Search Results (56)

Smart-city advanced metering infrastructure enables utility-scale remote analytics, but some forms of under-registration closely resemble lawful changes in demand and are hard to model as anomalies. We study a narrow, physically motivated event family at the single-meter level, namely multiplicative under-registration with unknown onset (a shunt-like attack), in which recorded active energy is approximately scaled by a factor $\alpha <1$ after a change-point while the daily-profile structure and spectral shape remain invariant. We formalize the problem and develop a physics-guided detector family based on weighted daily-profile regression (GLS) and its robust variant (RGLS), with quality-control filters, spectral-consistency checks, and an optional reactive-channel gate, designed to stay selective under confounders such as rooftop photovoltaics, electric-vehicle charging, and heat-pump onsets. On a device-disjoint Low Carbon London benchmark (487 households) the preferred GLS detector attains precision $0.915$, recall $0.978$, and $F_1=0.945$ at $\alpha =0.10$ while keeping the non-theft suspected rate near $1\%$; a cross-dataset check on Open Power System Data with real EV/PV/heat-pump overlays yields zero false alarms on all 72 cases, and Mendeley and WPuQ benchmarks add a second large family and a reactive-channel test. We compare against external baselines (classical change-point detection, Isolation Forest, autoencoder, LSTM, gradient boosting, and a supervised statistical pipeline) on the same protocol: generic anomaly detectors fail on this shape-preserving attack, and supervised models match the detector only in-distribution while, unlike it, failing to transfer to real lawful confounders. All metrics carry bootstrap confidence intervals, and a full reproducibility bundle accompanies the submission. Full article

Electricity theft remains a critical challenge that destabilizes power systems, causes significant financial losses, and disrupts the grid, particularly in developing countries. This study presents a machine learning framework integrating an ANN and advanced performance metrics to accurately detect fraud consumption patterns in a smart meter dataset. The method achieves strong categorization between normal and abnormal conduct by simulating temporal behavior across seasons, applying feature extraction to high-resolution energy signals, and assessing performance using RMSE, MAE, and R². The experimental results demonstrate that intelligent algorithms significantly improve theft-detection accuracy; reduce losses, especially NTLs; and provide a scalable foundation for future smart-grid security. Full article

Electricity theft is a critical source of non-technical losses in modern power systems, causing substantial financial and operational challenges for utilities. Traditional detection methods, such as manual inspections, are inadequate to detect advanced theft techniques, including meter tampering and cyberattacks on smart grids. This study introduces a machine learning-based framework for electricity theft detection using the TDD2022 dataset (derived from OEDI) and evaluates multiple algorithms—Random Forest, Decision Tree, XGBoost, LightGBM, CatBoost, Extra Trees, and Logistic Regression. To address class imbalance, SMOTE is applied, while feature selection leverages LASSO and ReliefF. Experiments compare electricity-only data with multi-utility inputs (electricity and gas) under balanced and imbalanced conditions. Results show that tree-based ensembles, particularly Extra Trees combined with SMOTE and ReliefF, achieve superior performance (accuracy $>95\%$, AUC $\approx 0.99$). Consumer-specific models outperform global models, with commercial classes yielding near-perfect detection, while residential profiles remain challenging. The findings highlight the importance of tailored modeling and feature selection for scalable, accurate theft detection in smart grid environments. Full article

In modern power grids, the detection of electricity theft is crucial for ensuring the safety and stability of the power system and reducing revenue losses. Current electricity theft detection methods do not take into account the spectral space features contained in the original time series data sequences, and thus are unable to adapt to the complex and ever-changing scenarios of electricity theft. This paper proposes an electricity theft detection model TSFPTD that integrates time series signals and their synchronous spectral features. The multi-modal model constructs the synchronous spectral modal space corresponding to the time series data through a deep wavelet network. It is found that this newly generated synchronous modal space contains implicit features that cannot be revealed by the original time series data. The explicit features of the time series data space and the implicit features of the synchronous spectral modal space are fused and aligned for the detection of power theft behavior. The performance verification experiment of the model was completed on the real dataset released by State Grid Corporation of China. The electricity theft detection accuracy of the TSFPTD model reached over 96.83%, and its performance is superior to the existing electricity theft detection methods. Full article

Background/Objectives: Alzheimer’s disease (AD) is a progressive neurodegenerative disorder that affects the daily lives of older adults, impacting their cognitive abilities as well as speech and language communication. Early detection is crucial, as it enables timely intervention and helps improve the quality of life for those affected. While large language models (LLMs) have shown promise from spontaneous speech, most studies are unimodal and miss complementary signals across modalities. Methods: We present an LLM-powered multimodal cross-attention framework that integrates lexical (text), acoustic (speech), and visual (image) information for dementia detection using the ADReSSo 2021 picture-description dataset. Within this framework, text data are encoded using the ModernBERT, audio features are extracted using the wav2vec 2.0-base-960, and the Cookie Theft image is represented through the CLIP ViT-L/14. These embeddings are linearly projected to a shared space and then combined via Transformer-based cross-attention, yielding a fused vector for AD detection. Results: Our results show that the trimodal model achieved the best overall performance when paired with an SVC classifier, reaching an accuracy of 0.8732 and an F1 score of 0.8571, surpassing both the top-performing unimodal and bimodal configurations. For interpretability, a sensitivity analysis of modality contributions reveals that text plays the primary role, audio provides complementary improvements, and image offers modest yet stabilizing contextual support. Conclusions: These results highlight that the method of multimodal embedding fusion significantly influences performance: a cross-attention block achieves an effective balance between accuracy and simplicity, producing integrated representations that align well with interpretable downstream classifiers. Full article

With the rapid deployment of the Internet of Things (IoT) in critical domains such as power and industrial systems, the number of IoT devices has surged, accompanied by increasingly severe network security risks. IoT networks face diverse threats, including distributed denial-of-service attacks, advanced persistent threats, and data theft or tampering, while traditional detection and defense, lacking deep feature analysis, struggle with complex and unknown attacks, degrading security threat event detection. To this end, this paper proposes an IoT network security threat detection algorithm that integrates symmetric linear routing with a sparse mixture-of-experts model. The algorithm consists of a ConvNeXt feature extractor and a sparse BiLSTM expert layer, with symmetric linear routing embedded in the gating module. ConvNeXt provides refined global and local representations, Top-K gated BiLSTM experts for the module sequence-level dependencies among ordered features, and symmetric linear routing suppresses routing bias, enabling efficient and robust detection of IoT security threats. Experimental results on the CIC-IDS2018, TON-IoT, and BoT-IoT datasets indicate that the proposed IoT network security threat detection algorithm achieves accuracies of 94.08%, $99.99\pm 0.01$%, and 99.78%, respectively. Comparative experiments show the proposed algorithm outperforms baseline and state-of-the-art models, while the ablation and Top-K studies confirm module effectiveness for IoT intrusion detection. Full article

Electricity theft in power grids results in significant economic losses for utility companies. While machine learning (ML) methods have shown promising results in detecting such frauds, they often suffer from low detection rates, leading to excessive physical inspections. In this study, we attempted to solve the above-mentioned problem using a novel approach. The proposed framework utilizes the intelligence of Siamese network architecture with the Triplet Loss function to detect electricity theft using a labeled dataset obtained from Multan Electric Power Company (MEPCO), Pakistan. The proposed method involves analyzing and comparing the consumption patterns of honest and fraudulent consumers, enabling the model to distinguish between the two categories with enhanced accuracy and detection rates. We incorporate advanced feature extraction techniques and data mining methods to transform raw consumption data into informative features, such as time-based consumption profiles and anomalous load behaviors, which are crucial for detecting abnormal patterns in electricity consumption. The refined dataset is then used to train the Siamese network, where the Triplet Loss function optimizes the model by maximizing the distance between dissimilar (fraudulent and honest) consumption patterns while minimizing the distance among similar ones. The results demonstrate that our proposed solution outperforms traditional methods by significantly improving accuracy (95.4%) and precision (92%). Eventually, the integration of feature extraction with Siamese networks and Triplet Loss offers a scalable and robust framework for enhancing the security and operational efficiency of power grids. Full article

The increasing complexity and cost of manufacturing monolithic chips have driven the semiconductor industry toward chiplet-based designs, where smaller, modular chiplets are integrated onto a single interposer. While chiplet architectures offer significant advantages, such as improved yields, design flexibility, and cost efficiency, they introduce new security challenges in the horizontal hardware manufacturing supply chain. These challenges include risks of hardware Trojans, cross-die side-channel and fault injection attacks, probing of chiplet interfaces, and intellectual property theft. To address these concerns, this paper presents ChipletQuake, a novel on-chiplet framework for verifying the physical security and integrity of adjacent chiplets during the post-silicon stage. By sensing the impedance of the power delivery network (PDN) of the system, ChipletQuake detects tamper events in the interposer and neighboring chiplets without requiring any direct signal interface or additional hardware components. Fully compatible with the digital resources of FPGA-based chiplets, this framework demonstrates the ability to identify the insertion of passive and subtle malicious circuits, providing an effective solution to enhance the security of chiplet-based systems. To validate our claims, we showcase how our framework detects hardware Trojans and interposer tampering. Full article

This research targets prediction of power consumption change (PCC) in the branch of electrical distribution grid between a sum meter and consumer meter in response to consumer load change. The problem is relevant for power preservation law-based event-driven methods aiming for detection of anomalies like meter errors, electricity thefts, etc. The PCC in the branch is due to the change of technical (wiring) losses as well as change of power consumption of loads connected to the same distribution branch. Using synthesized dataset set a data-driven model is built to predict PCC in the branch. Model performance is assessed using root mean squared error (RMSE), mean absolute, and mean relative error, together with their standard deviations. The preliminary experimental verification using a test bed confirmed the potential of the method. The accuracy of the PCC in the branch prediction is influenced by the systematic error of the meters. Therefore, the error of the consumer meter and the PCC in the branch cannot be evaluated separately. It was observed that the absolute error of the estimate of power measurement gain error was observed to be within ±0.3% and the relative error of PCC in the branch prediction was within ±10%. Full article

Drink spiking is a significant public safety issue, often linked to crimes such as theft and sexual assault. The detection of drugs used in these incidents is challenging due to the low concentrations (<ng) and complex matrices involved. This review explores the application of gas chromatography (GC) and gas chromatography-mass spectrometry (GC-MS) to identify drugs in spiked beverages. GC-MS offers high sensitivity and specificity, and is capable of detecting drugs at ng/mL levels and distinguishing between compounds with similar structures. This review highlights the advantages of GC-MS, including its ability to simultaneously analyze multiple substances and provide detailed molecular information. Various methods for detecting gamma-hydroxybutyrate (GHB), benzodiazepines, and other drugs in beverages are discussed, emphasizing the importance of derivatization to enhance their volatility and the method’s chromatographic performance. The paper also addresses the challenges of analyzing complex beverage matrices and the need for continuous improvement in detection techniques to keep pace with the evolving drug market. Overall, GC and GC-MS are powerful tools for forensic analysis in drink spiking cases, offering reliable and accurate results, which are essential for legal and investigative processes. Full article

Smart grids have enormous potential in terms of reliability and sustainability, but with the large-scale integration of distributed energy like solar energy, the network security risks of smart grids have also increased. In response to the physical and information network threats faced in the network security risk assessment of solar powered smart grids, this study develops a smart grid theft detection model based on TimesNet and a smart grid intrusion detection model based on bidirectional long short-term memory networks. The results indicated that when the proportion of electricity theft data was 25%, the false detection rate of the proposed model was 3.52. The area under the curve of the proposed model was 0.98, and the detection rate, false negative rate, F1 value, and accuracy were 97.04%, 1.21%, 92.69%, and 97.15%, respectively. The loss value of the proposed intrusion detection model was stable at around 0.012 in the NSL-KDD dataset and around 0.02 in the CICIDS2017 dataset, with a detection accuracy of 97.54% and a false positive rate of 1.21%. The experiment demonstrated the electricity theft behavior and network intrusion detection performance of the proposed model, which can effectively detect security threats faced by solar smart grids and provide practical basis for network security risk assessment. The research results can help reduce the economic losses of power companies, maintain a good order of electricity consumption, and ensure the safe and stable operation of solar smart grids. Full article

Electricity theft, emerging as one of the severe cyberattacks in smart grids, causes significant economic losses. Due to the powerful expressive ability of deep neural networks (DNN), supervised and unsupervised DNN-based electricity theft detection (ETD) schemes have experienced widespread deployment. However, existing works have the following weak points: Supervised DNN-based schemes require abundant labeled anomalous samples for training, and even worse, cannot detect unseen theft patterns. To avoid the extensively labor-consuming activity of labeling anomalous samples, unsupervised DNNs-based schemes aim to learn the normality of time-series and infer an anomaly score for each data instance, but they fail to capture periodic features effectively. To address these challenges, this paper proposes a novel periodicity-enhanced deep one-class classification framework (PE-DOCC) based on a periodicity-enhanced transformer encoder, named Periodicformer encoder. Specifically, within the encoder, a novel criss-cross periodic attention is proposed to capture both horizontal and vertical periodic features. The Periodicformer encoder is pre-trained by reconstructing partially masked input sequences, and the learned latent representations are then fed into a one-class classification for anomaly detection. Extensive experiments on real-world datasets demonstrate that our proposed PE-DOCC framework outperforms state-of-the-art unsupervised ETD methods. Full article

Intrusion detection systems are essential for detecting network cyberattacks. As the sophistication of cyberattacks increases, it is critical that defense technologies adapt to counter them. Multi-step attacks, which need several correlated intrusion operations to reach the desired target, are a rising trend in the cybersecurity field. System administrators are responsible for recreating whole attack scenarios and developing improved intrusion detection systems since the systems at present are still designed to generate alerts for only single attacks with little to no correlation. This paper proposes a machine learning approach to identify and classify multi-step network intrusion attacks, with particular relevance to smart cities, where interconnected systems are highly vulnerable to cyber threats. Smart cities rely on these systems seamlessly functioning with one another, and any successful cyberattack could have devastating effects, including large-scale data theft. In such a context, the proposed machine learning model offers a robust solution for detecting and mitigating multi-step cyberattacks in these critical environments. Several machine learning algorithms are considered, namely Decision Tree (DT), K-Nearest Neighbors (KNN), Naïve Bayes (NB), Support Vector Machine (SVM), Light Gradient-Boosting Machine (LGBM), Extreme Gradient Boosting (XGB) and Random Forest (RF). These models are trained on the Multi-Step Cyber-Attack Dataset (MSCAD), a recent dataset that is highly representative of real-world multi-step cyberattack scenarios, which increases the accuracy and efficiency of such systems. The experimental results show that the best performing model was XGB, which achieved a testing accuracy of 100% and an F1 Score of 88%. The proposed model is computationally efficient and easy to deploy, which ensures a fast, sustainable and low power-consuming intrusion detection system at the cutting edge. Full article

In order to improve the efficiency of electricity theft detection, the power theft detection area and users should be better integrated, we proposed a Blending ensemble learning electricity theft detection model based on the Base Learner Selection Strategy (BLSS). Firstly, the adaptive synthetic (ADASYN) sampling method is used to process the unbalanced power consumption data, and the sample distribution of training data is balanced. Secondly, the BLSS selection method is used to screen the optimal base learner combination and construct the Blending ensemble learning model. Then, based on the historical data, the model makes a short-term prediction of the power consumption of the station area the next day, and focuses on the verification of the suspected energy-stealing station area where the Root Mean Square Percentage Error (RSPE) exceeds the threshold, so as to lock in the potential energy stealing users. Finally, through the comparison and verification of real examples, the search scope for electricity theft inspections was reduced by 79.17%, greatly improving the detection efficiency of the power supply company. At the same time, the model’s electricity theft detection and recognition accuracy rate can be as high as 97.50%. The Blending ensemble learning electricity stealing detection model based on the BLSS base learner selection method has strong electricity stealing detection and recognition ability. Full article

The advanced metering infrastructure (AMI) of the smart grid plays a critical role in energy management and billing by enabling the periodic transmission of consumers’ power consumption readings. To optimize data collection efficiency, AMI employs a “change and transmit” (CAT) approach. This approach ensures that readings are only transmitted when there is enough change in consumption, thereby reducing data traffic. Despite the benefits of this approach, it faces security challenges where malicious consumers can manipulate their readings to launch cyberattacks for electricity theft, allowing them to illegally reduce their bills. While this challenge has been addressed for supervised learning CAT settings, it remains insufficiently addressed in unsupervised learning settings. Moreover, due to the distortion introduced in the power consumption readings due to using the CAT approach, the accurate prediction of future consumption for energy management is a challenge. In this paper, we propose a two-stage approach to predict future readings and detect electricity theft in the smart grid while optimizing data collection using the CAT approach. For the first stage, we developed a predictor that is trained exclusively on benign CAT power consumption readings, and the output of the predictor is the actual readings. To enhance the prediction accuracy, we propose a cluster-based predictor that groups consumers into clusters with similar consumption patterns, and a dedicated predictor is trained for each cluster. For the second stage, we trained an autoencoder and a one-class support vector machine (SVM) on the benign reconstruction errors of the predictor to classify instances of electricity theft. We conducted comprehensive experiments to assess the effectiveness of our proposed approach. The experimental results indicate that the prediction error is very small and the accuracy of detection of the electricity theft attacks is high. Full article