Electricity Theft Detection Using Rule-Based Machine Learning (rML) Approach

Since electricity theft affects non-technical losses (NTLs) in power distribution systems, power companies are genuinely quite concerned about it. Power companies can use the information gathered by Advanced Metering Infrastructure (AMI) to create data-driven, machine learning-based approaches for Electricity Theft Detection (ETD) in order to solve this problem. The majority of data-driven methods for detecting power theft do take usage trends into account while doing their analyses. Even though consumption-based models have been applied extensively to the detection of power theft, it can be difficult to reliably identify theft instances based only on patterns of usage. In this paper, a novel rule-based combined machine learning (rML) technique is developed for power theft detection to address the drawbacks of systems that rely just on consumption patterns. This approach makes use of the load profiles of energy users to establish rules, identify the rule or rules that apply to certain situations, and classify the cases as either legitimate or fraudulent. The UEDAS smart business power consumption dataset's real-world data is used to assess the performance of the suggested technique. Our technique is an innovation in theft detection that combines years of intensive theft tracking with the use of rule-based systems as feature spaces for traditional machine learning models. With an astounding 93% recall rate for the rule-based feature space combination of the random forest classifier, this novel approach has produced outstanding results. The acquired results show a noteworthy accomplishment in the field of fraud detection, successfully detecting fraudulent consumers 77% of the time during on-site examination.


INTRODUCTION (GİRİŞ)
Machine learning offers promising solutions for anti-electricity stealing by analyzing users' electricity consumption behavior.However, in the real world, due to different patterns of electricity consumption and imbalanced numbers of fraudulent activities, these solutions may fail to generalize effectively.Electricity theft is a significant problem that affects the normal operation of power grids and causes economic losses for power enterprises.In developing countries, the electricity theft rate can be as high as 30%, resulting in substantial financial impacts on power suppliers [1].According to recent research, the global annual loss due to electricity theft amounts to an astonishing $96 billion [2].To combat this issue, efficient anti-electricity theft measures must be implemented to ensure a reasonable power supply and rational use of electricity, thereby reducing economic losses as much as possible [1].Electricity theft detection methods can be broadly categorized into three categories: manually-driven, physically-driven, and data-driven.The manually-driven method relies on technicians manually checking electricity meters one by one, which is time-consuming and laborintensive.The physically-driven method analyzes physical rules or sensor data in the grid to detect power theft, but it can be costly and requires specific sensors and topology information.The implementation of advanced metering infrastructure (AMI) in smart grids has led to an increase in the use of data-driven methods, which are now more prevalent.AMI enables the collection of large amounts of electrical consumption data at high frequencies, making it useful for electricity theft detection.Data-driven analysis algorithms can detect anomalies in the data and play a crucial role in identifying theft at a lower cost [2].These methods can be categorized into unsupervised learning, semi-supervised learning, and supervised learning, depending on the level of prior knowledge required.Unsupervised learning does not require labeled data, semi-supervised learning uses a small amount of labeled data, and supervised learning relies on a significant amount of labeled data for detection [3].Several research papers discuss methods and approaches for detecting electricity theft using machine learning and data analysis techniques.These studies focus on analyzing users' electricity consumption behavior and identifying anomalies that may indicate fraudulent activities.By detecting abnormal consumption patterns, it is possible to identify potential instances of theft and improve the efficiency of anti-stealing efforts.Deep learning approaches, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and generative adversarial networks (GANs), have also shown promise in detecting abnormal electricity consumption patterns and identifying theft [4].Supervised learning methods in electricity theft detection such as Support Vector Machines (SVM), decision trees, and ensemble learning methods like XG-Boost, have been employed in this context with differing levels of success [2].These methods utilize Artificial Intelligence (AI) techniques to analyze energy consumption data and identify anomalies that may indicate theft or other irregularities.By leveraging large amounts of data from sub-meters and smart sensors, it becomes possible to detect anomalous power consumption and understand the causes of each anomaly [5].The choice of detection method depends on factors such as the availability of labeled data, data quality, complexity of the power grid environment, and desired detection accuracy.Researchers continue to explore and develop more sophisticated and efficient methods for electricity theft detection to overcome the limitations of existing approaches [2].Feature engineering and structured query language (SQL) analytic functions have also been proposed as solutions for detecting electricity frauds using machine learning.These approaches aim to engineer relevant features from the data and utilize SQL analytic functions to detect fraudsters.By improving the correlation between data features and the target variable, these methods enhance the model's ability to identify fraudulent activities [6].Table 1 presents the data-driven work conducted on the detection of electricity theft.Although machine learning approaches hold promise for electricity theft detection, the effectiveness of these methods may vary depending on the specific patterns of electricity consumption and the distribution of fraudulent activities in different regions and contexts.Achieving generalization across diverse scenarios remains a challenge.Further research and development are necessary to improve the robustness and accuracy of these models in realworld applications.In this paper, we propose a method that surpasses AI methods solely reliant on consumption patterns.Our approach aims to identify fraudulent consumers by leveraging rules developed in collaboration with experts.These rules are extracted from the load profiles of fraudulent consumers.It is worth emphasizing that our method incorporates consumption-based rules, which constitute just one part of the 14 rules under consideration.Our approach in detecting electricity theft represents a significant advancement over many existing studies, which often emphasize datadriven methodologies based on analyzing consumption patterns.A notable limitation in these studies, is their reliance on datasets that simulate electricity theft scenarios rather than reflecting actual incidents.These simulated datasets may not accurately capture the real-world nuances of electricity theft.Moreover, a critical aspect often overlooked in data-driven methodologies is the lack of on-site investigation.By relying solely on theoretical or simulated data, these models miss the opportunity to incorporate crucial empirical insights that can only be derived from physical verification and real-world observations.This gap results in a significant disconnect between the model outputs and the actual on-ground scenarios of electricity theft, limiting the practical applicability and effectiveness of these models in real-life situations.

XX
In contrast, our model distinguishes itself by integrating 9 specific rules, thoroughly investigated by experts, as key features.This inclusion of expert insights allows for a more nuanced and informed analysis of consumption data, directly targeting the complexities of real-world theft patterns.Moreover, our model extends beyond mere data analytics.
Following the predictive analysis, we conduct onsite evaluations to verify the model's results.This XX dual approach of integrating expert-derived rules and conducting physical verifications on-site ensures a comprehensive and accurate detection of electricity theft.To effectively determine the rules that fraudulent consumers adhere to, we evaluate the load histories of fraudulent and normal cases.Subsequently, these rules are treated as feature spaces, enabling us to classify consumers as either theft or benign.The trained model is then deployed for real-world electricity theft detection.Throughout this study, we explore 8 supervised models to identify the most optimal one.Among these models, the random forest algorithm exhibits the highest performance, delivering accurate results.
The key contributions of this study are as follows: • Development of a unique hybrid approach that integrates expert-derived rules with data-driven models for electricity theft detection.The rest of the articles are as follows.Section 2 describes the models.The method and analysis of experiment results is shown in Section 3. Finally, results and concluding remarks are presented in Section 4 and Section 5, respectively.

AI MODELS IN NON-TECHNICAL LOSS DETECTION (TEKNİK OLMAYAN KAYIP TESPİTİNDE YAPAY ZEKA MODELLERİ)
We examined a range of machine learning algorithms for NTL (Non-Technical Loss) detection, including Light-GBM, XG-Boost, Random Forest, Support Vector Machine (SVM), AdaBoost, K-Nearest Neighbors, Decision Trees and Multi-Layer Perceptron.Our goal was to identify the most effective classifiers for NTL detection.

ENSEMBLE METHODS (TOPLULUK YÖNTEMLERİ)
Ensemble methods in machine learning involve combining predictions from multiple base models to enhance overall performance.There are two main categories of ensemble methods: a. Averaging-Based Ensembles: These methods aggregate results from individual models by averaging their predictions, resulting in superior performance compared to single models.Random forest [43] is an example of this category, which combines predictions from randomized decision trees.
b. Boosting-Based Ensembles: These techniques combine weak learners to create a robust ensemble, reducing prediction bias.Examples include AdaBoost [44], Light-GBM [45], and XG-Boost.AdaBoost assigns greater weights to incorrectly predicted instances, guiding the model towards better performance.Light-GBM uses a depth-first approach for quicker training but may overfit on smaller datasets.XG-Boost [45] requires preprocessing for categorical features and handles missing data.
Ensemble methods improve predictive performance by combining outputs from multiple models.Each method has its strengths and considerations, making them suitable for different machine learning use cases.

VEKTÖR MAKİNESİ)
Support Vector Machines (SVM) [46] are a versatile class of machine learning techniques used for tasks such as outlier detection, regression, and classification.They are widely adopted in data mining due to their strong predictive capabilities and reliability in supervised learning.In our data classification, we used the Linear Support Vector Classifier (Linear SVC).

DECISION TREES (KARAR AĞAÇLARI)
Decision Trees are a fundamental machine learning technique used for both classification and XX regression tasks.They work by creating a tree-like structure where each node represents a decision based on specific features of the data.Decision Trees are easy to understand and interpret, require minimal data preprocessing (no need for data normalization), and can handle both numerical and categorical data.They can create overly complex trees prone to overfitting.Ensuring optimal tree structure can be computationally intensive, and they may not perform well on very small datasets [23].

NEURAL NETWORK MODEL (SİNİR AĞI MODELİ)
A multi-layer perceptron (MLP) is a type of artificial neural network designed for various machine learning tasks, particularly in deep learning.It consists of multiple interconnected layers of artificial neurons, each layer playing a unique role in information processing.Typically, an MLP includes an input layer, one or more hidden layers, and an output layer.The input layer receives the initial data, which is then passed through the hidden layers.Neurons in these hidden layers apply mathematical transformations to the input data, learning and extracting complex patterns and features.The final output layer produces the network's prediction or classification.MLPs are known for their ability to model complex relationships in data and are used in tasks such as image recognition, natural language processing, and predictive modeling.They are a fundamental component of deep learning, contributing to the success of modern artificial intelligence applications [47].

ÇIKARIMI)
To effectively combat electricity theft, it is necessary to extract comprehensive features from abnormal electricity consumption phenomena and quantifiable characteristics caused by various electricity theft behaviors.
Our team of experts has conducted a comprehensive and methodical examination of electricity theft patterns.Through this diligent analysis, we have formulated the following 14 rules to accurately assess the characteristics of a user's electricity consumption: 1. Meter tampering warning: Someone might have physically tampered with the smart meter to modify its internal components, leading to inaccurate readings.In these cases, the warning of the body lid being opened is checked.For suspicion of fraud, it should be evaluated along with sudden decrease in consumption.

Virtual meter Control:
The accuracy of the measurements made by the meter is regularly verified.Every 15 minutes, the product of the current, voltage, and power factor (cosine of the angle between current and voltage) is calculated and compared with the instantaneous value measured by the meter.Due to the nature of the meter, which provides instantaneous readings, and the control being performed every 15 minutes, there may be deviations with a tolerance of 10%.These deviations are considered acceptable and are not flagged as out of control.The active and reactive power progress, calculated based on the current, voltage, and power factor, is continuously monitored.If the calculated value exceeds the measurement value by 10%, it is flagged for further investigation.This step is taken to ensure that any significant discrepancies are promptly identified and addressed.

Daily average voltage V:
In the context of normal users, the voltage typically exhibits minimal fluctuations, indicating a relatively stable power consumption pattern.However, if there are noticeable abnormalities or deviations from the expected voltage levels, it could be an indication of irregular power consumption behavior by the user.These fluctuations may arise from various factors, such as faulty electrical equipment, overloading of circuits, or improper power usage.As such, monitoring the daily average voltage becomes crucial in identifying potential issues and ensuring the efficient and reliable operation of the electrical system.

Excessive number of frozen electricity amounts:
If one of the voltage phases is continuously removed, the number of interruptions will increase.Increasing the number of interruptions will give a clue that one of the voltage phases has been removed repeatedly.The case of more than 500 interruptions in a month is checked.If the number of interruptions exceeds 500 times in a month, it should be considered as a suspicious XX indicator of potential electricity theft.Frequent and excessive interruptions in the power supply, especially in such high numbers, could signal irregularities in electricity consumption.

General Current Control:
In a typical electrical system, the metering current exhibits irregular fluctuations depending on the user's load access.However, under normal operating conditions, the phase line current and neutral line current for a user should be nearly equal.This means that the total current flowing through the user's electrical circuit should be balanced, with minimal deviation between the current in the phase line and the neutral line.By closely monitoring and comparing the phase line and neutral line currents, it becomes possible to detect any discrepancies or imbalances in the system.Significant differences between these currents may indicate electrical faults, leakage, or other issues that warrant attention.
6. Installed Power-Demand Control: In a wellfunctioning electrical system, the installed power should not surpass the demand (maximum consumption during a month).Any instance where the demand exceeds the installed power requires immediate attention.Specifically, the system continuously monitors the power demand, and in cases where it exceeds the installed capacity or reaches more than 20% beyond the contracted limit for the day, specific measures are taken to rectify the situation 7. Demand Correlation Evaluation: The demand correlation analysis is performed by comparing data from corresponding months over a span of two years.In this study, the Grey Correlation Grade (GCG) [48] method is employed to calculate the correlation coefficient.This approach helps us identify and assess the level of correlation between the demand patterns of different subscribers during similar months over the two-year period.If the resulting correlation coefficient is found to be below 0.6, the subscribes data is classified as a potential candidate for the illegal suspect list.Given two data series X0 and Xi, the GCG can be calculated; 9. Current-demand Control: It is not possible that a meter records current without demand.During the first reading of the month, there might be instances where a "current available, no demand" alarm is received due to the fact that demand data has not been formed yet.In cases where there is a current of 0.1 A or more in any phase, the meter will be checked to ensure that demand recording is functioning correctly.

Consumption Correlation in Two Years:
Comparing consumption over two years helps see if a customer's consumption patterns changed or not.This correlation is quantified as a number between -1 and 1, where -1 indicates a perfect negative correlation, 0 indicates no correlation, and 1 indicates a perfect positive correlation.
11. Eight Month Consumption Correlation: For each consumer, the correlation between the last eight months of electricity consumption across two consecutive years has been calculated.The values of this correlation are expressed on a scale similar to the one outlined in item 10, where the strength of the relationship between the consumption patterns is quantified numerically.
12. Daily Average Consumption: The average consumption of consumers during peak hours is calculated and then compared with their XX installed power capacity.If this average consumption falls below 33% of the installed power, the consumer is flagged as potentially suspicious.
13. Three Month Consumption Correlation: As described in item 10, this involves a calculation of the correlation of electricity consumption.However, instead of spanning eight months, this assessment focuses on a three-month period.
14. Daily Average Demand: The daily average demand for electricity is calculated for two consecutive years and compared.If the value from the most recent year is at least 33% lower than that of the previous year, this may indicate that the consumer's usage is malignant.

ELECTRICITY THEFT DETECTION BASED ON EXTRACTED FEATURES (ÇIKARILAN ÖZELLİKLERE DAYALI ELEKTRİK HIRSIZLIĞI TESPİTİ)
With the guidance and expertise of industry specialists 14 rules were instantiated within a Javabased analytical framework.Over an observation period, we deployed these rules against our dataset to scrutinize the inter-correlations present among them.Notably, a subset of these rules exhibited a high degree of correlation, prompting an analysisdriven decision to excise the redundant rules from our framework.Consequently, we distilled our feature space down to 9 core rules.Despite the high correlation observed among certain rules, expert consultation reinforced the decision to preserve them.This strategic choice was underpinned by the nuanced domain knowledge of our experts, ensuring that the integrity and depth of our analytical capabilities remain robust.Subsequent to the refinement of our feature space, the 9 retained rules were employed as inputs for our classification model.This approach was predicated on the hypothesis that a more streamlined and pertinent set of features would enhance the model's predictive performance.By leveraging a targeted feature set, informed by empirical evidence and domain expertise, we aimed to strike a balance between model complexity and classification accuracy.The results of this methodology are anticipated to validate the efficacy of our feature selection process in the realm of data-driven predictive modeling.
Figure 1 illustrates the flowchart, and Figure 2 presents the block diagram of our method, respectively.

FEATURE EXPLANATION (ÖZELLİK AÇIKLAMASI)
The detailed explanation of the nine features extracted from section 3.1 is informed by expert experience, revealing their lack of intercorrelation.This insight leads to the creation of distinct feature spaces for individual consumers.Utilizing their historical data and conducting on-site inspections, consumers are then categorized as either fraudulent or normal.
The data set consists of business consumers of electricity (8,586), differentiating them into two distinct categories: 2,041 theft consumers and 6,545 normal consumers.Figure 3 shows the number of consumers and the load profile collection frequencies.To prepare a dataset as input for machine learning models, we examined the behavior of each consumer and applied the 14 rules to each consumer individually.Subsequently, we constructed feature spaces for all consumers based on the results of these rule evaluations.
A correlation analysis was performed to look at the correlations between the 14 features once the feature spaces were developed.Cases where the correlation coefficients were higher than the cutoff of 0.5 were found by this study.Considering the importance of these high correlation values, professional advice was sought to decide on the best course of action.Experts agreed that these relationships could not be ignored because of their possible importance and influence.It was therefore suggested that all characteristics showing a correlation coefficient more than 0.5 be kept for additional examination and thought out in the research.This methodology guarantees an exhaustive assessment of all pertinent and interconnected characteristics, thus augmenting the resilience and dependability of the complete study.Subsequent to rigorous expert scrutiny, a selection of features exhibiting high intercorrelations were judiciously excised from the dataset.Consequently, a refined subset of nine features was retained, deemed most pertinent for serving as inputs to the machine learning model.Figure 4

XX
Features are categorized as either categorical or numerical.Categorical features are represented as binary values, 0 or 1, to indicate specific conditions or states.Numerical features, on the other hand, are scaled using a standard scaler, adjusting their values to fall within a range of 0 to 1.This standardization ensures consistency and comparability across different scales and measurements.Table 2 shows the extracted data after removing the unwanted features.This structured approach to feature selection and preprocessing facilitates a more accurate and efficient analysis, enabling better insights and decision-making based on the data.
In other words, we analyzed the behavior of each consumer using the nine rules and used the outcomes of these rule-based evaluations to create feature sets or feature spaces for every consumer.These features can then be used as input data for machine learning models.Experts assisted in labeling the data to transform it into a classification problem.Table 3 presents the descriptive statistical metrics for the aforementioned nine features, offering a comprehensive overview of their distributional characteristics.

RESULTS AND DISCUSSIONS (BULGULAR VE TARTIŞMALAR)
In this segment, we establish the credibility of our research by conducting rigorous evaluations within the Python 3.10 environment.Our experimentation took place on a Windows Server running a 64-bit operating system, powered by robust hardware featuring an InteI) processor clocking in at 2.8 GHz and an ample 32 GB of RAM.The foundation of our analysis relies on the utilization of nine carefully selected features that serve as the basis for assessing the performance of various machine learning classifiers, yielding valuable insights into their effectiveness.Our evaluation process encompasses the computation of essential performance metrics, including precision, recall, and F-measure.These metrics provide a comprehensive perspective on the classifiers capabilities and their ability to distinguish between different classes.For clarity and reference, we present metrices summarizing the outcomes of all classifiers in Table 4 and Figure 5.This matrix encapsulates vital information regarding the models prediction accuracy and misclassification tendencies, contributing to a comprehensive assessment of their overall performance.In the quest for the optimal classifier, we have conducted a comprehensive analysis of various machine learning models, each with its own unique strengths and weaknesses.Ultimately, the choice of classifier should depend on the specific requirements and constraints of the task at hand.Ensemble methods like Random Forest and AdaBoost might be preferred for maximizing recall, while Decision Tree and Nearest Neighbors offer a balanced trade-off between recall and F1score.The Support Vector Machine and Neural Network classifiers also provide competitive options for different use cases.To make a final decision, further experimentation and consideration of the specific goals and data characteristics are necessary.
In addition to our comprehensive analysis of machine learning classifiers, our research introduces three novel aspects: • Expert-Driven Rule-Based Features: We enrich our models with nine expert-defined rules, adding depth and precision beyond typical consumption data-based approaches.This strategy enhances interpretability and aligns with current trends in machine learning.• On-Site Investigation Integration: Our methodology includes real-world data from onsite investigations, ensuring practical relevance and applicability in real-life scenarios, a feature often missing in theoretical models.
• Real vs. Synthetic Theft Patterns: Unlike common practices using synthetic data, our study focuses on genuine theft patterns, offering a more accurate representation of real-world electricity theft scenarios, significantly improving the reliability and practicality of our detection models.These innovative elements provide our research with a unique edge in the field of electricity theft detection, combining theoretical robustness with practical applicability.
In electricity theft studies, various methodologies and models have been employed to enhance detection accuracy while preserving privacy.Richardson et al. [50] utilized consumption data with an SVM model, injecting anomalies in feeders to detect irregularities.This approach was particularly focused on privacy preservation.In contrast, Figueroa et al. [9] enhanced the SVM model for datasets that are not balanced, addressing the challenge of skewed data distributions.Qu et al. [51] adopted the Random Forest method, with a XX specific focus on handling class imbalance issues.They employed the k-means and SMOTE methods for oversampling before applying the classifier, demonstrating an innovative approach to improving data representation.Nagi et al. [52] utilized expertwritten rules to filter output results from the SVM model.This approach leveraged domain expertise for more precise anomaly detection.Punmiya and Choe [53] explored the use of a Gradient Boosting classifier, where synthetic theft cases were generated based on historical theft data.This method was compared against various algorithms like SVM, Backpropagation Neural Network (BPNN), Extreme Learning Machine (ELM), Deep ELM (DELM), Logistic Regression (LR), Decision Tree (DT), Random Forest (RF), AdaBoost, Naïve Bayes (NB), and k-Nearest Neighbors (kNNs).The comparison aimed to evaluate which algorithms could detect electricity theft with higher accuracy or lower False Positive Rate (FPR).
It is noteworthy that in the above-mentioned studies, there appears to be a lack of on-site investigations and a sufficient number of real theft datasets.This limitation suggests an opportunity for future research to incorporate more comprehensive data and validation methods in electricity theft detection studies.

CONCLUSIONS (SONUÇLAR)
In conclusion, the realm of electricity theft detection is inundated with various supervised and unsupervised models, all claiming efficacy in identifying theft based on consumption patterns.However, real-world complexities such as sector variations, consumer dynamics (such as hiring new staff, acquiring new devices, vacancies, and changing business structures without altering power contracts), economic downturns, and other factors render relying solely on consumption data impractical for on-site inspections.
Our study addresses this challenge by emphasizing the significance of data preprocessing and postprocessing, conducted with expert guidance, to mitigate the impact of false positive detections.Unlike many existing approaches, our methodology extended beyond consumption analysis.We meticulously crafted features to encapsulate theft indicators, employing them as inputs for our models.Subsequently, on-site inspections were carried out, enhancing the accuracy of our findings.
Among the models tested, Random Forest emerged as the standout performer, particularly due to its robustness in minimizing false positives and its strength in reducing overfitting-a key advantage that helped us to detect more instances of electricity theft accurately during on-site investigations.Its effectiveness is further enhanced by its ability to adeptly handle mixed numeric and categorical features without the need for extensive preprocessing or scaling, making it exceptionally versatile across different data types.Additionally, Random Forest exhibits remarkable resilience when dealing with imbalanced data, ensuring that minority classes are adequately represented.This model also benefits from requiring less hyperparameter tuning compared to other algorithms, making it both a powerful and userfriendly option for tackling complex classification tasks.By leveraging Random Forest, we achieved a substantial success rate, detecting 77% of anomalies as instances of electricity theft.This accomplishment underscores the importance of not only the choice of the model but also the thoughtful integration of domain knowledge and comprehensive feature engineering, which collectively enhance the effectiveness of theft detection efforts.
In the future work, we aim to expand our approach by incorporating additional features derived from elaborated smart meter datasets.This will involve analyzing more granular data points to better understand consumption patterns.The goal is to further decrease the rate of false positives, which will be instrumental in reducing the costs associated with on-site investigations.By refining our detection algorithms and integrating more detailed data, we hope to increase the efficiency and accuracy of electricity theft detection, providing significant cost savings for companies and improving the overall effectiveness of theft identification.

ACKNOWLEDGEMENTS (TEŞEKKÜR)
This study was conducted as a part of the project titled "Technical and Non-Technical Losses Estimation and Warning System for Transformers and Subscribers" with the project number 7210765 and supported by TÜBİTAK.

Table 4
summarizes the key performance metrics, including recall, F1score, and precision, for each classifier type: