## 3 Methods
### Overview
To enhance the reliability of the results, we employed various network attack identification and classification mechanisms proposed by [PERSON] et al. [30], and, on this basis, we introduced an additional simulation experiment, referred to as \"Case 2\", for evaluation on the IEEE 39-bus test system. This power system consists of 10 generators, 39 buses, and 46 lines, with detailed topological models and parameters available in the study by [PERSON] et al. [31]. To assess the power system's response to disturbances, we applied a power change (active power of 20 MW and reactive power of 0.2 MVar) at the end of the line between bus 3 and bus 4, close to bus 3. The disturbance lasted from \(\tau=0.2\) s to \(\tau=0.4\) s.

Based on the above state responses, various random network attacks were generated as the training dataset for the proposed neural network. For stealthy False Data Injection Attacks (FDIAs), the randomness depends on the construction algorithm and boundary constraints. In this paper, the maximum allowable threshold for bad data detection is listed in Table 1. The randomness of replay attacks lies in the start and end times of the recording and replay. The randomness of the periodic denial-of-service (DoS) attack is reflected in sleep time. The randomness of delay attacks is reflected in the random delays. The randomness of spoofing attacks is characterized by the attack probability and the upper limit of nonlinearity. In this paper, we set the channel number of the hidden state \(d_{model}\) to 32 and used the Adam optimizer with an initial learning rate of \(10^{-4}\). The batch size was set to 64. The experiments were conducted on a hardware platform equipped with an Intel Core i7-13700 KF CPU (Intel, Santa Clara, CA, USA) and accelerated using an NVIDIA GeForce RTX 4070 Ti GPU (Nvidia, Santa Clara, CA, USA). The software platform was implemented using Python 3.10 and the PyTorch 2.1.1 framework. To ensure that each variable had a fair impact on the model and to avoid certain variables dominating the results due to differences in scale, we applied mean-variance normalization to the raw data. Specifically, for each feature \(x\), we first computed its sample mean \(\mu\) and standard deviation \(\sigma\), and then used the formula \(x^{\prime}=\frac{x-\mu}{\sigma}\) to transform the feature into a new one with zero mean and unit variance. This normalization method ensures that all input features are on the same scale, allowing the model to more objectively evaluate the importance of each feature. In this way, our model can more effectively learn the complex patterns in time-series data without being dominated by the scale of specific variables. To evaluate the performance of the model, we used Precision, Recall, and F1-score as evaluation metrics. The formulas for these metrics are shown in Equation (14):

\[ \begin{split} Precision=\frac{TP}{TP+FP}\\ Recall=\frac{TP}{TP+FP}\\ F1\text{-}score=2\times\frac{Precision\times Recall}{Precision+ Recall}\end{split}  \tag{14}\]

where true positive (TP) is the number of detected attack scenarios, True Negative (TN) is the number of normal scenarios where no alarm is triggered, false positive (FP) is the number of normal scenarios where an alarm is incorrectly triggered, and False Negative (FN) is the number of attack scenarios that were not detected. ### Experiment Results

To comprehensively evaluate the performance of the STformer model in anomaly detection tasks, we meticulously designed a series of experiments and compared it with 10 different baseline methods. These baseline methods included OCSVM [32], Deep-SVDD [33], VAR [34], LSTM [35], LSTM-VAE [36], BeatGAN [37], OmniAnomaly [16], InterFusion [16], THOC [17], and LSSL [38]. According to Table 2, STformer performs exceptionally well in the anomaly detection task, achieving a Precision of 98.19%, which significantly surpasses other methods. This