# Exploiting Autoencoder-Based Anomaly Detection to Enhance Cybersecurity in Power Grids
## 3 AE-GRU Anomaly Detection Framework
### Semi-Supervised Algorithms  
The primary objective of the detection stage is to differentiate between regular and unusual traffic routed in the smart grid. In this study, four semi-supervised anomaly detection techniques were explored: a One-Class Support Vector Machine (1 SVM), Local Outlier Factor (LOF), Isolation Forest (iF), and Elliptic Envelope (EE). These methods are designed to detect the anomalies in data without requiring labeled instances of anomalies during training. In other words, these methods were developed using a semi-supervised training approach, which involves training only with normal data (i.e., attack-free data).  
* A One-Class SVM is a machine learning algorithm used for anomaly detection, particularly in cases where only normal data are available for training. It works by constructing a hyperplane in a high-dimensional space that encapsulates the normal data points. This hyperplane should ideally separate the normal data from the rest of the feature space which contains anomalies [37; 38]. During training, the algorithm learns to maximize the margin around the normal data points while minimizing the possibility of including anomalies within this margin. During inference, data points lying outside this margin are classified as anomalies [39].
* Isolation Forest (iF) is an ensemble learning method designed for outlier detection. It constructs a set of isolation trees, each of which partitions the feature space by randomly selecting a feature and a split value. Anomalies are expected to be isolated in fewer partitions compared to the normal data points [40]. Therefore, they require fewer splits to be separated from the majority of the data. The algorithm measures the average path length for each data point in the trees. The shorter average path lengths indicate anomalies, while the longer path lengths suggest normal data [41].
* An Elliptic Envelope (EE) is a statistical method used for multivariate outlier detection assuming that the normal data points are located within a tightly bound elliptical region. The algorithm fits an ellipse to the data using robust covariance estimation techniques [42]. Data points lying outside the ellipse are considered outliers, as they deviate significantly from the expected distribution of normal data. The EE method is particularly useful when the normal data follow a Gaussian distribution and when the dimensionality of the data is relatively low [41].  
Figure 3: Architecture of the proposed hybrid AE-GRU model.  
* The LOF method comprises a density-based anomaly detection algorithm that measures the local density deviation of a data point with respect to its neighbors. It operates under the assumption that anomalies have lower densities compared to their neighbors, resulting in higher LOF scores [43]. The LOF score of a data point is computed based on the ratio of the local density of the point to the average local density of its neighbors. Data points with significantly higher LOF scores compared to their neighbors are considered outliers.  
Table 1 provides a concise overview of the characteristics of these four anomaly detection methods. These approaches offer different strategies for identifying the anomalies in data and can be applied depending on the specific characteristics of the dataset and the nature of the anomalies being targeted.