###### Abstract
It employs a unified approach to provide explanations for model predictions by utilizing Shapley values, which originate from cooperative game theory. These Shapley values indicate how each feature in the input data contributes to the model's prediction output. This paper focuses on securing ML-based ET anomaly detectors against adversarial evasion attacks using XAI. As far as we know, this is _the first work that investigates the SHAP explanations (interpretations) of consumption readings for the detection of evasion attacks by training on these explanations._ Unlike other defense mechanisms, we demonstrate the potential of XAI to secure anomaly detectors against evasion attacks while maintaining the detector's accuracy and relaxing the assumption of selecting ideal threshold values. In particular, we use SHAP explanations of consumption readings to train a cluster-based hybrid anomaly detector that combines a Deep Auto-Encoder (DAE) and a one-class support vector machine (OCSVM). The utilization of XAI alongside DAE+OCSVM anomaly detection brings multiple benefits, including improved classification performance, enhanced robustness against evasion attacks, and the ability to detect zero-day attacks without requiring the selection of optimal threshold value. This occurs because the SHAP explanations effectively distinguish between normal and abnormal consumption patterns, facilitating the identification of anomalies caused by evasion samples. Additionally, training the DAE+OCSVM anomaly detector on SHAP explanations of consumption readings, rather than the readings themselves, enhances classification accuracy. Furthermore, while DAE shows the capability to detect zero-day attacks, its performance is sensitive to the selection of good threshold values. The incorporation of OCSVM overcomes this problem by automatically determining the threshold. The main contributions of our work include the following:  
* We propose a hybrid DAE+OCSVM anomaly detector for ET detection. The experimental results indicate that the proposed DAE+OCSVM detector overcomes existinglimitations in the literature, including the inability of binary detectors to detect new (unseen) attacks and the sensitivity of DAE anomaly detectors' performance to the selection of the optimal threshold;
* We investigate the vulnerability of the DAE+OCSVM anomaly detector to gradient- and optimization-based evasion attacks. The experimental results indicate its vulnerability to benchmark evasion attacks, including the Fast Gradient Sign Method (FGSM), Basic Iterative Method (BIM), Carlini Wagner (C&W), Zeroth-Order Optimization (ZOO), and DeepFool;
* We propose a robust and accurate cluster-based DAE+OCSVM ET anomaly detector by training it on the SHAP explanations of consumption readings. The design objectives include enhancing accuracy, robustness, and the ability to detect new ET cyber-attacks. The experimental results illustrate the robustness of our detector against all the experimented evasion attacks while maintaining high accuracy. The remaining sections of this paper are organized as follows. We explore the prior research conducted in securing ET detection and XAI against adversarial attacks and discuss the limitations and research gaps in Section 2. In Section 3, the ET cyber-attacks, evasion attacks, and threat model addressed in this paper are discussed. Moreover, the proposed robust and accurate ET detector is presented in Section 4. Section 5 discusses the dataset, experimental scenarios, and performance evaluation. Finally, the paper is concluded in Section 6.