# IoT Anomaly Detection to Strengthen Cybersecurity in the Critical Infrastructure of Smart Cities
## 3 Results
### Model Implementation  
In implementing the anomaly detection models, a practical approach was achieved to address several critical scenarios. One of the highlights of this implementation was the ability of these models to identify attempts to tamper with the power grid, which significantly contributed to the prevention of cyber-attacks. First, threats related to the  
Figure 4: Comparison of precision and completeness curves of anomaly detection models. Figure 5: Comparison of accuracy and completeness of anomaly detection models. smart grid were addressed. The electrical grid is a fundamental component of a smart city, and its integrity is essential for adequately functioning other systems. Several anomalies in electricity consumption data were identified, such as unusual fluctuations in energy demand in certain areas or times of day. These anomalous patterns could indicate tampering attempts or targeted cyber-attacks on the power grid. The results in Table 6 reflect the anomaly detection models' success in identifying various anomalous situations in the smart city power grid. These models have demonstrated remarkable effectiveness in achieving high accuracy, completeness, and F1-score scores in their performance evaluation. The diversity of models used, such as Isolation Forest, RNNs, and VAEs, shows their ability to address different types of anomalies and patterns in electrical data. Additionally, ROC and precision-completeness curves provide a detailed view of how the models perform regarding accurate positive rates, false favorable rates, and the relationship between precision and completeness. Together, these results support the efficiency of the models in detecting anomalies, which contributes to the safety and stability of the smart city power grid. Another notable use case relates to preventing unscheduled outages, as presented in Table 7. The anomaly detection models could anticipate and detect failures in critical components of the power grid, such as transformers and transmission lines. This allows preventive measures, such as preventative maintenance or equipment replacement, to be taken before catastrophic failures occur. In protecting against cyber-attacks, the models also proved effective in detecting suspicious patterns in power grid communication data. For example, Table 8 detected attempts to infiltrate the electrical grid control system through unauthorized access. These attempts were detected and blocked before they caused significant damage. \begin{table}
\begin{tabular}{c c c} \hline
**Date and Time** & **Type of Anomaly** & **Detected Model** \\ \hline
15 March 2023 09:45:00 & Demand Fluctuation & Isolation Forest \\
20 March 2023 14:30:00 & Voltage Manipulation & RNN \\
25 March 2023 21:15:00 & False Data Injection & VAE \\
2 April 2023 17:50:00 & Frequency Alteration & Isolation Forest \\
8 April 2023 08:15:00 & Substation Overload & RNN \\
14 April 2023 23:00:00 & Unexpected Variations & VAE \\
20 April 2023 10:05:00 & Reading Manipulation & Isolation Forest \\
26 April 2023 19:20:00 & Noise Injection & RNN \\
3 May 2023 12:40:00 & Phase Imbalance & VAE \\
10 May 2023 05:55:00 & Pattern Detection & Isolation Forest \\ \hline \end{tabular}
\end{table} 
Table 6: Record of anomalies detected by models.