## 3 Proposed Resilient Demand Forecasting Systems
The point forecast (i.e., the most expected demand) of the DFS module at \(t+k\) is \(\overrightarrow{D(t+k)}\). The interval forecast of DFS at \(t+k\):  
The lower bound of the forecast distribution:  
\[\textit{L}(t+k)=\overrightarrow{D(t+k)}-3\sqrt{V(t+k)} \tag{1}\]  
The upper bound of the forecast distribution:  
\[\textit{U}(t+k)=\overrightarrow{D(t+k)}+3\sqrt{V(t+k)} \tag{2}\]  
_DG:_ The flowchart for DG is provided in Figure 4. The DG learns the joint probability distribution of the individual time series of each DPV and generates an infinite stream of \(\left(\overrightarrow{GMV(t)}\right)\) for each DPV. DG sends \(\overrightarrow{GMV(t)}\) to EHS to facilitate the generation of attack signatures. Figure 3: Flowchart for DFS. **EHS:** The flowchart for EHS is given in Figure 5. The task of EHS is to generate all possible attack signatures for the training of SIDS. To do so, the EHS uses the Particle Swarm Optimization (PSO) algorithm [42] with a game theoretic approach [43]. It plays repeated games with the other modules of PRDFS. In these games, EHS plays as an attacker while TMS and SIDS are teamed up to play as a defender of DFS. The attacker and defender play under the following rules: (1) in each game, the attacker has a fixed number of malicious nodes at the beginning. (2) If the defender detects a malicious node, it becomes a normal node. From the next step onwards, the attacker cannot modify its measurements. (3) An attacker cannot compromise a new or recovered node in the middle of the game. (4) EHS works with complete knowledge of the PRDFS. (5) The attacker randomly chooses one of the following two objectives to pursue in a game: (i) shift the demand trend upward, and (ii) shift the demand trend downward. Figure 4: Flowchart for DG. Figure 5: Flowchart for EHS. a vector containing the measurements of all DPVs at time step \(t\), wherein the measurements of normal DPVs are the same as the generated measurements by the DG and the measurements of the malicious DPVs are randomly initialized. The velocity \(\left(\overrightarrow{\mathbf{Vel_{q}(t,I)}}=\left[\mathbf{Vel_{1}(t),\ldots,\mathbf{Vel_{N} (t)}}\right]\right)\) of each particle \((q)\) at time step \(t\) and iteration \(I\) is a vector that has the same length as the position vector. Each element of the velocity vector contains the direction and speed at which the measurement of the corresponding DPV is updated from the one iteration to the next during the PSO search. In each particle, the velocities of normal DPVs are set to zero and regarded as constant. In addition, each particle has a state vector \(\left(\overrightarrow{\mathbf{ST_{q}(t,I)}}\right)\) containing the state of each DPV. Initially, the state vectors of all particles are the same. _Step 2._ The fitness of each particle's position \(\left(\overrightarrow{\mathbf{fitness}}\left(\overrightarrow{\mathbf{pos_{q}(t,I)}} \right)\right)\) is determined using the following method:  
* Present \(\overrightarrow{\mathbf{GMV(t)}}\) to TMS. TMS estimates the most trustworthy aggregated measurement of demand \(\overrightarrow{\mathbf{D_{g}(t)}}\) and sends it to DFS to forecast the \(k\)-step ahead demand \(\widehat{\mathbf{D_{g}(t+k)}}\). * Present \(\overrightarrow{\mathbf{pos_{q}(t,I)}}\) to TMS. TMS estimates the most trustworthy aggregated measurement of demand \(\overline{\mathbf{D_{q}(t)}}\) and sends it to DFS to forecast the \(k\)-step ahead demand \(\widehat{\mathbf{D_{q}(t+k)}}\). TMS also updates the time series of assessed trust scores \((\mathbf{TS})\) of DPVs by adding the assessed trust scores of DPVs (found in \(\overrightarrow{\mathbf{pos_{q}(t,I)}}\)) at time step \(t\) to \(\mathbf{TS}\), as well as the time series of the residuals of one-step ahead forecasts of each DPV's measurements \((\mathbf{SE})\) by adding the residuals of forecasting the measurements of DPVs at time step \(t\) to \(\mathbf{SE}\). SIDS uses the updated \(\mathbf{TS}\) and \(\mathbf{SE}\) to predict the current states (malicious and normal) of DPVs.