A Comparative Evaluation of Machine Learning Architectures for Detecting Attacks on Smart Meter Data

Companies in the electrical sector are responsible for the production, transport, distribution, and management of thousands or even millions of simultaneous users. Smart meters have improved user consumption monitoring by enabling the automatic collection of data. However, they also increase the risk of data tampering. This paper proposes detection methods for various subtle attack types aimed at reducing apparent consumption and monthly bills through illicit actions, such as altering consumption values before they are sent to the company. The proposal only relies on energy consumption time series (without assuming the availability of personal and socioeconomic data). On this data, a multiclass detector based on XGBoost is compared in performance with two variants of a two-stage detection architecture, which first apply either a classifier or a clustering method (K-Means) to rate the presence of any type of attack, to then perform attack type identification in a second stage. Detection rates exceeding 80% with a low false positive rate were achieved using the two-stage clustering plus classification detector on the subtle collection of attacks proposed.