# A Comprehensive Survey for Deep-Learning-Based
## 5 Methodologies
### Abnormality Detection with Deep Learning Methods  
Deep learning (DL) has gained a lot of popularity in recent years since it significantly improves the ability to learn the input data in their raw form and extract the hidden information with multiple levels of abstraction [23; 105; 106]. It has been widely used in various  
Because of these layers, the CNN is able to handle large-scale data and achieve a good performance in classification tasks. CNN has also often been adopted to detect anomalies. [PERSON] et al. proposed a CNN model together with random forest to detect electricity theft in a power grid system [27]. The model separates the non-technical losses from technical losses, and it is evaluated with real energy consumption data. The results show an advancement in terms of accuracy and efficiency. In [33], the authors adopted two CNNs in parallel to detect pavement cracks, and they were the first to do so. Two databases with different scales of grid are provided as the training sets, and each CNN is trained by one of the two databases. During the test phase, the results from both CNNs are compared, and the grids containing cracks are kept. Then, principal component analysis (PCA) is applied after the CNN to estimate the crack's type, classifying it as a longitudinal crack, transverse crack, or alligator crack. The model achieves more than 90% accuracy for all three crack types.  
Although CNNs have remarkable performance with large-scale input data, they cannot deal with temporal information. Recurrent neural networks (RNNs) address this problem with loops that preserve and learn from past instances. However, traditional RNNs suffer from gradient vanishing and exploding problems. A modified version called a long short-term memory (LSTM) network was invented to resolve these problems [34]. An LSTM network with stacked architecture was also proposed to detect anomalies in time series data [28]; the evaluation was performed with four different datasets for different purposes, and the effectiveness of the LSTM was verified. In [29], a supervised LSTM network was applied to determine non-robust statistical properties. Then, it was combined with normal statistical analysis to detect outliers, and the approach was evaluated in terms of precision, recall, and F-measure. [PERSON] et al. adopted an LSTM network to detect zero-day attacks against the controller code in a power grid system [19]. The network was first trained with normal hardware readings from performance counters, and then it estimated the distribution deviations from the normal behavior with an effective statistical test. The method was tested with six zero-day attacks and reached a detection rate near 100%, with latency less than 360 ms.  
Besides the aforementioned methods, a hybrid method that combines CNN and LSTM has been proposed in [25]. The method takes both data measurements and network-level features as input to estimate the system states jointly, and false data injection attacks in the power grid system can be detected in real time. The experiment shows superiority compared to traditional state estimation methods.