## 5 Methodology  
The dataset used was collected from an IoT server that hosts the data of a 10 kV solar power system for laboratory purposes. It is a time series dataset from an energy monitoring system. It regularly captures various energy consumption, production, and system performance parameters. A brief description of each column in the dataset is presented below:  
* DateTime: The timestamp when the data were recorded. * DlyEn (Daily Energy): The energy consumed or produced daily, measured in an appropriate unit (likely kilowatt-hours or similar). * TotEn (Total Energy): The cumulative total energy consumption or production up to that point. * ParEn (Parameter Energy): A specific measured value of energy, likely an additional or derived energy parameter. * WkE (Weekly Energy): The energy consumption or production over the past week. * MnE (Monthly Energy): The energy consumption or production over the past month. * YrE (Yearly Energy): The energy consumption or production over the past year. * Gv3 Ph (Grid Voltage, 3-Phase): The voltage measured across a 3-phase grid. * Gc3 Ph (Grid Current, 3-Phase): The current measured across a 3-phase grid. * Gp3 Ph (Grid Power, 3-Phase): The power measured across a 3-phase grid. * Freq3 Ph (Frequency, 3-Phase): The frequency of the 3-phase grid. * InPN (Input Power 1): The power input at point 1. * InPV1 (Input Voltage 1): The voltage input at point 1. * InPC1 (Input Current 1): The current input at point 1. * InPw2 (Input Power 2): The power input at point 2. * InPv2 (Input Voltage 2): The voltage input at point 2. * InPC2 (Input Current 2): The current input at point 2. * InvTemp (Inverter Temperature): The temperature of the inverter. * BstTemp (Boost Temperature): The temperature of the boost component. * IsIRes (Isolation Resistance): The resistance value for system isolation is essential for safety. Figure 2: Machine learning process [18, 19, 20]. * WGFreq (Wind Generator Frequency): The operating frequency of a wind generator, if applicable. * Phi3 Ph (Phase Angle, 3-Phase): The 3-phase system's phase angle indicates the power factor and efficiency. In our simulation, we used Gc3 Ph and Gp3 Ph as two features. In this study, we applied the following machine learning models to identify the FDIA on the dataset:
* Isolation Forest;
* Random Forest;
* Decision Tree;
* Logistic Regression. The objective of the simulation is to demonstrate the effects of a false data injection attack on the dataset and employ various machine learning algorithms to identify the attack. The overarching methodology used in the simulation is illustrated in Figure 3. In the case of other models, it is necessary to modify the training and model definitions; the remaining steps will remain unchanged. * **Isolation Forest:*
* The isolation forest algorithm detects anomalies using machine learning. It randomly partitions data into subsets using binary trees. Fewer splits in these trees isolate anomalies, which are data points that are markedly distinct from the majority. A threshold can be defined to find anomalies based on the algorithm's anomaly scores. Isolation forest is efficient, works well with high-dimensional data, and does not use complex distance metrics, although data distributions and parameter settings affect its performance [22; 23]. By dividing the dataset into separate segments and arbitrarily choosing features, the isolation forest method separates anomalies until individual data points are isolated. Anomalies are anticipated to be simpler to isolate and require fewer splits. Based on the average path length in the isolation trees, the anomaly score is calculated as follows: \[p(y,m)=2^{-F(g(y))/e(m)}\] (6) where \(F(g(y))\) is the average path length for a datapoint \(y\) in m isolation trees, and \(e(m)\) is a normalization factor. * **Random Forest:*
* Several decision trees are used in the random forest ensemble machine learning technique to enhance predictions.