Toward Secure Smart Grid Systems: Risks, Threats, Challenges, and Future Directions

Abstract

The evolution of electrical power systems into smart grids has brought about significant advancements in electricity generation, transmission, and utilization. These cutting-edge grids have shown potential as an effective way to maximize energy efficiency, manage resources effectively, and enhance overall reliability and sustainability. However, with the integration of complex technologies and interconnected systems inherent to smart grids comes a new set of safety and security challenges that must be addressed. First, this paper provides an in-depth review of the key considerations surrounding safety and security in smart grid environments, identifying potential risks, vulnerabilities, and challenges associated with deploying smart grid infrastructure within the context of the Internet of Things (IoT). In response, we explore both cryptographic and non-cryptographic countermeasures, emphasizing the need for adaptive, lightweight, and proactive security mechanisms. As a key contribution, we introduce a layered classification framework that maps smart grid attacks to affected components and defense types, providing a clearer structure for analyzing the impact of threats and responses. In addition, we identify current gaps in the literature, particularly in real-time anomaly detection, interoperability, and post-quantum cryptographic protocols, thus offering forward-looking recommendations to guide future research. Finally, we present the Multi-Layer Threat-Defense Alignment Framework, a unique addition that provides a methodical and strategic approach to cybersecurity planning by aligning smart grid threats and defenses across architectural layers.

1. Introduction

Smart grids are sophisticated, interconnected electrical power systems that incorporate cutting-edge modern technologies, such as sensors, smart meters, cyber–physical systems (CPSs), IoT devices, and control systems via communication networks to improve the availability, operability, sustainability, reliability, and efficiency of electrical transmission and distribution. One of their key benefits is improving energy management and grid resilience by implementing eco-friendly systems that produce the needed electricity with low carbon emissions. Smart grids have many benefits. However, there are always new safety and security concerns and challenges, mainly due to the smart grid’s complex connectivity. This makes smart grids vulnerable to a wide range of cyber–physical attacks, including malware infections, unauthorized access, security breaches, Distributed Denial-of-Service (DDoS) attacks, and False Data Injection (FDI) attacks. These attacks can result in power outages, disruptions, or interruptions of vital infrastructure services, or even physical harm. As a result, robust security measures are essential to protect the infrastructure of any smart grid, including access controls, encryption, intrusion detection, risk assessments, vulnerability testing, and incident response plans, to effectively identify and mitigate these potential threats. Safety is another issue surrounding the smart grid critical infrastructure and requires mitigating risks associated with physical hazards, electrical accidents, aging equipment, and operational failures. Maintaining safety requires regular safety checks, constant updates, compliance, and thorough risk assessments. Therefore, prioritizing smart grid safety and security can ensure the reliability, resilience, and trustworthiness of renewable energy sources, facilitating the adoption of sustainable and efficient future electrical power systems. This is particularly true, given that the smart grid system represents a major technological advancement that addresses the challenges of updating the electrical grid and meeting the demands of an expanding population. The Multi-Layer Threat-Defense Alignment Framework (MLTDAF), presented in this article as a unique contribution, maps threats and corresponding defenses to each architectural layer of the smart grid, thereby bridging the gap between current attack categories and actual implementation. This framework offers a scalable and dynamic model to inform the design of security architectures and threat mitigation strategies.

Traditional power grids have evolved into intelligent, data-driven infrastructures that enhance sustainability, efficiency, and reliability due to the increasing adoption of smart grid systems. To gather and share vast amounts of data in almost real time, these systems primarily rely on sophisticated sensors, communication, and computational capabilities, particularly in smart metering applications. However, this increased data availability raises additional privacy concerns, specifically around consumer behavior profiling, location monitoring, and unauthorized access to personal energy usage habits. These flaws leave the system vulnerable to wider cybersecurity risks in addition to data breaches. This paper emphasizes strategic, evidence-based analysis of high-risk attack vectors to support more focused security architectures. As a result, the purpose of this study is to investigate the state of cybersecurity in smart grids through an analysis of the latest developments in secure communication protocols, cryptography techniques, and anomaly detection systems. To provide a deep understanding of the existing solutions, their challenges, and the potential for future research in creating a safe and privacy-aware smart grid environment, special attention is paid to AI/ML-based approaches, embedded technologies, and cryptographic techniques.

1.1. Problem Formulation

Despite the presence of various cryptography- and non-cryptography-based algorithms, as well as protocols and solutions, the components of a smart grid remain vulnerable to security threats and vulnerabilities. Therefore, it is essential to continually monitor these systems and devices to enhance safety and security by developing new security standards, strategies, and technologies, particularly those based on machine learning, and introducing tamper-resistant equipment to ensure protection against physical attacks. Moreover, as renewable energy sources are being integrated into the smart grid domain, protecting and securing them will not only protect the grid but also the environment through combating climate change [1].

1.2. Motivation and Contributions

Considering the crucial role smart grid systems play in controlling essential infrastructure, any compromise in their security or system failure can have severe consequences for public safety and security. Besides causing physical damage, such incidents can also lead to significant harm and loss of life for individuals. Therefore, it is crucial to address these risks by identifying and understanding various threats, vulnerabilities, and attacks that would jeopardize the smart grid’s stability and security. Recognizing the need for enhanced security measures, this work focuses on developing a comprehensive list detailing these threats, aiming to safeguard data integrity and privacy within the smart grid domain. This requires protecting sensitive information from unauthorized access or exploitation, which is crucial in preventing identity theft and data leaks. In particular, this work contributes to the security and safety of smart grids by achieving the following security objectives, which must be integrated into smart grid systems and devices to accomplish the required protection and prevention against cyber–physical risks and attacks:

• Maintaining Security Goals: Essential to maintain availability by not interrupting power supplies and disrupting the supply chain integrity. This can be achieved by maintaining secure communication networks and channels, as well as ensuring confidentiality by protecting users’ data and implementing privacy-preserving measures.
• Advanced Security Analysis: By presenting the most prominent security threats, vulnerabilities, attacks, and challenges, as well as the impact and risk of the occurrence of these attacks, especially against the smart grid’s critical infrastructure.
• Automated Security Measures: By presenting several types of reactive and preventive security measures and countermeasures and analyzing them to show how large and hybrid smart grid systems and devices are protected.
• Dynamic Study: By studying and analyzing both cryptography and non-cryptography solutions that maintain the security and resiliency properties of smart grid systems.

This work selectively emphasizes the most impactful and under-addressed threats in the literature, thereby prioritizing actionable insights for researchers and system designers.

1.3. Related Work

This subsection provides a concise summary of each study’s key findings and contributions, offering a broad overview of the current state of smart grid cybersecurity research. Our work contributes to the evolving field of smart grid cybersecurity, building upon the foundational insights provided by recent surveys and reviews. While Ding et al. [2] categorize cyber threats and propose future research directions, Sahani et al. [3] explore machine-learning-based intrusion detection. In contrast to Mohassel et al. [4], who focus on the integration of advanced metering infrastructure (AMI), our study also focuses on novel security protocols for real-time data protection. Addressing gaps identified by Lazaro et al. [5] regarding communication vulnerabilities, we propose adaptive encryption techniques to enhance system resilience. Moreover, unlike Jokar et al. [6], who emphasize data privacy challenges, our research integrates robust encryption algorithms to safeguard sensitive information. Building on Tufail et al.’s [7] mitigation strategies, our approach leverages machine learning for anomaly detection, enhancing proactive defense mechanisms. Finally, similar to Nafees et al. [8], we emphasize cyber–physical situational awareness, innovating in response strategies to combat sophisticated operational technology attacks. In summary, our study presents an updated and advanced version of smart grid cybersecurity, integrating cutting-edge technologies and methodologies to address emerging threats and vulnerabilities. It distinguishes itself by offering a targeted synthesis of the most pressing threats in contrast to broader surveys, which often dilute technical specificity.

1.4. Organization

The remainder of the paper is structured as follows. Section 2 presents the background, which covers the application of the smart grid in IoT, the advantages of smart grid technology, and the various types of smart grid communication. Section 3 highlights and analyzes the limitations and challenges of the smart grid. Section 4 lists and discusses the smart grid’s threats and vulnerabilities. In Section 5, the most prominent smart grid security attacks are presented and analyzed, identifying their types and sources. In Section 6, the smart grid’s risks are identified, assessed, evaluated, and mitigated. In Section 7, the existing security solutions are presented and analyzed, including cryptographic and non-cryptographic solutions, as well as forensics, ethical hacking, Generative Adversarial Networks (GANs), and Large Language Model (LLM)-based security and privacy solutions. Section 8 presents the proposed framework. Section 9 gives the recommendations and the lessons learned. Section 10 offers insights into the future research directions. Finally, Section 11 concludes this work.

2. Background and Preliminaries

The IoT integrates smart grids as modern electrical networks rely on digital communication technologies and devices to collect and analyze data in real time. This integration, depicted in Figure 1, enables energy suppliers to facilitate the grid integration of renewable sources, allowing for real-time control and monitoring of energy consumption and usage [9]. It enhances their energy management through informed decision-making, improving the grid’s resiliency and reliability while reducing consumer costs [10]. In this section, the application of the smart grid in IoT is presented, along with the advantages of smart grid technology and the most commonly used communication types.

2.1. Smart Grid Application in IoT

The integration of smart grids with the IoT is achieved by deploying sophisticated sensors, smart meters, and linked devices that provide bi-directional communication and complete, real-time monitoring throughout the electrical grid. IoT devices gather detailed information about grid health, voltage levels, and energy usage. This information is sent to centralized SCADA systems for analysis and decision-making via protocols such as Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP). Demand response optimization, accurate load balancing, and the smooth integration of distributed energy resources (DERs) like wind turbines and solar panels are all made possible by this integration. Furthermore, IoT-enabled smart grids utilize machine learning algorithms for anomaly detection and predictive maintenance, enhancing grid resilience and dependability by anticipating and addressing potential errors or inefficiencies [11]. One important IoT application is the smart grid, which can be used in several IoT domains. Figure 2 shows examples where a smart grid is integrated into the IoT domain to improve its energy efficiency and maintain its sustainability and availability while reducing carbon emissions and energy costs.

The integration of IoT into the smart grid transforms traditional power systems into intelligent, efficient, and resilient networks as described in

Table 1. Integration of IoT into smart grid and its impact on efficiency, reliability, cost savings, consumer engagement, and sustainability.

Aspect	Integration of IoT	Impact
Smart Meters	Real-time measurement of electricity usage	Detailed consumption data, better energy management, and billing accuracy
Sensors and Actuators	Monitoring voltage, current, and temperature	Real-time grid monitoring and control, enhanced reliability, and prevention of failures
AMI	Two-way communication between utilities and consumers	Facilitates demand response, dynamic pricing, and improved data management
Grid Automation	Controlling switches, transformers, and other equipment	Improved fault detection, isolation, restoration, minimized downtime, and enhanced grid resilience
DERs Management	Integration and management of solar panels, wind turbines, and batteries	Better coordination and optimization of renewable energy sources and reduced reliance on fossil fuels
Predictive Maintenance	Collecting data on grid component conditions	Reduced maintenance costs, prevention of unexpected failures, and ensured continuous power supply
Efficiency	Real-time monitoring and control	More efficient energy distribution and consumption, optimized grid operations, and reduced energy losses
Reliability and Resilience	Quick detection and response to faults	Improved grid reliability and reduced outage duration and impact
Renewable Integration	Management of renewable energy variability	Seamless integration of renewable sources and stable grid operations
Cost Savings	Optimization of energy use and predictive maintenance	Reduced operational costs for utilities and lower energy bills for consumers
Consumer Engagement	Access to detailed usage data and participation in demand response	Informed consumer decisions and contribution to grid stability
Sustainability	Support for green energy sources and promotion of energy efficiency	Reduced greenhouse gas emissions and a more sustainable energy future

. It empowers utilities and consumers with real-time information and control, facilitates the integration of renewable energies, and enhances the overall performance and sustainability of the energy ecosystem while reducing carbon emissions and energy costs. The application in IoT presents several advantages, which are outlined below.

2.2. Advantages of Smart Grid Technology

Incorporating smart grid technology in the IoT domain brings a variety of advantages that boost the Industrial IoT domain, especially with the quick shift from Industry 4.0 to Industry 5.0 [12,13,14,15]. Some of these advantages are listed in

Table 2. Advantages achieved by employing smart grids.

Enhancement	Description
Effective Energy Management (EEM)	Achieves more effective energy supply and demand, smart grid energy storage systems, and more efficient grid management by gathering and evaluating vast amounts of data on energy use and grid performance. Utilizes DERs, Demand Response (DR) technologies, such as Smart Meters (SM), and Energy Management Systems (EMSs) to optimize energy usage and minimize waste. Expected to be replaced by Intelligent Energy Management (IEM) using machine learning and data analytics.
Enhanced Asset Management	Efficiently manages and monitors grid assets to lower maintenance and repair costs while enabling users to track their energy use in real time and make intelligent decisions about energy consumption. Controls energy demand response to minimize grid burden and reduce operational costs.
Enhanced Reliability	Utilizes modern monitoring and control systems to accurately detect and respond to disruptions, effectively identifying and isolating faults with minimal delays.
More Energy Efficiency	Enhances energy distribution management through real-time monitoring and analysis of energy consumption, enabling demand response programs and integration of renewable energy sources.
Efficient Renewable Energy Integration	Monitors and manages energy resource distribution to avoid waste and adopt an eco-friendly approach, enhancing renewable energy forecasting and improving energy supply and demand management.
Improved Grid Planning	Utilizes advanced sensors and data analysis tools to optimize grid planning and maintenance, enhancing resiliency, flexibility, and efficiency at a reduced cost.
Enhanced Safety and Security	Strengthens resilience against cyber and physical attacks, enabling rapid power restoration and improved grid resilience through self-healing and fault detection capabilities.
Enhanced EV Integration	Integrates EVs and provides charging infrastructure and smart charging management.
Modernized Technologies	Upgrades smart grid infrastructure with new capacitors, programmable logical controllers, transformers, transmission lines, substations, and equipment, improving planning, implementation, and design.
Real-Time Detection and Isolation	Monitors grid conditions, faults, and outages in real time, quickly isolating them to enable fast power restoration. Relies on IoT devices and sensors for data collection.
Improved Network Performance	Monitors network traffic in real time to detect and mitigate cyber–physical threats, optimizing network operations and performance securely.
Improved Energy Distribution	Relies on micro-grids and virtual power plants to provide a reliable energy supply independently of the primary grid, utilizing DERs to act as a single, coordinated energy source.

. These advantages are categorized into different classes, each representing a distinct aspect of smart grid improvement. The descriptions outline the key features and benefits associated with each class, including aspects such as energy management, asset management, reliability, efficiency, renewable energy integration, grid planning, safety and security, electric vehicle (EV) integration, modernized technologies, real-time detection and isolation, network performance, and energy distribution. This classification helps organize and understand the various ways smart grid technology can be enhanced to improve energy management, grid reliability, and overall performance. Next, the well-known types of smart grid-related communication are presented.

2.3. Smart Grid Communications

Smart grids use different communication types to ensure efficient and reliable data exchange [16] and fulfill security requirements [17]. In addition, smart grids utilize various technologies to connect home appliances with smart meters, enabling the identification of power consumption and the transmission of details to the server for calculations and billing [18]. Also, smart grids use two-way communications to maintain connectivity between their different components, including digital technologies, advanced sensing meters, and critical infrastructure [19] to offer improved, secure, and safe optimization and operationality of all of its components, including generation, transmission, distribution, and stakeholders [20,21].

Table 3. A set of possible communication types and technologies in smart grids.

Communication	Type/Technology	Description
Types	Home Area Network (HAN)	Uses wired (Ethernet) or wireless (Bluetooth, Zigbee, 802.11) technologies to link household appliances to smart meters to detect energy usage and transmit the data to the server [22].
	Neighborhood Area Network (NAN)	Links Intelligent Electronic Devices (IEDs), smart meters, and other distribution automation devices to WAN gateways, collectors, and field devices to gather user data and facilitate WAN-premise communication area [22].
	Wide Area Network (WAN)	Employs fiber optics, 3G, LTE, WiMAX, or GSM to facilitate communication via HAN [23] between a smart meter, suppliers, and the utility server.
	LoRaWAN	A low-power, long-range wireless platform that supports energy management, smart grid infrastructure efficiency, and disaster prevention [24].
Technologies	Power Line Communication (PLC)	Uses existing power distribution infrastructure to transmit data signals over the power lines.
	Wireless Communication	Used for data transmission in smart grids without physical connections.
	Fiber Optic Communication	FO cables provide high-speed data transmission for long-distance communication in smart grids, with high bandwidth, resilience to electromagnetic interference, and low latency.
	Radio Frequency Communication (RFC)	Uses radio waves for data transmissions using short-range communication between devices within a localized area.
	Broadband over Power Line (BPL)	Offers high-speed data communication over existing power lines, improving communication between systems and smart grid devices.
	Mesh Networking	Allows efficient and reliable communication within a localized area, forming a self-configuring and resilient network.
	Satellite Communication (SatComs)	Provides connectivity for data transmission, allowing smart grid devices in remote areas to communicate with the central grid management system.
	Ethernet Communication	Used in Local Area Networks (LANs) to provide high-speed and reliable data transmission over wired connections.
	Narrowband Communication	Uses narrow frequency bands for data transmission using low-power, low-data-rate applications.

presents a set of possible communication types and technologies that can be employed in smart grids. In the next section, the main limitations of smart grids are presented and discussed, including both security-related and non-security-related challenges.

2.4. Mapping IoT Technologies

The Smart Grid Architecture Model (SGAM) [25] organizes a smart grid into five domains: DER, Generation, Transmission, Distribution, and Customer Premises (see Table 4), as well as several interoperability layers, including the Component, Communication, Information, Function, and Business layers [26]. The Customer Premises and DER domains, where smart meters, home energy management systems, and local controllers are frequently installed, are where IoT technologies are primarily incorporated in this context. Lightweight communication technologies, such as MQTT, CoAP, and Zigbee, are typically supported by these domains. The Transmission and Distribution domains [27], on the other hand, still largely rely on conventional SCADA systems and industrial communication standards, such as IEC 61850 [28], Modbus [29] and DNP3 [30], where flexibility is often subordinated to real-time performance and deterministic communication. This domain-specific perspective helps to steer the right technology selection and prevent overgeneralization by enabling a more accurate mapping of IoT applications in smart grids [31].

Smart Grid Interoperability Layers

SGAM establishes a tiered structure to facilitate the smooth integration and interoperability of various smart grid components and services (see Table 5). The component, communication, information, function, and business layers are the five main layers of this architecture. Together, these layers facilitate the integration of IoT technologies at both the strategic and operational levels of the smart grid, each playing a distinct role in providing safe, scalable, and standards-compliant grid operations.

The component layer comprises the hardware assets and physical equipment that make up the smart grid, including substations, sensors, smart meters, control units, and DER components [32]. It provides real-time data capture and control by establishing the physical infrastructure on which IoT devices function. Since physical tampering or malfunction might cause the entire system to malfunction, it is imperative to provide security and resilience at this layer. The communication layer specifies the communication technologies, networking protocols, and media (both wired and wireless) used to transfer data throughout the grid [26]. Protocols such as IEC 61850, DNP3, Modbus, Zigbee, and LTE are widely used, depending on the domain and application. This layer is crucial to IoT technologies as it enables low-latency, secure, and dependable data flow between systems and devices. The information layer manages the syntactic rules, semantics, and data models that organize and interpret the data that is transferred [33]. It guarantees that information from various devices and fields is consistent, comprehensible, and useful for processing. This layer is essential to enabling analytics and machine-to-machine interoperability in an IoT-enabled smart grid. The function layer reflects the application logic and services, such as demand-response functions, forecasting, control algorithms, and grid monitoring, that use data to make operational decisions [34]. It connects unprocessed data with useful procedures, frequently with the help of AI/ML models for optimization. IoT integration provides automation and distributed intelligence at the grid’s edge. Finally, the business layer addresses the strategic, financial, and regulatory aspects of smart grid operations, including energy trading, billing, stakeholder relations, and compliance [35]. It analyzes information and performs tasks related to generating value and providing services. This layer is enhanced by IoT, which facilitates new business models such as dynamic pricing, real-time service adaptation, and prosumer energy exchange.

2.5. Smart-Grid-Based Cybersecurity Standards

The integration of demand response systems, DERs, and two-way communication infrastructures has a growing impact on the cybersecurity posture of contemporary power systems (see Table 6). International regulatory organizations have established and upheld a number of technical standards to guarantee safe and dependable functioning. This subsection examines the most common cybersecurity frameworks and standards that regulate the security of smart grids, emphasizing how they are used in controllable and dispersed settings.

Table 4. Smart grid domains and IoT integration.

Domain	Role	IoT Use Level	Protocol Examples	Use Cases	Key Characteristics	Advantages	Limitations	Drawbacks	Mitigation
DERs	Decentralized generation and storage; enhances resilience and flexibility	High	MQTT, CoAP, 6LoWPAN	Real-time DER monitoring and control; grid balancing	Decentralized, bidirectional, edge-driven	Enhances grid resilience and energy independence	Complex coordination and data management	High integration cost; intermittency issues	Use of edge AI and robust data standards
Distributed Power Generation	Centralized electricity production for large-scale supply	Moderate	Modbus, DNP3	Predictive maintenance, integration of renewables	Centralized, high-output, time-sensitive	Increases efficiency and integrates renewables	Legacy systems hinder modernization	Inflexibility; high maintenance needs	Gradual digital retrofitting, hybrid systems
Distributed Power Transmission	High-voltage electricity transmission across regions	Low	IEC 61850, SNMP	Grid health monitoring, fault localization	High-voltage, wide-area, latency-sensitive	Improves reliability and real-time decision-making	Low IoT penetration and high security risk	Cyberattack vulnerability; signal delays	Implement secure protocols and redundant links
Power Distribution	Medium/low-voltage electricity delivery to end-users	Moderate-High	DLMS/ COSEM, IEEE 802.15.4  [36]	Outage management; automated reconfiguration	Dynamic, distributed, consumer-near	Reduces outage durations and supports automation	Scalability and communication reliability issues	Infrastructure upgrade cost; fragmented standards	Mesh networking; standardized frameworks
Customer Premises	End-user interaction, consumption monitoring, and demand response	Very High	ZigBee, Wi-Fi, LoRaWA	Smart metering; energy efficiency feedback	User-centric, high data granularity	Empowers consumers and reduces peak load	Privacy concerns and data overload	User resistance, variable connectivity	Data anonymization and user-centric designs

Table 4. Smart grid domains and IoT integration.

Domain	Role	IoT Use Level	Protocol Examples	Use Cases	Key Characteristics	Advantages	Limitations	Drawbacks	Mitigation
DERs	Decentralized generation and storage; enhances resilience and flexibility	High	MQTT, CoAP, 6LoWPAN	Real-time DER monitoring and control; grid balancing	Decentralized, bidirectional, edge-driven	Enhances grid resilience and energy independence	Complex coordination and data management	High integration cost; intermittency issues	Use of edge AI and robust data standards
Distributed Power Generation	Centralized electricity production for large-scale supply	Moderate	Modbus, DNP3	Predictive maintenance, integration of renewables	Centralized, high-output, time-sensitive	Increases efficiency and integrates renewables	Legacy systems hinder modernization	Inflexibility; high maintenance needs	Gradual digital retrofitting, hybrid systems
Distributed Power Transmission	High-voltage electricity transmission across regions	Low	IEC 61850, SNMP	Grid health monitoring, fault localization	High-voltage, wide-area, latency-sensitive	Improves reliability and real-time decision-making	Low IoT penetration and high security risk	Cyberattack vulnerability; signal delays	Implement secure protocols and redundant links
Power Distribution	Medium/low-voltage electricity delivery to end-users	Moderate-High	DLMS/ COSEM, IEEE 802.15.4  [36]	Outage management; automated reconfiguration	Dynamic, distributed, consumer-near	Reduces outage durations and supports automation	Scalability and communication reliability issues	Infrastructure upgrade cost; fragmented standards	Mesh networking; standardized frameworks
Customer Premises	End-user interaction, consumption monitoring, and demand response	Very High	ZigBee, Wi-Fi, LoRaWA	Smart metering; energy efficiency feedback	User-centric, high data granularity	Empowers consumers and reduces peak load	Privacy concerns and data overload	User resistance, variable connectivity	Data anonymization and user-centric designs

Table 5. Smart grid interoperability layers.

Layer	Description	Role	IoT Use Level	Domain(s)	Examples	Use Cases	Key Characteristics	Advantages	Limitations	Drawbacks	Mitigation
Component	Represents the physical devices (sensors, actuators, smart meters, etc.) involved in the smart grid	Enables monitoring and control through data acquisition	High	All smart grid domains	Smart meters, sensors, actuators	Load monitoring, outage detection	Physical, hardware-centric, low latency	Enables real-time data collection and action	Device tampering, hardware faults	Requires secure deployment and maintenance	Use tamper-resistant designs, regular inspections
Communication	Focuses on the data exchange mechanisms and communication technologies used between components	Ensures reliable, real-time communication across grid infrastructure	High	All smart grid domains	Zigbee, Wi-Fi, 5G, LoRaWAN	Demand response, meter reading	Real-time, scalable, heterogeneous	Facilitates low-latency, high-throughput communication	Susceptibility to cyberattacks, protocol mismatch	Requires strong encryption/ authentication schemes	Adopt end-to-end encryption, protocol harmonization
Information	Deals with the semantics and formats of the data being exchanged between systems	Guarantees consistency and interoperability of exchanged data	Moderate	All smart grid domains	CIM (Common Information Model), XML, JSON	Data sharing between grid entities	Semantic consistency, interoperability	Supports efficient data integration and sharing	Semantic gaps, data format inconsistencies	High complexity in standard adoption	Standardize data formats, middleware solutions
Function	Includes control logic, services, and functionalities that enable smart grid operations	Provides decision-making and automation in grid operations	Moderate	DER, Distribution	SCADA logic, distributed control systems	Voltage regulation, predictive maintenance	Rule-based, autonomous, service-oriented	Improves grid automation and responsiveness	Complexity in logic design and coordination	Difficult to update in distributed environments	Employ AI-based monitoring and self-healing systems
Business	Encompasses market and policy aspects, business models, and regulatory requirements	Aligns business goals and strategies with technical operations	Low	Business Layer	Regulatory policies, pricing algorithms	Dynamic pricing, energy trading	Policy-driven, decision-supportive	Aligns technical and business goals	Slow adaptation to tech changes	Dependent on external policy evolution	Integrate flexible, modular policy management

Table 5. Smart grid interoperability layers.

Layer	Description	Role	IoT Use Level	Domain(s)	Examples	Use Cases	Key Characteristics	Advantages	Limitations	Drawbacks	Mitigation
Component	Represents the physical devices (sensors, actuators, smart meters, etc.) involved in the smart grid	Enables monitoring and control through data acquisition	High	All smart grid domains	Smart meters, sensors, actuators	Load monitoring, outage detection	Physical, hardware-centric, low latency	Enables real-time data collection and action	Device tampering, hardware faults	Requires secure deployment and maintenance	Use tamper-resistant designs, regular inspections
Communication	Focuses on the data exchange mechanisms and communication technologies used between components	Ensures reliable, real-time communication across grid infrastructure	High	All smart grid domains	Zigbee, Wi-Fi, 5G, LoRaWAN	Demand response, meter reading	Real-time, scalable, heterogeneous	Facilitates low-latency, high-throughput communication	Susceptibility to cyberattacks, protocol mismatch	Requires strong encryption/ authentication schemes	Adopt end-to-end encryption, protocol harmonization
Information	Deals with the semantics and formats of the data being exchanged between systems	Guarantees consistency and interoperability of exchanged data	Moderate	All smart grid domains	CIM (Common Information Model), XML, JSON	Data sharing between grid entities	Semantic consistency, interoperability	Supports efficient data integration and sharing	Semantic gaps, data format inconsistencies	High complexity in standard adoption	Standardize data formats, middleware solutions
Function	Includes control logic, services, and functionalities that enable smart grid operations	Provides decision-making and automation in grid operations	Moderate	DER, Distribution	SCADA logic, distributed control systems	Voltage regulation, predictive maintenance	Rule-based, autonomous, service-oriented	Improves grid automation and responsiveness	Complexity in logic design and coordination	Difficult to update in distributed environments	Employ AI-based monitoring and self-healing systems
Business	Encompasses market and policy aspects, business models, and regulatory requirements	Aligns business goals and strategies with technical operations	Low	Business Layer	Regulatory policies, pricing algorithms	Dynamic pricing, energy trading	Policy-driven, decision-supportive	Aligns technical and business goals	Slow adaptation to tech changes	Dependent on external policy evolution	Integrate flexible, modular policy management

Table 6. Cybersecurity standards for smart grids.

Standard	Purpose and Focus	Integration in Smart Grids	Security Domains	Advantages	Limitations	Key Challenges	Suggested Improvements
NERC CIP [37]	Cybersecurity enforcement for Bulk Electric Systems (BESs), central systems	Applied to centralized control systems, limited DER coverage	Policies, access control, system configuration, perimeter security	Regulatory mandate; detailed protection directives	Limited edge-device or DER support	Adapting to dynamic and distributed architectures	Expand scope to include DERs and demand-response systems
IEEE 2030 [38]	Layered cybersecurity architecture, modular deployment, and interoperability	Supports microgrids, DERs, EVs, and energy storage systems	Cyber–physical coordination, multi-layer defense	Promotes standardization and modular security design	Complex for SMEs or small-scale deployments	Deployment complexity in fragmented environments	Simplify architecture models and promote open API frameworks
NIST SP 800-82 [39]	Security guidelines for ICS, supports AI integration and resilience planning	Covers ICS/SCADA within smart grid infrastructure	Asset identification, risk modeling, defense-in-depth, anomaly detection	Adaptable to AI/ML integration, flexible implementation	Requires interpretation, not always plug-and-play	Operationalizing guidelines in legacy ICS settings	Develop plug-and-play security templates for ICS environments
ISO/IEC 27001 [40]	ISMS framework bridging IT and OT security	Used for power generation, automation systems, and distributed field operations	Data classification, access control, information flow, incident handling	Globally recognized framework, cross-domain applicability	Generic and high-level, not tailored to energy sector	High implementation overhead and training requirements	Customise ISMS models for smart grid-specific scenarios
IEC 62351 [41]	Secure communication protocols for power systems, particularly SCADA	Secures communication in SCADA and substations	Authentication, encryption, key management, RBAC, secure logging	Established protocols for SCADA and energy communication	Limited TLS/IPsec support, slow to update	Legacy system support and backward compatibility	Update encryption schemes, enable secure retrofitting options

Table 6. Cybersecurity standards for smart grids.

Standard	Purpose and Focus	Integration in Smart Grids	Security Domains	Advantages	Limitations	Key Challenges	Suggested Improvements
NERC CIP [37]	Cybersecurity enforcement for Bulk Electric Systems (BESs), central systems	Applied to centralized control systems, limited DER coverage	Policies, access control, system configuration, perimeter security	Regulatory mandate; detailed protection directives	Limited edge-device or DER support	Adapting to dynamic and distributed architectures	Expand scope to include DERs and demand-response systems
IEEE 2030 [38]	Layered cybersecurity architecture, modular deployment, and interoperability	Supports microgrids, DERs, EVs, and energy storage systems	Cyber–physical coordination, multi-layer defense	Promotes standardization and modular security design	Complex for SMEs or small-scale deployments	Deployment complexity in fragmented environments	Simplify architecture models and promote open API frameworks
NIST SP 800-82 [39]	Security guidelines for ICS, supports AI integration and resilience planning	Covers ICS/SCADA within smart grid infrastructure	Asset identification, risk modeling, defense-in-depth, anomaly detection	Adaptable to AI/ML integration, flexible implementation	Requires interpretation, not always plug-and-play	Operationalizing guidelines in legacy ICS settings	Develop plug-and-play security templates for ICS environments
ISO/IEC 27001 [40]	ISMS framework bridging IT and OT security	Used for power generation, automation systems, and distributed field operations	Data classification, access control, information flow, incident handling	Globally recognized framework, cross-domain applicability	Generic and high-level, not tailored to energy sector	High implementation overhead and training requirements	Customise ISMS models for smart grid-specific scenarios
IEC 62351 [41]	Secure communication protocols for power systems, particularly SCADA	Secures communication in SCADA and substations	Authentication, encryption, key management, RBAC, secure logging	Established protocols for SCADA and energy communication	Limited TLS/IPsec support, slow to update	Legacy system support and backward compatibility	Update encryption schemes, enable secure retrofitting options

2.5.1. NERC CIP

The North American Electric Reliability Corporation’s Critical Infrastructure Protection (NERC CIP) is very robust for centralized systems. However, it is less suitable for dynamic, distributed edge environments such as DERs or residential demand-response platforms [42]. Nonetheless, its standards enforce cybersecurity practices for Bulk Electric Systems (BESs) while including key directives such as CIP-003 [43] for cybersecurity policies, CIP-005 [44], for electronic security perimeters, CIP-007 [45] for system security management, and CIP-010 [46] for configuration and vulnerability management [47].

2.5.2. IEEE 2030

IEEE 2030 is a standard that focuses on the implementation of layered cybersecurity architecture and modular deployment to ensure alignment with IEEE 1547 [48], IEC 61850, and IEC 62351, thus promoting interoperability and cybersecurity in smart grid systems such as microgrids, distributed generation, and energy storage, as well as EV infrastructure. However, its adoption remains a challenge that persists in small-scale systems due to deployment complexities [49].

2.5.3. NIST Special Publication 800-82

The NIST Special Publication 800-82 (NIST SP 800-82) offers security guidelines and standards for Industrial Control Systems (ICSs), including smart grid infrastructure [50]. These guidelines and standards are essential in integrating AI-enhanced security tools and aligning system monitoring with critical infrastructure resilience goals. Its framework supports asset identification and categorization, risk-based system modeling, defense-in-depth methodologies, and real-time anomaly detection [51].

2.5.4. ISO/IEC 27001

ISO/IEC 27001 [52] establishes a general framework for an Information Security Management System (ISMS) as its standard helps bridge the security concerns of Information Technology (IT) and Operational Technology (OT), which is critical for controlling hybrid smart grid environments. It can also be applied in various parts of the energy sector, including power generation systems, control and automation technologies, and distributed field operations [53].

2.5.5. IEC 62351

The IEC 62351 series addresses security measures for power system communication protocols, specifically those that surround the standards of IEC 60870-5 [54], IEC 61850, and DNP3. This offers confidentiality, integrity, and authentication across SCADA communications yet lacks support for modern security protocols such as TLS or IPsec. Its specifications cover message authentication and encryption, secure key management, Role-Based Access Control (RBAC), and secure logging and auditing [55].

2.6. Beyond IoT Technologies

Aside from IoT, numerous major technologies enhance smart grid security by increasing flexibility, enabling real-time processing, and providing adaptive defense mechanisms. Their functions, characteristics, and contributions to the security of smart grid environments are presented below (see

Table 7. Beyond IoT technologies for smart grids.

Type	Description	Characteristics	Link to Smart Grid	Use Cases	Advantages	Limitations	Challenges	Mitigation
Edge Computing	Local data processing at or near smart grid endpoints	Low latency, decentralized, real-time response	Enhances local anomaly detection, reduces reliance on central systems	Fault isolation at substations, real-time load balancing	Reduced latency, bandwidth savings, improved resilience	Limited processing power, distributed complexity	Data synchronization, firmware attacks	Secure boot, local authentication, OTA updates
Fog Computing	Intermediate data processing between edge and cloud	Distributed, regional aggregation, near-real-time	Supports collaborative detection and coordinated regional responses	Regional anomaly aggregation, predictive load analytics	Balances speed and computation, scalable architecture	Latency higher than edge, still dependent on network health	Resource allocation, trust management	Encrypted channels, role-based access controls
SDN	Programmable network control separated from hardware	Centralized control, dynamic configuration, flexible routing	Quick re-routing in case of attacks, centralized monitoring	DDoS containment, segmented network zones	Fine-grained control, better visibility	Single point of failure risk	Controller security, interoperation with legacy systems	Redundant controllers, secure APIs
NFV	Virtualization of network services like firewalls or IDS	Hardware decoupled, scalable, cloud-native	On-demand deployment of security services	Dynamic firewall placement, remote IDS deployment	Cost-effective, flexible security functions	Performance can vary under load	Resource contention, function chaining complexity	Quality of Service (QoS) policies, function isolation
Digital Twin	Real-time virtual model of physical grid components	Real-time mirroring, predictive simulation	Allows testing of attack scenarios and impact analysis	Predictive maintenance, training simulations	Insightful monitoring, fault prediction	Requires continuous data flow, high setup complexity	Model accuracy, synchronization	Regular validation, AI-assisted modeling

).

2.6.1. Edge Computing

Edge computing enhances smart grid security by enabling local, real-time data analysis and response at substations and energy devices, thereby minimizing reliance on centralized systems that are susceptible to latency or attack [56]. The decentralization of detection and response capabilities enhances system resilience [33]. Edge computing enables IoT sensors and meters to optimize fault isolation, energy routing, and intrusion detection close to the source by allowing these devices to not only gather data but also respond instantly [57].

2.6.2. Fog Computing

Fog computing serves as a link between cloud systems and edge devices, creating a safe intermediate layer through which data can be gathered, filtered, and analyzed geographically [58]. In terms of smart grid security, it enables synchronized anomaly detection and threat response across distributed zones. Fog computing enhances IoT performance by mitigating central system overload, enabling load prediction, behavior modeling, and threat pattern detection on a larger scale when connected to IoT nodes [59].

2.6.3. Software-Defined Networking

Software-Defined Networking (SDN) improves the security of smart grids by providing centralized, programmable control over network flows [60]. This enables dynamic rerouting in the event of network congestion or security breaches. To guarantee that vital energy processes continue, it separates hacked parts and optimizes traffic. SDN provides fine-grained control over device communication pathways when used with IoT networks, thus lowering attack surfaces and enhancing grid scalability and efficiency in general [61].

2.6.4. Network Function Virtualization

NFV stands for Network Function Virtualization and offers an adaptable and economical way to implement essential network security features, such as firewalls or intrusion detection systems, on-demand across smart grid infrastructures without requiring additional physical installations [62]. NFV enables security services, when used in conjunction with IoT, to track distributed or mobile IoT nodes, providing scalable services such as remote diagnostics or secure energy trading, as well as adaptive protection [63].

2.6.5. Digital Twins

Digital twins enhance smart grid security by providing a continuously updated virtual replica of physical infrastructure, enabling predictive analysis, vulnerability simulation, and proactive maintenance [64]. This technology enables utilities to simulate security breaches and fine-tune their actions without putting actual assets at risk. Digital twins provide a synchronized view of grid conditions when provided with real-time data from IoT devices. This enhances operational planning and anomaly detection accuracy and facilitates quick decision-making [65].

3. Limitations and Challenges

Despite smart grid systems offering numerous potential benefits, including increased efficiency, reliability, and sustainability in electricity transmission and distribution, they remain vulnerable to several security-related and non-security-related limitations and challenges, as illustrated in Figure 3. In what follows, we discuss these limitations and challenges.

3.1. Smart Grid Limitations

In addition to the limitations discussed in [66,67],

Table 8. Limitations of smart grid technologies.

Limitation	Description
Financial Issues	May prove to be a constant limitation, especially since the cost of implementing a smart grid system and maintaining its infrastructure can be high, and without the proper funding and sponsorship, some facilities, utilities, plans, and projects may be delayed or canceled due to lack of investments.
Maintenance Issues	Smart grid systems require constant maintenance and scheduled inspection to maintain the effectiveness of their operations. However, this proves to be a problem, especially in modernizing them due to aging equipment that causes constant equipment failure.
Communication Bottleneck	Given how much smart grid technologies depend on communication networks to constantly transmit data and control electricity flow in a real-time manner, this already creates a burden that may affect the network performance and cause a communication bottleneck. Also, any disruptions will indeed cause a significant problem and result in the disruption and interruption of smart grid services.
Integration Issues	Due to the varied, complicated structure of smart grid systems and IoT devices, which rely on different requirements to deploy and integrate them, this is a challenging limitation.
Manpower	With the rise of machinery and reduced human labor, stakeholders may hesitate to adopt smart grid technologies due to concerns about job losses and salaries.
Energy Storage	May prove to be a problem due to the cost and technical limitations surrounding the energy storage capacities to manage intermittent renewable energy sources.
Cultural Barriers	May cause some communities not to adopt smart grid technologies due to safety, security, and privacy concerns, especially without reassurance and education.
Complexity of System and Data Management	Managing and maintaining a smart grid system with numerous interconnected components can be complex and resource-intensive. In addition, the smart grid generates vast amounts of data that require efficient storage, processing, and analysis, posing challenges in data management and analytics.
Reliability of Communication Networks	The performance of the smart grid heavily relies on the reliability of communication networks, which can be susceptible to failures and disruptions.
Security Concerns	Smart grids are susceptible to cyberattacks, data breaches, and other security threats, necessitating robust security measures to protect the grid infrastructure.

describes other security-related and non-security-related limitations.

3.1.1. Security-Related Limitations

Smart grid security constraints highlight situations where systems are susceptible to ransomware, malware, and DoS attacks, which can compromise sensitive data and disrupt operations. The intricacy and interconnection of grid components create multiple entry points for potential attackers, and weak authentication procedures and inadequate encryption in communication protocols can result in illegal access and data breaches [17]. In particular, note the following:

• Cyberattacks can compromise operational integrity by disrupting critical infrastructure, manipulating data flows, and potentially causing widespread service outages, highlighting the vulnerability of interconnected digital systems to malicious exploitation [68].
• Weak authentication allows unauthorized access to critical control systems and sensitive data, posing significant risks of malicious manipulation, unauthorized control over grid operations, and potential disruption of essential services. As a result, robust authentication protocols are critical in securing infrastructure [69].
• Weak cryptography exposes sensitive data and communications to unauthorized interception, manipulation, and exploitation by malicious actors, compromising the confidentiality, integrity, and availability of critical information and operational processes within the grid infrastructure. This requires strong encryption standards to mitigate these risks effectively [70].
• Data disruptions compromise real-time monitoring, decision-making, and system reliability. Breaches in data integrity can lead to incorrect operational decisions and system failures, while compromised privacy can expose consumer information, undermining trust and regulatory compliance. As a result, robust data protection measures and secure data handling practices are essential in smart grid operations [71].
• Insider threats include the misuse of credentials to manipulate data, disrupt operations, or steal sensitive information, posing significant risks to grid security and reliability. Effective monitoring, access controls, and employee training are essential to mitigate these insider threats and maintain the smart grid’s data integrity [72].
• Physical breaches lead to disruptions in power supply, equipment damage, and potential safety hazards for personnel and the public, emphasizing the importance of robust perimeter security, surveillance systems, access controls, and resilience planning in safeguarding critical infrastructure against physical threats [8].

3.1.2. Non-Security-Related Limitations

The high initial deployment costs and the difficulty of integrating new technologies into the current infrastructure, which might cause compatibility concerns, are two non-security-related constraints of smart grids [73]. Furthermore, complex data management and analytics skills are required to handle the massive volume of data generated by smart grids, which presents significant processing and storage challenges. Other solutions can be included too [67].

• Financial issues may prove to be a constant limitation, especially since the cost of implementing a smart grid system and maintaining its infrastructure can be high. Without proper funding and sponsorship, some facilities, utilities, plans, and projects may be delayed or canceled due to a lack of investment.
• Maintenance issues are another limitation since smart grid systems require regular maintenance and scheduled inspections to maintain their operational effectiveness. However, this proves to be a problem, especially in modernizing them due to aging equipment that causes constant equipment failure.
• A communication bottleneck may occur as smart grid systems heavily rely on communication networks to constantly transmit data and control electricity flow in real time. This already creates a burden that may affect network performance and cause a communication bottleneck. Also, any disruptions will surely cause a significant problem and result in the disruption and interruption of smart grid services.
• Integration issues due to the complex structure and heterogeneous nature of smart grid systems and IoT devices, which require different deployment and integration approaches, prove to be a significant limitation.
• Affected Manpower is another potential problem: with the rise of machinery and the reduction in human labor, stakeholders may be reluctant to adopt smart grid technologies due to concerns about job losses and salaries.
• Energy storage may prove to be a problem due to the cost and technical limitations that surround the energy storage capacities to manage intermittent renewable energy sources, especially in terms of safety, security, and performance. For example, Photovoltaic (PV) systems and EVs, while providing significant benefits in terms of sustainability and distributed energy production, are strongly reliant on efficient energy storage systems and seamless integration with grid infrastructure. The bi-directional energy flow resulting from PV energy injection and EV charging/discharging cycles can overburden local distribution networks. This results in voltage instability and produces asynchronous energy supply–demand dynamics if appropriate integration solutions are not employed. Furthermore, if legacy infrastructure is ill equipped to provide the necessary security services, these technologies create new attack surfaces and communication vulnerabilities when combined with IoT for real-time monitoring and control. Therefore, PV and EV technologies present important operational and cybersecurity concerns that need to be taken into consideration during system planning, design, and deployment, even though they are not in and of themselves restrictions.
• Cultural barriers may push some communities away from adopting smart grid technologies due to safety, security, and privacy concerns, especially without reassurance and education.

After presenting these limitations, the challenges are presented next.

3.2. Smart Grid Challenges

Smart grid challenges are based on security and safety obstacles and complexities surrounding the deployment and development of the smart grid infrastructure, as well as the development and deployment of its systems. These challenges are often the result of integrating advanced technologies, maintaining infrastructure, and implementing upgrades. Table 9 presents a set of existing challenges that can be divided into three categories: security-based challenges, safety-based challenges, and additional challenges, with their respective challenges listed under each category. The first two categories are described below.

• Security-based challenges: These cover risks and vulnerabilities associated with securing the smart grid infrastructure by using cyber–physical security means to protect and preserve data privacy [74] and prevent unauthorized access [75]. Other security measures include ongoing network, system, and device behavior monitoring, risk assessment using cryptography and non-cryptography solutions, and robust security controls [69,76].
• Safety-based challenges: These depend on demanding tasks to guarantee the secure management, upkeep, and operation of the smart grid system, which prove to be very challenging, especially with the deployment of advanced grid technologies and systems [77]. Other safety challenges include the following. The integration of DER introduces bidirectional power flows, which can challenge conventional protection systems that were designed for unidirectional current [78]. This may lead to unintended power circulation, difficulties in fault detection, and potential islanding during outages. To mitigate this, adaptive protection mechanisms, directional relays, and standards like IEEE 1547 [79] are essential to ensure safe DER–grid interaction. The likelihood of configuration mistakes, operator overload, and cascading failures during anomalous events also increases with the increased system complexity [80]. This requires sophisticated automation technologies, streamlined system designs, and intensive training for operational staff. Failures in communication networks are the result of communication between control centers, substations, and field devices being uninterrupted in real time for smart grid activities to function [81]. Whether intentional or unintentional, a breakdown in these communication channels could compromise grid stability, lead to inaccurate actuation, or delay decisions. Mitigation strategies include network redundancy, real-time monitoring, and fallback methods that allow autonomous local control during interruptions. Security breaches often occur when attackers modify control orders, sensor data, or protection logic in smart grids, leading to cybersecurity vulnerabilities that directly translate into safety hazards [17]. Such violations could result in equipment damage or power outages by disabling fail-safes or establishing hazardous operating conditions. Protecting safety functions requires enhancing security through the use of intrusion detection systems, encryption, authentication, and security-by-design procedures. Interoperability issues with protection systems occur when devices from various suppliers are frequently integrated into smart grid environments, even though they may not have the same operational logic or communication protocols [82]. Due to a lack of interoperability, protection responses may be delayed or fail to activate during hazardous situations. To guarantee dependable, coordinated protection across systems, standardized communication protocols such as IEC 61850 must be adopted, and extensive integration testing must be performed.

Addressing these challenges requires close collaboration and coordination among smart grid stakeholders to guarantee the safety, security, and reliability of the electrical system [83]. This also includes implementing appropriate risk management and mitigation strategies using proactive approaches, including safety protocols, regular maintenance, scheduled physical infrastructure updates, upgrades, and effective emergency response planning [84]. As a result, key safety challenges arise when considering the human factor, which can be the primary reason for this challenge.

As a result of these limitations and challenges, many threats arise, which are described in the next section.

Table 9. A set of existing challenges in smart grids.

Category	Challenges	Description
Security-based	Advanced Persistent Threats (APT)	Remain the most dangerous challenge, especially with zero-day exploits and attacks. This makes it extremely difficult to detect and mitigate this threat, which can cause a significant interruption of the smart grid’s services.
	Insider Threat	Recruiting operators without proper background screening seems challenging since they can freely operate without monitoring or accountability while conducting malicious information gathering, sabotage, or espionage. However, what seems to be more challenging is finding the right security measures to mitigate this risk.
Security-based	Physical Security Challenges	This requires protecting smart grid devices, systems, transmission lines, and transformers, which is a challenging task, not only in terms of cost but also in terms of deploying proper security measures and intrusion detection alarms.
	Budget Issues	The cost to implement, deploy, and maintain a smart grid security program can be costly, which can cause financial problems for stakeholders with limited smart grid capabilities, which makes them abandon the plan and accept the occurrence of the risk as it will be cheaper.
	Lack of Uniform Security Standards	This is frequently caused by the complexity of the various types of heterogeneous devices and systems in the smart grid, making it difficult to apply the same security practices and deploy uniform security measures.
	Legal Challenges	This is mostly affiliated with cross-border challenges since securing the smart grid’s infrastructure requires coordination and jurisdictions among all the involved countries, which often creates challenging legal and regulatory requirements, especially regarding collaborative security and information sharing.
	Resilience and Recovery Challenges	In case of a cyber–physical attack or natural disaster, the smart grid must have the ability to withstand disruption or interruption of services, with the ability to recover. This proves challenging due to the complex number of security and safety threats and the likelihood of their occurrence.
Safety-based	Public Health Challenges	The installation of certain renewable energy technologies close to residential areas negatively impacts human health and animals [85]. The challenge is based on the level of risk exposure to their emission and radiation and the safe distance needed to evade them. Finding a solution to reduce their emission and radiation remains a key challenge.
	Electromagnetic Radiation	If not well studied and regulated, it proves to be a challenge since smart-grid systems rely on wireless communications, which emit electromagnetic radiation that can potentially cause a health risk to humans and animals alike, especially if the exposure area is high and in the presence of individuals with certain medical conditions.
	Electrical Hazards	This remains challenging since they can target workers/operators and the public. They are linked to fire, electric shock, electrocution, and arc flash, which can release hazardous materials and radiation.
Additional	Privacy Challenges	More particularly, data privacy, which is frequently compromised in smart grid applications, especially when transferred in real time. This often proves to be a safety and security challenge since the disclosure of information can expose operators and public personnel.
	Cyber–Physical Challenges	The cyber part is frequently linked to a cyberattack that interferes with the smart grid’s performance. As for the physical part, it is more prone to physical damage such as vandalism, theft, or terrorism. Securing them proves to be challenging since it requires a combined cyber–physical security effort to evade such malicious events.
	System Interoperability Challenges	The presence of complex networks of interconnected systems and device types to ensure effective and safe communications proves to be challenging as it is a critical task to maintain the smart grid’s safety and reliability. If not well established, this may reduce its efficiency and effectiveness.
Additional	System Integration Challenges	This proves to be a challenge in terms of the safety and security of combining renewable energy sources, such as wind and solar energy, since it is difficult to maintain the smart grid’s stability and reliability, which comes at the cost of public health and safety.
	Infrastructure Maintenance Challenges	A certain budget is needed for the smart grid’s infrastructure updates and upkeep. This is due to the aging infrastructure, maintenance, and upgrades becoming more challenging in terms of budget and cost, as well as maintaining the operational, stable, and reliable safety of the infrastructure.
	Incident Response Challenges	Incident response requires high emergency preparedness to effectively respond to malicious events (i.e., cyber–physical attacks) or natural disasters. This proves challenging since it requires a readiness for a set of planned scenarios that stakeholders are trained to implement to maintain public safety and reduce the likelihood of loss of human lives and injury.
	Data Privacy Challenges	Collecting sensitive customer data, such as energy usage and power consumption, is easy. However, the challenge lurks in protecting the collected data and preserving its privacy, which is difficult due to advanced data breaches and sophisticated cyber attacks.
	Environmental Challenges	Surely, the adoption of renewable energy technologies proves to help reduce gas emissions. However, their construction along their transmission lines and substations comes at the cost of a negative impact on wildlife habitats and ecosystems, and this is where the challenge is.

Table 9. A set of existing challenges in smart grids.

Category	Challenges	Description
Security-based	Advanced Persistent Threats (APT)	Remain the most dangerous challenge, especially with zero-day exploits and attacks. This makes it extremely difficult to detect and mitigate this threat, which can cause a significant interruption of the smart grid’s services.
	Insider Threat	Recruiting operators without proper background screening seems challenging since they can freely operate without monitoring or accountability while conducting malicious information gathering, sabotage, or espionage. However, what seems to be more challenging is finding the right security measures to mitigate this risk.
Security-based	Physical Security Challenges	This requires protecting smart grid devices, systems, transmission lines, and transformers, which is a challenging task, not only in terms of cost but also in terms of deploying proper security measures and intrusion detection alarms.
	Budget Issues	The cost to implement, deploy, and maintain a smart grid security program can be costly, which can cause financial problems for stakeholders with limited smart grid capabilities, which makes them abandon the plan and accept the occurrence of the risk as it will be cheaper.
	Lack of Uniform Security Standards	This is frequently caused by the complexity of the various types of heterogeneous devices and systems in the smart grid, making it difficult to apply the same security practices and deploy uniform security measures.
	Legal Challenges	This is mostly affiliated with cross-border challenges since securing the smart grid’s infrastructure requires coordination and jurisdictions among all the involved countries, which often creates challenging legal and regulatory requirements, especially regarding collaborative security and information sharing.
	Resilience and Recovery Challenges	In case of a cyber–physical attack or natural disaster, the smart grid must have the ability to withstand disruption or interruption of services, with the ability to recover. This proves challenging due to the complex number of security and safety threats and the likelihood of their occurrence.
Safety-based	Public Health Challenges	The installation of certain renewable energy technologies close to residential areas negatively impacts human health and animals [85]. The challenge is based on the level of risk exposure to their emission and radiation and the safe distance needed to evade them. Finding a solution to reduce their emission and radiation remains a key challenge.
	Electromagnetic Radiation	If not well studied and regulated, it proves to be a challenge since smart-grid systems rely on wireless communications, which emit electromagnetic radiation that can potentially cause a health risk to humans and animals alike, especially if the exposure area is high and in the presence of individuals with certain medical conditions.
	Electrical Hazards	This remains challenging since they can target workers/operators and the public. They are linked to fire, electric shock, electrocution, and arc flash, which can release hazardous materials and radiation.
Additional	Privacy Challenges	More particularly, data privacy, which is frequently compromised in smart grid applications, especially when transferred in real time. This often proves to be a safety and security challenge since the disclosure of information can expose operators and public personnel.
	Cyber–Physical Challenges	The cyber part is frequently linked to a cyberattack that interferes with the smart grid’s performance. As for the physical part, it is more prone to physical damage such as vandalism, theft, or terrorism. Securing them proves to be challenging since it requires a combined cyber–physical security effort to evade such malicious events.
	System Interoperability Challenges	The presence of complex networks of interconnected systems and device types to ensure effective and safe communications proves to be challenging as it is a critical task to maintain the smart grid’s safety and reliability. If not well established, this may reduce its efficiency and effectiveness.
Additional	System Integration Challenges	This proves to be a challenge in terms of the safety and security of combining renewable energy sources, such as wind and solar energy, since it is difficult to maintain the smart grid’s stability and reliability, which comes at the cost of public health and safety.
	Infrastructure Maintenance Challenges	A certain budget is needed for the smart grid’s infrastructure updates and upkeep. This is due to the aging infrastructure, maintenance, and upgrades becoming more challenging in terms of budget and cost, as well as maintaining the operational, stable, and reliable safety of the infrastructure.
	Incident Response Challenges	Incident response requires high emergency preparedness to effectively respond to malicious events (i.e., cyber–physical attacks) or natural disasters. This proves challenging since it requires a readiness for a set of planned scenarios that stakeholders are trained to implement to maintain public safety and reduce the likelihood of loss of human lives and injury.
	Data Privacy Challenges	Collecting sensitive customer data, such as energy usage and power consumption, is easy. However, the challenge lurks in protecting the collected data and preserving its privacy, which is difficult due to advanced data breaches and sophisticated cyber attacks.
	Environmental Challenges	Surely, the adoption of renewable energy technologies proves to help reduce gas emissions. However, their construction along their transmission lines and substations comes at the cost of a negative impact on wildlife habitats and ecosystems, and this is where the challenge is.

4. Threats and Vulnerabilities

Threats represent potential dangers that could exploit vulnerabilities in a system or network, whether natural or human-made. Vulnerabilities, on the other hand, are weaknesses within a system that can be exploited by threats to carry out attacks. Attacks are actions or exploits by threat actors to compromise a system, often exploiting vulnerabilities to achieve specific goals. Security measures are implemented to mitigate vulnerabilities and prevent or minimize the impact of attacks. Risk, meanwhile, assesses the likelihood of a threat exploiting a vulnerability and the potential impact of such an event. These concepts are deeply interconnected, and effective cybersecurity strategies involve identifying and prioritizing vulnerabilities, assessing potential threats, implementing appropriate security measures, and monitoring for potential attacks to mitigate risk.

Smart grids are susceptible to various threats and vulnerabilities, including human errors, natural disasters, and cyber–physical incidents, which can compromise security, integrity, safety, performance, and functionality. This, in turn, would leave them exposed to data breaches, unauthorized access, service disruptions, or manipulation of grid operations [86,87]. Additionally, smart grids have several weaknesses stemming from a design flaw, which malicious actors can exploit to cause physical damage, data breaches, service disruptions, or manipulation of grid operations [88]. This led to the introduction of the Internet of Vulnerable Things (IoVT) concept in the smart grid [89]. Indeed, the challenge remains in overcoming the obstacles faced during the development, implementation, or operation of a smart grid system due to its complex nature before ensuring an efficient and reliable electricity delivery, as well as the availability, reliability, and safety of the smart grid infrastructure [90]. These threats are divided between security and safety types and are presented next.

4.1. Smart Grid Threats

Security threats refer to potential malicious actions or scenarios that can exploit vulnerabilities in the smart grid. These threats often originate from cybercriminals, cyberterrorists, hacktivists, insider actors, or state-sponsored attackers and include issues such as malware deployment, unauthorized access, and communication disruption. On the other hand, safety threats are derived from physical risks such as equipment failure, natural disasters, or human error, which may lead to public safety hazards or damage to infrastructure. These threats are summarized in

Table 10. Smart grid threat type and description.

Threat Type	Description
Cyber Threat	Unauthorized digital access, such as malware and DDoS attacks
Insider Threats	Misuse of legitimate access by internal personnel
Physical Threats	Destruction or tampering of physical infrastructure
Privacy Threats	Data exposure through surveillance or data leakage
Infrastructure Hazards	Equipment or environmental risks causing operational failure
Human Errors	Mistakes due to poor training or fatigue.

. Threats in smart grids refer to potential risks and vulnerabilities that can affect the system’s safety, security, and reliability (see

Table 11. Security and safety-based threats within smart grids.

Threat Classification	Type	Description	Enhancements
Security-based	Cyber Threats	Targets the communication networks, data storage, and control systems often used to manage the grid, often resulting in power outages and blackouts	Secure communication, encryption, or privacy-preserving
	Physical Threats	Damages, alters, or destroys the infrastructure of smart grids including sensors, smart meters, communication equipment	Tamper-resistant devices with access control and security guidelines
	Malware Threat	Forms many virus types, including Trojans and worms that infect smart grid devices and lead them to malfunction	Anti-malware and anti-virus
	Insider Threat	Exploits these privileges or non-malicious users accidentally/mistakenly use them	Accountability, access control, and limited privileges
	Privacy Threats	Leads sensitive information about electricity consumption patterns to be possibly leaked or intercepted	Privacy-preserving, anonymity, and encryption
	DoS Threat	Overwhelms the smart grid network with traffic or requests, causing the system to crash	DDoS detection, intrusion detection systems, firewalls, and honeypots
Security-based	Advanced Persistent Threats	Has sophisticated zero-day nature that would disrupt critical systems	Updating systems/operating systems software batches and security measures up to date
	Supply Chain Threats	Compromises its components where a malicious code can be injected into the smart grid network, halting its operational service	Incident response training, incident response planning
	Social Engineering Threats	The objective is to manipulate employees to divulge sensitive information or exploit their access privileges to compromise the smart grid’s security	Non-disclosure agreements, accountability and training, contracts and agreements, secure communications
Safety-based	Power Outages	Affects the smart grid’s critical infrastructure that relies on electricity as a functioning source	Backup plans/devices and incident response groups
	Infrastructure Hazards	Negatively impacts public safety and health	Adoption of international safety guidelines
	Cyberattacks	Causes a safety threat as the operations of smart grids can be halted and disrupted, resulting in power outages	Cryptography, intrusion detection, anti-malware, firewalls, and honeypots
	Human Mistakes	Impacts the safety of the smart grid, such as fatigue, dissatisfaction, lack of experience, and training	Awareness training, constant user training and education, Standard Operating Procedures
	Machine Error(s)	Occurs due to technical malfunctions, software bugs, glitches, hardware failures, sensor or measurement errors, equipment failures, or communication issues	User-friendly interfaces, safety by design, and regular system maintenance

). They are divided principally between security-based and safety-based threats as described below.

4.1.1. Security-Based Threats

The security threats to smart grid infrastructure are diverse and evolving. It is crucial for smart grid operators to regularly assess their security posture and implement appropriate measures to mitigate these risks [27]. To address these security threats, smart grid operators must implement a comprehensive security plan, including encryption, access control, intrusion detection, and monitoring. Periodic security audits and employee training are essential to keep a smart grid secure. Regular security audits and employee training are critical to maintaining a secure smart grid. Cyberattacks, such as ransomware, malware, and denial-of-service (DoS) attacks, pose a significant security risk to smart grids as they can disrupt operations, cause blackouts, and compromise data privacy and security. The security of sensitive data and the dependability of the grid are further threatened by physical attacks on equipment as well as flaws in communication protocols.

4.1.2. Safety-Based Threats

This type of threat can cause a severe problem, especially regarding user and equipment safety. Several solutions, such as regularly maintaining and upgrading physical infrastructure and developing effective emergency response plans, can be useful to ensure the smart grid’s safety and reliability [75]. Equipment failures and malfunctions pose a significant safety risk to smart grids as they can lead to electrical hazards, fires, or explosions that could harm individuals and property assets. Natural catastrophes like hurricanes, earthquakes, and floods can also harm infrastructure, posing a risk to public safety and causing long-lasting power outages and blackouts. These threats will surely make the smart grid integration into IoT prone to various vulnerabilities. These vulnerabilities will be presented next.

4.2. Smart Grid Vulnerabilities

Similarly, vulnerabilities within smart grids can be related primarily to security or safety in addition to other possible sources, such as equipment or communication failures, and natural disasters, with many others being named and described in [2]. Furthermore, smart grid security and safety vulnerabilities are diverse, on a constant rise, and include flaws, weaknesses, and potential risks that, in the event of their occurrence [91], can expose the reliability, performance, and security of the smart grid infrastructure (see

Table 12. Security and safety-based vulnerabilities within smart grids.

Vulnerability Classification	Type	Description	Enhancements
Security-based	Weak Authentication and Access Controls	Weak or outdated mechanisms for access control and authentication, leaving them prone to various attacks	Access controls, biometric measures, and multi-factor authentication
	Weak Encryption	Poor encryption or no encryption at all, leaving communication channels and networks open, exposing data	Advanced symmetric encryption techniques enforced by machine learning algorithms
	Software Vulnerabilities	Attackers can exploit security gaps and gain unauthorized access, exploit misconfiguration, execute malicious code, and inject malicious data	Constant updates and ethical hacking (pen testing)
	Supply Chain Vulnerabilities	Can disrupt the flow of data and services, which can affect the power outage and result in a blackout	Regulatory compliance, secure communication, cyber–physical security measures, and risk assessment
	Equipment and System Vulnerabilities	Flaws in the technological infrastructure, software, or hardware/device components to compromise the smart grid	Response strategies, regulatory compliance, and security awareness training
Security-based	Physical Security Vulnerabilities	Weaknesses with the physical infrastructure and assets, including non-secure and weakly surveyed substations, leading to them being breached	Fences, gates, surveillance cameras, intrusion detection systems, security facilities, and equipment protection
	DER Vulnerabilities	Lack of communication standardization can result in several exploitable protocols and standards, making them vulnerable to virus attacks	Strong authentication and encryption protocols, regular security checking and risk assessments
	Operators’ Vulnerabilities	Can occur intentionally as a result of an insider threat to cause sabotage or espionage acts or unintentionally	Background checks, regular employee training, monitoring users, and enforcing accountability
	Cloud-based Vulnerabilities	Raises data privacy and security concerns since it includes customer information, energy consumption patterns, grid operation data	Encryption, access controls, and secure communication protocols
Safety-based	Equipment Failure	Equipment breakdown or degradation of operations and services often caused by the malfunction of different smart grid parts	Proactive measures such as redundancy and backup systems, condition-monitoring techniques, regular and scheduled inspections, maintenance, and equipment testing
	Communication Failures	Communication disruption or interruption of smart grid’s communication channels and protocols for data transmission and receiving	Strong encryption and authentication (multi-factor) protocols, redundant communication paths, fault-tolerant systems, and backup or alternative communication channels
	Natural Disasters	Often related to severe weather conditions as a result of severe weather conditions such as extreme temperatures, heatwaves, ice storms, sand/desert storms, and high winds, or catastrophic events	Enhanced monitoring and early-warning systems, advanced equipment design and construction, proactive maintenance and vegetation management

). Such occurrences often cause unauthorized access, data breaches, service interruptions, or compromised grid operations [92]. As a result, aside from cryptography and non-cryptography-based solutions, regular testing, employee training, and adherence to industry best practices can also be an ideal mitigation solution [86]. In the following, these different vulnerabilities are described in detail.

4.2.1. Security Vulnerabilities

Security-related vulnerabilities include unauthorized access, manipulation of data, disruption/denial of services, and other malicious activities such as physical tampering and abuse of privilege, which can expose both security and safety operations of smart grid systems and services [93]. These vulnerabilities can target the smart grid’s layers, including hardware devices, software, firmware, and operating systems, communication networks, data storage, and management processes. They can result in manipulating energy generation or consumption data, disrupting grid operations due to false data injection attacks, denial-of-service, or even physical damage to the infrastructure [27]. Industry best practices for security, such as those outlined by the National Institute of Standards and Technology (NIST) and the North American Electric Reliability Corporation (NERC), can also prove useful. In fact, SCADA systems and communication protocols of smart grids are susceptible to zero-day exploits [94] and Advanced Persistent Threats (APTs) [95], which can compromise smart grid security, leading to unauthorized access, data manipulation, and service interruption. IoT device integration further broadens the attack surface by opening the grid to potential exploitation via unpatched firmware, weak authentication methods, and unsecured data transfer channels.

4.2.2. Safety Vulnerabilities

This type of vulnerability includes hazards, accidents, weaknesses, or potential risks surrounding the smart grid infrastructure that can compromise the safety of individuals, equipment, and/or the environment and cause physical harm, property damage, or adverse effects on public safety [96]. They can be the result of design flaws, equipment malfunctions, or human errors and can lead to electrical shocks, fires, explosions, equipment failure [97], or environmental contamination (i.e., radiation such as Chernobyl 1986 and Fukushima 2011 nuclear disasters) [98,99] or cyberattack such as the case of Stuxnet and BlackEnergy malware [100,101]. To address this issue, safety measures can be added, such as continuous system monitoring, safety performance evaluation, regular equipment inspections and maintenance, proper personnel training, emergency response protocols, and resilient risk assessment protocols to achieve electric grid safety and reliability. In fact, the AMI and power management systems of smart grids are susceptible to potential failures that could result in overloading, equipment burnout, and electrical fires [102]. In addition, using complex software algorithms to ensure grid stability raises the possibility of error or malfunction, which could result in dangers such as voltage instability, blackouts, and physical harm to the public and maintenance staff [103].

4.2.3. Equipment Failure

This failure type includes the breakdown or degradation of operations and services, often caused by the malfunction of different parts of the smart grid, including generation plants, transformers, transmission lines, distribution networks, substations, smart meters, and control systems, causing power outages, voltage fluctuations, grid instability, the interruption of operations, and the disruption of services. This often occurs due to aging infrastructure, inadequate maintenance, manufacturing defects, environmental conditions, or electrical faults. This can be mitigated using proactive measures such as redundancy and backup systems, condition-monitoring techniques, regular and scheduled inspections, maintenance, and equipment testing. Electrical fires, overheating, and cascading outages can occur from equipment failures in transformers, circuit breakers, and power inverters in smart grids [104]. Furthermore, the deterioration of aging infrastructure components raises the possibility of mechanical failures that result in expensive repairs and extended service disruptions [105].

4.2.4. Communication Failures

These failures cover both disruption or interruption of the smart grid’s communication channels and protocols for data transmission and receiving, resulting in network congestion, signal interference, delayed or inaccurate response, and the system’s failure to transmit and receive real-time data effectively [5]. This can be mitigated using strong encryption and authentication (multi-factor) protocols, redundant communication paths, fault-tolerant systems, and backup or alternative communication channels [106]. Ineffective power distribution, loss of real-time telemetry and control, and possible blackouts can result from communication failures in smart grids’ SCADA systems and IEC 61850 protocols [107]. Furthermore, grid stability is jeopardized by interruptions in data transmission between grid components via cellular, Wi-Fi, or Zigbee networks. This results in deficient load balancing, delays in fault isolation and detection, and a higher risk of cascading failures [108].

4.2.5. Natural Disasters

These disasters can be the result of severe weather conditions as a result of severe weather conditions such as extreme temperatures, heatwaves, ice storms, sand/desert storms, and high winds or catastrophic events caused by natural forces such as geological changes from seismic activities, such as earthquakes (Chile 2010 [109] and Turkey–Syria 2023 earthquakes [110]), hurricanes (Katrina 2005 [111] and Maria 2017 [112]), tornadoes (Kissimmee 1998 [113], 2008 Super Tuesday tornado [114], and the tornado outbreak of April 2014 [115]), tsunamis (Samoa tsunami 2009 [116], Indian Ocean 2004 [117], and 2011 Tohoku Tsunami [118]), floods (East Africa 2018 [119], North Korea [120], India [121], South East Asia 2011 [122], and China [123]) and wildfires (Victorian Black Saturday bushfires 2009 [124] and Attica Wildfires 2018 [125]). Such events severely affect the smart grid’s functional and operational activities, significantly impacting the grid infrastructure’s resilience, such as physical damage to power lines and substations, underground cables and equipment, transmission and distribution of electricity, and public safety. This can be mitigated using enhanced monitoring and early-warning systems, advanced equipment design and construction, proactive maintenance and vegetation management, integration of microgrids and renewable energy sources, and efficient coordination and communication between grid operators and first emergency/incident responders. However, with the presence of various smart-grid-related vulnerability types, numerous attacks are likely to occur, with some being more frequent and more damaging to the integration of smart grids in IoT. As a result, they will be presented in the following section.

4.2.6. Legacy Devices

Smart grid infrastructures continue to utilize legacy devices, which often lack the firmware architecture or processing power to handle contemporary security protocols [126]. The system is vulnerable due to this backwards compatibility, particularly when these devices are unpatched or unencrypted, requiring isolation, gateway-level security, or low-power cryptography [127].

4.2.7. Human Element

One of the most frequently used attack vectors in smart grid setups remains the human element. Even the most secure architectures can be compromised by social engineering, incorrect setups, and inadequate credential hygiene [128]. Role-based audits, stringent access control, and ongoing security training are, therefore, crucial countermeasures [129].

5. Smart Grid Attacks

Malicious individuals or groups often conduct smart grid attacks with criminal or terrorist intent to disrupt, interrupt, manipulate, and compromise the smart grid’s operational systems and critical infrastructure [130]. These attacks differ depending on their type, impact, and the components they target in the smart grids, including control systems, smart meters, connected devices, communication networks, channels, and many others [131]. The goal of each attack differs from the others as their motivation is to either disrupt the service, gain unauthorized access, manipulate or inject data, conduct espionage, or sabotage and is mainly driven by personal gain. They can often be carried out using various means, such as cyberattacks, physical intrusions, social/reverse engineering, and phishing techniques. Still, they can also be mitigated by implementing resilient security protocols, such as intrusion detection and prevention systems, access restrictions, honeypots, anti-malware solutions, encryption, multi-factor authentication mechanisms, and regular security assessments and updates [32].

This section categorizes the specific attack methods used to achieve these threats by directly exploiting vulnerabilities in smart grid systems. These attacks can be classified based on their nature, coordination, and complexity as seen in

Table 13. Classification of smart grid attacks.

Category	Attack Type	Description
Visibility	Covert, Overt	Attacks that are either stealthy or openly visible
Activity	Passive, Active	Passive (e.g., eavesdropping) or active (e.g., data injection)
Coordination	Simultaneous, Separate	Coordinated multi-vector or isolated events
Sophistication	Advanced Persistent Threat, Zero-day	Highly advanced attacks exploiting unknown vulnerabilities

. Each attack type is directly linked back to one or more of the threats outlined in Section 4, providing a structured perspective on how smart grid systems can be compromised in practice.

5.1. Types of Attack

Smart grid attacks can be divided into different types, as shown in Figure 4, and can manifest themselves in various forms, targeting different parts and components of the smart grid infrastructure.

Table 14. Extended classification of smart grid attack types.

Category	Attack Type	Description	Characteristics	Threats	Vulnerability	Impact Area	Countermeasures	Origin (Act of)
Visibility	Covert	Hidden, stealthy intrusion aimed at unauthorized data access or manipulation	Stealthy, persistent	Espionage, APT	Weak monitoring, unlogged access	Data privacy, integrity	Anomaly detection, behavioral analytics	Espionage, sabotage
	Overt	Openly launched attacks like DDoS or defacement	Obvious, aggressive	DoS, cybercrime	Public-facing systems	Availability, visibility	Firewalls, rate limiting, DoS filtering	Cybercriminal activity, protest (hacktivism)
Activity	Passive	Eavesdropping without modifying data or systems	Non-disruptive	Surveillance, sniffing	Unencrypted channels	Privacy, confidentiality	Encryption, secure protocols	Espionage
	Active	Direct data alteration or disruption	Intrusive, malicious	Tampering, spoofing	Insecure authentication	Integrity, availability	IDS/IPS, access control	Sabotage, cybercrime
Coordination	Simultaneous	Coordinated multi-vector attacks on multiple targets	High-impact, synchronized	Cyberwarfare, terrorism	System interdependence	Multiple critical services	Segmentation, redundancy, early-warning systems	Terrorism, military operations
	Separate	Isolated and independent attack events	Localized, targeted	Opportunistic attacks	Isolated endpoints	Specific devices/subsystems	Endpoint hardening, device-specific monitoring	Cybercriminal or insider threat
Sophistication	Zero-Day	Exploits unknown vulnerabilities to evade detection	Undetected, rapid	Zero-day malware	Software/firmware flaws	Control systems, data layer	Threat intelligence, patch management	Espionage, military-grade hacking
	APT	Long-term, targeted attacks via multiple vectors	Persistent, stealthy, complex	Espionage, data theft, sabotage	Weak access control, poor segmentation	Strategic infrastructure	Multi-layered defense, threat hunting, incident response	Espionage, state-sponsored military operations

presents a taxonomy of these main smart grid attack types divided into four categories: visibility, activity, coordination, and sophistication/characteristics.

Another possible taxonomy is based on the nature of attack, coordination and complexity, and persistence. In this case, covert/overt/passive/active/zero-day attacks follow the nature attack category. Simultaneous and separate attacks fall under the coordination category, while APT attacks are categorized by complexity and persistence.

5.2. Attack Source

The attack source refers to the origin of the entity responsible for coordinating attacks on the infrastructure of the smart grid. This covers the origin of hostile activity, such as unauthorized access, directed against the smart grid system, data manipulation, and disruption of services [132]. The attack source can be an individual, a group, an organization, a nation state, or a malicious actor, as shown in Figure 5. Therefore, it is essential to identify, mitigate, and prevent cyber–physical attacks on smart grids. Common attack sources are as follows:

Terrorists and Insurgents: Terrorist groups aim to target smart grid critical infrastructure through methods like suicide bombings (HBIED, VBIED, and motorbike VBIED) [133,134,135] and hit-and-run attacks [136] to destroy or damage civilian and military infrastructures [132].

Malicious Agents: Terrorist organizations use cyber asymmetric warfare, cyberattacks, terrorism [137], and industrial espionage to interfere with smart grids, topple governments, and weaken authority [138]. This causes power outages and other economic disruptions that have a big impact on the region [139]. By attacking or undermining infrastructure, they want to take control of smart grids and use the resulting publicity to draw in new members and media attention [140]. Disrupting smart grids can provide a military tactical advantage by allowing operations to occur in silence, causing confusion, and rerouting security troops to restore order.

Criminal Groups: Cybercriminals use compromised infrastructure to conduct fraud-related operations and launch DDoS or ransomware attacks in an attempt to profit from vulnerabilities in smart grid systems [141]. To cause extensive outages and cascade failures, their attacks target substations by jamming electrical power transmissions [142], manipulating energy usage, tampering with smart meters, and stealing confidential data (e.g., customer information, energy consumption trends, and system configurations). These activities frequently assist illegal activities, including drug trafficking, money laundering, and selling private information to malicious parties [143].

Spies: Foreign intelligence agency spies frequently use sabotage or espionage attacks to disrupt services by targeting smart grid systems. For espionage and counterintelligence reasons, this could involve larger cyber operations to create backdoor access, install malware, and make use of zero-day vulnerabilities (e.g., Titan Rain (2003), Operation Olympic Games (2006), Shadow Network, and GhostNet (2009) [144,145]). Attacks may also be used to achieve geopolitical and strategic goals, such as obtaining an advantage over competitors in the energy security and safety domains.

Hacktivists: As a sort of online political protest, hacktivists try to interfere with smart grid services to voice their disapproval or bring attention to particular issues [146]. They employ strategies that include Distributed Denial-of-Service (DDoS) attacks on control systems, energy distribution manipulation, unauthorized access, and the disclosure of private data. They utilize smart grids as a platform to disseminate their ideology or message, garner media attention, and elicit reactions from the general public.

Military Operations: Military operations can be divided into three main types, including combat operations (mostly overt), cyber operations (mostly covert), and psychological operations (mostly clandestine).

• Combat Operations: CombatOps (CoOps) involve military showcasing of offensive cyber capabilities to conduct both defensive and offensive operations against smart grids, aiming to disrupt enemy infrastructure and hinder recovery processes. This illustrates targeted attacks on smart grids by compromising control systems and exploiting communication vulnerabilities to achieve strategic objectives, such as impacting morale, disrupting economies, gaining tactical control of infrastructure, masking military operations, and mobilizing forces. Strategic targets such as vital points like ports, oil refineries, power stations, ports, telecommunications, power stations, and bridges to hinder force mobilization, exemplified in conflicts such as Iraq [147,148], Lebanon [149,150], Gaza [151], and West Bank [152].
• Cyber Operations: CyberOps (CyOps) utilize hacking to attack the smart grid’s cyber–physical infrastructure [153] as a new cyber-warfare concept [154,155], which is similar to cyberattacks on Estonia in 2007, Georgia in 2008 [156], and Ukrainian electricity companies in 2015–2016 using BlackEnergy malware [157,158,159]. Specific incidents include the deployment of the Havex RAT by the Russian APT group “Energetic Bear or Dragonfly” for global cyber espionage targeting energy, defence, and pharmaceutical sectors in the US and Europe [160]. Notable attacks such as Stuxnet (2010), under “Operation Olympic Games”, targeted Iranian nuclear facilities by manipulating Siemens PLCs. NotPetya (2017) [161], followed by the BlackEnergy [162,163], caused widespread damage globally.
• Psychological Operations: PsyOps use cyber deception [164,165] in conjunction with psychological warfare [166], sabotage, and espionage operations to compromise a nation’s security and resilience [167,168]. One prominent instance is the succession of unexplained fires and explosions that occurred in Iran between 2020 and 2021 and targeted vital infrastructure [169], including events at Parchin military installations as well as other power stations and industrial locations all around the nation. Reminiscent of recent Ukrainian counteroffensive operations, especially on the Donetsk front, propaganda videos such as “Plans Love Silence” emphasized Operational Security (OpSec) [170]. These events demonstrate the merging of CoOps and CyOps into PsyOps [171,172].

5.3. Security Attacks

Attacks on smart grid security encompass a range of malicious actions that take advantage of security gaps and target the weak points in the security of smart grid systems. These attacks, outlined below, frequently compromise the confidentiality, integrity, availability, authentication, safety, and privacy of the smart grid infrastructure, as presented in

Table 15. A set of possible smart grid security attacks and countermeasures.

Category	Attack Type	Description	Countermeasures
Integrity	False Data Injection Attacks (FDIA)	Alter the packet content to disrupt services by injecting false data.	Data-driven learning-based algorithm with reconfigurable Euclidean detectors [173]; mathematical model framing the original sinusoidal signal from the evaluator state variable [174]; strategic honeypot game model with reconfigurable Euclidean detectors [175]; machine-learning-based solutions including attention-aware deep reinforcement learning [176], pre-deployment PMU greedy algorithm [177]
	Meter Manipulation and Theft Attacks	Illegal tampering of smart meter hardware/software to retrieve data or steal electricity.	CNN-LSTM model for data classification [178]; robust data-driven detection of electricity theft adversarial evasion attacks [179]
	Time Synchronization Attacks (TSA)	Tampering with time offsets to desynchronize work schedules.	Fast pre-keying-based integrity protection for smart grid communications [180]; novel hardware-assisted authentication scheme [181]
Authentication	Spoofing Attacks	Eavesdropping and falsifying data to impersonate trusted senders.	Use of Routing Protocol for Low Power and Lossy (RPL) Networks [182]; cross-layer detection mechanism with GPS carrier-to-noise ratio (C/No)-based spoofing detection [183]
	Session Key Exposure Attacks	Interception of session key generation to find authentic key values.	Lightweight conditional privacy-preserving authentication and key-agreement protocol [184]; certificate-based access control in smart grid edge computing infrastructure [185]; secure demand response management authentication scheme [186]
	Sybil Attacks	Use of multiple fake identities to gain control in peer-to-peer networks.	Decentralized countermeasure against Sybil attack in RPL-based IoT networks [187]; Sybil attack detection scheme with optimized support vector machines and received signal strength [188]
Availability	(Distributed) Denial of Service (DoS/DDoS) Attacks	Overload of network traffic causing service disruptions.	Privacy-preserving traffic signaling protocol [189]; Functional Mock-up Interface (FMI)-compatible co-simulation platform [190]
	TCP-SYN Flooding Attacks	Flooding the system with SYN requests, leaving communication ports half-open.	Protocol-dependent detection and classification system [191]; machine-learning-enabled TCP-SYN flood detection framework using Openflow port statistics [192]; lightweight and practical mitigation mechanism for Software-Defined Networking (SDN) architecture [193]
	Jamming Attacks	Flooding wireless protocols with noise to disrupt communication.	Mobile jammer localization technique “JamCatcher” [194]; Channel hopping, MIMO-based jamming mitigation techniques, MAC layer strategies like rate adaptation and power control mechanisms, and channel coding techniques like FHSS and DSSS [195]
	Amplification Attacks	Use of UDP protocols and spoofed IPs to overwhelm networks or exhaust resources.	MD5-hash-algorithm-based socket program for encryption and decryption of vital smart grid data [196]; Software-Defined Networking (SDN) environment and lightweight Tsallis-entropy-based protection methods [197]
Privacy	Sniffing Attacks	Intercepting communication lines to retrieve valuable data.	One-Time Password (OTP) and OTP-based authentication approaches [198]
	Eavesdropping Attacks	Passive interception to discover sensitive information.	Privacy-enhanced authentication technique for smart grid infrastructure [199]; low-power Wireless Sensor Network (WSN) attack detection and isolation approach [200]
	Homograph Attacks	Use of visually similar characters to deceive users into accessing malicious domains.	Domain fluxing using Domain Generation Algorithms (DGAs) [201]; cryptocurrency wallet with comprehensive on-chain solution for aliasing accounts and tokens [202]; blockchain-based methodology for threat detection [203]; enhanced cloud storage encryption standard [204]

.

Table 16. Smart grid security attacks and countermeasures.

Attack		Target		Security Goals						Security Measures
Type	Class	Hardware	Software	Confidentiality	Integrity	Availability	Authentication	Authorization	Privacy	Detection	Prevention
False Data Injection	Modification	Yes	Yes	√	√	√	X	X	√	Data-driven learning-based algorithm [173], reconfigurable Euclidean detectors [174], strategic honeypot game model [175]	Attention-aware deep reinforcement learning [176], pre-deployment Phase Measurement Units (PMUs) [177]
Spoofing	Interception	Yes	Yes	√	√	√	X	√	X	Cross-layer detection mechanism [183]	Routing Protocol for Low Power and Lossy (RPL) Networks [182]
Sniffing	Interception	No	Yes	√	√	√	√	X	√	Intrusion Detection	Access Control, One-Time Password (OTP) [198]
Meter Manipulation and Theft	Tampering	Yes	Yes	√	√	√	√	√	√	Robust data-driven detection [179]	CNN-based LSTM model [178] for detection and hardware-based tamper detection [205], secure firmware and boot mechanisms [206], real-time consumption monitoring [207], and audit trails and logging [208] for mitigation
Session Key Exposure	Interception/ Manipulation	No	Yes	√	√	X	√	√	√	Access Control, Intrusion Detection	Lightweight conditional privacy-preserving authentication and the key-agreement protocol [184], certificate-based access control [185], secure demand response management authentication scheme [186]
Time Synchronization	Tampering	Yes	Yes	√	√	√	√	√	√	Intrusion Detection, Time Stamps	Fast prekeying-based integrity protection [180], novel hardware-assisted authentication scheme [181]
DDoS	Overloading	No	Yes	X	X	√	X	X	X	Anomaly Detection, compromise propagation model [209], hybrid deep learning algorithm [210]	Privacy-preserving traffic signaling protocol [189], Functional Mock-up Interface (FMI)-compatible co-simulation platform [190]
TCP-SYN Flooding	Flooding	No	Yes	X	X	√	X	X	X	Protocol-dependent detection and classification system [191], machine learning (ML)-enabled TCP-SYN flood detection framework [192]	Lightweight and practical mitigation mechanism [193]
Jamming	Interruption	Yes	Yes	X	X	√	X	X	X	“JamCatcher” [194]	MIMO-based techniques, rate adaptation and power control mechanisms, FHSS, DSSS [195]
Eavesdropping	Impersonation	Yes	Yes	√	X	X	X	X	√	Low-power Wireless Sensor Network (WSN) attack detection and isolation mechanism [200]	Privacy-enhanced authentication scheme  [199]
Homograph	Deception	No	Yes	√	√	X	√	√	√	Blockchain-based methodology for threat detection [203]	Domain Generation Algorithms (DGAs) [201], enhanced cloud storage encryption standard  [204]
Amplification	Disruption	No	Yes	X	X	√	√	X	X	Software-Defined-Networking-based DDoS Protection System [197]	MIAMI-DIL [211], anomaly detection algorithm [211]
Sybil	Disruption	No	Yes	X	X	√	√	X	X	Sybil attack detection scheme [188]	RPL-based IoT networks [187]

Checkmarks show what key security goals are targeted, and the X shows what key security goals are missed.

summarizes the smart grid security attacks and their countermeasures. Due to the presence of various attack types targeting different smart grid components, numerous risks arise. These risks are presented in the next section.

It is clear that the implementation of efficient safeguards is essential to the resilience of smart grid infrastructure, given the wide range of security and safety hazards outlined above, including insider threats, equipment malfunctions, cyberattacks, and communication vulnerabilities. These flaws compromise not only the confidentiality, availability, and integrity of data but also the dependability and security of vital infrastructure functions. The section that follows examines both cryptographic and non-cryptographic security methods designed to mitigate these risks, protect system components, and ensure the safe and continuous operation of the smart grid in response to these challenges.

6. Smart Grid Risks

Smart grid risks are based on potential threats and vulnerabilities that compromise the privacy, security, reliability, functionality, and availability of smart grid systems, networks, and services [212]. Physical incidents or natural disasters often cause these risks. Therefore, it is essential to understand how to manage these risks (see Figure 6) to ensure a safe, reliable, and operational smart grid infrastructure [213].

6.1. Risk Types

Smart grids are subject to various risks that impact their reliability, security, and functionality. To manage these risks effectively, a risk management strategy must be adopted to establish emergency response plans, ensure proper physical security measures, and promote a culture of security and awareness among personnel. Safety-based and security-based risks are the two categories into which risk types are categorized. Mitigating risks requires implementing cyber-security strategies and measures [7] to reduce the impact and likelihood of the evident risks by adopting the right risk mitigation measures [214,215], where the main ones are presented in

Table 17. Summary of risk types.

Category	Risk Type	Description
Safety-based	Data Exposure	Exposure of collected and analyzed data without proper privacy and security measures, revealing sensitive information about energy consumption patterns, user behaviors, and unauthorized access.
	Information Transmission	Disruption, delay, or denial of data transmission between sensors, smart meters, and control systems, causing potential health and safety hazards.
	Communication Emission Levels	Concerns about electromagnetic radiation emitted by smart grid communication, requiring further testing to comply with safety standards.
	System Downtime	Prolonged downtime causing significant inconvenience, impacting critical infrastructure such as hospitals and emergency services.
	Infrastructure Damage	Physical damage to substations, transformers, control centers, transmission lines, and electric grids due to natural disasters, aging equipment, or terror attacks.
	QoS	Issues like voltage fluctuations, harmonic distortions, or voltage sags causing equipment damage or safety hazards.
	Legal and Regulatory Issues	Differing regulations between countries, with gaps in safety standards, data privacy, and accountability.
	Energy Theft and Fraud	Exploitation of data collection and billing mechanisms for energy theft and fraudulent activities, requiring robust security measures.
	Grid Congestion and Overload	Increased energy load causing operational inefficiencies and potential equipment failures.
Security-based	Smart Grid Technologies	Involvement of supply chains in development, deployment, and maintenance introduces risks like hardware tampering, software exploits, and service disruptions.
	Malware Hacks	Vulnerability to malware attacks (e.g., Stuxnet, BlackEnergy) disrupting smart grid operations as part of espionage or sabotage acts.
	Insiders	Insider threats exploiting privileged access to sensitive information and systems, leading to abuse, exploitation, and data extraction.
	Lack of Security Standards	Introduction of security vulnerabilities in the infrastructure, making risk assessment and mitigation difficult.
	Remote and Unauthorized Access	Cyberattacks gaining unauthorized access through social engineering and phishing, leading to data manipulation and theft.
	Authentication and Authorization Risks	Inadequate enforcement compromising communication networks and devices, allowing unauthorized access to the grid and sensitive information.
	Lack of Security Updates and Patch Management	Failure to apply updates and patches in a timely manner, leading to software exploitation, data breaches, and unauthorized access.

.

6.2. Risk Assessment and Evaluation

Identification, analysis, and evaluation of potential risks and vulnerabilities related to the infrastructure of the smart grid, including CPS [216], are necessary for risk assessment [217]. Determining the possibility of a potential attack and evaluating its impact involves assessing the infrastructure, software, hardware, devices, networks, technologies, procedures, and human factors [218,219]. The smart grid risk assessment includes several key steps, which are presented in

Table 18. Smart grid risk management activities.

Risk Management Activity	Description
Asset Identification	Involves identifying and keeping track of important assets interconnected to the smart grid infrastructure, including power generation facilities, transmission lines, substations, control systems, and communication networks.
Threat Identification	Involves locating and evaluating possible risks and dangers that could affect the smart grid, including cyber–physical attacks, natural disasters, equipment malfunctions, or human errors.
Vulnerability Assessment	Assesses vulnerabilities, weaknesses, and security gaps within the smart grid infrastructure, such as communication networks, access controls, software, and hardware components.
Risk Analysis	Involves identifying and analyzing threats and vulnerabilities to evaluate the risk level, considering the likelihood of an event and its potential impact on smart grid operations, availability, security, safety, and reliability.
Risk Evaluation	Prioritizes identified risks based on severity, likelihood, and impact to identify the most critical risks for mitigation with available resources.
Risk Mitigation	Involves deploying security and safety strategies to mitigate identified risks, applying technical controls, operational practices, and organizational measures such as cyber–physical security measures, contingency plans, incident response, training, policies, and procedures.
Constant Risk Monitoring	Monitors and reviews the effectiveness of risk mitigation measures to maintain risk levels within acceptable margins, identifies future potential risks, and recommends new mitigation plans involving utility operators, cybersecurity experts, and engineers for proper assessment and monitoring.

.

Before analyzing risks in smart grids, one must first establish their relevance by assessing their likelihood and potential consequences should they occur [217,220]. This requires prioritizing them before mitigating them [221]. Risk mitigation should be a mandatory iterative process to improve and adapt to changing circumstances and varying risks to maintain smart grids’ resiliency, security, and robustness [222]. Therefore, risk evaluation in smart grids involves different steps listed and described in

Table 19. Risk evaluation steps in smart grids.

Risk Evaluation Step	Description
Risks Identification	Compilation of identified risks from the risk assessment process, including cyber–physical threats, accidents (human errors, equipment failure), and natural disasters.
Likelihood Assessment	Evaluation of the probability of each risk’s occurrence based on historical data analysis, expert judgment (pen testing), and (cyber) threat intelligence. Qualitative or quantitative risk assessments are assigned accordingly.
Impact Assessment	Analysis of potential consequences following the risk’s impact on smart grid infrastructure, including operations, communications, availability, safety, security, privacy, reputation, customer feedback, and financial losses. Qualitative or quantitative ratings are assigned accordingly.
Risk Calculation and Prioritization	Calculation of the severity level of each risk by combining its likelihood and impact to determine its significance. Prioritization is based on quantitative mathematical formulas or qualitative information analysis.
Decision-Making	Adoption of risk treatment strategies based on prioritization, determining if each risk should be accepted, avoided, or mitigated using appropriate security and safety measures in a cost-effective, robust, and feasible manner.
Risk Documentation	Documentation of results, including risks’ severity, occurrences, impacts, and risk treatment decisions based on lessons learned.

. As a result of these risks, many security-related solutions presented by different authors are highlighted and analyzed.

6.3. Risk Mitigation

Mitigating risks requires implementing cybersecurity strategies and measures [7] to reduce the impact and likelihood of the evident risks by adopting the right risk mitigation measures [214,215]. The main risk mitigation measures are presented in

Table 20. Risk mitigation measures.

Risk Mitigation Measure	Description
Security Measures	Involving both physical and cyber-security measures, such as access control systems, firewalls, intrusion detection/prevention systems, advanced encryption, honeypots, multi-factor authentication, anti-virus software, tamper-resistant devices, backup servers, advanced surveillance, and access privileges to safeguard vital smart grid infrastructure against physical and cyberattacks and to monitor for unusual or suspicious activity in system operations and network traffic.
Constant Updates	Regularly updating batch and patch software and firmware to address known and newly discovered vulnerabilities. This can be done by relying on ethical hacking and penetration testing to identify vulnerabilities and discover exploitable security gaps.
Securing Critical Components	Including substations, control centers, and data centers with physical barriers, barbed (electrical) fences/wires, intrusion detection and alarm systems, movement detection sensors, surveillance systems, access control mechanisms, and security personnel. This includes simulation scenarios to maintain ongoing regular inspection and maintenance of physical infrastructure to identify and address newly discovered vulnerabilities.
Advising Contingency Plans	As part of emergency and incident response plans, based on well defined and integrated procedures to address sudden and abrupt disruptions and interruptions of services. This includes constant testing and defining new methods and maps to follow and adopt to maintain a high level of readiness.
Regular Personnel Training	Educating staff on the best security practices depending on their working domain within the smart grid, including security personnel, engineers, stakeholders, and operators. This includes incident response and awareness of potential risks.
Security and Safety By Design	Designing robust and redundant fail-safe smart-grid mechanisms to reduce the likelihood and impact of equipment failures. This is achieved by implementing advanced grid management technologies to maintain real-time monitoring and control to promptly detect and respond to incidents, enhance system resilience, and mitigate the impact of power outages.
Maintaining Constant Collaboration	Between industry peers, government agencies, intelligence agencies, military (i.e., UN and NATO), and cybersecurity organizations for information sharing and (cyber) threat intelligence sharing on new dangers, threats, weaknesses, and obstacles, as well as identifying the best security/safety practices, frameworks, and guidelines to enforce regulatory compliance.
Constant Evaluation and Assessment	Of risk mitigation measures to adapt to evolving threats to maintain effective mitigation strategies and best practices, including continuous monitoring, incident response planning, and proactive threat intelligence analysis to maintain robust smart grid security and safety.

and are summarized in

Table 21. Smart grid security risk mitigation.

Attack		Risk			Target				Mitigation
Type	Classification	Safety	Security	Privacy	User	Software	Hardware	Communication	Security Measures
Social Engineering	Exploit	Moderate/High	Moderate	Moderate	√	X	X	X	Awareness training, non-disclosure agreement, accountability
Phishing	Malware	Low	High	Moderate	√	√	X	√	Awareness training, email security, anti-virus
Trojan/Worm	Malware	High	High	High	X	X	√	√	Anti-malware, anomaly detection, firewalls, constant updates
Botnet	Malware	Moderate	High	High	X	√	√	√	Anti-malware, intrusion detection, network monitoring, constant updates
False Data Injection	Interception	Low	Moderate/High	High	X	X	X	√	ML-based detection, encryption, secure channels
Spoofing	Interception	Low	High	High	X	√	X	√	ML-based multi-layer detection, encryption, secure channels
Sniffing	Interception	Low	Moderate	High	X	X	X	√	Access control, OTP, multi-factor authentication
Meter Manipulation and Theft	Forensics	Moderate/High	High	Moderate/High	X	√	√	X	ML-based detection, anti-tampering, intrusion-detection, access controls
Session Key Exposure	Interception	Low	High	Moderate/High	X	√	X	√	Certification-based access controls, privacy-preserving, key agreement, multi-factor authentication
Time Synchronization	Insertion	Low	Moderate/High	Moderate	X	X	√	√	Fast prekey-based integrity protection, hardware-assisted authentication
DDoS	Disruption	Moderate/High	Very High	Moderate	X	√	X	√	Privacy-preserving traffic signaling protocol, DDoS detection, anonymity, forward key secrecy
TCP-SYN Flooding	Disruption	Low/Moderate	High	Low	X	X	X	√	Protocol-dependent detection and classification, ML-based detection, lightweight encryption/authentication
Jamming	Disruption	Moderate/High	High/Very High	Low	X	X	√	√	MIMO, channel coding, FHSS, DSSS
Eavesdropping		Low	High	High	X	X	X	√	WSN detection and isolation, privacy-enhanced authentication
Homograph	Deception	Moderate	High	High	√	X	√	√	DGA, access control, awareness training, cloud storage encryption
Amplification	Disruption	Low/Moderate	High	Moderate/High	√	X	X	√	Anomaly detection, DDoS detection, lightweight encryption
Sybil	Disruption	Moderate/High	High	Low	X	X	X	√	ML-based solutions, DDoS detection, Sybil attack detection

Checkmarks show what key security goals are targeted, and the X shows what key security goals are missed.

.

6.4. Linking Risks to Security Solutions

In order to bridge the gaps, having identified the various risks and vulnerabilities that threaten smart grid infrastructure, it is clear that it is crucial to implement the right sophisticated security measures targeted at overcoming these threats, vulnerabilities, and attacks. The following table maps common smart grid risks to relevant security solutions, creating a strategic link between vulnerabilities and mitigation strategies as seen in

Table 22. Mapping of smart grid risks to appropriate security solutions.

Risk/Vulnerability	Impact Area	Suggested Security Solution
False Data Injection (FDI)	Data integrity, system reliability	Machine-learning-based anomaly detection, cryptographic message authentication, PMU redundancy
Insider Threats	Authentication, access control	Role-based access control (RBAC), behavior-based monitoring, forensic auditing
Communication Failures	Availability, service continuity	Redundant communication channels, mesh networking, fault-tolerant protocols
Zero-Day Vulnerabilities	Entire infrastructure	Threat intelligence feeds, regular patching, AI/LLM-based zero-day detection
Weak Authentication	Access control, data exposure	Multi-factor authentication, certificate-based identity verification
Physical Security Breaches	Hardware integrity, public safety	Perimeter intrusion detection, surveillance systems, tamper-evident hardware
Equipment Failures	Grid stability, public safety	Predictive maintenance using ML, hardware redundancy, safety compliance protocols

.

7. Existing Security Solutions

This section outlines a range of security solutions designed to mitigate the specific risks and vulnerabilities mapped in Table 22. It also provides a comprehensive overview of countermeasures, categorized into cryptographic and non-cryptographic techniques, to address the vulnerabilities identified in the previous section. The goal of these technologies is to increase the smart grid’s resilience to the most serious cyber–physical threats.

Securing smart grids is not an easy task; hence, the adoption of both cryptographic and non-cryptographic solutions serves different purposes in securing and protecting smart grids from various security attacks and threats while maintaining high accuracy and without affecting performance. Therefore, combining cryptography and non-cryptography is crucial. This is done by analyzing the data and extracting its valuable insights to identify energy theft, smart meter tampering, accurate prediction, grid frequency and voltage fluctuations management, energy storage optimization, fault diagnosis, equipment failure prediction, and maintenance schedules [223,224] to issue a report to repair the problem with the least possible delay [225].

To strengthen the practical dimension of this proposed work, real-world examples and performance-oriented enhancements are integrated into the discussion. Lightweight cryptographic algorithms, such as Elliptic Curve Cryptography (ECC) and AES-CCM, have been adopted in AMI due to their balance between security strength and computational efficiency, making them particularly suitable for resource-constrained smart grid devices. In parallel, non-cryptographic methods, including anomaly-based detection systems and dynamic risk scoring, have been implemented in various pilot deployments to enhance system responsiveness and resilience. Notably, machine-learning-based intrusion detection systems trained on datasets like ICS-CERT and KDD Cup have shown promising results, achieving high detection accuracy and minimal false positives. These real-world applications and performance evaluations provide a concrete basis for the effectiveness and feasibility of the solutions presented, underscoring their relevance in modern smart grid security architectures.

7.1. Cryptography Solutions

Cryptography plays a crucial role in ensuring the security and privacy of smart grids as it achieves data confidentiality through symmetric encryption, data integrity and message authentication via Message Authentication Codes (MACs) or digital signatures, and system and data availability through the use of available servers and backup devices, respectively. Entity authentication can be achieved via a cryptographic protocol that utilizes either symmetric encryption or asymmetric encryption, with non-repudiation ensured through digital signatures and certificates. Besides, secure and robust key management via secure generation, distribution, and management of cryptographic keys is mandatory. By employing these cryptographic techniques, data and user safety, security, privacy, and integrity can be protected against data tampering and breaches, as well as securing and protecting critical information and operations within the grid infrastructure in real time. Hence, a list of cryptography-based solutions is presented as follows (see

Table 23. Smart grid cryptographic protocols and security solutions.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2018	[226]	ECC-based Authentication	Lightweight ECC-based authentication scheme between substations and control center	Provides mutual authentication, low computational/communication costs	Defends against known attacks, suitable for resource-limited environments	Not blockchain-enabled, lacks post-quantum security	Not tested in dynamic environments or large-scale systems	Handling latency in real-time updates	Could benefit from integration with fog/blockchain layers
2021	[227]	ECC Mutual Authentication	ECC-based mutual authentication for robust smart grid security in delay-sensitive communication	Lightweight, scalable, ECC-based	Robust against known attacks, energy efficient	ECC still computational for ultra-constrained devices	Lack of privacy-preserving features	Ensuring low-latency in complex networks	Could incorporate privacy-preserving techniques like FHE
2019	[228]	TACIT Encryption	Message encryption using TACIT hardware chip in grid distribution	Time-authenticated cryptographic identity chip	Hardware-embedded, efficient for real-time use	Focused on message encryption only	Limited to hardware-level, not flexible for software update	Integration across legacy systems	Expand to support multiple encryption schemes
2021	[229]	TACIT and FPGA Security	Enhanced TACIT using embedded systems and FPGA for nuclear/grid data	High-speed, embedded, FPGA-integrated	End-to-end encryption, real-time processing	Hardware dependence	Limited scalability for non-FPGA systems	Firmware patching and compatibility	Hybrid software–hardware models for adaptability
2021	[230]	ECC Validation	ECC-based validation and data protection using ProVerif and BAN logic	Formal verification, ECC, lightweight	Strong formal proofs, efficient communication	Limited quantum resistance	Limited to validation without encryption layer	Addressing insider threats	Combine with secure key distribution systems
2022	[231]	AES S-box for SCADA	AES-based S-box to secure SCADA in smart grids	Lightweight chip-based AES	Efficient chip integration, SCADA protection	Focused on substitution layer only	Not holistic security coverage	Ensuring chip integrity in long-term use	Multi-layer security integration with IDS
2023	[232]	AES Chip	AES cryptographic chip simulated on Xilinx for grid data	Hardware-optimized AES	Efficient encryption/decryption, real-time performance	Chip-only implementation	Does not cover key management or authentication	Secure firmware lifecycle	Integrate key rotation protocols
2023	[233]	Fog-based Session Key Protocol	Anonymous session key agreement via fog computing	Specialized middle layer, dynamic session keys	Improved security and anonymity	Privacy trade-offs with session linkability	Scalability in ultra-dense deployments	Dynamic node handling	Merge with FL and blockchain for flexibility
2023	[234]	Lightweight Authentication Protocol	Lightweight Authentication using Esch256 and authenticated encryption	Hash-based, energy efficient, fast	Low-resource usage, high protection	Dependent on hash function strength	Needs full evaluation in wide networks	Resistance to side-channel attacks	Expand to hybrid crypto-auth models
2023	[235]	Secure Data Aggregation	Efficient data aggregation system to distinguish benign vs. malicious users	Privacy-aware, optimized crypto-overhead	Smart classification, efficient aggregation	Sensitive to data poisoning	Dependence on pre-learned thresholds	Adapting to evolving attacker behavior	Reinforcement-learning-enhanced detection models
2023	[236]	Lightweight Mutual Authentication	Mutual authentication for smart meters	Lightweight, surveillance-focused	Secure against known threats	May lack resilience to future attacks	No mention of integration with external APIs	Scaling to massive smart meter deployments	Integration with FL and anomaly detection models

).

7.1.1. Cryptographic Protocols

In [226], Mahmood et al. presented an Elliptic Curve Cryptography (ECC)-based lightweight authentication scheme for smart grids to secure underlying communication between substations and the corresponding control centre. The scheme is said to provide mutual authentication with low computational and communication costs while also withstanding all known security attacks. Additionally, in [227], Sadhukhan et al. proposed a new lightweight scheme for mutual authentication using Elliptic Curve Cryptography (ECC) to enhance the robustness of the smart grid against various security threats in complex, delay-sensitive smart grid network communication. The simulation results demonstrated that the scheme is sufficiently efficient to be implemented in a realistic scenario.

In [228], Kumar et al. presented a message encryption algorithm that can be employed in smart grid distribution system hardware, using a new Time Authenticated Cryptographic Identity Transmission (TACIT) algorithm hardware chip to secure grid communication. After this, in [229], Kumar et al. addressed the smart grid and nuclear power plant security issues and presented the latest Time Authenticated Cryptographic Identity Transmission (TACIT) cryptographic algorithm. The simulation showed that TACIT achieved good results when integrated with embedded hardware and Field Programmable Gate Array (FPGA) to provide grid data security from the distribution end to consumers or vice versa. Also, in [230], Kumar et al. presented a validation system dependent on Elliptic Curve Cryptography (ECC) to secure the smart grid, especially regarding validation and data protection. The formal verification was achieved using the ProVerif tool along with Burrows–Abadi–Needham logic (BAN logic), and, based on the conducted analysis, the system demonstrated its efficiency in terms of operation, storage, and transmission costs, as well as against numerous security attacks. The authors continued their work, and in [231], Kumar et al. presented the cryptography-based substitution box (S-box) Advanced Encryption Standard (AES) to securely manage Supervisory Control and Data Acquisition (SCADA) networks. These methods can be merged with smart grid communication hardware and grid distribution as an integrated chip to secure the smart grid and plants by incorporating secure hardware. Lastly, in [232], Kumar et al. successfully designed a cryptographic Advanced Encryption Standard (AES) algorithm hardware chip for a smart grid in Xilinx 14.7 software before simulating its functionality with cryptographic encryption and decryption to ensure secured smart grid data communication.

On the other hand, in [233], Mishra et al. presented an anonymous session key agreement protocol for the smart grid environment, which uses fog as a specialized middle layer technique to establish efficient communication. The protocol is said to achieve desirable security goals and performance attributes.

In fact, all recent cryptographic approaches are designed to be lightweight, reducing the required latency and resources and responding better to hardware limitations, especially in the case of tiny IoT devices.

In [234], Tanveer et al. devised a lightweight AuthentiCation (AC) protocol for a smart grid called LACP-SG. LACP-SG employs the hash function, “Esch256”, and “authenticated encryption” to accomplish the AC phase and ensures secure data exchange between the smart meter (SM) and server by validating the SM’s authenticity. Demonstrations showed that it is less resource-intensive and achieves better security characteristics. In [235], Park et al. presented an efficient system to address security and privacy problems to overcome the limitations of data aggregations in terms of cryptographic overhead. The experiments demonstrated that the scheme is efficient and can easily distinguish benign users and bad actors. In [236], Badar et al. presented a lightweight mutual authentication scheme to offer surveillance to smart meters in smart grid infrastructure. The analysis revealed that the scheme is efficient against well-known security threats.

In resource-constrained IoT environments, lightweight cryptographic algorithms, such as post-quantum and privacy-preserving techniques, can protect smart grid components from changing cyberthreats while preserving efficiency. One real-world example is their use in smart meters, where low-level encryption guarantees the safe transmission of real-time energy consumption data without exhausting the computational power of the device.

7.1.2. Blockchain Approaches

Apart from cryptographic protocols, blockchain approaches were also used as a solution that overcomes the drawbacks of cryptographic protocols (see

Table 24. Smart grid blockchain approaches and security solutions.

Year	Authors	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2021	Wang et al. [237]	Authentication Protocol and Blockchain	Combines ECC, Join-and-Exit mechanism, batch verification with blockchain to secure real-time power transmissions	Real-time security, blockchain-based, cryptographic protocol	Enhanced performance and security against DDoS	Complex integration of multiple cryptographic tools	Scalability concerns with large-scale smart grid environments	Ensuring low-latency in real-time applications	Combine lightweight cryptography for constrained devices
2023	Liu et al. [238]	Aggregation Scheme	Certificate-less public key cryptography for multi-dimensional data aggregation using Paillier encryption within fog computing	Paillier homomorphic encryption, fog-based architecture	Reduces computational load on smart meters, improves data privacy	Complex implementation, dependency on fog infrastructure	Certificate-less schemes may still require PKG trust assumptions	Secure key management and aggregation in dynamic environments	Introduce adaptive trust models for user key exchange
2023	Sani et al. [239]	Blockchain Model	SDAG model providing energy node visibility without involving energy operators using registration and data-aware protocols	Cryptographic identity assignment, session key-based awareness	Improves visibility, supports decentralized control	Protocol overhead may increase with node numbers	Limited real-world deployment validation	Balancing privacy with operational transparency	Leverage lightweight encryption for constrained nodes
2023	Oberko et al. [240]	Access Control Design	Ethereum-based design ensuring traceability and revocability, secured by Decisional Bilinear Diffie–Hellman theory	Smart contracts, public key generation, secure decryption	High security, traceability, reduced overhead	Requires Ethereum infrastructure and understanding of smart contracts	Energy-intensive operations on Ethereum blockchain	Maintaining performance in high-throughput scenarios	Optimize contract execution costs
2023	Bitirgen et al. [241]	Attack Detection Mode	CNN-LSTM model optimized with PSO to detect false data injection attacks in smart grids	Hybrid deep learning, particle swarm optimization	High accuracy, effective against FDI attacks	May require high training time and compute resources	Model generalizability across varying grid architectures	Adaptation to different smart grid configurations	Integrate online learning for real-time adaptation

). In [237], Wang et al. addressed the security issues surrounding real-time power transmission (i.e., DDoS) and presented a reliable and efficient authentication protocol by combining Elliptic Curve Cryptography (ECC), a dynamic Join-and-Exit mechanism, and batch verification with blockchain technology. The experimental results showed that the protocol achieves enhanced security and performance. In [238], Liu et al. presented a multi-dimensional data aggregation scheme based on certificate-less public key cryptography for smart grids. This scheme uses a Paillier homomorphic encryption system within a fog-computing-based architecture, implementing authentication and key negotiation among member users. Performance analysis showed that it can effectively reduce the computational overhead of both smart meters and aggregators compared to other schemes. In [239], Sani et al. introduced SDAG as a blockchain-enabled secure data awareness model that enables energy nodes to provide visibility into energy operations without involving energy operators in the smart grid. SDAG includes a Registration Protocol (RPro) that assigns a cryptographic identity to an energy node and a Data-Aware Protocol (DAPro) that executes data awareness with the support of a shared secret session key. The model was applied to mitigate the State Estimator (SE) loss due to contracting data in a real-world energy grid. In [240], Oberko et al. presented an Ethereum-blockchain-oriented secure access regulation design that upholds traceability and revocability to resolve smart grid problems, utilizing the Decisional Bilinear Diffie–Hellman (DBDH) complex theory to secure the system against multiple attacks. The analysis revealed that this design achieves shorter overhead duration in the phases of generating the public key, data encryption, and decryption. In [241], Bitirgen et al. presented a method that detects false data injection attacks in smart grids by optimizing Convolutional Neural Networks — Long Short-Term Memory (CNN-LSTM) with Particle Swarm Optimization (PSO). The results showed that this model outperformed other deep learning (DL) models with a high accuracy rate that provides decision support for smart grid operation systems.

Blockchain technologies provide decentralized trust, tamper resistance, and transparent auditing, making them ideal for safe data sharing and transaction validation in real-world smart grid environments. For instance, the blockchain can be utilized in peer-to-peer energy trading networks, enabling prosumers to safely trade excess solar energy with neighbors without the need for a central authority or intermediary.

7.2. Non-Cryptography Solutions

Cryptography plays a crucial role in securing smart grids, particularly in terms of data security. However, security solutions can be based on a non-cryptographic approach to detect and prevent intruders in addition to correcting the damage at a lower latency time and reinforcing the security level with an acceptable trade-off. This also requires providing additional layers of security while allowing them to be linked with cryptographic techniques to provide comprehensive security for smart grids. The main non-cryptography solutions presented below include anomaly/cyberattack detection and honeypot solutions.

7.2.1. Anomaly Detection

Anomaly detection is essential in smart grids due to the vast amount of data generated by IoT devices in real time, including energy consumption and grid conditions. These techniques identify and analyze abnormal patterns and behaviors to ensure the smart grid’s safety, security, and reliability while also enabling efficient energy management. As a result, various anomaly-detection-based solutions were presented (see Table 25) that can be based on statistical or machine learning approaches (unsupervised, supervised, or semi-supervised).

In [242], Yaacoub et al. presented a survey that discusses the security and safety issues, limitations, challenges, and solutions of federated learning with IoT systems, especially involving CPS and smart grid systems. In [243], Liu et al. presented a statistical-based anomaly detection method to detect consumption anomalies in a real-time manner. The results demonstrated the effectiveness and scalability of the proposed lambda detection system. Examples of unsupervised learning approaches such as Menon et al. [244] identify anomalies in the smart grid traffic and detect flooding and DoS attacks in smart grid networks using the k-Means clustering algorithm to cluster traffic data and outlier detection for the transmitted data. The results showed that it has a higher percentage in anomaly detection. Also, Karimipour et al. [245] presented an unsupervised anomaly detection scheme based on a statistical correlation between measurements to differentiate between an actual fault, a disturbance, and an intelligent cyberattack. The results showed that the scheme achieves an accuracy of 99%, a true-positive rate of 98%, and a false-positive rate of less than 2%.

In [246], El-Awadi et al. presented a strategy to detect anomalies in the edge of the smart grid using a fog computing approach that detects anomalous patterns in the electricity consumption data via collaboration of distributed devices at the edge of the smart grid network to reduce communication delay. In [247], Marino et al. presented a cyber–physical sensor called Industrial (Control Systems) Resilient Security Technology (IREST) that detects anomalies by considering both cyber and physical disturbances in a complex system, providing a scalable framework for cyber–physical security research.

In [248], Li et al. presented a privacy-preserving anomaly-based data falsification attack detection over Fully Homomorphic Encrypted (FHE) data that performs the needed computations to detect attacks over encrypted individual customer smart meter data. The experimental results show that injection of false power consumption is detected within 11–17 s of execution time, depending on the accuracy.

In [249], Abdelkhalek et al. presented a supervised Machine Learning (ML)-based Anomaly Detection System (ADS) to detect various stealthy IT and OT attacks on DER communication. The experimental results showed that the system has a detection rate of 98.4%, a false-positive rate of 0.28%, and a false-negative rate of 1.32%. In [250], Takiddin et al. presented an adoption of deep (stacked) auto-encoders with a Long Short-Term Memory (LSTM)-based sequence-to-sequence (seq2seq) structure to capture the sophisticated data patterns and exploit the time-series nature of data. The simulation results showed an enhancement of 4–21% and 4–13% in detection and false alarm rates. In [251], Nafees et al. presented an approach based on physics-informed hybrid deep-learning detection using a process control-based variational autoencoder, prior knowledge of physics, and Long Short-Term Memory to detect false data injection attacks. The experimental results show that the accuracy of the lowest reconstruction error is 96.9%. In [252], Abdel et al. introduced a novel privacy-preserving Federated semi-Supervised Class-Rebalanced (Fed-SCR) framework to detect anomalous power data in fog-assisted smart grids while maintaining communication efficiency. The evaluation results showed that the industrial smart grid (ISG) achieves an accuracy of 97.28% in binary classification and between 96.36 and 95.04% in multi-class classification. In [253], Siniosoglou et al. presented an IDS called MENSA (anoMaly dEtection aNd claSsificAtion), which adopts a novel Autoencoder-Generative Adversarial Network (GAN) architecture to detect operational anomalies and classify cyberattacks. The e valuation results showed that MENSA achieves high accuracy with a low False-Positive Rate (FPR). In [254], Aribisala et al. presented a hybrid Multilayer Perceptron (MLP) Sequential-Feed Forward Neural Network (SEQ-FFNN) as a self-learning model that performs a principal component analysis, hyper-parametrization, testing, training, and prediction of accurate outputs per code iteration. The results showed that the detection accuracy achieved 98.97% for tanh-activated layers and 99.59% for the Sigmoid-activated model. In [255], Jithish et al. presented a federated learning (FL)-based smart grid anomaly detection scheme where ML models are trained locally in smart meters without sharing data with a central server to ensure users’ privacy while securing model parameter updates for the Secure Sockets Layer/Transport Layer Security (SSL/TLS) protocol.The study showed that it performs efficiently regarding memory, bandwidth, CPU usage, and power consumption at edge devices and can be deployed in resource-constrained environments.

In [256], Stryczek et al. focused on the Internet of Energy (IoE) devices and network resources [257,258]. They considered three machine learning techniques, including Long Short-Term Memory (LSTM), Isolation Forest (IF), and Support Vector Machine (SVM), while also describing the data preparation process. The authors also showed that a more accurate classification can be achieved by increasing the number of analyzed features. In [3], Sahani et al. surveyed the concept of Machine learning (ML)-based Intrusion Detection System (IDS) approaches in smart grids, especially in transmission and distribution-side power components of a smart power grid while taking into consideration the security aspect. Meanwhile, several solutions were presented, such as the following: In [259], Karimipour et al. presented an unsupervised anomaly detection based on a statistical correlation between measurements and using symbolic dynamic filtering (SDF) to reduce the computational burden. The results showed an accuracy of 99%, with a true-positive rate of 98%. In [260], Dairi et al. presented an enhanced cyberattack detection strategy using unlabeled data to monitor ICS traffic and detect suspicious data transmissions, with two semi-supervised hybrid deep-learning-based anomaly detection methods being designed for intrusion detection in ICS traffic of the smart grid. The experimental results show that this strategy achieved enhanced detection with an averaged F1-score of 0.98. In [261], Babar et al. presented a secure Demand-Side Management (DSM) engine using machine learning for the IoT-enabled grid to preserve the efficient utilization of energy. In contrast, a specific resilient model was presented to control intrusions in the smart grid. Analysis showed that the projected DSM engine is less vulnerable to intrusion and effective enough to reduce power utilization. Finding unusual patterns and strange behaviors in smart grid operations that indicate cyberattacks or system failures requires the use of anomaly detection techniques, especially those based on machine learning. Anomaly detection, for instance, can be used to track grid voltage shifts and identify any sudden variations that could point to a substation equipment failure or a False Data Injection Attack (FDIA).

7.2.2. DDoS Detection

DDoS attacks can flood the smart grid’s network with traffic, overwhelming its capacity and causing it to crash and cause either a partial or a total power outage and/or cascading blackout, burnout, or brownout [262]. However, by implementing DDoS detection and prevention mechanisms, smart grid incident responders can quickly react by identifying the type of attack, activating the necessary countermeasures, and isolating systems and devices if necessary. This will prevent and minimize power disruptions and ensure the smart grid’s resiliency and reliability. As a result, several recent solutions were presented to mitigate this threat (see Table 26), such as in [263], where Ghanbari et al. described an anomaly detection method that improves the detection rate of DDoS attacks in smart grids. This was done by increasing the training classification and testing phases in a Convolutional Neural Network (CNN), using a full version of the Variance Fractal Dimension Trajectory (VFDTv2), and Support Vector Machine (SVM), and applying Discrete Wavelet Transform (DWT). The implementation managed to detect DDoS attacks with an accuracy of 87.35%. In [209], Acarali et al. presented a compromise propagation model alongside a behavioral DDoS model to explore how dependencies between the grid’s networks might influence the scale and impact of DDoS attacks. The results showed how these models could be considered in the future as an alternative to graph-based modeling for predicting the interconnected network vulnerabilities within smart grid critical infrastructure. In [264], Torres et al. presented iCAD as an information-centric architecture, extending the iCAAP architecture they had already presented before to show its effectiveness in mitigating DoS/DDoS attacks. The simulation results demonstrated that iCAD can successfully handle DDoS traffic and meet QoS expectations of applications. In [265], Merlino et al. developed a situational awareness tool to detect the system’s compromise by monitoring the Indicators of Compromise (IOCs) of amplification DDoS attacks and exploring attack footprints to understand their nature and cyber behavior. The tool was tested against a real dataset of DDoS attack instances and successfully distinguished and detected different types of amplification DDoS attacks. In [210], Diaba et al. presented a hybrid deep learning algorithm that focuses on DDoS attacks on the smart grid’s communication infrastructure, using the Convolutional Neural Network (CNN) and the Gated Recurrent Unit (GRU) algorithms. The simulation results showed that the algorithm outperforms the current intrusion detection algorithms with an accuracy of 99.7%. In [266], Ortega et al. presented a comprehensive and systematic analysis of DoS attacks in the smart grid along with their effect while discussing the detection and mitigation techniques against DoS attacks in the smart grid using reinforcement learning (RL) algorithms. DDoS detection techniques are crucial for preserving the smart grid’s control systems and communication channels’ availability, particularly in high-load, attack-prone conditions. One interesting use case involves using DDoS detection at a utility’s data aggregation server gateway, where real-time traffic analysis can pinpoint flooding efforts before they interfere with meter-to-grid interactions.

Table 25. Smart grid anomaly detection and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2016	[243]	Statistical	Real-time consumption anomaly detection using lambda detection system	Statistical model, real-time monitoring	Effective and scalable	Limited to statistical patterns	Might not adapt well to non-linear anomalies	Handling evolving data patterns	Integration with ML-based methods
2016	[244]	Unsupervised ML	k-Means clustering for anomaly detection in smart grid traffic	Unsupervised learning, clustering-based	High anomaly detection rate	Depends on clustering performance	Hard to interpret clusters	Real-time processing and adaptability	Hybrid approach with supervised methods
2019	[245]	Unsupervised ML	Statistical correlation-based scheme for anomaly detection	Correlation analysis, unsupervised	High accuracy and true-positive rate	Requires extensive historical data	Lower performance with noisy data	Differentiating between faults and attacks	Enhanced preprocessing and feature selection
2019	[246]	Fog computing	Fog-based anomaly detection at the edge in smart grid	Distributed detection, low latency	Reduces communication delay	Complex deployment and maintenance	Limited computational resources	Device synchronization and coordination	Edge-cloud collaboration models
2019	[247]	Cyber–physical sensor	IREST sensor to detect anomalies in ICS environments	Cyber–physical integration, scalable design	Scalable framework for ICS security	Needs comprehensive deployment	May miss application-specific threats	Calibration and tuning for various environments	Integration with threat intelligence
2022	[248]	FHE-based	FHE-based anomaly detection over encrypted smart meter data	Fully homomorphic encryption, secure computation	Preserves privacy while detecting falsified data	Computationally intensive	Execution time dependent on accuracy level	Efficient computation over encrypted data	Optimization of homomorphic operations
2022	[249]	Supervised ML-based ADS	Anomaly detection system for DER communication	High accuracy, low false-positive and false-negative rates	Effective in detecting stealthy IT/OT attacks	Relies on labeled data	Limited generalizability across domains	Data labeling, real-time adaptability	Enhance domain adaptability, reduce reliance on labeled data
2022	[250]	Deep Autoencoders and LSTM seq2seq	Captures complex time-series patterns in grid data	Layered structure, temporal sequence modeling	Improved detection and lower false alarms	High computational cost	Needs high-quality time-series data	Deployment on edge devices	Optimize for lightweight deployment
2022	[251]	Physics-informed hybrid deep learning	Detects false data injection using physics-based priors	Uses variational autoencoder and LSTM	High detection accuracy, physics-aware	Complex model integration	Scalability to large-scale systems	Computational efficiency	Improve scalability and real-time inference
2022	[252]	Federated semi-supervised class-rebalanced	Anomaly detection in fog-assisted grid with Fed-SCR	Semi-supervised, federated, privacy-preserving	Efficient and private	Class imbalance issues	Complex implementation	Model synchronization and imbalance	Refine rebalancing strategies
2021	[253]	Autoencoder-GAN based IDS	MENSA: anomaly detection and classification	GAN with autoencoder for smart grid	High accuracy, low FPR	Training complexity	Training stability of GANs	Deployment in real-time systems	Stabilize GAN training, adapt to grid dynamics
2022	[254]	Hybrid MLP SEQ-FFNN	Self-learning IDS with hyperparameter tuning	Multilayer, PCA, tanh/sigmoid activation	High detection accuracy	Overfitting risk	Performance drops on unseen patterns	Maintaining generalization	Incorporate regularisation and validation techniques
2023	[255]	Federated learning-based anomaly detection	Local training on smart meters, secure updates	FL, privacy-focused, efficient	Privacy-preserving, scalable	Communication overhead	Dependency on reliable connections	Resource constraints at edge	Reduce bandwidth needs, improve fault tolerance
2023	[256]	ML-based anomaly detection	Focused on Internet of Energy (IoE) devices using LSTM and SVM for intrusion detection	Multiple ML techniques, attention to feature engineering and preparation	Improved classification accuracy with more features	No mention of real-time testing, assumes sufficient computational resources	Scalability in real-world deployments, dependency on feature quality	Data heterogeneity and privacy in IoE environments	Increase the number of features analyzed for better accuracy
2019	[259]	Experimental Study	Unsupervised anomaly detection using statistical correlations and SDF	Reduced computational burden using symbolic dynamic filtering	High accuracy (99%) with low false positives	Focus limited to correlation-based attacks	Limited scope to certain types of anomalies	Model generalization to broader attacks	Integration with other detection layers
2023	[260]	Experimental Study	Semi-supervised hybrid DL anomaly detection for ICS traffic	Used unlabeled data for real-world intrusion detection	High F1-score (0.98) and effective with unlabeled data	Potential complexity in hybrid model tuning	Testing confined to ICS environments	Generalization to varied smart grid architectures	Adaptation to more diverse datasets
2020	[261]	Experimental Study	DSM engine for IoT-based smart grids with intrusion control	Focused on DSM and secure energy optimization	Reduced power use and improved intrusion resilience	Limited evaluation under diverse attack types	Does not explore detailed ML design	Real-time deployment and feedback integration	Broaden ML feature set and adaptive response mechanisms

Table 25. Smart grid anomaly detection and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2016	[243]	Statistical	Real-time consumption anomaly detection using lambda detection system	Statistical model, real-time monitoring	Effective and scalable	Limited to statistical patterns	Might not adapt well to non-linear anomalies	Handling evolving data patterns	Integration with ML-based methods
2016	[244]	Unsupervised ML	k-Means clustering for anomaly detection in smart grid traffic	Unsupervised learning, clustering-based	High anomaly detection rate	Depends on clustering performance	Hard to interpret clusters	Real-time processing and adaptability	Hybrid approach with supervised methods
2019	[245]	Unsupervised ML	Statistical correlation-based scheme for anomaly detection	Correlation analysis, unsupervised	High accuracy and true-positive rate	Requires extensive historical data	Lower performance with noisy data	Differentiating between faults and attacks	Enhanced preprocessing and feature selection
2019	[246]	Fog computing	Fog-based anomaly detection at the edge in smart grid	Distributed detection, low latency	Reduces communication delay	Complex deployment and maintenance	Limited computational resources	Device synchronization and coordination	Edge-cloud collaboration models
2019	[247]	Cyber–physical sensor	IREST sensor to detect anomalies in ICS environments	Cyber–physical integration, scalable design	Scalable framework for ICS security	Needs comprehensive deployment	May miss application-specific threats	Calibration and tuning for various environments	Integration with threat intelligence
2022	[248]	FHE-based	FHE-based anomaly detection over encrypted smart meter data	Fully homomorphic encryption, secure computation	Preserves privacy while detecting falsified data	Computationally intensive	Execution time dependent on accuracy level	Efficient computation over encrypted data	Optimization of homomorphic operations
2022	[249]	Supervised ML-based ADS	Anomaly detection system for DER communication	High accuracy, low false-positive and false-negative rates	Effective in detecting stealthy IT/OT attacks	Relies on labeled data	Limited generalizability across domains	Data labeling, real-time adaptability	Enhance domain adaptability, reduce reliance on labeled data
2022	[250]	Deep Autoencoders and LSTM seq2seq	Captures complex time-series patterns in grid data	Layered structure, temporal sequence modeling	Improved detection and lower false alarms	High computational cost	Needs high-quality time-series data	Deployment on edge devices	Optimize for lightweight deployment
2022	[251]	Physics-informed hybrid deep learning	Detects false data injection using physics-based priors	Uses variational autoencoder and LSTM	High detection accuracy, physics-aware	Complex model integration	Scalability to large-scale systems	Computational efficiency	Improve scalability and real-time inference
2022	[252]	Federated semi-supervised class-rebalanced	Anomaly detection in fog-assisted grid with Fed-SCR	Semi-supervised, federated, privacy-preserving	Efficient and private	Class imbalance issues	Complex implementation	Model synchronization and imbalance	Refine rebalancing strategies
2021	[253]	Autoencoder-GAN based IDS	MENSA: anomaly detection and classification	GAN with autoencoder for smart grid	High accuracy, low FPR	Training complexity	Training stability of GANs	Deployment in real-time systems	Stabilize GAN training, adapt to grid dynamics
2022	[254]	Hybrid MLP SEQ-FFNN	Self-learning IDS with hyperparameter tuning	Multilayer, PCA, tanh/sigmoid activation	High detection accuracy	Overfitting risk	Performance drops on unseen patterns	Maintaining generalization	Incorporate regularisation and validation techniques
2023	[255]	Federated learning-based anomaly detection	Local training on smart meters, secure updates	FL, privacy-focused, efficient	Privacy-preserving, scalable	Communication overhead	Dependency on reliable connections	Resource constraints at edge	Reduce bandwidth needs, improve fault tolerance
2023	[256]	ML-based anomaly detection	Focused on Internet of Energy (IoE) devices using LSTM and SVM for intrusion detection	Multiple ML techniques, attention to feature engineering and preparation	Improved classification accuracy with more features	No mention of real-time testing, assumes sufficient computational resources	Scalability in real-world deployments, dependency on feature quality	Data heterogeneity and privacy in IoE environments	Increase the number of features analyzed for better accuracy
2019	[259]	Experimental Study	Unsupervised anomaly detection using statistical correlations and SDF	Reduced computational burden using symbolic dynamic filtering	High accuracy (99%) with low false positives	Focus limited to correlation-based attacks	Limited scope to certain types of anomalies	Model generalization to broader attacks	Integration with other detection layers
2023	[260]	Experimental Study	Semi-supervised hybrid DL anomaly detection for ICS traffic	Used unlabeled data for real-world intrusion detection	High F1-score (0.98) and effective with unlabeled data	Potential complexity in hybrid model tuning	Testing confined to ICS environments	Generalization to varied smart grid architectures	Adaptation to more diverse datasets
2020	[261]	Experimental Study	DSM engine for IoT-based smart grids with intrusion control	Focused on DSM and secure energy optimization	Reduced power use and improved intrusion resilience	Limited evaluation under diverse attack types	Does not explore detailed ML design	Real-time deployment and feedback integration	Broaden ML feature set and adaptive response mechanisms

Table 26. Smart grid DDoS detection and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2022	[263]	DDoS Detection	Anomaly detection using CNN, VFDTv2, SVM, and DWT to improve DDoS detection rate in smart grids	Hybrid DL/ML, signal processing-based features	Multi-technique detection, good accuracy (87.35%)	Moderate performance, may require complex preprocessing	Model generalizability and real-time deployment not assessed	Latency and scalability on smart grid nodes	Streamlined preprocessing and edge optimization
2022	[209]	Modeling	DDoS propagation model capturing interdependencies and grid network behavior	Dependency modeling, behavioral analytics	Network-level insight into attack spread	Requires extensive graph data	Abstract representation without live data validation	Integrating into operational grid infrastructure	Empirical validation and hybridization with graph-based detection
2022	[264]	DDoS Mitigation	iCAD architecture extended from iCAAP to mitigate DDoS while preserving QoS	Information-centric, layered defense	QoS-aware protection against DoS/DDoS	Simulation-based, requires validation	Scalability and real-world deployment untested	Compatibility with legacy grid protocols	Testbed deployment and integration into smart grid middleware
2022	[265]	Situational Awareness	IOC-based DDoS detection tool tested on real amplification DDoS datasets	IOC analysis, amplification attack profiling	Effective in real-data scenarios	Focus on specific DDoS types only	Does not detect non-amplification DDoS attacks	Broader coverage and automated IOC update	Extension to adaptive IOC engines and real-time correlation
2023	[210]	Hybrid DL (CNN-GRU)	Hybrid DL-based model for detecting smart grid DDoS with CNN-GRU	Temporal and spatial learning via CNN-GRU	High detection accuracy (99.7%)	Model complexity may hinder deployment	No deployment context or system resource test	Balancing performance with runtime cost	Model compression or quantization for edge deployment
2023	[266]	Review	Review of DoS attack impact, detection, and mitigation using reinforcement learning	Comprehensive overview, RL-driven defense	Wide coverage and forward-looking strategy	Mainly theoretical and survey based	Lack of tested implementation	Real-world applicability of RL in smart grid	Pilot RL deployments and benchmark comparisons

Table 26. Smart grid DDoS detection and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2022	[263]	DDoS Detection	Anomaly detection using CNN, VFDTv2, SVM, and DWT to improve DDoS detection rate in smart grids	Hybrid DL/ML, signal processing-based features	Multi-technique detection, good accuracy (87.35%)	Moderate performance, may require complex preprocessing	Model generalizability and real-time deployment not assessed	Latency and scalability on smart grid nodes	Streamlined preprocessing and edge optimization
2022	[209]	Modeling	DDoS propagation model capturing interdependencies and grid network behavior	Dependency modeling, behavioral analytics	Network-level insight into attack spread	Requires extensive graph data	Abstract representation without live data validation	Integrating into operational grid infrastructure	Empirical validation and hybridization with graph-based detection
2022	[264]	DDoS Mitigation	iCAD architecture extended from iCAAP to mitigate DDoS while preserving QoS	Information-centric, layered defense	QoS-aware protection against DoS/DDoS	Simulation-based, requires validation	Scalability and real-world deployment untested	Compatibility with legacy grid protocols	Testbed deployment and integration into smart grid middleware
2022	[265]	Situational Awareness	IOC-based DDoS detection tool tested on real amplification DDoS datasets	IOC analysis, amplification attack profiling	Effective in real-data scenarios	Focus on specific DDoS types only	Does not detect non-amplification DDoS attacks	Broader coverage and automated IOC update	Extension to adaptive IOC engines and real-time correlation
2023	[210]	Hybrid DL (CNN-GRU)	Hybrid DL-based model for detecting smart grid DDoS with CNN-GRU	Temporal and spatial learning via CNN-GRU	High detection accuracy (99.7%)	Model complexity may hinder deployment	No deployment context or system resource test	Balancing performance with runtime cost	Model compression or quantization for edge deployment
2023	[266]	Review	Review of DoS attack impact, detection, and mitigation using reinforcement learning	Comprehensive overview, RL-driven defense	Wide coverage and forward-looking strategy	Mainly theoretical and survey based	Lack of tested implementation	Real-world applicability of RL in smart grid	Pilot RL deployments and benchmark comparisons

7.2.3. Honeypot Solutions

Using honeypots in smart grids can be an effective security strategy to detect cyberattacks and identify their source by creating a dummy system that tricks the attacker and collects data about them instead [8]. Honeypots can be deployed at various points within the smart grid’s critical infrastructure, including networks and their edges. In this paper, several honeypot-based solutions are presented (see

Table 27. Smart grid honeypot solutions and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2022	[267]	DL/Anomaly Detection	LSTM RNN-based model for log-based anomaly detection using partial feature contribution	Deep learning, weak label support, LSTM architecture	High accuracy (99.8%) with only 25% features used	Requires tuning and training effort	Model generalizability across domains not proven	Device resource limitations	Lighter architectures or edge deployment optimization
2022	[268]	Honeypot	GridPot honeypot deployed and threat data mapped to MITRE ATTACK for ICS	ICS-based honeypot, threat mapping	Grounded real-world attack behavior analysis	Honeypot visibility may limit attack variety	Limited coverage without large-scale deployment	Keeping mapping updated with latest tactics	Distributed deployment with diverse device profiles
2022	[269]	Honeypot	Low-interaction honeypots deployed in AWS to observe ICS compromise trends	Cloud-based honeypot with regional diversity	Scalable deployment, multi-region observations	Low interaction may miss advanced attacker behavior	Limited protocol emulation	Balancing fidelity and cost	Hybrid honeypots with partial interaction
2022	[270]	Honeypot	Decentralized honeypot using Android over cellular networks for IoT protocol emulation	Mobile-based, decentralized, IoT focus	Covers IoT-specific threats in mobile environments	Device-level attack emulation only	Realism depends on network fidelity	Scalability in public attack monitoring	Federated attack analysis sharing
2023	[271]	FL/Honeypot	Privacy-preserving FL with honeypot log sharing incentives and two-step verification	Federated learning, incentive mechanism	Secure model training and log verification	Complex coordination and reward validation	Depends on supplier participation	Scalability and verification trust	Dynamic reward schemes and lightweight models
2023	[272]	Honeypot	HoneyTrack lightweight honeypot deployed in Azure cloud for tracking attack origin	Lightweight, quick deployment	Fast setup and actionable output	Focus on initial attack phases	Limited scope without deeper inspection tools	Maintaining consistent monitoring	Integration with SIEM or XDR tools
2023	[273]	DAG/Blockchain	DAG blockchain for IoT authentication in 5G networks using Access Points	Quality of Service enhancement, decentralized trust	Improved performance and security metrics	Requires AP coordination	Depends on DAG protocol maturity	Integration with legacy networks	Backward-compatible protocol extensions

). In [267], Albaseer et al. presented a DL-based model with a Long Short-Term Memory Recurrent Neural Network (LSTM RNN) architecture as a method that addresses the vast amount of gathered data by log files and the limited smart grid devices’ capacity using deep-learning-based (DL) technology while combining weak labels to preserve their contribution during training. The experimental results show that it achieves 99.8% test accuracy while using only 25% of the features. In [268], Izzuddin et al. deployed a GridPot honeypot to collect threat data targeting the smart grid system. They analyzed the collected threat data by mapping them to the MITRE ATT&CK for the Industrial Control System (ICS) framework to show how real these threats can be at harming the smart grid. In [269], Rashid et al. deployed a scalable low-interaction honeypot in Amazon Elastic Compute Cloud (AWS EC2) instance across six different regions to determine the current threat landscape and the knowledge to compromise Industrial Control System (ICS). In [270], Lygerou et al. enhanced the HosTaGe honeypot specifically for IoT communication protocols over public networks for mobile Android devices. This protocol honeypot utilizes the cellular network to establish decentralized, simulated infrastructures of IoT systems across various types of IoT network protocols. The virtualized honeypot networks capture logs and analyze real-world public attacks on them. In [271], Albaseer et al. developed a privacy-preserving honeypot-based detector and cost-effective federated learning (FL) framework for efficient security model development, where two verification steps are required before forming the global model. In this model, the Traditional Power Retailers (TPRs) encourage the Small-scale Power Suppliers (SPSs) to share their collected honeypot logs by designing proper rewards. The extensive simulations show that the presented solution outperforms existing approaches. In [272], Auti et al. presented HoneyTrack as a lightweight and very efficient tool that can be easily and quickly installed in any system to help reach the roots of the attacker. The honeypot was set up in the Microsoft Azure cloud to monitor the attacks that targeted the authors’ server. The testing results show that companies can launch security policies based on the results of the HoneyTrack. In [273], Abdulqadder et al. proposed a Directed Acyclic Graph (DAG) blockchain architecture, where IoT mobile users in the 5G network are authenticated via the Access Points (APs). The experimental results show that this model outperforms existing QoS approaches, including bandwidth, response time, delay, packet loss, detection accuracy, and authentication time. To facilitate proactive threat intelligence and forensic investigation, honeypot solutions serve as decoys to deceive and track attackers without disclosing real smart grid assets. Placing honeypots within AMI to imitate vulnerable endpoints and record malicious activity without interfering with core operations is one popular deployment method.

7.3. Forensics Solutions

Smart grid forensics work on collecting, preserving, examining, and analyzing digital evidence retrieved or found during a security-related or non-security-related incident [274]. This also requires exploring communication logs, inspecting and isolating suspected devices, and analyzing network traffic to identify the cause of the incident and prevent future similar events [275] based on the newly developed strategies. As a result, several smart-grid-based forensics solutions were presented (see

Table 28. Smart grid forensic solutions and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2020	[276]	Forensics	Smart Grid Digital Forensics Investigation Framework supporting incidents like Stuxnet	Incident-based, forensic phase modeling	Tailored for smart grid cyber incidents	Scenario-based, may not generalize broadly	Complexity in full framework deployment	Adapting phases to dynamic attack surfaces	Automation and modular integration
2020	[277]	Forensics	Overview of CPS forensics and its approaches	High-level survey and conceptual frameworks	Lays foundation for CPS-specific investigations	Lacks implementation depth	Primarily theoretical	Bridging theory and practical deployment	Prototype development and testbeds
2017	[278]	Forensics	Statistical trust model for AMI data falsification detection	Trust modeling, probabilistic detection	High detection accuracy; modeled taxonomy	Requires statistical tuning	AMI-focused, less generalizable	Expanding to full grid monitoring	Broader smart grid adaptation
2019	[279]	Forensics	SDN-based forensic monitoring with NBA, DL, and DPI integration	Network-level defense, layered intelligence	Multi-modal security with forensic capabilities	Conceptual, lacks deployment results	Theory to practice gap	Real-world testbed and validation	End-to-end implementation
2019	[281]	Forensics	ISO/IEC 27043-based holistic framework with proactive, incident, and reactive phases	Standards-based, application-agnostic	Eliminates fragmented ad hoc approaches	May require customization for different domains	Initial setup complexity	Wide-scale smart grid adaptation	Domain-specific extensions
2019	[282]	Forensics	Logging framework ensuring forensic data legality using OSCAR and UK NCSC guidance	Legality-focused, structured logging	Supports court-admissible evidence	Log-centric, limited on real-time detection	Dependent on compliance tools	Ensuring traceability and integrity	Real-time log analysis integration
2020	[283]	Forensics	SPEAR framework enhancing awareness, attack detection, and evidence collection	Comprehensive situational awareness, privacy	Tailored for smart grid, enables secure sharing	System-wide coordination required	Early development stage	Full lifecycle validation	Operational deployment feedback loops
2021	[284]	Forensics	Hybrid blockchain-based forensic logging with access control and tamper resistance	Blockchain logs, encrypted access policies	Non-repudiation and log immutability	Blockchain maintenance overhead	Scalability in high-frequency logs	Balancing privacy and auditability	Adaptive block validation rates
2021	[285]	Forensics	Procedure for forensic investigation of DDoS and FDI attacks, ensuring legal admissibility	Legal compliance, integrity preservation	Court-admissible process workflow	Attack-specific scope	Reactive by design	Generalizing across threat models	Integrate real-time detection triggers

). In [276], Abdullah et al. conducted a study that sheds light on the development of the proposed Smart Grid Digital Forensics Investigation Framework to support digital forensics investigations, especially in cases like the Stuxnet attack, to identify the suitability of phases to be integrated in their framework. Mohamed et al. defined and discussed the emerging area of CPS forensics and reviewed some of its presented approaches in [277]. In [278], Bhattacharjee et al. presented a taxonomy of possible data falsification strategies in AMI micro-grids before presenting a trust model based on Kullback–Leibler divergence to identify compromised smart meters and additive and deductive attacks. The experimental results show this model has a high true-positive detection rate, with a false alarm rate of 8%. In [279], Parra et al. presented a conceptual Software-Defined Network (SDN)-based security monitoring framework that is based on SDN, Network Behavior Analysis (NBA), Deep Learning Models, and DPI attack corroboration, as well as a conceptual forensic-driven security monitoring framework with digital forensics and investigation capabilities being integrated for security monitoring. Sadineni et al. presented a holistic approach based on the ISO/IEC 27043 [280] international standard that covers the diverse application domains and eliminates the overhead of employing ad hoc models in [281]. The model has three forensics phases: forensic readiness (proactive), forensic initialization (incident), and forensic investigation (reactive), and it supports diverse Internet of Things applications. In [282], Kotsiuba et al. presented a logging architecture as a methodological framework based on the recommendations of the UK National Cyber Security Center and the result of applying the OSCAR methodology and relevant open-source tools to ensure the necessary collection and storage of forensics information, as well as the legality of evidence in courts. In [283], Grammatikis et al. presented the Secure and PrivatE smArt gRid (SPEAR) architecture to protect smart grids by enhancing situational awareness, detecting timely cyberattacks, collecting appropriate forensic evidence, and providing an anonymous cybersecurity information-sharing mechanism. In [284], Le et al. addressed data confidentiality by employing ciphertext-policy attribute-based encryption to establish a fine-grained log access control while introducing a hybrid blockchain system generating novel signature chains to achieve a private log protection system, loss prevention, tamper resistance, immutability, and non-repudiation. In [285], Abdullah et al. presented a digital procedure that guides investigators to perform digital forensic investigation against Distributed Denial of Service (DDoS) and False Data Injection (FDI) attacks, especially in a smart grid environment to ensure the evidence’s integrity during collection and analysis to be used as legal evidence in court. Cyber–physical attacks on smart grid systems can be investigated, traced, and linked with the help of forensics solutions, which facilitate post-event analysis and legal accountability. One practical scenario is the use of digital forensics in the event of a substation outage, where log data from network gateways and smart meters can be utilized to reconstruct the events and identify the source of the intrusion.

7.4. Ethical Hacking Solutions

In the context of smart grids, ethical hacking can play a crucial role in identifying vulnerabilities and security gaps/weaknesses in both systems and devices to help identify potential attack vectors and exploits that may jeopardize the safety and security of the smart grid domain (see

Table 29. Smart grid ethical hacking solutions and security approaches.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2021	[286]	Ethical Hacking	Framework with tools and scenarios for ethical hacking, including IoT use cases and red/blue team methodology	Penetration testing, role simulation, authorization emphasis	Realistic simulation of attacks and defenses; skill development	Requires high ethical and legal oversight	Not widely adopted in utility sectors	Formalizing and legalizing red/blue testing in smart grid contexts	Policy-driven frameworks and certification schemes
2013	[288]	Ethical Hacking	Security quantification and formal methods for AMI protocol with tool creation and testing	Formal verification, protocol analysis, tool design	Structured methodology for protocol testing	Protocol-specific adaptation	Focused only on AMI	Broader applicability to varied smart grid components	Extension to additional grid subsystems
2016	[289]	Ethical Hacking	Firmware and SCADA security testing for early vulnerability detection in IEDs	Stack-level analysis, proactive diagnostics	Early detection of firmware-level vulnerabilities	Limited to IEDs and SCADA	Firmware diversity hampers scalability	Maintaining up-to-date threat models	Integration with continuous firmware monitoring
2019	[290]	Ethical Hacking	Design of ISAAC testbed for smart grid cybersecurity with ML-based components	Testbed-based, CPS-oriented, machine learning ready	Comprehensive functional testbed for smart grid	High cost and complexity	Limited real-world deployment	Scalability and real-time simulation	Cloud-based testbed replication
2019	[291]	Ethical Hacking	Hardware intelligence gathering and hacking on grid equipment with hardening strategies	Hardware-level threat assessment and defense	Improves resilience at the physical layer	Requires physical access	Focused on specific hardware	Remote detection of hardware tampering	Remote attestation techniques
2021	[292]	Ethical Hacking	Integrated smart inverter testing platform to increase test efficiency and reduce manual errors	Platform-based automation, inverter-centric	Boosts test coverage and accuracy	Inverter-specific utility	Niche scope within grid testing	Platform extensibility for wider use	Modular plug-in design
2023	[293]	Ethical Hacking	Penetration testing on 22 connected home devices with discovery of multiple CVEs	Systematic vulnerability analysis, CVE disclosure	Comprehensive vulnerability identification	Home-focused, not grid-specific	Relevance to utility-grade devices	Translation of home findings to grid domain	Smart grid-specific device testing protocols

). A recent ethical hackers framework was presented in [286], including tools and scenarios/situations, especially surrounding the IoT domain [287], and can be adapted to the context of smart grids. However, ethical hacking must be conducted in an authorized, responsible, professional, safe, and legal manner, especially when applying the “Red Team/Blue Team” solution that divides the penetration testing scenario into a red team serving as attackers and a blue team serving as defenders.

As critical as this domain is for smart grids, there are not many available solutions dedicated to solving this issue. Yardley et al. [288] presented a case study that works on quantification of security, formal methods, and tool creation before testing it on the AMI protocol space to prove its effectiveness. In [289], Weerathunga et al. focused on the Intelligent Electronic Device (IED) firmware system security testing to ensure early vulnerability detection that surrounds the IED communication stack and Supervisory Control and Data Acquisition (SCADA) applications. Moreover, good security practices in design and coding were also discussed. In [290], Oyewumi et al. presented the design of ISAAC, the Idaho CPS Smart Grid Cybersecurity Testbed, with several fully functional components with machine learning capabilities for CPS. In [291], Konstantinou et al. discussed how the hardware of grid equipment can be used to collect intelligence using different attack and access scenarios while examining the outcome of “hardware hacking” at device and grid operation levels. Hardware hardening techniques were also presented to make components attack-resistant and reduce their vulnerability surface. In [292], Hashimoto et al. presented the design and implementation of an integrated testing platform, where several smart inverter behavior tests were executed with results showing that this platform increases the system testing efficiency by 85% while minimizing human errors and man-hours. In [293], Heiding et al. conducted the most comprehensive study on penetration testing of connected household products, where systematic penetration tests were conducted on 22 devices in five categories related to connected homes. As a result, 17 vulnerabilities were discovered and published as new Common Vulnerabilities and Exposures (CVEs), with 52 other weaknesses.

Authorized simulated attacks on smart grid infrastructure are used in ethical hacking to find security flaws before any adversary can take advantage of them. Penetration testers can, for example, simulate an insider trying to increase privileges within the SCADA network, assisting services in locating incorrectly installed access controls and fixing serious security holes and vulnerabilities.

It is important to know that despite being popular in IT security, direct application of penetration testing and ethical hacking in OT environments, particularly legacy systems, can be dangerous and even detrimental. Since OT systems are frequently mission-critical, they are not built to withstand stress-testing or active probing methods, which could cause unanticipated failures or outages. Therefore, such testing needs to be done very carefully in smart grid contexts, ideally using digital twins, testbeds, or replicated environments instead of operational systems. Live penetration testing is not suitable for the majority of OT infrastructures due to the potential for financial losses or disruption of critical services. Key security challenges and mitigation strategies in OT-based smart grid environments are presented in

Table 30. Security challenges and mitigation strategies in OT-based smart grid environments.

Aspect	Challenge Description	Impact in OT/Smart Grid	Mitigation Strategy
Legacy Device Integration	Many legacy systems lack support for modern cryptographic techniques or remote update capabilities	Increased vulnerability due to inability to patch or apply modern security standards	Use of protocol wrappers, secure gateways, and segmentation of legacy devices from critical systems
Human Element	Human error, lack of training, and social engineering attacks remain a common attack vector	Misconfigurations, phishing, or physical access compromises leading to potential system failures	Implement ongoing cybersecurity training, role-based access control, and insider threat monitoring programs
Penetration Testing Risks	Traditional penetration testing can cause system crashes in fragile OT systems	Unexpected service disruptions, equipment failures, and operational/financial losses	Perform security assessments in testbeds, use digital twins or simulations instead of live system testing
System Resilience	OT systems are not built for resilience against aggressive scans or tests	Even minor testing can lead to outages or degraded performance	Adopt non-intrusive monitoring tools, anomaly detection, and passive scanning
Operational Sensitivity	Downtime in OT systems, even brief, can lead to cascading failures or significant financial loss	Grid instability, energy distribution disruption, or failure to meet SLA requirements	Plan maintenance windows, leverage redundancy, and test recovery processes during simulations

.

7.5. GAN and LLM-Based Solutions

Generative adversarial networks (GANs) play a key role in enhancing smart grid security by enabling the encryption and concealment of confidential energy data usage within cover images to safeguard consumer privacy and data integrity. As a result, several solutions were presented (see

Table 31. GANs and LLMs in smart grid security.

Year	Ref.	Type	Description	Characteristics	Advantages	Drawbacks	Limitations	Challenges	Improvements
2018	[294]	GAN	Synthetic dataset generation using deep GANs based on real conditional probability distributions	Data-driven learning, conditional sampling	Boosts small dataset size, indistinguishable from real data in task performance	May replicate data biases	Dependent on quality/diversity of original dataset	Preventing misuse for adversarial attacks	Bias filtering and adversarial misuse prevention layers
2022	[295]	GAN	Synthetic data generation, energy-conserving, fine-grained control	Synthetic data generation, energy-conserving, fine-grained control	Preserves privacy in smart meter data without major data loss	Potential loss of minor data details	Limited to time series data scenarios	Maintaining realism in generated data	Improved calibration to match real-world power fluctuation profiles
2023	[296]	GAN	Encrypted data embedded into images using GAN to enhance confidentiality	Encryption and steganography using GANs	Dual-layer security (encryption and hiding)	Higher computational complexity	Image-based cover requirement	Balancing data fidelity and concealment	Lightweight encryption algorithms to reduce overhead
2023	[297]	GAN	Explores GANs for load forecasting, outage prediction, and preventive maintenance	Supports proactive grid operations	Predictive modeling using generative learning	Needs large historical datasets	Dependent on data variety and quality	Training stability and convergence	Hybrid GAN models with statistical smoothing
2024	[298]	GAN/Zero-Trust	Zero-trust PGSC framework using GANs with tail-risk metrics to detect GenAI-driven attacks	GenAI attack simulation and detection, tail-risk scoring	95.7% detection accuracy, 99% defence confidence	May be overfitted to specific attack types	Requires continuous model updates	Maintaining adaptability to new threats	Online learning enhancements and dynamic model retraining
2023	[299]	LLM	AI and analytics framework for automating software development in smart grids	AI-generated solutions, business integration	Faster development, monetization potential	Reliance on pretrained general-purpose models	Software code generality and domain fit	Domain-specific language understanding	Custom fine-tuning on smart grid datasets
2023	[300]	LLM	Cybersecurity anomaly detection in substations using LLMs and HITL training	IEC 61850, HITL, HIL testbed	Robust detection via LLM-HITL synergy	High setup complexity and training cost	Dependent on annotated datasets	Real-time inference speed	Edge-optimized LLM variants
2024	[301]	LLM	Introduces Sasha: LLM-based smart home automation assistant for user-driven routines	Conversational automation, user intent parsing	Flexible and intuitive control	Ambiguity in loosely defined commands	Context retention and behaviour prediction	Natural language variability	Context-aware memory models
2024	[302]	LLM	Explores LLMs’ role in energy sector ops and research directions	Evaluation of capabilities and safety-critical use cases	Insightful operational recommendations	High compute resource requirements	Generalization to energy-specific queries	System integration and trust	Power-domain tool embedding
2024	[303]	LLM	Analyzes potential LLM security risks in power systems	Threat assessment and countermeasure proposals	Proactive defense framework	Preemptive focus may miss emerging attacks	Uncertainty in threat modeling	Rapid evolution of LLM-based exploits	Real-time red-teaming and adaptive defences

). In [294], Zhang et al. presented a novel data-driven approach to synthetic dataset generation using deep GAN. This method generates synthetic samples that closely resemble real data by learning the conditional probability distribution of essential features from real datasets. The e valuation results demonstrated a convergence between real and synthetic datasets, showing that it is indistinguishable from real data in terms of task outputs. These solutions can be used to increase the size of the dataset (in the case of a small dataset) and retrain the model to enhance its performance. On the other hand, attackers can also use these solutions to construct adversarial samples that can be used to compromise ML cybersecurity solutions.

In [295], Desai et al. presented a privacy-preserving architecture for fine-grained power data in smart grids using GANs and an obfuscator to generate synthetic time series with minimal energy difference. Therefore, it effectively addresses consumer privacy concerns in the context of smart meter data. In [296], Himthani et al. presented a method where data encryption is followed by embedding encrypted data into cover images using a GAN to enhance data security by concealing confidential information. In [297], Ezgi presented a study to investigate the transformative potential of generative artificial intelligence, particularly GANs, in addressing challenges related to load forecasting, power outage prediction, and preventive maintenance within electricity distribution companies. In [298], Munir et al. presented a novel zero-trust framework for a Power Grid Supply Chain (PGSC), which facilitates early detection of potential GenAI-driven attack vectors. Tail-based risk metrics were also introduced to quantify the risks associated with extreme attacks. The efficacy of this zero trust framework achieves 95.7% accuracy in attack generation and 99% confidence in defense against GenAI-driven attacks.

The use of LLMs offers significant potential benefits for enhancing cybersecurity in smart grid security and is proposed to enhance automated threat detection, incident response/decision-making, vulnerability management, and operational efficiency. However, they also present challenges related to data sensitivity, resource requirements, interpretability, and ethical considerations (see

Table 32. Advantages and limitations of LLMs for smart grid security.

Aspect	Advantages	Limitations
Threat Detection and Analysis	Analyze vast amounts of data to identify potential threats and anomalies. Process security reports, threat intelligence feeds, and text-based data.	Resource-Intensive: Requires significant computational resources for training and deployment. Hard Interpreting: Interpreting and validating results can be challenging. Maintenance: Needs regular updates and maintenance. False Positives/Negatives: Risk of incorrect detection, which can undermine effectiveness. Large Dataset: Training requires large datasets that may include sensitive information. Bias and Accuracy: Can inherit biases from training data. Data Breaches: Improperly secured data can be targeted by attackers. Misuse Potential: Can be used to generate harmful content like deepfakes. Ethical Considerations: Ensuring fairness and preventing misuse. Black Box Nature: Lack of transparency in decision-making processes. Interpretability: Decision-making processes are not easily interpretable. Accountability: Challenges in regulated industries where understanding decision processes is crucial.
Incident Response	Automated Responses: Generate responses to detected threats, reducing response times and selecting optimal decisions. Incident Triage: Assist in prioritizing incidents based on severity and potential impact.
Vulnerability Management	Predictive Analysis: Predict potential vulnerabilities and exploit trends. Patch Management: Recommend patches and updates.
Security Automation	Automate repetitive security tasks. Develop and update incident response playbooks.
User Training and Awareness	Phishing Detection: Create realistic phishing simulations. Educational Content: Generate training materials and FAQs.
Data Privacy and Compliance	Policy Analysis: Ensure adherence to data privacy regulations. Automated Reporting: Generate compliance reports.

). Balancing these advantages and limitations is crucial for effectively leveraging LLMs in cybersecurity. Hence, several potential solutions are presented. In [299], Shahzad et al. presented a new framework using AI and advanced data analytics for automated solution development in smart grids, aiming to streamline the software development process, capitalize on recent advancements in AI technologies, and generate revenue through various business models. In [300], Zaboli et al. introduced a novel cybersecurity framework using LLMs to detect anomalies in IEC 61850-based digital substation communications, incorporating data pre-processing and Human-In-The-Loop (HITL) training, with comparative analysis conducted across various LLMs using a Hardware-In-The-Loop (HIL) testbed to evaluate performance metrics. In [301], King et al. introduced LLMs to create automation routines in response to loosely constrained user commands, proposing Sasha, a smarter smart home assistant, to address these challenges. In [302], Dong et al. highlighted the necessity to explore both capabilities and limitations of LLMs in enhancing the electric energy sector’s operations, identifying key research directions such as fine-tuning data collection systems, embedding power system-specific tools to improve LLM responses, and safety-critical use cases. In [303], Ruan et al. examined the potential security threats associated with applying LLM in modern power systems for proactive research and development of countermeasures to mitigate these threats and safeguard operational integrity. Based on the presented solutions, many lessons can be deduced and learned. These lessons are presented in the next section in full detail. In smart grid settings, GANs and LLMs provide sophisticated capabilities for both attack simulation and defense augmentation. For instance, LLMs can automate threat intelligence by examining security records and generating alerts or action plans that are accessible by humans, while GANs can be used to generate adversarial scenarios for training anomaly detectors.

In-Depth Analysis of GAN and LLM-Based Solutions

An in-depth analysis of GAN and LLM-based solutions for smart grid security is presented in this paragraph (see

Table 33. Comparative overview of GAN and LLM applications in smart grid security.

Aspect	GANs (Generative Adversarial Networks)	LLMs
Primary Use Cases	Synthetic attack data generation, anomaly simulation, and data augmentation for IDS	Threat log analysis, automated incident response, and policy summarization and retrieval
Advantages	Helps train models with limited real attack data, reveals blind spots via adversarial testing	Learns from diverse, unstructured data, enables real-time, context-aware decision support
Model Input	Numerical/time-series telemetry, and network traffic data	Text-based logs, configuration files, and incident documentation
Challenges	Requires stable training, risk of generating unrealistic or biased samples, and needs task-specific adaptation (e.g., TimeGAN)	High inference cost, risk of hallucinations, and needs domain adaptation and prompt tuning
Deployment Consideration Tables	Typically used offline for training IDS or simulators	Needs lightweight variants for edge/real-time use (e.g., quantized or distilled models)
Potential Integration	Enhancing IDS through adversarial robustness testing	Assisting operators in decision-making and reporting tasks

).

For GAN-based solutions, the lack of labeled attack data is one of the main obstacles to training security models for smart grids. GANs can provide synthetic but realistic cyberattack samples to supplement constrained datasets, allowing for more robust and generalizable IDSs training. GANs can model adversarial methods to mimic adaptive or covert attack behaviors. These adversarial scenarios help in exposing hidden weaknesses in security procedures and stress-testing current defensive mechanisms. Mode collapse and training instability are well known to affect GAN models. Customized architectures, such as TimeGAN or conditional GANs, are needed to apply them to smart grid data, which frequently consists of time-series telemetry and operational logs. To prevent overfitting or the introduction of noise, the synthetic data must also be assessed for realism and diversity.

For LLM-based solutions, LLMs provide a strong basis for real-time danger analysis, policy creation, and intelligent monitoring in smart grid settings. They are used for automation and decision support in addition to general NLP activities. LLMs are able to analyze both structured and unstructured SCADA system records, spot unusual operator behavior patterns, and provide corrective measures. They are ideal for changing threat environments due to their zero-shot and few-shot learning capabilities. LLMs can help with real-time diagnostics and reaction generation during security events by being trained or refined on domain-specific corpora, such as utility laws, incident response manuals, and cybersecurity best practices. LLMs can help with real-time diagnostics and reaction generation during security events by being trained or refined on domain-specific databases, such as utility laws, incident response manuals, and cybersecurity best practices. Despite its potential, latency, interpretability, and data privacy are among the key implementation challenges that LLMs must overcome in real-time smart grid systems. For edge deployment, lighter or more condensed versions (such as LoRa or quantized models) might be more useful. To adjust to evolving grid designs and threat profiles, attentive prompt engineering and frequent retraining are also necessary.

For combined use, a hybrid GAN-LLM strategy might be particularly effective. While GANs create artificial attack scenarios, LLMs assess and interpret them for downstream automation pipelines or human operators. Proactive defense, improved situational awareness, and semi-autonomous response mechanisms are all supported by this confluence. Utilities may advance towards more intelligent, flexible, and robust cybersecurity infrastructures by integrating these AI-driven models into the smart grid ecosystem. Stakeholder cooperation, domain-specific adjustments, and thorough validation are necessary to guide their integration.

8. Proposed Framework: Multi-Layer Threat-Defense Alignment Framework

In contrast to earlier research that mainly lists smart grid defenses and attacks without providing a cohesive viewpoint, this study presents the MLTDAF. This approach enables comprehensive and proactive security planning for smart grid infrastructures by mapping physical and cyber threats to corresponding architectural layers and suggesting customized defense methods. This enhances the state of the art.

8.1. Layered Smart Grid Architecture

Five logical layers will make up the smart grid, each with a distinct threat surface and functional role:

• Perception Layer: Is made up of data-gathering actuators, smart meters, and Internet of Things sensors.
• Network Layer: Is made up of gateways, routing systems, and communication protocols.
• Control Layer: Includes Programmable Logical Controllers (PLCs), backend controllers, and Supervisory Control and Data Acquisition (SCADA) systems for automation and decision-making.
• Application Layer: Makes user-facing services like demand response, billing, and analytics on energy use possible.
• Management Layer: Provides governance, auditing, and general security and policy enforcement.

8.2. Threat and Defense Mapping

Every architectural layer is vulnerable to different threats. The primary threats and suitable countermeasures for each tier are listed in

Table 34. Layer-based threat-defense mapping.

Smart Grid Layer	Primary Threats	Defensive Mechanisms
Perception	Physical tampering, sensor spoofing, FDIAs	Tamper-resistant hardware, ML-based anomaly detection, hardware encryption
Network	DoS/DDoS, eavesdropping, jamming	SDN-based intrusion detection, traffic shaping, redundant topologies
Control	Malware, command injection, timing attacks	Patch management, real-time behavioral analysis, integrity monitoring
Application	Data breaches, unauthorized access, phishing	Role-based access control (RBAC), Two-Factor Authentication (2FA), LLM-based anomaly detection
Management	Insider threats, misconfigurations, policy bypass	Zero-trust architecture, continuous auditing, behavioral biometrics

.

8.3. MLTDAF Contributions

The MLTDAF framework provides several unique features:

• Cross-Layer Integration: This framework methodically matches threats with the smart grid’s architectural makeup in contrast to other taxonomies that concentrate on specific attack types.
• Strategic Risk Management: By connecting the threat landscape to vital system operations, strategic risk management enables the allocation of security resources in a prioritized manner.
• Scalability and Flexibility: These facilitate ongoing adaptation by allowing for modular upgrades that take into account new attack methods and defense strategies.

The MLTDAF paradigm can be used in both brownfield (new infrastructure) and greenfield (existing infrastructure) smart grid deployments due to its modular versatility. Its multilayered architecture facilitates plug-in compatibility with third-party intrusion detection, anomaly detection, and encrypted communication layers, as well as integration with current SCADA security regulations. However, interoperability standards such as IEEE 2030 and IEC 61850, as well as the financial and training limitations that utility companies confront, must be taken into account in real-world applications.

8.4. Applications of MLTDAF in Counter-Terrorism

Due to their continued importance in national infrastructure, smart grids are now frequently the target of hybrid warfare and cyber-terrorism. Cyber-criminals, state-sponsored organizations, and terrorist organizations are among the malicious actors who aim to interfere with energy supply systems to cause fear, financial harm, or political influence. A strong defense paradigm designed for such high-impact threats is provided by the MLTDAF proposed in this study (see

Table 35. Summary of counter-terrorism benefits.

Objective	MLTDAF Benefit
Prevent terrorist access	Layered defense, strong authentication
Detect covert operations	Behavioral monitoring, ML-driven detection
Protect against hybrid attacks	Combined physical–cyber safeguards
Enhance response to attacks	Layer-specific contingency and incident plans
Guide strategic infrastructure policy	Prioritization of critical components and investments

).

8.4.1. Layered Defense Against Hybrid Terrorist Attacks

Proactive security hardening is made possible by MLTDAF’s alignment of physical and cyber threats to architectural layers. Terrorist actors might combine cyber incursions (such as fake data injection attacks) with physical disruption (like shutting down substations). In addition to offering countermeasures such as tamper-proof hardware at the perception layer and real-time behavioral analysis in the control layer, MLTDAF assists security teams in determining which layer is being targeted. This enables the implementation of a distributed defense plan that reduces grid-wide outages and cascade failures.

8.4.2. Enhancing Threat Detection and Early Warning

One of the key aspects of counter-terrorism is the timely identification of threats. MLTDAF integrates advanced detection mechanisms, including machine-learning-based anomaly detection and SDN-supported traffic monitoring, which are vital in detecting covert or Advanced Persistent Threats (APTs). For example, coordinated zero-day attacks or GPS spoofing attempts can be rapidly identified by mapping irregularities to the Control Layer, enabling swift mitigation.

8.4.3. Supporting Incident Response and Recovery Planning

Early threat detection is one of the most crucial components of counter-terrorism. To identify covert or Advanced Persistent Threats (APTs), MLTDAF incorporates sophisticated detection techniques, including anomaly detection based on machine learning and traffic monitoring supported by Software-Defined Networking (SDN). By mapping anomalies to the Control Layer, for instance, coordinated zero-day attacks or GPS spoofing attempts can be quickly detected and mitigated.

8.4.4. Enabling Policy-Level Counter-Terrorism Strategy

The modularity of the framework enables the creation of contingency procedures tailored to individual layers. MLTDAF enables the design of robust incident response tactics by providing insight into the propagation of specific attacks (such as malware insertion, jamming, or Sybil attacks) throughout the system. Layer-level vulnerability evaluations enable counter-terrorism units and infrastructure operators to allocate resources more effectively, practice emergency responses, and simulate attack scenarios.

8.4.5. Theoretical Approach

The suggested architecture is a multi-layered procedure that starts with edge-level data collecting from both IT and OT devices. AI/ML models are then used to preprocess and analyze this data, identifying abnormalities and correlating events from various sources. Following the identification of an anomaly, alerts are ranked and routed to a response coordination module, which, depending on the type of incident, either escalates the issue to the relevant Security Operations Center (SOC) or OT security teams or automates the mitigation procedure.

Despite still being theoretical, this approach will be further developed and defined in future work to ensure it is adopted as an effective countermeasure that can be used to thwart terrorist attacks, offering early detection and effective, robust, and sophisticated security measures and countermeasures against attacks targeting each layer. MLTDAF aims to be operated by a network of actors at many layers. OT security specialists focus on control-level events in SCADA and substations, while IT SOC personnel manage alerts at the enterprise and communication layers. AI-based support tools help reduce false positives and improve incident classification, while human analysts handle high-risk response decisions and facilitate cross-domain collaboration.

8.4.6. Analytical Comparison

This analytical comparison is based on design goals and is compared with the design goals and theoretical capabilities of a traditional Security Information and Event Management (SIEM). A qualitative comparison between the suggested framework and traditional SIEM systems is shown in

Table 36. Comparative analysis: MLTDAF framework vs. traditional SIEM.

Feature	Proposed MLTDAF Framework	Traditional SIEM
Scope	Unified IT–OT–DER coverage, suitable for smart grid environments	Primarily IT-focused, limited OT visibility
Detection Approach	ML-based dynamic anomaly detection with adaptive learning	Signature-based or rule-driven, less adaptive
Real-Time Response	Yes, by including automated alert classification and tiered prioritization	Often delayed, depends on manual analyst triage
Mapping to SGAM	Designed to align across all layers: Component, Communication, Information, Function, and Business	Usually focused on Information and Function layers only
Scalability	Architected to scale across distributed grid nodes and edge devices	Centralized processing may bottleneck in large-scale grid setups
Domain Coverage	High: Includes DERs, legacy systems, IoT edge, smart meters	Low to moderate; lacks embedded support for DERs or grid-specific assets
Privacy-Awareness	Supports pseudonymization and local anomaly processing before cloud transfer	Rarely considers privacy, centralized logging risks data exposure
Latency Tolerance	Low latency design with support for edge and fog computing nodes	Higher latency due to batch processing and central correlation
Human-In-The-Loop	SOC operators, OT engineers, and AI co-pilots in loop with adjustable oversight	Analysts play a reactive role; no domain-specific operational feedback loop
Resilience to Legacy Devices	Incorporates wrappers and proxies for devices lacking native security support	Legacy device integration rarely addressed

. Traditional SIEMs are still useful in IT settings. However, they frequently do not support OT, DER, and older equipment in smart grids. This gap is filled by the suggested architecture, which integrates ML-driven, privacy-aware, and low-latency features with full SGAM-layer alignment and support for both centralized and decentralized grid domains.

8.4.7. Ongoing and Future Work Statements

MLTDAF will be functioning as an overlay on top of current SCADA systems in a real-world utility environment, enhancing them with threat detection and response capabilities without compromising operational safety. The structure of MLTDAF may be mapped to the operational levels of the Purdue model, ranging from field to enterprise, and is made to be flexible enough to accommodate both the horizontal and vertical layers of SGAM. This human–machine teaming approach should be vital in counter-terrorism scenarios, where early detection, coordinated response, and layered visibility can prevent cascading disruptions or targeted physical–cyberattacks on critical infrastructure. Overall, this paper presents a conceptual framework. The future work will include implementing the architecture in a testbed environment and benchmarking it against conventional SIEM solutions using real smart grid data.

9. Lessons Learned, Suggestions, and Recommendations

The integration of smart grids within IoT’s framework has underscored the necessity for robust security and safety measures to ensure the resilience and efficiency of the grid. These lessons learned emphasize the importance of adopting lightweight, real-time techniques to mitigate both safety and security-related threats, which are presented next.

9.1. Lessons Learned

Here are some security lessons that have been learned from existing security breaches against smart grid systems and must be respected and adopted as a way to ensure safer and more secure smart grid systems for IoT domains:

• Risk Management: This is essential for smart grid systems to reduce both the occurrence and likelihood of that risk occurring. Hence, several key points are presented to mitigate it. Active Incident Response: This necessitates continuous observation of vital smart grid systems to identify possible security breaches and start an operational incident response plan to react immediately to a security issue or incident. Validation Testing: This is to identify and address the vulnerabilities surrounding the smart grid system components before exploitation. This can be done by relying on vulnerability scanning and penetration testing. Enhanced Risk Management Plans: These are based on constant risk assessments being regularly conducted to develop enhanced risk management plans to mitigate identified risks using cryptography and non-cryptography-based measures, as well as technical (i.e., monitoring and access control) and non-technical controls (i.e., policies, standards, and incident response).
• Cyber–Physical Threat Intelligence: CTI requires constant gathering, analysis, and sharing of information related to cyber threats with a potential impact to intentionally damage the infrastructure of the smart grid and interrupt its operations. This is frequently achieved by monitoring and evaluating threat intelligence data to identify and recognize new threats and weaknesses and then addressing them with proactive security measures. This move cannot be achieved without understanding the interdependencies between the smart grid’s cyber and physical aspects. Security and Safety Awareness Training: This is especially for users and operators to protect the smart grid systems to avoid risky behaviors, overcome phishing and social and reverse engineering, and raise situational awareness training, encouragement training, and accountability. This requires being aware of how to identify and report suspicious activity, protect sensitive data, and respond to a security incident. Enhanced Physical Security: Examples include tamper-resistant equipment, access control, surveillance, and secure storage to thwart theft, vandalism, and sabotage. Mitigating Insider Threats: Threats may be mitigated by, e.g., adopting security measures that limit access privileges, offering timed access control, training employees on security best practices, and monitoring smart grid systems, networks, and devices for any suspicious activities before initiating an incident response reaction. Securing Logistics and Supply Chains: This is to avoid exploiting hardware and software vulnerabilities, with smart grid systems being tampered with or compromised. This requires obtaining verified software components and equipment from trusted vendors before validating and testing them before integrating them into the smart grid system.

Figure 7 summarizes future directions, lessons learned, suggestions, and recommendations.

9.2. Suggestions and Recommendations

Ensuring the smart grid’s critical system safety and security [216,304] is necessary to keep a safe environment for users and operators. In the following, a set of recommendations necessary to ensure secure smart grid systems at different levels, such as the use of cryptographic solutions to ensure secure communication and secure data storage and processing in addition to segment network and the use of ethical hacking and digital forensics to reinforce security and safety of smart grid systems.

9.2.1. Cryptographic Suggestions

These suggestions include secure communication as it is a key component that enables smart grid components to communicate with each other. It is essential to present different robust security measures to maintain the necessary level of communication efficiency, safety, security, and performance. This also includes secure data availability in transit and at rest as smart grid data integrity and confidentiality are ensured by secure data availability, which is achieved through robust data handling protocols and encryption. Robust cryptographic techniques encrypt data as it is transmitted, guarding against unwanted access and alteration. Data is safeguarded from unauthorized access and tampering while at rest by being stored in secure environments with access controls, which preserves the confidentiality and integrity of smart grid activities. Moreover, it includes a multi-factor authentication protocol by enforcing users to submit two or more verification factors, such as combining their identity (biometric scan) with their smart card or token (smart card), or something they know (password), which increases the security of smart grids. These protocols are known as multi-factor authentication (MFA) protocols. This method enhances authentication integrity against cyberattacks targeting smart grid infrastructure while reducing the likelihood of unauthorized access.

9.2.2. Network Segmentation for Smart Grids

Network segmentation is a critical strategy for enhancing the security and resilience of smart grids by dividing the network into smaller, isolated segments or zones. This approach limits the spread of potential cyberattacks and confines breaches to a single segment, preventing lateral movement across the entire network. Each segment can be tailored with specific security policies and controls that address that zone’s unique needs and vulnerabilities. The effect of cyberattacks and unauthorized access is reduced by separating critical assets, such as data centers and control systems, from less vulnerable areas, including administrative networks. This strategy protects the availability and integrity of smart grid operations by narrowing the attack surface, tightening access constraints, and facilitating more targeted monitoring and response capabilities inside each segmented zone.

9.2.3. Advanced Ethical Hacking and Digital Forensics

Forensics is essential when it comes to testing and assessing the security level of a smart grid. Therefore, several measures could be adopted, such as employing advanced techniques of digital forensics and ethical hacking.

(A)

Employing Digital Forensics After Incident: To maintain the efficiency, security, and safety of smart grid systems, digital forensics tactics must be integrated. This is because they can make it possible to identify attack vectors and their source [305]. This is particularly important since, in addition to the vulnerabilities that currently exist in ML and DL, the system can be compromised at the client device, centralized server, or network levels [274,275]. Using digital forensics in the wake of a cyber incident involving smart grids requires carefully gathering and examining data from compromised systems to identify the attack vector, assess the size of the breach, and ascertain the techniques used by the attackers. This approach is essential to reconstructing the incident timeline, preserving evidence for use in court, and guiding future security measures aimed at averting recurrence and enhancing the overall resilience of the grid.

(B)

Employing Periodic Ethical Hacking: Since clients, servers, and network devices are vulnerable to various attacks, smart grid systems must periodically rely on ethical hacking techniques and tools [286] to identify potential vulnerabilities and suggest appropriate countermeasures to guarantee a higher level of security and privacy preservation. Since the selected client or server devices’ data samples are incorporated in the model training process, this technique can identify whether or not they are susceptible to attacks or can be compromised. As a result, intentional damage can also be achieved, aside from information leakage, while exposing the privacy of the training dataset. Therefore, to find and address any exploitable weakness or security gap, the security of every smart grid system component needs to be addressed and evaluated.

When authorized security professionals use simulated cyberattacks to periodically probe the smart grid’s communication network for vulnerabilities, they can find possible gaps in smart grids before hostile actors can exploit them. This technique is known as periodic ethical hacking. Through constant evaluation and enhancement of the grid’s security posture, this proactive strategy guarantees improved defense mechanisms and overall system robustness against changing threats. Enhancing smart grid security involves adopting a segmentation process to isolate critical components and mitigate potential malware attacks like worms and Trojans. Regular updates and patching across smart grid applications, software, firmware, middleware, devices, and hardware ensure ongoing resilience against emerging threats. Effective third-party management is essential as it verifies the security practices of external entities accessing smart grid systems, such as cloud storage or data analytics, to uphold stringent security standards and mitigate risks associated with external access.

9.2.4. Implementing Strong Security Measures

Deploying robust monitoring systems (i.e., IDS and Honeypots), securing remote access using advanced access controls and authorization, and using Virtual Private Networks (VPNs) to connect securely without compromising the system’s integrity [222]. This includes cybersecurity measures such as AI and physical security solutions in addition to dynamic honeypots.

(A)

Adopting the Security-by-Design Concept: This involves adding security to the smart grid system’s design while adopting a defense-in-depth strategy that deploys multiple security control layers to provide resiliency and robustness against potential cyber–physical attacks.

(B)

AI Solutions for Cybersecurity: Through constant analysis of enormous volumes of data, artificial intelligence (AI) technologies improve cybersecurity in smart grids by quickly identifying anomalies and possible threats. By adjusting to changing assault tactics, machine learning algorithms can increase the precision and speed of threat identification. AI also automates incident response, reducing risks quickly and effectively to preserve smart grid infrastructure security and resilience against sophisticated cyberattacks. Therefore, employing advanced machine learning and reinforcement learning safety and security measures in addition to federated learning [242] approaches to develop efficient solutions can quickly recognize, identify, and address abnormalities.

(C)

Enhanced Physical Security. This step is recommended for smart grid hardware components, including antennas, grids, substations, and other critical infrastructure. In other words, to safeguard vital infrastructure from both digital and physical threats, smart grids must integrate powerful encryption, firewalls, and intrusion detection systems with physical barriers, surveillance, and access controls. This all-encompassing security plan reduces risks and strengthens resilience against possible incidents while guaranteeing the grid’s availability, integrity, and confidentiality.

(D)

Dynamic Honeypots: To ensure a greater level of safeguarded deceptive technology that will be able to increase the detection level with a higher level of engagement, honeypots should be deployed at the client’s end or the centralized server with the dynamic variable selection of vulnerabilities. This makes it possible to gather and evaluate real-time information about the attacker more rapidly and precisely. To attract and identify malicious actors and their techniques and proactively strengthen the defensive mechanisms of the smart grid, honeypots are deliberately placed to mimic susceptible components. This strategy not only offers early-warning signals and real-time threat intelligence but also deters attackers from targeting important assets, enabling thorough forensic investigation and increased defense against cyber attacks.

9.2.5. Physical Security Measures for Smart Grids

This type of security measure requires implementing robust physical security measures and is essential for protecting the infrastructure of smart grids from unauthorized access, vandalism, and other physical threats. This involves securing critical components such as power plants, substations, and control centers with a combination of security technologies and practices. Smart grid physical security measures include a range of tactics to defend assets and infrastructure against external attacks. At substations, control centers, and other critical facilities, perimeter fences, security cameras, access control systems, and intrusion detection sensors are required. Using strong locks, alarms, and physical obstacles also improves safeguards against tampering and unwanted access. By reducing vulnerabilities, preventing intrusions, and guaranteeing the continuous operation of smart grid components, these precautions protect against physical attacks and guarantee the dependability of energy distribution networks.

9.2.6. Regular Vulnerability Assessment and Risk Monitoring

This method is crucial for ensuring smart grid security. This involves conducting penetration testing and simulating attack scenarios to evaluate security levels and response capabilities. It also requires implementing risk management measures to mitigate identified threats through various security countermeasures. Constant testing of smart grid systems through vulnerability assessments, penetration testing, log monitoring, and advanced threat modeling helps identify and address emerging security risks promptly and effectively. These practices are essential for maintaining the resilience and security of smart grid infrastructure against evolving cyber threats. This also requires enhancing control access and accountability in addition to regulatory compliance, which is described in the following:

(A)

Enhancing Control Access and Accountability. This step is needed to enhance accountability methods through deterrence policies, and limiting access for various users (i.e., attribute control access schemes) is crucial to reducing internal threats and fostering a safe and trustworthy environment. It also requires motivating all entities, boosting confidence, and discouraging bad actors. It also promotes the accountability of users and the ability to disclose any suspicious behavior or illegal activity quickly.

(B)

Regulatory Compliance. Compliance is also needed to enhance the cyber–physical security and safety of the smart grid critical infrastructure, such as the Critical Infrastructure Protection (CIP) and North American Electric Reliability Corporation (NERC) standards, the IEC 62351 standards series [306,307], and the NIST Framework [17]. In other terms, strict authentication procedures and granular access controls must be implemented to guarantee that only authorized individuals can interact with vital systems to improve control access and accountability in smart grids. This strategy guarantees traceability and accountability in conjunction with thorough logging and monitoring of user actions. It lowers the possibility of illegal access and facilitates quick incident response and forensic investigations.

9.2.7. Universal Collaboration

Government agencies and cybersecurity groups must collaborate universally to provide effective smart grid security. As part of this collaboration, information is continuously shared for threat intelligence analysis and developing best practices for smart grid system security. It also requires researching new technologies, such as edge computing and 5G, particularly in relation to smart grid security, and evaluating how security measures impact system performance. Furthermore, resilience research concentrates on protecting vital smart grid infrastructure against terrorism, natural disasters, armed conflict, and other possible threats (i.e., military operations or acts of terrorism). This also includes user education and training for smart grids. However, improving cybersecurity resilience for smart grids requires user education and training. This entails educating employees and other relevant parties on cybersecurity best practices, such as creating and maintaining secure passwords, recognizing phishing scams, and promptly reporting any suspicious activity. Cybersecurity procedures unique to smart grid operations, as well as new threats, should be covered in regular training sessions. Users can lower the risk of cyber events and guarantee the dependable operation of smart grid systems by actively safeguarding sensitive data and infrastructure and cultivating a culture of cybersecurity awareness. Figure 8 presents a safeguard based on an in-depth examination of the smart grid architecture.

10. Future Research Directions

Regarding future directions, it is also essential to set the direction of future research to enhance the safety and security of smart grid systems in IoT domains, ensuring their confidentiality, integrity, availability, robustness, and functionality.

10.1. Lightweight Cryptographic Solutions

Data security is primarily protected by cryptographic solutions, which consist of cryptographic algorithms and protocols. Consequently, designing lightweight cryptographic algorithms and protocols becomes vital for protecting smart grid systems, and these points are described in the following:

10.1.1. Lightweight Cryptographic Algorithms

These algorithms are needed to guarantee that the final entities are safely and securely connected. These adjustments will protect communicated/stored data from being intercepted, altered, or even destroyed. Therefore, to guarantee data availability, message authentication, and confidentiality/integrity, lightweight cryptographic algorithms are needed. Two possible directions are as follows:

• Optimizing the hardware/software implementation of existing cryptographic algorithms, where a set of recent solutions follows this direction.
• Algorithm optimization: Reducing the number of rounds or using simple round functions (symmetric algorithm) or operations instead of complicated ones. This approach may start with a collection of current lightweight cryptographic algorithms for IoT systems, such as [308,309,310].

Therefore, to ensure data confidentiality, integrity, and authenticity during communication, effective lightweight cryptographic algorithms are used to secure data exchanges while maintaining system performance by reducing computational and communication costs. Their significance lies in their ability to uphold strong security measures in settings where energy efficiency and conservation are top considerations.

10.1.2. Lightweight Cryptographic Authentication Protocols

Defining and designing a lightweight symmetric/asymmetric authentication protocol that can effectively balance security and performance is one of the main steps in the right direction [311,312]. To reach this goal, recent solutions use lightweight cryptographic algorithms. Let us indicate that recent authentication solutions are reinforced using other factors (you are and you know). Cybersecurity requires lightweight cryptographic authentication systems, particularly for situations with limited resources like smart grids and Internet of Things devices.

10.2. Lightweight and Robust ML/AI Solutions

Integrating AI/ML-based grid security schemes into future directions can improve the resilience of the smart grid and ensure the reliability and security of the grid infrastructure with accuracy and efficiency by continuously adapting to evolving threats, detecting anomalies, and proactively mitigating potential attacks. Using cutting-edge machine learning algorithms to examine massive volumes of data produced by smart grid systems is necessary to include AI/ML-based grid security methods in future approaches. These algorithms make real-time detection of cyber threats or anomalous behavior possible, enabling prompt response and mitigation. Using these tactics will help smart grid systems become more resilient and dependable in the face of changing cyber threats. Edge AI for cybersecurity has become one of the main research directions and can benefit well from the federated learning approach. On the other hand, Edge AI can employ one or several techniques to construct lightweight machine learning techniques such as Pruning, Weight Sharing, Quantization, Low-rank Approximation, Sparse Regularization, and Distillation in addition to feature selection for tabular/time-series datasets. Distillation techniques are one of the main directions that should be improved to construct lightweight deep-learning models that can achieve a good balance between model performance and device/application requirements. In the following, a set of possible future research points is presented to protect AI/ML solutions for smart grids or to use AI/ML to protect smart grids.

10.2.1. Lightweight and Robust Anomaly Detection/Prevention Systems

By utilizing machine learning and statistical techniques, lightweight anomaly detection/prevention systems can be implemented in smart grids with greater efficiency. To find unusual activity and unapproved access, these systems monitor device connections and network traffic. They function smoothly in smart grid activities, requiring little computational resources and latency. To remain safe from cyberattacks and operational interruptions, regular upgrades and fine-tuning are essential for keeping up with changing threats.

10.2.2. RL for Cybersecurity

Reactive learning improves response and decision-making processes in the face of cyberattacks. RL algorithms acquire knowledge by interacting with their surroundings and obtaining feedback through incentives or punishments according to their activities. Real-time defensive adaptation, policy optimization, and autonomous detection and response to anomalies are all possible using reinforcement learning in cybersecurity applications. Reactive learning works especially well in complex and dynamic contexts like smart grids, where threats change quickly, and proactive defenses are needed to protect vital infrastructure.

10.2.3. Adversarial Defense Mechanisms

These mechanisms investigate methods to enhance ML resilience against adversarial attacks specific to smart grid environments. This includes researching techniques to detect and mitigate adversarial inputs that could compromise the security and reliability of grid operations. Adversarial defense strategies for smart grids involve setting strong cybersecurity measures to guard against data tampering and unauthorized access, such as intrusion detection systems, encryption, and secure communication protocols. Incorporating machine learning algorithms for continuous monitoring and anomaly detection, in addition to regular updates and patches, improves early detection, identification, and mitigation of possible attacks and threats.

10.2.4. Privacy-Preserving Techniques

These techniques aim to develop ML with built-in privacy-preserving mechanisms to handle sensitive data within smart grid communications. Techniques like federated learning with lightweight homomorphic cryptographic algorithms could be explored to ensure confidentiality while maintaining model performance. To protect user privacy while conducting critical analysis, smart grid privacy-preserving strategies include employing data anonymization and aggregation techniques. Furthermore, homomorphic encryption and secure multi-party computation allow for safe data processing and sharing without disclosing private information.

10.2.5. Future Work for LLMs in Smart Grids

This includes integrating LLMs in smart grids, developing frameworks to enhance IoT device security and anomaly detection with lightweight edge models and powerful cloud-based models, implementing real-time threat detection and predictive maintenance, and optimizing LLM architectures for distributed and edge computing. It focuses on enhancing LLMs’ natural language understanding and explanation capabilities for improved operator interaction, developing dynamic threat response systems, and integrating LLMs with blockchain for enhanced data integrity and transparency. Additionally, LLMs can aid in regulatory compliance monitoring, ensuring adherence to cybersecurity standards.

10.3. Ethical Hacking and Digital Forensics for Smart Grids

With the number of IoT devices expected to reach 75.44 billion by 2025, cyberattacks on IoT systems have surged, posing significant risks to smart grid infrastructures. Standard security measures often fall short due to resource constraints in IoT devices, necessitating periodic penetration testing and ethical hacking simulations. This paper [287] explores and evaluates security vulnerabilities in IoT systems through ethical hacking, providing practical solutions to enhance the security of smart grids by identifying and mitigating exploitable vulnerabilities in end devices, gateways, and servers. On the other hand, digital forensics for smart grids has become essential after the rise in cyberattacks against IoT systems, which have significantly impacted smart grids and caused substantial human and financial losses. Cybercriminals employ advanced anti-forensics techniques to evade detection, rendering traditional security measures ineffective. The work of [275] reviews advanced forensic and anti-forensic methods essential for safeguarding smart grids, emphasizing the need for sophisticated forensic techniques to counter evolving cyber threats and ensure the security and resilience of smart grid infrastructures.

10.4. Other Possible Future Research Directions

Other possible future research directions are covered in this part, and they include zero trust/hardware security in addition to the integration of new advanced technologies that are described in the following:

10.4.1. Zero-Day Attacks

To counter zero-day attacks, smart grid security requires a proactive strategy to quickly find and fix vulnerabilities not currently covered by available security solutions. Quickly identifying and addressing zero-day exploits entails putting advanced threat detection technologies, real-time monitoring systems, and automated reaction mechanisms into place. Additionally, encouraging cooperation between cybersecurity researchers and industry professionals is essential for the prompt disclosure of vulnerabilities and the creation of efficient updates and patches that lessen the impact of zero-day attacks on smart grid systems.

10.4.2. Zero-Trust Security

To incorporate zero-trust security concepts into smart grid infrastructure, a rigorous access control architecture that requires verification and authentication of all users, devices, and apps before granting them access to any resources must be used. This strategy monitors and authenticates identities and devices continuously throughout their life cycle, assuming that threats may come from both internal and external sources. Reducing the attack surface and containing possible breaches can be achieved by applying strategies like micro-segmentation to establish security zones and imposing least privilege access regulations. Furthermore, integrating real-time reaction capabilities, anomaly detection, and continuous monitoring improves the capacity to quickly identify and address security risks, guaranteeing resilient defense against constantly changing cyber threats in smart grid settings. Hardware Security: This is essential and requires more focus on hardware-based solutions such as securing processors, substations, transmission lines, antennas, grids, and other critical infrastructure, especially from criminal activities, terror-related attacks, and sabotage acts. In addition, these solutions should ensure resistance against hardware attacks such as side-channel and fault attacks.

10.4.3. Investigating Potential Risks

To find vulnerabilities that could jeopardize system integrity, a thorough investigation and assessment are necessary when looking into potential threats in smart grid security. To detect and lessen new risks, preemptive steps, including thorough risk assessments, threat modeling, and scenario-based simulations, are used. Smart grid operators may put strong security measures in place to safeguard vital infrastructure and guarantee the dependable and secure functioning of smart grid systems by regularly assessing and mitigating possible risks.

10.4.4. Advanced Strategies

Cutting-edge smart grid security techniques guarantee operations’ resilience and continuity even in the face of disruptive occurrences like natural disasters or accidents. By investigating cutting-edge technologies like quantum computing, federated learning, AI, digital forensics, and ethical hacking, potential risks and threats related to the growing complexity and heterogeneity of smart grid systems might be reduced. By strengthening the framework for threat detection, reaction, and recovery, these technologies support the security framework and help to prevent security breaches while preserving the smooth operation of the smart grid. Various opportunities for future research to improve the security and safety of smart grid systems were presented and debated. Nevertheless, as the smart grid domain evolves within the IoT field, new opportunities and challenges are likely to emerge.

10.4.5. Enhancing Research Innovation and Differentiation Strategies

Despite providing a thorough analysis of the state of smart grid security, the work presented primarily consists of existing research, lacking novel theoretical frameworks, quantitative support, or game-changing technology. Therefore, while contemporary and relevant, the suggested future research directions also address common issues in the broader cybersecurity and smart grid fields, including risk management frameworks, data privacy, and the integration of machine learning. The following differentiation techniques are suggested to increase the uniqueness and significance of the upcoming work.

• Development of Novel Frameworks and Models: Future research should focus on proposing and validating novel security models, context-aware risk assessment frameworks, or resilience quantification metrics specifically applicable to hybrid CPSs within smart grids, rather than restating well-established security principles or enumerating known vulnerabilities.
• Empirical Assessments and Practical Case Studies: These present empirical insights that aim to enhance theoretical advances. Potential avenues for future investigation include real-time simulations that utilize real smart grid data from utilities and field tests or pilot installations in testbeds that combine IoT-enabled monitoring technologies with renewable energy. Adversarial learning is also employed in attack–defense games to model and respond to Advanced Persistent Threats (APTs) in dynamic environments.
• Cross-Domain Innovation: This includes multidisciplinary studies to provide novel insights. For example, modeling insider threat detection utilizes incentive structures and behavioral economics. Digital twins are also being used for virtual patch testing and proactive incident response planning. Investigating cryptographic techniques that are quantum-resilient is also designed especially for grid communication protocols.
• Quantitative Differentiation of Threat Landscapes: This includes a framework based on comparative metrics to assess the intensity and effects of different attack types (e.g., DoS vs. FDIA) on various smart grid components. It also includes the multilayer countermeasure methods’ scalability and efficiency with limited resources.
• Models of Security Governance Driven by Policy: Current recommendations focus on collaborative security practices but lack effective, policy-driven procedures. Future research aims to investigate frameworks for compliance automation that align with relevant regulations. Blockchain-powered auditability procedures for managing trust and data tracing. Architectures for exchanging global threat intelligence that are adapted to local technical and legal limitations.
• Enhanced Pilot Studies and Testbed Deployments: Here, pilot studies and testbed deployments should be given top priority in future research to confirm the effectiveness and scalability of suggested defense methods. Furthermore, regulatory agencies and utility operators need to work together to establish practical security guidelines that make it easier for these frameworks to be adopted, especially in settings with limited resources or outdated systems.

11. Conclusions

Ensuring the security and safety of the smart grid is challenging due to its critical role in providing reliable and resilient energy distribution, improving efficiency, enhancing grid management, and supporting modern, resilient electricity systems. Nevertheless, this implies introducing new risks and threats, as well as vulnerabilities and difficulties related to cyber–physical safety and security, which are thoroughly addressed in this paper due to their potential to cause operational disruptions, data breaches, power outages, and financial losses. As a result, this paper proposes that multi-layered proactive security approaches should be enforced, including robust cryptography-based, non-cryptography-based, and machine-learning-based solutions, as well as penetration testing and forensics tools to maintain constant security protection for IoT devices, sensors, smart meters, transmission lines, substations, access control, and monitoring systems. Continuous risk assessment, vulnerability monitoring, regular training (i.e., security and awareness), and international cooperation should also be encouraged to help establish a security-conscious culture. By providing an organized mapping between smart grid architectural layers, threat types, and defense mechanisms, the proposed MLTDAF improves upon conventional methods. This framework offers an extensive and useful tool to assist in the creation of smart grid infrastructures that are safe, robust, and prepared for the future. Following an in-depth examination of the most significant cybersecurity issues in smart grid contexts, as well as a practical framework for future technological and academic efforts, the paper concludes by identifying future research directions.