# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Network Intrusions  
Table 7 displays an overview of the findings. Sensing via sensors and supported by AI was already being studied more than a decade ago. An example being utilizing machine learning algorithms to identify and categorize abnormalities based on sensory data, which is valuable for promptly detecting unauthorized access in real time. The Decision Tree Classifier (J48) and C4.5 algorithm are used to generate a decision tree based on the provided training data [16].  
The development of an intrusion detection model is subject to unknown engineering problems. It is a complex challenge and requires multiple approaches. The combination of whale optimization algorithm (WOA) as an optimization technique and ANN for classification modeling is useful in this regard [56]. The WOA can train the ANN to find the optimal weights. The model comparison results show superiority over SVM and neural networks without WOA.  
Systems based on behavioral rules seek to detect malicious devices that exploit network vulnerabilities through known or unknown attacks. These methods allow us to recognize, for example, situations in which an attacker waits for the opportunity to affect some device by taking advantage of weather conditions in which adverse operating conditions would be expected [18]. The accuracy of discriminating or recognizing intrusions and false positives means that only rule-based IDS systems today may be unsuitable for complex networks, and their combination with ML methods should be explored.  
Electrical substations are susceptible to intrusions; here, host-based and network-based anomaly detection are applicable. A host-based anomaly detection system (ADS) uses logs generated by substation devices from which malicious footprints of intrusion-based steps in the substation facilities are extracted. A network-based ADS can detect malicious behaviors related to multicast messages in the substation network [19]. This kind of solution is practical but lacks mechanisms to detect unknown or undefined attacks in the algorithm, and improvement could be achieved by generating more robust hybrid methods that involve dynamic and automatic learning mechanisms.  
Enhanced network user monitoring can effectively reduce the risk of data leakage, phishing, and spam attacks through the implementation of statistically based detection models and an adaptive multi-agent architecture [69]. An architecture, as such, will not indicate what a system can do, but how it should work. This is an interesting perspective, as the architecture could be implemented with different AI methods that would determine the capabilities to profile and detect intrusions.  
Malicious data mining attacks can compromise sensitive user data if data packets can be intercepted through IoT network channels in SGs. The privacy-preserving data aggregation (PDAM) scheme based on the Paillier cryptosystem, and the knowledge signature mechanism shows a six-phase solution for this scenario [63]. This could be seen as a complementary proposal to detection systems, since if user data is at imminent risk, at least mechanisms would be in place to keep the data unreadable to external or internal attackers.