# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Unusual Consumption Behaviors and Measurements
\begin{table}
\begin{tabular}{c c c} \hline \hline _Scenario_ & _Method/Technique_ & _Objective_ \\ \hline \multirow{8}{*}{Unusual consumption behavior} & DWT, VFD, ANN, DNN, DRL & Identify anomalies in HAN environment \\ \cline{2-3}  & LP, REPTree, MSP, Random Forest, ANN, SVM & Identify anomalies in NAN + \\ \cline{2-3}  & \multirow{2}{*}{\
\begin{tabular}{c} LP, REPTree, MSP, Random Forest, ANN, SVM \\ \end{tabular} } & HAN environment \\ \cline{2-3}  & & Semi-supervised learning \\ \cline{2-3}  & GAN & Distinguish unusual \\ \cline{2-3}  & \multirow{2}{*}{
\begin{tabular}{c} Machine Learning, K-means, LSTM, ConvLSTM, regression tree model, CNN+GRU, FL \\ \end{tabular} } & non-fraudulent consumption \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Methods used to identify unusual consumption behavior. Such solutions must consider the ability to distinguish fraudulent consumption from real changes in a customer's consumption behavior. Experiments show that models based on recurrent neural networks can be a viable alternative. Detection of energy theft or fraudulent consumption is addressed with methods implementing a convolutional LSTM (ConvLSTM) approach that, compared to CNN-LSTM and MLP methods, can help optimize temporal data redundancy [67]. The experimental results demonstrate that ConvLSTM has strong predictive robustness, and its model structure can effectively avoid overfitting. A recent area of study is cyber-attacks aimed at energy theft at the distributed generation level, for example, in photovoltaic panels. In this case, machine learning and regression trees are used to detect suspicious data [68]. Compared with other detectors based on SVM, autoregressive integrated moving average, and least-square error, the simulation results revealed a superior detection performance. With respect to anomalous data that are related to the meter, the use of deep reinforcement learning (DRL) demonstrates accuracy in identification, especially in environments where thousands of metering devices are integrated into the network [71]. Compared to other methods using SVM, CNN, and LSTM, experimental results indicate that it takes less time to detect unknown attacks. Regarding smart meters, there is a growing concern about information privacy because communications between the meter and the energy service provider's servers could be breached. Here, the federated learning (FL) anomaly detection methods were compared with centralized models. It can be noted that when the distribution of data changes between clients, FL-based methods perform worse training data than centralized models. On the other hand, FL can replace centralized models in solutions that seek to safeguard data security and privacy [73]. Hybrid models are a trend in electricity theft detection, for example, combining a gated recurrent unit (GRU) and a CNN, where the GRU extracts temporal features while the CNN retrieves abstract patterns from electrical consumption data [72]. This hybrid model has the disadvantage of a high computational cost. On the other hand, it provides better accuracy in detection compared to other hybrid models such as CNN-LSTM and MLP-LSTM. Big Data technologies, such as Apache (Flink, Storm, Spark), Hadoop (HDFS), and KairosDB are also useful to study unusual customer consumption behaviors and discover unexpected patterns [38]. Due to the speed at which data is generated in SGs, similar solutions will be required as part of energy management systems.