Catching suspicious activity on an energy grid requires a nuanced and evolving understanding of how the grid typically functions.