## 4 Machine Learning Approach  
Machine learning (ML) techniques and algorithms allow computer systems to learn from data and improve performance without being explicitly programmed. ML algorithms analyze data patterns and trends to create predictions from the learned information [12]. ML typically follows these steps [11; 12; 13; 14]:  
* Data are collected from databases, sensors, and user interactions: The data should be representative and reflect a variety of task-related scenarios. For this paper, we collected the power dataset from an IoT server of a 10 KV solar PV system.
* Data are preprocessed for analysis: This stage may involve removing outliers, addressing missing values, normalizing or scaling data, and encoding categorical variables into numbers. To enhance the overall training process, data pre-processing is a crucial step in the experiment; we utilized generative adversarial networks (GANs) [15] to achieve data augmentation. The data collected from the IoT server was in CSV format, which we passed through the GAN model, and the augmented data were later used as the input for the machine learning models.
* Feature selection/engineering: Features representing the data's significant qualities and that fit the learning objective are selected and developed. Feature engineering creates new features from existing ones, while feature selection selects a subset. As per the dataset available, there are multiple features, but only one feature is used for the experiment, and that is Gp3 Ph (grid power on three phases), which is used for various calculations.
* Model selection: As far as the experiment is concerned, we need to classify the attacked data from non-attacked data, for which we use the supervised machine learning approach by using classification algorithms. We will see the details of the algorithms in a later section in this paper.
* Model training: The selected ML model is trained with the prepared data. Based on the input data, the model optimizes its performance throughout training. When a loss or error function is minimized, which involves measuring the model's prediction error, this is usually carried out.
* Model evaluation: The trained model is evaluated using task-specific measures, including accuracy, precision, recall, and mean squared error (Evaluation Metrics) [16; 17]. Evaluation determines the model's efficacy and generalization on unknown data.
* Model deployment [18; 19]: The learned model is deployed to provide forecasts or decisions based on fresh data. It is possible to utilize the trained model to work on various datasets, provided that one must ensure the input/features used in training are intact. In contrast, testing in a testing case or fresh training will be required for the new dataset.
* Model monitoring and maintenance [20]: The deployed ML model is regularly checked and upgraded. ML models may need periodic data re-training to adapt to shifting trends or increase performance. The model needs to be trained if there is a change in the features/input parameters or a significant change in the dataset. For this paper, we collected daily power generation data for one year from the IOT server, which is integrated with a 10 KV PV system in a laboratory environment. If there is a change in the power generation pattern for the next two years or one year, we also need to conduct fresh training to obtain optimum results. A typical machine learning scenario is presented in Figure 2 below.  
Machine learning models are employed in power system models for cyber threat detection because they can scrutinize vast data, identify anomalies, and adjust to emerging threats. The utilization of these models facilitates the monitoring of power systems in real time, the recognition of intricate patterns, and scalability, thereby providing a comprehensive approach to detecting potential threats. Through machine learning, entities can augment their security measures, proficiently address potential threats, and guarantee the dependability of essential power infrastructure [19, 20, 21].