A Review of Smart Grid Anomaly Detection Approaches Pertaining to Artificial Intelligence

Featured Application

This review can be used as a guiding reference to how studies of distinct types of smart grid abnormalities are approached.

Abstract

The size of power grids and a complex technological infrastructure with higher levels of automation, connectivity, and remote access make it necessary to be able to detect anomalies of various kinds using optimal and intelligent methods. This paper is a review of studies related to the detection of anomalies in smart grids using AI. Digital repositories were explored considering publications between the years 2011 and 2023. Iterative searches were carried out to consider studies with different approaches, propose experiments, and help identify the most applied methods. Seven objects of study related to anomalies in SG were identified: attacks on data integrity, unusual measurements and consumptions, intrusions, network infrastructure, electrical data, identification of cyber-attacks, and use of detection devices. The issues relating to cybersecurity prove to be widely studied, especially to prevent intrusions, fraud, data falsification, and uncontrolled changes in the network model. There is a clear trend towards the conformation of anomaly detection frameworks or hybrid solutions. Machine learning, regression, decision trees, deep learning, support vector machines, and neural networks are widely used. Other proposals are presented in novel forms, such as federated learning, hyperdimensional computing, and graph-based methods. More solutions are needed that do not depend on a lot of data or knowledge of the network model. The use of AI to solve SG problems is generating an evolution towards what could be called next-generation smart grids. At the end of this document is a list of acronyms and terminology.

1. Introduction

This study aims to examine the many solutions developed for detecting anomalies in Smart Grids (SGs). Specifically, it focuses on those solutions that employ artificial intelligence techniques or approaches. The objective is to gain insight into their practicality and highlight the prevailing trends in this area.

Digital technologies are being integrated into the foundational framework of the electrical grid. The driving forces behind this include the integration of renewable energy sources, ensuring the security of energy supply, and enhancing infrastructure operation and maintenance efficiency [1].

Smart grids face the following research challenges: (1) how to get a more accurate prediction method; (2) how to find optimal programming when an online learning task is performed; and (3) how to learn multiple tasks in a more automatic way [2]. As the complexity of the systems that support the operation of the power grids increases, there is also a growing need for a shift in the paradigm of network management from reactive to proactive, and this can be achieved using advanced monitoring tools, data analysis, and predictive methods [3].

Future smart grids will require systems that can monitor, predict, schedule, learn, and make consumption decisions in real time that are highly associated with external weather conditions and energy output [2,4].

The relevance of detecting, localizing, and predicting abnormal energy network events or behaviors extends to customers, network operators, service providers, and regulatory bodies. The anomaly detection solutions are applied to the four components of an SG: generation, transportation, distribution, and consumption of electric energy. Therefore, the detection of anomalies is an important part of the challenges facing new smart grids.

An anomaly is a modification of the expected behavior of the system, and three types are considered: specific, context, and collective anomalies. In specific anomalies, an individual event instance may be considered anomalous compared to the rest of the dataset [5].

Context anomalies start with the notion that behavior and context are separate: the same conduct may not be regarded as an anomaly if it occurs in a different context. For example, anomalous occurrences scheduled at specific times and days of the year may not activate an anomaly detection mechanism because they are already expected [6,7].

Collective anomalies refer to instances where abnormal behavior cannot be identified by examining each event in isolation but rather by considering them as part of a collection of events [6,7].

The SG progressively plays a significant role in critical and industrial infrastructures, especially with the industry 4.0 revolution. They have become more dependent on connectivity by supporting novel communication and remote-control functionalities that expand the risks of cyber-attacks [8]. This has promoted a growing interest in studies on anomaly detection.

The physical and cybernetic infrastructures that make up an SG may present unexpected behaviors in the face of cyber-attacks, natural disasters, meteorological phenomena, events coming from the network operation itself, physical damage to network components, deviation from normal operating parameters, and overloads [9].

In this context, SGs must be able to resist anomalous events, detect them, mitigate them, and provide support for the development of a capacity to restore service or behavior quickly and safely.

2. Materials and Methods

A review of papers related to the detection of anomalies in smart grids was carried out, and bibliographic management tools and digital repositories were used to search for documents. The following stages were considered: definition of research questions, planning and definition of a search strategy, establishment of study selection criteria, identification of results, and analysis.

2.1. Definition of Research Questions

The aim of the review is to identify research studies pertaining to anomaly detection in smart electrical grids as well as analyze the trends and methodologies employed. As a result, the answers to the following questions are sought:

• What is currently known about anomaly detection?
• What are the most common AI methods?
• What is the trend in this field?

The Mendeley library management tool and electronic resources, whose search tools allow the localization of documents relevant to the review, were used: ACM Digital Library, Compendex, ScienceDirect—Elsevier, IEEE Xplore, ISI Web of Science, SpringerLink, and Wiley Inter Science Journal Finder.

In the exploration and search for manuscripts the following keywords were combined: smart grid, cyber physical systems, anomaly detection, and artificial intelligence.

2.2. Planning and Definition of the Search Strategy

The search was planned in four stages, as shown in Figure 1, beginning with automated test searches to obtain the greatest number of works that match the combination of keywords, after which they manually discarded those works that were not related to the review’s objective or that were duplicates in a second stage.

In a third phase, the selection criteria set out in Section 2.3 are applied with the aim of reducing results and obtaining specialized manuscripts in the study area. Finally, quality criteria were applied to the results obtained in the selection phase to identify the most relevant papers.

The search approach involves utilizing automated search tools in digital repositories and bibliographic management systems to identify and organize the retrieved results and documents (Figure 2).

Test searches enable the refinement of filters to locate works pertaining to the detection methods of anomalies in SGs. Subsequently, the criteria specified during the planning stages are applied, and the resulting documents are stored for review. The search also considers the publishing date, starting from 2011 as the initial year, aligning the search with recent studies of global energy perspectives [12].

2.3. Selection and Quality Criteria

Three overarching principles are considered to determine the significance of each research project on smart grids in detecting anomalies: the work demonstrates rigor through its thorough approach and utilization of research techniques; the findings are presented in a well-structured and relevant manner, enhancing their credibility; and furthermore, the results hold relevance and practical value within the context of SGs.

The selection criteria showed in

Table 1. List of selection criteria.

N.	Criteria
1	Study addresses anomaly detection in relation to smart grids
2	The study presents empirical results
3	The study presents methods and their applications
4	The study presents future lines of research

are designed based on those three principles to discover papers that are pertinent to addressing research questions, considering their focus, aims, conclusions, findings, and study depth.

Table 2. List of quality criteria.

N.	Criteria
1	Knowledge of existing related literature is evident
2	Provides answers to research questions
3	The work enables practical applications or explores new design options
4	The solution to a real problem is being addressed
5	The work presents evidence of the validity of the findings
6	The work contrasts alternative solutions
7	The experiments are explained and reproducible

was created to define quality criteria for selecting documents that rigorously handle the issue, are relevant, and serve as reference sources. The chosen publications were those that had consensus among two out of the three academics involved in conducting this review.

3. Results and Analysis

Table 3. Summary of selected documents by year. Anomaly detection.

Year	Paper
2011	[13,14,15]
2012	[16,17]
2013	[18]
2014	[19]
2015	[20,21,22]
2016	[23,24,25,26,27]
2017	[7,28,29]
2018	[30,31,32,33,34,35]
2019	[5,6,36,37,38,39,40,41,42,43,44,45]
2020	[8,46,47,48,49,50,51,52,53,54,55,56]
2021	[57,58,59,60,61,62,63,64,65]
2022	[66,67,68,69,70,71,72]
2023	[73,74,75,76]

lists the papers that were reviewed. The dates range from 2011 to 2023, and they provide solutions for the following: distortions in data in measurements of energy consumption, distortions in measurements of electrical signal values, network intrusions, false events in the network, anomalies that can go unnoticed, deviations in state estimates in the network, distortions in consumer prices, injection of false data, distortions in event timestamps, and device configuration changes.

The investigations rely on real or artificially created data obtained through the utilization of information and communications technology. This data is derived from network events and time series, which are saved and processed via various methods with the goal of uncovering unforeseen patterns or behaviors in the SG. In this review, seven study objects related to the detection of anomalies in SGs were identified (

Table 4. Grouping of issues studied for the detection of anomalies in SGs.

Study Object	Paper
Data integrity attacks	[13,21,25,29,40,41,48,49,53,55,59,60,61,62,70,75,76]
Unusual consumption behaviors and measurements	[6,24,27,32,34,35,38,46,52,67,68,71,72,73]
Network intrusions	[16,18,19,56,63,69]
Network infrastructure anomalies	[14,15,17,20,22,33,39,47,58,64]
Electrical data anomalies	[7,23,26,36,43,44,45,50,54,65,66,74]
Cyberattack detection	[8,30,37,57]
Devices for detecting anomalies	[5,28,31,42,51]

).

3.1. Data Integrity Attacks

These are situations in which false data injection (FDI) commonly occurs. This form of attack aims to alter the values of electrical measurements or the outcomes of a network’s state estimation. The objective is to manipulate the energy price or modify the data transmitted between components of the network.

FDI can use sensors in supervisory control and data acquisition (SCADA) systems, sensors for weather monitoring, smart electricity meters, and physical communication components of neighborhood area networks (NAN) or wide area networks (WAN). Attackers usually know the network topology [40]. Technical, confidential information is in the control centers of electric utilities, and physical access is protected and regulated; therefore, it is not trivial for attackers to obtain the information, but it can happen [13]. In an FDI attack, electrical measurements such as voltage and current can be changed and even simulate a valid fault that causes switches or network protection elements to act [62].

Table 5. Detection of data integrity attacks in SGs.

Scenario	Method/Technique	Objective
Affecting the load frequency	ANN Luenberger Observer	Identify anomalies
Attacks on EMS systems	Graphical comparisons
FDI attacks in general	Semi-supervised learning GAN, CUSUM, CNN-LSTM, GAIN-LSTM, STDGL, Multi-tier detection schema	Detect anomalies/Mitigate attacks
Attacks on load forecasting	Supervised learning Unsupervised learning SVM, k-NN

summarizes what will be described below. These are a series of situations on which studies have focused that aim to show applicable solutions in scenarios where an FDI occurs, such as affecting load frequency, altering the energy management system database, affecting consumption prices, phasor measurement unit data, and load forecasts. Each situation presents a different solution.

To detect an FDI relative to load frequency control, artificial neural networks (ANN) are employed because attacks of this type do not have a fixed pattern and can be nonlinear and unpredictable. A Luenberger observer is combined to estimate values and send the observed data to the ANN unit to reduce the computational load [48]. One advantage of this method is its speed and accuracy; the disadvantage compared to other methods such as machine learning or network model-based detection algorithms is that it requires at least a simple mathematical model of the system under analysis.

Anomalies involving data compromised in phasor measurement units (PMUs) can be related to load frequency control; however, from a more holistic viewpoint, the use of generative adversarial imputation networks (GAIN) combined with long short-term memory (LSTM) are also used to identify FDI with acceptable performance and computational cost [75]. This is a novel deep-learning-based data-manipulation attack resilient framework.

The combination of convolutional neural network (CNN) and LSTM proves to be useful in constructing forecast-assisted methods to identify anomalies related to FDI [70]. This model proves to be able to identify anomalies with high accuracy and low false positives, is applicable towards PMU data integrity, and shows the effectiveness of designing layered structured detection systems.

An intruder can launch an unstructured attack when they do not know the connectivity, topology, and configuration of the network, or a structured attack when they know the assets and their interconnections. In both cases, deleting or altering all or part of the database will be unusual, and the attacker will want to go unnoticed. In the face of a stealthy attack, a graph-based approach to graph matching will help identify anomalies in the power grid database [25]. This method demonstrates a low computational load and better anomaly detection rates over principal component analysis-based and other ANN-based intrusion detection systems; the speed also stands out in this method. One limitation that can be highlighted is that the tests performed are not extensive enough to be considered the better solution; however, it is an interesting experimental alternative.

Another FDI attack is the sending of false prices to consumers. Here, the cumulative sum (CUSUM) technique is used [29], considering the control actions of the system under attack and how to design a controller that mitigates these attacks. But if there is a large variation in CUSUM samples caused by deviations in average consumption trends, more stealthy attacks could be omitted, and multi-tier detection schemes may be more effective [61]. Also, the two-tier real-time attack detection scheme compared to exponential weighted moving shows a better detection rate and fewer false alarms.

A principal issue in SG is load forecasting. There are five types of attacks: pulse, scale, ramp up or ramp down, random, and smooth curve. Here, k-means clustering is applied as an unsupervised machine learning algorithm to reconstruct the reference load data and naive Bayes classifier as the supervised machine learning algorithm for the classification of attack templates, and dynamic programming is used to calculate both the occurrence and parameter of a cyberattack on load forecast data [41]. This method is robust and has a high detection rate; however, its weakness is that it fails to find new variants of identified cyber-attacks, so improvements can be considered by incorporating multiple layers.

The possibility of affecting a wide area damping control (WADC) system by pulse attack, ramp attack, relay trigger attack, false data injection attack, or a coordinated attack combining several attacks is a real risk related to SGs. In this case, an anomaly detection algorithm with supervised machine learning and model-based logic for mitigation, support vector machine (SVM), decision trees, K-nearest neighbor (k-NN), Naive Bayes, discriminant analysis, logistic regression, and neural networks is raised as an effective option [53]. Solutions of this class that combine several methods to deal with a defined battery of specific attacks on the power grid have no clear benchmark against which to compare them; however, they can be evaluated on the accuracy of anomaly detection and in this case, the experimental result is 96.5%.

Semi-supervised learning in combination with other methods such as autoencoders and generative adversarial network (GAN), forming data-driven methods that are not dependent on specific estimation methods or system knowledge, can be effective in FDI detection and mitigation [55]. This method was evaluated against others such as semi-supervised support vector machines (S3VM), K-NN, and autoencoders, and showed a superior detection rate. This method may be ineffective against systems with variable topology; an improvement is to dynamically adapt to network changes.

Recent studies show that deep learning (DL) is valid in cybersecurity preservation applications but requires large data samples. Knowing if an FDI attack is occurring without prior samples is novel, and spatiotemporal graph deep learning (STDGL) is used for this purpose [76]. Compared to other methods, such as multi-layer perceptron (MLP), CNN, and GRU, it shows better accuracy and precision in identifying FDI attacks.

3.2. Unusual Consumption Behaviors and Measurements

Advanced metering infrastructure (AMI) is a key component because it is related to pricing, billing management, and consumption. It is targeted by cyber-attacks specializing in fraud and energy consumption patterns [24].

Non-technical losses (NTL) are economic impacts, damage to infrastructure, and decreased reliability due to fraudulent activities. In this category, there are three types of cyber-attacks known as “power overloading”:

(a)

Indirect load control (ILC) cyber-attacks performed by manipulating the price curve;

(b)

Direct load control mechanism (DLC) cyber-attacks, where the attacker compromises the energy management System (EMS) to send a false on or off signal;

(c)

Open charge point protocol (OCPP) cyber-attacks: an attacker can damage energy security if communication channels are intercepted, and security credentials are known.

Table 6. Methods used to identify unusual consumption behavior.

Scenario	Method/Technique	Objective
Unusual consumption behavior	DWT, VFD, ANN, DNN, DRL	Identify anomalies in HAN environment
	LP, REPTree, M5P, Random Forest, ANN, SVM	Identify anomalies in NAN + HAN environment
	Semi-supervised learning GAN	Distinguish unusual non-fraudulent consumption behavior from anomalies with fraudulent intent
	Machine Learning, K-means, LSTM, ConvLSTM, regression tree model, CNN+GRU, FL

shows a summary of the methods applied in the scenario of anomalies originating in consumption behavior or measurements.

The smart grid can incorporate WAN, NAN, and home area networks (HAN); at the HAN level, distortion attacks can occur on energy consumption based on a threshold, knowing what the expected behavior of a consumer is. In HAN network environments, it is important to analyze energy consumption patterns. The use of DWT as well as variance fractal dimension (VFD) and ANN prove to be useful [24]. One interesting thing here is that the solution is immune to noise and considers attacks of varying duration, a few minutes or an hour, for example; the detection rate is 96% at best. An improvement is to go towards dynamic learning automation of new attack characteristics, and this could be achieved by incorporating CNN.

The IoT is increasingly present and is a key factor to consider in HAN environments. Distributed machine learning in IoT devices using a distributed neural network (DNN) is focused on smart buildings and allows for analyzing occupants’ consumption behaviors as well as providing short-term energy forecasts [34]. Here, the solution aims to identify consumption behaviors for optimization and cost reduction. This is especially useful when focused on neighborhoods composed of smart buildings, where this method proves to have better results compared to SVM.

In NAN areas, there are scenarios where the fraudulent consumer reports a fraction of their energy consumed consistently; here, the use of linear programming (LP) manages to detect metering defects [32]. Other methods usually employed are SVM, decision tree, fuzzy clustering, and classification rough set theory; however, linear regression models and LP show better detection results.

Some methods cover NAN and HAN environments. These are anomaly detection frameworks based on consumption patterns, employing supervised machine learning (REPTree, M5P, Random Forest, ANN, and SVM) to detect and prevent cyber-attacks due to network overload [52]. In particular, the combination of methods called the consumption pattern-based anomaly detection framework (CPADF) shows at least experimentally a good detection rate and fewer false positives compared to other home and neighborhood network-focused solutions based on regression, neural network, and decision tree models.

Unsupervised learning is useful in scenarios where methods for detecting anomalous consumption behaviors must reduce the influence of subjective factors [35]. This method can be particularly useful in exploratory or experimental studies where little data is available, and it is suspected that there may be unusual energy consumption.

The clustering of historical time series allows for the identification of the consumption profile by K-means, and then the LSTM model, which is a particular type of RNN, serves to forecast future individual consumptions with respect to the most common profile [6]. Such solutions must consider the ability to distinguish fraudulent consumption from real changes in a customer’s consumption behavior. Experiments show that models based on recurrent neural networks can be a viable alternative.

Detection of energy theft or fraudulent consumption is addressed with methods implementing a convolutional LSTM (ConvLSTM) approach that, compared to CNN-LSTM and MLP methods, can help optimize temporal data redundancy [67]. The experimental results demonstrate that ConvLSTM has strong predictive robustness, and its model structure can effectively avoid overfitting.

A recent area of study is cyber-attacks aimed at energy theft at the distributed generation level, for example, in photovoltaic panels. In this case, machine learning and regression trees are used to detect suspicious data [68]. Compared with other detectors based on SVM, autoregressive integrated moving average, and least-square error, the simulation results revealed a superior detection performance.

With respect to anomalous data that are related to the meter, the use of deep reinforcement learning (DRL) demonstrates accuracy in identification, especially in environments where thousands of metering devices are integrated into the network [71]. Compared to other methods using SVM, CNN, and LSTM, experimental results indicate that it takes less time to detect unknown attacks.

Regarding smart meters, there is a growing concern about information privacy because communications between the meter and the energy service provider’s servers could be breached. Here, the federated learning (FL) anomaly detection methods were compared with centralized models. It can be noted that when the distribution of data changes between clients, FL-based methods perform worse training data than centralized models. On the other hand, FL can replace centralized models in solutions that seek to safeguard data security and privacy [73].

Hybrid models are a trend in electricity theft detection, for example, combining a gated recurrent unit (GRU) and a CNN, where the GRU extracts temporal features while the CNN retrieves abstract patterns from electrical consumption data [72]. This hybrid model has the disadvantage of a high computational cost. On the other hand, it provides better accuracy in detection compared to other hybrid models such as CNN-LSTM and MLP-LSTM.

Big Data technologies, such as Apache (Flink, Storm, Spark), Hadoop (HDFS), and KairosDB are also useful to study unusual customer consumption behaviors and discover unexpected patterns [38]. Due to the speed at which data is generated in SGs, similar solutions will be required as part of energy management systems.

3.3. Network Intrusions

Table 7. Methods related to intrusion detection in SGs.

Scenario	Method/Technique	Objective
Smart Grid Intrusions	Machine learning, Decision Tree Classifier (J48), Algorithm C4.5, Decisions Tree	Intrusion detection
	Behavioral rules specification system	Detect affected or malicious devices
	ADS host-based, ADS network-based	Detect anomalies in IED substation devices and circuit breakers
	WOA, ANN, Multi-agent architecture	Identify multiple intrusion scenarios
	PDAM	Prevent anomalies from data mining attacks

displays an overview of the findings. Sensing via sensors and supported by AI was already being studied more than a decade ago. An example being utilizing machine learning algorithms to identify and categorize abnormalities based on sensory data, which is valuable for promptly detecting unauthorized access in real time. The Decision Tree Classifier (J48) and C4.5 algorithm are used to generate a decision tree based on the provided training data [16].

The development of an intrusion detection model is subject to unknown engineering problems. It is a complex challenge and requires multiple approaches. The combination of whale optimization algorithm (WOA) as an optimization technique and ANN for classification modeling is useful in this regard [56]. The WOA can train the ANN to find the optimal weights. The model comparison results show superiority over SVM and neural networks without WOA.

Systems based on behavioral rules seek to detect malicious devices that exploit network vulnerabilities through known or unknown attacks. These methods allow us to recognize, for example, situations in which an attacker waits for the opportunity to affect some device by taking advantage of weather conditions in which adverse operating conditions would be expected [18]. The accuracy of discriminating or recognizing intrusions and false positives means that only rule-based IDS systems today may be unsuitable for complex networks, and their combination with ML methods should be explored.

Electrical substations are susceptible to intrusions; here, host-based and network-based anomaly detection are applicable. A host-based anomaly detection system (ADS) uses logs generated by substation devices from which malicious footprints of intrusion-based steps in the substation facilities are extracted. A network-based ADS can detect malicious behaviors related to multicast messages in the substation network [19]. This kind of solution is practical but lacks mechanisms to detect unknown or undefined attacks in the algorithm, and improvement could be achieved by generating more robust hybrid methods that involve dynamic and automatic learning mechanisms.

Enhanced network user monitoring can effectively reduce the risk of data leakage, phishing, and spam attacks through the implementation of statistically based detection models and an adaptive multi-agent architecture [69]. An architecture, as such, will not indicate what a system can do, but how it should work. This is an interesting perspective, as the architecture could be implemented with different AI methods that would determine the capabilities to profile and detect intrusions.

Malicious data mining attacks can compromise sensitive user data if data packets can be intercepted through IoT network channels in SGs. The privacy-preserving data aggregation (PDAM) scheme based on the Paillier cryptosystem, and the knowledge signature mechanism shows a six-phase solution for this scenario [63]. This could be seen as a complementary proposal to detection systems, since if user data is at imminent risk, at least mechanisms would be in place to keep the data unreadable to external or internal attackers.

3.4. Network Infrastructure Anomalies

Table 8. Anomaly detection in the SGI.

Scenario	Method/Technique	Objective
Network infrastructure anomalies	Construction of temporal events, Machine learning, GTP	Avoid device compromise
	Machine learning, AENN, RF	Detect time synchronization attack
	GN	Detect meter implant and network topology attacks
	SPN	Detect network topology attacks
	Pattern-based correlation capabilities, GAN	Identify anomalies in the communication protocols
	Spatiotemporal correlation, LWS, ReTAD	Detection of anomalies that are not cyber-attacks

displays an overview of the findings. Smart grid infrastructure (SGI) comprises all the tele-controlled elements, communications, sensors, hardware, and software that enable network communication and operation. Seven attack models are identified:

(a)

Implants of consumption devices;

(b)

Energy meter implants;

(c)

Black hole attacks;

(d)

Installation of malicious software;

(e)

Topology attacks;

(f)

Tampering with the resources of electronic devices: CPU, memory, operating systems, data, files, and configurations;

(g)

Exploitation of intrinsic weaknesses in communications protocols.

Regarding attack models (a), (b), (c), and (d), the pattern matching scheme to detect anomalous behaviors employing graph neuron (GN) as a decentralized pattern recognition algorithm that can form an associative memory structure by interconnecting the readings from SGI devices in a graph-like structure was one of the first proposals related to this field that could be identified in this area [15]. This is currently an interesting theoretical basis that can be strengthened by considering scenarios with attackers incorporating smart stealthy mechanisms in malicious devices implanted in the SG.

In electrical substations, avoiding the compromise of intelligent electronic devices (IED) and control circuit breakers is possible through early cyber intrusion detection algorithms based on the analysis of temporal events from which four malicious characteristics can be identified: intrusion attempts; change of the file system; change of the target system configuration; and change of the target system state [14]. This is an interesting knowledge base; it provides a baseline perspective of what is being targeted in the SG infrastructure, and it is now the basis on which more automatic and intelligent methods can be structured.

Monitoring CPU usage when it exceeds a predetermined threshold that could cause services to slow down, detecting RAM overload by setting a threshold on the maximum amount of usable memory, and keeping track of the number of concurrently active tasks on a machine can all support alerting of potentially compromised devices [64]. This type of monitoring has as input a large amount of log records generated by different heterogeneous devices connected in the network and could be improved by incorporating correlation and learning mechanisms.

Temporal event analysis can be useful and has been enhanced through automation supported by agent-based supervised learning. The learning process creates signatures based on the devices considered valid or true, ground-truth profile (GTP), allowing comparison and identification of potentially compromised devices [39].

Communication protocols are subject to cyber-attacks that can cause anomalies in the SG. The use of simple network management protocol (SNMP) configured in selected devices and correlation capabilities based on detection patterns allow for the recognition of anomalies in the network [17]. We are facing the advent of new-generation smart grids as the industry must assume solutions for increasingly heterogeneous and interconnected systems. New methods adopt DNN and GAN architectures to detect operational anomalies and classify Modbus/TCP and DNP3 cyber-attacks [58]. The combination of methods in this case shows better performance than the individual models of regression, SVM, random forest, MLP, and decision tree.

Global positioning system (GPS) is an indispensable device in SGs, but it can be compromised if an attacker is able to manipulate the timestamps by spoofing a GPS signal or manipulating the precision time protocol (PTP). This is a time synchronization attack (TSA) for which correlation analysis from historical data, unsupervised machine learning based on auto-encoder neural networks (AENN), and random forest (RF) as a supervised machine learning detector are useful [47]. The key to such solutions is the right combination of techniques in the context of attacks.

Topology attacks can be detected by using the stochastic petri net (SPN); this is a transition model that can describe system behaviors in the presence of topology attacks [33].

Not all anomalies in the SGI come from a cyber-attack; they can simply be disturbances whose origin is in the operating conditions. The spatiotemporal correlation to capture the characteristics of the anomaly inspired by the Ledoit–Wolf Shrinkage (LWS) method and real-time anomaly detection (ReTAD) algorithms allows the problem of the big volume of measurement data in anomaly detection to be overcome [20].

3.5. Electrical Data Anomalies

The treatment of problems in data collection about voltage, current, power quality, frequency, and phase angle are considered. A summary can be found in

Table 9. Electrical data anomalies.

Scenario	Method/Technique	Objective
Voltage drops in the electrical network	SVM, Decision Tree (C4.5)	Detect anomalies
Voltage/power anomalies	Comparison of values with established ranges, Fed-SCR
Anomalies from PMU	Unsupervised learning, HTM, MapReduce, Random matrix, isolation forest, K-Means, LoOP
Electrical load anomalies	Hyperdimensional Computing

.

Short-duration voltage sags and momentary current surges are studied using pattern recognition techniques to investigate the power signal and diagnose the voltage sag in the power grid using SVM and decision tree (DT). According to these analyses, the decision tree algorithm produces the best solution [23].

There are multiple approaches on the analysis of data coming from PMUs to detect anomalies in some of the measurements, for example: score-based detector arrays [43], hierarchical temporary memory (HTM) capable of unsupervised learning [54], application of big data tools (MapReduce) [45], random matrix theory, and new statistical models using massive data sets in the power grid [44]. In the case of HTM, a limitation is observed in not being able to classify anomalies based on the cause of the anomaly.

Machine learning is useful for the detection and classification of anomalous synchrophasor data by analyzing a selected window of data points using a combination of three unsupervised methods: isolation forest, K-means, and local outlier probability (LoOP) [65]. One interesting thing about this framework is that it does not require any training data, and experimentally, it has been observed that it can work with high accuracy in real time.

For power distribution systems, new AI techniques like hyperdimensional computing (HDC) are being used to find electrical load anomalies so that they do not have to rely on preprocessing and can focus on finding problems in real time [66]. Here, the experimental results showed better results than SVM, KNN, and LSTM, and the HDC approach works on raw data without preprocessing.

When there is not a lot of labeled data to work with, deep learning models that use federated learning and fog computing (Fed-SCR) get satisfactory results for finding power data that does not seem right [74].

3.6. Cyber-Attack Detection

There are behaviors of devices or data on the network that, compared to expected situations, can be classified as unusual, so it is important to know whether such behavior is a cyber-attack. The summary is in

Table 10. Cyber-attack detection.

Scenario	Method/Technique	Objective
The SG is the target of diverse types of cyber-attacks.	Real-time anomaly detection framework, unsupervised machine learning, Boltzmann machine, Dynamic Bayesian Networks, PRISM, Markov chains, and decision tree.	Identify and detect anomalies

.

Being able to differentiate a real failure from a disturbance and a smart cyber-attack is critical. Unsupervised anomaly detection employs the Boltzmann machine to detect unobservable attacks based on free energy as the anomaly index and resorts to dynamic Bayesian networks as probabilistic graphical models that can represent the system state as a set of variables [37]. This solution was evaluated considering that occasionally an interaction between sub-systems may occur that is not necessarily an attack, that random attacks exist, or that individual or simultaneous FDI attacks may occur.

Real-time monitoring and control in SGs are critical to improving reliability and operational efficiency; therefore, in real-time anomaly detection, it is important to take advantage of AMI technology and smart meter (SM) data. This information allows real-time anomaly detection by addressing three challenges: (1) large-scale multivariate count measurements; (2) missing points; and (3) variable selection. This is intended to diagnose, classify based on control limit policies, and evaluate consumer customer facilities [30].

If an attacker uses reinforcement learning, multi-criteria analysis comes into play for all types of attacks, from network engineering to physical, software, and even social engineering. This is what not only SG managers have to worry about but, in general, all ICPS. The severity of smart attacks in industrial cyber physical systems (SSA-ICPS) framework is an example of what can be applied in this scenario considering four components: (1) the user interface to interact within the tool kernel; (2) the model builder to create and compose the model of the system and the attacker; (3) the verification engine to verify and enforce the system in case of successful attacks; and (4) the library containing templates, attack models, and countermeasures, all supported by a probabilistic symbolic model checker (PRISM), discrete-time Markov chains, continuous-time Markov chains, and Markov decision trees [8].

3.7. Devices for Detecting Anomalies

Compact and affordable devices, such as the Raspberry Pi, have proven to be useful in identifying abnormalities in an SG by analyzing data collected from PMUs. These devices can detect two types of anomalies: (1) constraint anomalies, which refer to measured values that fall outside a predetermined acceptable range determined through heuristic methods, such as voltage or current; and (2) temporal anomalies, which refer to rapid oscillations or changes in measured values within a specific time frame [28].

The use of a single board computer (SBC) in a decentralized, heterogeneous architecture to keep the computational load at acceptable levels for lower-power chipsets demonstrates that anomalies can be detected at real-time speeds [31].

Big Data technologies and techniques are present in the detection of anomalies in electricity consumption based on Big Data analytical techniques and machine learning in industrial wireless sensors (IWSN) installed in the power grid. K-NN is employed in data mining and training [51].

The anomalies can range from harmless impedance changes at some network termination to pronounced electrical faults, also considering the degradation of physical components over time. Information about such anomalies in distribution networks can be collected using power line modems as network sensors to distinguish between localized faults, load impedance changes, and distributed faults [5].

The frequency of data collection in smart meters for early anomaly detection makes these devices increasingly relevant as specialized elements in detection [42].

4. Discussion

Research indicates that the operational components of a power management system are susceptible to many forms of abnormalities resulting from cyber-attacks, such as those affecting the topological database or device configuration, whether caused by unintentional or intentional alterations. When discussing anomalies, it is crucial to consider the harm or decay of materials and devices incorporated into the network, as well as weather conditions, and the network infrastructure.

This paper provides an initial classification of seven study objects related to SG anomalies that are amenable to AI-based methods or tools, such as distributed computing-capable devices that could give the network more intelligence. So, this classification is intended to be a contribution, and of course, it can be improved.

Each object of study describes multiple scenarios, each with different proposed solutions to detect anomalies of different natures; consequently, some solutions are not comparable. However, for each method or framework identified, we have tried to show, where possible, any weaknesses, opportunities for improvement, or alternatives against which they were evaluated.

This classification can be also a limitation of this work since it could be incomplete. We intend to improve and refine it in future works. Some papers are complex to place in one category or another as they analyze intersecting scenarios, such as unusual consumption behavior, data integrity attacks, and network intrusions.

The works reviewed address increasingly novel issues to propose optimal solutions, independent of the grid model and endowed with greater involvement of artificial intelligence, which is an evolution towards what could be called new-generation smart grids.

There are no definitive or unique anomaly detection solutions due to factors such as geographic location, installed infrastructure, and regulations. For this reason, the collection of reviewed works is a guiding reference on how to approach the study of diverse types of anomalies and can be a starting point for working to prevent anomalous behavior in SGs.

5. Conclusions

Cyber-attacks on the SGI will surely come from previous intrusions, so it is important to study how to detect a potential attack and the resulting anomalies proactively and intelligently from an intrusion.

The models proposed in the different studies reviewed give great emphasis to the use of machine learning, regression, decision trees, deep learning, support vector machines, and neural networks. Other proposals are presented in novel ways, such as federated learning, hyperdimensional computing, and graph-based methods. An increasingly visible challenge for the new models is to be able to detect anomalies by optimizing computational resources in less time, with less data, in real time, and independently of the network model.

In smart grids, experiments with synthetic data show that, compared to linear cases, nonlinear cases perform better in reducing the probability of false alarms related to anomalies.

Usually, it is about discovering malicious activities or violations of security policies through intrusion detection systems. The reviewed works show that we are evolving from signature databases to AI techniques to achieve the ability to detect new attacks starting from a referential network model, considering activities that are outside the normal model as anomalies and discriminating false positives.

There is a trend towards the formation of anomaly detection frameworks or hybrid solutions that consist of sets of various AI methods and tools combined to analyze the behavior of specific SG components.

In future work, we will go deeper into each object of study to refine it and show the evolution and trend. A further review could improve the list of study objects currently identified. In addition, the digital twins applied to SG in anomaly detection will be explored.