# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 2 Related Works  
DL algorithms have proven effective across various domains, including image recognition, speech processing, and anomaly detection. DL effectively analyzes data from sensors, control systems, and communication networks within smart grids. Recent interest focuses on using DL for cyberattack detection in smart grids, with studies exploring its application [17; 18; 19]. This section provides an overview of DL-based attack detection in smart grids. In [20], [PERSON] et al. introduced a Temporal Graph Neural Network (TGNN) architecture to detect FDI and ramp attacks. It constructs a temporal graph, utilizes a three-layer GNN with GRU units to learn normal behavior, and employs a graph attention mechanism for attack localization. However, the model's assumption of temporal sequencing in cyberattacks may not always hold, posing challenges for detection and localization. [PERSON] et al. [21] introduced an approach to detect compromised meters in smart grids using the KLD (Kullback-Leibler distance), ANNs (Artificial Neural Networks), and ELMs(Extreme Learning Machines). The KLD quantifies the dissimilarity between historical and real-time measurements to identify anomalies that signal data integrity attacks. ANNs and ELMs accurately predict the current loads and identify compromised meters based on an error threshold. In [22], [PERSON] et al. introduced an unsupervised model-free method based on Symbolic Dynamic Filtering (SDF) for feature extraction, a Dynamic Bayesian Network for transition probabilities, RBM for learning behavior patterns, and a Relative Entropy (RE) metric for anomaly detection. The accuracy of the framework may vary due to different symbolization methods for time series data. [PERSON] et al. [23] introduced the SG-FST-MCNN, a multi-view convolutional neural network (MCNN), for authenticating DSD (Distribution Synchrophasor Data) sources and detecting spoofing attacks. It utilizes Savitzky-Golay (SG) filter and fast S transform (FST) for feature extraction, followed by MCNN for classification without manual feature selection. However, an SG filter and FST assume linearity, which may limit their effectiveness with non-linear data. The study in [24] introduced a two-stage deep learning framework utilizing image recognition models to detect and locate attacks in multivariate time-series data. The framework converts data into 2D images using the Gramian Angular Field (GAF) and Recurrence Plot (RP) techniques and trains a multi-label CNN classifier for attack detection and localization. However, this approach is computationally demanding, presenting challenges for real-time detection. [PERSON] et al. [25] targeted DDOS attacks using the Autoencoder (AE) algorithm. They utilized a multi-level mixture of shallow and deep marginalized stacked denoising autoencoders (MSDA) for feature extraction. These features were projected into a kernel space, where the Multiple Kernel Learning for Dimensionality Reduction (MKLDR) algorithm trained the detection model. However, MKLDR faces challenges in selecting suitable kernels and has limited scalability for large or high-dimensional datasets. [PERSON] et al. [26] proposed a detection method that combines Variational Mode Decomposition (VMD) and OS-Extreme Learning Machines (OSELMs) to identify abnormal power system states. This approach extracts multiscale modes and analyzes statistical features to assess irregular behaviors. An OSELM correlates these features with the power system security status and identifies abnormal states. However, the effectiveness of the F-test may be limited by assumptions, particularly the handling of outliers and non-normal data distributions in real-world settings. [PERSON] et al. [27] focused on intrusion detection in Advanced Metering Infrastructure (AMI) using a Stacked Autoencoder (SAE) and Long Short-Term Memory (LSTM) models. A SAE reduced the input feature dimensionality, while the Bi-directional LSTM (BiLSTM) identified abnormal traffic patterns.