Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000.

Digital Object Identifier 10.1109/ACCESS.2024.0429000

Artificial Intelligence and Physics-Based Anomaly

Detection in the Smart Grid: A Survey
GIOVANNI BATTISTA GAGGERO1 (Member, IEEE), PAOLA GIRDINIO1 AND MARIO MARCHESE1
(Senior Member, IEEE)
1
Department of Electrical, Electronics and Telecommunications Engineering and Naval Architecture—DITEN, University of Genoa, via Opera Pia 11A, 16145,
Genoa, Italy
Corresponding author: Giovanni Gaggero (e-mail: [email protected]).
This work was partially supported by project SERICS (PE00000014) under the MUR National Recovery and Resilience Plan funded by the
European Union - NextGenerationEU

ABSTRACT The integration of advanced communication systems and distributed resources has transformed
power systems, enhancing control and efficiency in the Smart Grid. However, this increased complexity
introduces new vulnerabilities, heightening risks of cyber-attacks, equipment failures, and other anomalies.
Effective anomaly detection methods are essential for ensuring grid stability and security. This survey
reviews anomaly detection techniques in the Smart Grid, emphasizing methods that combine Artificial
Intelligence and physics-based modeling. By systematically examining the current state of research, this
paper identifies key gaps and offers insights for advancing in this research field.

INDEX TERMS review, AI, smart grid, anomaly detection, physics-based anomaly detection

I. INTRODUCTION anomaly detection. [3] aims to organize the existing literature

on attack detection in power grids, offering a review and anal-
T HE rapid evolution of the Smart Grid, with its integra-
tion of advanced communication networks, distributed
energy resources, and demand-side management, has revolu-
ysis of research conducted over the past decade in the field of
anomaly and attack detection within this domain. In [4] the
tionized the way power systems are managed. However, this contribution of Intrusion Detection and Prevention Systems
complexity also introduces new vulnerabilities and increases within the Smart Grid is examined through an analysis of 37
the likelihood of anomalies, such as cyber-attacks, equipment case studies. To the best of our knowledge, this is the first
failures, and irregular grid behaviors. Identifying and mit- paper to tackle specifically the use of artificial intelligence
igating these anomalies is critical to ensuring the stability, for anomaly detection in the smart grid environment.
reliability, and security of the Smart Grid. Anomaly detection This paper presents a comprehensive survey of anomaly
has emerged as a vital tool in addressing these challenges, detection methods within the Smart Grid, with a particular
and recent advances in Artificial Intelligence and physics- focus on AI and physics-based techniques. The aim is to
based modeling have paved the way for more sophisticated assess the current state of research, identify gaps, and provide
detection techniques. While AI methods excel at identify- insights into the most effective methods for enhancing grid
ing patterns from large and complex datasets, physics-based security and reliability. To guide this investigation, we address
approaches address the core issue of mitigating the risk for three main research questions, as detailed below. By answer-
cyber-physical systems, that is to ensure the proper behavior ing these questions, this survey seeks to provide a detailed
of the physical infrastructure. The convergence of these two overview of the existing solutions, highlighting areas where
approaches holds great promise for improving the robustness further research is needed, and offer recommendations for
and scalability of anomaly detection in the Smart Grid envi- future advancements in the field.
ronment. The paper is structured as follows. Section II introduces the
Anomaly detection in the smart grid is gaining increas- topic of physics-based anomaly detection in the smart grid
ing attention from the research community. [1] presents an environment. Section III describes the methodology used to
overview of anomaly detection techniques in the Smart Grid, conduct this research, including the research questions, and
but the work lacks a systematic approach. [2] presents a the process of selection and processing of studies. Section
review of physics-informed machine-learning techniques for IV describes the selected studies by extracting some features

VOLUME 11, 2023 1

 Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

from them, in order to compare the employed methods and the A. RESEARCH QUESTIONS
obtained results. Section V presents the results of this study, We selected the following three main research questions to
by addressing the research questions previously proposed. set this survey.
Finally, in Section VI, conclusions are drawn.
• Q1: Which use cases have been investigated? Are there
potential research gaps?
II. ANOMALY DETECTION IN THE SMART GRID • Q2: How the proposed solutions have been tested? How
ENVIRONMENT many of them reach a high Technology Readiness Level
Physics-based anomaly detection in cyber-physical systems (at least TRL 5)?
involves using models rooted in the physical laws governing • Q3: Are there any AI methods that result to be particu-
the system to identify unusual or potentially malicious behav- larly suitable in the Smart Grid environment?
ior. In smart grids, these systems integrate numerous compo-
nents—such as sensors, actuators, and controllers—linked to Data extraction will be guided to these questions, as detailed
the physical power infrastructure, making them susceptible below.
to cyber threats that could disrupt electricity distribution or
damage infrastructure. Physics-based anomaly detection is B. SEARCH STRATEGY
especially relevant in smart grids because it allows operators The search strategy for this review was carefully designed
to detect deviations in grid behavior that contradict the under- to identify relevant literature on Artificial Intelligence-based
lying physics of power flow and load demand. By monitoring anomaly detection in the context of smart grids. To ensure a
physical parameters (e.g., voltage, frequency, and phase an- high standard of quality, only Scopus-indexed journals and
gles) and comparing them to expected patterns derived from conference proceedings were considered. This selection en-
physical laws, this approach can effectively identify issues sures that the review focuses on peer-reviewed, credible, and
that might go undetected in purely cyber-based anomaly widely recognized sources in the field.
detection systems. Such techniques enhance resilience by The search process employed a comprehensive set of key-
providing early warnings and helping to prevent cascading words aimed at capturing a broad spectrum of studies related
failures or malicious attacks in critical energy infrastructures. to both anomaly detection and smart grid applications. Key
[5] addresses the security of Edge layer devices in Cyber- terms included "Anomaly Detection," "Smart Grid," "Power
Physical Production Systems by proposing an Adaptive Host- System," "Artificial Intelligence," "Machine Learning," and
based Intrusion Detection System that analyzes OPC UA "Deep Learning." Various combinations of these terms were
network traffic commonly used in machine-to-machine com- used. This combination of keywords allowed for the inclu-
munication; it tackles the challenge of integrating security by sion of studies that span across multiple domains of AI and
design, emphasizing the importance of incorporating intru- smart grid technology, ensuring a wide-ranging review of the
sion detection capabilities during the CPPS design phase. [6] literature.
examines previous work on physics-based anomaly detection The search was limited to publications from 2014 to 2024.
using a unified taxonomy to pinpoint existing limitations and This time frame was selected to capture the most recent
uncover underexplored challenges. advancements in AI techniques, given the rapid pace of de-
Technological advancements have resulted in the creation velopment in machine learning and deep learning, as well as
of numerous cybersecurity monitoring tools. However, it re- their increasing application in the energy sector over the last
mains uncertain which specific monitoring technologies in- decade. Earlier studies were excluded to maintain a focus on
dustrial companies should adopt to meet their objectives and contemporary approaches that reflect the current state-of-the-
enhance their cybersecurity defenses. [7] introduces a frame- art in both AI and smart grid anomaly detection.
work designed for the optimal implementation of these tools
in industrial environments with a vendor-neutral approach C. SELECTION OF STUDIES
to evaluating technologies, and aligning with the leading
The screening process began with an evaluation of the titles
standards and frameworks established for industrial cyberse-
and abstracts of these studies. Each title and abstract were
curity. The paper highlights how a physics-based solution can
reviewed to determine whether they were coherent with the
help to respect the IEC 62443 security requirements in some
research questions, specifically focusing on the application of
specific use cases.
Artificial Intelligence in anomaly detection for smart grids.
Studies were included if their titles and abstracts indicated
III. METHODOLOGY
a clear focus on AI techniques, such as machine learning
The aim of the paper is not only to survey existing literature or deep learning, being applied to detect anomalies in smart
on the topic, but especially to extract useful information for grid or power system environments. Papers that mentioned
the improvement of research. This section details the main alternative fields or unrelated AI applications were excluded
research questions that guided this survey and the process of at this stage, even if they contained relevant keywords, as they
selecting and extracting information from the literature. did not align with the review’s core objective of exploring AI-
driven anomaly detection in the context of smart grids.
2 VOLUME 11, 2023
Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

Once the initial screening of titles and abstracts was com- IV. LITERATURE REVIEW
plete, the full texts of the selected studies were reviewed to A resume of all the papers that has been selected is provided
assess their relevance more thoroughly. in Table 1
Inclusion and exclusion criteria were applied to further Column “Use Case” distinguishes some categories of
refine the selection of studies. Only studies that demonstrated power infrastructures on which the algorithms have been
the reproducibility of results were included, ensuring that the tested. We categorized the various works in:
methods described could be validated or replicated in future • Distribution Grids (DG): the algorithm make use of
research. Additionally, articles were required to provide a electrical parameters extracted from distribution grids,
clear explanation of the algorithm or methodology used, to both Low and Medium Voltage. The parameters are
allow for an in-depth understanding of how AI techniques generically extracted from the system, for example from
were applied to detect anomalies in the smart grid. Another a SCADA, or also not specified in the paper.
important criterion was the demonstration of reasonable per- • Distributed Energy Resources (DERs): the use case is
formance in relation to the specific use cases described. Stud- represented by small or medium-size generators con-
ies that lacked performance metrics or failed to show how the nected to the distribution grid, both in Low or Medium
AI models were effective in detecting anomalies in real or Voltage. The parameters extracted are electrical mea-
simulated smart grid environments were excluded. sures or measures related to the main energy source
(such as Photovoltaic Systems, Storage etc.)
D. DATA EXTRACTION • Phasor Measurement Units (PMU): the electrical pa-
Four main categories were used for organizing the extracted rameters are the ones that can be collected by PMUs
data: use case scenario, validation method, algorithm cate- deployed in trasmission od distribution power grids.
gory, and performance metrics. • Generators: the parameters are extracted from a big-size
The use case scenario category focused on the specific generator; they comprehend both elecrical measures and
application areas within the smart grid where the AI-based measures related to the main energy source (such as
anomaly detection methods were deployed. This included hydro-power plants, wind turbines etc)
scenarios such as Distributed Energy Resources (DERs), • Flexible Alternated Current Transmission Systems
where the detection of anomalies in distributed generation (FACTS): are a group of resources used to overcome
systems like solar panels or wind turbines was a key focus. certain limitations in the static and dynamic transmission
Another frequent use case was the detection of anomalies in capacity of electrical networks incorporating power-
devices within the distribution grid, such as transformers and electronics-based and other static controllers. The pa-
power lines. Another example is the use of anomaly detection rameters are extracted from the power converter.
for Internet of Things (IoT) devices within the grid, recogniz- • Wide Area Monitoring Control and Protection (WAMPAC):
ing the increasing role of IoT in modern energy systems. consists of various combinations of sensing devices,
For each study, the validation method was also docu- such as Intelligent Electronic Devices (IEDs), sources
mented. This included whether the anomaly detection meth- for a high precision time synchronization reference,
ods were validated in a real-world environment, using actual various phasor data concentrators, communications, ap-
operational data from a smart grid, or in a simulated or em- plications, and visualization tools for data presentation.
ulated environment where models were tested in controlled • Microgrid: the parameters are extracted from the con-
conditions. In some cases, the studies relied on datasets, either troller of the system, such as a SCADA.
publicly available or proprietary, to test the performance of • Electric Vehicle Charging Systems (EVCS): the param-
the AI algorithms. This information was crucial to assess the eters are extracted from the power controllers and/or the
TRL of the solutions. Energy Management System.
The next category, algorithm category, involved classifying Column “validation” distinguishes the way the algorithms
the AI techniques used for anomaly detection. Studies were have been tested. We used three main categories:
grouped based on whether they employed traditional machine
• Dataset: in this case, the performances are computed
learning algorithms, such as decision trees, support vector
offline by using a dataset, both in case the data comes
machines, or random forests, or more advanced deep learning
from a simulated environment or real scenarios.
models, including convolutional neural networks (CNNs),
• Simulation Environment (SE): in this case, the classifier
recurrent neural networks (RNNs), or hybrid models that
runs online by using a simulation/emulation environ-
combine various AI techniques. This categorization helped
ment.
in comparing the effectiveness of different AI approaches in
• Real Environment (RE): in this case, the classifier runs
identifying anomalies across various smart grid scenarios.
online on a real working infrastructure.
Finally, the performance of each anomaly detection method
was extracted and compared using relevant metrics. Common
performance indicators included accuracy, precision, recall,
and F1 score, with some studies providing additional metrics
such as false positive rate or computational efficiency.
VOLUME 11, 2023 3
 Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

Reference Title Use Case Validation Algorithms Performances

[8] Detecting Stealthy False Data Injection Using Ma- DG Dataset ML Low
chine Learning in Smart Grid
[9] Contextual anomaly detection for cyber-physical DER Dataset DL Low
security in smart grids based on an artificial neural
network model
[10] Ensemble Regression Model-Based Anomaly De- DER Dataset DL Low
tection for Cyber-Physical Intrusion Detection in
Smart Grids
[11] Catching Anomalous Distributed Photovoltaics: DER Dataset ML Low
An Edge-based Multi-modal Anomaly Detection
[12] Real-Time Cyber-Physical False Data Attack De- DG Dataset DL Medium
tection in Smart Grids Using Neural Networks
[13] Physics-Based Features for Anomaly Detection in DG Dataset ML Low
Power Grids with Micro-PMUs
[14] Ensemble-Based Algorithm for Synchrophasor PMU Dataset ML Low
Data Anomaly Detection
[15] Data-driven Physics-based Solution for False Data DG Dataset ML Low
Injection Diagnosis in Smart Grids
[16] A Deep and Scalable Unsupervised Machine DG Dataset ML Low
Learning System for Cyber-Attack Detection in
Large-Scale Smart Grids
[17] Unsupervised Machine Learning-Based Detection DG Dataset ML Low
of Covert Data Integrity Assault in Smart Grid
Networks Utilizing Isolation Forest
[18] Anomaly detection and mitigation for wide-area PMU Dataset ML Low
damping control using machine learning
[19] Hybrid data-driven physics model-based frame- DG Dataset ML Low
work for enhanced cyber-physical smart grid se-
curity
[20] Detecting stealthy false data injection attacks in the DG Dataset ML Low
smart grid using ensemble-based machine learning
[21] Detecting system fault/cyberattack within a pho- DER Dataset DL – Au- Low
tovoltaic system connected to the grid: A neural toencoder
network-based solution
[22] Anomaly Detection in Smart Grids using Machine Generator Dataset ML N/A
Learning. (generic)
[23] Smart Grid Anomaly Detection using a Deep DG Dataset DL – Low
Learning Digital Twin CNN
[24] Detecting Cyber Attacks in Smart Grids Using PMU Dataset ML Low
Semi-Supervised Anomaly Detection and Deep
Representation Learning
[25] The Virtualized Cyber-Physical Testbed for Ma- Generator SE ML High
chine Learning Anomaly Detection: A Wind Pow- (Wind)
ered Grid Case Study
[26] Real-time Anomaly Detection and Classification PMU Dataset DL Low
in Streaming PMU Data
[27] Deep neural networks for electric energy theft and DG Dataset DL – Medium
anomaly detection in the distribution grid LSTM
[28] Physics Guided Data-Driven Characterization of DER Dataset DL Low
Anomalies in Power Electronic Systems

4 VOLUME 11, 2023

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[29] Deep Autoencoder-Based Anomaly Detection of AMI Dataset DL – Low

Electricity Theft Cyberattacks in Smart Grids LSTM –
Autoen-
coder
[30] Machine learning-based cyber-physical anomaly FACTS Dataset ML High
detection in wide area voltage control ystems
[31] Machine Learning-Based and Physics-Based At- WAMPAC SE ML Low
tack Resilient Wide-Area Monitoring, Protection
and Control Systems
[32] Data-Driven Detection of Stealth Cyber-Attacks in Microgrid Dataset DL – Low
DC Microgrids LSTM –
Autoen-
coder
[33] Noise Resilient Learning for Attack Detection in PMU Dataset ML Low
Smart Grid PMU Infrastructure
[34] Detecting cyberattacks on electrical storage sys- DER Dataset DL – Au- Low
tems through neural network based anomaly de- toencoder
tection algorithm
[35] DynamoPMU: A Physics Informed Anomaly De- PMU Dataset ML Medium
tection, Clustering, and Prediction Method Using
Nonlinear Dynamics on µPMUMeasurements
[36] Physical Anomaly Detection in EV Charging Sta- EVCS SE DL – Au- Low
tions: Physics-based vs ResNet AE toencoder
[37] Time Sequence Machine Learning-Based Data Generator Dataset DL Low
Intrusion Detection for Smart Voltage Source (Wind)
Converter-Enabled Power Grid
[38] ETD-ConvLSTM: A Deep Learning Approach for DG Dataset DL – High
Electricity Theft Detection in Smart Grids CNN
LSTM
[39] Anomaly detection in smart grid using optimized DG Dataset ML Low
extreme gradient boosting with SCADA system
[40] Anomaly-detection-based learning for real-time DG Dataset DL – Low
data processing in non-intrusive load monitoring LSTM
[41] Cy-Phy ADS: Cyber Physical Anomaly Detection EVCS SE DL – Au- Low
Framework for EV Charging Systems toencoder
[42] Anomaly Detection Using Bi-Directional Long EVCS Dataset DL – Medium
Short-Term Memory Networks for Cyber-Physical LSTM
Electric Vehicle Charging Stations
[43] Multivariate Physics-Informed Convolutional Au- DG Dataset DL – High
toencoder for Anomaly Detection in Power Distri- CNN –
bution Systems with High Penetration of DERs PINN -
Autoen-
coder
TABLE 1: Caption

VOLUME 11, 2023 5

 Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

Column “algorithm” classifies the methods used in two still to be investigated, especially in the case of coordinated
main classes. Traditional Machine Learning (ML) ap- DERs, such as Virtual Power Plants.
proaches, which comprehend all the classical supervised,
unsupervised or seemi-supervised approaches, such as Sup-
port Vector Machine, Clustering, Isolation Forest, etc. Deep
Learning (DL) approaches, which make use of artificial neu-
ral networks. In this case, we also specified if some specific
type of neural network has been used, such as Convolu-
tional Neural Networks (CNN) or Long Short Term Memory
(LSTM), Physics Informed Neural Networks (PINN), and if
some specific architecture has been employed (for example
autoencoder).
Column “performances” classifies the wide range of results
into three main classes:
FIGURE 2. Pie chart of use-cases
• Low: if the most significant metric is below 99%
• Medium: if the most significant metric is between 99%
The main limitations of these works are the performances,
and 99.9%
as detailed in the next section.
• High: if the most significant metric is higher than 99.9%
Where the most significant metrics are extracted by using B. Q2
the following specifications, in order of priority: overall ac- How the proposed solutions have been tested? How many of
curacy of the most performing method, mean of accuracies them reach a high Technology Readiness Level (at least TRL
of the most performing methods across different investigated 5)?
sub-cases, overall metrics if accuracy cannot be computed (F1 Technology Readiness Level (TRL) is a scale for estimating
score, FP rate). If there is no performance evaluation in terms the maturity of technologies. TRL 4 corresponds to "Technol-
of common Machine Learning metrics, “N/A” is applied. ogy validated in lab", while TRL 5 corresponds to "Technol-
ogy validated in relevant environment (industrially relevant
V. RESULTS environment in the case of key enabling technologies)". Fig-
A. Q1 ure 3 shows the distribution of published papers by methods
Which use cases have been investigated? Are there potential of validation. It can be noticed how the vast majority of
research gaps? algorithms validate the proposed approach offline by using
The first consideration that can be done by analyzing the datasets. Few of them have been tested online in a simulation
publication year of Tab 1 is that the research interest is still environment, while none of them have been tested in a real
increasing. Figure 1 shows the number of publications per use-case scenario.
year and a linear trend of them. This suggests that the topic
will be increasingly investigated by the research community
in the next few years.

FIGURE 3. Pie chart of validation methods

FIGURE 1. Number of papers per year and trend The main limitation of the state-of-the-art stand resides
in the performances of the algorithms. In anomaly detection
Figure 2 shows the distribution of published papers by use- for cyber-physical systems, a very low false positive rate
case. We can see how the most common use case is related to is critical because each false alarm can trigger unnecessary
distribution grids or PMUs, due to the legacy of interest in responses, resulting in operational disruptions, wasted re-
power system state estimation. Also, DERs represent a big sources, and loss of trust in the detection system. Frequent
chunk of work. Recent papers are focusing on innovative sys- false positives can cause operators to become desensitized to
tems, such as EVCS; several novel control architectures have alerts, potentially ignoring genuine threats when they arise.
6 VOLUME 11, 2023
Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

Moreover, in critical infrastructure, repeated false alarms complex DL models is not necessary for certain patterns of
could lead to costly shutdowns or interventions that affect data, and therefore they do not outperform traditional ML;
system stability and customer service, making reliability in also this hypothesis must be taken into account by researchers
anomaly detection essential for maintaining safe, efficient, in future works.
and continuous operations. For these reasons, the accuracy
can be considered "high" only if metrics such as accuracy VI. CONCLUSIONS
are far behind 99.9%. Figure 4 shows the distribution of pub- This survey has examined the landscape of anomaly detec-
lished papers by performances. It can be noticed how the vast tion techniques in the Smart Grid, with a specific focus on
majority of algorithms have relatively low performances, few methods combining Artificial Intelligence and physics-based
of them have medium performances, while a small minority monitoring. Our review reveals that while AI approaches
present high performances. provide substantial flexibility and adaptability in identifying
complex patterns, the technology is still in an early stage.
The convergence of AI and physics-based techniques holds
significant potential for advancing Smart Grid anomaly de-
tection, offering improved accuracy and resilience against
increasingly sophisticated threats.
Our findings highlight several gaps in the existing liter-
ature, including limited real-world testing, and challenges
in achieving extremely low false positive rates—crucial for
minimizing disruptions in the grid’s operation. Future re-
search should prioritize the development of approaches that
capitalize on the strengths of both AI and physics-based
models, incorporating real-world data and addressing the
FIGURE 4. Pie chart of performances level issue of usability for human operators. By addressing these
challenges, future advancements in this field can strengthen
From the previous consideration, we can see how almost grid reliability, providing a more secure and stable power
all papers present a low TRL. There is a strong need to system.
further improve the research in both directions: from one side,
the performances must increase to a point while the systems REFERENCES
produce few alarms per day, in order to allow human operators [1] S. Banik, S. K. Saha, T. Banik, and S. M. Hossain, ‘‘Anomaly detection
techniques in smart grid systems: A review,’’ in 2023 IEEE World AI IoT
to analyze them; also, there is the need to test them online in Congress (AIIoT). IEEE, 2023, pp. 0331–0337.
real scenarios, to assess the effectiveness of the approaches in [2] M. J. Zideh, P. Chatterjee, and A. K. Srivastava, ‘‘Physics-informed ma-
mitigating the risk and allowing proper responses. chine learning for data anomaly detection, classification, localization, and
mitigation: A review, challenges, and path forward,’’ IEEE Access, 2023.
[3] S. Madabhushi and R. Dewri, ‘‘A survey of anomaly detection methods for
C. Q3 power grids,’’ International Journal of Information Security, vol. 22, no. 6,
Are there any AI methods that result to be particularly suit- pp. 1799–1832, 2023.
[4] P. I. Radoglou-Grammatikis and P. G. Sarigiannidis, ‘‘Securing the smart
able in the Smart Grid environment? grid: A comprehensive compilation of intrusion detection and prevention
While several papers directly compare the performances systems,’’ Ieee Access, vol. 7, pp. 46 595–46 620, 2019.
of traditional ML techniques against advanced DL models, [5] R. Pinto, G. Gonçalves, J. Delsing, and E. Tovar, ‘‘Enabling data-driven
anomaly detection by design in cyber-physical production systems,’’ Cy-
showing significantly higher performances of DL models, it bersecurity, vol. 5, no. 1, p. 9, 2022.
can be noticed from Table 1 that there is no strong evidence [6] J. Giraldo, D. Urbina, A. Cardenas, J. Valente, M. Faisal, J. Ruths, N. O.
that the performances of the papers are increasing over time. Tippenhauer, H. Sandberg, and R. Candell, ‘‘A survey of physics-based
attack detection in cyber-physical systems,’’ ACM Computing Surveys
This can have multiple reasons. From one side, it is possible (CSUR), vol. 51, no. 4, pp. 1–36, 2018.
that DL models are enabling anomaly detection techniques on [7] A. Armellin, R. Caviglia, G. Gaggero, and M. Marchese, ‘‘A framework
more complex data; in this sense, there would be a significant for the deployment of cybersecurity monitoring tools in the industrial
environment,’’ IT Professional, vol. 26, no. 4, pp. 62–70, 2024.
improvement brought by DL models. Also, it is possible [8] M. Esmalifalak, L. Liu, N. Nguyen, R. Zheng, and Z. Han, ‘‘Detecting
that this is due to a "bias" of researchers who, considering stealthy false data injection using machine learning in smart grid,’’ IEEE
performances around 99% as good results, simply create more Systems Journal, vol. 11, no. 3, pp. 1644–1652, 2014.
[9] A. M. Kosek, ‘‘Contextual anomaly detection for cyber-physical security
challenging data to check the performances of the algorithms. in smart grids based on an artificial neural network model,’’ in 2016 joint
Nevertheless, this approach strongly limits the advancement workshop on cyber-physical security and resilience in smart grids (CPSR-
of the research, while it would be very important to show SG). IEEE, 2016, pp. 1–6.
[10] A. M. Kosek and O. Gehrke, ‘‘Ensemble regression model-based anomaly
a very low FP rate in a real use-case scenario: in fact, in a detection for cyber-physical intrusion detection in smart grids,’’ in 2016
real environment, the FP rate should remain far below 0.01%, IEEE Electrical Power and Energy Conference (EPEC). IEEE, 2016, pp.
since every alarm should be verified by a proper engineer, and 1–7.
[11] D. M. Shilay, K. G. Lorey, T. Weiz, T. Lovetty, and Y. Cheng, ‘‘Catching
if the number of alarms grows too much, the system becomes anomalous distributed photovoltaics: An edge-based multi-modal anomaly
practically unusable. Finally, it is possible that the choice of detection,’’ arXiv preprint arXiv:1709.08830, 2017.

VOLUME 11, 2023 7

 Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

[12] E. M. Ferragut, J. Laska, M. M. Olama, and O. Ozmen, ‘‘Real-time cyber- tems,’’ in Security and Resilience of Control Systems: Theory and Applica-
physical false data attack detection in smart grids using neural networks,’’ tions. Springer, 2022, pp. 203–224.
in 2017 International Conference on Computational Science and Compu- [32] A. Takiddin, S. Rath, M. Ismail, and S. Sahoo, ‘‘Data-driven detection of
tational Intelligence (CSCI). IEEE, 2017, pp. 1–6. stealth cyber-attacks in dc microgrids,’’ IEEE systems Journal, vol. 16,
[13] M. El Chamie, K. G. Lore, D. M. Shila, and A. Surana, ‘‘Physics-based no. 4, pp. 6097–6106, 2022.
features for anomaly detection in power grids with micro-pmus,’’ in 2018 [33] P. Roy, S. Bhattacharjee, S. Abedzadeh, and S. K. Das, ‘‘Noise resilient
IEEE International Conference on Communications (ICC). IEEE, 2018, learning for attack detection in smart grid pmu infrastructure,’’ IEEE
pp. 1–7. Transactions on Dependable and Secure Computing, vol. 21, no. 2, pp.
[14] M. Zhou, Y. Wang, A. K. Srivastava, Y. Wu, and P. Banerjee, ‘‘Ensemble- 618–635, 2022.
based algorithm for synchrophasor data anomaly detection,’’ IEEE Trans- [34] G. B. Gaggero, R. Caviglia, A. Armellin, M. Rossi, P. Girdinio, and
actions on Smart Grid, vol. 10, no. 3, pp. 2979–2988, 2018. M. Marchese, ‘‘Detecting cyberattacks on electrical storage systems
[15] R. D. Trevizan, C. Ruben, K. Nagaraj, L. L. Ibukun, A. C. Starke, A. S. through neural network based anomaly detection algorithm,’’ Sensors,
Bretas, J. McNair, and A. Zare, ‘‘Data-driven physics-based solution for vol. 22, no. 10, p. 3933, 2022.
false data injection diagnosis in smart grids,’’ in 2019 IEEE Power & [35] D. Dwivedi, P. K. Yemula, and M. Pal, ‘‘Dynamopmu: A physics informed
Energy Society General Meeting (PESGM). IEEE, 2019, pp. 1–5. anomaly detection, clustering and prediction method using non-linear dy-
[16] H. Karimipour, A. Dehghantanha, R. M. Parizi, K.-K. R. Choo, and namics on µpmu measurements,’’ IEEE Transactions on Instrumentation
H. Leung, ‘‘A deep and scalable unsupervised machine learning system and Measurement, 2023.
for cyber-attack detection in large-scale smart grids,’’ Ieee Access, vol. 7, [36] H. S. Mavikumbure, V. Cobilean, C. S. Wickramasinghe, T. Phillips, B. J.
pp. 80 778–80 788, 2019. Varghese, B. Carlson, C. Rieger, T. Pennington, and M. Manic, ‘‘Physical
[17] S. Ahmed, Y. Lee, S.-H. Hyun, and I. Koo, ‘‘Unsupervised machine anomaly detection in ev charging stations: Physics-based vs resnet ae,’’ in
learning-based detection of covert data integrity assault in smart grid 2023 IEEE 32nd International Symposium on Industrial Electronics (ISIE).
networks utilizing isolation forest,’’ IEEE Transactions on Information IEEE, 2023, pp. 1–7.
Forensics and Security, vol. 14, no. 10, pp. 2765–2777, 2019. [37] M. A. H. Sadi, D. Zhao, T. Hong, and M. H. Ali, ‘‘Time sequence machine
[18] G. Ravikumar and M. Govindarasu, ‘‘Anomaly detection and mitigation for learning-based data intrusion detection for smart voltage source converter-
wide-area damping control using machine learning,’’ IEEE Transactions on enabled power grid,’’ IEEE Systems Journal, vol. 17, no. 2, pp. 2477–2488,
Smart Grid, 2020. 2022.
[19] C. Ruben, S. Dhulipala, K. Nagaraj, S. Zou, A. Starke, A. Bretas, A. Zare, [38] X. Xia, J. Lin, Q. Jia, X. Wang, C. Ma, J. Cui, and W. Liang, ‘‘Etd-convlstm:
and J. McNair, ‘‘Hybrid data-driven physics model-based framework for A deep learning approach for electricity theft detection in smart grids,’’
enhanced cyber-physical smart grid security,’’ IET Smart Grid, vol. 3, no. 4, IEEE Transactions on Information Forensics and Security, vol. 18, pp.
pp. 445–453, 2020. 2553–2568, 2023.
[20] M. Ashrafuzzaman, S. Das, Y. Chakhchoukh, S. Shiva, and F. T. Sheldon, [39] A. Sharma and R. Tiwari, ‘‘Anomaly detection in smart grid using op-
‘‘Detecting stealthy false data injection attacks in the smart grid using timized extreme gradient boosting with scada system,’’ Electric Power
ensemble-based machine learning,’’ Computers & Security, vol. 97, p. Systems Research, vol. 235, p. 110876, 2024.
101994, 2020. [40] Z. Chen, Z. Y. Dong, and Y. Xu, ‘‘Anomaly-detection-based learning
[21] G. B. Gaggero, M. Rossi, P. Girdinio, and M. Marchese, ‘‘Detecting system for real-time data processing in non-intrusive load monitoring,’’ Energy
fault/cyberattack within a photovoltaic system connected to the grid: A Conversion and Economics, vol. 5, no. 3, pp. 146–155, 2024.
neural network-based solution,’’ Journal of Sensor and Actuator Networks, [41] H. S. Mavikumbure, V. Cobilean, C. S. Wickramasinghe, B. J. Varghese,
vol. 9, no. 2, p. 20, 2020. B. Carlson, C. Rieger, T. Pennington, and M. Manic, ‘‘Cy-phy ads: Cyber
[22] P. K. R. Shabad, A. Alrashide, and O. Mohammed, ‘‘Anomaly detection physical anomaly detection framework for ev charging systems,’’ IEEE
in smart grids using machine learning,’’ in IECON 2021–47th Annual Transactions on Transportation Electrification, 2024.
Conference of the IEEE Industrial Electronics Society. IEEE, 2021, pp. [42] A. Hussain, A. Yadav, and G. Ravikumar, ‘‘Anomaly detection using
1–8. bi-directional long short-term memory networks for cyber-physical elec-
[23] W. Danilczyk, Y. L. Sun, and H. He, ‘‘Smart grid anomaly detection tric vehicle charging stations,’’ IEEE Transactions on Industrial Cyber-
using a deep learning digital twin,’’ in 2020 52nd North American Power Physical Systems, 2024.
Symposium (NAPS). IEEE, 2021, pp. 1–6. [43] M. J. Zideh and S. K. Solanki, ‘‘Multivariate physics-informed convolu-
[24] R. Qi, C. Rasband, J. Zheng, and R. Longoria, ‘‘Detecting cyber attacks in tional autoencoder for anomaly detection in power distribution systems
smart grids using semi-supervised anomaly detection and deep representa- with high penetration of ders,’’ arXiv preprint arXiv:2406.02927, 2024.
tion learning,’’ Information, vol. 12, no. 8, p. 328, 2021.
[25] D. L. Marino, C. S. Wickramasinghe, V. K. Singh, J. Gentle, C. Rieger, and
M. Manic, ‘‘The virtualized cyber-physical testbed for machine learning
anomaly detection: A wind powered grid case study,’’ IEEE Access, vol. 9,
pp. 159 475–159 494, 2021.
[26] C. Hannon, D. Deka, D. Jin, M. Vuffray, and A. Y. Lokhov, ‘‘Real-time
anomaly detection and classification in streaming pmu data,’’ in 2021 IEEE
Madrid PowerTech. IEEE, 2021, pp. 1–6.
[27] A. Ceschini, A. Rosato, F. Succetti, F. Di Luzio, M. Mitolo, R. Araneo, and
M. Panella, ‘‘Deep neural networks for electric energy theft and anomaly
detection in the distribution grid,’’ in 2021 IEEE International Conference GIOVANNI GAGGERO (S’19–M’22) is currently
on Environment and Electrical Engineering and 2021 IEEE Industrial and Assistant Professor at the Satellite Communica-
Commercial Power Systems Europe (EEEIC/I&CPS Europe). IEEE, tions and Heterogeneous Networking Laboratory
2021, pp. 1–5. at the University of Genoa. He is also CEO of
[28] K. Bhatnagar, S. Sahoo, F. Iov, and F. Blaabjerg, ‘‘Physics guided data- the spinoff of university of Genova AIrFIELD
driven characterization of anomalies in power electronic systems,’’ in 2021 Security srl. He got his MSc degree in electrical
6th IEEE Workshop on the Electronic Grid (eGRID). IEEE, 2021, pp. 01– engineering and his Ph.D. degree in Electronic and
06. Telecommunication engineering at the University
[29] A. Takiddin, M. Ismail, U. Zafar, and E. Serpedin, ‘‘Deep autoencoder- of Genoa. His main research activity concerns
based anomaly detection of electricity theft cyberattacks in smart grids,’’ Network Security of Industrial Control Systems,
IEEE Systems Journal, vol. 16, no. 3, pp. 4106–4117, 2022.
Microgrids, and Smart Grids.
[30] B. Hyder, V. K. Singh, M. Govindarasu, and R. Nuqui, ‘‘Machine learning-
based cyber-physical anomaly detection in wide area voltage control sys-
tems,’’ in 2022 IEEE Power & Energy Society Innovative Smart Grid
Technologies Conference (ISGT). IEEE, 2022, pp. 1–5.
[31] G. Ravikumar and M. Govindarasu, ‘‘Machine learning-based and physics-
based attack resilient wide-area monitoring, protection and control sys-

8 VOLUME 11, 2023

Author et al.: Preparation of Papers for IEEE TRANSACTIONS and JOURNALS

PAOLA GIRDINIO Full Professor of Electrotech-

nics at the Faculty of Engineering, University of
Genoa, where she was formerly Dean of the Fac-
ulty, is currently Chair of the Center of Compe-
tence for Security and Optimization of Strategic
Infrastructure 4.0 (Start 4.0). She has served as
a board member of ENEL, the Costa Crociere
Foundation, Ansaldo STS, Banca Carige, Ansaldo
Energia, D’Appolonia (RINA Group) and the Uni-
versity of Genoa. She is also a member of the board
of directors of Ansaldo Energia, WSENSE of the scientific committee of the
Eurispes Security Observatory, a member of the technical committee of the
AZIMU infrastructure fund, and was selected in the 2018 European awards
short list BCI. For her commitment in academic and professional spheres, she
was included in the roll of experts in technological innovation established by
the Italian Ministry of Economic Development.

MARIO MARCHESE (S’94–M’97–SM’04) got

his "Laurea" degree cum laude in 1992 and his
Ph.D. degree in "Telecommunications" at the Uni-
versity of Genoa in 1997. From 1999 to January
2005, he worked with the Italian Consortium of
Telecommunications (CNIT) where he was Head
of Research. From February 2005 to January 2016
he was Associate Professor and since February
2016 he has been Full Professor at the University of
Genoa where, since December 2020, he has been
Rector’s Delegate to Doctoral Studies. He is the author of the book “Quality
of Service over Heterogeneous Networks”, John Wiley Sons, Chichester,
2007, and author/co-author of more than 300 scientific works, including
international magazines, international conferences and book chapters. The
most important contribution of Mario Marchese’s scientific activity is in
the field of: Networking, Quality of Service over Heterogeneous Networks,
Software-Defined Networking, Satellite Networks, Network Security, Criti-
cal Infrastructure Security and Intrusion Detection Systems.

VOLUME 11, 2023 9