## 2 Methodology
### Network Attack Path Analysis of Smart Grid  
The transient process from the occurrence of a network attack to the power system paralysis was very short. Therefore, it was difficult to obtain sufficient data to characterize the power grid state when the attack occurred, resulting in a serious imbalance between the number of network attack samples and normal samples. On the one hand, the number of network attack samples was insufficient to meet the modeling requirements of the machine learning algorithms. On the other hand, data imbalance made the learning ability of the model biased towards most class samples, which made the performance of the model unreliable [30,31]. To reduce the impacts of sample size differences, a central interpolation strategy was proposed to improve the Kmeans-SMOTE oversampling algorithm--Center interpolation Kmeans-SMOTE (CIKS), which implemented the oversampling of data to obtain a balanced network attack data. The CIKS algorithm included three steps of clustering, filtering, and sampling. The algorithm execution process is shown in the Figure 2.  
1. Clustering: based on the Kmeans clustering algorithm, \(n\) clustering centers were determined in the minority sample space, and the minority samples were clustered into \(n\) clusters according to the location of the cluster centers. 2. Filtering: Select clusters that participated in oversampling. The principle was that several clusters containing a large number of minority class samples participated in oversampling. After determining the clusters participating in the oversampling, we calculated the sampling weight of the clusters participating in the oversampling. The sampling weight determined the number of pseudo samples generated in the cluster. The clusters participating in the oversampling were given a sampling weight between 0 and 1. At the same time, the minority sample density lower clusters were assigned high sampling weights and generated more pseudo samples. The sampling weight depended on the ratio between the density of a single cluster and the average density of all selected clusters. The weight calculation steps are as follows:  
Figure 1: Network attack intrusion path. For each filtered cluster \(f\), the Euclidean distance matrix between a few types of samples is calculated. Add all the off-diagonal elements of the Euclidean distance matrix, and then divide by the number of non-diagonal elements to calculate the average minority sample distance for each cluster. The minority sample number in each cluster is divided by the power of its average minority sample distance, and the density of the cluster is calculated as shown in Equation (1):  
\[density(f)=\frac{minorityCount(f)}{averageMinorityDistance()^{m}} \tag{1}\]  
where \(minorityCount(f)\) represents the number of minority samples in the cluster \(f\), \(averageMinorityDistance()\), represents the method for calculating the average minority sample distance. Calculate the sparse factor \(sparsity(f)=1/density(f)\). The sampling weight of each cluster is equal to the sparse factor of the cluster divided by the sum of the sparse factors of all clusters. The sum of all sampling weights was 1. According to this feature, the sampling weight of the cluster was multiplied by the total number of samples to be generated, which was the number of samples to be generated in the cluster. (3) Sampling: after the sampling weight was determined, in the filtering stage, for clusters involved in sampling, oversampling was performed in turn. The oversampling is shown in Figure 3. A sample in the cluster was then randomly selected, and we performed a linear interpolation between the cluster center to generate a new sample. We looped the above steps until all pseudo samples in the cluster matched the weights determined in step (2), and the oversampling was ended. Figure 2: The execution process of the CIKS algorithm.