# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Network Infrastructure Anomalies  
Table 8 displays an overview of the findings. Smart grid infrastructure (SGI) comprises all the tele-controlled elements, communications, sensors, hardware, and software that enable network communication and operation. Seven attack models are identified:  
1. [label=()]
2. Implants of consumption devices;
3. Energy meter implants;
4. Black hole attacks;
5. Installation of malicious software;
6. Topology attacks;
7. Tampering with the resources of electronic devices: CPU, memory, operating systems, data, files, and configurations; \begin{table}
\begin{tabular}{c c c} \hline \hline _Scenario_ & _Method/Technique_ & _Objective_ \\ \hline \multirow{6}{*}{Smart Grid Intrusions} & Machine learning, Decision Tree Classifier (J48), Algorithm C4.5, Decisions Tree & Intrusion detection \\ \cline{2-3}  & Behavioral rules specification system & Detect affected or malicious devices \\ \cline{2-3}  & ADS host-based, ADS network-based & Detect anomalies in IED substation devices and circuit breakers \\ \cline{2-3}  & WOA, ANN, Multi-agent architecture & Identify multiple intrusion scenarios \\ \cline{2-3}  & PDAM & Prevent anomalies from data mining attacks \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Methods related to intrusion detection in SGs. Regarding attack models (a), (b), (c), and (d), the pattern matching scheme to detect anomalous behaviors employing graph neuron (GN) as a decentralized pattern recognition algorithm that can form an associative memory structure by interconnecting the readings from SGI devices in a graph-like structure was one of the first proposals related to this field that could be identified in this area [15]. This is currently an interesting theoretical basis that can be strengthened by considering scenarios with attackers incorporating smart stealthy mechanisms in malicious devices implanted in the SG. In electrical substations, avoiding the compromise of intelligent electronic devices (IED) and control circuit breakers is possible through early cyber intrusion detection algorithms based on the analysis of temporal events from which four malicious characteristics can be identified: intrusion attempts; change of the file system; change of the target system configuration; and change of the target system state [14]. This is an interesting knowledge base; it provides a baseline perspective of what is being targeted in the SG infrastructure, and it is now the basis on which more automatic and intelligent methods can be structured. Monitoring CPU usage when it exceeds a predetermined threshold that could cause services to slow down, detecting RAM overload by setting a threshold on the maximum amount of usable memory, and keeping track of the number of concurrently active tasks on a machine can all support alerting of potentially compromised devices [64]. This type of monitoring has as input a large amount of log records generated by different heterogeneous devices connected in the network and could be improved by incorporating correlation and learning mechanisms. Temporal event analysis can be useful and has been enhanced through automation supported by agent-based supervised learning. The learning process creates signatures based on the devices considered valid or true, ground-truth profile (GTP), allowing comparison and identification of potentially compromised devices [39]. Communication protocols are subject to cyber-attacks that can cause anomalies in the SG. The use of simple network management protocol (SNMP) configured in selected devices and correlation capabilities based on detection patterns allow for the recognition of anomalies in the network [17]. We are facing the advent of new-generation smart grids as the industry must assume solutions for increasingly heterogeneous and interconnected systems. New methods adopt DNN and GAN architectures to detect operational anomalies and classify Modbus/TCP and DNP3 cyber-attacks [58].