## 3 Detection of Cyber-Attacks with Supervised Machine Learning-Artificial Neural Networks
### Deployment of Supervised Machine Learning-Based Artificial Neural Networks  
Data-driven methods, i.e., AI-based solutions, are implemented to detect cyber threats in various applications [38; 39; 40; 41] in cyber-physical systems. The choice of neural network type should be made based on the nature of the system to be modeled. Feedforward neural networks are preferred if the relationship between inputs and outputs in the system is static. While the capacitor of the PV converter stores and discharges energy, the inductor creates a magnetic field and affects currents that change over time. Therefore, there is no instantaneous input-output relationship; instead, there is a time series-based relationship that also considers past situations. Since the capacitor voltage and inductor current depend on past values, a dynamic relationship exists between inputs and outputs. Hence, models, such as recurrent neural networks (RNNs), long-short-term memory (LSTM), or gated recurrent unit (GRU), which account for time dependence, are favored over feedforward neural networks. For this purpose, the proposed ANN design typically operates on sensor datasets, as they do not need feedback mechanisms. If a pattern recognition problem is a time-dependent problem (e.g., time series analysis, speech recognition, anomaly detection), dynamic ANN types can be developed using different architectures. To simplify the defense mechanism and reduce complexity with effortless computational burden, a basic ANN structure has been preferred to classify inputs into a set of target categories. Given that the capacitor voltage-\(V_{C}\) and inductor current-\(I_{L}\) depend on past values, a dynamic relationship exists between inputs and outputs in the proposed ANN that detects signal anomalies. The relationship between capacitor voltage and inductor current corresponds to a nonlinear dynamic structure in power electronic circuits, mainly due to their switched structures and semiconductor elements. To this end, this type of ANN employs supervised learning and deep learning techniques. They are implemented using a multi-layer perceptron (MLP) and effectively address pattern recognition problems through the backpropagation algorithm to accurately classify vectors. The two-layer feed-forward neural network structure utilizes sigmoid activation in the hidden layer and a SoftMax activation function in the output layer. The network is trained with scaled conjugate gradient backpropagation to mitigate vanishing gradient issues. This scheme assesses its performance using cross-entropy and confusion matrices. The results appear satisfactory, indicating that this scheme is particularly effective for identifying anomalies in signals, such as \(V_{C}\) and \(I_{L}\). Equation (13) expresses the feature vector for the ANN-based detection scheme (state variables) as follows:  
\[x_{n}=[V_{c},I_{L},dV_{c}/dt,dI_{L}/dt] \tag{13}\]  
To train well-predefined ANN as a classifier to discriminate between regular changes and attack changes in capacitor voltage and inductor current, the logic state of the attack bit can be presented as a function of the input vector as  
\[Attack\_Bit=f(x_{n}) \tag{14}\]  
As for \(\lambda_{V}\) and \(\lambda_{I}\), they are predefined threshold values for voltage and current, respectively. If a threat is detected, an alarm-like logic state change is triggered to indicate the attack. The detection case can be formulated as  
\[ \begin{array}{l}|V_{c}-{V_{c}}^{*}|>\lambda_{V}\\ |I_{L}-{I_{L}}^{*}|>\lambda_{I}\end{array}  \tag{15}\]  
The algorithm mentioned used in ANNs is displayed below as a pseudo-code flow as seen in Algorithm 1. In Figure 4, ANNs are executed for [a] cyber-attack detection scheme and [b] DC bus voltage-\(V_{DC}\) estimation to support the demand side.