Open Access is an initiative that aims to make scientific research freely available to all. To date our community has made over 100 million downloads. It’s based on principles of collaboration, unobstructed discovery, and, most importantly, scientific progression. As PhD students, we found it difficult to access the research we needed, so we decided to create a new Open Access publisher that levels the playing field for scientists across the world. How? By making research easy to access, and puts the academic needs of the researchers before the business interests of publishers.
We are a community of more than 103,000 authors and editors from 3,291 institutions spanning 160 countries, including Nobel Prize winners and some of the world’s most-cited researchers. Publishing on IntechOpen allows authors to earn citations and find new collaborators, meaning more people see your work not only from your own field of study, but from other related fields too.
Over the past few years, the anomaly detection problem has been intensively researched within different areas and applications. From a data-based analysis point of view, anomalies can be defined as data points that represent non-typical events, that is, abnormalities, with respect to the rest of the considered observations. The importance of anomaly detection relies on the fact that abnormal data highlights potentially undesirable situations in regard to the underlying physical phenomena under observation, which can have severe consequences for human beings, nature, infrastructures or information. This review article intends to provide a comprehensive overview of recent work on anomaly detection in a critical sector that is experiencing a deep digital transformation: the energy sector. With that, 52 articles have been reviewed, most of which focus on renewable energy generation, building energy consumption and energy storage. Interestingly, artificial intelligence-based approaches are found in ensemble schemes, where different models are combined for the maximization of the anomaly detection performance, oftentimes including deep learning (DL) models. However, under-represented trends and knowledge gaps are also identified, underscoring the lack of articles referring to specific energy application domains, such as critical infrastructures and electric vehicle (EV) charging infrastructure, and open issues for specific methodologies, such as explainability and applicability for deep learning anomaly detection solutions. Further, emerging concepts are highlighted and future research directions are identified.
Electronics Engineering Department, MCIA Research Centre, Universitat Politècnica de Catalunya, UPC, Terrassa, Spain
Mayra Ramírez Chávez
Automatic Control Department, MCIA Research Centre, Universitat Politècnica de Catalunya, UPC, Terrassa, Spain
Miguel Delgado Prieto
Automatic Control Department, MCIA Research Centre, Universitat Politècnica de Catalunya, UPC, Terrassa, Spain
Luis Romeral Martínez
Electronics Engineering Department, MCIA Research Centre, Universitat Politècnica de Catalunya, UPC, Terrassa, Spain
*Address all correspondence to: joan.valls.perez@upc.edu
1. Introduction
Anomaly detection involves identifying patterns within data that are different from expected behavior. These irregular patterns are often referred to as anomalies, outliers, novelties, discordant observations, exceptions, aberrations, peculiarities or contaminants, depending on the application domain [1]. These terms are largely interconnected and often overlap, though they carry subtle distinctions in meaning. The literature offers a variety of definitions for abnormal observations or outliers. Some describe them as data points that deviate significantly from the rest of the sample [2] to the extent that they raise suspicion of having been produced by a different underlying process [3]. Similarly, more recent definitions [4, 5] refer to the concept of local density or relative density or even mention clusters of data.
A key aspect of anomaly detection lies in understanding the type of anomaly being identified. There is a general consensus in the literature on categorizing anomalies into three main types: point anomalies, collective anomalies and contextual anomalies [1, 6, 7]. A point anomaly refers to an individual data point that significantly differs from the rest of the dataset. When such a deviation is only considered anomalous within a specific context, it is termed a contextual anomaly. If a group of related data points is collectively unusual compared to the overall dataset, it is identified as a collective anomaly [1]. Other references [8, 9] introduce the concept of continuous anomaly, which closely aligns with the definition of collective anomaly. Meanwhile, Samariya and Thakkar [10] expand this classification by introducing a fourth category, termed group anomaly, with a slightly different organizational structure compared to the framework proposed by Chandola et al. [1].
While point anomalies are generally considered alarm triggers that must be addressed based on predefined knowledge, such as the ones caused by a momentary malfunction in the data acquisition, transmission or processing chain, collective and contextual anomalies typically uncover a more complex scenario. These types of anomalies often lead to the discovery of new behavioral patterns within the system under analysis.
Thus, anomaly detection application domains range from industry to finance and cybersecurity, as well as e-commerce and logistics. However, one of the sectors that is currently attracting significant attention, due to its ongoing transition to a digital framework, is the energy sector, particularly regarding energy generation and distribution, monitoring and management of smart grids.
The proliferation of intelligent decision-making procedures at different levels of smart asset management (i.e., primary, secondary and tertiary), along with the availability of high computing capacities both at the edge and in the cloud, is leading to the development of multiple data-driven solutions. These solutions enable, among other functionalities, anomaly detection related to system operation. Thus, due to its current trend of digitalization and its various levels of application, ranging from individual measurement devices to energy grid management, anomaly detection is a key aspect in the energy sector, which acts as the main motivation of the present study.
Consequently, conducting a systematic literature review (SLR) was deemed valuable to offer an overview of recent developments in anomaly detection research. Thousands of relevant publications were systematically screened from two major online databases, ultimately resulting in a curated set of 52 papers related to anomalies. Information from these studies was extracted and synthesized to address the authors’ research questions (RQs). Ultimately, the main contributions of this work are the responses to the research questions and their sub-questions, presented in Section 4.
RQ1: What recent peer-reviewed studies apply anomaly detection to energy systems, and what are their key methods, data types, applications and evaluation metrics?
RQ2: What are the open issues of anomaly detection research?
The main contribution of this work lies in a comprehensive synthesis and interpretation of the current state of the art regarding anomaly detection in the energy sector. Thus, a systematic literature review (SLR) has been considered, which includes search, selection, classification and analysis of the most recent research studies in this field.
This approach not only provides an in-depth understanding of advancements in the specific domain, which are highlighted throughout this work, but also facilitates the identification of trends and developments, current challenges and research opportunities, as well as the formulation of taxonomies and theoretical frameworks that enable comparative analysis of approaches and critical evaluation of research directions.
The originality of this study includes consideration of recent research works, its specific emphasis on the energy sector, and its discussion structured around three main axes: applications, methodologies and algorithms.
The remainder of this chapter is structured as follows. Section 2 provides some background in the form of a taxonomy focused on anomaly detection in energy applications. Then, in Section 3, the chosen approach to conduct this systematic literature review is presented. Key results and findings are described in Section 4, with special attention to open issues and future research directions. Finally, Section 5 concludes the chapter, highlighting the major findings and most relevant concepts.
Anomaly detection approximations have been developed within diverse research areas, and many anomaly detection taxonomies have been published over time, some of which focus on a specific type of algorithm (e.g., deep learning, generative adversarial networks (GANs), transient wave-based methods) [6, 11, 12, 13] or a particular application domain (e.g., network communications, internet of things, time series data, financial data) [14, 15, 16], while others are more generic [1].
Longstanding publications [1, 17] refer to seven different anomaly detection categories, characterized by particularities related to the input data and whether they are labeled, their type of anomaly among those described in Section 1, and the type of output data, such as score or label. Specifically, statistical, nearest neighbor-based, isolation-based, spectral techniques, information-theoretic techniques, classification-based and clustering-based. Although some previous references [18, 19, 20] also mention link-based and model-based approaches, this nomenclature has not been coined, which could relate to the fact that words such as link and model have become generic in the literature.
Statistical anomaly detection is the earliest work that has been proposed for anomaly detection [10], as it relies on well-known statistical models and statistical tests. In this approach, a statistical model is fitted to the given data, and then an inference test is applied to determine if an unseen instance belongs to the fitted model, which would be declared normal behavior or an anomaly otherwise [1]. Anomaly detection algorithms based on statistical models can be classified into parametric and non-parametric according to their assumption of the knowledge of the underlying distribution [21]. Parametric algorithms, such as the maximum normed residual (MNR) test or Dixon test, assume that the underlying distribution is known, whereas non-parametric algorithms, such as histograms or kernel density estimation (KDE), do not assume any prior knowledge of the data distribution. Statistical techniques’ strengths are their simplicity and intuitiveness, but they tend to struggle with high-dimensional data, which is very common in many applications. The concept known as the curse of dimensionality, first introduced by Bellman [22], describes the issue of data sparsity that arises as the number of input dimensions increases. This sparsity can hinder the effectiveness of anomaly detection methods, as the presence of irrelevant or redundant attributes may mask or distort the abnormal characteristics of the data [23]. This effect, although it has an impact on any data-based analysis approach, poses particular challenges for statistical and statistical-based methods. For instance, distance-based measures become less reliable in high-dimensional spaces, as data points tend to appear nearly equidistant from one another, a direct consequence of the curse of dimensionality [24].
Nearest neighbor-based methods operate under the assumption that normal instances tend to reside in dense regions of the data space, while anomalies are typically isolated and distant from their nearest neighbors. These techniques rely on a measure of distance or similarity between data points, which can be calculated in various ways. Broadly, nearest neighbor approaches can be classified into two categories: distance-based and density-based methods. Distance-based methods, such as k-nearest neighbor (kNN), evaluate anomalies by measuring the distance from a data point to its kth nearest neighbor. In contrast, density-based approaches, such as the local outlier factor (LOF) or connectivity-based outlier factor (COF), assess anomalies by comparing the local density of each instance to that of its neighbors to compute an anomaly score [1]. Both approaches have been deeply researched, and several improvements have been proposed over the years. Recent works grant an independent category to each of these two approaches [10], whereas others refer to nearest neighbor anomaly detection as neighbor-based [25]. Performance of statistical and nearest neighbor approaches decreases with high-dimensional datasets with varying sample densities, which fueled the inception of isolation-based anomaly detection.
Isolation-based anomaly detection represents a fundamentally distinct methodology, as it does not rely on traditional distance or density calculations. Instead, it leverages two key characteristics of anomalies: their rarity and their distinct attribute values compared to normal data points. The earliest implementation of this approach introduced the use of a binary tree structure known as an isolation tree (iTree) and a combination of them in the form of an isolation forest (iForest), which are very simple mechanisms that are effective and efficient in detecting anomalies [17]. Building upon these mechanisms, many extensions and variations have been proposed, such as separate clustered isolation forest (SciForest) or local sensitive hashing isolation forest (LSHiForest), to address different challenges and improve performance [26]. Isolation measures improve handling datasets with regions of different densities, which is one of the main weaknesses of distance-based and density-based methods. Some recent works [26] refer to isolation mechanisms and their application in other anomaly detection-related tasks, such as clustering and classification, whereas others [10] refer to isolation as an individual anomaly detection approach.
Spectral methods aim to approximate the dataset by identifying a combination of attributes that capture most of its variance, operating under the assumption that the data can be effectively represented in a lower-dimensional subspace where normal and anomalous instances become more distinguishable [1]. In some recent works, spectral techniques are primarily principal-component-analysis-based techniques [27, 28], which are in line with the aforementioned assumption. However, other recent research [10, 25] refers to subspace-based anomaly detection under the same assumption, thus avoiding decomposition-focused algorithms and presenting algorithms that combine selection space and anomaly detection, such as subspace outlier degrees (SOD) and LOF.
Information-theoretic approaches examine the informational characteristics of datasets through metrics such as Kolmogorov. Complexity, entropy and relative entropy are based on the premise that anomalies introduce disruptions in the overall information structure of the dataset [1]. Although some very recent works [29] consider an information-theoretic characterization for anomaly detection in data compression environments, recent anomaly detection surveys [16, 24, 25, 28, 30] no longer refer to information-theoretic techniques as a specific approach for anomaly detection.
Classification-based and clustering-based terminology is frequently used to distinguish between supervised and unsupervised learning settings, respectively. In classification-based anomaly detection, for example, a model is built using a labeled dataset and subsequently employed to assign new instances to predefined classes based on the learned patterns. Thus, classification-based approaches consist of solving supervised problems, that is, with a priori knowledge (i.e., historical labeled data), by means of neural network (NN) models, support vector machines (SVMs) and rule-based schemes. On the other hand, clustering-based anomaly detection approaches consist of solving unsupervised problems or semi-supervised problems, that is, with unlabeled or partially labeled data, by means of clustering algorithms such as self-organizing maps (SOMs), k-means clustering and expectation maximization (EM) [1].
Over the last two decades, the proliferation of data processing techniques based on artificial intelligence, which range from supervised, semi-supervised and unsupervised, has promoted the inception of new approaches, which have had an effect on the already existing categories found in the literature. Specifically, recent work [28] mentions classification-based approaches and clustering approaches as two of the main categories, which also include artificial intelligence-based approaches, while other recent authors [30] refer to deep learning-based approaches as a main category. As the datasets gradually become larger and more complex, more deep learning (DL) models have been proposed to perform anomaly detection tasks, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), auto-encoders (AEs) and generative adversarial networks (GANs) [12]. Other recent works [10, 25, 28] mention machine learning (ML) when referring to an approximation that is not found in longstanding publications, namely ensemble-based anomaly detection or hybrid anomaly detection, which consists of simultaneously combining different learning techniques or even multiple subspaces, where the potential anomalies are derived by ensemble techniques.
Despite of the certain categories which are considered in recent literature reviews on anomaly detection, there is no generalized consensus regarding the main approaches. In some cases, conceptual synonymy can be observed among terms used to define specific categories, as seen in the case of ensemble or hybrid approaches. While longstanding publications refer to subcategories at a second level of taxonomy [1], more recent studies tend to limit themselves to a single level to differentiate the main approaches, using the second level to reflect the relationship between techniques associated with each approach. Thus, categories appear to serve as a general framework within which the included techniques share theories and analytical foundations. However, some categories may exhibit set intersections, such as spectral and statistical approaches, for instance, in the case of principal component analysis (PCA).
An SLR was carried out by referring to other pertinent guidelines and studies cited in [31, 32, 33]. Guided by the research questions outlined in Section 3.1, relevant search terms were defined (Section 3.2), and a search strategy was developed (Section 3.4). This strategy incorporates inclusion and exclusion criteria detailed in Section 3.3 to minimize potential bias during the selection process. The main results from the selected studies are presented in Section 4.
3.1 Research questions
To answer the general research questions raised in Section 1, we detail them into sub-questions, as research questions of an SLR are usually generic and related to research trends. To be more specific on what characteristics of the most recent anomaly detection studies are to be examined, RQ1 is divided into five sub-questions.
As discussed in Section 2, the overview of anomaly detection approximations has evolved over the years, with new approximations gaining interest while others become less mentioned in the literature. It is important to understand which key methods are being considered in the most recent publications. Firstly, from the approximation point of view. RQ 1.1—Which anomaly detection approximations were most researched? However, as it was noted in Section 2, although different authors converge when referring to specific anomaly detection approaches, there are also significant differences regarding the organization of the main approaches and regarding the specific algorithms for each category. Secondly, it is important to investigate from the algorithms and techniques point of view, which will also provide insight about the popularity of anomaly detection-based applications of artificial intelligence algorithms. RQ 1.2—Which algorithms and techniques were implemented?
Anomaly detection is used in several application domains, such as intrusion detection systems, fraud detection and fault detection, where anomalies can relate to people, systems and processes, with very different meanings. From an anomaly detection in energy applications point of view, which is closely related to industrial devices and communication systems, anomaly detection algorithms and techniques can be implemented in different hierarchical layers, that is, component, device, system, process and plant. RQ 1.3—In which hierarchical level were anomaly detection techniques implemented?
Availability of datasets and data spaces is essential for developing anomaly detection applications that are relatable to real-world scenarios. In that sense, it is paramount to characterize the nature of data used for the validation of algorithms and techniques in anomaly detection applications. RQ1.4—What were the main characteristics of the selected datasets? Were the datasets publicly available?
Finally, as in many other knowledge fields, evaluation metrics are a key aspect of the validation of anomaly detection solutions, as they enable benchmarking the performance of innovative anomaly detection schemes against the performance achieved by ones that have already been developed and consolidated in the literature. Therefore, it is a relevant aspect to be investigated. RQ1.5—Which are the reference evaluation metrics that have been used more recently?
3.2 Search string
Based on the research questions, search terms were determined and organized into three distinct categories. As discussed in Section 1, anomaly detection, novelty detection and outlier detection are sometimes used indistinctly. Therefore, the first group contains the keywords:
Group 1: (“anomaly detection” OR “novelty detection” OR “outlier detection”).
As presented in Section 2, specific anomaly detection main categories are found in the literature, although there is no consensus regarding the organization of the categories. The second group is related to the approximations that are included in the present study, represented by the following keywords:
Group 2: (“statistics” OR “nearest neighbor” OR “distance” OR “density” OR “isolation” OR “spectral” OR “subspace” OR “information theory” OR “classification” OR “survey” OR “ensemble” OR “hybrid”).
Finally, regarding the outcome of the contribution, which is related to the goals of the anomaly detection publications, represented by the following keywords:
Group 3: (“architecture” OR “design” OR “verification” OR “validation” OR “test” OR “analysis”).
To design the search string, the conjunction of the group terms above was used, that is, Group 1 AND Group 2 AND Group 3. Thus, the string designed for the search was the input for the procedure, which will be described in Section 3.4.
3.3 Inclusion and exclusion
The aim of this SLR was to identify and classify papers related to anomaly detection approaches for energy applications. The inclusion criteria (IC) were:
(IC1) The paper must refer to an anomaly detection application.
(IC2) The paper must have an energy context.
(IC3) The paper must be published between 2020 and 2025.
Papers were excluded if they met any of the following exclusion criteria (EC), which were:
(EC1) Studies that do not focus on energy are omitted.
(EC2) Gray literature and papers written in languages that are not English are discarded.
(EC3) Studies and documents that are not peer-reviewed are also excluded, as well as books, theses and dissertations.
(EC4) Papers published in journals with SCImago Journal Rank (SJR) [34] below 1.0 are excluded.
3.4 Search strategy and selection process
The search strategy developed consists of four main phases and has been designed around two reference databases, aiming to maximize the chances of retrieving anomaly detection papers from different research communities. Figure 1 depicts the search strategy, providing the number of studies that resulted from conducting each phase.
Figure 1.
Search strategy steps.
Particularly, the search string, which was introduced in Section 3.2, was used, with adaptation if necessary, on two online databases: ACM DL [35] and Scopus [36]. The main reason for using these databases is that they are well-known within the research community, easy and intuitive to use and provide access to a vast number of scientific papers, which can be exported easily into reference managers.
Step 1. The results obtained from the various search engines were combined to remove any duplicate entries.
Step 2. Books, white papers and conference articles were manually removed. Journal articles published earlier than 2020 were removed. From the resulting set of journal articles, the ones published in academic journals with SJR below 1.0 were excluded.
Step 3. A large portion of the candidate papers was excluded based on the established inclusion and exclusion criteria. The selection process involved multiple levels of review, including evaluation of the title and abstract and a quick examination of the main content. Papers that raised any uncertainty during the process were retained for more detailed assessment at a later stage.
Step 4. Papers falling near the inclusion threshold were reviewed collaboratively by the authors to make final decisions regarding their inclusion or exclusion. Ultimately, a total of 52 papers were selected for the final corpus.
In this section, the outcomes of the review are addressed. First, the most significant publication trends are presented graphically, aiming to provide a simple yet illustrative overview of the selected publications. Then, results of the research questions and sub-questions are provided in an organized manner, presenting the most relevant aspects and revealing significant insights. Finally, based on the presented findings for the research questions, open issues for anomaly detection in energy sector applications are pointed out, and research directions are proposed.
4.1 Publication topics
The analysis of the distribution of the selected anomaly detection studies can be investigated by focusing on different dimensions, which provide interesting insights. First, the number of articles published for each year is illustrated in Figure 2, which shows a steady growth in the number of anomaly detection publications for energy applications for the last 5 years. In that sense, 2025 should be ignored when looking for a year-to-year trend, as the time of writing was the first quarter of 2025. Thus, the increase in published papers is believed to support that anomaly detection in energy applications is becoming increasingly relevant.
Figure 2.
Distribution of the selected articles per year.
Now, the distribution of studies per journal of publication is investigated to capture, at a glance, which areas were of interest within energy-focused anomaly detection applications. The bar chart in Figure 3 illustrates this, highlighting the interest in research on anomaly detection applications related to renewable energy generation systems, energy storage systems, power systems and smart grids.
Figure 3.
Distribution of the selected articles per journal.
From the publication type perspective, the pie chart in Figure 4 shows that only 7.7% (4 out of 52) of the selected studies are reviews or surveys. These publications address three of the four topics that receive the most attention in the remaining articles that comprise the sample selected in the present study, which are building electric consumption data, district heating and electric vehicle batteries.
Figure 4.
Distribution of the selected articles per topic (left) and per type of contribution (right).
Furthermore, regarding publication topics, there is a significant number of publications that focus on renewable energy sources, which is also depicted in Figure 4. Remarkably, a quarter (i.e., 25%) of the publications (13 out of 52) refer specifically to anomaly detection applications on wind turbines, namely, condition monitoring, fault detection and power curve modeling. Following is a brief introduction of the other topics that receive attention, underscoring their importance:
The availability of energy consumption data has increased with the massive deployment of specific metering solutions (i.e., smart meters or smart sensors) or smart devices that include metering capabilities (i.e., smart inverters). With that, different stakeholders in the electrical system, end-users, energy producers or utility companies, are able to identify deviations in consumption patterns that can be investigated for different purposes. From the anomaly detection perspective, energy consumption data allows for applications such as energy saving, energy theft, theft attack detection, occupancy detection, home elderly monitoring and fault detection of the energy systems. In one of the selected reviews [37], artificial intelligence techniques for anomaly detection are thoroughly discussed, with consideration not only of the most relevant techniques and algorithms but also of computing environments and application domains.
Efficient heat distribution in urban areas is a key application for energy management and efficiency-improving research, which is one of many application domains for anomaly detection. Specifically, district heating substations (DHS) are drawing interest as they are being increasingly used for affordable, low-carbon heat supply, which can be directly used by customers [38]. In short, the function of DHS is to hydraulically separate the water in the district heating circuit from that in the end-user installation. For that, fault detection is the most concerning anomaly detection application for DHS, as faulty or worn components can cause water leakages, which would be a waste of resources and could potentially damage nearby components.
Aside from wind energy, which is the most popular topic within the selected articles, solar photovoltaic energy (PV) has become a widespread renewable energy technology, with regulators incentivizing the installation of industrial, tertiary and residential buildings, as well as with the decrease in the price of the required components for the installation, mainly the PV panels. From the anomaly detection perspective, detection and classification of anomalies in these systems is critical for ensuring a sustainable expansion of this technology, as well as the reduction of energy costs for the end-user [39]. Figure 5 depicts some of the problems that can cause anomalies in PV systems.
Electric traction solutions are booming due to the increasing pressure on vehicle manufacturers in the form of restrictions related to emissions from internal combustion engine vehicles. In this sense, all elements, components and subsystems found in electric powertrains of electric vehicles (EVs) are receiving attention from the perspective of design and operation optimization. Battery safety and reliability, in particular, are of great interest, given their high manufacturing cost caused by the complexity of the manufacturing process and the scarcity of the required materials. Thus, research into the development of supervision and monitoring systems, typically battery management systems (BMSs), with anomaly detection functionalities, is critical to safely maximize the life of these elements. In particular, lithium-ion batteries, which are the most common in mass-produced electric vehicles, present anomalies related to energy efficiency and safety [41].
Figure 5.
Various problems that can cause anomalies in PV systems [40].
Finally, it is worth noting that terminology-wise, most studies refer to anomaly detection and outlier detection, which suggests that novelty detection, which was included in the search string presented in Section 3, has not been coined in anomaly detection in energy applications.
4.2 The characteristics of anomaly detection studies
This section describes the main results to answer RQ1 and its sub-questions. Each subsection focuses on one of the sub-questions, detailing the most interesting aspects of the selected papers and illustrating the differences in distribution among the four main topics by means of comparative tables.
4.2.1 Anomaly detection approaches
Anomaly detection approaches that are referred to in the review articles are subject to different notions of faults and anomalies. Therefore, the heterogeneous terminology used in the reviewed articles has been challenging for the extraction of each author’s point of view on the anomaly detection approaches taxonomy. In this section, the authors’ answer to RQ1.1 is presented in the form of a brief presentation of the categorizations found in the reviewed articles, followed by a detailed discussion of the works focused on each approach.
For instance, in [37], different dimensions are considered for the categorization of anomaly detection techniques for electric load consumption, such as the nature of the implemented artificial intelligence algorithm (i.e., supervised, unsupervised or semi-supervised), applications (i.e., energy saving, fault detection, theft attack detection, occupancy detection, at-home elderly monitoring), detection level (i.e., aggregated level, appliance level or spatio-temporal level) and computing platforms (i.e., edge computing, fog computing or cloud computing). However, there is no specific mention of the anomaly detection approach, which suggests that some authors consider it redundant with the dimension related to the algorithms and techniques. In [42], a statement is made about using terminology that refers to seven anomaly detection approaches, even though it does not match their definitions. In contrast, [41] only mentions four main categories, with many subcategories each. Furthermore, some articles suggest an initial dual classification, from which the remaining categories emerge, based on the differentiation between model-based and data-based approaches [43, 44], which will be discussed in Section 4.2.2. In [45], a distinct knowledge-based approach is presented. This method primarily depends on an in-depth understanding of battery mechanisms, along with knowledge and experience accumulated over time. It is particularly well-suited for complex, non-linear systems where mathematical modeling is not necessary.
Based on the findings regarding different anomaly detection approximations, common categories among different taxonomies have been identified, and additional categories have been incorporated to ensure a comprehensive representation of the identified approaches and algorithms. Consequently, from the review of the current state of the literature, five main categories have been established:
Statistical approaches.
Nearest neighbor-based approaches.
Isolation-based approaches.
Subspace-based approaches.
Information-theoretic approaches.
4.2.1.1 Statistical approaches
The statistical approach is found to be notably present in the literature, particularly in publications focusing on large-scale systems [46, 47], emphasizing its simplicity and efficiency for monitoring complex systems, as well as its robustness against unstable data quality and low resource deployment environments, which limit the full utilization of existing methods such as model-based and machine learning algorithms [47]. Other studies, such as Refs. [48, 49], also refer to the concept of robustness in applications related to power systems, thereby supporting the potential relationship between robustness-oriented approaches and statistical methods and techniques.
4.2.1.2 Nearest neighbor-based approaches
The nearest neighbor approach is frequently represented in the reviewed articles for different applications. In [50], it is presented as an outlier detection approach in a framework focused on short-term individual residential load forecasting [50]. In other works, it is innovatively combined with supervised learning techniques, primarily random forest (RF) [40] and SVM [51], or alternatively with algorithms from other fields of knowledge, such as the rain flow counting method used to assess the fatigue of a component under variable stress over time [52], with a focus on detecting collective anomalies in energy consumption [53]. Additionally, two publications [54, 55] refer to anomaly detection methodologies based on density-based methods, which were considered as a subcategory within the nearest neighbor in a longstanding publication [1].
4.2.1.3 Isolation-based approaches
Numerous articles refer to isolation-based methods, either as part of their anomaly detection framework or as reference algorithms for comparing the results of proposed approaches. In Refs. [50, 56], the isolation forest algorithm is employed as the primary technique for anomaly detection. Moreover, in Refs. [57, 58], isolation forest is utilized as a benchmark to evaluate the performance of the proposed methodology in anomaly detection for electricity consumption data. In particular, Gao et al. [59] propose an intelligent framework whose core technology is the isolation forest algorithm for ambient mode extraction for the smart grid. The use of such methods in high-impact articles suggests a growing interest in these algorithms within the energy sector, potentially indicating a degree of maturity, given that the approach has been in existence for over a decade [17].
4.2.1.4 Subspace-based approaches
As it was pointed out in Section 2, spectral anomaly detection approximations have been referred to in recent studies with the term subspace. Thus, whilst the term spectral is used in some of the reviewed articles, it is used when referring to spectral features or spectral clustering techniques. Conversely, subspace is mentioned in a number of articles, mainly referring to the concept of subspace, and only in one article [51] is a subspace detection method presented. Therefore, according to the reviewed articles, this approach does not seem to be considered in energy-related applications.
4.2.1.5 Information-theoretic approaches
The concept of information theory appears only once [44] in the reviewed articles, where mutual information theory and Gaussian copula entropy are applied to examine the relationships between different condition monitoring variables and performance indicators of abnormal cases within a parameter identification framework for wind turbines. In this regard, a conclusion similar to the one presented for subspace-based approaches could be drawn.
Finally, approaches such as classification or clustering were not found to be presented solely anomaly detection approach; rather, these approaches were implemented in combination with other types, leading in some cases to detection and classification methodologies in applications related to wind turbines [44, 57] or power systems [60]. In fact, innovative combinations of up to five data-based methods have been proposed for the early detection of anomalous lithium-ion battery degradation [61]. These publications often refer to this approach as an ensemble, which will be discussed in Section 4.2.2 and which conforms to the majority group among the reviewed articles.
In summary, three of the five approaches identified (i.e., statistical, nearest neighbor and isolation) in the literature are present in three of the four most popular topics in the selected articles, suggesting that they are consolidated in the current state of the art regarding anomaly detection in the energy sector. In this sense, isolation-based methodologies may be emerging as the new benchmark with respect to the statistical approach, which has traditionally been considered the reference given its simplicity and potential for working with large volumes of data. In particular, the statistical approach is considered superior in long-term performance, arguing that artificial intelligence-based models struggle to cope with the variation in operating conditions that represent both normal and abnormal operating states due to system wear [62]. Interestingly, only a specific reference is made to the problem of collective anomaly detection, which is treated from the nearest neighbor perspective, which suggests a methodological gap.
Furthermore, it must be noted that the taxonomy of anomaly detection approaches is closely intertwined with the terminology referring to the types of problems to be solved (e.g., classification, regression), also depending on the nature of the data considered (e.g., unsupervised, supervised). Moreover, the fact that the presence of artificial intelligence is increasing in the field of anomaly detection cannot be ignored, and numerous studies on anomaly detection in other application areas place artificial intelligence on the same hierarchical level as approaches such as those identified in this study.
For illustrative purposes, the distribution of a number of references among the selected articles across the five identified categories regarding anomaly detection approaches, which focus on the four main topics covered by the reviewed studies, is presented in Table 1.
Distribution of anomaly detection topics across different approaches.
4.2.2 Algorithms and techniques
Anomaly detection approaches usually combine different algorithms and techniques in accordance with criteria such as real-time operation, availability of labeled data or prior knowledge of the system to which they are applied. Therefore, it is important to understand which algorithms and techniques were selected and the rationale that justifies their suitability in each case. In this section, the authors’ answer to RQ1.2 is presented in the form of a brief discussion about the nature of the technique implemented and in the reviewed articles, followed by a discussion of some representative works on each approach.
Among the reviewed articles, a wide variety of techniques and algorithms have been identified, ranging from traditional model-based approaches to innovative methods that combine data-driven techniques. The following classification encompasses the vast majority of techniques found in the reviewed works, specifically categorized into seven groups:
Model-based methods.
Statistical tests and analysis.
Combined models, also known as ensemble models.
Deep learning techniques.
Data mining techniques.
Innovative learning strategies.
4.2.2.1 Model-based methods
Model-based anomaly detection methods are considered among the traditional approaches for anomaly detection, together with manual analysis and thresholds [42]. Specifically, model-based anomaly detection approaches were used in only two of the reviewed articles [49, 60], which converge in their application to power systems state estimation. Besides state estimation methods, model-based anomaly detection methods include the parameter estimation method and the coordinated estimation method [41]. In [49], robust particle filters (PFs) are introduced, which are a type of sequential Monte Carlo (MC) algorithm used to estimate the state variables of dynamic systems, assuming that there can be errors or perturbations in the available observations [68]. In [60], an anomaly detection method is developed combining conventional weighted least squares (WLS) with extended Kalman filters (EKFs).
A distinct publication [55] integrates the theoretical model related to the power of a wind turbine in the outlier detection method, which uses the well-known density-based spatial clustering of applications with noise (DBSCAN) algorithm. As a result, a model-data hybrid-driven (MDHD) outlier detection method is presented for the wind turbine power curve (WTPC), which plays an essential role in many fields such as power forecasting and control [69, 70].
4.2.2.2 Statistical tests and analysis
On the topic of wind turbines, data-driven techniques have been used extensively in the reviewed articles for power curve modeling, condition monitoring and fault detection. Figure 6 depicts the typical power curve shape for wind turbines.
Figure 6.
Power curve modeling for wind turbine, final result of an outlier detection process [55].
Specifically, a number of publications that use statistical tests and analysis for wind turbines are found within the selected studies. For instance, Ohunakin et al. [65] apply the Kolmogorov-Smirnov test to evaluate turbine data for fault detection. Alternatively, in [63], a monitoring method based on stationarity is introduced, which relies on a sliding window approach and employs the Augmented Dickey-Fuller (ADF) test to examine the stationarity of data at each update step, where the resulting t-statistics are associated with fault identification. In [43], through a nonlinear autoregressive exogenous model (NARX), which is a statistical model for time series modeling, and previous knowledge fusion, the singular features of healthy gas turbines are revealed, and robust and sensitive anomaly detection is performed.
4.2.2.3 Combined models
The reviewed articles feature multiple data-driven techniques and algorithms, generally combined with each other to complement the strengths of different approaches. Thus, studies that employ a single technique are rare, such as [71], where a methodology is presented to integrate multiple data sources for fault diagnosis using a one-class support vector machine (OCSVM) classifier to assess normal behavior model error. Another example is [57], which exclusively uses the isolation forest technique for anomaly detection and removal. A comparative study of four anomaly detection methods (i.e., iForest, LOF, Gaussian mixture models (GMMs) and k-NN) for wind turbine power curve cleaning is presented in [72], highlighting Gaussian mixture models (GMMs) due to their favorable accuracy while maintaining wind variability. In contrast, Khan and Byun [73] suggest a new approach to detect anomalies in wind turbines using a combination of techniques, namely PCA, k-means clustering for labeling and a combination of classifier models in an ensemble scheme for outlier identification. In [74], an ensemble framework based on extreme gradient boosting (XGBoost), integrating multiple machine learning and data mining techniques, was successfully developed for fault detection.
In lithium-ion battery-focused applications, different approaches to outlier and anomaly detection were also observed. In [66], two variants of the LOF algorithm were proposed and evaluated individually. Alternatively, in [61], the LOF algorithm was combined with four other methods of different natures and used to develop an ensemble-based algorithm to robustly identify anomalous samples as early as possible. Specifically, these methods include regression models with prediction bounds, SVM, Mahalanobis distance (MD) and sequential probability ratio test (SPRT).
The combination of models in ensemble schemes also enriches other application domains, such as building energy consumption monitoring. In [75], the use of two complementary semi-supervised machine learning applications, based on classification and regression tree (CART) and multi-layer perceptron (MLP), is proposed to achieve highly interpretable and accurate anomaly detection. Lei et al. [76] introduce a dynamic anomaly detection algorithm tailored for building energy consumption data, capable of identifying both point anomalies and collective anomalies. This approach integrates supervised clustering with an unsupervised method, where particle swarm optimization (PSO) is employed to fine-tune the parameters of the unsupervised clustering algorithm.
4.2.2.4 Deep learning techniques
Some publications that investigate anomalies in electricity consumption in buildings or that consider the resilience of various infrastructures, such as advanced metering infrastructure (AMI) and heating, ventilation and air conditioning (HVAC) systems, focus on implementing deep learning techniques. In [77], an asymmetric hybrid encoder-decoder (AHED) architecture is presented for anomaly detection, aimed at accurately predicting and identifying both point and collective anomalies in the context of building energy consumption. This framework combines supervised and unsupervised learning techniques and employs a sophisticated encoder-decoder structure to enhance the precision of energy usage forecasting. In contrast, regarding the resilience of infrastructures, Elnour et al. [56] develop and validate a semi-supervised, data-driven attack detection strategy using an isolation forest, combined with deep learning techniques for temporal feature extraction, specifically a 1D CNN-based encoder. In [78], profiles obtained from advanced metering infrastructure (AMI) meters are used to create 2D images through a continuous wavelet transform. Subsequently, several deep learning models are sequentially applied for feature extraction and the detection of false data injection attacks (FDIA). Similarly, in [45], a sparse autoencoder is used to extract the characteristic parameters of battery faults from the reconstructed high-frequency part of the original voltage signal.
Long short-term memory (LSTM), a deep learning algorithm, is increasingly recognized in the literature as a powerful technique for anomaly and fault detection in wind turbine applications. In [44], an approach combining LSTM and AE neural networks is proposed to evaluate sequential condition monitoring data from wind turbines. This method builds a performance assessment model using LSTM units and AE networks to compute performance indices, which are used to quantify the degree of performance anomalies. From this, key condition monitoring parameters are identified by analyzing their relationships with abnormal performance instances. Identifying these critical parameters is essential not only for detecting potential faults in wind turbines but also for optimizing the use of limited fault data to identify issues across different wind turbine generators (WTGs), especially when data distributions differ between units. Additionally, as discussed in [79], the scarcity of fault data in real-world wind turbine operations has led to growing interest in transfer learning (TL) for condition monitoring and fault diagnosis. In this regard, Zhu et al. [79] present a hybrid method that integrates LSTM, fuzzy synthesis and feature-based TL.
4.2.2.5 Data mining techniques
Regarding data mining techniques and methodologies, some of the reviewed articles consider bootstrapping for anomaly detection, which is a data resampling method for estimating the distribution of a statistic. Specifically, in [80], it is a central concept, as it is used to improve a traditional threshold-based outlier detection method, which is local correlation integral (LOCI), as it focuses on searching for an improvement on the thresholds used in the classification of the LOCI method by analyzing its distribution. This approach helps eliminate subjectivity in threshold selection by data analysts or maintenance personnel, with the ultimate goal of improving energy efficiency in building operations.
4.2.2.6 Innovative learning strategies
It has been observed that among the reviewed works, some particularly focus on innovative learning strategies. For instance, Choubey et al. [81] address scenarios characterized by limited and low-quality data, aiming to reduce dependence on large, balanced and labeled datasets with complex patterns. By incorporating advanced feature extraction techniques, the authors propose a contrastive learning model that improves the performance, reliability and scalability of electricity load anomaly detection. This approach enhances cost-effectiveness and adaptability across a wider range of real-world applications.
Other publications consider anomaly detection schemes that take into account the evolution of the systems being monitored. In [82], the challenge of detecting evolving electricity theft behaviors in modern power systems is addressed through a combination of active learning and incremental learning. The proposed model integrates active learning with incremental support vector data description, using an adaptive mechanism to identify candidate support vectors and incrementally update the existing model. This strategy effectively balances computational efficiency and detection accuracy, accommodating the evolving nature of electricity theft.
Similarly, [83] focuses on the nonstationary behavior of lithium-ion battery cells during charging and discharging processes, which complicates anomaly detection. To address this, the authors introduce a condition-driven mode partition strategy that identifies multiple operational modes within the nonstationary data, enabling more effective anomaly detection under varying operational conditions.
Summarizing, among the five identified categories regarding anomaly detection techniques (i.e., model-based, statistical, ensemble, DL-based and data mining), only the combination of different techniques and algorithms (i.e., combined models or ensemble) is present in the four most represented topics in the selected articles, which supports that anomaly detection schemes based on an ensemble of models are popular across diverse energy applications. In fact, despite there being longstanding publications that refer to ensemble learning, the open and flexible nature of it, which allows for the combination of innovative algorithms and techniques as well as for innovative combination schemes, promotes its continued relevance.
Now, regarding specific types of algorithms and techniques, DL techniques are found to be employed in three of the four main topics, only missing in the heat distribution networks. This is coherent with the increasing use of DL over ML in many applications, due to the ability to detect hidden patterns in complex datasets without the need for previous feature selection. Therefore, DL becomes suitable for anomaly detection applications, such as cyber-attack detection and fault detection, which is supported by the publications referring to data-driven cyber-attacks toward electric buildings, as well as by the studies that focus on condition monitoring on wind turbines and electric vehicle batteries. Also, DL techniques are specifically chosen for the treatment of spatio-temporal information for anomaly detection in [58], where multi-scale graphs are used to learn spatial features, and convolutional networks are proposed for learning the temporal features. However, a different paper among the selected studies [84] proposes an alternative method for spatio-temporal analysis based on inverse distance weighting (IDW), questioning the need to use complex machine learning or deep learning algorithms to tackle this kind of problem, including considerations for data-constrained scenarios in which meteorological data such as irradiance and temperature is unavailable.
There are only two references in the selected literature that propose model-based anomaly detection, which converge on power state estimation. This suggests that data-driven approaches are more effective for anomaly detection applications and do not require modeling expertise, despite sometimes compromising the explainability of the results.
Finally, within the reviewed works, some focus on more singular techniques, as well as innovative learning strategies. On one hand, data mining techniques are proposed in only one study, suggesting that, despite bringing an interesting big data perspective, which can work as an alternative to traditional methods, other data-driven algorithms such as ML or DL are preferred by the researchers. On the other hand, innovative learning strategies are focusing on specific scenarios in which training anomaly detection models is particularly complex, such as low data quality and availability, dynamic environments and systems with multiple operation conditions, all of which are interesting in the energy application domain.
For illustrative purposes, the distribution of a number of references among the selected articles across the five identified categories regarding anomaly detection techniques, which focus on the four main topics covered by the reviewed studies, is presented in Table 2.
Distribution of anomaly detection topics across different types of algorithms and techniques.
4.2.3 Layer of application
Anomaly detection measures in energy applications are deployed using various techniques and algorithms, which can be implemented at different scopes that can be classified into hierarchical levels (i.e., component, device, system, process and plant). Therefore, it is relevant to analyze how different approaches and techniques for anomaly detection relate to these levels. In this section, the authors present their answer to RQ1.3 in the form of a brief discussion, moving from the lower hierarchical level to the higher level.
A particular article [86] stands out as the most specific case by focusing directly on a single system component—high-frequency-link power conversion systems. These systems benefit from recent advances in data-driven modulation approaches, which aim to automate design processes. However, the performance of data-driven models can degrade significantly in the presence of outliers or when training data is insufficient. To mitigate these challenges, the study introduces an artificial intelligence-based methodology for outlier detection tailored to this application.
In the field of electricity consumption measurement, a few works were found to take a slightly broader approach than the previously presented. Instead of focusing on the integrated circuit within a device, they analyze the signal that the device is capable of measuring. For example, Li et al. [87] propose a domain knowledge-based and topology-aware anomaly detection algorithm that uses sensor data from a dynamic grid. This method integrates time series data of both measurements and topological changes, employing graph distances informed by domain knowledge to estimate reliable distributions of measurements at each time step. From a different perspective, in [78], a semi-supervised scheme is presented, which utilizes the ratio profile generated from the readings of the observer meter and the user’s smart meter as the input, which is processed in an innovative manner in order to reduce false positives (FPs) for energy theft. Among the reviewed articles, one study specifically considers increasing granularity from the perspective of consumption disaggregation. Lastly, Castangia et al. [88] take a fine-grained approach to anomaly detection through energy consumption disaggregation. It presents a method for identifying electrical faults in household appliances by analyzing their unique power signatures, highlighting the potential of detailed consumption data to support targeted fault detection in residential settings.
Regarding anomaly detection approaches for more complex devices, a considerable number of works within the reviewed articles integrate outlier or anomaly detection in the management of batteries, which require specific considerations due to their chemical nature, or wind turbines, which are large-scale electromechanical devices. As previously discussed, anomaly detection and classification for lithium-ion batteries, usually performed by the BMS, are key to ensuring safe and reliable operation, a fact supported by the battery-focused publications among the reviewed articles [41, 45, 47, 66, 83]. Similarly, as previously mentioned, the characterization and monitoring of wind turbines have garnered significant interest among the reviewed articles, enabling more efficient utilization of renewable energy.
However, a notable area of interest in anomaly detection focuses on processes, plants or systems in which early identification of anomalies in large-scale infrastructures helps prevent critical consequences, rather than detecting the failure of a single component or device. Among the reviewed articles, a number of references directed at the system level have been identified, specifically regarding the management of HVAC systems, both from the perspective of detecting specific faults in air handling units (AHUs) and rooftop units (RTUs) [89], as well as from the standpoint of cybersecurity [56] and the management of substations within a district heating network [42].
In [54], the focus is placed on the analysis of blast furnace gas (BFG) and Linz-Donawitz converter gas (LDG), which are typical by-product gases generated during the iron- and steel-making processes [90]. The generation and consumption flows, as well as the variations in the gas tank levels, are intrinsically related due to the underlying manufacturing processes. For instance, in the BFG system—characterized by a continuous production process—the complexity of the blowing-down and re-blowing mechanisms causes severe fluctuations in the gas generation flow. These fluctuations often lead to inconsistencies between the sensor readings and the actual process conditions, resulting in a significant number of anomalous data points. On the other hand, the LDG system follows a batch process [91], with intermittent off-recycling stages between nitrogen blowing and slag splashing cycles designed to protect the converters [92]. Due to the complexity of molten steel composition and the fluctuations in oxygen flow, abnormal data are commonly found in the sensor measurements related to LDG generation flow.
Lastly, two publications among the reviewed articles have been identified that consider a plant-level scope, meaning they are capable of detecting anomalies in large-scale infrastructures. In [64], an integrated diagnostic pipeline is proposed for PV systems, combining various innovative routines to differentiate between common failures and performance degradation modes—such as zero or reduced power output, system degradation, soiling and snow-related losses. This approach relies on a single performance metric and is intended for both batch analysis of large PV fleets and real-time monitoring, provided that the technical specifications (e.g., system characteristics and meteorological data) are available. Similarly, Wang et al. [47] introduce a comprehensive data-driven assessment framework designed for multitask management within cloud-based battery management systems. This approach is aimed at enhancing the overall performance and scalability of such systems, particularly in the context of lithium-ion batteries used in electric vehicles (EVs), where integrating multiple tasks efficiently is a growing area of interest.
Summarizing, most of the selected studies focus on device, system and process levels, proposing a range of anomaly detection approximations and techniques that have been discussed in previous sections. Within them, HVAC machinery, EV batteries and wind turbines are the most popular devices and systems found in the selected studies. Contrarily, few studies address either component level (e.g., power converters) or large-scale architectures (i.e., plants), suggesting that both ends of the spectrum are more niche knowledge fields and publications are scarce.
Regarding approximations and techniques, statistical tests and analysis span across the hierarchical levels and are specifically chosen for the large-scale scenarios. Differently, DL-based and model-based approaches focus on more intermediate layers (i.e., device, system and process).
4.2.4 Datasets
The rise of data-driven methods reinforces the importance of the availability and quality of representative data for the component, device, system, process or plant to be monitored from the perspective of fault or anomaly detection. Therefore, it is important to investigate various aspects of datasets used for the validation of algorithms and techniques in anomaly detection applications. In this section, the authors present their answer to RQ1.4 in the form of a brief discussion.
Datasets play a crucial role throughout the development process, whether they serve as proof of concept for visualization, manual examination and statistical analysis or as training input for machine learning techniques like regression, clustering and classification [42]. In a notable number of the reviewed articles, real datasets are used for validation purposes, which were usually presented together with the main characteristics of the component, device or system from which they originate. For example, in publications referring to renewable energy generation infrastructures, details such as the peak power generation capacity of a PV plant or a wind turbine are typically provided. In particular, these studies often specify the location of the infrastructure, whereas only in some cases, such as Refs. [44, 74], are details of the physical characteristics of the infrastructure included. Specifically, due to the emphasis on power curve modeling in studies focused on wind turbines, some of these articles also include details regarding the configuration of their transmission systems [63]. Special consideration is given to articles that used open datasets for residential load forecasting [50], electricity theft detection in smart grids [78, 82] and wind turbine monitoring [63].
In some cases, there is a notable interest in validating the proposed algorithms and methodologies using both real and simulated data as an effort to demonstrate their applicability. For instance, in [66], both simulation data from an air-cooled lithium-ion battery energy storage system and experimental data from a water-cooled lithium-ion battery energy storage system are considered. Similarly, in [89], the dataset consists of both simulated (i.e., modeled) and experimental (i.e., physical) data from test facilities. Additionally, some references consider standardized IEEE test cases, such as the IEEE 16-generator 5-area system, which is examined in [59]; the IEEE 39-bus New England system, which is analyzed in [49]; the IEEE 14-bus test system, considered in [60]; and the IEEE 33-bus power distribution system, studied in [48]. In contrast, two articles focused on power system state estimation [49, 60] rely exclusively on simulation data. However, it is important to highlight that these simulation datasets correspond to standardized IEEE test cases.
A few works among the reviewed articles focus only on experimental data obtained from an on-premises experimental testbed. For instance, in [67], an experimental platform is used for battery testing in different temperature ranges, which can be controlled by a temperature chamber. Similarly, a prototype platform was used in [86] for experimental verification on dual active bridge power converter monitoring.
In summary, the proliferation of data-driven approaches, techniques and algorithms is highlighting the importance of open, rich and representative datasets for research and development of anomaly detection in the energy applications domain. Although high-impact researchers support their studies with a high level of detail when describing the datasets and infrastructures from which data has been acquired, there is still a notable amount of research that uses longstanding datasets, which could question the applicability of the proposed developments.
4.2.5 Evaluation metrics
Evaluation metrics are key to assessing the performance of existing solutions, as well as for benchmarking against novel developments. Within the selected studies, those that utilize labeled datasets often utilize a range of evaluation metrics or apply the same metrics in varying manners. Specifically, some metrics appear to be used by most of the authors, specifically for classification and forecasting problems.
Several studies use classic metrics related to binary classification problems, which are fundamental in anomaly detection applications, in which normal data points are assigned to the negative class, and anomalous instances are classified as the positive class.
From this perspective, different metrics are calculated from the number of occurrences of correct predictions on the positive samples, true positive (TP), and negative samples, true negative (TN), and from the number of occurrences of incorrect predictions on both conditions, false positive (FP) and false negative (FN), respectively.
Precision, or positive predictive value (PPV), is computed by dividing TP occurrences by the total number of samples classified as positive by the model, which describes the sterility of the detected faults and whether there are FPs present. Precision is one of the most popular metrics within the reviewed studies [56, 73, 77, 93].
Alternatively, Recall, Sensitivity or true positive rate (TPR), is computed by dividing TP by all of the positive samples that were used for validation, which describes the rate of existing faults detected by the classifier. This metric is considered together with Precision a number of times [73, 93], while other studies [60] opt to combine them into a single metric, which is the F1-score, computed as the harmonic mean of Precision and Recall, as there is a severe class imbalance in the considered dataset. TPR can also be investigated against the probability of false alarm or false positive rate (FPR), which leads to the receiver operating characteristics (ROC) curve, describing how the ratio of TP and FP shifts across all thresholds. Thus, the area under the ROC curve (ROC-AUC) is sometimes used as a summarized indicator of model quality [42].
A particular paper [82] on studying electricity theft utilizes Specificity, or true negative rate (TNR), which is the negative equivalent of Sensitivity, considering that TN indicates the number of samples of electricity theft customers with correct detection results. Therefore, TNR quantifies the proportion of correctly classified theft samples among all actual theft cases.
Moreover, a few references use Accuracy [64, 89], which is computed by dividing the sum of the two elements on the diagonal of the confusion matrix (TP and TN) by the total number of positive and negative samples, measuring the percentage of samples correctly classified. A specific study [94] considers balanced accuracy (BA), which provides a balanced measure of classification performance by considering both Sensitivity and Specificity, which is used in the presence of imbalanced data. Finally, studies that include metrics for forecasting performance [50, 95] propose the mean absolute percentage error (MAPE).
In summary, a range of metrics is identified among all the reviewed studies, but many of them underscore the importance of the development of unified metrics that enable trustworthy and comparable evaluation of already existing solutions.
4.3 Open issues and research agenda
Drawing from the results of research question RQ1, additional conclusions are presented that highlight application areas and methodological approaches that are rarely addressed or considered in the reviewed studies.
First, it is found that two relevant topics are missing within the reviewed papers, suggesting that they are under-represented trends in the sample of studies, which has resulted from the selection process. On one hand, there are no papers specifically addressing anomaly detection in critical infrastructures and critical entities, which provide essential services to society in sectors such as energy, transport, finance or health, among others. In that context, the interdependence of many sectors on the energy system (i.e., power generation, transportation and distribution), such as the digital infrastructure for communications, underscores the need to develop specific anomaly detection applications for critical infrastructures of the energy sector. Notably, given their critical nature, it must be noted that standards and regulations regarding critical infrastructures are more mature when compared to other application domains, which could discourage researchers who are not willing to take the time to understand the legal and regulatory framework. On the other hand, the increased penetration of renewable energy, along with the proliferation of electric vehicles, has promoted the increase in charging points throughout the country, offering more charging options to EV users and also enabling flexibility solutions that integrate energy exchanges between the EV and the distribution grid, sometimes referred to as vehicle-to-grid (V2G). However, no publications within the selected studies address anomaly detection for EV chargers or EV charging stations.
Second, a number of methodological gaps are identified when carefully studying the selected works. For instance, federated learning (FL), which is an emerging ML paradigm that enables a large number of actors to perform an on-device training of a single ML model without sharing raw data, is only mentioned once in the 52 papers. However, FL is believed to be very powerful as infrastructures across all sectors become more and more distributed, which also includes the energy sector. In parallel, the usage of generative IA is scarce, mainly in the form of GANs and GAN-based algorithms, and focused on extending the available dataset, as well as generating imbalanced data.
Furthermore, DL-related methodological gaps have been found. On one hand, from a methodological point of view, it is not clear how to tackle the resource consumption, explainability and applicability of DL algorithms in anomaly detection applications. On the other hand, algorithms derived from DL, such as deep reinforcement learning (DRL), are emerging in other engineering applications and sectors, but there are very few references to them among the selected articles. In fact, the suitability of DRL is explicitly highlighted only in the context of detecting more complex anomalies, which typically involve high-dimensional data, such as consumption patterns and environmental conditions, as well as challenges like uncertain agent observations and sparse reward signals for anomaly identification [37]. In all other cases, DRL is only referred to in future works and future research directions.
Now, the current open issues of anomaly detection research are pointed out in order to answer RQ2. For each open issue, some research directions are proposed to address it.
4.3.1 Real-time operation and online deployment
Real-time operation is a key aspect of anomaly detection systems in energy applications. Specifically, it is critical in distributed environments such as the energy metering infrastructure or distributed renewable energy resources, which are equipped with resource-constrained edge devices that are limited in terms of computational resources and storage. Reducing training expenses of anomaly detection models, increasing detection efficiency and allowing real-time data analysis are believed to transform anomaly detection systems into more dependable and scalable solutions for many real-world anomaly detection situations [81].
Cloud-edge collaborative frameworks, such as those proposed by Li et al. [41], in which deep learning models can be deployed on both edge devices and cloud servers, enable efficient data processing and analysis. Thus, edge computing and model compression techniques can address the limitations of computational resources and bandwidth in vehicular environments, while cloud computing provides a robust platform for more complex battery anomaly detection tasks, including training deep learning models, long-term data storage and historical data analysis.
4.3.2 Explainability and interpretability
In recent years, the enduring challenge of evaluating and quantifying machine learning explainability has garnered some attention [96]. Nonetheless, many of the existing approaches are tailored primarily to classification or clustering tasks, making their adaptation to anomaly detection scenarios particularly challenging [97]. As a result, the interpretability of anomaly detection techniques has gained growing significance.
Therefore, explainable anomaly detection (XAD) refers to the process of deriving meaningful information from an anomaly detection model regarding patterns present in the data or acquired by the model. This information is deemed relevant when it offers valuable insight into the anomaly detection problem being examined by the end-user [97]. However, authors in [98] argue that most existing outlier detection methods typically fail to provide explanations for why certain instances are classified as outliers, that is, they do not clearly identify the specific characteristics that make those instances stand out.
Explainability is especially limited in deep learning-based anomaly detection approaches. Although these methods often deliver strong performance, the black-box nature of deep learning models poses a challenge for practical implementation [99], as the lack of transparency can reduce operator trust and hinder real-world deployment [94]. This issue is particularly relevant in the context of energy consumption anomaly detection, where understanding the reasons behind detected anomalies is essential. Therefore, developing deep learning-based methods that can explain why a particular power consumption event or observation is considered abnormal can help experts concentrate on the most critical anomalies and enhance their confidence in the implemented solutions [100, 101].
4.3.3 Learning strategies
Alternative and innovative learning strategies emerge in recent works in order to enable models to consider the evolution of different systems and the characteristics of anomalous data points, as well as to reduce the dependence on large, balanced, labeled datasets containing intricate patterns.
For instance, several recent studies have explored the use of TL strategies in condition monitoring and fault diagnosis, motivated by the limited availability of fault data during the actual operation of wind turbines [79].
Alternatively, by employing advanced feature extraction methods, contrastive learning models improve the effectiveness, robustness and scalability of electricity load anomaly detection, thereby increasing cost-efficiency and making them more suitable for a wide range of real-world applications [81].
In the context of energy theft detection, current approaches often struggle to effectively learn and adapt to the continuously changing and complex nature of theft behaviors. Moreover, they frequently fall short in meeting the real-time processing demands required for analyzing such behaviors. Research on incremental learning tailored to theft detection remains relatively limited [102]. Similarly, as discussed in Section 4.2.2, specific methodologies need to be developed to cope with the variation in operating conditions that represent both normal and abnormal operating states due to turbine wear [62].
In general, future research needs to provide anomaly detection algorithms for energy applications with adaptive incremental learning capabilities to enhance the resilience and applicability of anomaly detection models.
4.3.4 Data availability and reproducibility
Although significant progress has been made in developing anomaly detection techniques for energy-related applications, several factors have been identified that hinder reproducibility and, consequently, the fair and consistent experimental comparison of these algorithms [37]. One of the main challenges lies in evaluating the generalizability of anomaly detection approaches, as most frameworks are typically tested on a single dataset, often supplied by a partnering utility company. Such datasets are usually unlabeled and not publicly accessible, as is the case for the majority of studies reviewed, as mentioned in Section 4.2.4. This lack of accessibility complicates method comparison, increases the risk of error, and ultimately slows down advancement in the field [42].
To address this challenge, there is a pressing need to make open-source anomaly detection toolkits available, which should include challenging energy-related datasets alongside existing anomaly detection algorithms. This would enable fair, straightforward and reproducible comparisons of different methods [37]. Additionally, experimental data can serve as a valuable alternative to simulation data for data-driven modeling. The potential of combining simulation data with experimental results in hybrid approaches should also be explored. Furthermore, advanced artificial intelligence techniques such as attention neural networks, physics-informed neural networks and multitask learning can be integrated to enhance the practicality and effectiveness of data-driven models [86].
As highlighted in Section 4.2.2, numerous reviewed articles integrate these techniques, particularly LSTM, AE and CNN. The strength of deep learning lies in its ability to handle large-scale datasets and automatically learn discriminative features from the data, removing the need for manual feature engineering by domain experts. However, despite these advantages, deep neural networks (DNNs) face challenges during training that make them vulnerable [103]. For example, training can take several hours or even days. Additionally, deep models commonly suffer from overfitting and require a large volume of samples to train effectively [104], often resulting in poorer performance compared to shallow machine learning methods when training data is limited.
The use of edge control devices equipped with advanced microcontrollers featuring integrated machine learning accelerators enables inference, and potentially training, to be carried out directly on small, resource-limited, low-power devices rather than relying on large computing systems (such as desktops or workstations) or cloud platforms. Consequently, deep learning models must be compressed to fit the limited computing power, storage capacity and bandwidth of these devices, all while preserving their core functionality and accuracy [37].
In this study, the results of a systematic literature review on anomaly detection in energy applications have been presented. The results aim to shed some light on a long-established research area, which has been developed within diverse research areas. More specifically, this work focused on answering two general research questions and the corresponding sub-questions, which are summarized as follows:
The main anomaly detection applications in the energy sector appear to be energy distribution networks, that is, heat and electricity, as well as renewable energy generation, mainly PV and wind energy, and energy storage systems.
Regarding the main anomaly detection methodologies identified in previous reviews and surveys, some of them show very low or no presence among the selected articles, which underpins the idea that new taxonomic approaches are needed to improve terminological consistency in the field.
Regarding the techniques and algorithms implemented in the selected articles, a broad range of approaches has been observed, primarily model-based and data-driven. Notably, there is a strong presence of artificial intelligence-based models, especially DL, as an emerging and powerful tool for anomaly detection, although some knowledge and methodological gaps arise related to it. Also, a significant use of statistical techniques and particularly isolation-based algorithms, such as isolation forest and its derivatives, has been identified. In some cases, algorithms have been deployed on cloud infrastructures, monitoring large-scale systems, while in others, models are implemented at the edge level, prioritizing decentralized and real-time anomaly detection.
Under-represented trends have been investigated and discussed, as well as open issues, not only related to edge-cloud collaboration and online model updating but also encompassing adaptive and incremental learning strategies, as well as the explainability and interpretability of models, particularly in the case of deep learning-based approaches. Furthermore, its improvement will encompass research reproducibility and reduce the likelihood of the same methodology being developed simultaneously and unknowingly by multiple researchers.
From a continuation perspective, anomaly detection is considered to have a cross-cutting impact across various application domains. While the theoretical foundation provided by the algorithms remains consistent, the challenges encountered and the methodological or procedural solutions required vary by sector. In this regard, the authors aim to extend this line of research by applying anomaly detection analysis to fields currently undergoing significant digital advancements, particularly cybersecurity in critical infrastructure, where the physical and cyber dimensions must be addressed within a unified framework.
6.Nassif AB, Talib MA, Nasir Q, Dakalbab FM. Machine learning for anomaly detection: A systematic review. IEEE Access. 2021;9:78658-78700
7.Ariyaluran Habeeb RA, Nasaruddin F, Gani A, Targio Hashem IA, Ahmed E, Imran M. Real-time big data processing for anomaly detection: A survey. International Journal of Information Management. 2019;45:289-307
8.DeMedeiros K, Hendawi A, Alvarez M. A survey of AI-based anomaly detection in IoT and sensor networks. Sensors. 2023;23(3):1352
9.Wu Y, Dai HN, Tang H. Graph neural networks for anomaly detection in industrial internet of things. IEEE Internet of Things Journal. 2022;9(12):9214-9231
10.Samariya D, Thakkar A. A comprehensive survey of anomaly detection algorithms. Annals of Data Science. 2021;10:829-850. Available from: https://link.springer.com/10.1007/s40745-021-00362-9
11.Pang G, Shen C, Cao L, Hengel AVD. Deep learning for anomaly detection: A review. ACM Computing Surveys. 2021;54(2):1-36. DOI: 10.1145/3439950
12.Xia X, Pan X, Li N, He X, Ma L, Zhang X, et al. GAN-based anomaly detection: A review. Neurocomputing. 2022;493:497-535
13.Che TC, Duan HF, Lee PJ. Transient wave-based methods for anomaly detection in fluid pipes: A review. Mechanical Systems and Signal Processing. 2021;160:107874
14.Ahmed M, Naser Mahmood A, Hu J. A survey of network anomaly detection techniques. Journal of Network and Computer Applications. 2016;60:19-31
15.Ahmed M, Mahmood AN, Islam MR. A survey of anomaly detection techniques in financial domain. Future Generation Computer Systems. 2016;55:278-288
16.Cook AA, Misirli G, Fan Z. Anomaly detection for IoT time-series data: A survey. IEEE Internet of Things Journal. 2020;7(7):6481-6494
17.Liu FT, Ting KM, Zhou ZH. Isolation-based anomaly detection. ACM Transactions on Knowledge Discovery from Data. 2012;6(1):1-39
18.Ghoting A, Otey ME, Parthasarathy S. LOADED: Link-based outlier and anomaly detection in evolving data sets. In: Fourth IEEE International Conference on Data Mining (ICDM’04). Brighton, UK: IEEE; 2004. pp. 387-390. Available from: http://ieeexplore.ieee.org/document/1410317/
19.He Z, Deng S, Xu X. A Unified Subspace Outlier Ensemble Framework for Outlier Detection. In: Fan W, Wu Z, Yang J, Hutchison D, Kanade T, Kittler J, Kleinberg JM, Mattern F, Mitchell JC, et al., editors. Advances in Web-Age Information Management, Lecture Notes in Computer Science. Vol. 3739. Berlin, Heidelberg: Springer Berlin Heidelberg; 2005. pp. 632-637. Available from: http://link.springer.com/10.1007/11563952_56
20.Abe N, Zadrozny B, Langford J. Outlier detection by active learning. In: Proceedings of the 12th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. Philadelphia PA USA: ACM; 2006. pp. 504-509. Available from: https://dl.acm.org/doi/10.1145/1150402.1150459
21.Chandola V. Outlier Detection: A Survey. Available from: https://www.researchgate.net/profile/Vipin-Kumar-54/publication/242403027_Outlier_Detection_A_Survey/links/0deec52d83600bb86c000000/Outlier-Detection-A-Survey.pdf
22.Bellman R. Dynamic programming. Science. 1966;153(3731):34-37
23.Zhang L, Lin J, Karim R. Sliding window-based fault detection from high-dimensional data streams. IEEE Transactions on Systems, Man, and Cybernetics: Systems. 2016;47:1-15
24.Thudumu S, Branch P, Jin J, Singh J. A comprehensive survey of anomaly detection techniques for high dimensional big data. Journal of Big Data. 2020;7(1):42
25.Xu X, Liu H, Yao M. Recent progress of anomaly detection. Complexity. 2019;2019(1):2686378
26.Cao Y, Xiang H, Zhang H, Zhu Y, Ting KM. Anomaly detection based on isolation mechanisms: A survey. arXiv. 2024. Available from: https://arxiv.org/abs/2403.10802
27.Toshniwal A, Mahesh K, R. J. Overview of anomaly detection techniques in machine learning. In: 2020 Fourth International Conference on I-SMAC (IoT in Social, Mobile, Analytics and Cloud) (I-SMAC). Palladam, India: IEEE; 2020. pp. 808-815. Available from: https://ieeexplore.ieee.org/document/9243329/
28.Samara MA, Bennis I, Abouaissa A, Lorenz P. A survey of outlier detection techniques in IoT: Review and classification. Journal of Sensor and Actuator Networks. 2022;11(1):4
29.Marchioni A, Enttsel A, Mangia M, Rovatti R, Setti G. Anomaly detection based on compressed data: An information theoretic characterization. IEEE Transactions on Systems, Man, and Cybernetics: Systems. 2024;54(1):23-38
30.Moustafa N, Hu J, Slay J. A holistic review of network anomaly detection systems: A comprehensive survey. Journal of Network and Computer Applications. 2019;128:33-55
31.De Almeida Biolchini JC, Mian PG, Natali ACC, Conte TU, Travassos GH. Scientific research ontology to support systematic review in software engineering. Advanced Engineering Informatics. 2007;21(2):133-151
32.Kitchenham B, Charters S. Guidelines for Performing Systematic Literature Reviews in Software Engineering. EBSE Technical Report EBSE-2007-01. United Kingdom: Keele University
33.Kitchenham BA, Budgen D, Pearl BO. Using mapping studies as the basis for further research—A participant-observer case study. Information and Software Technology. 2011;53(6):638-651
34.SCImago Journal Rank (SJR) [Internet]. Available from: https://www.scimagojr.com/
35.ACM DL [Internet]. Available from: https://dl.acm.org/
36.Scopus [Internet]. Available from: https://www.elsevier.com/products/scopus/search
37.Himeur Y, Ghanem K, Alsalemi A, Bensaali F, Amira A. Artificial intelligence based anomaly detection of energy consumption in buildings: A review, current trends and new perspectives. Applied Energy. 2021;287:116601. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85100478413&doi=10.1016%2fj.apenergy.2021.116601&partnerID=40&md5=cfcaf88aa168a4b327e69d1fd1379663
38.Frederiksen S. District Heating and Cooling. 1st ed. Lund: Studentlitteratur; 2013. 586 p
39.De Souza Silva JL, Moreira HS, Dos Reis MVG, Barros TADS, Villalva MG. Theoretical and behavioral analysis of power optimizers for grid-connected photovoltaic systems. Energy Reports. 2022;8:10154-10167
40.de Souza Silva JL, Mahmoudi E, Carvalho RRM, dos Santos Barros TA. Classification of anomalies in photovoltaic systems using supervised machine learning techniques and real data. Energy Reports. 2024;11:4642-4656
41.Li X, Wang Q, Xu C, Wu Y, Li L. Survey of lithium-ion battery anomaly detection methods in electric vehicles. IEEE Transactions on Transportation Electrification. 2025;11(1):4189-4201
42.Neumayer M, Stecher D, Grimm S, Maier A, Bücker D, Schmidt J. Fault and anomaly detection in district heating substations: A survey on methodology and data sets. Energy. 2023;276:127569. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85153487782&doi=10.1016%2fj.energy.2023.127569&partnerID=40&md5=1d2ea8bd8b1b3e2b6f1368acf4f37c74
43.Bai M, Liu J, Chai J, Zhao X, Yu D. Anomaly detection of gas turbines based on normal pattern extraction. Applied Thermal Engineering. 2020;166:114664. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85076598604&doi=10.1016%2fj.applthermaleng.2019.114664&partnerID=40&md5=03fa9a404a482d8fba9d6120f1e9db92
44.Chen H, Liu H, Chu X, Liu Q, Xue D. Anomaly detection and critical SCADA parameters identification for wind turbines based on LSTM-AE neural network. Renewable Energy. 2021;172:829-840
45.Jiang J, Zhang R, Wu Y, Chang C, Jiang Y. A fault diagnosis method for electric vehicle power lithium battery based on wavelet packet decomposition. Journal of Energy Storage. 2022;56:105909. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85140489562&doi=10.1016%2fj.est.2022.105909&partnerID=40&md5=c239fcbda50e0c3de3a3b06baa3ca2b7
46.Taghezouit B, Harrou F, Sun Y, Arab AH, Larbes C. Multivariate statistical monitoring of photovoltaic plant operation. Energy Conversion and Management. 2020;205:112317. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85077460624&doi=10.1016%2fj.enconman.2019.112317&partnerID=40&md5=9c6c472583117a5fcebf095b1742890a
47.Wang Y, Han X, Xu X, Pan Y, Dai F, Zou D, et al. A comprehensive data-driven assessment scheme for power battery of large-scale electric vehicles in cloud platform. Journal of Energy Storage. 2023;64:107210. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85151028561&doi=10.1016%2fj.est.2023.107210&partnerID=40&md5=54d4705677c99be21a4a3a62dc3e5483
48.Algikar P, Xu Y, Yarahmadi S, Mili L. A robust data-driven process modeling applied to time-series stochastic power flow. IEEE Transactions on Power Systems. 2024;39(1):693-705
49.Abolmasoumi AH, Farahani A, Mili L. Robust particle filter design with an application to power system state estimation. IEEE Transactions on Power Systems. 2024;39(1):1810-1821
50.Forootani A, Rastegar M, Sami A. Short-term individual residential load forecasting using an enhanced machine learning-based approach based on a feature engineering framework: A comparative study with deep learning methods. Electric Power Systems Research. 2022;210:108119. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85133966897&doi=10.1016%2fj.epsr.2022.108119&partnerID=40&md5=30704793ef9e235244c2995e2d615e31
51.Zhang S, Robinson E, Basu M. Wind turbine condition monitoring based on three fitted performance curves. Wind Energy. 2024;27(5):429-446
52.Obermayr M, Riess C, Wilde J. A novel online 4-point rainflow counting algorithm for power electronics. Microelectronics Reliability. 2021;120:114112
53.Yin S, Yang H, Xu K, Zhu C, Zhang S, Liu G. Dynamic real–time abnormal energy consumption detection and energy efficiency optimization analysis considering uncertainty. Applied Energy. 2022;307:118314. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85120745388&doi=10.1016%2fj.apenergy.2021.118314&partnerID=40&md5=bec14803ea2627ec4d8c06762c664c8e
54.Jin F, Wu H, Liu Y, Zhao J, Wang W. Varying-scale HCA-DBSCAN-based anomaly detection method for multi-dimensional energy data in steel industry. Information Sciences. 2023;647(C):119479. DOI: 10.1016/j.ins.2023.119479
55.Yao Q, Hu Y, Liu J, Zhao T, Qi X, Sun S. Power curve modeling for wind turbine using hybrid-driven outlier detection method. Journal of Modern Power Systems and Clean Energy. 2023;11(4):1115-1125
56.Elnour M, Meskin N, Khan K, Jain R. Application of data-driven attack detection framework for secure operation in smart buildings. Sustainable Cities and Society. 2021;69:102816. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85102971255&doi=10.1016%2fj.scs.2021.102816&partnerID=40&md5=48c224deae535fddfedb4cd21a3f7565
57.Li T, Liu X, Lin Z, Morrison R. Ensemble offshore wind turbine power curve modelling—An integration of isolation forest, fast radial basis function neural network, and metaheuristic algorithm. Energy. 2022;239:122340. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85117364439&doi=10.1016%2fj.energy.2021.122340&partnerID=40&md5=d37af9463db3a3e12a11ce7fc6e4592f
58.Kong J, Jiang W, Tian Q, Jiang M, Liu T. Anomaly detection based on joint spatio-temporal learning for building electricity consumption. Applied Energy. 2023;334:120635. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85146457701&doi=10.1016%2fj.apenergy.2022.120635&partnerID=40&md5=e50a22ff89197a29aa5df898a64734c5
59.Gao H, Yang D, Cai G, Chen Z, Ma J, Wang L, et al. Machine learning-based reliability improvement of ambient mode extraction for smart grid utilizing isolation forest. IEEE Transactions on Power Systems. 2023;38(5):4752-4760
60.Asefi S, Mitrovic M, Ćetenović D, Levi V, Gryazina E, Terzija V. Anomaly detection and classification in power system state estimation: Combining model-based and data-driven methods. Sustainable Energy, Grids and Networks. 2023;35:101116. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85166961930&doi=10.1016%2fj.segan.2023.101116&partnerID=40&md5=856d8ba5448d11595cf0fa323e84a0b0
61.Diao W, Naqvi IH, Pecht M. Early detection of anomalous degradation behavior in lithium-ion batteries. Journal of Energy Storage. 2020;32:101710. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85089036032&doi=10.1016%2fj.est.2020.101710&partnerID=40&md5=c51a8199f4c6e012e1406491b203bc16
62.Dao PB. On Wilcoxon rank sum test for condition monitoring and fault detection of wind turbines. Applied Energy. 2022;318:119209
63.Dao PB, Barszcz T, Staszewski WJ. Anomaly detection of wind turbines based on stationarity analysis of SCADA data. Renewable Energy. 2024;232:121076. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85199995353&doi=10.1016%2fj.renene.2024.121076&partnerID=40&md5=e450c7bffbe0cc0ac8ebd77964cc9ae6
64.Livera A, Theristis M, Micheli L, Stein JS, Georghiou GE. Failure diagnosis and trend-based performance losses routines for the detection and classification of incidents in large-scale photovoltaic systems. Progress in Photovoltaics: Research and Applications. 2022;30(8):921-937
65.Ohunakin OS, Henry EU, Matthew OJ, Ezekiel VU, Adelekan DS, Oyeniran AT. Conditional monitoring and fault detection of wind turbines based on Kolmogorov–Smirnov non-parametric test. Energy Reports. 2024;11:2577-2591
66.Qiu Y, Peng P, Jiang F. Improvement of local outlier factor algorithms for lithium-ion battery fault diagnosis. Journal of Energy Storage. 2024;98:113100. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85199787191&doi=10.1016%2fj.est.2024.113100&partnerID=40&md5=a10ba01e78c6d65ede66a6cf26f564bb
67.Yuan H, Cui N, Li C, Cui Z, Chang L. Early stage internal short circuit fault diagnosis for lithium-ion batteries based on local-outlier detection. Journal of Energy Storage. 2023;57:106196. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85143536926&doi=10.1016%2fj.est.2022.106196&partnerID=40&md5=8e6b2dd41356291bb1fa93c0163a1276
68.Ristic B. Particle Filters for Random Set Models. New York, NY: Springer New York; 2013. Available from: https://link.springer.com/10.1007/978-1-4614-6316-0
69.Wang Y, Hu Q, Li L, Foley AM, Srinivasan D. Approaches to wind power curve modeling: A review and discussion. Renewable and Sustainable Energy Reviews. 2019;116:109422
70.Khezami N, Benhadj Braiek N, Guillaud X. Wind turbine power tracking using an improved multimodel quadratic approach. ISA Transactions. 2010;49(3):326-334
71.Turnbull A, Carroll J, McDonald A. Combining SCADA and vibration data into a single anomaly detection model to predict wind turbine component failure. Wind Energy. 2021;24(3):197-211
72.Morrison R, Liu X, Lin Z. Anomaly detection in wind turbine SCADA data for power curve cleaning. Renewable Energy. 2022;184:473-486
73.Khan PW, Byun YC. Detecting anomaly classification using PCA-Kmeans and ensembled classifier for wind turbines. IEEE Open Access Journal of Power and Energy. 2024;11:349-361
74.Trizoglou P, Liu X, Lin Z. Fault detection by an ensemble framework of Extreme Gradient Boosting (XGBoost) in the operation of offshore wind turbines. Renewable Energy. 2021;179:945-962
75.Mascali L, Schiera DS, Eiraudo S, Barbierato L, Giannantonio R, Patti E, et al. A machine learning-based anomaly detection framework for building electricity consumption data. Sustainable Energy, Grids and Networks. 2023;36. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85175365401&doi=10.1016%2fj.segan.2023.101194&partnerID=40&md5=9394e4198b60c8ca6e5a5f6429731f7f
76.Lei L, Wu B, Fang X, Chen L, Wu H, Liu W. A dynamic anomaly detection method of building energy consumption based on data mining technology. Energy. 2023;263:125575. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85139299674&doi=10.1016%2fj.energy.2022.125575&partnerID=40&md5=6481fd85df259a6aeabc1007bac94dd5
77.Zhang L, Guo J, Lin P, Tiong RLK. Detecting energy consumption anomalies with dynamic adaptive encoder-decoder deep learning networks. Renewable and Sustainable Energy Reviews. 2025;207:114975. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85206268172&doi=10.1016%2fj.rser.2024.114975&partnerID=40&md5=c158cbd6ab47c830b2d22b064da4be98
78.Qi R, Li Q, Luo Z, Zheng J, Shao S. Deep semi-supervised electricity theft detection in AMI for sustainable and secure smart grids. Sustainable Energy, Grids and Networks. 2023;36:101219. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85177026911&doi=10.1016%2fj.segan.2023.101219&partnerID=40&md5=8d65d3cb86d60e3ad933d6ba75e663ac
79.Zhu Y, Zhu C, Tan J, Tan Y, Rao L. Anomaly detection and condition monitoring of wind turbine gearbox based on LSTM-FS and transfer learning. Renewable Energy. 2022;189:90-103
80.Tobar A, Flores M, Castillo-Páez S, Naya S, Zaragoza S, Tarrío-Saavedra J. Bootstrap-LOCI data mining methodology for anomaly detection in buildings energy efficiency. Energy Reports. 2023;10:244-254
81.Choubey M, Chaurasiya RK, Yadav JS. Contrastive learning for efficient anomaly detection in electricity load data. Sustainable Energy, Grids and Networks. 2025;42:101639. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85217280793&doi=10.1016%2fj.segan.2025.101639&partnerID=40&md5=078584789d3b60aaa093606d8b3563b0
82.Cai Q, Li P, Zhao Z, Wang R. Dynamic electricity theft behavior analysis based on active learning and incremental learning in new power systems. International Journal of Electrical Power & Energy Systems. 2024;162:110309. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85207691006&doi=10.1016%2fj.ijepes.2024.110309&partnerID=40&md5=2458a2ae9bc0e4de6a959c5bcb91407e
83.Yang J, Chen X, Zhao C. Toward the ensemble consistency: Condition-driven ensemble balance representation learning and nonstationary anomaly detection for battery energy storage system. Applied Energy. 2025;381:125160. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85212562453&doi=10.1016%2fj.apenergy.2024.125160&partnerID=40&md5=ab8023cc5f01dbaaa539d36e7b85a151
84.Shi Y, He W, Zhao J, Hu A, Pan J, Wang H, et al. Expected output calculation based on inverse distance weighting and its application in anomaly detection of distributed photovoltaic power stations. Journal of Cleaner Production. 2020;253:119965. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85077397181&doi=10.1016%2fj.jclepro.2020.119965&partnerID=40&md5=b6c5565334b7034efdece9d629fc1f3f
85.Hermans C, Al Koussa J, Van Oevelen T, Vanhoudt D. Fault detection for district heating substations: Beyond three-sigma approaches. Smart Energy. 2024;16:100159. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85205483172&doi=10.1016%2fj.segy.2024.100159&partnerID=40&md5=f07ae8242fb01830ae209d18e4e7d738
86.Lin F, Zhang X, Li X, Sun C, Zsurzsan G, Cai W, et al. AI-based design with data trimming for hybrid phase shift modulation for minimum-current-stress dual active bridge converter. IEEE Journal of Emerging and Selected Topics in Power Electronics. 2024;12(2):2268-2280
87.Li S, Pandey A, Hooi B, Faloutsos C, Pileggi L. Dynamic graph-based anomaly detection in the electrical grid. IEEE Transactions on Power Systems. 2022;37(5):3408-3422
88.Castangia M, Sappa R, Girmay AA, Camarda C, Macii E, Patti E. Anomaly detection on household appliances based on variational autoencoders. Sustainable Energy, Grids and Networks. 2022;32. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85145802031&doi=10.1016%2fj.segan.2022.100823&partnerID=40&md5=cc63c3df3de9be1a900a41149fb9ae23
89.Movahed P, Taheri S, Razban A. A bi-level data-driven framework for fault-detection and diagnosis of HVAC systems. Applied Energy. 2023;339:120948. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85150300115&doi=10.1016%2fj.apenergy.2023.120948&partnerID=40&md5=bafeb38b4d246268d47f166bed4ae03d
90.Jin F, Zhao J, Han Z, Wang W. A joint scheduling method for multiple byproduct gases in steel industry. Control Engineering Practice. 2018;80:174-184
91.Wang T, Zhao J, Liu Q, Wang W. Granular-based multilayer spatiotemporal network with control gates for energy prediction of steel industry. IEEE Transactions on Instrumentation and Measurement. 2021;70:1-12
92.Souza Santos IA, De Medeiros Santos VR, Dos Reis Lima W, Da Silva AL, Maia BT, De Oliveira JR. Slag splashing: Simulation and analysis of the slags conditions. Journal of Materials Research and Technology. 2019;8(6):6173-6176
93.Li Y, Shen X. Anomaly detection and classification method for wind speed data of wind turbines using spatiotemporal dependency structure. IEEE Transactions on Sustainable Energy. 2023;14(4):2417-2431
94.Gao B, Kong X, Li S, Chen Y, Zhang X, Liu Z, et al. Enhancing anomaly detection accuracy and interpretability in low-quality and class imbalanced data: A comprehensive approach. Applied Energy. 2024;353:122157. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85175533259&doi=10.1016%2fj.apenergy.2023.122157&partnerID=40&md5=21851b4184f0669e48a62752e614cea5
95.Huyghues-Beaufond N, Tindemans S, Falugi P, Sun M, Strbac G. Robust and automatic data cleansing method for short-term load forecasting of distribution feeders. Applied Energy. 2020;261:122157. Available from: https://www.scopus.com/inward/record.uri?eid=2-s2.0-85077647677&doi=10.1016%2fj.apenergy.2019.114405&partnerID=40&md5=4bbcdc278f19b9a0f16375aaffec7ce1
96.Carvalho DV, Pereira EM, Cardoso JS. Machine learning interpretability: A survey on methods and metrics. Electronics. 2019;8(8):832
97.Li Z, Zhu Y, Van Leeuwen M. A survey on explainable anomaly detection. ACM Transactions on Knowledge Discovery from Data. 2023;18(1):1-54. DOI: 10.1145/3609333
98.Vinh NX, Chan J, Romano S, Bailey J, Leckie C, Ramamohanarao K, et al. Discovering outlying aspects in large datasets. Data Mining and Knowledge Discovery. 2016;30(6):1520-1555
99.Amarasinghe K, Kenney K, Manic M. Toward explainable deep neural network based anomaly detection. In: 11th International Conference on Human System Interaction (HSI). Gdansk, Poland: IEEE; 2018. pp. 311-317. Available from: https://ieeexplore.ieee.org/document/8430788/
100.Kauffmann J, Ruff L, Montavon G, Müller KR. The clever Hans effect in anomaly detection. arXiv. 2020. Available from: https://arxiv.org/abs/2006.10609
101.Antwarg L, Miller RM, Shapira B, Rokach L. Explaining anomalies detected by autoencoders using SHAP. arXiv. 2019. Available from: https://arxiv.org/abs/1903.02407
102.Yao R, Wang N, Ke W, Liu Z, Yan Z, Sheng X. Electricity theft detection in incremental scenario: A novel semi-supervised approach based on hybrid replay strategy. IEEE Transactions on Instrumentation and Measurement. 2023;72:1-12
103.Papernot N, McDaniel P, Jha S, Fredrikson M, Celik ZB, Swami A. The limitations of deep learning in adversarial settings. In: 2016 IEEE European Symposium on Security and Privacy (EuroS&P). Saarbrucken: IEEE; 2016. pp. 372-387. Available from: http://ieeexplore.ieee.org/document/7467366/
104.Lemley J, Bazrafkan S, Corcoran P. Deep learning for consumer devices and services: Pushing the limits for machine learning, artificial intelligence, and computer vision. IEEE Consumer Electronics Magazine. 2017;6(2):48-56
Written By
Joan Valls Pérez, Mayra Ramírez Chávez, Miguel Delgado Prieto and Luis Romeral Martínez
Submitted: 17 March 2025Reviewed: 16 July 2025Published: 25 August 2025
Open access peer-reviewed chapter - ONLINE FIRST
