# An Anomaly Detection Ensemble for Protection Systems in Distribution Networks
## 4 Case Study
\begin{table}
\begin{tabular}{c c} \hline \hline
**Feature Type** & **Data Features** \\ \hline Historical operational data & pre-operational status, common defects, maintenance status, and correctness rate of actions \\ \hline \multirow{3}{*}{Real-time operational data} & operational voltage, frequency, internal temperature, input/output status, connection status \\  & of voltage and current transformers, communication status of SV and GOOSE messages, soft \\  & pressure plate status, and CPU utilization rate \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Data of the case study. The precision-recall (PR) curve can depict the changing trend between _PPV_ (also known as Precision) and TPR (also known as Recall). This curve is better suited to assess prediction results when the data in the input database have a stronger bias [47]. Since the PR curve primarily compares true positive data rather than true negative data with false positive data, it can better judge the performance of different prediction models when negative data samples predominate in the input database. Generally, the proportion of outliers in the example data indicators is small, i.e., most of the samples in the dataset are negative data samples. Therefore, using the PR curve has a better analytical effect. This article uses the area under the PR (AUPR) curve and the ROC (AUC) curve as an evaluation indicator, with a specific diagram shown in Figure 5 below. As can be seen from the above figure, the area under the PR curve is the geometric area between the PR and the coordinate axis. Moreover, for a perfect prediction, both the PPV and TPR values will be 1; hence, a perfect PR curve must pass through the coordinate point (1,1). Therefore, the closer the PR curve generated by the prediction model is to the top right corner, i.e., the larger the AUPR, the better the performance of the prediction  
As can be seen from Figures 8 and 9, the proposed KPCI-IF method has the highest detection performance for different scenarios, devices, and parameters in the protection system. Among all the characteristic data of the examples, the detection accuracy of the maintenance status, transformer connection status, etc., is relatively high due to the overall high safety and the presence of relatively fewer samples deviating from the normal value range. However, real-time operation data such as operating frequency and CPU utilization rate have a relatively lower detection accuracy, due to the large number of data samples and the dense time series. However, most of them cannot cause substantial faults, so for this type of data feature, a relatively higher detection threshold can be independently set later. In addition, among the three comparative anomaly detection models, the detection accuracy of the IF, LOF, and K-means methods decreases successively, proving that tree structures have corresponding advantages in terms of model construction perfection compared to density and distance structures. Finally, by comparing the detection results of KPCI-IF and ordinary IF, it can be seen that the added dimension reduction step is very significant when facing potentially high-dimensional large-capacity data. The timeliness of the proposed method is then validated and the calculation time of the proposed KPCI-IF method is compared with that of PCI-IF and IF methods. The comparison results are shown in the following Table 11.  
From the above table, it can be concluded that the proposed KPCI-IF method still has a certain advantage in terms of timeliness. Compared to the single-model IF detection method, IF combined with the data dimension reduction model can effectively reduce the complexity of data, thereby improving the response speed of anomaly detection. In addition, by incorporating kernel functions, KPCI is better adapted to high-dimensional data environments than the standard PCI and has certain advantages in terms of computational efficiency. In addition, we further strengthen our arguments and findings via comparative analysis.