## 2 ToU Pricing Dataset and Synthetic Theft Cases Generation
### Novel d-ToU and f-ToU Price-Based Theft Cases Generation Using Novel Window-Based Usage Analysis
Although the prices may vary on weekends vs. weekdays as well as during different seasons, in our presented f-ToU, we assume a low-price period from 9:30 p.m. through to 8:30 a.m., a normal price period from 8:30 a.m. to noon and again from 6 p.m. to 9:30 p.m., and, finally, a peak price period from noon to 6:30 p.m. based on the reference [22]. Referencing the existing literature [10; 12], the following would be typically defined theft cases for existing static pricing strategy,  
1. \(t1(x_{t})=x_{t}*random(0.1,0.9)\);
2. \(t2(x_{t})=x_{t}*random[0,1]\);
3. \(t3(x_{t})=x_{t}*t_{t}\) (\(r_{t}=random(0.1,1.0)\));
4. \(t4(x_{t})=mean(x)*random(0.1,1.0)\);
5. \(t5(x_{t})=mean(x)\);
6. \(t6(x_{t})=x_{T-t}\), (where \(T\) is the sample size per day, that is, 48); where \(x_{t}\) is the real usage of the consumer (\(t\in[0,\ 47]\) is the time index). In this paper, new theft cases based on ToU pricing models are derived (modified) from the six above listed theft cases as follows. After carefully observing the six conventional flat price-based theft cases [13; 15], for window-based ToU pricing synthetic theft data generation, we eliminate the last three cases, which are trivial in our opinion, and revise the first two cases slightly--cases 1 and 3. As seen above, theft case 1 multiplies each day's usage values with a random number between 0.1 and 0.9, while case 3 simply multiplies usage values with a random value between 0.1 and 1.0 every sampling interval. However, for the window-based cases, the user might sometimes send \"0\" during the theft period. Therefore, we suggest that multipliers to 0.0 instead of 0.1 are used in both theft cases 1 and 3. Furthermore, in the ToU pricing models, sending the reverse of corresponding real usage is not feasible during that window, since we do not know the accurate future usage beforehand. That is, especially the 6 th theft case, where the consumer reports the reverse of the actual usage for that day, practically has very little significance (the 4 thand 5 th cases using mean values as well) and no association with window-based theft activities. Hence, we just choose the first three practical and reasonable theft cases from the above list of six cases, for which window-based electricity theft could be considerably active during the theft period--even simulation results regarding all six theft cases are included in Section 4.4 and still show comparable results. Therefore, we generate the novel three theft cases (based on the above discussion), where theft occurs only during the theft periods, and train our classifier to detect them. Figure 2 shows a regular real usage and various possible malicious/theft usage generated by manipulating the real usage. Figure 2: Cont. The following are the window-based theft cases for the ToU pricing scheme:  
1. \(t1\left(x_{tp}\right)=\ x_{tp}*random(0.0,0.9)\);
2. \(t2\left(x_{tp}\right)=x_{tp}*random[0,1]\);
3. \(t3\left(x_{tp}\right)=\ x_{tp}*r_{t}\left(r_{t}=random(0.1,1.0)\right)\); where \(x_{tp}\) or the \"theft period\" indicates the normal and high price period. The remaining low-price consumption is assumed to stay unaffected by malicious behavior. In this paper, we are using supervised ML, where artificially generated training theft cases are not limited to the above three cases. In other words, if a new type of suspicious attack is detected through other means by the utilities, additional training data based on that theft pattern can be generated and the presented algorithm can be used to retrain the theft detector to detect such additional cases (see Section 4.4).