Detecting Electricity Theft Cyber-Attacks in AMI Networks Using Deep Vector Embeddings

Despite being equipped with advanced metering infrastructure (AMI), utility companies are subjected to electricity theft cyber-attacks. The existing machine learning-based detectors do not capture well the complex patterns and the temporal correlation present in the time-series profile of energy consumption data. This article proposes a deep recurrent vector embedding model to identify electricity theft cyber-attacks. Vector embedding is a data representation method that we use to express energy consumption profiles as vectors of real numbers. Since the reported electricity readings may be benign or malicious, vector embedding algorithms help in analyzing the relationships and capturing the patterns within the customer's reported readings. Furthermore, our model captures well the time-series nature of the data due to the adoption of gated recurrent units. We implement a sequential grid-search hyperparameter optimization algorithm to further improve the models detection performance. We test our model against two real datasets of benign and malicious readings. Results are \text{95.8}\% in detection rate (DR), \text{2.1}\% in false alarm (FA), and \text{93.7}\% in highest difference (HD). Our model outperforms shallow detectors by \text{3.5\%--9.7\%} in DR, \text{3.1\%--10\%} in FA, and \text{8.7\%--21.8\%} in HD. It also outperforms deep detectors by \text{1.5\%--3.2\%} in DR, \text{2\%--4.3\%} in FA, and \text{5.6\%--9.6\%} in HD.