Towards Privacy-preserving Anomaly-based Attack
Detection against Data Falsification in Smart Grid
Yu Ishimaki˚ , Shameek Bhattacharjee: , Hayato Yamana˚ , and Sajal K. Das;
˚ Department of Computer Science and Communications Engineering, Waseda University, Tokyo, Japan{yuishi, yamana}@yama.info.waseda.ac.jp: Dept of Computer Science, Western Michigan University, Kalamazoo, USA (shameek.bhattacharjee@wmich.edu); Dept of Computer Science, Missouri University of Science and Technology, Rolla, USA (sdas@mst.edu)

Abstract—In this paper, we present a novel framework for
privacy-preserving anomaly-based data falsification attack detection in a smart grid advanced metering infrastructure (AMI).
Specifically, we propose an anomaly detection framework over homomorphically encrypted data. Unlike existing privacy-preserving
anomaly detectors, our framework detects the presence of not only
energy theft (i.e., deductive attack), but also more advanced data integrity attacks (i.e., additive and camouflage attacks) over encrypted
data without diminishing detection sensitivity. We optimize theanomaly detection procedure such that potentially expensive
operations over homomorphically encrypted space are avoided.
Moreover, we optimize the encryption method designed for a
resource constrained device such as smart meters, and the time
to complete encryption gets 40x faster over the naı̈ve adoption of
the encryption method. We also validate the proposed frameworkusing a real dataset from smart metering infrastructures, anddemonstrate that the data integrity attacks can be detected withhigh sensitivity, without sacrificing user privacy. Experimental
results with a real dataset of 200 houses from an AMI in Texas
showed that the detection sensitivity of the plaintext algorithm is
not degraded due to the use of homomorphic encryption.

I. INTRODUCTION
In an advanced metering infrastructure (AMI), the finegrained power consumption data collected from smart meters
plays a central role in the energy optimization, efficiency, andoperational reliability of the emerging smart grid technologies.
Such meter data drives key operations such as automatedbilling, load forecast, and critical peak shifts. Additionally, data
falsification attacks are launched by organized adversaries dueto the immediate operational and economic impact of suchattacks. Thus, attack detection mechanism in AMI is requiredby the utility to detect the presence of such attacks.
Since data driven attack detections require fine-grained power
consumption data from customers’, it violates privacy of eachcustomer during such computations. The customer privacy has
been known as a major concern [1]. Thus, it is indispensable tostrike a balance between achieving privacy and security. Therefore, in this paper, we propose a framework for anomaly-based
attack detection mechanism that is also privacy preserving at
the same time.
978-1-7281-6127-3/20/$31.00 c 2020 IEEE

Privacy preservation can be accomplished in one of the following ways: (i) differential privacy (DP), (ii) secure multiparty
computation (SMC), and (iii) homomorphic encryption (HE).
First, Differential Privacy (DP) adds an adequate amount ofnoise to hide sensitive data. While it allows the quantification ofprivacy leakage, there exists a trade-off between the information
leakage level and the accuracy of the statistics generated overnoisy data. Thus, an exact computation cannot be achieved inorder to guarantee the privacy level. Moreover, balancing thebest trade-off is an open problem [1].
Second, in SMC based on secret sharing, each data readingis split into multiple pieces, called shares, which are sent
to the other parties involved in the protocol, e.g., a set ofcomputational servers operated by third-parties, so that adding
all the shares yield the original value. While in this case, thesmart meters can delegate a desirable computation to multiple
servers in feasible time, it is assumed that non-colluding servers
are operated by different third parties [2], [3]. The disadvantageof this approach is high management cost of two or more
non-colluding servers, and the strong privacy assumption on
non-collusion of third parties. Since each of the servers must
communicate with each other to perform multiplications, thisapproach is more vulnerable to traffic analysis attacks.
Thirdly, compared with SMC, HE offers lower communication complexity, and requires a single computational server
only rather than multiple non-colluding servers. Existing works
such as data aggregation [4] and billing [5] are mostly based on
Additive HE (AHE), which supports only addition and constantmultiplication over encrypted data. However, highly sensitive
data integrity attack detectors require more complex operations
such as division and logarithms.
Motivation and Challenges: Our investigation of previous
works reveals that none of the existing methods based on
HE addresses the problem of privacy preserving data integrity
attack detection which offers both security and privacy simultaneously. Unlike the traditional AHE, recently developed HE
schemes enable both addition and multiplication of integers
or real/complex numbers over encrypted data. This motivates
us to consider the feasibility of HE-compatible anomaly-based
attack detection in a smart grid as a novel problem. Amongprevious anomaly detectors in AMI, the harmonic to arithmetic
mean (HM-AM) ratio-based detector [6] has been shown tobe an effective one against various attack types. However,it was designed under the assumption that the raw power
consumption data from a set of different smart meters is visible
throughout the computation, thus compromising customers’
privacy completely. Thus, in this paper, we adopt HE to
remodel a HM-AM ratio-based anomaly detection framework.
Yet, the following three key challenges exist: (1) It is crucial
to adopt an HE such that the attack detector preserves thedetection sensitivity compared with the detector without HE.
(2) The computation of the HM-AM ratio requires several HEunfriendly operations, which makes entire system inefficientdue to a large HE parameter setting. (3) A standard HE
encryption process becomes expensive for resource-constrainedInternet of Things (IoT) devices such as smart meters especiallyin our parameter setting.
Contributions:We make the following contributions:(i) We develop a HE-based anomaly-based attack detection
framework for AMIs, that detects attacks over encrypted smart
meter data. The fine-grained smart meter readings of individual
customers are not revealed to anyone at any stage. The computation of the ratio, requiring a set of fine-grained consumption,is performed at a computational server over encrypted data,
followed by the ratio-based computation (in plaintext) for the
anomaly detection performed at a utility. We demonstrate thatthe detection sensitivity is not degraded by the approximation
error due to the use of HE.
(ii) We optimize the data encoding of power consumption for
the ratio computation, to lower the HE ciphertext size.
(iii) We propose a simple, optimized user-side encryption
procedure designed for low-power devices and achieve a 40x
speed-up over a naı̈ve method, both with the HE parameter set
specific to the anomaly detection for a smart meter dataset.
The rest of this paper is organized as follows. Section II
introduces backgrounds of HE and our base anomaly detector
while Section III describes the system and threat models.
Section IV presents HE-based privacy-preserving anomaly detection. Section V deals with security analysis and Section VI
provides performance evaluation. Section VII discusses additional capability of our system, followed by conclusions.

expressed as a fixed-point integer, i.e., m is scaled up by ascaling factor ∆ “ 2p P Z followed by rounding to its nearest
integer, denoted by m1 :“ t∆ms. Besides, during encryption
process, a small amount of noise e is added, forming a resulting
ciphertext Encpm1 q such that the decryption of the ciphertext
produces the approximation of the underlying message. Thatis, DecpEncpm1 qq “ m1 ` e « ∆m, where the noise part isa source of both security and approximation error. We canobtain the above decryption result as long as a parameter
called ciphertext modulus Q is larger than m1 ` e. Meanwhile,
as a homomorphic multiplication exponentially increases theamount of message (and the noise), we may require Q to be
exponentially large in the number of multiplications, whichmakes ciphertext size too large. To have Q small, the CKKS
scheme maintains the growth by an operation called rescaling,that homomorphically scales down the underlying approximate
message by reducing the ciphertext modulus. To obtain thecorrect decryption result, we need to set the initial ciphertext
modulus large enough. Typically, Q is determined by themultiplicative depth which is the maximum consecutive numberof homomorphic multiplications in a computation. Therefore,
designing a function with less multiplicative depth is crucial toachieve efficiency in terms of both storage and computationalcosts.
B. Anomaly Detection Ratio Metric
The harmonic to arithmetic mean (HM-AM) ratio is a metricthat has been recently demonstrated as an effective indicatorfor detecting anomalous behavior in smart metering data [6].
We use the HM-AM ratio as the anomaly-based attack detector
because (i) it handles various attacks (described in the next
section) simultaneously and (ii) it is sensitive to small margins
of data falsification attack.
We denote by N the number of smart meters in a neighborhood area network in an AMI. Let T be a set of timeslots ina day. For each timeslot t P T , the i-th smart meter has power
piq
consumption pt P R` . To maintain the stability of the HMAM ratio, each power consumption is transformed by taking
piq
piq
natural logarithm, yielding Pt :“ lnppt ` 2q. For d-th date,the HM-AM ratio Qd is computed byřHMt
Qd “ řtPT
,tPT AMt

II. P RELIMINARIESFor symbols related to power consumption, the year, date,
and timeslot are indicated in the subscript. For simplicity, we
will omit the year and date. We use Encp¨q and Decp¨q torepresent encryption and decryption of the HE, respectively. We
respectively denote homomorphic addition and multiplicationby ‘ and d.
A. The CKKS Scheme
The CKKS scheme [7] is an approximate HE scheme
specifically designed for real/complex-number arithmetic overencrypted data. At a high level, a real/complex number m is

where
AMt “

piq
i“1 Pt

řN

N

,

(1)

HMt “ řNN

1i“1 P piq

.

(2)

t

Due to the page limitation, we only give a high-level descriptionof it. (For further details, please refer to the paper [6].) The
anomaly detection consists of training and test phases. During
the training phase, the utility computes the ratio of daily HM
to AM ratio, and establishes the normal range of difference
between the observed ratio samples and a safe margin thresholdparameter (residual) known, termed as the standard limit [6].
Subsequently, the test phase is done by checking that theresidual value derived from the given HM-AM ratios is within
the standard limit range. Any residual outside of the standard
limit is inferred as an attack, which requires a security audit.
III. S YSTEM G OALSWe show our architecture in Figure 1. Without loss ofgenerality, we consider three types of stakeholders: a computational server (operated by a third-party), a utility, and N smart
meters. The goal of our system is to securely perform anomalybased attack detection without revealing the fine-grained power
consumption data of the end user to the server and the utility.
Namely, we enable the server to securely compute the HM-AM
ratio from N homomorphically encrypted power consumption
data at each timeslot, while ensuring that the server does notlearn anything about each power consumption and the HM-AM
ratio. Besides, the utility only learns the HM-AM ratio but notanything beyond what can be inferred from them. Using the
HM-AM ratio, the utility performs the anomaly detection in
the clear.

Figure 1. Overview of our system

Privacy Threat Model: Our system strives to protect the privacy of users against both the server and the utility. We assume
that the all of the stakeholders are semi-honest (honest-butcurious), i.e., they follow the protocol but attempt to infer as
much information as possible from the messages exchanged
during the protocol. Moreover, we assume that the utility (thesecret-key holder) and the server do not collude. The privacy
requirement can be ensured as long as these assumptions hold.
The detailed analysis is provided in Section V. Note that we
do not restrict the collusion among smart meters and between
smart meters and the server. That is, when the server and asubset of the smart meters are colluded, only the meter readingsof the smart meters are revealed but not those of the othermeters.
Security Threat Model: We consider the data integrity threat,
which involves an adversary performing a data falsification
attack on meter readings, assumed to occur before smart meters
encrypt their power consumption. Specifically, we consider theattack model for AMI networks proposed in [6], [8]. It has
four features that characterize the attack model: the fraction ofcompromised meters, the margin of false data, attack types, andthe falsification strategy, as described below:
Compromised Meter Fraction: Let M pď N q be the numberof compromised meters and Sall be a set of compromised
meter ids. The idj -th (idj P Sall ) smart meter in the area
is compromised for each j P rM s, such that the fraction ofcompromised meters is treated as a parameter ρmal .
Margin of False Data: The attacker samples M uniformly
pjq
random variables tδt ujPrM s , each from a discrete rangerδ (min) , δ (max) s for δ (min) , δ (max) P Z, whose steady-state
average is denoted by δavg , quantifying the stealth of the attack.
Attack Types: We consider deductive, additive, and camouflage
attacks. In deductive attacks, the consumption data is reduced
from its original values to incur losses to the utility and errors
in forecast. For j P rM s, the compromised meter reading
pid q
pjq
is given by pt j ´ δt . Whereas, in additive attacks, it ispidj qpjq
pt` δt , intended to incur loss of business confidence
that users experience owing to rival companies. In camouflage
attacks, each half of the set of the compromised meters launch
additive and deductive attacks simultaneously, with an intention
to keep the mean consumption same, while favoring one set ofcustomers at the expense of other half.
Falsification Distribution Strategy: We pick data order aware
as it is the stealthiest of all strategies that has lowest deviationfrom the original data distribution compared to other known
strategies such as scaling attacks. More specifically, the random
pjq
variables tδt ujPrM s are sorted in ascending and descendingorders for the deductive and additive attacks, respectively. We
consider that the attacks occur between two timeslots, and theevaluation uses different attack start points and averages themto remove performance bias.
IV. P RIVACY- PRESERVING A NOMALY D ETECTION
We propose a privacy-preserving anomaly detection by
adopting HE to our previous work [6] based on the HMAM ratio. The HM-AM ratio requires several HE-unfriendly
operations. Thus, naı̈ve adoption of the HE leads to inefficiency
in terms of both storage/communication and computationalcosts. We optimize both encoding and encryption procedures
to mitigate these. In what follows, we describe our protocol insequence.
A. Initial Setup
The utility performs key generation and obtains a secret andpublic key pair (sk, pk) and an evaluation key evk. Then, pk
is installed manually in each smart meter which encrypts thepower consumption data to form an HE ciphertext, while evk
is sent from the utility to the computational server. sk is kept
secret at the utility for the decryption of the ratio.
B. Data Encoding & Encryption via User-side Precomputation
At first glance, the ratio can homomorphically be computed
pjq
from a set of encrypted power consumption Encppt q. As
shown in Eqn. (1) and (2), computation of the ratio consists

of a set of HE-unfriendly operations such as log-transformation
for AM and its inverse for HM. Evaluating these over encrypted
data is expensive because of the large multiplicative depth.
Moreover, the encryption process gets expensive especially in aresource constrained IoT device such as smart meter due to thelack of computational resources. We address these problems.
Optimized Data Encoding: In Eqn. (2), the log-transformationand its inverse are applied on each power consumption. Thus,
each of the smart meters can compute these operations locallyin plaintext, and then encrypts three values. This can lower
the HE parameter set compared with the naı̈ve solution where
the server homomorphically evaluates these operations. Morespecifically, the i-th smart meter locally performs natural log
piqtransformation, and computes its inverse, yielding Pt
“
1
piq
piq
piq
lnppt ` 2q and Pt“ 1{Pt , respectively. Then, three
1
piq
piq
piq
ciphertexts Encppt q, EncpPt q and EncpPt q are generated
by the i-th smart meter for each i P rN s.
Optimized Encryption: The encryption process of the CKKS
scheme is broken into two steps: 1) generating an encryptionof zero, and 2) adding a message to the encryption of zero. As
later shown in Table II, 1) takes 97% of the encryption time.
Meanwhile, it can be performed independently of the message.
Thus, instead of adopting the CKKS encryption directly bypiq
performing the two steps after pt is known, our method firstpiq
pre-computes the encryption of zero, before pt is known.
Namely, the i-th smart meter first generates three encryptionsof zero z0 Ð Encp0q, z1 Ð Encp0q, z2 Ð Encp0q. After the log
piqtransformations on pt are performed, the resulting ciphertexts
piq
piq
piq
piq
are generated via Encppt q Ð z0 `Pt , EncpPt q Ð z1 `Pt
1
1
piq
piq
and EncpPt q Ð z2 ` Pt . Note that each z0 , z1 and z2
must be re-generated after the encryption process is completed
in every timeslot. This is because subtracting the two ciphertexts generated from the same encryption of zero reveals thedifference between the two underlying messages.
C. Invariant Time Series Computation over Encrypted Data
For each date, the computational server homomorphicallyevaluates Eqn. (1) via Algorithm 1. We use the homomorphic
division algorithm Inv presented in [9]. The encrypted ratio issent to the utility.
Algorithm 1 Homomorphic Evaluation of the Daily Ratios
Input:‚

piq

Encrypted log power consumption in an area tEncpPt quiPrN s,tPT
1 piq

Encrypted inverse log power consumption in the area tEncpPt
Output: Encrypted HM-AM ratio
1: HM Ð 0, AM Ð 0
2: for t P T do
3:
fracsumt Ð 0, sumt Ð 0
4:for i Ð 1 to N dopiq
5:sumt Ð sumt ‘ EncpPt q
‚

1

piq
6:
fracsumt Ð fracsumt ‘ EncpPt q
7:
end for8:
HM Ð HM ‘ pInvpfracsumt q d N q
1
9:AM Ð AM ‘ psumt d Nq
10: end for
11: return HM d InvpAMq

quiPrN s,tPT

D. Anomaly Detection from the HM-AM ratio (in Plaintext)
Upon receiving the ciphertext, the utility decrypts it andlearns the ratio Qd . Then, the utility performs anomaly detection in plaintext. Algorithm 2 presents the overall protocol,
except the initial setup.
Algorithm 2 Privacy-preserving Anomaly Detection Protocol
1) Data Transmission: In a year y on the d-th date at each timeslot t in an area,
the i-th smart meter SMi does the following:piq‚

Obtain the power consumption py,d,t‚Compute Py,d,t :“ lnppy,d,t ` 2q and Py,d,t :“

‚

piq

piq

piq

piq

1 piq

1 piq

1
piq
P
y,d,t

Encrypt py,d,t , Py,d,t and Py,d,t using pre-installed pk
piq
piq
Encppy,d,t q, EncpPy,d,t q

1 piq

Send
and EncpPy,d,t q to the computational
server through a data collector in NAN and other higher-level network
2) Homomorphic Evaluation of HM-AM Ratio: Upon receiving the ciphertexts,
the computational server does the following:‚ Call Algorithm 1 and obtain EncpQd q if the daily amount of ciphertexts is
piq
available (Encppy,d,t q is used for other tasks as discussed in Section VII)
‚ Send EncpQd q to the utility3) Anomaly Detection: The utility does the followings:‚ Decrypt EncpQd q using sk, and locally save Qd‚ Perform training if a sufficient amount of Qd ’s is available‚ Perform test if the training phase has been performed, and obtain a decisionbit‚

V. S ECURITY A NALYSIS
In our system, joint privacy and accuracy of attack detection
must be ensured. We show how to guarantee privacy while alsopreserving the correctness of anomaly detection metrics, suchthat sensitivity to attack detection is not degraded. Since thecorrectness is ensured by setting the ciphertext modulus large
enough which is described in the next section, we only describe
the privacy analysis below.
We show that the privacy of fine-grained power consumption is preserved against both the computational server andpiq
piq
the utility. Each smart meter sends Encppt q, EncpPt q and1
piq
EncpPt q at each timeslot to the computational server. The
server calls Algorithm 1 to homomorphically evaluate the HMAM ratio for each date, and the resulting ciphertext is sent
to the utility. Subsequently, the utility decrypts and learns
the HM-AM ratio. As each of the ciphertexts is generated
under the semantically secure CKKS encryption scheme, noinformation about the underlying messages is revealed to thesemi-honest server. The HM does not have a closed-form
expression itself [6]; thus, its ratio with AM makes it impossible
to infer the individual customer consumption as the number ofparticipating meters becomes more than three. Therefore, it isreasonable to conclude that the individual privacy is preserved
against the semi-honest utility and the computational server aslong as they do not collude.
VI. P ERFORMANCE E VALUATIONIn this section, we examine the feasibility of our protocol
with a real dataset in terms of accuracy and efficiency. First, we
compare the accuracy of our protocol with that of the method
in plaintext (i.e., non-private). Then, we report the runtime ateach user and the one at the server, and the ciphertext sizes.

B. Attack Detection Accuracy and Correctness
We compare the detection accuracy from anomaly detection
with and without HE via receiver operating characteristics(ROC) curve. We calculate the ROC by tuning different standard limits, and then examine trade-off between false alarms
and true attack detection as a way of evaluating the performance of the anomaly detector. Specifically, we attempt toshow how close our HE-based anomaly detector performs with
its plaintext counterpart and show the extent of performancedegradation across varying thresholds. Fig. 2(a) shows the ROC
curve for deductive attack with two extreme δavg of 200W and800W to show that the sensitivity scales well across margins.
Similarly, Fig. 2(b) and (c) respectively show the same for the
camouflage and additive attack. From the close proximity ofboth ROC curves with and without HE for all attack types,
it is shown that the attack detection performance is preserved
under HE.
1 https://www.pecanstreet.org/
2 https://github.com/kimandrik/HEAAN

1.0

True Alarm Rate

1.0

True Alarm Rate

0.8

0.8

0.6

0.6

0.4

0.4

200W w/o privacy
200W w/ privacy
800W w/o privacy
800W w/ privacy

0.2
0.0
0.0

0.2

0.4

0.6

0.8

0.0

1.0

False Alarm Rate

200W w/o privacy
200W w/ privacy
800W w/o privacy
800W w/ privacy

0.2

0.0

(a) Deductive

0.2

0.4

0.6

0.8

False Alarm Rate

1.0(b) Camouflage

1.0

True Alarm Rate

A. Experimental Setup
We used a smart grid dataset collected from Pecan Street
Project1 , which consists of a dataset from 200 households in
Texas, USA over three years (2014–2016). The number oftimeslots per day is 24. The data in 2014–2015 was used forthe training phase, wheres the data in 2016 was used for the test
phase. For the data pre-processing, we performed winsorizing
as in the original work [6] by setting the lower and upper limitsof each power consumption to 50W and 6000W, respectively.
That is, values smaller (resp. greater) than 50 (resp. 6000) are
replaced by 50 (resp. 6000).
We implemented our system in C++ using g++ 7.4.0 with “O2” option. We used Raspberry Pi 3 equipped with an ARMv7
processor (1.2 GHz), 1GB RAM, and 64GB SD card for an
experiment on user-side computation. The other experiments
about the computational server and the utility were ran on amachine running Ubuntu 16.04, equipped with Intel Xeon E51620 v4 3.50 GHz in single-threaded mode.
We used the HEAAN library2 ; an open-source implementation of the CKKS scheme, and chose a parameter set as
pn, log Q, pq “ p215 , 491, 35q, in which a fresh ciphertext size
is calculated as 2n log Q bits. The other parameters were default
values such that the parameter set provides the correctness andan 80-bit security level according to the online security estimator [10]. Let L be the multiplicative depth. To maintain the
precision and message growth throughout the computation, theciphertext is rescaled after every homomorphic multiplication.
As a result, we chose log Q “ L ¨ 2p ` p2p`1 q such that thesize of the ciphertext the utility obtains is 2npp ` 1q bits, i.e.,during decryption, the utility can obtain a noisy HM-AM ratio
as a pp`1q-bit fixed-point integer with the integral part and thefractional part being 1-bit and p-bit, respectively. Algorithm 1
requires L “ 13 mostly due to the Inv operation. We found pfrom the experiment.

0.8
0.6
0.4

200W w/o privacy
200W w/ privacy
800W w/o privacy
800W w/ privacy

0.2
0.0
0.0

0.2

0.4

0.6

0.8

False Alarm Rate

1.0(c) Additive
Figure 2. Sensitivity of Anomaly Detection Performance

C. Computation and Communication Performance Results
We show how our framework performs for smart metering,in terms of time to encryption completion, the computation
time, and the data size given that the HE is known to becomputational and resource-intensive.
1) User-side Computation Speed-up: Table I shows thecomplexity reduction of the cost by our method from the naı̈ve
generation of the CKKS ciphertext. It is known that any subroutine in the CKKS is bounded by polynomial multiplications.
With our technique, all necessary polynomial multiplications
for the encryption are offloaded in the pre-computation phase,and ciphertext generation can be done with only a single
polynomial addition.
We measured the actual runtime for encrypting three ciphertexts by each household at each timeslot to assess the timeto encryption completion. We compared the timing result of
the naı̈ve CKKS encryption method with that of our proposed
method. Table II shows the speed-up of the timing result for
the encryption completion at the user side.
Table IRUNTIME COMPLEXITY FOR USER - SIDE ENCRYPTION
MethodCKKS Encpmq
Pre-computation (Encp0q)
Optimized Enc (Encp0q ` m)

# Poly. Mult.
2
2
0# Poly. Add.
321

Table IIRUNTIME FOR USER - SIDE ENCRYPTION COMPLETION IN MILLISECOND
MethodCKKS Encpmq
Pre-computation (Encp0q)
Optimized Enc (Encp0q ` m)

RAM
4525
4512
112

SD Card
N/A
7964
4151

In our experiment, we have two options to store the encryption of zero; viz., a RAM or SD card in the Raspberry Pi. The
primary difference between using the RAM and SD card is theexistence of a file I/O. With the SD card, the pre-computedEncp0q is written. Once the message m is known, it is added
to Encp0q read from the card. The file write took 3479ms while
its read took 4040ms, indicating almost the same cost as theoriginal Encpmq with the RAM. The usage of the RAM showsthat the pre-computation takes most of the time in the entire
encryption process while the addition of m is cheap. Therefore,
our encryption time is accelerated especially with the RAM. As
smart meters are typically online in the smart grid, using the
RAM-based pre-computation is a valid optimization.
2) Computation Time at Server and Utility: We measured
two different computational time at the server, and the one at
the utility, as shown in Table III. First, server side computation
Table IIIA NOMALY D ETECTOR T URNAROUND T IME IN SECOND
Step
Server Computation / timeslot

Running Time
9.935

Server Computation (last timeslot)

18.342

Utility Decryption

0.022

time per timeslot was measured, i.e., average computation timein each iteration of the outer loop in Algorithm 1. Next, wemeasured time for computing the last iteration of the outer
loop followed by completing the ratio computation. Finally,
the time for decrypting the HM-AM ratio at the utility wasmeasured. Because the minimum requirement of AMI is toperform the test phase of the anomaly detection on a daily
basis, we achieved significantly faster protocol.
3) Ciphertext Size: Table IV shows concrete cost of ciphertexts size. In our protocol, CKKS ciphertexts are transferred in
the following paths: 1) from each household to the server and 2)
from the server to the utility. The size of the CKKS ciphertexts
gets smaller as the rescaling is performed. Therefore, the sizeof ciphertexts from the sever to the utility is smaller than thatfrom each smart meter to the server.
Table IV
C IPHERTEXT SIZE FOR ANOMALY DETECTION
A Household Ñ Server
Server Ñ Utility3 ¨ 2 ¨ 215 ¨ 491 bit = 11,784KB
2 ¨ 215 ¨ 36 bit = 288KB

VII. D ISCUSSION ON S MART G RID F UNCTIONALITY
While we showed the applicability of the anomaly detection
in a smart gird in a privacy-preserving manner, the primary
requirements in a smart grid are automated billing and loadmonitoring. In this section, we discuss the capability of our
proposed system to these tasks:
Load Monitoring: Load monitoring and forecasting are performed at different scales, and data aggregation (homomorphic
addition) is sufficient for these tasks.
Automated Billing: Automated billing is performed for individual customers. It can be accomplished via data aggregationof power consumption from a specific customer over timeslots(e.g., per day). Thus, simple homomorphic addition is sufficient.
Our CKKS parameter is capable of handling these tasks since
they do not require homomorphic multiplications.

Handling Each Tasks in Different Sectors: Moreover, we
provide another option in case each task is performed indifferent organizations or different sectors of the utility, i.e.,
the anomaly detection center C1 , load monitoring center C2 ,and the billing center C3 . Accordingly, we consider a setting
where the secret key is generated by a cryptographic service
provider (CSP) instead of the utility, which also does notcollude with the server. The only difference from the system
in Figure 1 is that each center will receive its appropriate value
from both the server and the CSP. For example, suppose theserver holds Encpr1 q and C1 is willing to obtain r1 . The server
first generates a uniformly random number r11 in some integer
ring Zq that the CKKS scheme natively supports. It sends
Encpr1 ´ r11 q and r11 to the CSP, and C1 , respectively. Thenthe CSP decrypts and sends r1 ´ r11 mod q to C1 . Finally, C1
only knows r1 by adding the two received values over Zq .
VIII. CONCLUSION
In this paper, we developed a privacy-preserving anomalybased attack detection framework using HE, that does not
sacrifice the functionality of smart grid and sensitivity of theanomaly detector. The quantification of the information leakageof the fine-grained power consumption from the HM-AM ratio
will be part of our future work.
Acknowledgments: This work was supported by JST
CREST Grant #JPMJCR1503, Japan-US Network Opportunity(JUNO2) funded by NICT and NSF; and also by NSF grants
DGE-1433659, CNS-1818942, CNS-2030611, CNS-2030624.
R EFERENCES[1] M. R. Asghar, G. Dán, D. Miorandi, and I. Chlamtac, “Smart Meter Data
Privacy: A Survey,” IEEE Communications Surveys Tutorials, vol. 19,
no. 4, pp. 2820–2835, 2017.
[2] G. Danezis, C. Fournet, M. Kohlweiss, and S. Zanella-Béguelin, “Smart
meter aggregation via secret-sharing,” in Proceedings of the First ACM
Workshop on Smart Energy Grid Security. ACM, 2013, pp. 75–80.
[3] M. A. Mustafa, S. Cleemput, A. Aly, and A. Abidin, “A secure andprivacy-preserving protocol for smart metering operational data collection,” IEEE Transactions on Smart Grid, 2019, (To Appear).
[4] F. Li, B. Luo, and P. Liu, “Secure information aggregation for smart grids
using homomorphic encryption,” in Proceedings of IEEE International
Conference on Smart Grid Communications, 2010, pp. 327–332.
[5] X. Liang, X. Li, R. Lu, X. Lin, and X. Shen, “UDP: Usage-Based
Dynamic Pricing With Privacy Preservation for Smart Grid,” IEEE
Transactions on Smart Grid, vol. 4, no. 1, pp. 141–150, 2013.
[6] S. Bhattacharjee and S. K. Das, “Detection and Forensics against Stealthy
Data Falsification in Smart Metering Infrastructure,” IEEE Transactions
on Dependable and Secure Computing, vol. to appear, 2020.
[7] J. H. Cheon, A. Kim, M. Kim, and Y. Song, “Homomorphic encryption
for arithmetic of approximate numbers,” in Advances in Cryptology –ASIACRYPT 2017, Proceedings, Part I, vol. 10624 of LNCS, 2017, pp.
409–437.
[8] S. Bhattacharjee, A. Thakur, and S. K. Das, “Towards fast and semisupervised identification of smart meters launching data falsification
attacks,” in Proc. of ACM ASIA CCS, ser. ASIACCS, 2018, pp. 173–185.
[9] J. H. Cheon, D. Kim, D. Kim, H. H. Lee, and K. Lee, “Numerical Method
for Comparison on Homomorphically Encrypted Numbers,” in Advancesin Cryptology – ASIACRYPT 2019, vol. 11922 of LNCS.
SpringerInternational Publishing, 2019, pp. 415–445.
[10] M. Albrecht, R. Player, and S. Scott, “On the concrete hardness ofLearning with Errors,” Journal of Mathematical Cryptology, vol. 9, no. 3,
pp. 169–203, 2015.