## 2 Related Work
### Classification Algorithms  
Intrusion detection scheme for smart grid based on machine learning refers to: converting the network intrusion problems into a packet type classification problems based on different intrusion types of packets, and using machine learning methods to train classification models to identify and classify intrusion packet types. However, due to the large number of network data features, if various features are used for training, it will increase the training time and model complexity, and the hardware requirements will also increase. To solve the problems of too many dimensions of network data features, there are various methods to extract data feature dimensions for reducing data feature dimensions. Consequently, intrusion detection can be treated as a packet type classification problem using machine learning. Feature extraction is usually adopted to reduce computation, whose common methods include correlation-based feature selection and encoding of data packets. The former uses a correlation function to select subsets of data, thereby reducing data size. The latter uses encoding to extract data features. Typical feature classification algorithms include K-nearest neighbour (KNN), Naive Bayes (NB) classifier, Back Propagation Neural Network (BPNN) and Decision Tree (DT). _KNN Algorithm_-The KNN algorithm first selects the value of \(K\), which denotes the number of nearest neighbours. Between a given data point \(x\) and its neighbour \(y\), their distance in the \(n\)-dimensional Euclidean space is  
\[d_{xy}=\sqrt{\sum_{i=1}^{n}{(x_{i}-y_{i})^{2}}} \tag{1}\]  
Then it takes the \(K\) nearest neighbours as per the calculated Euclidean distance. Among these \(K\) neighbours, the algorithm counts the number of points in each class. Finally, it assigns x to that class for which the number of neighbours is maximum. The KNN algorithm is relatively accurate with simple implementation. Nevertheless, its efficiency will significantly decrease as the number of data points increases. _Naive Bayes Algorithm_--The Naive Bayes classifier calculates conditional probability to perform classification. \[y=\arg\max\{p(y=C_{k})\prod p(x|y=C_{k})\} \tag{2}\] \begin{table}
\begin{tabular}{c c l} \hline
**Type** & **Attack** & **Description** \\ \hline Normal & Normal data traffic & Normal data type \\ \hline \multirow{4}{*}{DoS} & Back, Land, Neptune, & Denial of service attacks, \\  & Pod, Smurf, Teardrop, & which make computers and \\  & MailDomb, Processtable, & networks unable to provide \\  & UDPstorm, Apache2, Worm & normal services \\ \hline \multirow{2}{*}{Probe} & Satan, Nmap, Mscan, Saint, & Port attack, scan port \\  & IP sweep, Portsweep & vulnerabilities to attack \\ \hline \multirow{4}{*}{U2R} & Buffer overflow, Sql attack, & Unauthorized users obtain \\  & XtermLoadmodule, Rootkit, & root vulnerabilities through \\  & Perl, Ps & network vulnerabilities and \\  & & perform illegal operations \\ \hline \multirow{4}{*}{R2L} & Guess password, Imap, & \\  & Multihop, Ftp write, Phf, & Remote attack, users remotely \\  & Waremaster, Xclock, & log in operate illegally \\  & Xsnoop, Snmpguess, & through accounts and \\  & Snmpgetattack, Sendmail, & passwords \\  & Httptunnel, Named & \\ \hline \end{tabular}
\end{table} 
Table 2: Summary of attacks types labeled in the NSL-KDD dataset. With \(x=(x_{1},x_{2},\ldots,x_{n})\), assuming that all features \(x\) are mutually independent, from Bayesian theorem we have  
\[p(C_{k})p(x|C_{k})=p(C_{k})\prod_{i=1}^{n}p(x_{i}|C_{k}) \tag{3}\]  
Therefore, \(p(C_{k}|x)\propto p(C_{k})\prod_{i=1}^{n}p(x_{i}|C_{k})\).