Protecting Consumer Privacy from Electric Load
Monitoring
Stephen McLaughlin Patrick McDaniel
Systems and Internet Infrastructure Security Lab
Pennsylvania State Univesity
University Park, PA, USA
{smclaugh,mcdaniel}@cse.psu.edu
William Aiello
Networks, Systems, and Security Lab
University of British Columbia
Vancouver, B.C., Canada
aiello@cs.ubc.ca
ABSTRACT
The smart grid introduces concerns for the loss of consumer pri-
vacy; recently deployed smart meters retain and distribute highly
accurate profiles of home energy use. These profiles can be mined
by Non Intrusive Load Monitors (NILMs) to expose much of the
human activity within the served site. This paper introduces a new
class of algorithms and systems, called Non-Intrusive Load Lev-
eling (NILL) to combat potential invasions of privacy. NILL uses
an in-residence battery to mask variance in load on the grid, thus
eliminating exposure of the appliance-driven information used to
compromise consumer privacy. We use real residential energy use
profiles to drive four simulated deployments of NILL. The simula-
tions show that NILL exposes only 1.1 to 5.9 useful energy events
per day hidden amongst hundreds or thousands of similar battery-
suppressed events. Thus, the energy profiles exhibited by NILL are
largely useless for current NILM algorithms. Surprisingly, such
privacy gains can be achieved using battery systems whose storage
capacity is far lower than the residence’s aggregate load average.
We conclude by discussing how the costs of NILL can be offset by
energy savings under tiered energy schedules.
Categories and Subject Descriptors
J.m [Computer Applications]: Miscellaneous
General Terms
Security
Keywords
smart meter, privacy, load monitor
1. INTRODUCTION
Smart meters are being aggressively deployed in homes and busi-
nesses as part of a move to global smart grids [23]. This digitization
of grid systems offers substantial benefits for society; increased
efficiencies and information availability can enable cheaper and
Permission to make digital or hard copies of all or part of this work for
personal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, to
republish, to post on servers or to redistribute to lists, requires prior specific
permission and/or a fee.
CCS’11, October 17–21, 2011, Chicago, Illinois, USA.
Copyright 2011 ACM 978-1-4503-0948-6/11/10 ...$10.00.
greener energy generation, less loss in energy storage and transmis-
sion, better fault isolation and recovery, and support for alternative
energy sources, e.g., consumer generated wind and solar energy.
The move to digital grid control systems also introduces con-
cerns about security [19, 24, 27]. The smart grid is a complex
system of sensors, networks, and computing resources. Attacks
against the smart-grid networks and computing elements can range
from fraud, to denial of service, to privacy loss [27]. While some
regulatory agencies have begun to explore security concerns, no
comprehensive system has emerged to address these threats.
One area of particular concern is the loss of consumer privacy.
Replacements for the antiquated in-home electromechanical me-
ters, smart meters are embedded systems that use power and volt-
age sensors to collect and report load profiles. Load profiles are
histories of energy usage collected at a configured granularity, e.g.,
seconds or minutes. While instrumental to managing energy use
at the local and regional levels, such profiles are also sufficient to
determine occupant behavior in residential settings [22, 21, 11].
Depicted here, this behavioral inference is made possible by a class
of algorithms known as Non-Intrusive Load Monitoring (NILM):
Load monitoring Load profile
Lighting
Oven
Heater
...
Appliance
ON -------------------
OFF -- ON --- OFF
ON - OFF - ON ---
...
Time
• Presence
• Meals
• Sleep
• Habits
Appliance profile Behavior
(kW)
(s)
NILM
To simplify, NILM algorithms decompose load profiles into com-
posite appliance profiles based on known or learned signatures. For
example, traces of discrete changes in energy use can be mapped
directly to ON/OFF events associated with identifiable appliances.
The profile is a detailed description of appliance use and indirectly
a surprisingly accurate model of human activity [22].
The concerns surrounding potential invasions of privacy via en-
ergy profiles appear to be more than hypothetical [15, 6]. Reuse
of data by direct marketers, criminals, or law enforcement with-
out prior approval or notification is often in conflict with privacy
regulations, but may be occurring anyway [22]. Undercutting ex-
isting regulatory structures is a maze of often conflicting laws and
court decisions relating to consumer privacy. For example, the 1939
Supreme Court United State v. Miller decision indicates that there
is no reasonable expectation of privacy for information shared with
third parties. State and regional agencies have built legal and reg-
ulatory structures to buttress privacy in the face of such decisions,
but consumer rights remain, at best, murky.
The potential exposure of living conditions, occupancy, and fam-
ily routines, through energy profiles warrants vigilance [15]. This
prompts the goal of this work: we aim to protect consumer privacy
(+)
Net Demand
Battery charge/
discharge
Leveled load
profile
(kW)
(s)
(kW)
(s)
⊕
Battery
Control
Figure 1: Idealized non-invasive load leveling (NILL).
in the face of profile-exposing smart meters while acknowledging
two practical constraints of the current grid environment:
• Energy usage must always be accurately reported. Any mod-
ification of usage data would undermine grid management,
and introduce inaccuracies in billing and grid controls.
• The privacy solution must not require any modification to the
meters, appliances, grid control systems, or provider opera-
tion. The metering infrastructure, which is not under the con-
trol of the consumer, is assumed to be untrusted. Moreover,
with millions of smart meters already installed and many
more in deployment,
1
any solution requiring new grid sys-
tems will not be logistically and economically viable [27].
We address threats to electricity consumer privacy through Non-
Intrusive Load Leveling (NILL), a novel technique to mask appli-
ance features in a home’s net load. Illustrated in Figure 1, NILL
is conceptually simple; a consumer places a battery and control
system between the smart meter and the circuit breaker of their
residence. The load observed by the meter is smoothed by offset-
ting spikes and dips in usage by charging or discharging the bat-
tery. Hence, NILL removes the information content that reveals
appliance usage. Because we make no assumptions about adver-
sary motivations, NILL aims to smooth all appliance features in a
house. However, because of the physical limits and structure of
electrical systems, this is a more challenging task than one might
initially surmise. Note that NILL is currently not designed to mask
longer term energy usage such as day/night diurnal energy patterns,
but only the instantaneous energy transitions that expose minute-to-
minute human behavior exploited by NILM algorithms. However,
we do explore the challenges and countermeasures posed by cur-
rently undeveloped NILM techniques that use more sophisticated
learning and inference techniques in Appendix A.
NILL is an algorithm and control system that attempts to remove
the fine-grained appliance signal represented by changes in the re-
ported load. The control system directs the battery charges and
discharges to obscure energy usage. This is conceptually similar to
queue delay perturbation countermeasures that prevent networking
timing analysis [5]. By de-correlating both the timing and ampli-
tude of ON/OFF events in the load profile, we remove the signal
that NILM algorithms use to identify behavior.
The idea of using a battery to provide “best effort” privacy pro-
tection is not new. For example, one short paper [16] has suggested
the use of a power router to allow a battery to offset appliance loads,
though the existing technology in this area limits the battery to han-
dling one appliance at a time. Furthermore, none of the physical
challenges of introducing a battery into a residential setting were
evaluated. Ours is the first work to perform a rigorous physical
1
$4.3 billion dollars has been allocated by the U.S government for
the smart grids [28], with similar programs in progress in Asia and
the EU.
Table 1: Commodity smart meters [29].
Epoch Product(s) Deployed
monthly electromechanical meters N/A
(no data) Sensus iCon [34] 7.6 million
15 min Elster REX 2 [8] 4.0 million
5 min Echelon NES echelon 4.4 million
1 min Itron Centron [14] 14.4 million
1 s TED 5000 [37] (no data)
simulation of such a system under substantial real-word data. The
NILL approach presented here attempts to provide privacy for all
appliances under all battery states. Our analysis also extends be-
yond previous results by examining NILL’s effect on the basic unit
of load monitoring, the feature pair, and by measuring the amount
of privacy afforded over time due to changes in battery states.
The remainder of this paper identifies and evaluates a candidate
NILL algorithm. A simulation of NILL is built on the widely-used
SimPowerSystems [26] platform. We simulate four homes using
energy profile data collected from real residential use. These exper-
iments show that NILL exposed 1.1 and 5.9 identifiable appliance
events per day. Such features reside amongst hundreds or thou-
sands of battery-suppressed events, making reliable recovery of ap-
pliance profiles virtually impossible under current NILM. Further,
we showed that such privacy can be achieved in the tested environ-
ments using only a moderately priced 50 amp-hour battery system–
far smaller than the aggregate loads of protected residences.
2. BACKGROUND
2.1 Load Profiles
Conventional electromechanical watt-hour meters do not record
instantaneous demand, only net energy consumed over time. Thus,
they act as memoryless accumulators whose readouts are physically
spinning dials. Energy use is measured by computing dial position
changes since the last reading (typically by a human meter reader
once a month). In contrast, smart meters generate load profiles,
time series of electric demand, that are delivered to the provider
at or near real time. The level of detail in load profiles is useful
for load forecasting and fraud detection [23]. Common low cost
meters measure epochs at 15 minutes, but more sophisticated mod-
els can generate profiles at a second or lower granularity. Table 1
summarizes the capabilities of several market-leading meters with
different capabilities.
2
The three-day load profile for a large 5-bedroom home is shown
in Figure 2. A diurnal pattern is observable: peaks are felt in the
morning, mid-day, and evening. The drop-out box shows an event
occurring about 7pm on the 18th. A plasma television connected
to a home theater system was turned on and then off about 5 sec-
onds later using a master switch. The initial large spike represents
the power-hungry television, followed by the theater receiver and
speaker system powering on. The OFF event shows a symmet-
ric decrease in power draw. NILM algorithms match these sister
features (ON/OFF features of equal amplitude) against known ap-
pliance profiles to uncover in-residence behavior.
2.2 Non-Intrusive Load Monitoring
NILM algorithms extract appliance profiles from load profiles.
It is considered “non-intrusive” because it does this at the elec-
tric meter without instrumenting individual appliances. An appli-
2
Note that TED identified in the table is not a smart meter, but a
in-home device used to monitor energy usage (see Section 4.1).
Basic Definitions
t A time variable (t
0
is used for an initial time when needed.)
d(t) The net demand from all appliances in the house over time
u(t) The load measured by the smart meter (This includes battery charging)
c(t) The battery’s state of charge over time
b(t) The battery’s rate of charging over time
b(t) > 0 The battery is charging
b(t) < 0 The battery is discharging
H The upper safe limit on the battery’s state of charge
L The lower safe limit on the battery’s state of charge
K
SS
The target constant load value for u(t)
Relations
u(t) = d(t) + b(t) (utility observable profile)
c(t) =
R
t
t
0
b(t) dt + c(t
0
) = K
SS
[t − t
0
] −
R
t
t
0
d(t) dt + c(t
0
) (state of charge)
NILL Constraints
u(t) = K
SS
for some constant K
SS
(leveled load)
L < c(t) < H (safe state of charge)
Figure 3: Summary of the house and battery model used for NILL.
0
2
4
6
8
10
12
14
16
18
9/16 00:00 9/16 12:00 9/17 00:00 9/17 12:00 9/18 00:00 9/18 12:00 9/19 00:00 9/19 12:00
Power (volts)
time (seconds)
Power (kW)
Power (kW)
Figure 2: Three-day load profile for large home taken in
September 2010. The drop-out box shows a higher resolution
view of a television power ON and OFF.
ance profile consists of the types of appliances and the times dur-
ing which each is operational during the day. Load profiling tech-
niques classify devices by the changes in steady state load caused
by their being turned ON and OFF [18]. The approach is to de-
compose the load profile into a composite of individual appliances
features, i.e., representative pairs of ON/OFF events. For exam-
ple, periodic spikes in energy use are visible in homes with electric
furnaces during cold weather. NILM algorithms can extract the ex-
pected furnace load from the load profile to expose other, possibly
smaller, appliance loads. These techniques use appliance models
and information learned about a residence over time to reconstruct
behavior from a single aggregate signature. Such techniques have
been shown to be highly accurate in practice [25, 21, 33, 22]. We
discuss other classes of NILM that are not relevant to residential
smart meters in Section 5.3.
2.3 Energy Storage
NILL requires one of a particular class of deep-cycle batteries.
Deep cycle batteries are designed to be able to operate adequately
during long cycles of charging and discharging without signifi-
cantly reducing their lifetime. Such batteries are frequently used
in recreational vehicles such as RVs and boats. There are several
types of deep cycle batteries that support highly variable load pro-
files (at short timescales) present in home energy consumption. The
Absorbed Glass Mat (AGM) battery (which has a lead-acid chem-
istry) has several properties that make it ideal for home use; they
work well at extreme temperatures, have low internal resistance,
can be charged at high voltages, and are designed to prevent leak-
age. To avoid sulfation (inability to hold charge due to crystalliza-
tion of the lead sulfate), deep cycle batteries should not be allowed
to discharge below 20% of their total capacity, and staying above
50% is optimal. When a battery is to be charged beyond 90%, its
charger should switch to a lower constant voltage than what was
used for previous charging [13].
For our evaluation of NILL, we model a 50 Ah
3
lead-acid battery
operating at a nominal voltage of 120V. This is achievable by con-
necting typical 50 Ah sealed DC batteries, which typically retail for
approximately $100 [2], in series. One of the most common volt-
ages for these types of batteries is 12V, requiring 10 such batteries
(approx. $1,000) to achieve the necessary characteristics. We use a
60 ampere (A) maximum discharge current system as available in
modern home solar setups [1].
3. Non-Intrusive Load Leveling
The goal of a NILL system is to level the load profile to a con-
stant target load, thus removing appliance features. To achieve this,
NILL relies on a battery to offset the power consumed by appli-
ances. When an appliance turns ON, it will exert a load beyond the
target load. Thus, NILL will discharge the battery to partially sup-
ply the load created by the appliance, maintaining the target load.
4
Similarly, if an appliance enters the OFF state, the load profile will
decrease below the target load. These opportunities are used to
charge the battery while restoring the target load. The NILL sys-
tem presented here consists of two parts: a battery and a control
system that regulates the battery’s charge and discharge based on
the present load and battery state. The controller attempts to main-
tain a steady state target load K
SS
, but will go into one of two
special states K
L
or K
H
if the battery needs to recover from a low
or high state of charge. This section describes the NILL runtime
control system and the calculation of the initial system parameters.
3.1 Run Time Control
In a perfect NILL implementation, there would be no runtime
control as the battery would have sufficient capacity for maintain-
ing the target load. For any reasonably sized battery, there will be
times when the state of charge is insufficient to maintain the target
load under a heavy load. We call this a low recovery state because
the battery’s SOC has become too low to maintain the target load.
3
Ah stands for amp-hours, which is a measure of the battery charge
capacity.
4
The battery is only used to supply appliances in the house. It is
never discharged back into the grid as is done in net metering.
Similarly, in times of light load, the battery will draw from the util-
ity to maintain the constant load. If however, the load remains light,
eventually the battery will reach its maximum SOC. We call this a
high recovery state.
We use the model shown in Figure 3 in describing the control
system and bootstrapping phase in the next section. The model
captures both the actual load profile of the house d(t), as well as
the load under the influence of NILL as perceived by the electric
meter u(t). The essence of NILL is described by the equation,
u(t) = d(t) + b(t), where b is the battery’s rate of charge over
time. If b(t) > 0, the battery is charging, otherwise b(t) < 0
and the battery is discharging. Finally, c(t) is used to represent the
battery’s state of charge (SOC).
5
The NILL controller must main-
tain the target load and respond to low and high recovery states.
The controller sits next to the battery at the service-panel or elec-
tric meter. A sensor placed on the same line as the meter is used
to monitor d, and one on the battery to monitor c. Using these two
parameters, the controller selects b to maintain a constant u within
the battery’s operational constraints.
K
SS
K
L
K
H
c(t) > H
d(t) < K
SS
d(t) - K
H
> 5 A
c(t) > 80%
c(t) < L
d(t) > K
SS
Update
K
SS
Update
K
SS
Figure 4: The transitions between the steady state target load
and the high and low recovery loads. In state K
i
, the battery
output is calculated using K
i
− d.
If the controller enters one of two recovery states, the target load
will be altered to allow the battery to reach a safe state while still
attempting to mask features present in the load profile. We denote
the target load during steady state operation as K
SS
, and the targets
for the low and high recovery states as K
L
and K
H
respectively.
Because entering a recovery state is a sign that the target load was
either too high or too low to maintain, it is adjusted each time the
controller transitions to a recovery state. Figure 4 illustrates the
conditions under which the controller changes states and adjusts
K
SS
. While in state K
i
, the battery is controlled using b = K
i
−d.
In a low recovery state, a new target load K
L
is chosen to al-
low the battery to recharge while still hiding the majority of load
events. Thus, K
L
is set equal to the battery’s maximum sustained
charge amperage, masking all load events with amperages less than
or equal to this maximum. To reduce the frequency of recovery
states over time, the controller will adapt K
SS
each time a low
or high recovery state occurs. This is done using the exponential
weighted moving average of the instantaneous demand since the
last recovery state at t
r
: K
SS
← α
D
t−t
r
+ (1− α)K
SS
.
6
Once the
battery reaches 80% SOC, the system returns to steady state. The
effects of low recovery states in our experimental results are shown
in Section 4.4.
In a high recovery state, the battery is at its maximum SOC, and
the load is below K
SS
. Once in this state, the only choices are
5
Some literature uses Depth of Discharge (DOD), the complemen-
tary quantity to SOC.
6
Note that this is not an EWMA over continuous time samples, but
over discrete steady state periods.
idling the battery, which allows all events to appear in the load
profile, or discharging the battery. Because NILL’s goal is to cancel
appliance level features, we choose the latter. The only question
left is the choice of K
H
. For this, the controller uses the most
recent load samples to guess at a K
H
that will be just below the
current load (by approximately 1 to 5 amperes). If this guess is not
successful after the first few seconds, a more conservative guess is
made. With K
H
< d, the battery can discharge minimally while
producing a flat area in the load profile. If the load increases by 5 or
more amps, the system returns to steady state. An example of a low
recovery state in our experimental results is shown in section 4.3.
3.2 Determining Initial Target Loads
A NILL system requires an initial value for K
SS
to bootstrap
normal operation. A good target load is one that can be sustained
with little variation over time. Target load selection is also useful
for battery sizing, i.e., if there is no feasible target load for a given
battery capacity, a larger battery should be used. For the remainder
of this section, we refer to the initial K
SS
as simply K to distin-
guish from the steady state target load during run time operation.
Two constraints must be satisfied for the target load K to be consid-
ered feasible. First, the utility observable profile should be leveled
to K at all times. Second, the battery charge and discharge required
to achieve u(t) = K must not cause the battery to exceed its safe
capacity limits L and H. Under these constraints, the equation for
battery SOC can be rewritten in terms of d and K as shown in the
RHS of the state of charge relation. This rewriting is used in the
algorithm for finding a minimal target load.
Algorithm 1 F indM inT argetLoad
1: Given demand d(t), start time t
0
, end time t and initial charge
c(t
0
)
2: D ←
R
t
t
0
d(t) dt
3: d
max
← max
[t
0
,t]
d(t)
4: Binary search K ∈ [0, d
max
]
5: Check that L ≤ K[t − t
0
] − D + Hc(t
0
) ≤ H over [t
0
, t]
6: Output minimal satisfactory K
We use Algorithm 1 to find the minimal target load for a given
battery capacity. The minimal feasible K is chosen to put the least
stress on the battery when coming on line. The input d(t) is a
sample of a load profile from the residence hosting the NILL in-
stallation. The output is the initial target K. In practice, we select
c(t
0
) = 50% SOC, L = 20% SOC, and H = 90% SOC to model
the safe bounds on battery charge.
4. EVALUATION
4.1 Source Data Collection
The data used in the experiments was collected from devices
installed in four homes in the Northeast United States. A TED
5000 [37] measuring transmitting unit (MTU) device was installed
in each monitored location and collected real power (kW) and volt-
age data. TEDs passively measure power and voltage crossing the
main circuit between the meter and the circuit panel. Energy read-
ings are transmitted to a TED gateway over the house electrical cir-
cuits via power line communications. The gateway is connected via
a wired network to a personal computer, which can access readings
via HTTP. The TEDs were polled at half-hour intervals to collect
per-second load profiles.
Required by
SimPowerSystems
util
i
+
é
u(t) (A)
powergui
Continuous
pow_to
ohms_util
MATLAB
Function
load_profile
MATLAB
Function
d(t) (A)
control
MATLAB
Function
c(t) (%)
b(t) (A)
Utility
Util
VR
Control
Link
ïT
ï
Util
CS
Control
Link
ïTï
To Bool
o
ole
a
Programmable
Load
I
Pos
Neg
Net Demand
i
+
é
Memory
Load Profile Sync
12:34
Control Trace
Charge / Discharge Control
DC/AC conversion
Batt Pos
Batt Neg
Util
P
os
Util
N
eg
Charge
Control
LinK
ïTï
Battery
+
_
m
Batt
VR
Control
Link
ïT
ï
Batt
CS
Control
Link
ïT
ï
metrology
MATLAB
Function
<SOC (%)>
<Current (A)>
❶
❷
❸
❹
❺
❻
❼
❽
❾
Util
Discharge
Signal
Batt
Charge
Signal
Util
Charge
Signal
l
l
l
Batt
Discharge
Signal
Utility
Power
Source
Figure 6: The NILL Simulator. Signals from the control algorithm (1) regulate the switching circuitry (2) that connects the battery
(3) and load. The load profile data is inserted at (4) and exerted by a variable resistor (5). The sum of load and battery (u(t)) is
measured by the meter (6), and rate and state of charge are measured at (7) and (8) respectively. A trace of the control signals (9)
was used for debugging purposes.
Table 2: Experimental data sources - energy usage traces col-
lected from residences in spring of 2010
Residence H1 H2 A1 T1
Start 3/1 9am 4/17 12am 3/15 12am 4/18 11:15am
End 5/1 9am 5/16 12am 4/14 12am 5/17 11am
Length 61 days 30 days 30 days 29 days
Bedrooms 5 2 3 2
Residents 4 3 3 2
Init. K
SS
4.64 kW 4.08 kW 3.85 kW 8.20 kW
The experiments in the following section use load profiles col-
lected in the spring of 2010 in the four residences, as described in
Table 2. We refer to the data sets as H1, H2, A2, and T1 throughout
(homes 1 and 2, apartment 1 and townhouse 1, respectively). The
data collection process introduced a small number of sample out-
ages in which no data was collected. This was due to brief power
cycles of the TED or lost communication between the TED col-
lector and usage sensor. We repair these gaps by placing repeated
samples of the constant average of the surrounding 100 seconds.
The H1 data contained two such gaps (1 hour, 3 minutes), H2 con-
tained one gap (19 minutes), A1 contained no outages, and T1 had
2 gaps (11 minutes, 13 minutes). Given their relatively small size,
these gaps have little influence on our experimental results.
Figure 5 illustrates energy use over different time scales for one
residence, H1. The month profile highlights the relatively constant
rate of use over time. Note that during the week of March 3rd, the
usage drops off substantially. The occupants left for a spring break
during this period, turned down the thermostat, and unplugged ap-
pliances throughout the house. The daily energy use exhibits sim-
ilar diurnal patters as described in Section 2.1. The periodic usage
spikes observed in the day-scale data was the result of the home’s
furnace turning ON and OFF blower motors to force heat in the
0
5
10
15
20
25
30
35
40
04/03/10 09/03/10 14/03/10 19/03/10 24/03/10 29/03/10
Kw
Month profile
kW
0
2
4
6
8
10
12
14
16
18
00:00 04:00 08:00 12:00 16:00 20:00 00:00
kW
Day Profile
2
2.5
3
3.5
4
4.5
5
5.5
6
6.5
7
18:00:00 18:10:00 18:20:00 18:30:00 18:40:00 18:50:00 19:00:00
kW
Hour profile
Figure 5: Residence monthly, daily, and hourly profiles.
gas-heated house. Finally, the hourly readings show the enormous
sensitivity of these devices to internal use; while spikes caused by
starting dryers and heat pump blowers are very clear, small changes
caused by appliances such as lamps are also visible.
4.2 Full System Simulation
The NILL system simulation answers the question of how effec-
tively the battery and controller can remove appliance features from
a metered load profile. To achieve a realistic battery model, we im-
plemented the simulation in Simulink with the SimPowerSystems
extension [26]. This was necessary, as using an oversimplified bat-
tery model, e.g. one with linear discharge characteristics, would
lead to an inaccurate assessment of NILL’s capabilities.
![Table 1: Commodity smart meters [29]. Epoch Product(s) Deployed](/figures/table-1-commodity-smart-meters-29-epoch-product-s-deployed-25x7vxpv.webp)
