# Risk Assessment Method of Solar Smart Grid Network Security Based on TimesNet Model
## 3 SSG-NSR Evaluation
### Sgid Model Based on Bi-Lstm  
The proposed TimesNet-based SGTBD model can detect electricity theft behavior in smart grids, but mainly focuses on the physical network of the grid. The development of information technology construction in smart grids may also involve the risk of information side network attacks, especially those aimed at obtaining economic benefits. In addition, with the integration of distributed energy sources such as solar energy, the network boundaries of smart grids have become more complex and the attack surface has expanded. Intrusion detection of solar smart grids has become increasingly important and is a key component of smart grid security. Therefore, to conduct a security risk assessment of the information network of the smart grid, this study will build an SgID model. Considering that the data feature dimension of the smart grid information network is relatively high and contains a large amount of redundant information, this study first uses DBN to perform feature dimensionality reduction. DBN is essentially a generative graphical representation  
Figure 2: Structure diagram of SGTBD model based on TimesNet. network consisting of multiple stacked Restricted Boltzmann Machines (RBM) and one or more classifiers [23]. The DBN structure is exhibited in Figure 3.  
In Figure 3, the unsupervised pre training stage is from the input layer to the output layer, and each RBM layer of DBN is trained through unsupervised learning using unlabeled data. After pre-training is completed, DBN can be fine-tuned using labeled data, so the process of returning from the output layer to the input layer is supervised learning. RBM is a randomly generated neural network that can learn probability distributions from input datasets. Its structure is simplified into visible and hidden layers, and the connections between these two layers are bidirectional, but there are no connections between nodes within each layer, allowing RBM to learn feature representations of data unsupervised. By learning high-dimensional features of data, RBM can help reduce the data dimensionality. The energy function of RBM can be used to calculate the probability distribution of RBM. Given a set of states \((v,h)\), their energy function \(P(v,h)\) is shown in Equation (9). \[P(v,h)=-\sum_{i=1}^{n}a_{i}v_{i}-\sum_{j=1}^{m}b_{j}h_{j}-\sum_{i=1}^{n}\sum_{j =1}^{m}v_{i}w_{ij}h_{j} \tag{9}\]  
In Equation (9), \(v=(v_{1},v_{2},\dots,v_{n})\) is a visible layer neuron. \(h=(h_{1},h_{2},\dots,h_{m})\) is a hidden layer neuron. \(a_{i}\) and \(b_{j}\) are the bias terms of \(v_{i}\) and \(h_{j}\). \(v_{i}\) and \(h_{j}\) are the state of the \(i\)-th and \(j\)-th visible and hidden layer neurons. \(w_{ij}\) is the connection weight between \(v_{i}\) and \(h_{j}\). In the pre training stage of DBN, it is necessary to use multi-layer RBM to map feature vectors to a new space. In RBM, given the activation state of the visible layer, the state of each hidden layer neuron depends only on the state of the visible layer neuron and is independent of the states of other hidden layer neurons. The calculation of the probability \(p\big{(}h_{j}=1\big{|}v,\theta\big{)}\) of \(h_{j}\) being activated is shown in Equation (10). \[p\big{(}h_{j}=1\big{|}v,\theta\big{)}=\sigma\Bigg{(}\sum_{i}w_{ij}v_{i}+b_{j} \Bigg{)} \tag{10}\]  
Figure 3: Structure diagram of DBN. In Equation (10), \(\sigma\) represents the Sigmoid activation function. According to Equation (10), the probability \(p\big{(}v_{j}=1|h,\theta\big{)}\) of \(v_{i}\) being activated can be derived in reverse, as shown in Equation (11). \[p\big{(}v_{j}=1|h,\theta\big{)}=\sigma\Bigg{(}\sum_{i}w_{ij}h_{i}+a_{j}\Bigg{)} \tag{11}\]  
After completing feature dimensionality reduction, this study takes these preliminary features as inputs for network intrusion detection. Deep learning has been widely applied in network intrusion detection, which can automatically extract features and classify large amounts of data through learning, thereby identifying attacks and malicious behaviors.