## 2 ToU Pricing Dataset and Synthetic Theft Cases Generation
### Novel d-ToU and f-ToU Price-Based Theft Cases Generation Using Novel Window-Based Usage Analysis  
As seen in the previous literature review, the dataset used in [17] is one of the first public electricity consumption datasets with labelled realistic theft cases, with a sampling rate of one per day: \(f_{s}=1\). However, in order to study ToU-based theft cases, we need datasets with a higher sampling rate (i.e., \(f_{s}\) is much larger than 1) and labelled theft data. Fortunately, the ToU-based dataset of the Low Carbon London project with \(f_{s}=48\) solves the first half of this problem. However, there still exists a lack of verified theft cases in this dataset. Therefore, like many other existing studies in the literature, we are limited to experimenting with synthetically generated theft cases in this paper. That is, until a realistic public ToU pricing scheme-based dataset is released by a reputable source that contains verified and labelled theft cases, synthetic theft case generation is necessary for the testing of the proposed ML-based theft detection algorithm (see Section 4) and not easily negligible; it is carefully analyzed in the next section. In this paper, we assume that from the perspective of the attacker, any day can be broken down into the two \"windows\", i.e., the \"theft period\" window indicating time periods where theft could result in maximum profit to the attacker and the \"non-theft period\" specifying the least profit for the attacker. Hence, the synthetic theft cases proposed  
Figure 1: Example of a single day usage from the dataset (sampling interval of 30 min) of a consumer. Dotted line represents corresponding tariff period (0—low, 1—normal, and 2—high price periods, respectively). in this section are revisions of previous theft cases, taking these windows of variable time durations into consideration. The \"windows\" could be, of course, randomly chosen time slots or carefully planned time slots to maximize the profits of the attackers. Based on our previous literature review, in many papers (such as [13; 15]) where existing flat pricing is chosen, the probable theft cases have been mathematically modelled to mimic the intentions of the attacker using the entire consumption data of each day. However, in the case of ToU, with the tariff prices given a day ahead via the Smart Meter IHD text message to mobile phones, we assume that a malicious consumer may steal electricity (or manipulate meter readings) only during certain periods with the intentions to minimize his electricity bill and maximize his profits. From the dataset, we find that on average, the high and normal price periods together contribute to approximately 97% of the total tariff, which means the consumer will benefit the most if theft occurs during those periods. Hence, when dynamic pricing is adopted, the theft pattern could be different from static pricing and targeted to highly probable theft periods or simply the \"theft period\", denoted as \(x_{tp}\). Such a theft strategy may significantly reduce the consumer's chance of being caught by traditional consumption only-based classifiers. In this paper, for simplicity and the availability of real-world data, we extensively study the two window-based ToU pricing models, i.e., dynamic ToU (d-ToU) and fixed ToU (f-ToU) and apply them to update (or revise) the conventional theft cases. Although the f-ToU and d-ToU pricing systems are simulated in this paper, we can extend the proposed methods to other pricing systems with ease (for example, RTP, etc.). In the case of d-ToU, the low, normal, and high (or on-peak) price periods are not at the same time every day, while high price and/or low (or off-peak) price periods are absent on some days. Therefore, these windows are variable in size every day. On the other hand, in the case of f-ToU, the on-peak, off-peak, and normal hours are at same time every day such that the theft periods \(x_{tp}\) are fixed for each day during the high and normal price periods.