# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 3 AE-GRU Anomaly Detection Framework
### The Proposed AE-GRUI-Driven Anomaly Detection Framework  
This section provides a brief overview of the proposed anomaly detection framework for detecting the cyberattacks in smart grids, specifically focusing on monitoring network traffic data, mainly focusing on the IEC 104 protocol communication. This protocol is commonly used for exchanging control and monitoring information between the devices in smart grids. By focusing on IEC 104 data, the framework specifically targets the communication within the smart grid control system, potentially leading to more accurate anomaly detection compared to analyzing general network traffic. To effectively model the distribution of normal traffic, it is imperative to capture the temporal data dependencies \begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Approach** & **Basic Idea** & **Pros** & **Cons** \\ \hline \multirow{6}{*}{1 SVM} & \multirow{6}{*}{Constructs a hyperplane to encapsulate normal data and separates it from anomalies.} & - & Effective for high-dimensional data & - & Sensitive to parameter tuning \\  & & & & Works well with small training & - & Slow training on large datasets \\ \cline{1-1}  & & & & data & large datasets \\ \hline \multirow{6}{*}{LOF} & \multirow{6}{*}{Measures the local density deviation of a data point with respect to its neighbors.} & - & Robust to outliers and noise & - & The computational complexity increases with dataset size \\ \cline{1-1}  & & & & data & parameter selection can be challenging \\ \hline \multirow{6}{*}{Isolation Forest (if)} & \multirow{6}{*}{Constructs isolation trees to isolate anomalies with fewer splits than normal data.} & - & Efficient for high-dimensional data & - & Prone to overfitting with noisy data \\ \cline{1-1}  & & & data & data & - & Limited interpretability \\ \cline{1-1}  & & & & and inference & & interpretability \\ \hline \multirow{6}{*}{Elliptic Envelope (EE)} & \multirow{6}{*}{Fits an ellipse to the data and detects outliers ellipse.} & - & Robust to multivariate outliers & - & Assumes a Gaussian distribution of normal data \\ \cline{1-1}  & & & & data & data \\ \cline{1-1}  & & & & data & data \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Comparison of the four semi-supervised anomaly detection methods. inherent in data sequences and time-series data. The proposed deep learning model is designed to achieve this by integrating the AE with the GRU model, which is renowned for its ability to learn long-range dependencies, into its structure. Within this framework, the autoencoder (AE) plays a pivotal role, performing two critical tasks: feature extraction and dimensionality reduction. Through the training process, the deep AE constructs a compact representation of the data, incorporating the relevant features and reducing the dimensionality. By combining the robustness of deep autoencoders with the effectiveness of recurrent neural networks, the AE-GRU model can effectively capture lengthy time-period dependencies. Importantly, this method is agnostic to the communication standard employed in the smart grid network, allowing for versatility across various standards. For the purposes of this study, the proposed cyberattack detection procedure was evaluated using the IEC-104 standard. The process flow is depicted in Figure 4, illustrating the two phases: training and detection. Data preprocessing involves the removal of missing values and standardization of numeric features. Subsequently, during the training phase, the AE-GRU model and anomaly detection procedures are trained using attack-free data. The trained model is then evaluated using testing data to assess its performance. During the training stage, the data are normalized and organized into sequences of specific lengths. Encoding these sequences generates a compact representation containing the essential features, with the training process aiming to minimize the reconstruction error using the cross-entropy loss function. This iterative process continues until the model converges and the reconstruction error stabilizes.