# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 4 Threat Scenarios and Results
### Detection Results
All the methods had precision scores of 1, indicating near-perfect identification of attack instances. The AE-GRU-based methods showed recall values from 0.9616 to 1, while the standalone methods ranged from 0.4927 to 1. Overall, the AE-GRU-based methods consistently outperformed the standalone methods, demonstrating their superior detection capabilities for injection attacks. Figure 6: Detection performance comparison of (**a**) the AE-GRU-based and (**b**) standalone anomaly detection methods during the switching attack scenario. Figure 7: Detection performance comparison of (**a**) the AE-GRU-based and (**b**) standalone anomaly detection methods during the injection attack scenario. * Connection loss attacks: In this category, the attacker attempts to interfere with specific devices, disrupting their interconnected communications. Two scenarios were simulated to replicate this interference. In the first scenario, a 10 min disconnection led to the loss of 146 packets. In the second scenario, the disconnection persisted for an hour, losing several packets. These attacks aim to disrupt the normal functioning of the targeted devices, potentially causing delays, malfunctions, or data loss. Such interference poses significant threats to the reliability and integrity of the communication network, underscoring the importance of robust cybersecurity measures in mitigating such risks. Figure 8 shows a heatmap comparing the evaluation metrics of the AE-GRU and standalone anomaly detection methods during a connection loss attack scenario, based on the test data. From Figure 8, we observe that the AE-GRU-based methods, specifically the AE-GRU-LOF and AE-GRU-EE methods, exhibited a significantly higher detection performance compared to the standalone methods, with F1-score values of 94.93% and 96.43%, respectively. This signifies a balanced performance in precision and recall, crucial for accurate anomaly detection. Conversely, the standalone methods, including the iForest and 1 SVM methods, demonstrated lower F1-scores, with the iForest method reaching 51.37% and the 1 SVM method reaching 83.29%. This suggests that while the standalone methods might excel in certain aspects such as recall, their overall performance in terms of precision and recall balance is not as robust as the AE-GRU-based methods are. These differences in F1-score highlight the effectiveness of the AE-GRU-based methods in achieving a harmonious trade-off between precision and recall, thereby offering a more balanced approach to the anomaly detection during connection loss attacks. This balance is crucial in ensuring the accurate detection of anomalies while minimizing false positives, ultimately enhancing the cybersecurity of smart grid networks. the iForest and LOF methods, achieved impressive F1-scores of 99.03%, indicating highly accurate detection with minimal false positives and negatives. On the other hand, the standalone methods showed a more varied performance. While the LOF method achieved a perfect F1-score, the iForest method exhibited a lower F1-score of 60.04%, indicating a less balanced detection performance. Figure 9b reveals that the 1 SVM method achieved an F1-score of 86.95%, demonstrating relatively balanced precision and recall compared to the AE-GRU-based methods. However, it still fell short of the performance attained by the AE-GRU-based methods. These quantitative results highlight the superior performance of the AE-GRU-based anomaly detection methods in accurately identifying the rogue devices within smart grid networks. Leveraging deep learning and sequential data modeling, these methods offer a robust approach to enhancing the cybersecurity by effectively detecting anomalous behavior. While no single approach exhibited a superior performance across all the considered attacks, the AE-GRU-based anomaly detection methods consistently outperformed the standalone anomaly detection methods (LOF, EE, 1 SVM, iForest) in detecting the various types of attacks in smart grid networks. This superiority can be attributed to several factors.