Applied Energy xxx (xxxx) xxxx

Contents lists available at ScienceDirect

Applied Energy
journal homepage: www.elsevier.com/locate/apenergy

Real-time prediction and anomaly detection of electrical load in a residential

community☆
Xinlin Wanga, Sung-Hoon Ahna,b,c
a
Department of Mechanical and Aerospace Engineering, Seoul National University, South Korea
b
Innovative Technology and Energy Center, Tanzania
c
Institute of Advanced Machines and Design, Seoul National University, South Korea

H I GH L IG H T S

• The load predictor can reduce the influence of the over-or-under fitting problem.
• The detector presents an independent detection process to identify anomalies.
• The data exploration method provides guidelines for the feature selection.
• The method realizes visual display and has low hardware requirements.
• The method is based on off-grid power plant, applied in a rural area of Tanzania.

A R T I C LE I N FO A B S T R A C T

Keywords: Regression model-based electrical load anomaly detection shows great potential to improve the quality of de-
Electrical load anomaly detection mand side management (DSM) because the load prediction and detection requirements can be satisfied by a
Demand side management single framework simultaneously. However, compared with other detection methods, both prediction and de-
Load prediction tection accuracy need improvement. To overcome this limitation, this work proposes a residential electrical load
Rule-engine
anomaly detection framework (RELAD) that includes a hybrid one-step-ahead load predictor (OSA-LP) and a
Residential electricity usage
rule-engine-based load anomaly detector (RE-AD). Considering that the diversity and randomness of residential
electricity usage may render prediction difficult, the OSA-LP cascades an autoregressive integrated moving
average (ARIMA) model and artificial neural networks (ANN) to achieve high precision in linear and nonlinear
regression. Meanwhile, through employing the Bayesian information criterion (BIC), the OSA-LP efficiently
reduces the influence of the over- or underfitting problem in real-time prediction and improves the prediction
accuracy. To remedy the deficiency of overreliance on prediction outcomes in regression-model-based anomaly
detection methods, the RE-AD integrates a support vector machine (SVM), the k-nearest neighbors (kNN)
method and the cross-entropy loss function to develop an independent detection process to analyze the cor-
rectness of data. This method was applied to detect the load of the off-grid solar power plant in Ngurudoto, a
rural area in Tanzania with 44 households and nearly 150 residents. The results of the practical application
demonstrate that the proposed predictor and anomaly detector exhibit better predictive and detective accuracy
than that achieved in previous work, which demonstrates the practicality of the proposed method.

1. Introduction of industrial and commercial sectors, are the major components of

energy consumption. According to a survey of the Energy Information
The electrical loads of residential communities, together with those Administration in 2018, the residential load accounted for 38.5% (1.46

☆
This research was supported by the International S&T Cooperation Program through the National Research Foundation of Korea (NRF) funded by the Ministry of
Science, ICT & Future Planning (MSIP) (NRF-2017K1A3A9A04013801) and the Basic Research Lab Program through the NRF funded by the MSIT
(2018R1A4A1059976). The authors gratefully acknowledge the help of all the members in Innovative Technology and Energy Center, Tanzania, for their kind
cooperation and help in this project. Additionally, the authors would like to express sincere thanks to Institute of Engineering Research at Seoul National University
and Dr. Zhuqing Mao.
E-mail addresses: wangxl1013@snu.ac.kr (X. Wang), ahnsh@snu.ac.kr (S.-H. Ahn).
URL: http://www.fab.snu.ac.kr/ (S.-H. Ahn).

https://doi.org/10.1016/j.apenergy.2019.114145
Received 5 September 2019; Received in revised form 21 October 2019; Accepted 11 November 2019
0306-2619/ © 2019 Elsevier Ltd. All rights reserved.

Please cite this article as: Xinlin Wang and Sung-Hoon Ahn, Applied Energy, https://doi.org/10.1016/j.apenergy.2019.114145
X. Wang and S.-H. Ahn
Nomenclature
DSM demand side management
PACF partial autocorrelation function
RELAD residential electrical load anomaly detection framework
ADF augmented Dickey-Fuller
OSA-LP one-step-ahead load predictor
ARMA autoregressive-moving average
RE-AD rule-engine based load anomaly detector
Preal SVM classification result of load
ARIMA autoregressive integrated moving average
Pprediction SVM classification result of prediction results
ANN nonlinear artificial neural networks
PkNN kNN classification result of load
trillion kWh) of the total annual electricity consumption in the United
States [1]. Therefore, efficient detection of electrical load anomalies,
such as electrical theft, leakage, and other nontechnical losses in re-
sidential communities, is critical to save energy and ensure the safety of
a power supply system [2]. At the same time, with the development of
demand side management (DSM), simply monitoring current power
consumption is not sufficient to meet the second-by-second balance
between power consumption and generation. Especially in some rural
regions where the main grid is not available, stablishing a compre-
hensive framework that can detect anomalies in residential power
usage in real time while simultaneously forecasting the future load has
become an important step in improving the efficiency of the smart grid
[3]. To this end, previous studies have used regression model-based
anomaly detectors to first predict the load and then use the difference in
the forecasting results and the real load data to identify anomalies [4].
This method provides an effective solution to improve energy effi-
ciency: the prediction and detection requirements can be satisfied by a
single framework. However, some long-term issues exist in the research
on regression-model-based anomaly detection. First, given the in-
dependence, diversity, and randomness of residential electricity use, it
remains challenging to employ an efficient prediction model to forecast
electrical loads in real time. Second, because the goal is to identify
anomalies, such as electrical theft, leakage, and other nontechnical
losses in residential communities, traditional regression model-based
anomaly detectors rely on the outcomes of a prediction model and lack
an independent anomaly detection design to analyze the correctness of
load data. These characteristics create a vicious cycle that compromises
the anomaly detection accuracy.
To address the gaps in previous research, a residential electrical
load anomaly detection framework (RELAD) composed of a one-step-
ahead load predictor (OSA-LP) and a rule-engine-based load anomaly
detector (RE-AD) is presented in this study. Our research innovations/
contributions are as follows:
• The proposed OSA-LP is used to forecast the electricity needs of
residential areas. This framework combines the advantages afforded
by the linear autoregressive integrated moving average (ARIMA)
and nonlinear artificial neural networks (ANN). Then, considering
the influence of human-induced random events on the prediction
results, the Bayesian information criterion (BIC) is employed to re-
duce the influence of the over- or underfitting problem of the
ARIMA model in real time. The introduction of BIC makes this study
achieve automatic model optimization in a real-time prediction
process.
• Our RE-AD integrates a support vector machine (SVM), the k-nearest
neighbors (kNN) method, and the cross-entropy loss function to
create an independent detection approach to analyze the correctness
of load data that is not affected by the prediction results. Anomalies
are identified accurately by reference to the normal power
2
Applied Energy xxx (xxxx) xxxx
BIC Bayesian information criterion
SVM-AD SVM-based anomaly detector
SVM support vector machine
ARIMA/AN-AD ARIMA/ANN-based anomaly detector
kNN k-nearest neighbors
LSTM-AD long short-term memory network-based anomaly detector
LSTM long short-term memory network
C regularization parameter
SC(k) silhouette coefficient
F1 detection accuracy measure
ACF autocorrelation function
R2 goodness-of-fit regression measure
RMSD root-mean-square deviation
consumption patterns of residents. Moreover, according the feature
of time series data in different periods, the RE-AD selects the optimal
detection approach which not only ensures the detection accuracy
but also reduces the computational cost.
• We employ a novel data processing method that derives guidelines
for residential load data and other nonstationary time series data
exploration. In this study, the results reflect residential load char-
acteristics over different periods.
• RELAD is applied to detect the load of a standalone solar power
plant in Ngurudoto (longitude: 36.906933, latitude −3.332608), a
rural area in Tanzania with 44 households containing nearly 150
occupants. The households lack a sustainable energy source. The
successful operation of RELAD addresses the need for providing
uninterrupted electricity in remote areas through better load pre-
diction and anomaly detection.
The rest of this paper is organized as follows. Section 2 presents
related work, and Section 3 introduces our system overview and the
data exploration. Section 4 and 5 present our load predictor and
anomaly detector. Section 6 discusses the experimental results and
comparisons, and Section 7 provides a summary.
2. Related work
Based on previous research in the literature, the current electrical
load anomaly detectors can be categorized into three main types: (1)
regression-model-based anomaly detectors, (2) classification-model-
based anomaly detectors, and (3) others.
The regression-model-based anomaly detectors first use regression
methods to fit the historical electrical load data and predict the future
load according to the results. Finally, monitored data with large de-
viations from the predicted results are identified as anomalies.
Considering the effect of temperature on the power usage of residents,
Zhang et al. developed a linear regression-model-based load anomaly
detector [5]. The prediction results serve as the baseline: if the real
consumption data are far below the baseline, they are considered to be
anomalous. This method provided a simple regression model-based
load anomaly detection approach that considers environmental factors;
however, individual differences in temperature sensitivity were ig-
nored. Moreover, if the annual temperature is constant, the model may
not be useful. Considering the complexity of building electrical loads,
Chou et al. proposed a hybrid prediction-model-based anomaly detector
[6]. The hybrid prediction model cascades ARIMA and ANN (ARIMA/
ANN). ANN are introduced to compensate for the prediction error of
ARIMA in nonlinear regression and to enable the hybrid model to ex-
ploit the advantages of both linear and nonlinear models. However,
although the prediction model has been improved, this work lacks a
reasonable detection process. The two-sigma rule to detect anomalous
data may be too simple to fully consider the impact of normal random
X. Wang and S.-H. Ahn
events on the prediction results. To address the detection error caused
by the simple detection algorithm, Luo et al. proposed a dynamic re-
gression-results-based anomaly detector [7]. Instead of using a fixed
threshold for the difference between the prediction results and real
load, an active adaptive threshold is calculated. The proposed dynamic
detection rule improves the detection accuracy; however, this work
lacks an independent detection algorithm to identify anomalies, and the
outcomes of the prediction model are still the only reference for
anomaly detection. Fenza et al. developed a drift-aware method to
detect anomalies in smart grids [8]. Historical data are first used to
train a long short-term memory (LSTM) network; then, the anomaly
detection algorithm evaluates the prediction error trend obtained from
the LSTM over time. Because the target of this work is to test the
consumer profile rather than identify general nontechnical loss, iden-
tified anomalies are not based on the error between the prediction re-
sult and the real data at a specific time, instead the error trend is uti-
lized.
In addition to regression-model-based anomaly detectors, classifi-
cation-model-based anomaly detectors are widely used anomaly de-
tection methods. According to the classification model, these detectors
can be further classified into supervised-classification-model-based
anomaly detectors and unsupervised-classification-model-based
anomaly detectors.
Jokar et al. developed a supervised-model-based anomaly detector
of electricity theft [9]. During training, k-means clustering and the
silhouette score are employed to determine the number of patterns in
the dataset, and an SVM-based classifier is constructed to learn the
normal and anomalous patterns. Pinceti et al. presented a comparison
test to consider the application of different supervised learning models
for detecting attacks in load redistribution [10]. A nearest-neighbor
method, an SVM, and a replicator neural network are employed to
identify anomalies in a realistic dataset, and the nearest-neighbor al-
gorithm outperforms the other detectors. The supervised-classification-
model-based anomaly detector is an efficient anomaly detection
method with rational detection references and high detection accuracy.
However, the limitations of this method are the training cost and ap-
plicability. First, the detection accuracy is directly affected by the
quality of the training dataset: considerable time and resources are
required to obtain a high-quality labeled training dataset. Second, with
the development of DSM, detecting anomalies in the real-time load may
not be sufficient to improve the energy efficiency and sustainability.
Fan et al. proposed an unsupervised-classification-based building
power consumption anomaly detector to reduce the training cost of
supervised-learning-based anomaly detection [11]. The dominant per-
iods and influential exogenous variables of each appliance in a building
are identified by spectral density estimation and a decision tree. Finally,
an unsupervised learning model autoencoder is employed to calculate
the anomaly score for each observation. Scores that are higher than a
preset threshold are identified as anomaly candidates. Pereora et al.
developed an autoencoder-based unsupervised anomaly detector to
detect anomalies in solar energy generation series [12]. Compared with
the general autoencoder model, the proposed encoding-decoding pro-
cess is improved by a variational self-attention mechanism. The
Table 1
Summary of electrical load anomaly detection works.
Type Advantages
Regression model Anomaly detection and future power usage prediction
Classification model-Supervised High detection accuracy
Classification model-Unsupervised Low training cost
RELAD (this work) Anomaly detection and future power usage prediction
High detection accuracy
3
Applied Energy xxx (xxxx) xxxx
unsupervised-classification-based system provides a new method for
identifying anomalous data without additional training cost; however,
due to the lack of references, this approach is limited by the fact that
the detection results cannot be easily evaluated [13]. The consumer
power load anomaly detection results should be strengthened with
explanations of why the data are detected as abnormal.
Additional types of anomaly detection methods have been reported.
Cabrera et al. presented a rule learning-based anomaly detector that
targets the detection of power waste patterns in educational institutions
[14]. Data binning is first employed to reduce the data size; then, dif-
ferent determination rules are used to identify energy waste patterns.
Although this static analysis approach did not discuss the application
details of the method, such as the detection speed and training cost, it
proposes a new detection approach with full consideration of the sur-
rounding environment.
Table 1 summarizes the advantages and limitations of regression-
model-based and classification-model-based anomaly detection
methods and the proposed RELAD.
3. System overview
The proposed RELAD is designed to realize real-time residential
electrical load prediction and anomaly detection. The framework of
RELAD is illustrated in Fig. 1. The input of RELAD is the real-time load
data and the historical load data of the past 24 h. To avoid the over-or
underfitting problem in real-time prediction and balance the require-
ments of prediction accuracy and calculation speed, the moving
window is designed to update the prediction model in each step. In each
step, after receiving the real-time data, the moving window selects the
real-time data and the historical data of the past 24 h as the input to
update the OSA-LP. After updating the OSA-LP and obtaining the pre-
diction result, then the RE-AD determines the correctness of the real-
time data. The outputs of RELAD are composed of the prediction result
for the next step and the detection result of the real-time data. Fig. 2
shows a diagram of the moving window.
3.1. Data exploration
RELAD is applied to detect the load of an off-grid solar power plant
(32 × 150 W solar panels; total 4.8 kW) built in Ngurudoto. Fig. 3(a)
shows five days of raw power plant load for Ngurudoto: the x-axis is
hours. The load is complex. The household electricity consumption data
are influenced by two aspects: the living habits of residents and random
events. A machine learning model can learn living habits through well-
trained datasets; however, random events are unpredictable, which
makes learning difficult. Some random activities, such as suddenly
turning on a bathroom light or making coffee, have a random, irregular,
and uncontrolled occurrence that reflects the diversity of modern
people’s lives and increases the difficulty of power consumption pre-
diction and detection. Even more challenging is that the overall energy
consumption of a residential community is the sum of all such random
events in each household, further complicating the learning process. As
shown in Fig. 3(a), some trends are observed in the change in daily
Limitations
Low prediction
detection accuracy
High training cost
Lacking of prediction information
Weak interpretability
Lacking of prediction information
High training cost
X. Wang and S.-H. Ahn
Fig. 1. The proposed residential electrical load anomaly detection framework.
Fig. 2. Diagram of the moving window.
load, and some parts of these trends show significant differences.
During the day, the load data show high randomness; therefore, vi-
bration analysis and autoclustering are implemented to capture the
intrinsic characteristics of the residential load and to design a novel
detection method to reduce the difficulty of anomaly detection.
Fig. 3. The results of data exploration.Note: Ngurudoto is an underdeveloped rural village in Tanzania; the power consumption of this area is relatively low.
4
Applied Energy xxx (xxxx) xxxx
3.1.1. Vibration analysis
Vibration analysis mines load series characteristics from the per-
spective of time series. Since the load series typically changes dyna-
mically over time in a strongly nonlinear manner, the first step is to
transform the nonstationary series into a stationary series [15]. The
method used in this study is to calculate the x-order difference of the
load series and use the augmented Dickey-Fuller (ADF) test to detect
whether the x-order difference is stationary. x starts at 1 and is in-
creased until a stationary difference is obtained [16]. According to the
ADF results, the first-order difference of the load series (i.e., x = 1) is
stationary, as shown in Fig. 3(b). During the period from 7 pm to 7 am,
the first-order difference is near zero, which means that the power
consumption of residents tends to be stable. However, during other
periods, severe vibrations are evident, which illustrates the impact of
random events in human life on electricity consumption. Therefore,
vibration analysis identifies a vibration and a nonvibration period: the
former from 7 am to 7 pm and the latter overnight. The results of the
vibration analysis provide a guideline for selecting a suitable load
prediction model according to the different periods and features of
different models.
3.1.2. Autoclustering
Because the independence, diversity, and randomness of the power
plant load inevitably affect the anomaly detection results, we classify
load data into different clusters to reduce the difficulty of anomaly
detection caused by random events. Compared with general supervised-
learning-based classification techniques, the autoclustering proposed in
this study does not rely on a training dataset and provides a simple data
exploration method to process complex data. We use automated clus-
tering featuring k-means and silhouette coefficients. K-means clustering
is widely used because it is fast and simple [17]. For all clustering
models, when the k-means are used to assign N data to k disjoint
clusters, k (the number of groups) must be preset. However, k is un-
known for new data; therefore, the silhouette coefficient, which mea-
sures how similar an object is to other objects in its own cluster com-
pared to objects in other clusters, is employed. The silhouette
coefficient is [18]:
b (k ) − a (k )
SC (k ) = ,
max(a (k ), b (k )) (1)
where a (k ) is the mean intracluster distance and b (k ) is the mean
nearest-cluster distance for k. The silhouette coefficient ranges from − 1
X. Wang and S.-H. Ahn
to + 1, with + 1 being optimal. We assume that there are m clustering
scenarios and label the clustering scenarios from 2 to m. For each sce-
nario, k-means is used to cluster the data, and the silhouette coefficient
is used to evaluate the result. After m clustering epochs, we obtain m
silhouette coefficients, and the maximum value of the silhouette coef-
ficient is selected to present the best clustering result.
After autoclustering, Fig. 3(c) exhibits five load patterns (labeled
0–4). Patterns 3 and 4 occur during the vibration period; however,
during the daytime, the patterns are random. By means of automatic
clustering, the irregular load data are transformed into different power
consumption patterns. In the anomaly detection phase, the detector
needs to detect only whether the real-time load data belong to a benign
learned pattern.
4. One-step-ahead load predictor
Previous work has shown that time series data may consist of two
types of characteristics: linear characteristics and nonlinear character-
istics [4]. Therefore, a comprehensive predictor applied in time series
data should feature both linear regression and nonlinear compensation:
linear regression is used to fit the data, and nonlinear compensation is
employed to reduce the regression error [6].
4.1. Linear regression
Of the various linear regression models, the autoregressive moving
average (ARMA) model may be optimal in this scenario, and its accu-
racy and flexibility have been proven in many time series data pre-
diction studies. An ARMA (p , q) model can be expressed as [4]:
yt = a1 yt − 1 + a2 yt − 2 + …ap yt − p + nt + b1 nt − 1 + ⋯+bq yt − q
where yt , the value at time t, is a function of the previous p values, i.e.,
yt − 1 , yt − 2 , …, yt − p . The errors at times t , t − 1, …, t − q are
nt − 1, nt − 2, …, nt − q . p is the number of autoregressive terms, a1, …, ap are
the autoregressive coefficients, q is the number of lagged forecast er-
rors, and b1, …, bq are the moving average coefficients.
However, as the electrical load is nonstationary, the use of ARMA to
directly fit the data is inappropriate [15]. Therefore, we generalized the
ARMA model to an ARIMA (p , d, q) model. The only difference between
ARIMA and ARMA is that before fitting the series, ARIMA first trans-
forms the nonstationary time series into a stationary d-order difference
series, where d is the order of the difference. Given that we use the
results of the vibration analysis in this study, d = 1.
A limitation of ARIMA when applied in real-time load prediction is
that the values of p and q must be preset according to the features of the
target data series. Generally, to avoid over- or underfitting caused by
inappropriate p and q values, the autocorrelation function (ACF) and
partial autocorrelation function (PACF) are employed to analyze the
target data series. The optimal values of p and q are selected and preset
according to the results of the ACF and PACF. Nevertheless, this ap-
proach ignores the problem that the nonstationary load series change
dramatically over time. The characteristics of the load series used for ex
ante analysis and real-time monitoring may vary considerably. Fixed
parameters may not be sufficient to reflect the characteristics of the
real-time data, which ultimately results in over- or underfitting. Thus,
the BIC, a criterion for optimal model selection from a set of finite
models, is introduced. The general idea of BIC is to use informative
priors to shrink the unrestricted model toward an accurate benchmark
to reduce parameter uncertainty and improve prediction accuracy [19].
After scoring the fitting results of each model, the lowest BIC score is
selected as an indicator of the best fitting model. For autoclustering, we
assume that the maximum values of both p and q are n, yielding n2
regression scenarios numbered from 1 to n2 . We obtain n2 BIC scores
and then select the regression with the lowest BIC. The BIC is [20]:
BIC = k × ln (m) − 2 × ln (L )̂
Applied Energy xxx (xxxx) xxxx
where L ̂ is the maximized value of the model likelihood function, m is
the sample size, and k is the number of model parameters. In this study,
the sample size m is equal to n2 , and k is equal to 2 (p and q). n2 is set as
n2 = U × U T , where U is a vector [0, k ], i.e., [0, 2].
The introduction of BIC realizes automatic model optimization, re-
ducing the influence of over- or underfitting in real-time prediction. In
each prediction, the moving window selects the historical data of the
past 24 h to update the ARIMA model, and BIC is simultaneously em-
ployed to select the optimal parameters.
4.2. Nonlinear compensation
Nonlinear compensation is an important part of the prediction
model. Although ARIMA is improved by BIC, the model is still not
sufficiently accurate to fit the electrical load. Here, we select ANN as
the nonlinear compensation model to compensate for the fitting error of
the improved ARIMA (ARIMA and BIC) in nonlinear regression. ANN is
a nonlinear modeling technique with a structure similar to that of the
brain and is suitable for modeling in a wide range of applications [4].
The inputs of the ANN training dataset are the regression result series of
the improved ARIMA and the related prediction time. The fitting errors,
i.e., the differences between regression results and real load value, are
the outputs. The moving window is designed to record the inputs and
outputs of the training dataset and to update the ANN model in each
step. Considering the nonlinear features of residential power usage
data, a hyperbolic function is selected as the ANN activation function.
After testing, to balance the computation speed and accuracy, the
learning rate of the network is set to 0.01 and the structure is 10 × 10.
The final result of the OSA-LP is the sum of the linear prediction result
of the improved ARIMA model and the nonlinear compensation result
(2) of the ANN.
5. A rule-engine-based load anomaly detector
The difference between the proposed RE-LAD and earlier regression-
model-based anomaly detectors is that the prediction results are not the
only indicators of anomalies; a rule engine is employed to detect
anomalies in real time, even when the predictions are inaccurate.
According to the different load characteristics of vibration and non-
vibration periods, two types of rule engines are designed. In the de-
tection process, the current time determines the rule engine to be used.
5.1. Anomaly detection in the vibration period
Random events and predictive errors occur frequently during the
vibration period. Therefore, to identify the anomalous data accurately
and to reduce the influence of random events on detection, the rule
engine operates in the following order: 1. Results classification, 2.
Comparison of classification results, 3. Classification error test, and 4.
Evaluation of classification results.
5.1.1. Results classification
To avoid the effect of the predictive errors on anomaly detection,
the prediction results and real load are not simply compared. We first
use an SVM to explore whether the results exhibit the same power
consumption pattern. An SVM is a widely used classifier that is
strengthened by the kernel method. By introducing the kernel, an SVM
gains flexibility in the choice of the form of the threshold separating
anomalies from normal data. Since the kernel is nonparametric and
operates locally, it does not need to have the same functional form for
all the data [21]. In this study, the SVM model employs a Gaussian
kernel. By locating the solution space in high-dimensional space, the
Gaussian kernel-based SVM can effectively solve the problem caused by
the nonlinear decision function, improving the model’s nonlinear clas-
sification performance [22]. The training datasets of an SVM consist of
(3) a benign dataset and a malicious dataset; the benign dataset used in this
5
X. Wang and S.-H. Ahn
work is the autoclustering result shown in Fig. 2(c). The malicious
dataset contains two types of malicious events: electricity theft and
leakage. Notably, because electricity theft and leakage are infrequent,
in our historical dataset, the number of anomalies is limited compared
with the quantity of normal data. To prevent the classification error
caused by imbalanced data, the benign sample-based malicious sample
creation method first proposed by Jokar et al. is employed [9]. n data
from the benign dataset are randomly selected to form a new benign
dataset x, i.e., x ∈ {x1, …, x n} . Because the goal of electricity theft is to
report a lower consumption than normal use, the electricity theft da-
taset y can be represented as y = α × x , where α ∈ [0, 1] and
E (y ) ⩽ E (x ) . Similarly, the electricity leakage dataset z can be denoted
as z = β × x , where β ∈ [1, ∞] and E (x ) ⩽ E (z ) . Although defining all
the malicious samples that are consistent with E (y ) ⩽ E (x ) or
E (x ) ⩽ E (z ) might not be practical, the malicious dataset can be gen-
erated by considering the generalization property of the SVM [12]. The
values of α and β can be considered as the detection sensitivity criteria.
In this study, α is set to 0.5, and β is set to 2. The prediction results and
the real load value are classified after training the SVM.
5.1.2. Comparison of classification results
According to the classification results, three cases are explored:
• If the prediction result and the real load exhibit the same pattern
(i.e., Pprediction = Preal ) and the pattern is benign, the current load
value is normal.
• If Pprediction = Preal but the pattern is malicious, the load is anomalous,
and a warning follows.
• If Pprediction and Preal exhibit different learned patterns, there are two
potential reasons: (1) the random events affect the load and make
the real data vary greatly, resulting in different patterns; (2) there is
a classification error. Therefore, the algorithm first performs a kNN-
based classification error check to reassess the results. If no error is
observed, then whether the classification result is in fact acceptable
is determined.
5.1.3. Classification error test
The kNN method, which is simple, practical, and robust to noisy
training data, is used to evaluate the classification results. K, a positive
integer, is the number of nearest neighbors to be evaluated [23]. We use
the simplest kNN model, i.e., 1NN. As our predictions and the real data
Fig. 4. Flowchart of the rule engine in the vibration period.
6
Applied Energy xxx (xxxx) xxxx
exhibit different patterns, we focused on the detection of real loads as
follows:
• Use the kNN method to find the training dataset pattern closest to
the real load, and label it P . kNN
• If P = P ,there is no classification error. Daily random events of
real kNN
residential power use are the cause of Pprediction and Preal exhibiting
different patterns. If Preal is benign, a result follows.
• If Preal and PkNN exhibit different patterns, there is a classification
error. Although we introduced the advantages of the SVM in the first
step, misclassification remains unavoidable. An SVM may mis-
classify when the training data quality is inadequate or the reg-
ularization parameter C is inappropriate. [24]. Therefore, the kNN
result is preferred in this scenario. If PkNN is benign, it is tested in the
next step.
The kNN result is defined as correct when it differs from the SVM
result. Many previous studies have found that SVM outperforms kNN in
large feature spaces [25,26]; however, as mentioned above, the accu-
racy of an SVM relies on the C value and the use of a high-quality
training dataset. In comparison, the kNN method relies on a limited
number of neighbors rather than class domains. Therefore, kNN is va-
luable for correction when classification errors occur [27]. Notably, we
use the kNN method only to check and correct classification errors: the
kNN method cannot substitute for the SVM in the first step of anomaly
detection because of the features of the SVM, which are mentioned in
the results classification step.
5.1.4. Evaluation of classification results
In this step, the cross-entropy loss function is used to evaluate
whether the classification result is acceptable from the perspective of
global optimization. The cross-entropy loss function is a popular clas-
sification/clustering result evaluation method that is simple, accurate,
and adaptable to global optimization. The cross-entropy loss function is
defined as [28]:
T
⎛ ⎞
Loss ⎜y, y ⎟̂ = ∑ ̂
yi log(yi ),
⎝ ⎠ i=1 (4)
where y is the real label in the training dataset, y ̂ is the classification of
the SVM, and L is the size of the training dataset. The lower the cross-
entropy loss is, the better the classification. The steps are as follows:
X. Wang and S.-H. Ahn Applied Energy xxx (xxxx) xxxx

• Use the cross-entropy loss function to calculate the loss of the initial speed.
training dataset.
• Place the load data and the matched pattern into the training dataset 6.1. Experimental results
(to build a new dataset) and use the (new) cross-entropy loss func-
tion to recalculate the loss. 6.1.1. Test A
• Compare the two results. If the difference between the two loss Fig. 6 shows the user interface (UI) of RELAD. The current mon-
functions ε is smaller than threshold1, the classification result of kNN itoring time (t) is 10:20 am, during the vibration period, and the current
is acceptable, and the load is benign. Otherwise, even if the kNN load is 490 W. In the previous step (t − 1), the predictor forecasted the
method indicates that the load is benign, the algorithm considers the next load to be 479 W (blue point), i.e., 479 W at 10: 20 am. Therefore,
load to be abnormal. according to the rule engine, the anomaly detector classified the current
load of 490 W, and the prediction result of 479 W by the SVM. The
Fig. 4 shows a flowchart of the rule engine in the vibration period. classification results showed that both the real load of 490 W and the
prediction result of 479 W belong to pattern 1, a benign pattern.
5.2. Anomaly detection in the nonvibration period Therefore, the result of the anomaly detector was normal. Moreover,
the moving window selected the historical load data of the past 24 h to
The load in the nonvibration period tends to change linearly. Given update the OSA-LP and predicted that the load at the next step (t + 1)
the high performance of our prediction model in this period, the rule- would be 491 W. The prediction results of this study can be used in two
engine operates as follows: ways. First, the results provide a reference for the next anomaly de-
Compare the difference between the prediction result and the real tection. Second, the results can be compared with the remaining ca-
load with respect to a preset parameter, threshold2 . If the difference is pacity of the battery and the charging speed of the solar panel to de-
higher than threshold2 , the data are abnormal. termine the remaining power supply time of the off-grid power supply
The rule engine of the nonvibration period is straightforward but is system.
applicable only in some special periods when the possibility of random
electricity use is low. For daytime power consumption anomaly detec-
6.1.2. Test B
tion, this rule engine is not sufficiently comprehensive to achieve high
Fig. 7 shows another test result in the normal monitoring case. In
detection accuracy.
this test, the prediction result in the previous step (t − 1) was 667 W,
but the current load (t) is 1200 W. The two results exhibit two different
6. Experimental results and comparison
patterns (the load data belong to pattern 3 and the prediction results
belong to pattern 1). Therefore, according to the rule engine, the RE-AD
The proposed method is applied to detect the load of the solar power
first uses kNN to assess the classification error. The kNN result shows
plant built in Ngurudoto. The wiring diagram of Ngurudoto is shown in
that the current load data belong to pattern 3, which is the same as the
Fig. 5. We previously designed a long range (LoRa)-based wireless en-
result of the SVM. Then, the cross-entropy loss function is employed to
ergy monitoring system to track the electrical load of the power plant
evaluate the classification result and indicates an acceptable result.
and all households in the village. Considering the system needs to op-
Therefore, the final results show that the current power consumption
erate in a harsh environment with limited skilled manpower for op-
situation is normal, the load belongs to a benign learned pattern, and
eration and maintenance, the wireless energy monitoring system con-
the prediction result for the next step (t + 1) is 1040 W.
tains two parts: a local part in Tanzania and a remote control part in
South Korea. RELAD is implemented in South Korea. In each step, if
RELAD identifies the real-time load is abnormal, a warning will be is- 6.1.3. Test C
sued to the manager of the system to remote control the power plant in Fig. 8 shows the change in load when the power supply system is
Tanzania. abnormal. The prediction result in the previous step (t − 1) was 318 W,
The prediction interval of the OSA-LP, i.e., the communication in- pattern 0. However, the current load (t) is 3053 W, and the SVM result
terval between Tanzania and South Korea, is determined based on the is pattern 6, malicious dataset. Finally, RELAD issues a warning. Ver-
prediction accuracy and early warning of battery capacity. If the in- ification showed that this warning was caused by an abnormal circuit in
terval is long, there will be sufficient time to confirm the remaining the power supply system. Benefiting from the timely feedback of the
power of the standalone power supply system to prevent power
outages. However, considering the unpredictable occurrence of random
events in residential power usage, a long interval will also reduce the
prediction accuracy. Conversely, if the interval is short, the prediction
accuracy can be improved, but the significance of an early warning is
lost. Therefore, considering the prediction accuracy, the effectiveness of
early warning and the number of households afforded by the off-grid
power plant, the prediction interval in this work is set to 15 min.
RELAD has low computer hardware requirements and is im-
plemented using a desktop computer with a 3.4 GHz Intel Core i5
processor, 4 GB RAM, and the Windows 10 operating system. To sim-
plify the data mining process, the proposed method is designed based
on C Sharp and Python; C Sharp builds a visual interface with several
user options. Through investigating the value of cross-entropy loss in
normal power consumption, in this study the threshold1 is set to 3.
According to the results of vibration analysis, to balance the accuracy
and sensitivity of detection, the threshold2 is set to 50 W.
Three experimental results are presented to illustrate the im- Fig. 5. Wiring diagram of Ngurudoto (from Google map). Note: Ngurudoto is a
plementation of RELAD in detail. To further demonstrate the con- rural area in Tanzania with 44 households and nearly 150 occupants. The
tributions of this study, RELAD is compared with previous works, and power of this village is supplied by an off-grid solar power plant (32 × 150
the comparison results are discussed in terms of accuracy and running solar panels; total 4.8 kW).

7
X. Wang and S.-H. Ahn Applied Energy xxx (xxxx) xxxx

Fig. 6. The UI of RELAD - test A. On the left

side of the UI is the operation panel. Our
method has two modes of operation: auto-
detection mode and manual detection model.
Because our method is suitable not only for
monitoring the load of Ngurudoto but also
for detecting and forecasting the power
consumption of the smart manufacturing
process, additional buttons are included on
the operation panel.

ARIMA/AN-AD is updated by the moving window in each step, and

p , d , and q are set to 1. The training datasets of SVM-AD, LSTM-AD and
our method are the same. SVM-AD uses a multiclass SVM with a radial
basis function (RBF) kernel. The structure of LSTM-AD consists of a first
visible layer with 1 input, a hidden layer with 80 LSTM neurons, and an
output layer. Network training is performed for 90 epochs. After two
months of uninterrupted, 24-h real-time detection of the power plant
load in Ngurudoto (from February 1, 2019, to April 1, 2019), the results
of each detector are evaluated and reported in Table 2.
To explain the prediction performance of each model more com-
prehensively, two goodness-of-fit regression measures are introduced.
The common R-squared (R2 ) goodness-of-fit regression measure is used
to provide an intuitive measure of how well observations are replicated
by each model according to the proportion of total variation of the
Fig. 7. The UI of the proposed method-test B.
outcomes. R2 ranges from 0 to 1: the higher the score is, the better the
fit [29]. The root-mean-square deviation (RMSD) is another frequently
used measure of the differences between values predicted by a model
and the values observed. In general, a lower RMSD is better than a
higher one [30].
F1 score is a measure, that provides a balanced evaluation of the
overall performance of a classifier. The F1 score consists of precision p
and recall r, which were developed by the information retrieval com-
munity. p , r and the F1 score are defined as follows [23]:
TP
p ≔ ,
FP + TP (5)

TP
r ≔ ,
FN + TP (6)

F1 score is the harmonic mean of the precision p and recall r as follows:

Fig. 8. The UI of the proposed method-test C.
2×p×r
F1 ≔ ,
p+r (7)
proposed method, the manager can remotely control the power supply
system in time to reduce losses.
Table 2
Comparison of the results between the proposed method and previously re-
6.2. Comparison results and evaluation ported methods.
Items R2 RMSD F1
The results of RELAD were compared with the results of Chou et al.
[6], Fenza et al. [8], and Jokar et al. [9]. Chou et al. use an ARIMA/ RELAD (this work) 0.6967 217.3001 0.9953
ARIMA/ANN-AD 0.5928 243.5128 0.8427
ANN-based anomaly detector (ARIMA/AN-AD), Fenza et al. use an
LSTM-AD 0.6361 217.6356 0.9837
LSTM network-based anomaly detector (LSTM-AD), and Jokar et al. use SVM-AD N/A N/A 0.9829
an SVM-based anomaly detector (SVM-AD). The prediction model of

8
X. Wang and S.-H. Ahn
where TP represents the number of time points at which normal data
were correctly classified, FP represents the number of time points at
which anomalous data were classified as normal, TN represents the
number of time points at which anomalous data were considered ab-
normal, and FN represents the number of time points at which normal
data were labeled abnormal.
6.2.1. Accuracy
1. Prediction results:
The three methods other than SVM-AD, which has no prediction
model, use different prediction models to forecast the current or
future load of the power plant. The results of R2 are consistent with
that of RMSD, and show that the OSA-LP outperforms the ARIMA/
ANN-AD. That indicates the introduction of BIC enhances the
ARIMA/ANN model and can effectively reduce the influence of the
over- or underfitting problem of the ARIMA model, thereby im-
proving the real-time prediction accuracy. Regarding the prediction
results of both the OSA-LP and the LSTM-AD, both the results of R2
and RMSD show that the OSA-LP outperforms the LSTM-AD, mainly
because the OSA-LP is a real-time predictor and the moving window
updates the model in each step. Considering the influence of human-
induced random events in the residential load on the prediction
results, prediction errors are unavoidable for each model. In this
scenario, determining how to realize automatic prediction error
compensation becomes the key to improve the accuracy of real-time
prediction. For the OSA-LP, even if prediction errors occur, the best
parameters can still be selected through BIC to fit the latest histor-
ical data selected by the moving window in real time. This design
ensures less discrepancy between the observed values and the values
expected under the model. By comparison, although the LSTM-AD
uses a more sophisticated neural network, the model still lacks a
feedback mechanism to reduce the prediction error. To exhibit the
prediction results of each model more intuitively, Fig. 9 shows 24-h
real-time prediction results of ARIMA/AN-AD, LSTM-AD, and OSA-
LP, and Table 3 exhibits the related prediction results. The results
shown in Table 3 are consistent with that of Table 2, and both the
results of R2 and RMSD show that the OSA-LP outperforms the other
two methods.
2. Anomaly detection results:
Among all the anomaly detectors, ARIMA/ANN-AD exhibits the
lowest F1 score. General regression-model-based anomaly detection
methods for identifying anomalies rely excessively on the results of
the prediction model. Classifying all the points outside of 2 standard
deviations (SDs) from the mean of the prediction results as anom-
alous data is not reasonable. The results of the RELAD show that an
independent anomaly detection process is necessary to improve the
anomaly detection accuracy of the regression-model-based anomaly
detector. Although the target of LSTM-AD is to detect anomalies in
consumer behavior, such as family structure changes, rather than
specific nontechnical loss, when anomalies occur, LSTM-AD can still
capture the changes in data series. According to the F1 scores of
LSTM-AD and ARIMA/ANN-AD, LSTM-AD has higher detection ac-
curacy for two main reasons: 1. The prediction accuracy of the LSTM
network is higher than that of ARIMA/ANN; 2. The detection pro-
cess of LSTM-AD does not compare the error between the predicted
and real loads at a specific time, but in analyzing the trend, it im-
proves the rationality of detection. The SVM-AD also exhibits a high
F1 score. However, in contrast to other methods, the SVM-AD cannot
provide more information about the future load, which limits its
application. In summary, RELAD shows the best prediction and
anomaly detection performance among all anomaly detectors.
6.2.2. Running speed
The ARIMA/ANN-AD, SVM-AD, and RELAD have fast running
speeds. After long-term verification, the mean calculation time of the
9
Applied Energy xxx (xxxx) xxxx
OSA-LP is approximately 400 ms, and the total calculation time of
prediction and detection is approximately one second, which ap-
proaches real-time monitoring. However, the running speed of LSTM-
AD is slower than that of the other methods. In actual testing, the
computation speed is too slow for real-time monitoring. The limitation
of LSTM-AD is that the method, which is based on a deep neural net-
work, has its practicability limited by the hardware configuration. By
contrast, RELAD not only realizes real-time load forecasting and
anomaly detection on a computer with a simple hardware configuration
but also provides visual display and function selection, which improves
practicability.
7. Conclusion
Among all the types of current power consumption anomaly de-
tectors, regression-model-based anomaly detectors, which detect
anomalies and forecast the future load simultaneously, have great po-
tential to improve the quality of demand side management. However,
the prediction and detection performance of traditional regression
model-based anomaly detection works is unsatisfactory, which hinders
the application of such methods. In this study, we propose a novel
anomaly detection framework consisting of a one-step-ahead load
predictor and a rule-engine-based load anomaly detector. On the one
hand, the proposed predictor simultaneously exploits the advantages of
each model and reduces the influence of the over- or under fitting
problem in real-time prediction. On the other hand, the proposed
anomaly detector exhibits an independent anomaly detection process
that can identify anomalies such as electrical theft or leakage by re-
ferencing the normal power usage patterns of residents. The proposed
method provides critical guidance for reducing nontechnology loss and
improving the efficiency of smart grids.
Our experimental results demonstrate that (1) the data exploration
method presented in this study is an efficient feature selection method
that can be used as a guideline for more nonstationary time series data
exploration research; (2) the proposed predictor and detector achieve
better prediction and detection accuracy than that in previous work;
and (3) while realizing high-speed calculation and accurate prediction
and detection, our method provides a visual display and function se-
lection with low hardware requirements, expanding the application of
machine learning technology. Our results are based on the electrical
load of a solar power plant in Ngurudoto, a rural area of Tanzania. The
power consumption pattern is relatively simple. For a more general
application, future work will apply this method in more residential
areas to test different power consumption patterns. Meanwhile, con-
sidering the influence of human-induced random events on the results
of real-time residential electrical load prediction and anomaly detec-
tion, further work will also employ more advanced approaches to fur-
ther improve the prediction and anomaly detection performance of this
method.
This work presents a standalone power source-based anomaly de-
tection framework. The accuracy and practicality of this method have
been demonstrated in this study. We hope that through the application
of this method, an ever-increasing number of people using off-grid
Fig. 9. 24-h real-time prediction results of each prediction model.
X. Wang and S.-H. Ahn Applied Energy xxx (xxxx) xxxx

Table 3 [11] Fan C, Xiao F, Zhao Y, Wang JY. Analytical investigation of autoencoder-based
Comparison of the 24-h real-time prediction results between the proposed methods for unsupervised anomaly detection in building energy data. Appl Energy
method and previously reported methods. 2018;211:1123–35.
[12] Pereira J, Margarida S. Unsupervised anomaly detection in energy time series data
Items R2 RMSD using variational recurrent autoencoders with attention. In: 2018 17th IEEE inter-
national conference on machine learning and applications; 2018.
[13] David Weinberg. Our machines now have knowledge we will never understand;
OSA-LP (this work) 0.7711 125.4662
2017. https://www.wired.com/story/our-machines-now-have-knowledge-well-
ARIMA/ANN-AD 0.6099 167.7502
never-understand/.
LSTM-AD 0.7384 150.0135
[14] Cabrera DFM, Zareipour H. Data association mining for identifying lighting energy
waste patterns in educational institutes. Energy Build 2013;62:210–6.
[15] Nie HZ, Liu GH, Liu XM, Wang Y. Hybrid of ARIMA and SVMs for short-term load
power sources can enjoy uninterrupted electricity as soon as possible. forecasting. Energy Procedia 2012;16:1455–60.
[16] Owoye Oluwole. The causal relationship between taxes and expenditures in the G7
countries: cointegration and error-correction models. Appl Econ Lett 1995;2:19–22.
Declaration of Competing Interest [17] Gaddam SR, Phoha VV, Balagani KS. K-Means+ID3: a novel method for supervised
anomaly detection by cascading K-means clustering and ID3 decision tree learning
methods. IEEE Trans Knowl Data Eng 2007;19:345–54.
The authors declare that they have no known competing financial
[18] Amorim RC, Hennig C. Recovering the number of clusters in data sets with noise
interests or personal relationships that could have appeared to influ- features using feature rescaling factors. Inf Sci 2015;324:126–45.
ence the work reported in this paper. [19] Sune Karlsson. Forecasting with Bayesian vector autoregression. Handbook Econ
Forecast 2015;2:791–897.
[20] Findley David F. Counterexamples to parsimony and BIC. Ann Inst Stat Math
References 1991;43:505–14.
[21] Auria L, Moro RA. Support vector machines (SVM) as a technique for solvency
[1] EIA; 2017. https://www.eia.gov/energyexplained/index.php?page=electricity_use. analysis; 2008.
[2] Spagnuolo A, Petraglia A, Vetromile C, Formosi R, Lubritto C. Monitoring and op- [22] Ye Tian. Stock forecasting method based on wavelet analysis and ARIMA-SVR
timization of energy consumption of base transceiver stations. Energy model. In: 2017 3rd international conference on information management; 2017.
2015;81:286–93. [23] Iwayemi A, Zhou C. SARAA: semi-supervised learning for automated residential
[3] Thiaux Y, Dang TT, Schmerber L, Multon B, Ahmed HB, Bacha S, et al. Demand-side appliance annotation. IEEE Trans Smart Grid 2017;8:779–86.
management strategy in stand-alone hybrid photovoltaic systems with real-time [24] Zhou Hua. Machine learning, Tsinghua. University Press; 2016.
simulation of stochastic electricity consumption behavior. Appl Energy 2019;253. [25] Hmeidi I, Hawashin B, Qawasmeh EE. Performance of KNN and SVM classifiers on
[4] Narendra C, Eswara Reddy BB. A moving-average filter based hybrid ARIMA-ANN full word Arabic articles. Adv Eng Inform 2008;22:106–11.
model for forecasting time series data. Appl Soft Comput 2014;23:27–38. [26] Colas F, Brazdil P. Comparison of SVM and some older classification algorithms in
[5] Zhang Y, Chen WW, Black J. Anomaly detection in premise energy consumption text classification tasks. In: IFIP international conference on artificial intelligence in
data. In: 2011 IEEE power and energy society general meeting; 2011. theory and practice; 2016. p. 169–78.
[6] Chou JS, Telaga AS. Real-time detection of anomalous power consumption. Renew [27] Palaniappan R, Sundaraj K, Sundaraj S. A comparative study of the SVM and kNN
Sustain Energy Rev 2014;33:400–11. machine learning algorithms for the diagnosis of respiratory pathologies using
[7] Luo J, Hong T, Yue M. Real-time anomaly detection for very short-term load fore- pulmonary acoustic signals. BMC Bioinformatics 2015;15.
casting. Clean Energy 2018;6:235–43. [28] Kroese DP, Rubinstein RY, Taimre T. Application of the cross-entropy method to
[8] Fenza G, Gallo M, Loia Vi. Drift-aware methodology for anomaly detection in smart clustering and vector quantization. J Global Optim 2007;37:137–57.
grid. IEEE Access 2019;7:9645–57. [29] Glantz SA, Slinker BK. Primer of applied regression and analysis of variance.
[9] Jokar P, Arianpoo N, Leung VCM. Electricity theft detection in AMI using customers’ McGraw-Hill; 1990.
consumption patterns. IEEE Trans Smart Grid 2016;7:216–26. [30] Robert P, Olufunmilayo T, Hao C. Components of information for multiple resolu-
[10] Pinceti A, Sankar L, Kosut O. Load redistribution attack detection using machine tion comparison between maps that share a real variable. Environ Ecol Stat
learning: a data-driven approach. 2018 IEEE power & energy society general 2008;15:111–42.
meeting. 2018.

10