# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 1 Introduction
[11] explored ML-based techniques to differentiate among regular operations, cyber-attacks, and natural disturbances in smart grids, evaluating algorithms like Random Forest (RF), Naive Bayes (NB), SVM, and AdaBoost. [PERSON] et al. [12] tackled stealthy false-data injection attacks using Principal Component Analysis (PCA)-based dimensionality reduction and SVM trained over labeled data for detection. [PERSON] et al. [13] introduced an unsupervised Isolation Forest (iForest) algorithm for detecting covert data-integrity exploits using unlabeled historical data of State Estimation Measurement Features (SE-MF) and a PCA-based data reduction technique. [PERSON] et al. [14] addressed the detection of stealthy attacks in large-scale smart grid networks by applying Kernel PCA (KPCA) to solve the computational complexity issues. The output data from KPCA were fed into the Extra-Trees algorithm. [PERSON] et al. [15] presented an integrated solution combining one-class classification (OCSVM) with PCA for the accurate detection of memory dump malware, including novel types. [PERSON] et al. [16] proposed an unsupervised K-means-based model to identify Denial of Service (DoS) attacks, such as UDP and ICMP flood attacks, directed at the AMI network. The model, relying on unlabeled data, successfully clustered both normal and abnormal behaviors. The evolution of smart grids has spurred technological advancements and an increasing demand for more efficient and sustainable energy systems. However, the integration of communication systems into smart grids has escalated the risk of cyberattacks, potentially leading to power outages and system disruptions. This paper introduces a semi-supervised approach for detecting malicious attacks in Industrial Control Systems (ICSs) and Supervisory Control and Data Acquisition (SCADA) networks. Unlike traditional supervisedlearning, which relies on labeled data, this method utilizes only attack-free data for training. This eliminates the need for costly and time-consuming manual labeling, making it more practical and cost-effective for real-world deployment. By learning from attack-free data, the model can effectively identify deviations from normal behavior during testing, without the need for explicit labels. This approach simplifies the training process and reduces the risk of bias introduced by human labeling errors. The contributions of this study are summarized next. * Firstly, a hybrid deep learning approach is proposed for detecting the cyberattacks in smart grids. Specifically, we introduce the Autoencoder (AE)-Gated Recurrent Unit (GRU) approach, integrating two stacked GRU layers into the AE model's encoder and decoder. By incorporating GRU units into both the encoder and decoder sides, the model learns compact representations of sequential smart grid data while ensuring minimal loss in data reconstruction. For cyberattack detection, the AE-GRU approach is combined with semi-supervised anomaly detection methods, including Isolation Forest (IF), Local Outlier Factor (LOF), OCSVM, and Elliptical Envelope (EE). Initially, the AE-GRU approach extracts pertinent features from the data, seamlessly integrated with semi-supervised techniques (IF, OCSVM, EE, and LOF) to detect anomalies effectively. Specifically, AE-GRU handles data reduction and feature extraction, followed by applying anomaly detection algorithms to identify potential cyberattacks. * The effectiveness of these approaches was evaluated based on the IEC 60870-5-104 (IEC 104) control communication protocol, commonly used in SCADA networks to manage critical infrastructures such as power stations. The IEC 104 protocol is widely used in smart grid environments for the exchange of control and monitoring information between various devices and systems. This protocol facilitates the communication between different components of the power grid, including sensors, actuators, controllers, and SCADA systems.