  Tampering of metering infrastructure of an electrical distribution system can
significantly cause customers' billing discrepancy. The large-scale deployment
of smart meters may potentially be tampered by malware by propagating their
agents to other IP-based meters. Such a possibility is to pivot through the
physical perimeters of a smart meter. While this framework may help utilities
to accurately energy consumption information on the regular basis, it is
challenging to identify malicious meters when there is a large number of users
that are exploited to vulnerability and kWh information being altered. This
paper presents a reconfiguration switching scheme based on graph theory
incorporating the concept of distributed generators to accelerate the anomaly
localization process within an electrical distribution network. First, a data
form transformation from a visualized grid topology to a graph with vertices
and edges is presented. A conversion from the graph representation to machine
recognized matrix representation is then performed. The connection of the grid
topology is illustrated as an adjacency or incidence matrix for the following
analysis. A switching procedure to change elements in the topological matrix is
used to detect and localize the tampered node or cluster. The procedure has to
meet the electrical and the temporary closed-loop operational constraints. The
customer-level anomaly detection is then performed in accordance with
probability derived from smart meter anomalies.
