Machine Learning-Based Detection of DDoS Attacks on Advanced Metering Infrastructure Networks in Smart Grid

Abstract

Advanced Metering Infrastructure (AMI) networks in smart grids face evolving cybersecurity threats, with Distributed Denial of Service (DDoS) attacks posing critical risks to network availability and operational integrity. This paper presents a comprehensive evaluation of deep learning architectures for DDoS attack detection in AMI environments, focusing on Convolutional Neural Network (CNN), CNN-Long Short-Term Memory (CNN-LSTM), and CNN-Gated Recurrent Unit (CNN-GRU) hybrid approaches. Using a dataset of 72,007 AMI samples enhanced with realistic DDoS attack simulations covering six attack categories, we implemented extensive feature engineering generating 3,398 features optimized to 75 discriminative indicators. The methodology incorporates synthetic attack generation maintaining 30% attack ratio with stratified data partitioning for robust evaluation. The results gotten from experiments demonstrate that the CNN architecture achieves excellent performance with 86.52% accuracy, 91.08% precision, and 85.73% F1-score, requiring only 23.7 minutes training time and 291,841 parameters. The CNN-LSTM hybrid shows competitive performance with 85.82% accuracy and enhanced temporal modeling capabilities. Both architectures significantly outperform the more complex CNN-GRU variant, establishing CNN-based approaches as optimal for AMI security applications. This research contributes evidence-based architectural guidance for AMI threat detection systems, demonstrating practical deployment solutions that balance detection accuracy with computational efficiency for real-world utility environments.