## 4 Proposed Robust and Accurate ET Anomaly Detector
### The Rationale Behind the Detector's Design  
The rationale behind our robust and accurate ET detector is illustrated as follows:  
1. There is a trade-off between the level of generalization and robustness against evasion attacks in ML-based detectors [16, 44, 45]. Therefore, since a cluster-based detector requires less generalization, it leads to increased robustness compared to global detectors. This is because the cluster-based model is trained on data with close consumption patterns, resulting in superior performance and robustness [32, 33]. To probe more deeply into the reasons behind this superiority, we applied principal component analysis (PCA) to the consumption readings of the dataset in global and cluster-based settings, as shown in Figure 4 and Figure 5, respectively. PCA allows one to reduce the dimensionality, which facilitates the visualization of complex relationships within the data. Analyzing the plots of the first two PCA components in these figures reveals a notable overlap between benign and malicious consumption patterns in the global setting as opposed to the cluster-based setting. Therefore, we opted for a cluster-based detector rather than a global detector;
2. There is a deep connection between XAI model explanations and adversarial evasion samples. Intuitively, a model's XAI explanation leads to robustness against adversarial evasion samples because evasion samples often result in anomalous XAI explanations [27, 29]. To delve deeper into the reasons behind this, we applied PCA to the SHAP explanations of the consumption readings of the dataset in a cluster-based setting, as shown in Figure 6. It is evident from the figure that the SHAP explanations of benign and malicious consumption patterns are significantly distinct. Additionally, upon examining the cumulative variance explained by the principals component, we observe that approximately 90% of the data variance is explained by the first two components of the XAI explanations, compared to only 50% for the consumption readings. Therefore, SHAP explanations are capable of compressing larger amounts of information more efficiently than consumption readings, i.e., with a lower number of PCA components. Consequently, our detector is trained using the SHAP explanations of consumption readings, rather than the readings themselves;
3. Unsupervised anomaly detectors are trained solely on benign data to detect various malicious activities by identifying deviations from learned benign patterns without needing malicious datasets during the training phase. However, they use malicious data to determine the ideal reconstruction threshold for superior detection performance. Comparing DAE and OCSVM anomaly detectors, the DAE achieves superior  
Figure 3: SHAP values: top-20 features (readings).  
detection performance because its deep structure extracts relevant features from the input data, thereby enhancing detection [15; 46]. However, the performance of the DAE is susceptible to threshold selection. Conversely, the OCSVM does not require finding optimal threshold values, which may be difficult to find without any knowledge of malicious data [47]. Therefore, we propose a hybrid anomaly detector that combines DAE and OCSVM, achieving superior performance while eliminating the need for determining optimal threshold values.