1 Introduction

The development of the industry and the rise in population have increased the consumption of electricity. The upward trend of electricity consumption is not going to curb [1, 2]. While the electricity providers make every effort to fulfill the electricity consumption and to provide the best service to the customers, the service providers are suffering losses in technical and non-technical forms. Technical losses are usually caused by short circuits, power outage, or grid failures. Non-technical losses are mainly caused by humans’ inappropriate usage of electricity and electricity theft, etc. [3, 4]. In the USA alone, electricity theft was reported to cost the providers around <DOLLAR/>6B/year. Energy theft has been a serious problem in the traditional power system [5].

Identifying the non-technical factors and mitigating the losses incurred by them are the major concerns of the electricity service providers [6, 7]. The approach of anomaly detection in the traditional power grid was as follows: If abnormal electricity consumption behaviors were detected by manually monitored, the inspection team would be sent to the detected locations for further inspection. The detection result was considered abnormal if the electricity consumption changes drastically from the normal consumption in either way if it was increased or decreased. This traditional approach required tedious man-hour and money and added more burden to the electricity service providers. Meanwhile, the approach had a low detection rate of below 5% [8].

The requirements for greater efficiency, reliability, and security, as well as the concerns of anomaly detection for electricity consumption, constantly highlight the necessity of a leap in the power grid. This leap is referred to as the smart grid. The smart grid is defined as an electricity network that efficiently integrates the behaviors and actions of all users connected to it such as generators, consumers, and those that do both [9, 10]. The smart grid is capable of delivering electricity more efficiently and making a timely response to wide-ranging events, such as detecting abnormal electricity consumption and adopting the corresponding strategies [11, 12].

As a key technology in the smart grid, advanced metering infrastructure (AMI) can reduce the probability of electricity theft through its excellent monitoring capacities and the detailed usage measurements [13]. Due to the widespread popularity, smart meters provide the opportunity for the utilizers to collect massive electricity consumption data. High-resolution data collected by smart meters provide information on electricity consumption and the lifestyles of the consumers [14]. With the analysis result of customs’ normal power consumption, irregular statistics can reveal some malicious activities. However, the detection rate is limited by some shortcomings in existing classification schemes:

  1. 1

    Data imbalance. The numbers of normal and abnormal samples are out of proportion. Benign samples are easy to get through analyzing historical data. In contrast, abnormal samples or theft samples are rare or do not exist in the dataset. Lack of exhaustive dataset limits the detection rate.

  2. 2

    Non-malicious factors’ interference. The detection rate can be influenced by several non-malicious factors, such as the dynamical change of consumers’ energy demands and the diversity of appliances’ categories, etc. If these non-malicious factors are not properly distinguished and dealt with, they are likely to be mistaken for the false alarm which can result in bad performance of the detection.

To achieve acceptable detection accuracy and manage plenty of smart meters in safe and reliable ways, utilities have to extend existing systems to a distributed data center. Cloud computing, in this respect, is considered to play the key role [15]. It refers to a new computation paradigm, which has extensively spread among industries, academic organizations, and individual clients. In the smart grid, cloud computing can deal well with the massive data generated by millions of smart meters which are deployed in every corner of the city [16]. Cloud computing is capable of improving the detection rate of energy consumption for the following reasons [17]. Managing massive data and distinguishing the malicious factors are complex and beyond the processing capability of the existing system in the smart grid. Therefore, with the aim of achieving a higher detection rate, cloud computing can be utilized to optimize information processing due to the storage and computing mechanisms [18].

The paper is organized as follows. Section 2 introduces the definitions of anomalies and anomaly detection. Section 3 surveys proposed frameworks of anomaly detection for electricity consumption and the framework of anomaly detection for electricity consumption in edge-cloud computing. Section 4 presents the centralized detection of anomaly electricity consumption with big data analysis and decentralized detection of anomaly electricity consumption with edge-cloud computing. Section 5 describes the applications of centralized and decentralized methods for anomaly electricity consumption. Section 6 discusses the open challenges of the accuracy of detection and anomaly detection for electricity consumption with edge computing.

2 Definition

In this section, we first elaborate on the definitions of anomalies and anomaly detection, respectively, then discuss three categories of anomaly detection techniques, and particularly focus on anomaly detection for electricity consumption.

2.1 Anomaly electricity consumption

Anomalies, in general, are also known as outliers, deviants, discordance, or exceptions [19]. Generally, anomalies encompass the following types:

  1. i

    Point anomalies. While a data point is distinct from the rest of the data, it could refer to as a point anomaly. A point anomaly is the simplest case and is very common.

  2. ii

    Contextual anomalies. While a data point is anomalous in one specific context, it could refer to as a contextual anomaly. In other words, contextual anomalies often are identified in time-series and spatial data.

  3. iii

    Collective anomalies. While a collection of data is anomalous, it could refer to as a collective anomaly. Generally, the term “collective” represents the spatial-temporal collection. Even if a set of data is a collective anomaly, it may not be a point anomaly, respectively.

Table 1 lists four definitions of anomalies, respectively. Definitions are all from the perspective of the discrepancies of data [20]. However, for a more comprehensive definition, Johnson et al. [21] not only considered the distinctions of data but also discussed the individual characteristics of each data point. Given aberrant data may do harm for analysis and lead to deviated parameters and faulty results, anomaly detection is a key task to scale down such potential risks. In addition, three definitions of anomaly detection are also presented in Table 1.

Table 1 Definitions of anomalies and anomaly detection
Full size table

Due to the data explosion and the hidden disadvantage of aberrant data, detecting anomalous events is becoming essential increasingly. In Table 2, these three categories of anomaly detection techniques are summarized.

  1. 1)

    Classification:

    1. i)

      Bayesian network. Khosravi et al. [29] leveraged an improved dynamic Bayesian network to satisfy the demand of a detection model that recognizes anomalous events in the data.

      Table 2 Techniques for anomaly detection
      Full size table
    2. ii)

      Support vector machine (SVM). Miao et al. [25] proposed a distributed online one-class SVM algorithm to discover anomalous data via wireless sensor networks and get a decentralized loss function.

    3. iii)

      Neural networks. Sabokrou et al. [26] used an unsupervised fully convolutional neural network providing anomalous detection in the video stream.

  2. 2)

    Nearest neighbor:

    1. i)

      KNN algorithm. Wang et al. [41] used the KNN algorithm based on the design and simulation of the QualNet simulation platform.

    2. ii)

      Relative density-based method. Gan et al. [32] proposed a method using an improved local outlier factor (LOF) algorithm for implementing adaptive dynamic adjustment of parameters in network traffic scenarios.

  3. 3)

    Clustering:

    1. i)

      General clustering. Wazid et al. [35] put forward a new intrusion approach using the k-means clustering algorithm for the hybrid anomaly in the wireless sensor network.

    2. ii)

      Co-clustering. In [44], a novel scheme of anomaly detection based on co-clustering was developed, respectively.

2.2 Cloud computing

Recently, with the speedy advances of the economy and improvement of residents’ living standards, the amount of power usage is getting higher increasingly and the requirement of utilizing electricity tends to diversify. In 2007, the Energy Independence and Security Act (EISA) stated a national policy to support the National Institute of Standards and Technology (NIST) to create a new power grid [45]. Therefore, to make an extensive distributed power delivery network, a novel power grid, the smart grid, was proposed that is informative, digital, automatic, and interactive. Moreover, there are several characteristics of the smart grid concluded by EISA, including improving power reliability and quality, optimized utilization, higher capacity, and efficiency of the electric network [46]. Given the emergence of smart meters and sensors, anomaly detection could be better adapted to get access to real-time measured data in smart grids aiming to identify the irrelevant data or events that happen infrequently. In particular, the detection of anomalous electricity consumption is one of the most serious issues for electricity providers in smart grids. In this section, losses of electricity in smart grids were discussed; after that, we will show leveraging cloud computing platforms to detect electrical consumption anomalies.

  1. 1)

    Losses of electricity: Due to the rapid advances in modernization and industrialization, the consumption of electricity rises rapidly. Meanwhile, energy providers could face serious problems with anomalous electricity consumption since there are billions of dollars which are lost in energy utilization. In recent years, anomaly detection attracted much attention to electricity consumption in the power systems since it is beneficial for electricity providers to find unusual events that happen infrequently or unconventionally, enhance operational safety, and diminish revenue losses. Particularly, as shown in Table 3, losses of electricity are typically classified into two categories as follows: (i) Technical losses—in the power grid, technical losses are caused by power dissipation, transmission, and distribution loss or equipment failure, which means it occurs inevitably and naturally. Technical losses give rise to financial losses and inefficient usage of energy for a country. Therefore, the improvement of technical losses should be considered from the perspective of a country rather than an institution or an organization. (ii) Non-technical losses (NTLs)—NTLs, on the other hand, are specifically caused by utilizing electricity illegally, electricity theft, meter failure, or bill fraud [47, 48]. Compared with technical losses, NTLs make up the most portion of electricity losses and lead to a huge amount of economic cost. The electricity theft by connecting to the power grid illegally or unauthorized tampering of electric meter is one of the most typical cases in NTLs. It is estimated that up to <DOLLAR/>25 billion was lost in electricity usage due to power theft worldwide every year.

    Table 3 Techniques for anomaly detection
    Full size table
  2. 2)

    Using cloud platforms to detect power consumption anomalies: During the last decade, a novel computation paradigm, cloud computing, has been developing dramatically, which has extensively spread among industries, academic organizations, and individual clients. In general, the principle of cloud computing is to leverage distributed data centers or central servers to satisfy the demand of computer resources, specifically data storage (e.g., cloud storage) and data computing, at any time for different customers [49]. With the development of smart grids in recent years, the electricity requirement from consumers has increased sharply in diverse periods. The pressure from discovering anomalous electricity consumption, especially NTLs, as well as security analysis and communication efficiency, is growing for smart grid systems. Consequently, electricity providers need to integrate most resources into cloud computing platforms for more powerful computation capability and a higher efficient communication network. Compared with the conventional identifying patterns for power consumption, a novel detecting model of electricity consumption with cloud computing [50], which will be elaborated on in Section 3, can boost the efficiency of resource utilization and reduce the time of computation. Therefore, energy providers can discover anomalous electricity usage in real-time by leveraging cloud platforms.

3 Framework

Considering that anomalous electricity consumption could give rise to multiple revenue losses, significant efforts have been spent on identifying unusual events of electricity use by energy service providers. In this section, the frameworks of anomaly detection for electricity consumption were reviewed, and we propose a framework with a particular focus on cloud computing.

3.1 Surveys on proposed frameworks of anomaly detection for electricity consumption

In general, anomaly detection in smart grid systems relates to unusual power consumption, especially NTLs which encompass illegal electricity usage, theft of power, and bill fraud. It could lead to numerous economic costs every year globally. Electricity theft, in particular, plays a key role in NTLs using power by unauthorized connection to power systems or faking bills without paying [51]. There is a considerable body of studies in anomaly detection for electricity consumption to identify aberrant activities of power theft and minimize financial costs for energy providers. This section introduces a survey on existing frameworks of anomaly detection for power consumption, then summarizes it in Table 4. Moghaddass et al. [45] put forward an anomaly detection framework in real-time to discover the events, conditions, and behaviors that occur infrequently. Such a framework is much different from existing works that it is designed based on the hierarchical structure of the grid and smart grid data and solves significant challenges, including multivariate counting data, missing points, high-dimensionality, and variable selection. Yip et al. [46] proposed a novel anomaly detection framework aiming to assess the electricity usage of consumers for discovering the possible behaviors of power theft, energy fraud, and meter errors. Due to the existing approaches for discovering NTLs that do not perform very well, it is necessary to utilize a new framework that can availably identify electricity theft for minimizing revenue costs. Therefore, they proposed such a framework using linear programming to address the problems concerning existing detection methods. Tao et al. [47] developed a statistical framework that can detect electricity theft and discover consumers involved based on information usage of higher-order statistics of energy consumption. Owing to the financial losses by electricity theft, advanced metering infrastructure (AMI) has emerged to control the occurrence and decrease the potential risk of energy theft. To improve the capability of monitoring anomalous events, smart meters and sensors are utilized extensively. Qiu et al. [48] designed a monitoring and alarm framework that describes the patterns of consumers’ electricity consumption by acquiring multiple features. To improve the detection efficiency, the framework leverages the grid processing technology that chooses outliers of low-density regions. Xu et al. [56] put forward an AMI intrusion detection framework aiming to integrate the sensors and consumption data, as well as integrate meter audit logs of events to the anomaly detection model for detecting electricity theft with higher precision. Although several proposed frameworks, as mentioned above, can discover and recognize electricity theft-related events, they may have some drawbacks as follows: (i) Limited computation resources—driven by the increasing requirement of electricity, the scale of power data or information from meters or sensors generated by consumers is expanding constantly. The local data servers in power systems are not able to execute such computational and processing tasks due to finite computing power. (ii) Limited storage capability—in general, the storage capability of local servers in power systems is hard to satisfy the infinite storage. Once the storage limit will be reached, the data center needs to extend the number of servers, which is inefficient, unadaptable, and costly. Therefore, in the next section, we will propose a novel framework of anomaly detection for electricity consumption by using cloud computing.

Table 4 Proposed frameworks of anomaly detection for electricity consumption
Full size table

3.2 Framework of anomaly detection for electricity consumption with cloud computing

Besides the overview of proposed frameworks, we further propose a framework of anomaly detection for electricity consumption by utilizing cloud platforms, as illustrated in Fig. 1. The goal of such a framework is to identify anomalous power consumption with high scalability, availability, and reliability. Main components of this framework are described as follows:

  1. 1)

    Data collection: Due to the improvement of industrialization and modernization, the amounts of power consumption are getting higher significantly. One of the big features of smart grids is the data explosion generated from meters or sensors. Compared with the conventional meters, the capability of smart meters is gathering electricity consumption from customers and appending more power information, including the values of voltage, phase angle, and frequency [62]. Smart meters can also read real-time electricity use and transmit these data to the energy providers. In our framework, the data collection phase contains three steps to collect higher accurate, complete, and consistent data.

    1. Step 1:

      Data acquisition. Multiple data of power consumption generated from industries, buildings, and households are collected by smart meters or sensors. All these electrical data do not store to the database or data centers immediately; however, they could be transferred to executing further processing in the next step.

      Fig. 1
      figure 1

      The framework of anomaly detection for electricity consumption with cloud computing

      Full size image
    2. Step 2:

      Data cleaning. Although numerous electricity consumption data are gathered, we may need to remove irrelevant data. Smart grid data have the characteristics of time-series, such as intra-week, intra-day, intra-hour, and real-time. There may have some incomplete data, error data, duplicated data, or noise. Therefore, before utilizing these raw data to identify anomalous events, they could be cleaned.

    3. Step 3:

      Data transmission. After pre-processing collected data, these ready data will be transmitted to a cloud data center. Smart grids could utilize the characteristics of cloud platforms which can provide high fault-tolerance through redundancy and rollback-recovery through versioned copies [63]. Furthermore, cloud data centers could extend the existing communication network to a distributed network for satisfying the demand of sending smart meter data in a reliable, real-time, and elastic way.

  2. 2)

    Anomaly detecting: In this stage, a detection model, deployed in the cloud computing platform, will be used to identify anomalous electricity consumption data in smart grids, especially power theft. Compared with the conventional detection model distributed on local servers, the utilization of cloud computing can offer consumers a virtualized infrastructure and raw materials of hardware (e.g., processing, memory, and servers). The virtual machines with different configurations based on clients’ requirements are provisioned, which improves the flexibility and customization for using computing resources. The size of ready data generated from smart meters or sensors is considerable. Therefore, traditional data centers of power grids may not be capable of processing such scale data due to limited computing performance, while the cloud data center has a more powerful computing capability. After data cleaning, the features of pre-processed data will be calculated. The data size could be scaled down by removing data with duplicated or similar features to reduce the data dimension. Moreover, several methods are available for detecting anomalous electricity consumption, including neural network, support vector machine, KNN algorithm, and Bayesian network [64]. Such approaches run in real-time for anomaly detection in cloud platforms, which is the key part of this stage. The results of the anomaly detection model could depend on the selected method and its outputs. After that, the outputs are analyzed and evaluated to identify anomalies.

  3. 3)

    Results evaluation: In this stage, we need to provide insight into different factors that could influence the performance of anomaly detection for electricity consumption. For a better intuition about its advantages and limitations, the following metrics could be used to evaluate the performance of the detection model: (i) Accuracy—the accuracy is the percentage of the number of correctly detecting values Nc out of the total number of the detected values N. The accuracy rate Ra is calculated by Ra=Nc/N. For example, a high Ra means a better detection performance. (ii) False positives—if some negative samples are identified with the positive or non-negative samples by detection method, that case is referred to as false positives [65]. Supposed that the number of false positives is FP, and the number of true negatives is TN, the false positive rate FPR is calculated by FPR = FP/(TN + FP). (iii) False negatives—on the other hand, if some positive samples are identified with the negative or non-positive samples by detection method, that case is referred to as false negatives. Supposed that the number of false negatives is FN, and the number of true negatives is TP, the false negative rate FNR is calculated by FNR = FN/(TP + FN) [66].

4 Methods for prevention of anomaly power consumption

Currently, plenty of studies have been carried out which point to the anomaly detection of electricity. In this section, we will methodically present, categorize, and outline the extant methods both in the centralized and decentralized aspects.

4.1 Centralized detection of anomaly electricity consumption with big data analysis

Centralized detection of anomaly electricity consumption methods can be generally separated into two sides: the mathematical analysis methods and machine learning algorithms. In this section, we will discuss these two sides in great detail.

4.1.1 Mathematical methods

In truth, there is presently no state-of-the-art method that has been proposed in the mathematical area of anomaly detection for electricity consumption, and the existing methods may all have different benefits and weaknesses. Therefore, we extract mathematical analysis methods to high-dimensional random matrix methods and sequence discretization methods [67]. In this section, we take a holistic view of these methods, with the hope of setting a clear direction for future research.

Tasfi et al. [68] described the merit of minimum variance distortionless response beam-forming (or Capon beam-forming). Moreover, the author analyzed the need of estimating the inverse covariance matrix of the received signals from data. Besides, the author designed an estimator to optimize the inverse covariance, which is suitable for high-dimensional settings.

Rashid et al. [69] identified and defined factor models to reduce dimension. Furthermore, the author presented a new approach to estimate high-dimensional factor models, using the empirical spectral density of residuals. The proposed method is robust to noise or the presence of weak factors. Whereas the method failed to employ more general residual modeling, so further study is needed to calculate the distribution readily.

Morris et al. [70] paid attention to the problem of low-rank plus sparse matrix decomposition for big data. Meanwhile, the author proposed an approach that transforms the decomposition problem into a subspace learning problem. In addition, the author proposed adaptive sampling algorithms to address the problem of column/row sampling.

Basumallik et al. [71] performed an average case analysis of the generalization dynamics of large neural networks trained using gradient descent. Especially, the author studied the practically-relevant “high-dimensional” to use random matrix theory and exact solutions in linear models. As a result, the author identified two novel phenomena underlying this behavior in over-complete models.

Table 5 shows the benefits and weaknesses of mathematical methods.

Table 5 Benefits and weaknesses of mathematical methods
Full size table

4.1.2 Machine learning algorithms

During the post-more law age, the hash rate ceases to be the restraining factor in the big data processing area. Therefore, machine learning algorithms have become mainstream in the electricity consumption detection industry. In this section, we will explain the applications of machine learning algorithms based on the most common model: deep neural networks (DNN) and recurrent neural networks (RNN).

Rashid et al. [69] proposed a revised method based on the non-intrusive load monitoring theory. They constructed a workload model by using the REFIT dataset from smart-meter devices and regarded it as a built-in prediction model for the method. The method focuses on estimating the electricity consumption based on the built-in model to detect the anomaly consumption, if and only if the worker node is in running.

Eldali et al. [73] investigated the influence of acquisition frequency in the electrical power system and proposed a detecting method by regulating the frequency dynamically for every worker node in the system. By incorporating the detecting rate of different acquisition frequencies under the normal condition and the sudden increase condition, they found the corresponding frequency for each situation. The method detects anomaly consumption by looking for changing data under the appropriate acquisition frequency.

Guarany et al. [74] proposed a classification method base on the CNN model. They identified the problem as a multiclass classification problem and combined the electricity consumption data (e.g., worker nodes’ states, aggressive behaviors, common time sequences) as a multivariate vector for feeding the CNN model.

Kou et al. [75] collected the electricity consumption dataset generated by the smart sockets and used the dataset to build the user behavior model. They proposed a classification method by inferring users’ abnormal behaviors, based on estimating the operating states of users’ smart home devices in view of the user behavior model.

Table 6 shows the benefits and weaknesses of machine learning algorithms.

Table 6 Benefits and weaknesses of machine learning algorithms
Full size table

4.2 Decentralized detection of anomaly electricity consumption with edge-cloud computing

The centralized detection methods mainly focused on detecting the unnatural value in the dataset but neglect the trend of period series [76]. Instead, we use decentralized detection methods to find the anomaly trend in the dataset generated by smart appliances [77]. In this section, we will review some significant decentralized methods.

Buzau et al. [78] argued that the following two steps can identify anomalies: (1) electricity consumption forecasting and (2) anomaly detection. Consequently, the author proposed a shared connected deep neural network for forecasting electricity consumption time-series anomaly. What is more, the method of transferring learning knowledge between domains significantly to improve the forecasting results has been proposed.

García et al. [65] described the great impact of analyzing consumption to find unexpected behaviors. The research conducted by the author presents an experimental study of supervised and unsupervised neural networks for anomaly detection in electrical consumption. Besides, the result of experiments shows that the supervised approach has a significant improvement in the anomaly detection rate.

Xiang et al. [80] identified detecting consumption anomalies with a real-time big data analytic problem. Moreover, the author proposed a supervised learning and statistical-based anomaly detection method, and implemented a lambda system using the in-memory distributed computing framework, Spark, and its extension Spark Streaming.

Ahn and Wang [67] proposed a residential electrical load anomaly detection framework that includes a hybrid one-step-ahead load predictor and a rule-engine-based load anomaly detector for the goal of improving prediction and detection accuracy. Meanwhile, through employing the Bayesian information criterion, the author reduced the influence of the over- or under-fitting problem.

Zhou et al. [82] utilized two subnetworks: one performs reconstruction and uses unlabeled data, while the other one performs classification with labeled data. On this basis, the author presented a deep semi-supervised convolutional neural network with confidence sampling for electrical anomaly detection.

5 Applications

5.1 Applications of centralized detection methods for the anomaly electricity consumption

The centralized detection methods for the anomaly electricity consumption process and analyze the obtained electricity consumption data uniformly, and the methods which are based on the big data have been widely used in practice. Advanced metering infrastructure (AMI), such as smart meters, can measure the user’s electricity consumption at fine-grained intervals, including the user’s electricity consumption, voltage level, and the switching status of power services. The smart meter sends these data to the data processing center for processing and analysis. In this process, the methods based on big data or other centralized detection ways are used to analyze the electricity data generated by a large number of electricity meters and these methods have provided a suitable solution for the detection of the anomaly electricity consumption. Cui et al. [72] used the centralized detection method and built a system to help a facilities management company to detect and visualize anomalous events in the school electricity consumption data. This system based on the centralized detection method can greatly improve the performance when detecting the anomaly electricity consumption in the school. Eldali et al. [73] got the AMI data through the smart meters and applied the AMI data to anomaly detection. They developed a kind of open-source computer software based on the centralized detection methods, and this software can analyze the AMI data and visualize the anomaly detection results. Silva et al. [74] anticipated the occurrence of anomaly electricity consumption with the centralized detection method. They applied this method to the data generated by the building in 20 weeks and achieved the expected result. At the same time, this method can be used for anomaly prediction directly.

5.2 Applications of decentralized detection methods for the anomaly electricity consumption

The decentralized detection methods for the anomaly electricity consumption distribute and analyze a large number of electricity consumption data by installing an electricity meter device in each household [86]. In the latest smart-grid architecture, millions of smart devices are distributed across buildings and homes over a wide geographical area and use smart meters to monitor electricity consumption. A large number of data will be generated under the architecture of the smart grid, but these data are difficult to handle with cloud computing alone and often lead to a large number of latency [87]. In this case, adopting edge-cloud computing or fog computing can effectively reduce delay and improve data processing efficiency[88]. In the process of electricity anomaly detection, the data such as current and voltage are obtained from the sensor of the smart electricity meter firstly, and then, the obtained data are trained and analyzed with an appropriate model so that the abnormal data can be extracted efficiently. EI-Awadi et al. [74] used fog computing to solve the problem of anomaly electricity consumption detection. They applied this method to the microgrid of the University of Vigo and detected the anomaly electricity consumption through the distributed collaboration of terminal devices. Qi et al. [89] used the decentralized detection method based on deep learning and extract the high-level representation from the data acquired automatically from the smart meters. This method has a good prospect for intelligent applications and can improve the efficiency of calculation. Buzau et al. [78] used an end-to-end solution based on the decentralized detection methods to solve the problem of the non-technical losses in anomaly electricity consumption, and this model has been used in Endesa, which is the largest electricity company in Spain.

6 Open challenges

The existing methods show good performance in anomaly electricity consumption detection, but at the same time, there are some shortcomings. In order to improve the accuracy and security of anomaly electricity consumption detection and ensure the reliable and efficient operation of the smart grid, the challenges in anomaly electricity consumption detection need to be further analyzed.

6.1 The accuracy of detection

Centralized and decentralized detections of anomaly electricity consumption can effectively know whether the user has anomaly electricity consumption, but in practical application, the accuracy of the two methods needs to be further improved [91]. At the same time, when we receive the electricity consumption data, we should ensure the security of the data transmission.

  1. 1

    Some anomaly detection methods use the AMI data to analyze the behavior of power users. But the AMI data do not have a common data format, so it is difficult to share the data generated by different providers.

  2. 2

    The smart grid consists of a large number of smart nodes, and this kind of network may be more vulnerable to malicious attacks. To ensure the security of the smart grid, it is necessary to detect any unusual behaviors in the smart grid.

  3. 3

    In the electric system, the malfunction of measuring instruments is almost inevitable and will affect the detection accuracy. Using the double devices or backing up the electricity consumption data is helpful to rectify the erroneous data.

6.2 Anomaly detection for electricity consumption in edge computing

After obtaining more accurate anomaly electricity detection data, the next step is to further improve the real-time performance of anomaly electricity detection. Real-time detection of anomaly electricity consumption needs to use a large amount of data, and it needs to be able to quickly process a large number of data streams in the real-time environment and use the edge calculation which can effectively improve the concurrency of data processing [92]. In the future anomaly electricity consumption detection, smart electricity meters with calculation performance can be set in each power consumption place, and a large amount of data calculation can be distributed to each smart electricity meter, so as to realize real-time detection of anomaly electricity consumption[93].

7 Conclusion

With the development of the industry and the population rise, the upward trend of electricity consumption is not going to cease. Meanwhile, due to some technical and non-technical factors such as electricity theft, anomaly detection for electricity consumption in the traditional power grid needs to be upgraded. As a result, the smart grid is an enhancement of the traditional power grid. With the utilization of advancing technologies, for instance, cloud computing, anomaly detection for electricity consumption in the smart grid can achieve acceptable accuracy. In this paper, the definition of anomalies and anomaly detection was first introduced. Then, comprehensive surveys on the proposed framework of anomaly detection for electricity consumption were conducted, and the framework of anomaly detection for electricity consumption with cloud computing was proposed. Afterward, overviews of methods and applications of centralized and decentralized detection were provided. Finally, the open challenges of the accuracy of detection and anomaly detection for electricity consumption with edge computing were discussed. We hope the survey is capable of eliciting further research on anomaly detection for electricity consumption with cloud computing.