# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Data Integrity Attacks
This method demonstrates a low computational load and better anomaly detection rates over principal component analysis-based and other ANN-based intrusion detection systems; the speed also stands out in this method. One limitation that can be highlighted is that the tests performed are not extensive enough to be considered the better solution; however, it is an interesting experimental alternative. Another FDI attack is the sending of false prices to consumers. Here, the cumulative sum (CUSUM) technique is used [29], considering the control actions of the system under attack and how to design a controller that mitigates these attacks. But if there is a large variation in CUSUM samples caused by deviations in average consumption trends, more stealthy attacks could be omitted, and multi-tier detection schemes may be more effective [61]. Also, the two-tier real-time attack detection scheme compared to exponential weighted moving shows a better detection rate and fewer false alarms. A principal issue in SG is load forecasting. There are five types of attacks: pulse, scale, ramp up or ramp down, random, and smooth curve. Here, k-means clustering is applied as an unsupervised machine learning algorithm to reconstruct the reference load data and naive Bayes classifier as the supervised machine learning algorithm for the classification of attack templates, and dynamic programming is used to calculate both the occurrence and parameter of a cyberattack on load forecast data [41]. This method is robust and has a high detection rate; however, its weakness is that it fails to find new variants of identified cyber-attacks, so improvements can be considered by incorporating multiple layers. The possibility of affecting a wide area damping control (WADC) system by pulse attack, ramp attack, relay trigger attack, false data injection attack, or a coordinated attack combining several attacks is a real risk related to SGs. In this case, an anomaly detection algorithm with supervised machine learning and model-based logic for mitigation, support vector machine (SVM), decision trees, K-nearest neighbor (k-NN), Naive Bayes, discriminant analysis, logistic regression, and neural networks is raised as an effective option [53]. Solutions of this class that combine several methods to deal with a defined battery of specific attacks on the power grid have no clear benchmark against which to compare them; however, they can be evaluated on the accuracy of anomaly detection and in this case, the experimental result is 96.5%. Semi-supervised learning in combination with other methods such as autoencoders and generative adversarial network (GAN), forming data-driven methods that are not dependent on specific estimation methods or system knowledge, can be effective in FDI detection and mitigation [55]. This method was evaluated against others such as semi-supervised support vector machines (S3 VM), K-NN, and autoencoders, and showed a superior detection rate. This method may be ineffective against systems with variable topology; an improvement is to dynamically adapt to network changes. Recent studies show that deep learning (DL) is valid in cybersecurity preservation applications but requires large data samples. Knowing if an FDI attack is occurring without prior samples is novel, and spatiotemporal graph deep learning (STDGL) is used for this purpose [76]. Compared to other methods, such as multi-layer perceptron (MLP), CNN, and GRU, it shows better accuracy and precision in identifying FDI attacks.