## 2 Related Work
### Feature Extraction Methods  
Correlation-Based Feature Extraction-Correlation-based feature selection (CFS) uses the evaluation function to select a feature subset. For two continuous random variables \(X\) and \(Y\), their linear correlation coefficient is given by  
\[r_{XY}=\frac{\sum_{i}\left(x_{i}-\overline{x_{i}}\right)(y_{i}- \overline{y_{i}})}{\sqrt{\sum_{i}\left(x_{i}-\overline{x_{i}}\right)^{2}}\sqrt {\sum_{i}\left(y_{i}-\overline{y_{i}}\right)^{2}}} \tag{9}\]  
Automatic Encoder-Asymmetric Convolutional Encoder (ACE) can be used with a convolutional neural network [19] for unsupervised feature learning to extract the local features of the original data. The output of a hidden layer can be used as the input of the next layer. In each round of training operation of the convolutional layer, the algorithm first initialises \(k\) convolution sum, each convolution with weight \(w\) and bias \(b\),  
\[h^{k}=f\Big{(}x*w^{k}+b^{k}\Big{)} \tag{10}\]  
The convolutional layer output from the upper layer is reconstructed (with bias \(c\)) to obtain the output data characteristics, which are adjusted by comparing the input and output data.  
\[y=f\left(\sum_{k=1}^{K}h^{k}*w^{k}+c^{k}\right) \tag{11}\]  
This method uses multiple iterations of convolution, which increases the computational complexity.  
Recently, intrusion detection was also studied for Internet of Things (IoT) and [PERSON] et al. presented a lightweight intrusion detection method using supervised machine learning-based support vector machine (SVM) to detect malicious data injection [20]. However, it is difficult to apply it directly in smart grids due to different types of attacks. In [21], [PERSON] et al. presented an unsupervised anomaly detection based on statistical correlation between measurements and time series partitioning to discover causal interactions between the subsystems. It adopted feature extraction utilising symbolic dynamic filtering (SDF) to reduce computational burden. In [22], [PERSON] et al. presented an anomaly detector using stacked autoencoders with a long-short-term-memory (LSTM)-based sequence-to-sequence structure to detect electricity theft cyberattacks in smart grids. [PERSON] et al. presented an extensive survey on various cybersecurity enhancements of smart grids to detect false data injection attacks (FDIA), DoS attacks, distributed denial of service (DDoS) attacks, and spoofing attacks [23]. Interestingly, [PERSON] et al. presented a comprehensive survey for deep-learning-based abnormality detection in smart grids using multimodal image data [24], which include visible light, infrared, and optical satellite images. In [25], [PERSON] et al. reviewed different machine learning tools to detect cyberattacks in smart grids. In addition, it also highlighted various challenges, drawbacks and possible solutions of machine learning based cybersecurity applications in smart grids. A latest anomaly detection approach based on federated learning was proposed in [26], where machine learning models were trained locally in smart meters without sharing data with a central server, thus ensuringuser Privacy. Table 3 compares our work with those machine learning based works found in the literature.