Intrusion detection in advanced metering infrastructure based on consumption pattern

In this paper, we present a novel approach for detecting intrusions in the advanced metering infrastructure (AMI). Unlike traditional intrusion detection systems that use the network features and system behavior for attack detection, we leverage the predictability property of the AMI data. Electricity usage reports and pricing information constitute the major parts of the data traffic in AMI. Considering that electricity consumption patterns of customers follow a statistical model, which is a function of time and price, we introduce long-term anomaly detection and instantaneous anomaly detection of consumption patterns to detect adversarial activities in AMI with long term and short term effects, respectively. The feasibility and efficiency of the proposed approach in detecting various types of adversarial activities against AMI is demonstrated through simulations.