A machine learning-based detection framework against intermittent electricity theft attack.

• A new intermittent electricity theft attack is presented by repeating normal and fraudulent behaviors alternately. • Electricity feature engineering is conducted on the automatically divided time intervals. • A machine learning-based detection framework is proposed to detecting the intermittent electricity theft attack. • VBGMM is used to overcome the difficulty of parameter selection of detection threshold. The widespread installation of advanced metering infrastructure (AMI) brings convenience to applications including but not limited to load management and demand response. However, AMI is also at risk of electricity theft and non-technical loss. Using the smart meter data provided by AMI to dig out user electricity consumption behavior is an effective way to construct electricity theft detectors. In this paper, a new intermittent electricity theft attack behavior is presented which switches between committing electricity theft and honestly consuming electricity alternately to skillfully evade the existing detectors. Based on the assumption that the labels of intermittent adversaries are unavailable, a new machine learning-based detection framework is proposed to detect this attack. Initially electricity features are constructed based on time intervals divided by a numerical iteration method. Then light gradient boosting method (LightGBM) is used to classify the normal users and adversaries. Further, the disperse degree of users is designed for capturing the differences between the intermittent adversaries and others. A new 2D label set is then constructed by combining the predicted labels of LightGBM and the disperse degree. Finally, a variational Bayesian Gaussian mixture model is employed based on the 2D label set to sort the users into the normal users and adversaries visually. Results of the case studies show that the presented attack can evade state-of-the-art detectors but still gain high profits. In addition, the proposed machine learning-based detector outperforms state-of-the-art detectors on both persistent attacks and intermittent attacks. [ABSTRACT FROM AUTHOR]