# A Review of Smart Grid Anomaly Detection Approaches
## 3 Results and Analysis
### Unusual Consumption Behaviors and Measurements  
Advanced metering infrastructure (AMI) is a key component because it is related to pricing, billing management, and consumption. It is targeted by cyber-attacks specializing in fraud and energy consumption patterns [24]. Non-technical losses (NTL) are economic impacts, damage to infrastructure, and decreased reliability due to fraudulent activities. In this category, there are three types of cyber-attacks known as \"power overloading\":  
1. Indirect load control (ILC) cyber-attacks performed by manipulating the price curve;
2. Direct load control mechanism (DLC) cyber-attacks, where the attacker compromises the energy management System (EMS) to send a false on or off signal;3. Open charge point protocol (OCPP) cyber-attacks: an attacker can damage energy security if communication channels are intercepted, and security credentials are known. Table 6 shows a summary of the methods applied in the scenario of anomalies originating in consumption behavior or measurements. The smart grid can incorporate WAN, NAN, and home area networks (HAN); at the HAN level, distortion attacks can occur on energy consumption based on a threshold, knowing what the expected behavior of a consumer is. In HAN network environments, it is important to analyze energy consumption patterns. The use of DWT as well as variance fractal dimension (VFD) and ANN prove to be useful [24]. One interesting thing here is that the solution is immune to noise and considers attacks of varying duration, a few minutes or an hour, for example; the detection rate is 96% at best. An improvement is to go towards dynamic learning automation of new attack characteristics, and this could be achieved by incorporating CNN. The IoT is increasingly present and is a key factor to consider in HAN environments. Distributed machine learning in IoT devices using a distributed neural network (DNN) is focused on smart buildings and allows for analyzing occupants' consumption behaviors as well as providing short-term energy forecasts [34]. Here, the solution aims to identify consumption behaviors for optimization and cost reduction. This is especially useful when focused on neighborhoods composed of smart buildings, where this method proves to have better results compared to SVM. In NAN areas, there are scenarios where the fraudulent consumer reports a fraction of their energy consumed consistently; here, the use of linear programming (LP) manages to detect metering defects [32]. Other methods usually employed are SVM, decision tree, fuzzy clustering, and classification rough set theory; however, linear regression models and LP show better detection results. Some methods cover NAN and HAN environments. These are anomaly detection frameworks based on consumption patterns, employing supervised machine learning (REPTree, MSP, Random Forest, ANN, and SVM) to detect and prevent cyber-attacks due to network overload [52]. In particular, the combination of methods called the consumption pattern-based anomaly detection framework (CPADF) shows at least experimentally a good detection rate and fewer false positives compared to other home and neighborhood network-focused solutions based on regression, neural network, and decision tree models. Unsupervised learning is useful in scenarios where methods for detecting anomalous consumption behaviors must reduce the influence of subjective factors [35]. This method can be particularly useful in exploratory or experimental studies where little data is available, and it is suspected that there may be unusual energy consumption. The clustering of historical time series allows for the identification of the consumption profile by K-means, and then the LSTM model, which is a particular type of RNN, serves to forecast future individual consumptions with respect to the most common profile [6].