# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 3 AE-GRU Anomaly Detection Framework
### Auto-Encoders  
An autoencoder, a type of neural network architecture widely employed in tasks such as dimensionality reduction, feature learning, and data compression, is particularly valuable in cybersecurity applications [30]. An autoencoder comprises two main components: an encoder network and a decoder network (Figure 1). The encoder network compressesinput data into a latent space representation, whereas the decoder network reconstructs the original input based on this compressed representation.  
The encoding stage of an autoencoder is pivotal in compressing input data, \(\mathrm{x}=\{\mathrm{x}_{1},\mathrm{x}_{2},\ldots,\mathrm{x}_{n}\}\), into a lower-dimensional latent space representation, \(\mathrm{h}=\{\mathrm{h}_{1},\mathrm{h}_{2},\ldots,\mathrm{h}_{m}\}\), which contains essential features and patterns for efficient reconstruction by the decoder stage. This transformation involves applying a linear transformation to the input, followed by a non-linear activation function, represented mathematically as [31]:  
\[h=f(x)=A_{f}(Wx+b), \tag{1}\]  
where \(W\) denotes the weight matrix, \(b\) represents the bias vector, and \(A_{f}\) is the activation function applied element-wise. In the decoding stage, the compressed representation \(h\) from the encoding stage is transformed back into the original input data space. This process involves applying a series of hidden layers to \(h\), each involving a linear transformation followed by a non-linear activation function, represented mathematically as [31; 32]:  
\[\hat{\mathrm{x}}=\mathrm{g}(\mathrm{h})=\mathrm{A}_{\mathrm{g}}(\mathrm{W}^{ \prime}\mathrm{h}+\mathrm{b}^{\prime}), \tag{2}\]  
where \(\mathrm{W}^{\prime}\) is the weight matrix, \(\mathrm{b}^{\prime}\) is the bias vector, and \(\mathrm{A}_{\mathrm{g}}\) is the activation function. The output of this transformation, \(\hat{\mathrm{x}}=\{\hat{\mathrm{x}}_{1},\hat{\mathrm{x}}_{2},\ldots,\hat{ \mathrm{x}}_{n}\}\), represents the reconstructed input data. The goal of the decoding stage is to generate a reconstruction that closely matches the original input data \(x\), thereby capturing the essential features and patterns encoded in the compressed representation \(h\).  
During training, an AE adjusts the parameters such as weights and biases to minimize the difference between the input data and their reconstructed output. This iterative process utilizes optimization algorithms like the stochastic gradient descent (SGD) algorithm to update the parameters and minimize a chosen loss function. Cross-entropy is widely used as a loss function in autoencoders for its effectiveness in capturing the differences between the input and reconstructed data distributions. It is expressed as [32]:  
\[L_{BCE}=\frac{1}{M}\sum_{i=1}^{m}\sum_{j=1}^{n}\bigl{[}x_{j,i}log\hat{x}_{j,i}+ \bigl{(}1-x_{j,i}\bigr{)}log\bigl{(}1-\hat{x}_{j,i}\bigr{)}\bigr{]}, \tag{3}\]  
where M represents the number of training samples or instances, and \(x_{j,i}\) denotes the \(j\)-th feature of the \(i\)-th training instance. In cybersecurity, autoencoders trained on normal data learn patterns and structures. Deviations from these learned patterns during inference can signal anomalies or cyber threats.  
Figure 1: Fundamental structure of an autoencoder (AE).