Anomaly detection in smart grids with imbalanced data methods

The research of anomaly-based intrusion detection within smart grids is a current topic and is investigated by many researchers. Thus, little experience is available on how to address the problem of detecting anomalies in smart grids. Another problem emerges when one tries to use common approaches of pattern recognition. As the data in such systems is typically highly imbalanced — there are many more normal instances than attack instances — there is often a high rate of misclassification when considering the attack, or minority class. In order to study this issue, this paper investigates the use of resampling techniques for intrusion detection inside of a hierarchical, three-layer smart grid communication system using a relatively new data set called ADFA-LD (this dataset includes contemporary attacks and is well-known for evaluating the performance of anomaly-based intrusion detection systems). Results compare the performance of typical and resampled techniques, demonstrating that the use of resampling leads to improved detection of attacks with a smart grid communication system.