## 4 Experiments and Results
\begin{table}
\begin{tabular}{|p{113.8 pt}|p{113.8 pt}|} \hline
**Algorithm** & **Parameters** \\ \hline BHL (dataset 1) & iters = 3000, lrate = 0.01, \(\alpha=3\), \(\beta=3\) \\ BHL (dataset 2) & iters = 10,000, lrate = 0.01, \(\alpha=3\), \(\beta=4\) \\ BHL (dataset 3) & iters = 10,000, lrate = 0.05, \(\alpha=3.5\), \(\beta=5\) \\ k-means (dataset 1, 2 and 3) & k = 6, random initialization of the centroids, sqEuclidean distance \\ \hline \end{tabular}
\end{table} 
Table 2: BHL and k-means parameters for datasets 1, 2 and 3. Finally, dataset 3 presents a combination of 2 types of attacks, scan port (3 port attacks) and MIB transfer (source-destination and destination-source attacks), therefore, there are 5 attacks and the rest of the sample contains information about the normal behaviour of the network. Figure 6 presents the best BHL projection for dataset 3 (MIB transfer and scan port). In this case, BHL can clearly differentiate between the samples associated with normal network behaviour (green samples in Figure 6) and the samples belonging to abnormal situations. Moreover, BHL can distinguish the different types of scan port. Figure 3: MOVICAB projection for dataset 1, port scan attack. Figure 2: BHL projection for dataset 1, port scan attack. port (red, blue and cyan samples in Figure 6) and MIB transfer attacks (2 types, yellow and magenta samples in Figure 6). However, in previous researches (see Figure 7), MOVICAB-IDS was not able to generate separate groups without mistakes, as it mixed packets belonging to different categories, failing to distinguish between normal and abnormal samples. It is important to remark, that MOVICAB-IDS was able to detect 3 classes; normal samples, scan port, and MIB, however, it was not able to distinguish  
Figure 4: BHL projection for dataset 2, MIB transfer attack. Figure 5: MOVICAB projection for dataset 2, MIB transfer attack. becomes increasingly important. Therefore, the use of tools that are capable of visually representing the general behavior of these networks (in terms of data traffic), allows to quickly and easily detect possible attacks that cause abnormal network behavior. The results presented in Section 4 demonstrate that Dimensional Reduction Techniques (DRT), provide a general overview of the internal dataset structure. This helps prevent potential cyberattacks in smart grids through the visual inspection of the network's traffic data. The previously applied DRTs were able to visually represent the behaviour of the network's traffic data, however, their clustering is not good enough, especially in the case of different types of attacks that are produced at the same time (MIB and Scan port). On the contrary, BHL gives a detailed overview of the network traffic and provides well-defined clusters that make it possible to identify anomalous situations and different types of attacks, overcoming the challenges associated with data volume, system dynamics and network traffic diversity, including first-time attacks (0-day). The clarity of BHL projections makes it easy to distinguish between normal traffic and anomalous traffic patterns, facilitating the early detection of attacks. BHL can easily identify scan port attacks at different ports. Moreover, when this type of attack is combined with the MIB attack, BHL is not only able to distinguish between them but also between the two types of MIB attack and the scanned ports. This makes BHL a powerful tool for network management protocols. The results of the conducted experiment have proven that BHL's performance is superior to that of the techniques used in previous researches, proving comprehensible projections, where attacks are clearly distinguished from the normal behaviour of the network, even when different types of attacks occur at the same time. The results obtained by EPP algorithms such as BHL demonstrate that they are suitable to be applied in smart grids for the detection of intrusions in the network. In conclusion, advances have been made in the early identification and characterization of cyberattacks.