## 4 Defense Against False Data Injection
### Experiments
#### 4.2.1 Dataset Preparation  
The proposed detector requires training on both benign and malicious data to distinguish between normal and fraudulent SoC patterns. However, obtaining real-world malicious SoC data is challenging, as such data is not publicly available. To overcome this limitation, we simulate malicious data by applying a series of FDI cyber-attacks, as described in Section 3.1. These attacks manipulate benign SoC values to generate realistic malicious samples. The benign dataset is created by running the RL-based charging coordination agent, collecting the SoC values after the agent's policy converges to the optimal policy, \(\pi^{*}\). The agent uses net-load readings derived from real-world data on energy consumption and generation provided in [28]. These net-load readings reflect the difference between energy consumed and energy generated by solar panels at each time step. To convert the net-load readings into SoC values for each consumer's battery, the RL agent applies the following equation at each time step \(t\):\[\text{SoC}_{i}^{(l+1)}=\text{SoC}_{i}^{(l)}-\left(\frac{\text{R}_{i}^{(l)}}{\text {Battery Capacity}}\times 100\right)+\left(\frac{C_{i}^{(l)}}{\text{Battery Capacity}}\times 100\right) \tag{14}\]  
where,  
\(\text{SoC}_{i}^{(l+1)}\) is the state of charge of consumer \(i\) at time step \(t+1\).  
\(\text{R}_{i}^{(l)}\) is the net-load reading for consumer \(i\) at time step \(t\).  
\(\text{C}_{i}^{(l)}\) represents the amount of energy charged by the battery of consumer \(i\) decided by the RL agent at time step \(t\).  
Battery Capacity is the total capacity of the consumer's battery.  
This equation calculates the updated battery state of charge by accounting for three factors: the charging power allocated to the consumer by the RL agent, the energy consumed by the consumer within one hour, and the renewable energy generated by the consumer during that time. After computing the SoC values of the honest consumers, every 24 values (that covers one day) is taken as one sample in the benign dataset and labeled benign.  
The malicious data is generated by applying the five FDI cyber-attacks described in Section 3.1 to the benign samples, resulting in a malicious dataset that is five times larger than the benign dataset. For Attacks #1 and #2, the parameter \(\alpha\) is a uniformly distributed random variable within the interval \([0.1,0.4]\). In Attack #2, the start time \(t_{s}\) is also a uniformly distributed random variable within the range \([0,19]\), while the end time \(t_{e}\) is fixed at 24, and \(0.1\leq\beta\leq 0.3\) in Attack #5. Consequently, each consumer's dataset contains 365 benign samples and 1825 malicious samples (365 samples from each of the five attacks), resulting in a total of 2190 samples per consumer. This creates an imbalanced dataset with a class ratio of 1:5, as the number of benign samples is significantly lower than the number of malicious samples. Training the FDI attack detector on this imbalanced dataset may lead to a bias toward the malicious class, which represents the majority.  
To address this class imbalance, we apply the Synthetic Minority Over-sampling Technique (SMOTE), which generates synthetic samples by interpolating between existing minority class samples. This method over-samples the minority benign class for each consumer, resulting in a balanced dataset. Consequently, the total number of samples per consumer increases to 3650, with an equal division between benign and malicious samples, each consisting of 24 readings. Considering 10 consumers over 365 days, the overall dataset comprises 36,500 samples (3650 per consumer). The dataset is then split into training and testing sets in a 70% to 30% ratio, yielding 25,550 samples for training and 10,950 samples for testing.