{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,4]],"date-time":"2026-07-04T17:01:10Z","timestamp":1783184470643,"version":"3.54.6"},"reference-count":48,"publisher":"MDPI AG","issue":"2","license":[{"start":{"date-parts":[[2021,1,18]],"date-time":"2021-01-18T00:00:00Z","timestamp":1610928000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"name":"General Program of National Natural Science Foundation of China","award":["51575081"],"award-info":[{"award-number":["51575081"]}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Sensors"],"abstract":"<jats:p>Among the key components of a smart grid, advanced metering infrastructure (AMI) has become the preferred target for network intrusion due to its bidirectional communication and Internet connection. Intrusion detection systems (IDSs) can monitor abnormal information in the AMI network, so they are an important means by which to solve network intrusion. However, the existing methods exhibit a poor ability to detect intrusions in AMI, because they cannot comprehensively consider the temporal and global characteristics of intrusion information. To solve these problems, an AMI intrusion detection model based on the cross-layer feature fusion of a convolutional neural networks (CNN) and long short-term memory (LSTM) networks is proposed in the present work. The model is composed of CNN and LSTM components connected in the form of a cross-layer; the CNN component recognizes regional features to obtain global features, while the LSTM component obtain periodic features by memory function. The two types of features are aggregated to obtain comprehensive features with multi-domain characteristics, which can more accurately identify intrusion information in AMI. Experiments based on the KDD Cup 99 and NSL-KDD datasets demonstrate that the proposed cross-layer feature-fusion CNN-LSTM model is superior to other existing methods.<\/jats:p>","DOI":"10.3390\/s21020626","type":"journal-article","created":{"date-parts":[[2021,1,20]],"date-time":"2021-01-20T03:34:25Z","timestamp":1611113665000},"page":"626","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":127,"title":["Intrusion Detection System in the Advanced Metering Infrastructure: A Cross-Layer Feature-Fusion CNN-LSTM-Based Approach"],"prefix":"10.3390","volume":"21","author":[{"given":"Ruizhe","family":"Yao","sequence":"first","affiliation":[{"name":"Faculty of Electronic Information and Electrical Engineering, Dalian University of Technology, Dalian 116024, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ning","family":"Wang","sequence":"additional","affiliation":[{"name":"Faculty of Electronic Information and Electrical Engineering, Dalian University of Technology, Dalian 116024, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zhihui","family":"Liu","sequence":"additional","affiliation":[{"name":"Faculty of Electronic Information and Electrical Engineering, Dalian University of Technology, Dalian 116024, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Peng","family":"Chen","sequence":"additional","affiliation":[{"name":"Faculty of Electronic Information and Electrical Engineering, Dalian University of Technology, Dalian 116024, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xianjun","family":"Sheng","sequence":"additional","affiliation":[{"name":"Faculty of Electronic Information and Electrical Engineering, Dalian University of Technology, Dalian 116024, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"1968","published-online":{"date-parts":[[2021,1,18]]},"reference":[{"key":"ref_1","first-page":"1","article-title":"Intrusion Detection for Cybersecurity of Smart Meters","volume":"99","author":"Sun","year":"2020","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"46595","DOI":"10.1109\/ACCESS.2019.2909807","article-title":"Securing the Smart Grid: A Comprehensive Compilation of Intrusion Detection and Prevention Systems","volume":"7","author":"Sarigiannidis","year":"2019","journal-title":"IEEE Access"},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"830","DOI":"10.1109\/TSG.2017.2753738","article-title":"A Tunable Fraud Detection System for Advanced Metering Infrastructure Using Short-Lived Patterns","volume":"10","author":"Zanetti","year":"2019","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Park, C.H., and Kim, T. (2020). Energy Theft Detection in Advanced Metering Infrastructure Based on Anomaly Pattern Detection. Energies, 13.","DOI":"10.3390\/en13153832"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Pedramnia, K., and Rahmani, M. (2018, January 28\u201329). Survey of DoS Attacks on LTE infrastructure used in AMI System and Countermeasures. Proceedings of the Smart Grid Conference, Sanandaj, Iran.","DOI":"10.1109\/SGC.2018.8777832"},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Liu, H., and Lang, B. (2019). Machine Learning and Deep Learning Methods for Intrusion Detection Systems: A Survey. Appl. Sci., 9.","DOI":"10.3390\/app9204396"},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"51","DOI":"10.1016\/j.neucom.2019.11.016","article-title":"A novel statistical analysis and autoencoder driven intelligent intrusion detection approach","volume":"387","author":"Ieracitano","year":"2020","journal-title":"Neurocomputing"},{"key":"ref_8","doi-asserted-by":"crossref","first-page":"178","DOI":"10.1016\/j.asoc.2014.01.028","article-title":"A novel hybrid KPCA and SVM with GA model for intrusion detection","volume":"18","author":"Kuang","year":"2014","journal-title":"Appl. Soft Comput."},{"key":"ref_9","first-page":"1","article-title":"A hybrid method consisting of GA and SVM for intrusion detection system","volume":"27","author":"Rahmani","year":"2016","journal-title":"Neural Comput. Appl."},{"key":"ref_10","unstructured":"Tahir, H.M., Hasan, W., and Said, A.M. (2015, January 11\u201313). Hybrid Machine Learning Technique for Intrusion Detection System. Proceedings of the International Conference on Computing and Informatics, Istanbul, Turkey."},{"key":"ref_11","first-page":"277","article-title":"Malicious Traffic Detection Using K-means","volume":"41","author":"Shin","year":"2016","journal-title":"J. Korean Inst. Commun. Inf. Sci."},{"key":"ref_12","doi-asserted-by":"crossref","unstructured":"Tang, C., Luktarhan, N., and Zhao, Y. (2020). SAAE-DNN: Deep Learning Method on Intrusion Detection. Symmetry, 12.","DOI":"10.3390\/sym12101695"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Thapa, N., Liu, Z., Kc, D.B., Gokaraju, B., and Roy, K. (2020). Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems. Future Internet, 12.","DOI":"10.3390\/fi12100167"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"13546","DOI":"10.1109\/ACCESS.2019.2893871","article-title":"Introducing Deep Learning Self-Adaptive Misuse Network Intrusion Detection Systems","volume":"7","author":"Papamartzivanos","year":"2019","journal-title":"IEEE Access"},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"38597","DOI":"10.1109\/ACCESS.2019.2905633","article-title":"A Deep Learning Method with Filter Based Feature Engineering for Wireless Intrusion Detection system","volume":"7","author":"Kasongo","year":"2019","journal-title":"IEEE Access"},{"key":"ref_16","unstructured":"Anderson, J.P. (1980). Computer Security Threat Monitoring and Surveillance, James P. Anderson Co."},{"key":"ref_17","first-page":"235","article-title":"Statistical fraud detection: A review","volume":"17","author":"Bolton","year":"2004","journal-title":"Oper. Res."},{"key":"ref_18","unstructured":"Kou, Y., Lu, C.T., and Sirwongwattana, S. (2004, January 21\u201323). Survey of fraud detection techniques. Proceedings of the IEEE International Conference on Networking, Taipei, Taiwan."},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"216","DOI":"10.1109\/TSG.2015.2425222","article-title":"Electricity Theft Detection in AMI Using Customers\u2019 Consumption Patterns","volume":"7","author":"Jokar","year":"2017","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Alseiari, F.A.A., and Aung, Z. (2015, January 14\u201315). Real-time anomaly-based distributed intrusion detection systems for advanced Metering Infrastructure utilizing stream data mining. Proceedings of the International Conference on Smart Grid & Clean Energy Technologies, Offenburg, Germany.","DOI":"10.1109\/ICSGCE.2015.7454287"},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Vijayanand, R., Devaraj, D., and Kannapiran, B. (2017, January 1\u20137). Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid. Proceedings of the 4th International Conference on Advanced Computing and Communication Systems, Coimbatore, India.","DOI":"10.1109\/ICACCS.2017.8014590"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1005","DOI":"10.1109\/TII.2016.2543145","article-title":"Decision Tree and SVM-Based Data Analytics for Theft Detection in Smart Grid","volume":"12","author":"Jindal","year":"2016","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Yuancheng, L., Rixuan, Q., and Sitong, J. (2018). Intrusion detection system using Online Sequence Extreme Learning Machine (OS-ELM) in advanced metering infrastructure of smart grid. PLoS ONE, 13.","DOI":"10.1371\/journal.pone.0192216"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Boumkheld, N., Ghogho, M., and Koutbi, M.E. (2016, January 5\u20137). Intrusion detection system for the detection of blackhole attacks in a smart grid. Proceedings of the 4th International Symposium on Computational and Business Intelligence, Olten, Switzerland.","DOI":"10.1109\/ISCBI.2016.7743267"},{"key":"ref_25","first-page":"1800","article-title":"Intrusion Detection and Prevention for ZigBee-Based Home Area Networks in Smart Grids","volume":"9","author":"Jokar","year":"2016","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Almakrami, H. (2016, January 5\u20137). Intrusion detection system for smart meters. Proceedings of the 2016 Saudi Arabia Smart Grid, Jeddah, Saudi Arabia.","DOI":"10.1109\/SASG.2016.7849674"},{"key":"ref_27","doi-asserted-by":"crossref","first-page":"89507","DOI":"10.1109\/ACCESS.2019.2925838","article-title":"HML-IDS: A Hybrid-Multilevel Anomaly Prediction Approach for Intrusion Detection in SCADA Systems","volume":"7","author":"Khan","year":"2019","journal-title":"IEEE Access"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"2505","DOI":"10.1109\/TSG.2017.2703842","article-title":"Real-Time Detection of False Data Injection Attacks in Smart Grid: A Deep Learning-Based Intelligent Mechanism","volume":"8","author":"He","year":"2017","journal-title":"IEEE Trans. Smart Grid"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"1606","DOI":"10.1109\/TII.2017.2785963","article-title":"Wide & Deep Convolutional Neural Networks for Electricity-Theft Detection to Secure Smart Grids","volume":"14","author":"Zheng","year":"2017","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Ullah, A., Javaid, N., and Omaji, S. (2020, January 15\u201319). CNN and GRU based Deep Neural Network for Electricity Theft Detection to Secure Smart Grid. Proceedings of the 2020 International Wireless Communications and Mobile Computing, Limassol, Cyprus.","DOI":"10.1109\/IWCMC48107.2020.9148314"},{"key":"ref_31","first-page":"1","article-title":"CNID: Research of Network Intrusion Detection Based on Convolutional Neural Network","volume":"1","author":"Liu","year":"2020","journal-title":"Discret. Dyn. Nat. Soc."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"42210","DOI":"10.1109\/ACCESS.2019.2904620","article-title":"An Intrusion Detection Model Based on Feature Reduction and Convolutional Neural Networks","volume":"7","author":"Xiao","year":"2019","journal-title":"IEEE Access"},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"64366","DOI":"10.1109\/ACCESS.2019.2917299","article-title":"Wireless Network Intrusion Detection Based on Improved Convolutional Neural Network","volume":"7","author":"Yang","year":"2019","journal-title":"IEEE Access"},{"key":"ref_34","doi-asserted-by":"crossref","first-page":"526","DOI":"10.1093\/comjnl\/bxx101","article-title":"An Ensemble Method based on Selection Using Bat Algorithm for Intrusion Detection","volume":"61","author":"Shen","year":"2018","journal-title":"Comput. J."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Zhang, K., Hu, Z., Zhan, Y., Wang, X., and Guo, K. (2020). A Smart Grid AMI Intrusion Detection Strategy Based on Extreme Learning Machine. Energies, 13.","DOI":"10.3390\/en13184907"},{"key":"ref_36","first-page":"136","article-title":"Applying long short-term memory recurrent neural networks to intrusion detection","volume":"56","author":"Staudemeyer","year":"2015","journal-title":"South. Afr. Comput. J."},{"key":"ref_37","doi-asserted-by":"crossref","unstructured":"Kim, J., and Thu, H.L.T. (2016, January 15\u201317). Long Short Term Memory Recurrent Neural Network Classifier for Intrusion Detection. Proceedings of the International Conference on Platform Technology & Service, Jeju, Korea.","DOI":"10.1109\/PlatCon.2016.7456805"},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"48697","DOI":"10.1109\/ACCESS.2018.2867564","article-title":"An Intrusion Detection System Using a Deep Neural Network with Gated Recurrent Units","volume":"6","author":"Congyuan","year":"2018","journal-title":"IEEE Access"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Hasan, N., Toma, R.N., Nahid, A.-A., Islam, M.M., and Kim, J.-M. (2019). Electricity Theft Detection in Smart Grid Systems: A CNN-LSTM Based Approach. Energies, 12.","DOI":"10.3390\/en12173310"},{"key":"ref_40","doi-asserted-by":"crossref","first-page":"1792","DOI":"10.1109\/ACCESS.2017.2780250","article-title":"HAST-IDS: Learning Hierarchical Spatial-Temporal Features Using Deep Neural Networks to Improve Intrusion Detection","volume":"6","author":"Wang","year":"2018","journal-title":"IEEE Access"},{"key":"ref_41","doi-asserted-by":"crossref","unstructured":"Vinayakumar, R., Soman, K.P., and Poornachandran, P. (2017, January 13\u201316). Applying convolutional neural network for network intrusion detection. Proceedings of the International Conference on Advances in Computing, Communications and Informatics, Karnataka, India.","DOI":"10.1109\/ICACCI.2017.8126009"},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"436","DOI":"10.1038\/nature14539","article-title":"Deep learning","volume":"521","author":"LeCun","year":"2015","journal-title":"Nature"},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"Javaid, A.Y., Niyaz, Q., and Sun, W. (2015, January 3\u20135). A Deep Learning Approach for Network Intrusion Detection System. Proceedings of the 9th EAI International Conference on Bio-Inspired Information and Communications Technologies, New York, NY, USA.","DOI":"10.4108\/eai.3-12-2015.2262516"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Tavallaee, M., Bagheri, E., and Lu, W. (2009, January 8\u201310). A detailed analysis of the KDD CUP 99 data set. Proceedings of the IEEE Symposium on Computational Intelligence for Security and Defense Applications, Ottawa, ON, Canada.","DOI":"10.1109\/CISDA.2009.5356528"},{"key":"ref_45","first-page":"1790","article-title":"Feature Reduction using Principal Component Analysis for Effective Anomaly\u2013Based Intrusion Detection on NSL-KDD","volume":"2","author":"Shilpa","year":"2010","journal-title":"Int. J. Eng. Sci. Technol."},{"key":"ref_46","first-page":"1","article-title":"K-Means Clustering Approach to Analyze NSL-KDD Intrusion Detection Dataset","volume":"3","author":"Kumar","year":"2013","journal-title":"Int. J. Soft Comput. Eng."},{"key":"ref_47","doi-asserted-by":"crossref","unstructured":"Al-Daweri, M.S., Zainol Ariffin, K.A., and Abdullah, S. (2020). An Analysis of the KDD99 and UNSW-NB15 Datasets for the Intrusion Detection System. Symmetry, 12.","DOI":"10.3390\/sym12101666"},{"key":"ref_48","doi-asserted-by":"crossref","unstructured":"Zhan, X., Yuan, H., and Wang, X. (2019, January 27\u201329). Research on Block Chain Network Intrusion Detection System. Proceedings of the 2019 International Conference on Computer Network, Electronic and Automation, Xi\u2019an, China.","DOI":"10.1109\/ICCNEA.2019.00045"}],"container-title":["Sensors"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/2\/626\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T05:12:18Z","timestamp":1760159538000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/1424-8220\/21\/2\/626"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,1,18]]},"references-count":48,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2021,1]]}},"alternative-id":["s21020626"],"URL":"https:\/\/doi.org\/10.3390\/s21020626","relation":{},"ISSN":["1424-8220"],"issn-type":[{"value":"1424-8220","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,1,18]]}}}