# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 4 Threat Scenarios and Results
### Detection Results
On the other hand, the LOF and EE methods achieved an accuracy of 0.8905, with perfect precision, recall, and F1-scores, suggesting their effectiveness in detecting DOS attacks. However, the 1 SVM method displayed a slightly lower accuracy of 0.8869, with precision, recall, and F1-score values of 0.8901, 0.9959, and 0.94, respectively, indicating its high recall but lower precision compared to the other methods. Overall, the AE-GRU-based anomaly detection methods, particularly the AE-GRU-iForest and AE-GRU-1 SVM methods, outperformed the standalone models in detecting DOS attacks, achieving higher accuracies and balanced precision-recall trade-offs. This highlights the effectiveness of leveraging deep learning techniques, such as the AE-GRU, for anomaly detection in smart grid cybersecurity applications. * Switching attack: In a switching attack, malware is utilized to manipulate the targeted devices, turning them alternately on and off. This type of attack disrupts the normal operation of the devices and can potentially lead to system instability or malfunction. In this scenario, the switching attack persisted for 10 min, during which 72 packets were transmitted to the victim station. The attacker's objective is to disrupt the station's functionality by manipulating its operational status, which can have significant repercussions on the overall grid operation and stability. Figure 6 displays a heatmap comparing the detection performance metrics of the AE-GRU-based and standalone anomaly detection methods during the switching attack scenario. In the switching attack scenario, both the AE-GRU-based and standalone anomaly detection methods were evaluated. The AE-GRU-based methods, like the iForest and LOF methods, showed good accuracy and precision, with the iForest method achieving 0.8903 accuracy and 0.9856 precision, and the LOF method achieving 0.8945 accuracy and good precision (Figure 6a). However, the 1 SVM model performed poorly with only 0.1181 accuracy and 0.0833 recall. The EE model had moderate accuracy at 0.8692 and precision at 0.9852. The standalone methods, especially the LOF and EE methods, demonstrated a strong performance, with accuracies of 0.9576 and perfect precision scores (Figure 6b). The 1 SVM model also had high accuracy and precision, with scores of 0.9556 and 0.9575, respectively. Overall, while the AE-GRU-based methods like the iForest and LOF methods performed well, the standalone methods, particularly the LOF and EE methods, consistently showed a strong performance, suggesting their effectiveness in detecting the anomalies in the switching attack scenario. Figure 5: Detection performance comparison of (**a**) the AE-GRU-based and (**b**) standalone anomaly detection methods during the DOS attack scenario. * Injection command attacks: In injection command attacks, the attacker interferes with a connected device by modifying its configurations or introducing fraudulent commands, leading to abnormal behavior. This manipulation results in the generation of various anomalies within the system. The attack occurred in two distinct instances: the first lasted for 5 min and involved 83 packets, while the second persisted for 15 min and comprised 221 packets. The attacker aims to compromise the integrity and functionality of the targeted device, potentially causing disruptions or damage to the overall system. Such attacks pose significant risks to the security and reliability of the network, highlighting the importance of robust cybersecurity measures in safeguarding critical infrastructure like smart grids. Figure 7 illustrates the heatmap comparing the detection performance metrics of the AE-GRU-based and standalone anomaly detection methods during the injection attack scenario based on the testing data. In the injection attack scenario, both the AE-GRU-based and standalone anomaly detection methods achieved high accuracy, precision, and recall. The AE-GRU-based methods had accuracy values from 0.9619 to 0.9771, while the standalone methods ranged from 0.457 to 0.9275.