A Deep Learning-Based Intrusion Detection System for Multiclass Cyber-Attack Detection in Smart Grids Advanced Metering Infrastructure (Published)
Smart grids are promising innovations that integrate digital communication technologies, sensors, distributed energy resources, and storage systems to enable real-time monitoring, intelligent control, and efficient energy management. While these technologies improve reliability, efficiency, and responsiveness through two-way communication between utilities and consumers, they also expose Advanced Metering Infrastructure (AMI) systems to significant cybersecurity threats. To address these challenges, this work proposes a deep learning-based intrusion detection system for detecting cyber-attacks in smart grid environments. The framework emphasizes the need for scalable and intelligent Meter Data Management Systems capable of supporting real-time analytics, demand forecasting, distributed asset optimization, and enhanced cybersecurity. Using the BoT-IoT dataset, extensive preprocessing techniques were applied, including data cleaning, feature encoding, normalization, and sequence-based dataset restructuring. Two recurrent deep learning models, Recurrent Neural Network (RNN) and Bidirectional Long Short-Term Memory (Bi-LSTM), were developed for multiclass classification of network traffic into five categories: Distributed Denial of Service, Denial of Service, Reconnaissance, Theft, and Normal traffic. Experimental findings revealed that both models achieved strong detection capabilities. However, the Bi-LSTM model significantly outperformed the RNN model across all evaluation metrics. The Bi-LSTM achieved 99.12% accuracy, 87.26% precision, 97.82% recall, 91.81% macro F1-score, and 99.96% AUC-ROC, demonstrating superior ability in detecting minority attack classes while reducing false positives. The RNN model achieved accuracy (97.29%), precision (66.59%), recall (96.55%), macro F1-score (72.55%) and AUC-ROC (99.86%). The results confirm the effectiveness of bidirectional sequence learning in capturing temporal dependencies in network traffic and highlight the proposed framework’s potential for strengthening cybersecurity and resilience in smart grid AMI systems.
Keywords: AMI, Bi-LSTM, RNN, Smart grids, intrusion detection, multiclass classification, network traffic