1
EnThM: Energy Theft Mitigation in Smart Grids using Hierarchical Verification of Metering Data
arXiv:2605.24951v1 [cs.CR] 24 May 2026
Tapadyoti Banerjee, Pabitra Mitra, Senior Member, IEEE, and Dipanwita Roy Chowdhury, Senior Member, IEEE
Abstract—The advent of digital technologies has revolutionized traditional power distribution networks, transforming them into smart grids that are more reliable, efficient, and sustainable. Despite these advancements, electricity theft remains a significant threat to the effective operation of large electrical networks. To address this issue, we propose EnThM, a lightweight and communication-efficient scheme for real-time mitigation of power theft in smart grid systems. Our approach uses the hierarchical structure of the smart grid infrastructure to verify the authenticity of the metering data at multiple levels of the power distribution network. Our work focuses primarily on issues related to cryptographic security. The verification process involves statistically modeling the cumulative averages of the power usage data and applying rule-based checks on the aggregated power consumption at each level, while accounting for seasonal and daily consumption variations. The proposed method has been tested on benchmark consumption data, yielding high accuracy, efficient implementation, and real-time applicability. Index Terms—Authentication, Power Theft, Smart Grid, Smart Meter.
I. I NTRODUCTION Cybersecurity aims to protect systems, networks, and data from cyber threats. As cyberattacks continue to rise worldwide, securing digital systems has become a top priority. Check Point’s 2025 Cyber Security Report [1] indicates that the average number of weekly cyberattacks on enterprises reached 1673, a 44% increase over the previous year. This surge is driven by expanding digital footprints and an increasingly sophisticated cybercrime network. Organizations now face advanced, coordinated attacks as well as large-scale social engineering campaigns. Therefore, neglecting cybersecurity can lead to severe consequences, including financial losses, reputational damage, and regulatory penalties. Cybersecurity encompasses multiple domains, including AI security, application security, cloud security, network security, endpoint security, mobile security, information security, and critical infrastructure security. Among these, critical infrastructure security is particularly important because of its direct impact on public safety, economic stability, and national security. Disruptions to critical infrastructure can have far-reaching and devastating consequences, affecting everything from public health to national defense. In this paper, we focus on the cybersecurity of power grid systems, one of the most prominent examples of critical infrastructure. Over the years, power grids have evolved from small, localized systems to large, widely distributed networks, spanning Department of Statistics and Data Science, National University of Singapore and Department of Computer Science and Engineering, Indian Institute of Technology Kharagpur
entire nations or even continents. Electricity grids are now recognized as a vital component of critical infrastructure in many countries. However, a significant concern is that much of the existing grid infrastructure was established over a century ago, which is unable to meet the growing demands due to its aging components and the lack of modern technological capabilities [2]–[4]. This issue is expected to worsen in the coming years, as forecasts predict that global energy demand will triple by 2050, compared to current levels [5]. The energy sector has adopted digital technology at a slower pace than other industries, primarily due to its large scale and the need for high system availability. To maintain the stability and reliability of the electricity supply, the current power system requires urgent and comprehensive reform. These reforms must be cost-effective and compatible with existing infrastructure to ensure an uninterrupted transition. To address this challenge, conventional power systems are being upgraded to smart grids to meet the needs of the contemporary world. A smart grid (SG) enables bilateral flows of electricity and information, resulting in improved energy distribution, increased dependability, and a robust platform for integrating renewable energy sources. Although such connectivity improves power distribution and smart monitoring, it also exposes the network to critical cyberthreats, which could cause widespread power outages, compromised data, and financial losses. As a result, numerous initiatives have been launched to develop communication standards, protocols, and technologies for smart grids [6]. One such important protocol is IEC 61850 [7]. However, this did not include any cyber or information security features. Although the improved protocol IEC 62351 includes some comprehensive security measures [8], major vulnerabilities persist [9]. One of the key weaknesses that remains is the occurrence of unexpected and abrupt power outages, which continue to have a significant impact on consumers and distributors in current power infrastructures. In this paper, our focus is specifically on monitoring and detecting power theft arising from unknown, misallocated, or inaccurate energy flows. In a power grid, electricity losses can be broadly classified into two categories: technical losses and non-technical losses. Technical losses occur naturally during the transmission and distribution of electricity, due to the inherent resistance of electrical components, such as cables, overhead lines, and transformers. These losses are unavoidable to some extent, though they can be mitigated through infrastructure upgrades and improved grid design. On the other hand, non-technical losses arise from factors unrelated to the physical properties of the electrical system. These include electricity theft, faulty metering, and unmetered consumption. Such losses are often
2
the result of cyberattacks, in which malicious users exploit vulnerabilities in the power system to consume large volumes of electricity without detection. This imposes a considerable load on electrical systems, leading to substantial financial losses and energy waste. Non-technical losses can be further broadly categorized as follows: Energy Theft: This involves unlawful extraction of electricity from the grid, typically through meter tampering or the manipulation of electrical equipment. • Conveyance Errors: This occurs when power is used lawfully, but not accurately documented, resulting in unaccounted energy loss within the system. • Errors in Unmetered Supplies: Fluctuations in the electricity consumption of unmetered supplies, which include street lighting, public infrastructure, and advertising displays, can lead to non-technical losses when the estimated usage deviates from the real demand.
•
Among the aforementioned types of non-technical losses, conveyance errors and errors in unmetered supplies are difficult to account for and are unavoidable to a certain extent. However, energy theft resulting from cyberattacks is a critical area for intervention. Specifically, in developing countries unlawful use of electricity can potentially rise up to 30% [10], and even in developed countries, such as the United States, electricity theft is estimated to cost the energy industry up to $6 billion each year [11]. Consequently, to reduce power outages and help mitigate the impending global energy crisis, it has become imperative to develop efficient, real-time monitoring and detection mechanisms for energy theft within smart grid systems. This involves the development of a predictive recognition system designed to monitor and analyze daily electricity consumption data for individual customers. Existing approaches sometimes utilize machine learning-based classifiers, such as Support Vector Machine (SVM) and Artificial Neural Networks, for the detection of electricity theft in smart grids [12]–[23]. However, these methods often require computationally intensive training and artificial feature extractions, which increases both space and time complexities, making them unsuitable for high-performance real-time implementation [20]. A real-time power theft monitoring and detection system with a double metering architecture has been proposed recently in [24], however, its practical feasibility is limited due to high implementation costs. In this paper, we propose EnThM, a novel real-time strategy for mitigation of energy theft by tracking the usage data from the smart meters, specifically focusing on issues related to cryptographic security. A smart meter transmits the global intensity data (that is, the magnitude of the power consumed), in short intervals, usually every fifteen to thirty minutes. Our approach involves tracking the cumulative averages of global intensity over a sliding time window of length T , initialized at the present time and also at a corresponding point 12 months prior. These averages are computed whenever the measured intensity deviates above or below the baseline current level. The cumulative averages are updated in real time, based on a rateof-change parameter that is dynamically calculated from the global intensity data itself. Variations in the global intensity are
then compared to the evolving cumulative averages, using the cumulative distribution function of the uniform distribution, to assess the legitimacy of the consumption pattern and detect potential electricity theft. The following are the highlights of our proposed method: • Our method for electricity monitoring and theft detection relies on a simple statistical analysis of the smart meter usage data. As a result, it can be implemented efficiently and in real time, enhancing the security of smart grids against cyberattacks. • We leverage the hierarchical structure of the smart grid infrastructure to enable periodic, key-less authentication of the identities of the consumers. • The proposed method has been tested on benchmark data, where we also consider variations in electricity consumption patterns due to both seasonal and daily fluctuations, demonstrating high accuracy for identifying electricity theft from smart-meter usage data. The remainder of the paper is organized as follows: Section II introduces the smart grid architecture, discusses various threat models, and provides a brief overview of the properties of uniform distribution. In Section III we describe our proposed method for monitoring and detecting electricity theft. In Section IV we present the experimental results of our approach. Finally, concluding remarks are provided in Section V. II. BACKGROUND AND P RELIMINARIES In this section, we describe some of the prior work (Section II-A), the smart grid architecture (Section II-B), the threat model that we have considered in our approach (Section II-C), and the relevant background on probability distributions (Section II-D). A. Prior Work Existing approaches for tackling electricity theft in smart grids often utilize machine learning-based classifiers, such as Support Vector Machine (SVM) and Artificial Neural Networks [12]–[23]. Specifically, Nagi et al. [12] introduce a novel methodology for detecting non-technical losses in power utilities using a Support Vector Machine (SVM). The fraud detection model developed in their study identifies suspicious customers by analyzing anomalies in consumption behavior. Their approach employs data mining techniques, including feature extraction from historical consumption data. The SVMbased model utilizes customer load profiles and other relevant factors to detect behavioral patterns that are strongly correlated with non-technical losses. The framework of SVMs is also employed in [13]. This work delineates the estimated energy consumption patterns of various clients, including instances of theft. A dataset of consumer energy usage profiles is constructed using historical data, and SVMs are subsequently trained on data collected from smart meters, which captures diverse manifestations of fraudulent behavior. This data is categorized using predefined rules, and anomalous consumption patterns are identified and aggregated accordingly. In a related work, Depuru et al. [14] explore the potential and
3
importance of High Performance Computing techniques in detecting illegal electricity usage. The authors parallelize the entire customer classification process to enhance detection efficiency. In contrast, Costa et al. [15] suggested the use of a knowledge discovery in databases approach, leveraging artificial neural networks to classify customers for targeted inspection. A knowledge-based system was developed by Guerrero et al. [16], that incorporates the experience of field inspectors and employs a combination of text mining, neural networks, and statistical methods to identify non-technical losses. Information was extracted from sample data and translated into rules, which were then integrated with expertderived rules from inspectors. Zheng et al. [17] present a novel electricity theft detection method using a hybrid deep learning model that combines a wide and deep Convolutional Neural Network (CNN). The deep component is designed to effectively detect the non-periodicity of theft-related electricity usage patterns, while capturing the periodicity typical of normal consumption. The wide component complements this by capturing high-level characteristics of the usage data. In a similar vein, Hasan et al. [18] designed an electricity theft detection system that integrates a CNN with a Long ShortTerm Memory (LSTM) network, enabling both spatial and temporal pattern recognition. Another approach for detecting and identifying energy theft in distribution systems is proposed by De Souza et al. [19], introducing a unique methodology tailored to modern power distribution networks. In this method a self-organizing map is employed to cluster users based on similar consumption patterns. For each cluster identified by the SOM, a Multilayer Perceptron Artificial Neural Network is developed to classify consumers as either honest or fraudulent. In a different approach, Kocaman et al. [20] developed a deep learning method based on LSTM networks to detect electricity theft. Viegas et al. [21] explored cluster-based techniques, employing Fuzzy C-Means and Fuzzy Gustafson–Kessel algorithms for identifying anomalous consumption behaviors. Similarly, Razavi et al. [22] applied a Genetic Programming algorithm to detect electricity theft in smart grid environments. Lin et al. [23], on the other hand, suggested an approach using adaptively tuned Recurrent Neural Networks to enhance detection accuracy. Most of the methods mentioned above, however, often require computationally intensive training and artificial feature extractions, which increases both space and time complexities, making them unsuitable for high-performance real-time implementation [20]. A real-time power theft monitoring and detection system with a double metering architecture has been proposed recently in [24], however, its practical feasibility is limited due to high implementation costs. B. Grid Architecture Figure 1 shows a schematic of the Smart Grid (SG) communication framework, which forms the backbone of the power transmission and distribution system [25]. The power distribution network consists of two main components: the transmission substation of the power plant, and multiple distribution substations. From the perspective of communication,
the Smart Grid (SG) topology can be viewed as a hierarchical network structure [25], [26]. At the top of the hierarchy is the control center (CC) of a Distribution Substation (DS). Each DS comprises of a hierarchical communication network that conists of Neighborhood Area Networks (NAN), Building Area Networks (BAN), and Home Area Networks (HAN). For simplicity, we assume that each di stribution substation serves a single neighborhood area. For instance, in Figure 1 we show n NANs, each of which is made up of b BANs, each of which in turn has a variety of apartment-based networks (HANs) assigned to them. Smart Meters (SM) are deployed in the SG design to enable automated two-way communication between utility providers and customers. Each smart meter has two interfaces: one for recording power and the other acts as a communication gateway. These meters track key metrics such as electricity usage, voltage, current, and power factor, transmitting data for system monitoring, customer billing, and insights into consumption patterns. This system improves transparency for both consumers and electricity suppliers.
C. Threat Model We will examine potential attacks on the smart grid structure using the Dolve-Yao threat model [27]. This model posits that attackers can engage in various malicious activities, including eavesdropping on grid communications, intercepting wireless two-way channels, replaying old messages, forging messages, injecting new messages, and the extraction of sensitive information from consumer-to-gateway communications. The increasing intricacy and widespread interconnectivity of Smart Grids introduce new opportunities for attackers to exploit security vulnerabilities. Inherent weaknesses in the infrastructure can be targeted to compromise control centers, intercept or manipulate smart meter datagrams, disrupt power distribution, and ultimately cause brownouts or even large-scale blackouts.
D. Statistical Preliminaries Our power theft detection scheme will use properties of the continuous uniform distribution, which is also sometimes referred to as the rectangular distribution. A distribution of this kind depicts an experiment with an arbitrary result that falls within predetermined parameters. The boundaries are defined by the parameters, a and b, which represent the minimum and maximum values of the random variable. The length of the interval is defined by the difference between the boundary values. All intervals of the same length on the support of the distribution are equally likely. Specifically, the probability density function (PDF) for a continuous uniform distribution on the interval [a, b] is given by: ( f (x) =
1/(b − a) 0
for a ≤ x ≤ b for x < a or x > b,
(1)
where the parameters a and b satisfy: −∞ < a < b < ∞. Hence, the cumulative distribution function (CDF) of the
4
POWER PLANT
CONTROL CENTER NAN Gateway Smart Meter NAN 1 BAN Gateway Smart Meter BAN 1 HAN Gateway Smart Meter HAN 1
NAN 2, …, NAN n
BAN 2, …, BAN b
HAN 2, …, HAN h
HAN = Home Area Network, BAN = Building Area Network, NAN = Neighborhood Area Network
Fig. 1. Hierarchical architecture of Smart Grid (SG) communication network.
continuous uniform distribution on the interval [a, b] is given by: for x < a 0 (2) F (x) = (x − a)/(b − a) for a ≤ x ≤ b 1 for x > b.
CONSUMER Electricity usage data
PROVIDER Receives Smart Meter data
Smart meter data
Verifies the cumulative average of electricity
Note that the CDF F (x) is the probability that a random variable with uniform distribution on the interval [a, b] is less than or equal to the value x.
?
III. P ROPOSED M ETHODOLOGY The goal of our research is to detect electricity theft by identifying sudden power outages in the smart grid or by detecting non-technical losses. Our proposed method EnThM is a novel real-time, hierarchical verification scheme for energy theft mitigation in Smart Grids. Our approach involves analyzing patterns in the cumulative average of electricity usage, based on data periodically transmitted by smart meters. The schematic of the proposed approach is given in Figure 2. Our method naturally integrates with the hierarchical structure of the Smart Grid (see Figure 1), where the higher-order nodes can execute the algorithm on the electricity consumption data of their immediate lower-order nodes to determine whether there is a power theft. For instance, with reference to Figure 1, each HAN will be verified by its parent BAN, and each BAN will be verified by its corresponding NAN, and each NAN will be verified by the Control Center. In the practical setting, whenever a new consumer node is added to the grid, it is connected to some producer node, and a first-time authentication takes place to verify its identity [28]. However, since communication between the consumer and producer continues over an extended period, an intial onetime authentication is insufficient to ensure long-term security. The advantage of our verification method is that it can be performed periodically and in real time, each time the smart meter transmits the usage data, ensuring continued safety to the system. It is also worth noting that in the large-scale smart
Electricity consumption
Provide electricity
No Yes
Determine non-technical losses
Continue service
Provider-Consumer relationship in Control Center PROVIDER
CONSUMER
Neighborhood Area Network Building Area Network Building Area Network
Home Area Network
Fig. 2. Schematic of the proposed methodology, and the provider-consumer view with respect to smart grid hierarchical architecture.
grids, communication routes of the unguided transmission media might be changing as per necessity. However, the communication media does not create any effects on our algorithm, as it primarily deals with the received data and the information stored in the smart meters. A. Input Parameters Our power theft detection method takes the following parameters as input: •
Time Stamp (t): Smart meter sends the electricity usage data periodically. Hence, the time stamp t when the data is transmitted is an important input parameter.
5
•
Global Intensity (GIt ): Another important input parameter is the global intensity of electricity at time t. This is the global minute-averaged current intensity (measured in Ampere) as recorded by the smart meter. The global intensity at time t will be denoted by GIt .
B. Variable Initialization and Update We denote by ‘a’ and ‘b’ the lower and upper limits of the current. These are predefined by the service provider, which denotes the maximum upper limit and minimum lower limit of the current at which accuracy is maintained. Alternatively, a is referred to as NULL (denoting no or minimal possible current) and b as IM AX , the maximum allowed intensity. Also, denote by Ib the basic current, as defined in IEC 61036 (2000–09) [29, Section 3.5.1.1]. It is the reference value used to define the performance characteristics of a direct connection meter. These parameters are related as follows: IM AX = b > Ib > a = N U LL.
(3)
With the above parameters set, we now compute the cumulative averages of the global intensity GIti (depending on whether it is above or below the basic current Ib . For this, denote by B a time span of 1 year (12 months). Hence, given a time instance ti , the notation ti−B will denote the time instance 12 months prior to i. Then the cumulative global intensity functions R1 and R2 at time ti are computed as follows: 1 R2 (ti ) = 2T + 2
i+T X
GItj 1{GItj > Ib }
j=i
+
i−B+T X
! GItj 1{GItj > Ib } ,
(4)
j=i−B
and 1 R1 (ti ) = 2T + 2
i+T X
Next, we continuously update the values of R1 and R2 , based on a rate-of-change parameter computed from global intensity data, to obtain the threshold functions which will be used to verify the electricity consumption pattern. The value of the rate of change parameter at time-stamp ti is denoted by α. Technically, the value of α depends on the time-stamp ti , but to simplify the notation we drop the dependence of ti from α. The calculation of α is described later in Algorithm 1. Then the lower and upper threshold functions r1 and r2 at time ti are computed as follows: b if ti = t0 , (1 + α)R2 (ti ) if (1 + α)R2 (ti ) ≤ b and b − R2 (ti ) ≥ R2 (ti ) − Ib , (1 − α)R2 (ti ) if (1 − α)R2 (ti ) > Ib r2 (ti ) = and b − R2 (ti ) < R2 (ti ) − Ib , R2 (ti ) if (1 + α)R2 (ti ) > b, R2 (ti ) if (1 − α)R2 (ti ) < Ib ; and a (1 − α)R1 (ti ) (1 + α)R1 (ti ) r1 (ti ) = R1 (ti ) R1 (ti )
if ti = t0 , if (1 − α)R1 (ti ) ≥ a and R1 (ti ) − a ≥ Ib − R1 (ti ), if (1 + α)R1 (ti ) ≤ Ib and R1 (ti ) − a < Ib − R1 (ti ), if (1 − α)R1 (ti ) < a, if (1 + α)R1 (ti ) > Ib .
From the above definitions and (6) it follows that GItj 1{GItj ≤ Ib }
b ≥ r2 (ti ) > Ib ≥ r1 (ti ) > a.
j=i
+
i−B+T X
! GItj 1{GItj ≤ Ib } .
(5)
The functions r1 , r2 are shown in Figures 5 and 6 in the data example.
j=i−B
Here, 1{GItj > Ib } denotes the indicator function which is 1 when GItj > Ib , and 0 otherwise. 1{GItj ≤ Ib } is defined similarly. In other words, R2 (ti ) is the average of the global intensity, when the global intensity values are higher than Ib , over a time slide window of length T starting at ti and also over a time slide window of length T that begins B = 12 months before ti . Similarly, R1 (ti ) is the average of the global intensity, when the global intensity values are lower than Ib , over a time slide window of length T starting at ti and also over a time slide window of length T that begins B = 12 months before ti . The reason for considering the global intensity values from 12 months prior, in addition to the set of recent values, is to enhance the accuracy of the estimate by considering seasonal variations. By definition of R1 (ti ) and R2 (ti ) and the relation in (3), we get b > R2 (ti ) > Ib ≥ R1 (ti ) > a.
(6)
C. Calculation of Rate-of-Change Parameter We now describe the calculation of the rate-of-change parameter α at the time-stamp ti . For this, it is also necessary to take into account the values of the global intensity in the current time slide window as well as a time slide window from B = 12 months prior. The details are given in Algorithm 1. To understand the calculation of α described in Algorithm 1 let us consider an example. Example: Let us assume that there are 5 samples in the time window from i to i+T with global intensity values as follows: {9.600, 9.600, 10.500, 8.600, 7.400}. Also, suppose the time window from (i − B) to (i − B + T ), which also contains 5 more data samples, have global intensity values: {11.500, 10.500, 9.600, 9.300, 8.500}.
6
Algorithm 1 Rate of change calculation Require: Time slide window length (T ) and the starting timestamp of a window (ti ). 1: for j = i to i + T and (i − B) to (i − B + T ) do 2: IM AX − GItj × 100 . nj = IM AX Express nj = 10 × αj + βj , where 0 ≤ αj ≤ 10 and 0 ≤ βj ≤ 9 are integers. 3: end for 4: return α = 0.1 × mode{αi , . . . , αi+T , αi−B , . . . , αi−B+T },
PROVIDER (VERIFIER)
CONSUMER
Step 1: Initialize a = NULL b = IMAX. Step 2: Periodically send global intensity with timestamp tj
Step 4: Send ti +T +1 and (timestamp and global intensity pair at query time i+t+1)
where mode of a collection of integers is the element that has the highest frequency. In case the mode is not unique, the largest value is chosen.
Step 3: Periodically evaluate R1, R2 and determine r1, r2
Step 5: Check if condition (7) holds. If yes, implies valid consumer. Else, invalid.
Fig. 3. Workflow of the proposed scheme.
The union of these 2 sets of values is: {9.600, 9.600, 10.500, 8.600, 7.400, 11.500, 10.500, 9.600, 9.300, 8.500}. With respect to the standard household electric power consumption, we consider IM AX to be 30 Ampere (Amps) [30]. Then for each tj we can compute nj as in Algorithm 1. For example, GItj = 9.600, we have, IM AX − GItj nj = × 100 IM AX 30 − 9.600 = × 100 30 = 68. Similarly, the values of nj can be calculated for the other values of GItj . This gives the following set of values for nj : {68, 68, 65, 72, 76, 62, 65, 68, 69, 72}.
E. Summarizing the Workflow The workflow of our scheme is illustrated in Figure 3, which highlights the communication flow between the consumer and the provider. The following are the main steps: • Initially, the values of the variables a and b are set by the service provider. • Then the consumer periodically sends the global intensity value GItj and its time stamp tj to the provider. • The provider then calculates the cumulative global intensity functions R1 and R2 and the threshold functions r1 and r2 (as described before). • In the query time, the consumer sends the time-stamp ti+T +1 and global intensity value GIti+T +1 to the provider. • The provider then verifies the validity of the consumer at time-stamp ti+T +1 by checking whether or not condition (7) is satisfied.
Therefore, the corresponding values of αj are as follows: IV. E XPERIMENTAL R ESULTS
{6, 6, 6, 7, 7, 6, 6, 6, 6, 7}. Note that the mode (dominating frequency) in this set is 6. Hence, α = 0.6, in this case. □ D. Verification Method We can validate the query global intensity at time stamp ti+T +1 , using the threshold functions r1 and r2 , computed as above. Specifically, we check if the global intensity GIti+T +1 lies in the interval [r1 (ti+T +1 ), r2 (ti+T +1 )]. In other words, recalling the CDF of the continuous uniform distribution from Equation (2)), we say the query global intensity at time stamp ti+T +1 is valid when 0≤
GIti+T +1 − r1 (ti+T +1 ) ≤ 1. r2 (ti+T +1 ) − r1 (ti+T +1 )
(7)
Else, we flag the global intensity at the time-stamp ti+T +1 as invalid, which prompts the electricity provider to take appropriate action.
The details of the experimental setup and results are described in this section. Note that, since power grid security is part of critical infrastructure security, results from practical testing and comprehensive vulnerability assessments are typically withheld from public access, due to national security concerns and the risk of malicious exploitation. Likewise, data related to critical infrastructure is generally not publicly available, as the exposure of vulnerabilities could lead to catastrophic disruptions of essential services. Governments and commercial organizations responsible for critical infrastructure classify such information as sensitive to protect against threats, including cyberattacks, terrorism, and sabotage. Consequently, we validate our schemes through simulations, benchmark datasets, and FPGA-based testing. A. Data Description For our experiment we use individual household electric power consumption data set provided by the UCI Machine
7
Learning Repository (obtained from Kaggle [31]). The dataset contains about 20,75,259 measurements gathered between December 2006 and November 2010 (47 months) with the following 9 attributes: • date: Date formatted as dd/mm/yyyy; • time: Time in the following format: hour, minute, and second (hh:mm:ss); • global active power: Global minute-averaged active power per household (in kilowatts); • global reactive power: Global minute-averaged reactive power per home (in kilowatts); • voltage: Average voltage per minute (in volts) • global intensity: Average household current intensity per minute globally (in ampere); • sub metering 1: Energy sub-metering No. 1 (active energy in watt-hours). This represents the kitchen, which is mostly equipped with microwave, oven, and dishwasher (hot plates are gas-powered rather than electric); • sub metering 2: Energy sub-metering No. 2 (active energy in watt-hours). This includes washing machine, a dryer, a refrigerator, and a light (this is equivalent to the laundry room); • sub metering 3: Energy sub-metering No. 3 (active energy in watt-hours). For this air conditioners and electric water heaters are the equivalents. In our analysis, we use the date, time and global intensity attributes. To introduce anomalies to the data set, we consider Industrial Control System (ICS) Cyber Attack Datasets, generated by Oak Ridge National Laboratories (ORNL) [32] (which is also available in Kaggle [33]). The dataset includes measurements related to electric transmission system normal, disturbance, control, and cyber attack behaviors. In particular, the dataset contains the following types of attack scenarios: • Short-circuit fault: This is caused by a short in a power line that can occur in various locations along the line. • Line maintenance: Here, one or more relays on a specific line are disabled to allow for maintenance activities on that line. • Remote tripping command injection attack: This is an attack that sends a command to a relay, which causes a circuit breaker to open. • Relay setting change attack: Here, relays are configured with a distance protection scheme, and an attacker changes the settings to disable the relay’s functionality. As a result, the relay fails to trip in response to a legitimate fault or a valid control command. • Data Injection: This type of attack simulates a valid fault by altering parameters such as current, voltage, and sequence components. This attack aims to blind the operator and cause a black out. B. Design Rationale An important factor to consider when analyzing electricity usage data is seasonal variation. Electricity consumption varies based on the time of day and weather conditions. For example, energy usage patterns differ between day and night, between weekdays and weekends, and also between seasons. Figure
4 shows the variations in the load patterns of the dataset in 3 scenarios: (a) comparison of daytime power consumption between weekday and weekend; (b) comparison of nighttime power consumption between weekday and weekend; and (c) comparison of summer versus winter daytime. As expected, power consumption is typically higher during the daytime, when most electrical appliances are in use, compared to nighttime. Similarly, energy consumption patterns vary between seasons. In the summer, high-consumption appliances, such as air conditioners, are often used during the day, whereas this usage is significantly lower in the winter. The plots in Figure 4 clearly illustrate that electricity consumption patterns are significantly affected by season and time of day. These variations must be taken into account to accurately detect anomalies in consumption behavior. Hence, in our analysis we implement our monitoring and detection algorithm, that is, construct the threshold functions r1 and r2 , separately, depending on the time of the day and the season. C. Results To illustrate our monitoring and detection method, we consider the time window starting from 10:00 on 21st November, 2010 to 11:50 on 21st November, 2010 (24-hour time format is considered). Figure 5 shows the global intensity curve GI(t), the cumulative global intensity functions R1 (t) and R2 (t) (computed as in Equations (5) and (4)), and the threshold functions r1 (t) and r2 (t). The predefined lower and upper limits a and b and the basic current Ib are also shown. Note that in this window, the global intensity curve GIt lies within the threshold functions r1 (t) and r2 (t), hence no anomaly is reported. Next, we apply a forged global intensity at time 11:55 on 21st November, 2010 (this corresponds to the time ti+T +1 ). Then calculated values of R1 , R2 , r1 , and r2 are 2.800 Amps, 12.400 Amps, 2.100 Amps, and 15.500 Amps, respectively. (Here, for household electric power consumption, we consider IM ax and Ib to be 30 Amps and 5 Amps, respectively [30]). From this calculate the global intensity value GIti+T +1 = 25 Amps. Note that, in this case, GIti+T +1 − r1 (ti+T +1 ) = 1.709 > 1, r2 (ti+T +1 ) − r1 (ti+T +1 ) which indicates the presence of electricity theft. Hence, our method is able to correctly detect the occurrence of electricity theft in this dataset. Table I shows the results, and the electricity curve is shown in Figure 6. Note that at the time point 11:55 on 21st November, 2010, the value of the global intensity exceeds the value of the upper threshold function r2 at that point, indicating the presence of an anomaly. TABLE I T HEFT VERIFICATION RESULTS Variables Variable r1 Variable r2 Forged global intensity GIti+T +1 GIti+T +1 −r1 (ti+T +1 ) r2 (ti+T +1 )−r1 (ti+T +1 )
Values at time i + T + 1 2.100 Amps 15.500 Amps 25 Amps 1.709 > 1
8
(a) Weekend and Weekday Daytime comparison Weekend Date: 21-11-2010, Weekday Date: 23-11-2010 Start Time: 10:00, End Time: 11:50
(b) Weekend and Weekday Night-time comparison Weekend Date: 21-11-2010, Weekday Date: 23-11-2010 Start Time: 10:00, End Time: 11:50
(c) Summer and Winter Daytime comparison Weekend Date: 11-06-2009, Weekday Date: 11-11-2009 Start Time: 10:00, End Time: 11:50 Fig. 4. Comparing energy consumption patterns.
Next, we insert forged global intensity values from [32] into the dataset [31] multiple times to evaluate the performance of our method. We have injected the faults in the dataset at random positions and executed our proposed method, EnThM, to detect the faults. We have considered 20,75,259 measurements of the dataset [31], within which the number of altered data, or inserted faults, was 500. These 500 faulty data values are
taken from the dataset [32]. Specifically, we take into account the performance of the metrics described here: • Accuracy: This is the percentage of correctly identified examples out of all occurrences. Formally, Accuracy =
TP + TN . TP + FP + TN + FN
Here, T P denotes true positives, that is, attack instances
9
Intensity of electricity (Amperes)
b
b − R2 (ti )
r2 (t)
r2 (ti ) = (1 + α)R2 (ti )
R2 (t) R2 (ti ) GI(t)
R2 (ti ) − Ib
Ib R1 (t) r1 (t) a
r1 (ti ) = (1 + α)R1 (ti ) R1 (ti ) ti
Time (t)
Intensity of electricity (Amperes)
Fig. 5. Calculation of the threshold functions r1 (t) and r2 (t) in the time window 10:00, 21st November, 2010 to 11:50, 21st November, 2010.
b Forged global intensity
b − R2 (ti )
r2 (t)
r2 (ti ) = (1 + α)R2 (ti )
R2 (t) R2 (ti ) R2 (ti ) − Ib r1 (ti ) = (1 + α)R1 (ti ) R1 (ti )
ti
GI(t) Ib R1 (t) r1 (t) a
Time (t)
Fig. 6. Anomaly detection at time 11:55, 21st November, 2010.
correctly identified as attacks; T N denotes true negatives, that is, normal instances correctly identified as normal; F P denotes false positives, that is, normal instances incorrectly identified as attacks; and F N denotes false negatives, that is, attack instances incorrectly identified as normal. • True Positive Rate (T P R): This is the fraction of real
attacks that are correctly identified: TP . (8) TPR = TP + FN A high true positive rate (T P R) indicates the efficiency of a method in detecting malicious activity. • False Positive Rate (F P R): This is fraction of typical occurrences that are mistakenly identified as attacks: FP FPR = . FP + TN
10
In order to avoid numerous false alarms, which can make operators less sensitive to alerts and erode their confidence in the detection system, a low F P R is crucial. • F 1 Score: This is defined as F 1 Score = 2 ×
Precision × Recall Precision + Recall
P where Precision = T PT+F P is the proportion of correct positive predictions (true positives) out of all the positive predictions made by the method; and Recall = TP T P +F N = T P R is true postive rate (recall (8)). Therefore, a high F 1 Score, which is the harmonic mean of the notions of Precision and Recall, provides a balanced assessment of total performance by indicating that the model performs well in both attack detection and in identifying normal circumstances.
The performance of our proposed method is shown in Table II. The results show that our method achieves high Accuracy, TPR, and F1 score as well as low FDP for energy theft detection. Collectively, these metrics highlight effectiveness of our approach in detecting energy theft in smart grid systems. TABLE II E VALUATION R ESULTS FOR DETECTING E NERGY T HEFT Accuracy True Positive Rate False Positive Rate F1 Score
99.61% 99.88% 0.25% 99.79%
V. C ONCLUSION In this paper, we introduce EnThM, a novel hierarchical real-time verification method for the energy theft mitigation scheme in Smart Grids. The verification process relies on dynamically computing two threshold functions from the smart meter electricity usage data. The observed global intensity values are then compared against these thresholds using the CDF of the continuous uniform distribution, enabling efficient validation of electricity usage at query time. This approach yields a periodic, key-less authentication scheme for threat monitoring and detection that eliminates the need for computationally intensive training or manual feature extraction, making it well-suited for efficient real-time implementation. In contrast to existing approaches that focus on predicting the likelihood of future threats, our method is able to detect attacks in real time, as they occur. Once an attack is identified, communication is halted and the provider initiates a verification process. The method requires only data from a fixed time window T , along with corresponding data from up to one year prior. Smart meters collect readings continuously throughout the day and retain this data for 13 months, after which older records are discarded. This simplifies accessing the data and performing the necessary calculations. The proposed method has demonstrated strong performance on benchmark datasets, showcasing its effectiveness in enhancing the security of the Smart Grid infrastructure.
R EFERENCES [1] “The State of Cyber Security 2025: Your guide to navigating emerging cyber threats and strengthening defenses in 2025, Check Point Software Technologies Ltd. [Internet],” Available from: https://www.checkpoint. com/security-report/, 2025. [2] H. Verdejo and C. Becker, “The Erratic Implementation of Measuring, Monitoring and Control System (MMCS) in Chile: The crisis on smart meters,” Energy Reports, vol. 6, pp. 2140–2145, 2020. [3] I. Smajla, D. K. Sedlar, D. Vulin, and L. Jukić, “Influence of smart meters on the accuracy of methods for forecasting natural gas consumption,” Energy Reports, vol. 7, pp. 8287–8297, 2021. [4] R. Pereira, J. Figueiredo, R. Melicio, V. Mendes, J. Martins, and J. C. Quadrado, “Consumer energy management system with integration of smart meters,” Energy Reports, vol. 1, pp. 22–29, 2015. [5] T. Chen, X. Yin, and G. Wang, “Securing communications between smart grids and real users; providing a methodology based on user authentication,” Energy Reports, vol. 7, pp. 8042–8050, 2021. [6] V. C. Gungor, D. Sahin, T. Kocak, S. Ergut, C. Buccella, C. Cecati, and G. P. Hancke, “Smart grid technologies: Communication technologies and standards,” IEEE Transactions on Industrial Informatics, vol. 7, no. 4, pp. 529–539, 2011. [7] “IEC Webstore, International Electrotechnical Commission. IEC 618505:2013 Communication networks and systems for power utility automation - Part 5: Communication requirements for functions and device models [Internet],” Available from: https://webstore.iec.ch/publication/ 6012, Last accessed: 23rd November 2025. [8] “IEC Webstore, International Electrotechnical Commission. IEC 623516:2020 Power systems management and associated information exchange - Data and communications security - Part 6: Security for IEC 61850 [Internet],” Available from: https://webstore.iec.ch/publication/ 63742, Last accessed: 23rd November 2025. [9] M. Strobel, N. Wiedermann, and C. Eckert, “Novel weaknesses in IEC 62351 protected smart grid control systems,” in 2016 IEEE International Conference on Smart Grid Communications (SmartGridComm). IEEE, 2016, pp. 266–270. [10] S. C. Bhattacharyya, “The Electricity Act 2003: will it transform the Indian power sector?” Utilities Policy, vol. 13, no. 3, pp. 260–272, 2005. [11] “The Wall Street Journal, CIO Journal, Sponsored content by Deloitte, Using Analytics to Crack Down on Electricity Theft. [Internet],” Available from: https://deloitte.wsj.com/cio/ using-analytics-to-crack-down-on-electricity-theft-1385960523, Last accessed: 23rd November 2025. [12] J. Nagi, K. S. Yap, S. K. Tiong, S. K. Ahmed, and M. Mohamad, “Nontechnical loss detection for metered customers in power utility using support vector machines,” IEEE Transactions on Power Delivery, vol. 25, no. 2, pp. 1162–1171, 2009. [13] S. S. S. R. Depuru, L. Wang, and V. Devabhaktuni, “Support vector machine based data classification for detection of electricity theft,” in 2011 IEEE/PES Power Systems Conference and Exposition. IEEE, 2011, pp. 1–8. [14] S. S. S. R. Depuru, L. Wang, V. Devabhaktuni, and R. C. Green, “High performance computing for detection of electricity theft,” International Journal of Electrical Power & Energy Systems, vol. 47, pp. 21–30, 2013. [15] B. C. Costa, B. L. Alberto, A. M. Portela, W. Maduro, and E. O. Eler, “Fraud detection in electric power distribution networks using an annbased knowledge-discovery process,” International Journal of Artificial Intelligence & Applications, vol. 4, no. 6, p. 17, 2013. [16] J. I. Guerrero, C. León, I. Monedero, F. Biscarri, and J. Biscarri, “Improving knowledge-based systems with statistical techniques, text mining, and neural networks for non-technical loss detection,” KnowledgeBased Systems, vol. 71, pp. 376–388, 2014. [17] Z. Zheng, Y. Yang, X. Niu, H.-N. Dai, and Y. Zhou, “Wide and deep convolutional neural networks for electricity-theft detection to secure smart grids,” IEEE Transactions on Industrial Informatics, vol. 14, no. 4, pp. 1606–1615, 2017. [18] M. N. Hasan, R. N. Toma, A.-A. Nahid, M. M. Islam, and J.-M. Kim, “Electricity theft detection in smart grid systems: A CNN-LSTM based approach,” Energies, vol. 12, no. 17, p. 3310, 2019. [19] M. A. de Souza, J. L. Pereira, G. d. O. Alves, B. C. de Oliveira, I. D. Melo, and P. A. Garcia, “Detection and identification of energy theft in advanced metering infrastructures,” Electric Power Systems Research, vol. 182, p. 106258, 2020. [20] B. Kocaman and V. Tümen, “Detection of electricity theft using data processing and lstm method in distribution systems,” Sādhanā, vol. 45, no. 1, p. 286, 2020.
11
[21] J. L. Viegas, P. R. Esteves, and S. M. Vieira, “Clustering-based novelty detection for identification of non-technical losses,” International Journal of Electrical Power & Energy Systems, vol. 101, pp. 301–310, 2018. [22] R. Razavi, A. Gharipour, M. Fleury, and I. J. Akpan, “A practical featureengineering framework for electricity theft detection in smart grids,” Applied energy, vol. 238, pp. 481–494, 2019. [23] G. Lin, H. Feng, X. Feng, H. Wen, Y. Li, S. Hong, and Z. Ni, “Electricity theft detection in power consumption data based on adaptive tuning recurrent neural network,” Frontiers in Energy Research, vol. 9, p. 773805, 2021. [24] C. L. Zulu and O. Dzobo, “Real-time power theft monitoring and detection system with double connected data capture system,” Electrical Engineering, pp. 1–19, 2023. [25] T. W. Chim, S.-M. Yiu, V. O. Li, L. C. Hui, and J. Zhong, “PRGA: Privacy-preserving recording & gateway-assisted authentication of power usage information for smart grid,” IEEE Transactions on Dependable and Secure Computing, vol. 12, no. 1, pp. 85–97, 2014. [26] M. M. Fouda, Z. M. Fadlullah, N. Kato, R. Lu, and X. S. Shen, “A lightweight message authentication scheme for smart grid communications,” IEEE Transactions on Smart Grid, vol. 2, no. 4, pp. 675–685, 2011. [27] D. Dolev and A. Yao, “On the security of public key protocols,” IEEE Transactions on Information Theory, vol. 29, no. 2, pp. 198–208, 1983. [28] S. Lakshminarayanan, “Authentication and authorization for smart grid application interfaces,” in 2011 IEEE/PES Power Systems Conference and Exposition. IEEE, 2011, pp. 1–5. [29] “IEC Webstore, International Electrotechnical Commission. IEC 61036:1996+AMD1:2000 CSV Withdrawn Consolidated version - Alternating current static watt-hour meters for active energy (classes 1 and 2) [Internet],” Available from: https://webstore.iec.ch/publication/18924, Last accessed: 23rd November 2025. [30] “WEST BENGAL STATE ELECTRICITY DISTRIBUTION COMPANY LIMITED, Technical Specifications for A.C. Single Phase , 2Wire Solid State ( Static) Fully Electronic Energy Meter Accuracy Class: 1.0, Current Rating (5-30) A, With Backlit LCD Display for 240 V System [Internet],” Available from: https://www.wbsedcl.in/irj/go/km/docs/internet/webpage/ techspec/Technical\%20Specifications\%20for\%20A.C.\%20Single\ %20Phase\%20,\%202Wire\%20Solid\%20State.pdf, Last accessed: 23rd November 2025. [31] “kaggle, Household Electric Power Consumption. Provided by UCI MACHINE LEARNING [Internet],” Available from: https://www.kaggle. com/datasets/uciml/electric-power-consumption-data-set, Last accessed: 23rd November 2025. [32] “Industrial Control System (ICS) Cyber Attack Datasets, Dataset 1: Power System Datasets. Provided by Oak Ridge National Laboratories (ORNL) [Internet],” Available from: https://sites.google.com/a/uah.edu/ tommy-morris-uah/ics-data-sets, Last accessed: 23rd Noivember 2025. [33] “kaggle, Power System: SMART GRID MONITORING POWER. Power System Attack Datasets - Mississippi State University and Oak Ridge National Laboratory, 4/15/2014 [Internet],” Available from: https://www.kaggle.com/datasets/bachirbarika/power-system/data, Last accessed: 23rd Noivember 2025.