A Multi-Stage Framework for Intrusion Detection and Attack-Path Reconstruction in Advanced Metering Infrastructure (AMI) Networks

Advanced Metering Infrastructure (AMI) underpins bidirectional communication in smart grids, a foundational layer of smart city energy systems, facilitating the flow of data, real-time monitoring, and demand-responsive control. But its connectivity exposes smart meters to data tampering, denial-of-service attack, and false-data-injection attacks. Most intrusion detection systems (IDSs) for AMI only report that an intrusion has occurred but cannot reconstruct how it propagated or where it originated, leaving the operators without the forensic evidence to perform containment. This paper proposes a multi-stage approach coupling detection with forensic analysis. A recurrent neural network (RNN) extracts temporal features, a support vector classifier (SVC) performs binary classification, and ant colony optimization (ACO) serves two purposes: feature selection before classification and a backward path reconstruction after an intrusion is confirmed. The proposed framework is evaluated on a simulated AMI network with forensic ground truth and further validated on the public UNSW-NB15 benchmark. The detection accuracy exceeds 96%, while ACO reduces the feature set from 40 to 14. A McNemar’s test (p=0.265) indicates that this feature reduction does not significantly alter the per-sample error pattern. With the use of the improved tracer, the Path Overlap Score increases from 0.29 to 0.40, while the False-Positive Path Rate decreases from 0.39 to 0.19, relative to the centroid baseline tracer used for forensic tracking. This improvement in the Path Overlap Score is statistically significant (p=4.39×10−8). However, the Source Localization Rate remains relatively low (9%–11%) for both methods, owing to the intrinsic difficulty of identifying the true source meter from incomplete alert data. Therefore, the proposed framework not only reliably detects intrusions but also significantly outperforms the baseline tracer in path overlap and false-positive rate, although precise source localization remains an open challenge.