Cybersecurity Enhancement of Smart Grid: Attacks, Methods, and Prospects

Abstract

Smart grid is an emerging system providing many benefits in digitizing the traditional power distribution systems. However, the added benefits of digitization and the use of the Internet of Things (IoT) technologies in smart grids also poses threats to its reliable continuous operation due to cyberattacks. Cyber–physical smart grid systems must be secured against increasing security threats and attacks. The most widely studied attacks in smart grids are false data injection attacks (FDIA), denial of service, distributed denial of service (DDoS), and spoofing attacks. These cyberattacks can jeopardize the smooth operation of a smart grid and result in considerable economic losses, equipment damages, and malicious control. This paper focuses on providing an extensive survey on defense mechanisms that can be used to detect these types of cyberattacks and mitigate the associated risks. The future research directions are also provided in the paper for efficient detection and prevention of such cyberattacks.

1. Introduction

An electricity network, in which the bidirectional flow of electricity and data is achieved using digital technologies for communication, is called a smart grid [1]. The purpose of a smart grid is to transform traditional electricity networks into the modern grid with the help of information and communication technologies (ICTs) [2]. Transmission of large data was not possible in traditional grids with the high-voltage transmission cables [3]. The electric power transfer from centralized power plants to the consumers involves various electrical components [4], such as transmission lines, transformers, and substations, among others [5]. Furthermore, traditional grids have no energy storage devices available on a large scale. Renewable power generation and demand response at the distribution end need effective communication for information exchange among different components of a smart grid [6]. Smart grid has the best possible solutions for almost all the challenges a traditional network can face [7,8]. To achieve reliability, security, efficient monitoring, and enhanced transfer of electricity, smart grid researchers introduced communication between electrical and digital data [9]; however, the advantages of digitization in smart grids have also increased data security issues for the electricity networks; therefore, smart grid security is also a vital challenge [10].

The complete infrastructure of a smart grid is highly dependent on its communication system that is coupled with power system [11]. A power system relies on the power flow, whereas a cyber system relies on the information flow. The communication channel uses various devices and technologies for communication. The communication systems are extremely vulnerable to cyberattacks [12]. The attackers aim to attack the communication links to access physical systems and modify or block information flow [13].

Cybersecurity refers to the practice of protecting data confidentiality, availability, and integrity in the systems or devices that are associated with the Internet [14]. It defends electronic devices and networks such as mobile devices, computers, and electronic systems by protecting their data from misuse by unauthorized users and attackers [15]. Cybersecurity in the smart grids defends their data confidentiality, availability, and integrity from such dangers [16]. Security mechanisms built for IT networks are not sufficient for securing grid networks because of different system dynamics [17]. Availability, integrity, and confidentiality of smart grid network data must be secured for its reliable and continuous operation; therefore, well-defined cybersecurity mechanisms are needed to protect the smart grid system from malicious attacks and vulnerabilities [18].

Data attacks in a smart grid can be categorized into three major divisions: Confidentiality, integrity, and availability attacks [18]. These data attacks can happen on devices, network topology, and network protocols [19,20]. False data injection (FDI) attacks are the influential attacks that target the communication protocols of the smart grid network. Denial of Service (DoS) is another attack that disturbs the network topology due to which operators cannot have a wider observation and control of the power system [21]. Malware, replay attack, and eavesdropping are some foremost attacks on meters and sensors of a smart grid. The main objective of the attacker is to obtain, modify or block the information to adversely affect the smart grid operation, steal confidential information, or gain financial benefits [22,23,24].

The schematic representation of a smart grid system is given in Figure 1, which shows different components of a smart grid [25]. The power generation plants, transmission and distribution system, information and communication systems, distributed generation and energy storage, and prosumers are major parts of the smart grid system. Power sources for bulk generation are hydroelectric plants, diesel power plants, microtrubines, nuclear power plants, wind turbines, and photovoltaic plants [26]. Using these primary sources, power is generated to transmit it for use in domestic and industrial applications. In a transmission network, interconnected lines facilitate the power transmission to distribution end. High voltage AC current is transferred through transmission lines whereas voltage is reduced for local distribution of current. In the primary stage, bulk electric power is transferred from the generating station to the substation. In the secondary stage, power is transferred from substations to different cities and villages. To store the excess electricity, grid energy storage is used to store energy on a large scale. Smart grid system can be monitored, controlled, and managed remotely with sensors and intelligent electronic devices (IEDs) [27]. The transmission and distribution levels include power lines, intelligent substations, monitoring and control automation systems, and smart transformers that are equipped with sensors. All the devices and components are managed at the upper level by an energy management system, transmission and distribution management system, centralized and decentralized management system, and outage management system. The supervisory and management systems are interfaced with the power network by information and communication technologies (ICT) layer.

1.1. Preceding Affined Review Papers

Different reviews on cyberattacks for smart gird already exist in the literature. However, they most cover only the FDI attacks, DoS attacks, and their machine and deep-learning-based detection methods within the smart grid system. The summary of these reviews is given in

Table 1. Review papers on cyberattacks in smart grid systems.

Ref.	Description
[28]	This paper reviewed the FDIA attacks and discussed the economic and physical impact of the successful FDIA in smart grids. It also presented the defense strategies against FDIAs.
[29]	The authors analyzed the impacts of cyberattacks on interactive models of smart grids and presented corresponding solution approaches as graphic dimension, mechanism dimension, and probability dimension methods.
[30]	The authors introduced a layered approach to evaluate the security risks of both cyber and physical power systems against integrity and denial of service attacks.
[31]	This paper detected the FDIA impacts toward non-technical losses, state estimation, and load forecasting using machine learning methods.
[32]	This paper summarized the modeling methods of smart grid systems. This paper also analyzed the impacts of cyberattacks on control and stability of power system, and types of cyberattacks from the perspectives of simulation, probability, topology, and mechanism. It also introduced a unified framework for modeling physical and cyber components.

. In [28], FDIA is introduced and its physical and economic impact on smart grids along with detection approaches are discussed. In [29], the impacts of cyberattacks on smart grids are analyzed and potential research progress in China is discussed. The authors in [30] assessed the security risks of DoS and integrity attacks in smart grid system. In [31], only machine-learning-based detection methods are discussed for only FDIA in smart grid systems. In [32], the impacts of cyberattacks on control and stability of smart grid system are discussed. However, these review papers do not express the DDoS and GPS spoofing attacks together with FDIA and DoS attacks. Moreover, these review papers are mainly focused on machine-learning-based defense strategies for cyberattacks detection in smart grid, which formed the main motivation for this paper.

1.2. Necessity for an Up-To-Date Review

In the existing literature/research, the main focus was on either false data injection or denial of service attack. The attacks, such as GPS spoofing and distributed denial of service attacks, were not included in the past research; we have considered both denial of service attacks and false data injection with other important attacks, such as GPS spoofing and distributed denial of service attacks. The types of attacks are increasing with the rapid improvement and extensive acquisition of smart grid technology devices. This makes the security concerns further complicated, which increases the need to constantly update the security systems by researching and investigating them. As the utilization of technology increases, and with the rise in the amount of information available on networks, quicker and more proficient ways to identify attacks are required, and undoubtedly there are a large number of progressing ways of further developing the security of networks. Moreover, these reviews focused on artificial intelligence-based detection methods for FDIA and DoS attack. However, this review includes both artificial intelligence and other detection methods for cyberattacks detection within smart grid. According to the Google Scholar database, there is a continuous increase in the number of publications dealing with smart grid attacks, from 4900 in 2018 to 5060 publications in 2022. The focus of the research community for smart grid applications and cyberattacks on them is globally emerging. Detecting the location of the attack is also pretty important; however, the previous smart grid research focuses only on the presence of FDI and DoS attacks.

1.3. Review Methodology Brief Description

Various sources of information, namely, Scopus, IEEE Xplore, Google Scholar, MDPI, and Web of Science were used to find the existing research for conducting this literature review. The key step was to retrieve the relevant review articles on the basis of some selected keywords. The primary selection for this review was made with respect to several characteristics, as provided in Figure 2. These keywords are smart grid, cyber-physical power system (CPPS), cybersecurity, cyberattack, cyberthreats, FDIA, DOS, DDoS, and GPS spoofing attack. Articles published in English between 2012 and 2021 were selected for review. The second step involved the grouping of these articles into different sections. The articles were divided into two main groups: articles related to smart grid applications and articles related to smart grid attacks. Articles related to cyberattacks are further divided into FDI attacks, spoofing attacks, DoS attacks, and DDoS attacks. Every single article is further distributed with respect to the core of its research findings.

1.4. Formation of the Remaining Work

The rest of the article is structured as follows: Cyberattacks (FDIA, DoS, DDoS, and GPS spoofing) in smart grid and their detection methods are described in Section 2. Future research directions are provided in Section 3. Finally, conclusions are summarized in Section 4.

2. Cyberattacks in Smart Grid

Smart grid is a combination of the power grid and a communication network, security attacks may take place in both the physical space, as in the conventional power grid, and cyber space as in any communication network. There are numerous types of attacks that may be carried out on a smart grid system. The most commonly occurring attacks in smart grid are FDIA, DoS, DDoS, and GPS spoofing attacks. The detection methods proposed for these attacks are discussed in the following sections.

2.1. False Data Injection Attacks

False data injection attack (FDIA) is the most vicious attack in the smart grid systems. In FDIA, an attacker intrudes the system and modifies sensor readings such that undetected errors are to be introduced into estimation of state variables and scheduling decisions. The direct access of the physical network is considerably difficult compared to accessing the communication channel. In this attack, the attacker focuses on the communication network and communication channel to manipulate the sensors reading as shown in Figure 3. Detecting such kinds of attacks is extremely complex and challenging.

A deep-learning-based location detection (DLLD) architecture is proposed in [33] to detect the real-time location of FDIA attacks. A bad data detector is also used to filter the low-quality data. A convolutional neural network (CNN) is employed for capturing the inconsistent power flow measurements; however, it does not modify the current bad data detection system and also does not leverage any prior statistical assumptions. In [34], a linear model is presented for a general FDIA attack, which is based on a short-term state forecasting with the temporal correlation. It presents the consistency test to examine the deviations among the received measurements and the forecasted measurements. Furthermore, a detector is also proposed to check the shortcomings of the previous detectors and to handle critical estimations.

An adaptive sliding mode controller is presented in [35] to detect FDIA and dynamic load altering attack (DLAA). The developed controller is able to secure the reliable operations of the under attacked power system. Moreover, the upper bound of the attack signals is also estimated to eliminate the effect of multiple attacks. In, [36], authors claim to develop the quickest intrusion detection algorithm for FDIA detection. The detection algorithm is developed by analyzing the statistical properties of dynamic state estimations. It is claimed that the algorithm minimizes the worst-case detection delay while identifying FDIA attacks and sudden system changes.

A hybrid FDIA detection mechanism is introduced in [37] to ensure the security of power system operations and control. The proposed mechanism combines machine learning and variational mode decomposition (VMD) technology. VMD is used to disintegrate the system state time series into an ensemble of elements with distinct frequencies. The consequence of attack intensity and environmental noise on the performance of the aimed technique is also examined. In [38], combination of weighted residual method and equivalent measurement transformation is used to identify and detect false data. To test the effectiveness of the algorithm IEEE 14 bus system was used in the MATLAB environment. In [39], an improved extreme learning machine method is proposed to suppress the redundancies of the feature vectors and use the obtained features vectors for training a time-series analysis-based LSTM detection method. This proposed mechanism can efficiently detect the new type of FDIA by examining the variations between the feature vectors in both the temporal and spatial aspects.

In [40,41], cumulative sum (CUSUM)-based statistics are used to detect FDIA in real-time. In the general CUSUM-based statistics method, maximum possible loss is minimized using the known probability distribution functions of both pre- and post-attacks events. The smart grid system is considered under attack if the CUSUM-based statistic exceeds pre-defined threshold; however, [40] proposed a generalized likelihood ratio-based centralized and distributed sequential detection method using a level-triggered sampling technique. It is reported to be computationally efficient to detect the FDIA attack and reduce the communication overhead in the system; on the contrary, the authors in [41] proposed a modified real-time FDIA detection method using a residual pre-whitening technique. It aims to reduce the average detection delay and provide the quickest stopping point for declaring that the system is under attack. A power load forecasting model is proposed in [42], which is based on the framework of the cyber–physical–social systems to take social implications into account for load balancing. The authors of [43] introduced the Padé approximation-based method and explicit infinitesimal generator discretization-based method against delayed cyber–physical power systems.

In [44], the worst-case impact of FDIA is investigated in smart grid with both fixed and switching locations. In [45], a method for extracting patterns based on temporal–topological correlation is proposed to restore the complete attack path for all network attacks; however, it is merely limited to small topologies. To capture ideal measurements in state estimation against FDIA, generative adversarial network (GAN) based data model is introduced in [46] and results showed promising outcomes. In [47], authors introduced cognitive risk control (CRC) as a physical model and research tool to unit the cognitive-dynamic systems (CDS). Yet, it is not able to identify the specific sensor which is affected by the FDIA attack.

Table 2. Review of false data injection attack detection in smart grid systems.

Ref.	Victim Device	Type of Attack	Solution Method	Description
[33]	State estimator	FDI-Power buses	Convolutional neural network	It captures the inconsistency and co-occurrence dependency in the power flow measurements due to the potential attacks and detects the exact locations of FDIA in real-time by concatenating convolutional neural network with a standard bad data detector.
[34]	SCADA and PMU measurements	FDI-Power measurements	Short-term state forecasting-based method	Proposed detector addresses the shortcoming of previous detectors in terms of handling critical measurements using temporal correlation.
[35]	Smart grid	FDI- Control and Dynamic load altering attack	Adaptive sliding mode controller	It presents and adaptive sliding mode controller to ensure the reliable operation of the power system under unknown attack by using the adaptive mechanism.
[36]	SCADA system	FDI-power grid state transitions and worst case detection delays	Quickest intrusion detection algorithm and Dynamic state estimation algorithm	It estimates and tracks the time-varying and non-stationary power grid states using Rao-CUSUM detector.
[37]	Power system state estimators	FDI-Power buses and Sensors	Online sequential extreme learning machine and variational mode decomposition	An effective FDIA detection method is presented with temporal correlation.
[38]	State estimation system	FDI-Power measurement	Equivalent-current based measurement transformation method	A weighted residual method is presented to detect and identify the FDIAs.
[39]	Communication System	FDI-Generation scheduling and power shedding	LSTM	Attacks are detected by analyzing the feature vectors that learn the temporal correlations of the feature vectors in time sequence.
[40]	Power monitoring meters and State estimators	FDI-Power measurements	Generalized CUSUM algorithm	A distributed sequential detector is proposed which uses level-triggered sampling technique.
[41]	State estimation system	FDI-Power Buses and measurements	Residual pre-whitening algorithm	Residual pre-whitening technique based on the CUSUM of the one-shot statistic is used to resolve real-time FDIA detection mechanisms.
[42]	Power network and Social network	FDI-Load Measurement	LSTM	A power load forecasting model based on deep learning and statistical method is proposed which is able to mitigate FDIA.
[44]	Generator bus	FDI- Generator frequency and switching attack	Optimal partial state feedback law	A scheme based on manipulating the subset of control signals and changing the locations of attack continually to degrade system performance at a minimum cost using convex relaxation and Pontryagin’s maximum principle.
[46]	Power system state estimator	FDI-Power measurement	Generative Adversarial Network (GAN)-based data model	Novel smooth training technique for GAN is developed and an online adaptive window is explored to maintain the state estimation integrity in real-time.
[47]	Smart grid	FDI-Power bus	Cognitive risk control	The entropic state is used to detect and bring FDI attacks under control using CRC with task-switch control.

presents the summary of detection methods developed for FDIA detection in smart grid system. The targeted devices and contributions are also summarized in it.

2.2. Denial of Service (DoS) Attacks

In a DoS attack, the attacker mainly focuses on making an intelligent device inaccessible for its intended use by flooding it with large unexpected data traffic. Data flooding blocks the regular traffic from reaching to its target device as shown in Figure 4. Flooding the service and crashing the service are two main methods of DoS attacks. The flooding includes three types of attacks: buffer overflow attack, synchronization, and ICMP flood attacks. The advanced form of DoS is Distributed Denial of Service (DDoS) attack. Instead of flooding, a DDoS attack focuses on crashing the target machine by attacking the machine from multiple compromised hosts rather than one source. In the smart grid, DoS attack exploits the network topology and attacks all the possible attack sources, whereas DDoS attacks use compromised hosts to launch an organized DoS attack towards multiple targets—it effectively expands the power of attack and makes defense more obscure and complex.

A Gaussian process model is presented in [48] for malicious DDoS attacks detection. A warning system is introduced in smart grid control to predict such malicious events and enable smart grid control center to develop the mitigation strategy. Moreover, this system can also predict fluctuations and abnormal voltage surges. In [49], DoS detection methods in different layers of sensor networks are discussed. It is also concluded that cybersecurity enhancement must be considered at the design stage of sensors to maximally avoid DoS attacks in their real-time operation.

Different methods for DDoS attack detection are proposed in [50]. A pattern detection mechanism uses a model that stores the signatures of previously identified attacks. The second method is the anomaly detection method. In this method, a model is created on the basis of the expected state of the system. This model is then compared with the current state of the system. In the third-party detection mechanism, it rely on externals to handle the detection process and provide attack characterization. Authors in [51] deployed a pseudo-state estimation application to detect the DoS attack or clock accuracy. It provides valid and realistic results built on a proof-of-concept prototype. However, it uses an overlay-based proactive defense mechanism that can offer smart grid network nodes to create a first-level firewall against DDoS attacks. By using a pub-sub infrastructure, it can also provide secure data delivery in a light-weight manner.

Honeypots are introduced in [52] for enhancing security against DDoS attacks in the advanced metering infrastructure network of the smart grid. Honeypot game strategy is used to analyze the strategic interactions between attackers and defenders to protect data and improve the security of the advanced metering infrastructure network. In [53], a reputation-based topology configuration scheme is presented against DOS attacks that enables cyber elements to distributively reconfigure the system’s routing topology to isolate malicious nodes in the micro grid.

A detection framework is proposed in [54] that allows sufficient readings from meters to be continuously collected through various local controllers for estimating the states of a grid and provide self-healing capability against jamming and DOS attacks. In [55], a general and scalable mitigation approach is developed that is aimed to be capable of timely detection of DDoS attacks in IoT devices.

The authors in [56] implemented parametric feedback linearization controller to control the delay that occurred between sensors and controllers due to DOS attack; however, they tested this controller on limited nodes. In [57], an advanced communicated-assisted protection scheme is introduced to examine the vulnerabilities such as permissive overreaching transfer trip to DDoS and FDIA attacks. The authors of [58] established a new lightweight, secure, and reliable communication platform that can allow both secure and cost-effective communication.

Table 3. Review of DoS and DDoS attacks detection in smart grid systems.

Ref.	Victim Device	Type of Attack	Solution Method	Description
[48]	Smart meter and electric appliances	DDoS	Gaussian process	Gaussian process is used to detect DDoS attack using mean and covariance functions of underlying system model to predict its abnormal mode of operation.
[49]	Sensors	DoS	Authorization, redundancy, and real-time location-based methods	Attacks in different communication layers and their defense mechanisms are discussed and dropped data are recorded even outside the sensor network.
[50]	Electric system devices	DDoS	Activity level, cooperation degree, and deployment location-based defense mechanisms	Taxonomies of DDoS attacks and their corresponding defense mechanism are briefed.
[51]	Cloud assisted applications	DDoS	Port hopping spread spectrum	DDoS attacks are prevented with the help of open port switching over time in a pseudo-random manner. The proposed method is verified on the PlanetLab test-bed and Amazon’s EC2.
[52]	Advanced Metering Infrastructure	DDoS	Honeypot game strategy	The propose method helps in better analysis of strategic interactions between defenders and attacks. Attack detection rate are considerably improved, which shows promising security enhancement of AMI networks.
[53]	Wireless relay nodes	DoS	Reputation-based topology configuration method	Successful isolation of attacked cyber nodes are achieved and data are continuously transmitted at low latency.
[54]	Smart meter	DoS and channel jamming attacks	Intelligent local controller switching with channel hopping	Sufficient readings from meters are continuously collected through various local controllers to estimate the states of a grid under considered attacks. Optimal placement strategy of local controllers is also provided to avoid jamming attacks.
[55]	Smart appliances	DoS	Minimally invasive attack mitigation via detection isolation and localization	The proposed mitigation method is scalable and has capability of timely detection of DDoS attacks.
[56]	Sensor and controllers	DoS	Parametric feedback linearization control	Time-delay tolerance of power system is enhanced using communication latency values between controllers and sensors.
[57]	Distance relay	DDoS	Directional comparison unblocking scheme	Only permissive overreaching transfer trip protection is studied. DDoS attacks are avoided in power system protection relays to some extents only.
[58]	Client nodes	DDoS and replay attacks	Multi-homing based enhanced packet diffusion mechanism	Secure end-to-end data delivery is ensured with light weight mechanism against DDoS and replay attacks.

presents the summary of detection methods developed for DoS and DDoS attacks detection in smart grid system. The targeted devices and contributions are also summarized in it.

2.3. Spoofing Attacks

In a spoofing attack, the attacker focuses on the communication links. GPS spoofing attack is the widely studied spoofing attack in smart grid system. A general illustration of GPS spoofing attack is depicted in Figure 5. The communication links between a monitoring device and the control center are vulnerable to spoofing attacks [59,60].

Smart grid systems need sub-microsecond precision at power substations to provide better performance measurements, fault detection, automated network management, and protection relay operations. This sub-microsecond precision relies on time reference sources such as global navigation satellite system (GNSS) clocks. In order to enable real-time automatic control of the smart grid, low-cost and high-precision GPS receivers are being embedded into a large number of intelligent grid sensors, such as phasor measurement units. However, GPS receivers can be spoofed by nearby attackers that transmit high-power false signals with the same GPS frequency. Moreover, the position of each satellite in the global navigation satellite system is publicly available online; therefore, a GPS signal can be easily spoofed or jammed by a malicious attacker [61]. Timing inaccuracies at the time source or between the time source and the time stamping site might result in erroneous measurement data, missing data, and/or failed data frame compilation. Data gaps caused by unreliable data delivery to data concentrators, control centers, and applications within acceptable latency times could impede early warning information about dynamic grid issues [62]. Hence, It is essential that the GPS signals are resilient to interference, and increasingly to jamming and spoofing, given the importance of the power system and the possibility that the smart grid will depend on high-precision timing in the future.

A fast GPS spoofing detection method is presented in [63], which is based on multi-antenna by applying the probabilistic metric of the carrier signal to noise ratio from two receive antennas to conduct the speediest GPS spoofing detection. A test bed is also set up to verify their results. The results demonstrated the effective scheme to glimpse and stop spoofing attacks.

The authors in [64] aimed to secure the phasor measurement unit model combined with the dynamic network model against spoofing attacks in the power grid. These models are appropriate for receiving GPS measurements in the state estimation. The performance of this dynamic network model is better as compared to the static model. In [65], a neural network method named neural network GPS spoofing detection (NNGSD) is proposed to diagnose the spoofing attack and its location by operating phasor measurement unit data with the help of a dynamic power system. This method has been experimented in different conditions and the results show the promising real-time performance.

The authors in [66] proposed a strategy against GPS spoofing attacks while considering its dynamic nature in the power grid. They used dynamic monitoring mechanism to observe the measurements using a state-space model combined with the data of SCADA and PMU. The developed anti-GPS spoofing attack mechanism detects these attacks and measurement corrections using a dynamic model of the smart grid system.

Table 4. Review of spoofing attacks detection in smart grid systems.

Ref.	Victim Device	Type of Attack	Solution Method	Description
[63]	Phasor measurement unit	GPS spoofing time stamp attack	multi-antenna based quickest detection	The probabilistic metric is used which takes information of the carrier signal to noise ratio from two receive antennas to conduct the quickest GPS spoofing detection.
[64]	Phasor measurement unit	GPS spoofing attack	Weighted lest square state estimation	The detection method estimates the state variables such as nodal voltages in rectangular coordinates, generator rotor angles and its rotor speed, as well as the time-varying attacks.
[65]	Phasor measurement unit	GPS spoofing phase angle attack	multilayer perceptron neural network	The proposed neural network detection method is able to diagnose the GPS spoofing attacks and determine their location as well. The learning process of neural network is executed only once.
[66]	Phasor measurement unit	GPS spoofing time attack	Kalman filter-based dynamic fusion estimator	The proposed method uses a state-space model combined with the data of SCADA and PMU under dynamic system conditions. Proposed detection approach can detect multi-GPS spoofing attacks.

presents the summary of detection methods developed for spoofing attacks detection in the smart grid system. The targeted devices and contributions are also summarized in it.

3. Research Directions

Many researchers have proposed methods for the detection of FDIA, DoS, and spoofing attacks on smart grid systems. There are also works reported in the literature for the study of the impact of these attacks. However, most of these studies are focused on individual components of the smart grid systems. This entails further research on smart grid systems that focuses on the protection of a whole smart grid.

To achieve an enhanced and improved the impact analysis of FDIA, further research work is required on the distribution system other than the transmission system. Time duration of an attack could have an impact on smart grid failure due to a cyberattack; therefore, it is important to analyze the detection duration and impact of the cyberattack on the power system in that duration.

Optimization of the network topology should also be performed while considering 5G technology in sensors, smart meters, local controllers, state estimators, and other advanced metering infrastructure. Moreover, there is also need to analyze the impact of cyberattacks on voltage ride-through of the inverter in the smart grid. Encryption methods can also be introduced for secure data transmission to enhance the defense against these malicious attacks. Moreover, potential deep federated learning should also be explored for securing smart grid systems against cyberattacks. Cost estimation of cyberattacks on smart grid for the protection of infrastructure is an essential research area. It can help in prioritizing the parts of a smart grid for security.

As real data collection is still challenging, hence it will be beneficial to simulate cyberattacks to collect key characteristics that resemble real ones using virtual reality (VR). VR may potentially offer a potential solution by including reinforcement learning. Additionally, artificial intelligence experts will be able to predict the kind of attacks, which resembles real cybersecurity problems in smart grid system.

Transfer learning can also be explored to transfer data from models learned real datasets to simulation models or vice versa. GANs also need to be explored to extract novel instances from data obtained using different components of the smart grid. Lowering computational costs and convergence of different defense mechanisms need to be studied to have a better realization of their real-world implementations.

Privacy protection of data using the confidentiality, integrity, and availability triad in a form of decentralized/centralized learning is the key topic to be covered in the cybersecurity of smart grid systems. Privacy is a crucial issue that has not been addressed keeping the artificial intelligence model itself intact. Future research needs decentralized federated learning to be taken into account to protect the attack modeling procedure and add more security measures.

4. Conclusions

Smart grid, a cyber–physical power system, can be adversely affected by various cyberattacks due to digital evolution. This paper provided a comprehensive review on the detection of most occurring cyberattacks including false data injection attacks, denial of service, distributed denial of service, and GPS spoofing attacks in the smart grids. It also provided an analysis of the impact these attacks can have on a smart grid. The false data injection attack is a type of cyberattack that targets the supervisory control and data acquisition systems, state estimators, monitoring meters, and sensors. In contrast, the DoS and DDoS attacks target smart meters, sensors, local controllers, state estimator, and advanced metering infrastructure. The security of these targeted devices must be strengthened to limit the occurrence of cyberattacks. Different defense mechanisms, both artificial intelligence and traditional solution methods, are also highlighted to provide insight into enhancing the security of smart grid systems; however, there is still a need to explore more defensive strategies against such types of cyberattacks. Digital twin models and data-driven methods such as machine and deep learning should be explored for both analyzing different types of attacks and mitigating the impact of these attacks in smart grid systems; therefore, future recommendations are also highlighted for the improvement and more secure operations of the smart grid system against cyberattacks.