## 1 Introduction
Noisy CAT readings pose a challenge for detecting electricity theft and designing accurate predictors compared to using actual readings. In this paper, we propose a two-stage approach for AMI using CAT readings. The first stage includes a predictor trained exclusively on CAT power consumption readings, with the output being the actual readings. To improve prediction performance, we introduce a cluster-based predictor that groups consumers into clusters with similar consumption patterns, and a dedicated predictor is trained for each cluster. In the second stage, a one-class SVM is trained on the benign reconstruction errors from the predictor to classify instances of electricity theft. We conducted comprehensive experiments to evaluate the effectiveness of our proposed predictor and one-class electricity theft detector. The experimental results indicate that the prediction error is minimal and the detection accuracy is high. To the best of our knowledge, this paper presents the first attempt to design a one-class classifier for CAT readings and a predictor using CAT readings as input. This work is particularly challenging for two reasons: (1) CAT readings are clipped compared to the actual readings, making it more difficult to design models based on CAT data; and (2) since we aimed to develop a one-class anomaly detector to defend against zero-day attacks, which typically suffers from low accuracy, we incorporated clustering techniques along with a carefully designed model architecture to ensure high accuracy. Our main contributions in this paper can be summarized as follows:  
* We propose a two-stage scheme consisting of a predictor and a classifier to detect electricity theft in the smart grid while optimizing data collection using the CAT approach. The predictor generates accurate power consumption readings, while the classifier accurately identifies instances of electricity theft. * In the first stage, we develop a global-based predictor trained exclusively on benign CAT consumption readings to produce actual readings. To improve prediction accuracy, a cluster-based predictor is used, grouping consumers with similar consumption patterns and training dedicated predictors for each cluster. This approach results in more accurate predictions and less errors across various CAT thresholds. * In the second stage, we train an autoencoder and a one-class support vector machine (OC-SVM) on benign reconstruction errors from the predictor to detect instances of electricity theft. This combined architecture of the autoencoder and OC-SVM demonstrates superior performance compared to training the OC-SVM directly on the errors, achieving higher accuracy, precision, recall, and F1 scores. * We performed extensive experiments using a real dataset to assess our proposals. The experimental results show that our models achieve accurate power consumption predictions, high detection accuracy, and low false alarm rates, demonstrating their ability to learn consumption patterns and make correct predictions and classifications. The remainder of this paper is structured as follows. Section 2 reviews the related literature, providing an overview of current research on securing AMI networks from malicious smart meters. It also highlights the main limitations and our motivations. Section 3 offers the necessary background information to understand our study, covering the K-means clustering technique, recurrent neural networks (RNNs), and one-class support vector machine (OC-SVM). In Section 4, we first describe our accurate power consumption predictor,followed by a detailed explanation of our electricity theft classifier. Section 5 presents our evaluation results for both the predictor and classifier, detailing the dataset preparation process, the metrics used for evaluation, and a discussion of our experiments and their results. Finally, Section 6 concludes the paper by first summarizing the key findings of our research and then discussing some future works.