A Multi-Sensor Energy Theft Detection Framework for Advanced Metering Infrastructures

TLDR

Advanced metering infrastructure replaces analog devices with smart meters, enabling efficient management but also attracting energy‑theft attacks, and although sensors can indicate theft, individual methods suffer many false positives. This paper introduces AMIDS, an intrusion detection system that fuses sensor outputs and consumption data to more accurately detect energy theft. AMIDS integrates meter audit logs of physical and cyber events with consumption data to model and detect theft‑related behavior. Experiments on normal and anomalous load profiles demonstrate that AMIDS accurately identifies theft attempts while correctly distinguishing legitimate load changes that simpler analyses misclassify.

Abstract

The advanced metering infrastructure (AMI) is a crucial component of the smart grid, replacing traditional analog devices with computerized smart meters. Smart meters have not only allowed for efficient management of many end-users, but also have made AMI an attractive target for remote exploits and local physical tampering with the end goal of stealing energy. While smart meters posses multiple sensors and data sources that can indicate energy theft, in practice, the individual methods exhibit many false positives. In this paper, we present AMIDS, an AMI intrusion detection system that uses information fusion to combine the sensors and consumption data from a smart meter to more accurately detect energy theft. AMIDS combines meter audit logs of physical and cyber events with consumption data to more accurately model and detect theft-related behavior. Our experimental results on normal and anomalous load profiles show that AMIDS can identify energy theft efforts with high accuracy. Furthermore, AMIDS correctly identified legitimate load profile changes that more elementary analyses classified as malicious.