “A User-Centered Active Learning Approach for Appliance Recognition" IEEE
International Conference on Smart Computing (SMARTCOMP), 2020[24] Y.L. Sun, W. Yu, Z. Han, K.J. Ray Liu, “Information Theoretic Framework of Trust Model and Evaluation for Ad Hoc Networks",IEEE
Journal on Sel. Areas in Communications, Vol. 24(2), pp. 305-317, Feb. 2006.
[25] S. H. Tung, “On Lower and Upper Bounds of the Difference Between the Arithmetic and the Geometric Mean", AMS Mathematics ofComputation, Vol. 29, No. 131, pp. 834-836, 1975.
[26] J. P. Talusan, F. Tiasus, K. Yasumoto, M. Wilbur, A. Dubey, S. Bhattacharjee, “Smart Transportation Delay and Resiliency Testbed Basedon Information Flow of Things Middleware," IEEE International Conference on Smart Computing (SMARTCOMP), USA, 2019.
[27] E. Werley, S. Angelos, O. Saavedra, O. Cortes, and A. Souza, “Detection and identification of abnormalities in customer consumptionsin power distribution systems", IEEE Trans. on Power Delivery, Vol. 26(4): pp. 2436-2442, Oct. 2011.
[28] M. Wilbur, A. Dubey, B. Leao, S. Bhattacharjee, “A decentralized approach for real time anomaly detection in transportation networks",
IEEE Conference on Smart Computing, 2020.
[29] W. Xia, Y. Chu, “The schur convexity of gini mean values in the sense of harmonic mean", Mathematica Scientia, Vol. Vol. 31(3), pp.
1103-1112, 2011.
[30] W. Yu, D. Griffith, L. Ge, S. Bhattarai and N. Golmie, “An integrated detection system against false data injection attacks in the Smart
Grid, Security and Commun. Networks, Vol. 8(2), pp. 91-109, Jan. 2015.
[31] [Online] Available at: https://skyvisionsolutions.files.wordpress.com/2014/08/utility-smart-meters-invade-privacy-22-aug-2014.pdf[32] NY Times, Last Accessed Oct. 2020, [Online] Available at: http://www.nytimes.com/2009/12/14/us/14meters.html?ref=energyenvironment&_r=0[33] [Online] Last Accessed Oct. 2020, Available at: http://www.telegraph.co.uk/news/2017/03/06/smart-energy-meters-giving-readingsseven-times-high-study-finds/[34] [Online] Last Accessed Oct. 2020, Available at: https://www.maximintegrated.com/content/dam/files/design/technicaldocuments/white-papers/smart-grid-security-recent-history-demonstrates.pdf[35] [Online] Last Accessed Oct. 2020, Available at: https://energy-solution.com/2015/01/29/enabling-automated-demand-response-pgedras/[36] [Online] Last Accessed Oct. 2020, Available at: https://www.smartgrid.gov/files/The_Smart_Grid_Promise_DemandSide_Management_201003.pdf[37] [Online] Last Accessed Oct. 2020, Available at: http://blog.comverge.com/intelligent-energy-management/does-ami-have-what-ittakes-for-demand-response/[38] [Online] Last Accessed Oct. 2020, Available at: http://krebsonsecurity.com/2012/04/fbi-smart-meter-hacks-likely-to-spread/[39] [Online] Last Accessed Oct. 2020, Available at: https://www.whitehouse.gov/sites/default/files/microsites/ostp/nstc-smart-gridjune2011.pdf[40] [Online] Last Accessed Oct. 2020, Available at: https://www.smartgrid.gov/project/pecan_street_project_inc_energy_internet _demonstration.html[41] [Online] Last Accessed Oct. 2020, Available at: http://energy.gov/sites/prod/files/oeprod/DocumentsandMedia/14AMI_System_Security_Requirements_updated.pdf[42] [Online] Last Accessed Oct. 2020, Available at: Irish Social Science Data Archives, Available at: http://www.ucd.ie/issda/data/[43] Link: https://drive.google.com/file/d/1rWZ6O68Hm55Qf403RQp2M2o0HuD7hqam/view

ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

1:34

Bhattacharjee et al.

Appendix A. Implementation of Data Order Aware Attacks:
In Fig. 18, the blue line corresponds to the actual power consumption. The redand yellow lines correspond to deductive attacked consumption data following a
non-data order aware and a data order aware strategy respectively under same 𝛿𝑎𝑣𝑔
and 𝜌𝑚𝑎𝑙 . Even as the same revenue is achieved with both strategies, the chancesof detection (using proximity based mechanisms) are lesser in data order aware
strategy due closer proximity to the actual data.
Meter Reading (W)

4000
3000

NO AttackNon Data Order Aware Attack
Data Order Aware Attack

2000
1000
0

0

10

20

30

40

50

60

70

80

Smart Meter ID

Fig. 18. Illustration: Benefit of Data Order AwarenessThis strategy is implemented in the following manner: The adversary sorts theactual power consumptions observed from its set of 𝑀 compromised meters such
( 1)
(𝑚)
(𝑀)
that 𝑃𝑎𝑐𝑡(𝑡) ≤, · · · , 𝑃𝑎𝑐𝑡(𝑡), ≤ 𝑃𝑎𝑐𝑡(𝑡). Then adversary generates 𝑀 random numbers for 𝛿 (𝑡), sorted as 𝛿𝑡𝑚𝑖𝑛 ≤, · · · , ≤ 𝛿𝑡𝑚𝑎𝑥 . For a deductive attack, the highest observed power consumption data is changed with the highest 𝛿𝑡𝑚𝑎𝑥 , while
the lowest observed power consumption data is changed with the lowest 𝛿𝑡𝑚𝑖𝑛 .
( 1)(𝑀)Hence, 𝑃𝑎𝑐𝑡(𝑡) − 𝛿𝑡𝑚𝑖𝑛 , · · · , 𝑃𝑎𝑐𝑡(𝑡) − 𝛿𝑡𝑚𝑎𝑥 . For an additive attack, the lowest observed power consumption data is changed with the highest 𝛿𝑡𝑚𝑎𝑥 , while highest observed power consumption data is modified with lowest 𝛿𝑡𝑚𝑖𝑛 , and so on,( 1)(𝑀)such that 𝑃𝑎𝑐𝑡(𝑡) + 𝛿𝑡𝑚𝑎𝑥 , · · · , 𝑃𝑎𝑐𝑡(𝑡) + 𝛿𝑡𝑚𝑖𝑛 . For a camouflage attack, the sorted
( 1)
(𝑀)
𝑃𝑎𝑐𝑡
(𝑡) ≤, · · · , ≤ 𝑃𝑎𝑐𝑡(𝑡) is divided into two parts, and corresponding portions
are changed accordingly. This kind of attack therefore, is more aware of the current consumption trends as seen by the meters under adversarial control and minimizes the chances of the final reported value to be obvious outliers and more close
to the actual power consumption distributi10n.
Appendix B. Explanation of Stability of Ratio Metric:
We provide a short theoretical and mathematical reasoning behind the observed
stability of absolute difference between harmonic mean to arithmetic mean for
AMI power consumption data across various data sets. Note that, the invariant
𝐴𝐷 (𝑇 ) is a daily metric and most residential households share certain coarse
grained common behavioral routines, although individual fine grained differences
exist. Hence, the power consumption of different households are not completely
independent but exhibit some weak positive correlation (i.e. the power consumption of houses tend to increase or decrease together due to commonality of habits).
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.

Attack Context Embedded Data Driven Trust Diagnostics in Smart Metering Infrastructure

1:35

For example, most houses are tend to use more electricity on very cold days. Obviously, the strength of this positive correlation varies may vary from region toregion, but in a particular Neighborhood Area it produces some common correlation. Since humans have common behavioral habits during a typical day, thenintuitively the daily pattern of average difference in power consumption values
between any two pair of houses averaged over 𝑇 is not going to be arbitrarily
different from each other. Let the average difference between power consumption of any two houses in the sorted series 𝑝 1 (𝑇 ) · · · , 𝑝 𝑁 (𝑇 ) over 𝑇 be denotedÍ𝑁
𝑖+1 (𝑇 ) − 𝑝 𝑖 (𝑇 )|. The distribution of 𝜉 (𝑇 ) for the Irish datasetas 𝜉 (𝑇 ) = 𝑁1 𝑖=
1 |𝑝
as shown in Fig. 19(a), follows a stable trend. Additionally, the variance in 𝜉 (𝑇 ) is
also less. The most important thing is that the 𝜉 (𝑇 ) is stationary in the mean in
the wide piecewise sense even for 5000 houses.
400

16

350

14

300

Frequency

Average Difference

ξ

18

12
10
8

250
200
150
100

6
50
4
0

50

100

150

200

Days

(a)

250

300

0
-200

0

200

400

600

800

1000

Power (Watts)(b)

Fig. 19. Irish Dataset: Distribution of (a) 𝜉 (𝑇 ); (b) 𝑎𝑚𝑖𝑛

Now, we show an important relationship between the stability of 𝜉 (𝑇 ) andTung’s Theorem [25], which proposed the theoretical upper and lower bounds on
the absolute difference between Arithmetic and Geometric Means in any series
data. The corollary for this Theorem [21] describes the upper and lower bounds
on the absolute difference between Harmonic and Arithmetic Mean in a series
data.
• Tung’s Theorem Corollary: Given a sorted series 𝑎 = 1 ≡ 𝑎 1, · · · , 𝑎𝑛 ≡ 𝐵, where
1 and 𝐵 denote the minimum and maximum values of the series of 𝑛 numbers.
Let 𝐻𝑛 and 𝐴𝑛 denote the harmonic and arithmetic means respectively. Then thebounds on the absolute difference between 𝐻𝑛 and 𝐴𝑛 :pp
(𝐵 − 1) 2≤ |𝐴𝑛 − 𝐻𝑛 | ≤ ( (𝐵) − (1)) 2(38)
𝑁 (𝐵 + 1)
For minimum (𝑎𝑚𝑖𝑛 ) and maximum (𝑎𝑚𝑎𝑥 ) values, Eqn. 38 can be rewritten as:pp(𝑎𝑚𝑎𝑥 − 𝑎𝑚𝑖𝑛 ) 2≤ |𝐴𝑛 − 𝐻𝑛 | ≤ ( (𝑎𝑚𝑎𝑥 ) − (𝑎𝑚𝑖𝑛 )) 2
(39)𝑛(𝑎𝑚𝑎𝑥 + 𝑎𝑚𝑖𝑛 )where 𝑎𝑚𝑎𝑥 ∼ 𝑎𝑚𝑖𝑛 + (𝑛 − 1)𝜉. Therefore, the bounds on |𝐴𝑛 −𝐻𝑛 | is only a functionof 𝜉 and 𝑎𝑚𝑖𝑛 .From Figs. 19(a) and 19(b), we know that both 𝜉 and 𝑎𝑚𝑖𝑛 are mostly
stable; hence |𝐴𝑛 −𝐻𝑛 | is also highly stable. This is one explanation on the stabilityof harmonic to arithmetic mean ratios across multiple datasets and subsets.
Received xxxxx; revised xxxx; accepted xxxx
ACM Transactions on Privacy and Security., Vol. 1, No. 1, Article 1. Publication date: October 2020.