# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 4 Threat Scenarios and Results
### Detection Results  
The anomaly detection methods were trained using normal IEC 104 communication data (attack-free data), which consisted of 58,930 packets collected over a period of 2 days, 19 h, and 55 min. This approach was chosen because the proposed methods are semi-supervised, eliminating the need for labeled data. From each traffic sample, 16 key attributes were extracted, including source and destination IP addresses, as well as port numbers. During the training, the parameters of each method were adjusted to minimize the cross-entropy of the reconstructed error, ensuring the optimal performance of the models. The AE-GRU model is configured with nine input features and utilizes the ReLU activation and Cross-Entropy loss functions. The Rmsprop optimizer was employed during training, which consists of 300 epochs with a batch size of 250. Each input sequence has a length of 12 timesteps. The encoder comprises three layers, with the first layer containing a GRU with 128 units, followed by a GRU layer with 16 units, and finally, a dense layer with units equal to the number of features. On the other hand, the decoder comprises three layers: the first layer is a dense layer with the units equal to the number of features, followed by two GRU layers with 16 and 128 units, respectively. On the other hand, the standalone anomaly detection methods are configured with the specific parameters for their operation. Isolation Forest is set with a contamination rate of 0.01 and utilizes 150 estimators. The LOF method also has a contamination rate of 0.01 and is configured with the novelty set to TRUE. The EE method is configured with a contamination rate of 0.01 and a support fraction of 0.995. For the 1 SVM method, the kernel used is the Radial Basis Function (RBF), with the parameters set as follows: \(\
u=0.0015\) and \(\gamma=0.25\). * DOS attack: In this scenario, a DOS attack is directed at an IEC 104 control station, aiming to overload it and disrupt its functionality, thereby potentially causing grid failure. The attacker gains unauthorized access by utilizing a spoofed IP address and floods the victim with a significant volume of 1049 messages over a 30 min period. This onslaught overwhelms the control station's resources, rendering it unable to respond effectively to legitimate requests and ultimately leading to system instability or failure. Figure 5 presents the heatmap illustrating the detection performance metrics attained by the AE-GRU-based and standalone anomaly detection methods during the DOS attack scenario. During the DOS attack scenario, Figure 5 shows that the AE-GRU-based anomaly detection methods demonstrated varying performance levels compared to the standalone models. Specifically, the AE-GRU-iForest method achieved an accuracy of 0.8875, exhibiting strong precision and F1-score values of 1 and 0.9052, respectively. This suggests that the AE-GRU-iForest method effectively detected anomalies with minimal false positives and achieved a balance between precision and recall. However, the AE-GRU-LOF method showed a lower accuracy of 0.65, indicating that it struggled to correctly classify instances during the attack. While it achieved perfect recall, its precision and F1-score were notably lower at 0.65 and 0.7879, respectively. Conversely, both the AE-GRU-1 SVM and AE-GRU-EE methods demonstrated excellent performance, with accuracies exceeding 0.99 and perfect precision, recall, and F1-scores, indicating their robustness in detecting DOS attacks. In comparison, the standalone anomaly detection methods exhibited different detection capabilities (Figure 5b). The iForest method achieved an accuracy of 0.5709, indicating a lower overall performance compared to the AE-GRU-based methods. Although it exhibited reasonable precision and F1-score values of 0.8391 and 0.7269, respectively, its recall was notably lower at 0.6411, indicating a higher rate of false negatives.