## 2 Related Work  
A smart grid consists of Home Area Network (HAN), Neighborhood Area Network (NAN) and Wide Area Network (WAN). The HAN consists of smart sensors, actuators and a user interface like home energy management system (HEMS). The NAN collects data from multiple HANs and transmits the data to the corresponding High Level Control Centres [6]. The NAN is therefore a dedicated channel for information exchange between the HAN and the WAN. Finally, the WAN connects multiple NANs, controlling the power transmission. The Intrusion Detection System (IDS) monitors and detects malicious behaviour by collecting data information from key host nodes, building assessment models and analysing the network for the presence of illegal behaviour [7; 8]. The IDS detects the attack trajectory of an attacked host and reports warnings to ensure the integrity of the network's central host system. This will make the smart grid resistant to external network attacks [9]. Intrusion detection involves data acquisition, intrusion analysis and intrusion response. It reviews information from host logs, network segment protocol packets and gateways, and checks the network data using anomaly detection algorithms and discriminatory models [10]. The intrusion response module is used when anomalous attacks are reported by the intrusion analysis module. The module takes pre-defined measures, such as network disruption and alarm response, to prevent further deterioration of the situation. Intrusion detection models are divided into host-based models, network-based models and feature-based models. Host-based models analyse the operating system's audit trail and log messages of a single host [11]. They can detect viruses, malicious programs and destructive intrusion attacks on hosts [12]. However, the model monitors a host's memory, which adversely affect the host's performance. Additionally, its high memory space requirement does not support the handling of multiple attacks. For network-based models, they protect hosts by monitoring the number of network packets in a gateway to determine the network communication traffic of multiple hosts. This model can monitor large network sections with less memory [13]. However, the model cannot analyse the information flow \begin{table}
\begin{tabular}{c c} \hline \hline
**Abbreviation** & **Term** \\ \hline HEMS & home energy management system \\ \hline IDS & Intrusion Detection System \\ \hline IoT & Internet of Things \\ \hline KDD & Knowledge Discovery in Databases \\ \hline KNN & K-nearest neighbour \\ \hline LSTM & long-short-term-memory \\ \hline NISTIR & National Institute of Standards and Technology \\  & Interagency Report \\ \hline NSL-KDD & Network Security Laboratory - Knowledge \\  & Discovery in Databases \\ \hline R2L & root-to-local \\ \hline ReLU & rectified linear activation function \\ \hline SCADA & Supervisory Control And Data Acquisition \\ \hline SDF & symbolic dynamic filtering \\ \hline SVM & Support Vector Machine \\ \hline U2R & user-to-root \\ \hline WAN & Wide Area Network \\ \hline \hline \end{tabular}
\end{table} 
Table 1: _Cont._of an encrypted network. It results in low detection accuracy in large-scale high-speed networks, thus it cannot handle fragmentation attacks. For feature-based detection model, it matches network intrusions to defined attack features through the misuse detection analysis system, which usually defines a separate feature for each anomalous event and uses a database to store the features for maintenance and matching [14]. This model enables efficient detection of correlated intrusion without generating excessive warning reports. However, this model requires constant updating of the feature database to maintain the system security, and it is unable to prevent malformed network attacks. Intrusion detection methods include anomaly detection and misuse detection. The former is behavioural detection, which assumes that all network attacks are anomalous behaviour, then builds a model to differentiate normal behaviours from anomalous ones by comparison.