# Gaussian Mixture Modeling for Detecting Integrity Attacks in Smart Grids
## 4 Experimental Set-Up and Results
### Parametrization and Results
The detection delays are 34 ms, 42 ms, 26 ms, 63 ms, and 28 ms with respect to scale, pulse, ramp, random and replay attacks. Since we deal with a detection task [39], we employed the following three typical figures of merit to measure the capabilities of the proposed framework:  
1. False positive (FP): it comprises the number of times that the proposed algorithm detects an integrity attack even though it is not present. 2. True positive (TP): it comprises the number of times that the proposed algorithm detects an integrity attack which is present. 3. False negative (FN): it comprises the number of times that the proposed algorithm does not detect an attack which is present. 4. True negative (TN): it comprises the number of times that the proposed algorithm does not detect an attack which is not present. 5. Detection Delay (DD): it measures the time delay for a correct detection by the proposed algorithm. Comparative results are tabulated in Table 1 with respect to the proposed GMM clustering approach and the one employing SVM. They were trained and tested on identical datasets in order to achieve a fair comparison. As we can see, the proposed approach reaches a higher performance level than the SVM with respect to every type of integrity attack. It achieves lower FP and FN rates along with smaller DDs. Some representative detection examples of the proposed method are demonstrated in Figure 4. The complementary results of TP and TN rates confirm the superiority of the proposed approach over the contrasted one. The attack which is detected faster by the proposed method is the _pulse_ one, while the one with the highest latency is the _ramp_ attack. We can observe that all the metrics are kept within very low values, which demonstrates the strength of the proposed approach, especially while considering the non linear characteristics of the specific application. The merits of generative modelling are evident here since the distribution followed by the nominal state of the system is better captured and subsequently identified. The dependencies existing in the dataset are exploited by means of the parameter space where the differences between the normal operating conditions vs. operation under attack are highlighted. We can safely assume that the main goal of this work, i.e., very fast detection of integrity attacks, is achieved, at least to some extent. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Integrity Attack** & **Model Type** & **FP (\%)** & **TP (\%)** & **FN (\%)** & **TN (\%)** &
\begin{tabular}{c} **Detection Delay** \\ **(\# of Samples)** \\ \end{tabular} \\ \hline \multirow{3}{*}{_Pulse_} & _Proposed_ & **0.2** & **99.8** & **0.8** & **99.2** & **4** \\ \cline{2-6}  & _SVM_ & 7.1 & 92.9 & 3.8 & 96.2 & 13 \\ \hline \multirow{3}{*}{_Scaling_} & _Proposed_ & **0.4** & **99.6** & **1.2** & **98.8** & **2** \\ \cline{2-6}  & _SVM_ & 3.5 & 96.5 & 6.2 & 93.8 & 19 \\ \hline \multirow{3}{*}{_Ramp_} & _Proposed_ & **0.7** & **99.3** & **0.9** & **99.1** & **7** \\ \cline{2-6}  & _SVM_ & 2.9 & 97.1 & 4.1 & 95.9 & 12 \\ \hline \multirow{3}{*}{_Random_} & _Proposed_ & **1.3** & **98.7** & **1.8** & **98.2** & **6** \\ \cline{2-6}  & _SVM_ & 3.7 & 96.3 & 5.9 & 94.1 & 8 \\ \hline \multirow{3}{*}{_Replay_} & _Proposed_ & **1.2** & **98.8** & **0.4** & **99.6** & **3** \\ \cline{2-6}  & _SVM_ & 8.8 & 91.2 & 4.5 & 95.5 & 16 \\ \hline \multirow{3}{*}{_Average_} & _Proposed_ & **0.76** & **99.24** & **1.02** & **98.98** & **4.4** \\ \cline{2-6}  & _SVM_ & 5.4 & 94.6 & 4.9 & 95.1 & 13.6 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: The detection results of the proposed method and the contrasted one using SVM. The figures of merit are shown with respect to each type of integrity attack (see Section 4.2). The highest performances with respect to each attack are emboldened.