Conference PaperPDF Available


In this paper, a problem of misclassification due to cross pairs across a decision boundary is investigated. A cross pair is a junction of the two opposite class samples. These cross pairs are identified using Tomek links technique. The majority class sample associated with cross pairs are removed to segregate the two opposite classes through an affine decision boundary. Due to non-availability of theft data, six theft cases are used to synthesize theft data to mimic real world scenario. These six theft cases are applied to benign class data, where benign samples are modified and malicious samples are synthesized. Furthermore, to tackle the class imbalance issue a K-means SMOTE is used for the provision of balance data. Moreover, the technical route is to train the model on a time-series data of both classes. Training model on imbalance data tends to misclassification of the samples, due to biasness towards a majority class, which results in a high FPR. The balanced data is provided as an input to a hybrid bi-directional GRU and bi-directional LSTM model. The two classes are efficiently classified with a high accuracy, high detection rate and low FPR.
Electricity Theft Detection in Smart Meters using a
Hybrid Bi-directional GRU Bi-directional LSTM
Shoaib Munawar1, Benish Kabir2, Muhammad Asif2, Pamir2, Ashraf Ullah2, Nadeem Javaid2,
1Department of Electrical Engineering, International Islamic University, Islamabad 44000, Pakistan
2Department of Computer Science, COMSATS University Islamabad, Islamabad 44000, Pakistan
Corresponding author:;
Abstract—In this paper, a problem of misclassification due to
cross pairs across a decision boundary is investigated. A cross
pair is a junction of the two opposite class samples. These cross
pairs are identified using Tomek links technique. The majority
class sample associated with cross pairs are removed to segregate
the two opposite classes through an affine decision boundary.
Due to non-availability of theft data, six theft cases are used to
synthesize theft data to mimic real world scenario. These six theft
cases are applied to benign class data, where benign samples are
modified and malicious samples are synthesized. Furthermore, to
tackle the class imbalance issue a K-means SMOTE is used for
the provision of balance data. Moreover, the technical route is to
train the model on a time-series data of both classes. Training
model on imbalance data tends to misclassification of the samples,
due to biasness towards a majority class, which results in a high
FPR. The balanced data is provided as an input to a hybrid bi-
directional GRU and bi-directional LSTM model. The two classes
are efficiently classified with a high accuracy, high detection rate
and low FPR.
Index Terms—Smart meters, BiGRU, BiLSTM, Tomek links,
Theft cases, FPR
A power system infrastructure consists of three phases:
power generation, transmission and distribution [1]. Power
is generated at high voltages in power stations and it is
transmitted through transmission lines. These high voltages
in transmission lines are stepped down and a low compatible
voltage level is supplied to electricity consumers via distribu-
tion system. Generally, consumers are connected to a low-
voltage station. A utility provider (UP) intelligently moni-
tors consumers’ consumed energy by deploying smart meters
(SMs) on customer premises [2]. The supplied electric energy
undergoing these three phases suffers from some undesirable
losses, namely, technical losses (TLs) and non technical losses
(NTLs) [3]. TLs are natural occurring losses in a power system
due to energy dissipated in conductors, transformers, etc.,
whilst NTLs are malicious activities adopted by fraudulent
consumers, connected on a low-voltage station. A major
concern of these malicious activities is to under-report the
consumed energy in order to reduce the electricity billing.
Fraudulent consumers attempt malicious activities by adopting
various approaches like meter tampering with shunt devices,
double tapping and electronic faults [4]. These malicious
activities over burden UP and increases energy demand. The
smooth power flow of supplied energy is disrupted, which
causes a huge revenue loss. The authors in [5] estimated
that losses on distribution side have been increased from
11% to 16% between the years 1980-2000, which indicate
that increasing losses are the most conspicuous issues. These
revenue losses vary from country to country. For an instance,
nearly 20% of the total generated energy loss is reported in
India due to occurrence of malicious activities [6]. Similarly,
developed countries, United States, United Kingdom, Brazil,
Russia, Canada etc., are also effected by these issues. Statistics
in [7]-[8] report a 10% , 16% and 100 million dollars revenue
loss in Russia, Brazil and Canada, respectively. Worldwide, a
recent report indicates a revenue loss of 96 billion dollars due
to these malicious activities [9].
Concerning the electrical theft problem, in the existing lit-
erature, various countermeasure approaches to identify and
investigate the theft occurrence. One of the major approaches
is to target advanced metering infrastructure (AMI). AMI pro-
vides the sequential data, which is analysed for the detection
of malicious behaviour. Furthermore, a mutual strategy of
considering sequential and non-sequential data is opted for the
enhancement of theft detection. Sequential data comprises of
SMs’ consumption data whilst non-sequential is an auxiliary
data containing geographical and demographical attributes of
the consumers. Moreover, neighbourhood area network (NAN)
and morphological patterning approaches tend to identify the
maliciousness in customers’ premises. A NAN is a cluster of
customers’ connected to a low voltage side of a transformer. In
NAN topology, an observer meter is installed on the low volt-
age side of the transformer, which monitors the total consumed
energy of corresponding consumers. TLs are adjusted numeri-
cally through a constant within a NAN, in order to achieve the
relevancy in readings of observer meter and consumers’ SMs.
However, morphological patterning focuses on the forecasting
of consumers’ behaviour. Forecasting of the consumed energy
is based on the historic consumption patterns of consumers.
The irrelevancy between the historic and forecasted pattern
identifies the maliciousness in electricity consumption.
A. List of Contributions
The contributions of this work are enlisted as follows.
To overcome the class imbalance issue, six theft cases are
used to synthesize theft data. Later on, K-means SMOTE,
a data over sampling technique, is used for the provision
of balanced data.
Cross pairs identified and removed using Tomek links.
In order to solve the misclassification issue, a hybrid
model of bi-directional gated recurrent unit (Bi-GRU) and
bi-directional long term short term memory (Bi-LSTM)
is used. Additionally, an efficient theft detection method
is developed.
This section provides an overview of the existing literature
related to electricity theft detection (ETD) in SMs.
A. Considering Sequential Data
NTLs in large portion are due to the energy theft.
Detection algorithms analyse the severity and period of
the energy theft. Generally, theft detection is based on the
historic monitored data of a customer’s SM. These detection
approaches are categorized as data-oriented, network-oriented
and hybrid-oriented. Solution proposed in [22] is data driven
approach. An ensemble bagged tree (EBT) algorithm, which
consists of many decision trees is used to detect NTLs.
However, a small change in data disrupts the structure of
the optimal decision trees (DTs). In [17], a solution based
on boosting classifiers, a gradient boosting classifier (GBCs)
detector, is introduced considering intentional theft, though
non-fraud anomalies are ignored. GBCs detector is based on
categorical boosting (CatBoost), extreme gradient boosting
(XGBoost) and light gradient boosting (LGBoost), which
is computationally expensive due to large number of trees.
Besides that, it takes a large execution time and more memory.
In [27], the authors address issues of imbalanced data nature
and dense time-series data consequences. A maximal over
lapped discrete wavelet-packet transform (MODWPT) method
is used to reduce high data dimensionality issue and to
extract the abstract features whilst a random under sampling
boosting (RUSBoost) algorithm is used for data balancing
[34]. However, RUSBoost eliminates the key features which
results in information loss to a large extent. Similarly, in
[29], to tackle data imbalance issue, SMOTE a data balancing
technique, is used to balance the imbalanced data. While
balancing the data, SMOTE considers neighbouring samples
from the opposite classes and synthesizes the sample which
is the injection of an additional noise to the data. In [18],
[19], [20] CNN, CNN-RF and CNN-LSTM are developed,
respectively. However, CNN has a maxpooling operation,
which is significantly slower. So forth literature in [23],
presents a semi-supervised auto-encoder (SSEA), which
learns the advanced features such as current, voltage and
active power from the available SMs’ data. However, the
results are not accurate and are less stable. Moreover, authors
in [25] propose XGBoost technique for the detection of
anomalies, whereas, computational and time complexity
constrains are being ignored.
Solutions proposed in [10], [11], [12], focuses on the
consideration of non sequential data along with the SMs’
data to detect maliciousness. However, non malicious factors
and data leakage during training of the model, are beyond
the scope of this study.
B. Investigating Neighbourhood Area Network
A network-oriented approach requires a hardware based
infrastructure, which enhances precision. A neighbourhood
area network (NAN) based mechanism developed in [13], [15]
identifies the benign and theft customers. However, interpret-
ing of one’s consumer reading by a nearby neighbour is not
pinpointed. Similarly, in [26], the authors develop an ensemble
technique of maximum information coefficient (MIC) and
clustering technique by fast search and find of density peaks
(CFSFDP). MIC is used for correlation between the observer
meter’s data and NTLs whilst CFSFDP is used to investigate
the morphology of massive amount of consumption patterns.
Though, changes due to non malicious factors in the observer
meter are not tackled.
C. Monitoring Morphological Patterning
The work in [14], develops a decision tree combined K-
nearest neighbour and support vector machine (DTKSVM)
technique to investigate anomalies. However, non malicious
factors are not considered, which tend to misclassification in
this scenario. A LSTM model is used by [24], [33] to forecast
future energy consumption curves and to compare it with the
most common historic consumption profiles of the customers.
LSTM based model requires the larger memory bandwidth and
excessive computational complexities. To further enhance the
electricity theft detection accuracy, in [16] a morphological
aspect of the consumer’s pattern is observed by deploying a
stacked sparse denoising autoencoder (SSDAE). An estimated
noise is added to cope the non malicious factors, which is not
a suitable assumption. Moreover, in [28] authors tackle NTLs
using linear and categorical enhanced regression based scheme
for detection of energy theft smart meters (LR-ETDM, CVLR-
ETDM) algorithms. However, LR is sensitive to outliers. Non
malicious factors cause a depicted outlier scenario, which
disrupts the model performance and result a bad accuracy. In
[29], authors propose an anomaly pattern detection hypothesis
testing (APD-HT) scenario to investigate the malicious users.
However, this model fails to detect variations in the reading
of SMs’ due to non malicious factors.
TABLE I: Mapping of Limitations and Proposed Solutions
Limitations to be Addressed Solutions to be Proposed Validations to be
L1: Data leakage during train-
S1: Stratified methodol-
V1: Figs. 4 and 5
L2: Problem of imbalanced
S2: Using K-means
V2: Performance
measurement with
existing model
L3: Misclassification due to
cross pairs
S3: Using Tomek links V3: Table 2
The proposed solution for NTL detection is shown in Fig.
1. In the figure, the proposed solution is a hybrid electricity
theft detector, which has three phases: data preprocessing, data
augmentation and classification. These three phases typically
consists of 6 main steps.
In step (1), the data is preprocessed, missing values and
outliers are filled and removed, respectively. Usually,
missing values degrade the model’s accuracy due to
the noisy and ambiguous data. To clean the data for
fair training of the model, a simple imputer method
is proposed. The missing values are filled using mean
In step (2), the cleaned data is then passed to the next
step in which data augmentation is performed. In real
world, fraudulent consumers’ samples are rare. Training
of the model on such imbalanced dataset leads to biasness
towards a majority class; therefore, data balancing is a
necessary requirement.
In step (3), six theft cases are applied to benign class
samples. Correspondingly, six theft samples are generated
for each of the benign sample. In this way, the number
of theft class samples are increased from the available
benign class samples.
In step (4), a Tomek links technique is used to identify
the cross pairs across the decision boundary. The asso-
ciated majority class sample from the cross pairs is then
removed while keeping the information preserved.
In step (5), the stratified available data is then passed to
the next phase for classification purpose.
In step (6), a hybrid bi-directional GRU and bi-directional
LSTM model is developed and time series data is passed.
A sigmoid function is used for the final classification. Bi-
directional LSTM is suitable to handle a high dimensional
time sequence data whilst a bi-directional GRU is a fast
module that is used for avoiding computational complex-
A. Data Preprocessing
Data preprocessing technique is used to transform the raw
data into usable format. Electricity consumption data is a high
dimensional time-series data. Analysing such a huge data is
impractical and takes very long execution time. The time-series
data contains certain missing values and outliers. Training
a model with such a data compromises the accuracy of the
forecasting model. Therefore, the missing values and filled
without compromising the original data’s integrity. Training
a model with such a data compromises the accuracy of the
forecasted results. In our case, a simple imputer technique is
applied to fill the NaN values. An independent mean strategy
is applied to fill the NaN values. It is a fast and an easy
B. Data Augmentation and Balancing
In the real world, malicious samples rarely exist. A balanced
dataset is required to train ML and deep learning (DL) models.
Training on an imbalanced dataset causes biasness towards
a majority class, which leads to misclassification. There are
many synthetic data generating techniques to tackle these
issues such as undersampling and oversampling techniques.
Undersampling techniques work on a majority class to discard
redundant data, which leads to information loss. On the other
hand, oversampling techniques duplicates the minority class
to generate synthetic samples that is prone to overfitting. In
our scenario, we are using six theft cases to mimic real world
theft data. The following six theft cases are used in this paper
to generate synthetic data sample:
T1(s t) = s t random(0.1,0.9),(1)
T2(s t) = s t x t(x t =random(0.1,0.9)),(2)
T3(s t) = s t random[0,1],(3)
T4(s t) = mean(s)random(0.1,1.0),(4)
T5(s t) = mean(s),(5)
T6(s t) = S T t(W here T is sample time).(6)
In theft case 1, as shown in Fig. 2, the benign class
samples are modified by multiplying them to a random
number ranges between (0.1-0.9).
In theft case 2, as shown in Fig. 2, to mimic a disconti-
nuity in the consumption pattern, the benign class values
are manipulated by multiplying with a random number
within the range of (0.1 , 1.0).
In theft case 3, SMs’ readings are manipulated by multi-
plying them with 1 or 0. In zero multiplication scenario,
patterns multiplied with 0 show no consumption during
that timestamp. However, multiplication with 1 tries to
inhibit a historic constant minimal energy usage pattern,
which under-reports the usage in an intelligent induction,
as shown in Fig. 2.
In theft case 4, a mean of the total consumption is
multiplied by a random state between (0.1-0.9) to under-
report SMs’ readings, as shown in Fig. 3.
In theft case 5, a simple mean consumption of the total
consumed energy is taken, as shown in Fig. 3. The mean
represents a consistent consumption throughout a time
In theft case 6, as shown in Fig. 3, peak hours are
swapped with off peak hours. The swap is the reverse
of actual electricity utilization during that time span.
A synthetic theft data is then generated using these theft
Input Data
Smart Meter
Cross Pairs
Classication and prediction
Balanced Data
Class e
Six e Tomek Link
Data Balancing
Time Series Data
Cross Pairs
Yt-1 Yt Yt+1
Xt-1 Xt+1Xt
Bi-directional LSTM Bi-directional GRU
y1 y2 y3
x1 x2 x3
L.1 Imbalanced data set
Limitations Addressed
L.2 Identication of cross pairs
L.3 Data Leakage Problem
Fig. 1: The Proposed System Model
C. Bi-drirectional LSTM
RNN suffers from gradient vanishing problem and to resolve
the problem, a BiLSTM is developed for preserving the long
distance information [23]. A BiLSTM model processes a
temporal data sequence. It consists of two LSTMs. Past and
future information is accessed through forward and backward
directions. One is fed with time series data in forward direction
while the other with a reversed copy of the input sequence
data. This mode of feeding input data increases the amount
of available information. It has the capability of driving its
gates according to its own need. A BiLSTM learns faster than
a single LSTM. While developing a BiLSTM, two copies of
hidden layers are created. The outputs of these layers are then
concatenated [30].
The performance of the hybrid BiGRU-BiLSTM model
is evaluated using DR, FPR, AUC score and accuracy. A
confusion matrix is a base for all these measuring parameters.
Confusion matrix divides the dataset into four basic parts:
true positive (TP), false positive (FP), true negative (TN)
and false negative (FN). TP and TN show the correctly
predicted positive and negative samples whilst FP and FN
show the falsely classified negative samples as positive and
positive samples as negative, respectively. Similarly, DR is the
sensitivity of the model and it refers to a TPR in the literature.
It is a ratio of the detected abnormal samples to the total
number of abnormal samples. Mathematical representation of
DR is shown in Eq. (7).
DR =T P /(T P +F N ).(7)
FPR is an important aspect of the evaluation matrix. In
literature it is referred as false alarms. It is an incorrect
consideration of negative samples as a positive. A high FPR
is an expensive parameter resulting in an on-site verification,
which leads to time utilization and increased monetary cost.
Mathematically FPR is shown in Eq. (8).
FPR =F P /(F P +T N ).(8)
Fig. 2: Theft Cases 1, 2 and 3
Fig. 3: Theft Cases 4, 5 and 6
This section focuses on the simulation results of our pro-
posed hybrid model. We have evaluated our proposed model
using the electricity consumption data of residential con-
sumers. At first, consumers having similar class are identified
and labelled to understand their behaviour. Label 0 represents
a benign class samples whilst label 1 stands for a theft class
sample. The consumers consumption is monitored after every
thirty minutes. A total of 48 features are extracted for a single
day’s energy consumption. Theft samples are synthesized by
applying six theft cases on the benign class. The synthesised
theft data is concatenated with the benign class data. The
concatenated data is then balanced using K-means SMOTE
technique. Before training of the model, the two classes are
segregated by a decision boundary. The decision boundary
is inrushed with cross pairs, which degrade the model’s
efficiency. These cross pairs are identified and are removed
using Tomik links.
In Fig. 4, the performance of the proposed BiGRU-BiLSTM
is compared with an existing CNN-LSTM model [31]. The
TABLE II: Identification of Cross Pairs
Total Samples (be-
Identification of
Cross Pairs
Remaining Samples
5194 51 5143
Fig. 4: AUC of the proposed BiLSTM-BiGRU and exist-
ing GRU-LSTM Model
Fig. 5: PRC of the proposed BiGRU-BiLSTM and exist-
ing CNN-LSTM Model
plots in Fig. 4, indicate the AUC of the existing and proposed
models. Based on the classification accuracy, initially, both of
the models perform quite well, showing a higher TPR with the
lowest FPR when AUC score is 0.60. It is observed that with
a small data, hybrid CNN-LSTM classifies the samples with a
low FPR. However, at AUC score of 0.63, it misclassifies the
samples, which increases FPR. In range of AUC score 0.63-
0.87, the performance of CNN-LSTM model fluctuates with
an increasing FPR. Similarly, in range of AUC score 0.60-
0.87, the proposed BiGRU-BiLSTM model performs much
better as compared to CNN-LSTM with an increased TPR.
However, as the amount of data is increased, the proposed
BiGRu-BiLSTM model achieves a maximum peak of 0.93.
Our hybrid model beats its opponent model with a high TPR
and achieves a high rate of accurate classification. Moreover,
a PRC curve is used to evaluate performance of the binary
classification. The performance of the proposed model is
shown in Fig. 5. The figure 5 shows that a low PRC rate is
not a suitable choice. It causes high rate of misclassification.
Misclassification increases FPR and burdensome the UPs for
an excessive on-site clarification effort, which is an expensive
In this paper, a hybrid BiLSTM and BiGRU based model
is proposed for the detection of NTLs. Initially, an affine
classification boundary is defined between the benign and
theft samples. The cross pairs are identified using Tomek
links and the majority class sample is then removed from
the identified cross pairs. Afterwards, six theft attacks are
applied on the benign class data to synthesize theft class data.
For a single benign sample, six theft variants are generated.
K-means SMOTE technique is applied on the benign class
for the provision of balanced data. It makes clusters of the
samples and minority data is oversampled. The balanced data
is split into training and testing data. The proposed BiGRU-
BiLSTM model is tested on unseen samples and it achieves an
accuracy of 93%. An existing CNN-LSTM model is trained
and tested on the same data; however, it fails to provide the
precise output as compared to the proposed BiGRU-BiLSTM
model. Our future work will include feature engineering based
preprocessing to make the proposed model more efficient and
[1] Grigsby, Leonard L., ed. Electric power generation, transmission, and
distribution. CRC press, 2018.
[2] Yu, X., Cecati, C., Dillon, T., & Simoes, M. G. (2011). The new frontier
of smart grids. IEEE Industrial Electronics Magazine, 5(3), 49-63.
[3] Depuru, S. S. S. R., Wang, L., & Devabhaktuni, V. (2011). Electricity
theft: Overview, issues, prevention and a smart meter based approach to
control theft. Energy policy, 39(2), 1007-1015.
[4] M. Buzau, J. Tejedor-Aguilera, P. Cruz-Romero and A. G´
osito, ”Hybrid Deep Neural Networks for Detection of Non-
Technical Losses in Electricity Smart Meters,” in IEEE Transactions
on Power Systems, vol. 35, no. 2, pp. 1254-1263, March 2020
[5] World Bank. (2003). World development report 2004: making services
work for poor people. The World Bank.
[6] Gaur, V., & Gupta, E. (2016). The determinants of electricity theft: An
empirical analysis of Indian states. Energy Policy, 93, 127-136.
[7] Bhatti, S. S., Lodhi, M. U. U., ul Haq, S., Gardezi, S. N. M., Javaid, E. M.
A., Raza, M. Z., & Lodhi, M. I. U. (2015). Electric power transmission
and distribution losses overview and minimization in Pakistan. Interna-
tional Journal of Scientific & Engineering Research, 6(4), 1108-1112.
[8] [8] Buzau, M. M., Tejedor-Aguilera, J., Cruz-Romero, P., & G´
osito, A. (2019). Hybrid deep neural networks for detection of non-
technical losses in electricity smart meters. IEEE Transactions on Power
Systems, 35(2), 1254-1263.
[9] Smart Meters help reduce electricity theft increase safety BC Hydro, inc,
vancouvers BC,Canada,Mar, 2011
[10] Saeed, M. S., Mustafa, M. W., Sheikh, U. U., Jumani, T. A., & Mirjat,
N. H. (2019). Ensemble bagged tree based classification for reducing
non-technical losses in multan electric power company of Pakistan.
Electronics, 8(8), 860.
[11] R.PunmiyaandS.Choe,”Energy Theft Detection Using Gradient Boosting
Theft Detector With Feature Engineering-Based Preprocessing,” in IEEE
Transactions on Smart Grid, vol. 10, no. 2, pp. 2326-2329, March 2019,
doi: 10.1109/TSG.2019.2892595.
[12] Buzau, M. M., Tejedor-Aguilera, J., Cruz-Romero, P., & G´
osito, A. (2018). Detection of non-technical losses using smart meter
data and supervised learning. IEEE Transactions on Smart Grid, 10(3),
[13] Biswas,P.P.,Cai,H.,Zhou,B.,Chen,B.,Mashima,D.,&
Zheng,V.W.(2019).Electricity theft pinpointing through correlation
analysis of master and individual meter readings.IEEE Transactions on
Smart Grid, 11(4), 3031-3042.
[14] [14] Li, S., Han, Y., Yao, X., Yingchen, S., Wang, J., & Zhao, Q. (2019).
Electricity theft detection in power grids with deep learning and random
forests. Journal of Electrical and Computer Engineering, 2019.
[15] Hasan,M.,Toma,R.N.,Nahid,A.A.,Islam,M.M.,&
Kim,J.M.(2019).Electricity theft detection in smart grid systems: A
CNN-LSTM based approach. Energies, 12(17), 3310.
[16] [16] Lu, X., Zhou, Y., Wang, Z., Yi, Y., Feng, L., & Wang, F. (2019).
Knowledge embedded semi-supervised deep learning for detecting non-
technical losses in the smart grid.Energies, 12(18), 3452.
[17] Z. Zheng, Y. Yang, X. Niu, H. Dai and Y. Zhou, ”Wide and Deep
Convolutional Neural Networks for Electricity-Theft Detection to Secure
Smart Grids,” in IEEE Transactions on Industrial Informatics, vol. 14, no.
4, pp. 1606-1615, April 2018, doi: 10.1109/TII.2017.2785963.
[18] Yan, Z., & Wen, H. (2021). Electricity theft detection base on extreme
gradient boosting in AMI. IEEE Transactions on Instrumentation and
Measurement, 70, 1-9.
[19] M. Buzau, J. Tejedor-Aguilera, P. Cruz-Romero and A. G´
osito, ”Hybrid Deep Neural Networks for Detection of Non-
Technical Losses in Electricity Smart Meters,” in IEEE Transactions
on Power Systems, vol. 35, no. 2, pp. 1254-1263, March 2020
[20] M. M. Buzau, J. Tejedor-Aguilera, P. Cruz-Romero and A. G´
osito, ”Detection of Non-Technical Losses Using Smart Meter Data
and Supervised Learning,” in IEEE Transactions on Smart Grid, vol. 10,
no. 3, pp. 2661-2670, May 2019, doi: 10.1109/TSG.2018.2807925.
[21] Ismail, M., Shaaban, M. F., Naidu, M., & Serpedin, E. (2020). Deep
learning detection of electricity theft cyber-attacks in renewable dis-
tributed generation. IEEE Transactions on Smart Grid, 11(4), 3428-3437.
[22] P. Jokar, N. Arianpoo and V. C. M. Leung, ”Electricity Theft De-
tection in AMI Using Customers’ Consumption Patterns,” in IEEE
Transactions on Smart Grid, vol. 7, no. 1, pp. 216-226, Jan. 2016, doi:
[23] Liu,Y.,Liu,T.,Sun,H.,Zhang,K.,& Liu,P.(2020).Hidden electricity theft by
exploiting multiple-pricing scheme in smart grids. IEEE Transactions on
Information Forensics and Security, 15, 2453-2468.
[24] Zheng,K.,Chen,Q.,Wang,Y.,Kang,C.,& Xia,Q.(2018).A novel combined
data-driven approach for electricity theft detection. IEEE Transactions on
Industrial Informatics, 15(3), 1809-1819.
[25] Kong, X., Zhao, X., Liu, C., Li, Q., Dong, D., & Li, Y. (2021). Electricity
theft detection in low-voltage stations based on similarity measure and
DT-KSVM. International Journal of Electrical Power & Energy Systems,
125, 106544.
[26] Fenza, G., Gallo, M., & Loia, V. (2019). Drift-aware methodology for
anomaly detection in smart grid. IEEE Access, 7, 9645-9657.
[27] Huang, Y., & Xu, Q. (2021). Electricity theft detection based on stacked
sparse denoising autoencoder. International Journal of Electrical Power &
Energy Systems, 125, 106448.
[28] Yip, S. C., Wong, K., Hew, W. P., Gan, M. T., Phan, R. C. W., & Tan, S.
W. (2017). Detection of energy theft and defective smart meters in smart
grids using linear regression. International Journal of Electrical Power &
Energy Systems, 91, 230-240.
[29] Park, C. H., & Kim, T. (2020). Energy Theft Detection in Advanced
Metering Infrastructure Based on Anomaly Pattern Detection. Energies,
13(15), 3832.
[30] Hu, Jie & Li, Shaobo & Hu, Jianjun & Guanci, Yang. (2018). A
Hierarchical Feature Extraction Model for Multi-Label Mechanical Patent
Classification. Sustainability. 10. 219. 10.3390/su10010219.
[31] Hasan, M., Toma, R. N., Nahid, A. A., Islam, M. M., & Kim, J. M.
(2019). Electricity theft detection in smart grid systems: A CNN-LSTM
based approach. Energies, 12(17), 3310.
[32] Khalid, R., Javaid, N., Al-Zahrani, F. A., Aurangzeb, K., Qazi, E. U. H.,
& Ashfaq, T. (2020). Electricity load and price forecasting using Jaya-
Long Short Term Memory (JLSTM) in smart grids. Entropy, 22(1), 10.
[33] Aslam, Z., Javaid, N., Ahmad, A., Ahmed, A., & Gulfam, S. M. (2020).
A Combined Deep Learning and Ensemble Learning Methodology to
Avoid Electricity Theft in Smart Grids. Energies, 13(21), 5599.
[34] Adil, M., Javaid, N., Qasim, U., Ullah, I., Shafiq, M., & Choi, J. G.
(2020). LSTM and bat-based RUSBoost approach for electricity theft
detection. Applied Sciences, 10(12), 4378.
In this project, the online monitoring systems to classify the leakage current of 15 kV and 25 kV distribution insulators were installed in mountain areas in Taiwan. The convolution neural network bidirectional Long Short-Term Memory (CNN-Bi-LSTM) was employed to categorize the leakage current levels based on the field experiences of the TaiPower company. The sequential weather factors and the different distribution insulators leakage current were collected every hour and utilized in the proposed model's learning process. In addition, a simple grid search parameter optimization was implemented to identify the optimum architecture of CNN-Bi-LSTM for each data collection. Moreover, the optimized CNN-Bi-LSTM structure performances were evaluated and compared with the gated recurrent unit (GRU), LSTM, CNN-LSTM, and Bi-LSTM neural networks. The experiments results proved that the proposed CNN-Bi-LSTM improved the category cross-entropy error, the accuracy, and the precision metric with a maximum enhancement of 71.331%, 14.382%, and 14.042% in the training data and 91.250%, 17.529%, and 17.343% in the validating data, respectively. Moreover, the experiment outcomes in different data models prove that the 24-sequential weather parameters have a significant impact on the achievement of CNN-Bi-LSTM in categorizing the leakage current. The optimized CNN-Bi-LSTM structures were applied in the online monitoring systems to provide a better schedule for maintenance operations at the Taipower company.
Full-text available
Electricity is widely used around 80\% of the world. Electricity theft has dangerous effects on utilities in terms of power efficiency and costs billions of dollars per annum. The~enhancement of the traditional grids gave rise to smart grids that enable one to resolve the dilemma of electricity theft detection (ETD) using an extensive amount of data formulated by smart meters. This data are used by power utilities to examine the consumption behaviors of consumers and to decide whether the consumer is an electricity thief or benign. However, the traditional data-driven methods for ETD have poor detection performances due to the high-dimensional imbalanced data and their limited ETD capability. In this paper, we present a new class balancing mechanism based on the interquartile minority oversampling technique and a combined ETD model to overcome the shortcomings of conventional approaches. The combined ETD model is composed of long short-term memory (LSTM), UNet and adaptive boosting (Adaboost), and termed LSTM--UNet--Adaboost. In~this~regard, LSTM--UNet--Adaboost combines the advantages of deep learning (LSTM-UNet) along with ensemble learning (Adaboost) for ETD. {Moreover, the performance of the proposed LSTM--UNet--Adaboost scheme was simulated and evaluated over the real-time smart meter dataset given by the State Grid Corporation of China. The simulations were conducted using the most appropriate performance indicators, such as area under the curve, precision, recall and F1 measure. The proposed solution obtained the highest results as compared to the existing benchmark schemes in terms of selected performance measures. More specifically, it achieved the detection rate of 0.92, which~was the highest among existing benchmark schemes, such as logistic regression, support vector machine and random under-sampling boosting technique. Therefore, the simulation outcomes validate that the proposed LSTM--UNet--Adaboost model surpasses other traditional methods in terms of ETD and is more acceptable for real-time practices.
Full-text available
Energy theft refers to the intentional and illegal usage of electricity by various means. A number of studies have been conducted on energy theft detection in the advanced metering infrastructure using machine learning methods. However, applying machine learning for energy theft detection has a problem in that it is difficult to obtain enough electricity theft data to train a machine learning model. In this paper, we propose a method based on anomaly pattern detection to detect electricity theft in data streams generated from smart meters. The proposed method requires only normal energy consumption data to train the model. Previous usage records of customers being monitored are not needed for energy theft detection. This characteristic makes the proposed method applicable in real situations. Experiments were conducted using real smart meter data and artificial attack data, including the preprocessing of daily consumption vectors by standard normalization, the construction of an outlier detection model on normal electricity consumption data of randomly chosen customers, and the application of anomaly pattern detection on test data streams. Some promising results were obtained, notably, that attacks of types 4, 5, 6 were detected with an average F1 value of 0.93 and average delay of 19 days.
Full-text available
The electrical losses in power systems are divided into non-technical losses (NTLs) and technical losses (TLs). NTL is more harmful than TL because it includes electricity theft, faulty meters and billing errors. It is one of the major concerns in the power system worldwide and incurs a huge revenue loss for utility companies. Electricity theft detection (ETD) is the mechanism used by industry and academia to detect electricity theft. However, due to imbalanced data, overfitting issues and the handling of high-dimensional data, the ETD cannot be applied efficiently. Therefore, this paper proposes a solution to address the above limitations. A long short-term memory (LSTM) technique is applied to detect abnormal patterns in electricity consumption data along with the bat-based random under-sampling boosting (RUSBoost) technique for parameter optimization. Our proposed system model uses the normalization and interpolation methods to pre-process the electricity data. Afterwards, the pre-processed data are fed into the LSTM module for feature extraction. Finally, the selected features are passed to the RUSBoost module for classification. The simulation results show that the proposed solution resolves the issues of data imbalancing, overfitting and the handling of massive time series data. Additionally, the proposed method outperforms the state-of-the-art techniques; i.e., support vector machine (SVM), convolutional neural network (CNN) and logistic regression (LR). Moreover, the F1-score, precision, recall and receiver operating characteristics (ROC) curve metrics are used for the comparative analysis.
Full-text available
Unlike the existing research that focuses on detecting electricity theft cyber-attacks in the consumption domain, this paper investigates electricity thefts at the distributed generation (DG) domain. In this attack, malicious customers hack into the smart meters monitoring their renewable-based DG units and manipulate their readings to claim higher supplied energy to the grid and hence falsely overcharge the utility company. Deep machine learning is investigated to detect such a malicious behavior. We aim to answer three main questions in this paper: a) What are the cyber-attack functions that can be applied by malicious customers to the generation data in order to falsely overcharge the utility company? b) What sources of data can be used in order to detect these cyber-attacks by the utility company? c) Which deep machine learning-model should be used in order to detect these cyber-attacks? Our investigation revealed that integrating various data from the DG smart meters, meteorological reports, and SCADA metering points in the training of a deep convolutional-recurrent neural network offers the highest detection rate (99.3%) and lowest false alarm (0.22%).
Full-text available
Electricity theft costs utility companies billions of dollars worldwide annually. The electricity consumption data recorded by consumers' smart meters, coupled with the aggregate energy supply data recorded by master meters provide a new opportunity to pinpoint the source of electricity theft. Existing works on electricity theft pinpointing either assume linear attack modes which often limit their capability in identifying nonlinear electricity theft behaviours, or incur extra cost for model training or sensor installation. Our insight hinges upon the fact that the value of electricity theft loss (ETL) should be more correlated to the meter readings of energy thieves than to those of honest consumers. Guided by this insight, we formulate the problem of electricity theft pinpointing as a time-series correlation analysis problem which does not require linearity assumption of attack modes or any cost of training. Two coefficients are defined to evaluate the suspicion level of a consumer's reported energy consumption pattern. A comprehensive set of experiments has been conducted on a real-world energy usage dataset with several types of attacks, and the results show that our proposed technique significantly improves the pinpointing accuracy when compared with other state-of-the-art methods.
Full-text available
As one of the major factors of the nontechnical losses (NTLs) in distribution networks, the electricity theft causes significant harm to power grids, which influences power supply quality and reduces operating profits. In order to help utility companies solve the problems of inefficient electricity inspection and irregular power consumption, a novel hybrid convolutional neural network-random forest (CNN-RF) model for automatic electricity theft detection is presented in this paper. In this model, a convolutional neural network (CNN) firstly is designed to learn the features between different hours of the day and different days from massive and varying smart meter data by the operations of convolution and downsampling. In addition, a dropout layer is added to retard the risk of overfitting, and the backpropagation algorithm is applied to update network parameters in the training phase. And then, the random forest (RF) is trained based on the obtained features to detect whether the consumer steals electricity. To build the RF in the hybrid model, the grid search algorithm is adopted to determine optimal parameters. Finally, experiments are conducted based on real energy consumption data, and the results show that the proposed detection model outperforms other methods in terms of accuracy and efficiency.
Metering data from the advanced metering infrastructure can be used to find abnormal electricity behavior for the detection of electricity theft, which causes huge financial losses to electric companies every year. This article proposes an electricity theft detector using metering data based on extreme gradient boosting (XGBoost). The metering data are preprocessed, including recover missing and erroneous values and normalization. The classification model based on XGBoost is trained using both benign and malicious samples. Simulations are done by using the Irish Smart Energy Trails data set with six certain attack types. Compared with the support vector machine, decision tree, and other eight machine learning methods, the proposed method can detect electricity theft with either higher accuracy or lower false-positive rate. Experiment results also demonstrate that the proposed method is robust when the data are imbalanced. Our codes are available at .
The theft of electricity affects power supply quality and safety of grid operation, and non-technical losses (NTL) have become the major reason of unfair power supply and economic losses for power companies. For more effective electricity theft inspection, an electricity theft detection method based on similarity measure and decision tree combined K-Nearest Neighbor and support vector machine (DT-KSVM) is proposed in the paper. Firstly, the condensed feature set is devised based on feature selection strategy, typical power consumption characteristic curves of users are obtained based on kernel fuzzy C-means algorithm (KFCM). Next, to solve the problem of lack of stealing data and realize the reasonable use of advanced metering infrastructure (AMI). One dimensional Wasserstein generative adversarial networks (1D-WGAN) is used to generate more simulated stealing data. Then the numerical and morphological features in the similarity measurement process are comprehensively considered to conduct preliminary detection of NTL. And DT-KSVM is used to perform secondary detection and identify suspicious customers. At last, simulation experiments verify the effectiveness of the proposed method.
Inspired by the powerful feature extraction and the data reconstruction ability of autoencoder, a stacked sparse denoising autoencoder is developed for electricity theft detection in this paper. The technical route is to employ the electricity data from honest users as the training samples, and the autoencoder can learn the effective features from the data and then reconstruct the inputs as much as possible. For the anomalous behavior, since it contributes little to the autoencoder, the detector returns to a comparatively higher reconstruction error; hence the theft users can be recognized by setting an appropriate error threshold. To improve the feature extraction ability and the robustness, the sparsity and noise are introduced into the autoencoder, and the particle swarm optimization algorithm is applied to optimize these hyper-parameters. Moreover, the receiver operating characteristic curve is put forward to estimate the optimal error threshold. Finally, the proposed approach is evaluated and verified using the electricity dataset in Fujian, China.
With the development of demand response technologies, the pricing scheme in smart grids is moving from flat pricing to multiple pricing (MP), which facilitates the energy saving at the consumer side. However, the flexible pricing policy may be exploited for the stealthy reduction of utility bills. In this paper, we present a hidden electricity theft (HET) attack by exploiting the emerging MP scheme. The basic idea is that attackers can tamper with smart meters to cheat the utility that some electricity is consumed under a lower price. To construct the HET attack, we propose an optimization problem aiming at maximizing the attack profits while evading current detection methods, and design two algorithms to conduct the attack on smart meters. Moreover, we disclose and exploit several new vulnerabilities of smart meters to demonstrate the feasibility of HET attacks. To protect smart grids against HET attacks, we propose several defense and detection countermeasures, including selective protection on smart meters, limiting the attack cycle, and updating the billing mechanism. Extensive experiments on a real data set demonstrate that the attack could cause high economic losses, and the proposed countermeasures could effectively mitigate the attack’s impact at a low cost.