# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Data Integrity Attacks  
These are situations in which false data injection (FDI) commonly occurs. This form of attack aims to alter the values of electrical measurements or the outcomes of a network's state estimation. The objective is to manipulate the energy price or modify the data transmitted between components of the network. FDI can use sensors in supervisory control and data acquisition (SCADA) systems, sensors for weather monitoring, smart electricity meters, and physical communication components of neighborhood area networks (NAN) or wide area networks (WAN). Attackers usually know the network topology [40]. Technical, confidential information is in the control centers of electric utilities, and physical access is protected and regulated; therefore, it is not trivial for attackers to obtain the information, but it can happen [13]. In an FDI attack, electrical measurements such as voltage and current can be changed and even simulate a valid fault that causes switches or network protection elements to act [62]. Table 5 summarizes what will be described below. These are a series of situations on which studies have focused that aim to show applicable solutions in scenarios where an FDI occurs, such as affecting load frequency, altering the energy management system database, affecting consumption prices, phasor measurement unit data, and load forecasts. Each situation presents a different solution. To detect an FDI relative to load frequency control, artificial neural networks (ANN) are employed because attacks of this type do not have a fixed pattern and can be nonlinear and unpredictable. A Luenberger observer is combined to estimate values and send the observed data to the ANN unit to reduce the computational load [48]. One advantage of this method is its speed and accuracy; the disadvantage compared to other methods such as machine learning or network model-based detection algorithms is that it requires at least a simple mathematical model of the system under analysis. Anomalies involving data compromised in phasor measurement units (PMUs) can be related to load frequency control; however, from a more holistic viewpoint, the use of generative adversarial imputation networks (GAIN) combined with long short-term memory (LSTM) are also used to identify FDI with acceptable performance and computational cost [75]. This is a novel deep-learning-based data-manipulation attack resilient framework. The combination of convolutional neural network (CNN) and LSTM proves to be useful in constructing forecast-assisted methods to identify anomalies related to FDI [70]. This model proves to be able to identify anomalies with high accuracy and low false positives, is applicable towards PMU data integrity, and shows the effectiveness of designing layered structured detection systems. An intruder can launch an unstructured attack when they do not know the connectivity, topology, and configuration of the network, or a structured attack when they know the assets and their interconnections. In both cases, deleting or altering all or part of the database will be unusual, and the attacker will want to go unnoticed. In the face of a \begin{table}
\begin{tabular}{c l l} \hline \hline _Scenario_ & \multicolumn{2}{c}{_Method/Technique_} & _Objective_ \\ \hline \multirow{2}{*}{Affecting the load frequency} & ANN & \multirow{2}{*}{
\begin{tabular}{l} \\ Luenberger Observer \\ \end{tabular} } & \multirow{2}{*}{Identify anomalies} \\ \hline \multirow{2}{*}{Attacks on EMS systems} & Graphical comparisons & \\ \hline \multirow{2}{*}{FDI attacks in general} & Semi-supervised learning & \\  & GAN, CUSUM, CNN-LSTM, & \\  & GAIN-LSTM, STDGL, & \\  & Multi-tier detection schema & \\ \hline \multirow{2}{*}{Attacks on load forecasting} & Supervised learning & \\  & Unsupervised learning & \\  & SVM, k-NN & \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Detection of data integrity attacks in SGs. stealthy attack, a graph-based approach to graph matching will help identify anomalies in the power grid database [25].