Several localizations or ranging techniques have been proposed in the literature and received considerable attention from researchers. In [90], the authors divide the localization techniques into Received Signal Strength (RSS-based), Received Signal Strength Indicator (RSSI-based), Time Difference of Arrival (TDoA-based), and Angle of Arrival-based localization (AoA-based).

RSS signals are widely used in communication technologies for various purposes. One information that can be derived from RSS is the transmitter’s location, which has been the focus of numerous studies. For instance, the authors of [91] propose an RSS-based technique for detecting spoofing attacks based on a spatial correlation feature. In this study, the authors extracted RSS stream features in order to decrease the redundancy of data and applied two distinguishable features of RSS streams, including the Summation of Detailed Coefficient (SDCs) in Discrete Haar Wavelet Transform (DHWT) and the ration of out-of-bound frames [92]. Their proposed approach provides an effective, low-cost method for detecting spoofing attacks in a network. However, the authors of [92] highlight that the RSS-based technique suffers from poor localization accuracy, which is a critical disadvantage of this technique. It is one of the simplest localization techniques

that consider a cost-effective method in networks.

In [93], the authors propose RSSI-based detection mechanism for MITM attacks. In this study, RSSI values are commonly arbitrary integers, which are received by antennas. These values can be evaluated using a sliding window, that leads to static information about signals’ characteristics, including mean and standard deviation. Their proposed technique can detect MITM attacks by analyzing these profiles. In [94], the authors also take advantage of RSSI-based techniques for detecting spoofing attacks in smart grids. They developed a cosine-similarity method of RSSI in home area networks in a smart grid. Their proposed technique provides a higher detection rate compared to other related studies [95] - [101]. The authors of [102] combine RSS-based technique with the maximum likelihood estimation to handle uncertainty in measurements. According to their simulation results, this technique outperforms the existing RSS-based techniques in detecting attackers.

Localization-based techniques also consist of another common type, TDoA-based. Methods under this type are well-known techniques that measure the distance between nodes. For instance, the authors of [102] [103] introduce a lightweight TDoA-based technique between source and beacon nodes. The authors of [104] also propose a TDoA-based technique to detect time synchronization attacks in a network. In this work, the authors focus on using TDoA-based techniques on fixed sensors whose time reference could be maliciously affected. Their proposed solution mainly exploits the weighted least squares estimator with newly generated weights and the measurements of TDoA conducted from an unknown source. In [105], the authors describe a TDoA-based technique combined with the Maximum Likelihood Estimator (MLE), which provides superior performance compared to some other existing approaches.

In [106], the authors introduce a new localization technique, AoA-based technique. This technique mainly focuses on the angle of arrival signals to calculate transmitters’ locations. In [107], the authors discuss this localization technique, which can achieve the angle of data by using radio array approaches. They highighlight two ways to evaluate the angles of arrival, multiple and directional antennas. Multiple antennas work based on time analysis or even phase difference between the signals at various array elements in which the locations are known. While, directional antennas can compute the RSS ratio between several directional antennas in order to have an overlap between their major beams. In [108], the authors demonstrate that AoA-based localization techniques are not a good fit for cyber-attack detection of an indoor system in networks. In this study, the system’s accuracy was reduced because of intensive multi-path components and Non-Line of Sight (NLOS) communications.

AI-based techniques category consists of various machine-learning and deep learning algorithms, data mining techniques, evolutionary algorithms, and fuzzy logic methods. For detecting cyber-attacks, machine learning category has received more attention from researchers. For example, the authors of [55] use machine-learning to detect jamming attacks, namely random forest, support vector machine, and neural network. Their numerical results show that the proposed technique based on random forest achieves high accuracy. In [109], the authors also use machine learning algorithms to detect social engineering attacks. The technique performs based on unsupervised learning, which means that there is no previous knowledge about the observed cyber-attacks. They compare the performance of different machine learning algorithms (support vector machine, biased support vector machine, artificial neutral, scaled conjugate gradient, and self-organizing map) in terms of reliability, accuracy, and speed. Their simulations show instead of proved that support vector machine gives better results compared to other algorithms.

In [81], the authors use machine-learning techniques to detect brute force attacks on the Secure Shell protocol (SSH) at the network layer. The authors used different classifiers, including K-Nearest Neighbors (KNN), decision tree, and Naïve Bayes (N.B.), to develop scalable detection models that can provide good prediction results. Another study in the literature that exploits machine-learning is detailed in [110]. In this study, the authors highlight a concept from statics and economics, named “first difference”, which led them to develop a classifier to detect time synchronization attacks in the network. Their results show that Artificial Neural Networks (ANN) are the best choice for detecting these attacks in the network. In [111], the authors use an ANN model to detect MITM attacks and their results did provide a good detection rate. In [112], the authors use machine learning techniques to detect and locate intruders in smart grids. The simulation results of this study showed that the proposed method could achieve a good detection rate. In [113], the authors propose ensemble techniques, namely bagging, boosting, and stacking to detect intrusions in smart grid. The results show that the stacking technique provides satisfactory results. In [114], the authors use boosting ensemble technique along with Tree-structured Parzen Estimator Optimization to detect and classify attacks on smart grid. The authors show that optimization techniques improve the detection performance of the mode. Overall, these proposed techniques provide good results.

Deep learning techniques have also been used to detect cyber-attacks targeting smart grid infrastructure. For instance, in [115], the authors propose ensemble deep learning techniques, using deep neural network (DNN) and decision tree. The proposed model is evaluated based on the 10-fold cross validation. The evaluation results show instead of showed that the proposed model outperforms other traditional techniques, including random forest, AdaBoost, and DNN. In [116], the authors apply a deep reinforcement learning based technique to identify the physical tripped line and the fake outrage line. Another study [117] also employ a deep learning technique, called encoders to reduce dimensions and feature extraction, followed by an advanced Generative Adversarial Network (GAN) to detect false data injection attacks. In addition, in [118], the authors propose a deep learning approach, namely residual neural network to detect attacks on smart grid. The results show that the proposed approach outperforms other existing techniques. in literature.

Another type of AI-based category is data mining algorithms that can be useful for detecting cyber-attacks in the smart grid. In [16], the authors survey existing studies that used data mining techniques for detecting false data injection attacks (FDIA) in the smart grid. These techniques can determine patterns in huge datasets in order to analyze invisible patterns of data. Some studies use a data mining method, Common Path Mining (CPM), to detect FDIA in networks. They introduce a path as a sequence of samples in a temporal order. For any unique event, there is a path, which consists of various types of faults [119] [120] [121] [122]. Hence, when a sequence is compatible with the paths, it will be listed as an attack. In [112], the authors also introduce a Casual Event Graph (CEG) to detect FDIA in smart grids. The main objective of data mining techniques in this study is to train historical datasets. Although data-mining techniques provide some benefits, they may sometimes require low computational complexity (based on the data size) when a training process is over, which is considered a benefit in detecting FDIA in a smart grid.

Fuzzy logic-based methods have also been proposed to effectively detect various attacks in a network. For example, the authors of [116] propose artificial immune systems and fuzzy logic in order to detect flooding attacks in a network. In this study, the aim of using fuzzy logic is to reduce uncertainty whenever there is no clear line between malicious and legitimate traffic. Another study that applied fuzzy logic in cyber-attack detection is described in [117], in which the authors describe a detection technique based on fuzzy logic for jamming attacks. This technique uses the clear channel assessment, bad packet ratio, and received strength signal parameters to detect link loss due to jamming or other causes. The efficiency of their proposed techniques for constant and random jamming is high. Other authors [118] combine fuzzy logic with other approaches, such as genetic algorithms and Hidden Markov Model (HMM), to detect various cyber-attacks.

Another important type in AI-based techniques is that of evolutionary algorithms, which are widely used for global optimizations. One popular instance of evolutionary algorithms is genetic algorithms. These algorithms can mimic the evolution and natural selection process. In [119], the authors propose a technique based on a genetic algorithm that consists of two stages, training and detection. In their work, they applied a genetic algorithm for reducing the set of features in the detection stage. According to the authors’ results, this technique provides a high level of accuracy for various cyber-attacks in networks. In [120], the authors also analyze the impact of genetic algorithms on various machine-learning techniques, such as SVM, KNN, and ANN. The simulation results show that genetic algorithms and these three machine learning techniques effectively detect FDIA in smart grids. However, KNN and SVM were found more efficient in detecting these attacks than some existing techniques.

In another work, the authors propose a hybrid technique based on Genetic algorithms and fuzzy logic [121]. They developed a multi-objective genetic-fuzzy model for detecting anomalies in networks. The numerical results show that the proposed method is not suitable for detecting attacks in networks. In [122], the authors also analyze a hybrid framework for detecting different cyber-attacks that apply both genetic and fuzzy logic techniques. This method provides good accuracy and better results compared to some other existing techniques.

With the increasing variety and number of cyber-attacks in smart grids, it has become challenging to detect cyber-attacks in any network. The process of detecting attacks usually occurs late for a victims’ network. Therefore, detection and identification of attacks in an early stage are considered a challenge for modern systems. Prediction models are well-adapted methods to predict attacks at an early stage in the systems. They mainly apply statistics for the prediction of the results of any unknown events. Several studies focused on using prediction models for attack detections in smart grid infrastructures. For example, the authors of [123] proposed a detection method that uses cosine similarity and chi-square detector to identify FDIA in networks. They also employed Kalman filter to find expected measurements and calculate any deviation between actual measurements and estimated values. Their results show that both chi-square detector and cosine similarity machining are effective methods for the detection of random attacks. In addition, the authors concluded that chi-square detector cannot detect FDIA based on their methodology; however, using cosine similarity provided better results in detecting FDIA in networks.

In another study, Kalman filter is used to improve cyber-attack detection performance [124]. They modeled the smart grid network as a discrete linear dynamic system and exploited Kalman filter as the state estimation. Several studies also used Kalman filter as a technique to enhance cyber-attack detection in a smart grid, along with other techniques, such as the Euclidean detector [125] [126] [127], cosine similarity detector [126], and chi-square detector [120]. Auto Regressive Moving Average (ARMA) and Auto Regressive Integrated Moving Average (ARIMA) are other instances of prediction models that have been proposed for detecting cyber-attacks in networks. In fact, auto regression-based models can predict future trends from past behavior, while moving averages can predict long-term behaviors. ARIMA is also another statistical model that uses time-series data to forecast future behaviors.

In [128], the authors describe an early-stage method to detect SYN flooding attacks. In this method, the SYN traffic is predicted by using ARIMA model, and a cumulative sum algorithm is used to discover SYN flooding attacks. Other studies also used these time series models for detecting cyber-attacks smart grid networks [129] - [158].

Filtering-based techniques represent another common category for cyber-attack detections in a smart grid. This survey will discuss two main techniques in this category, namely threshold-based and bloom filtering techniques. Several studies evaluated the efficiency of threshold-based techniques in detecting cyber-attacks in any system. For example, the authors of [103] used threshold-based techniques to detect social engineering attacks in networks. They are easy to develop but not efficient due to their values’ limitations. On the other hand, the authors of [135] used bloom filters to detect flooding attacks against signaling protocols. They also introduced a metric called session distance to detect flooding attacks. In addition, they also used the bloom filters in the SCADA system. Because these filters need low memory and computing power, they can effectively help detect any existing anomalies in the SCADA system.

In [136], the authors describe a hybrid model for detecting intrusion attacks in SCADA systems. They proposed an approach using multi-level methods to detect anomalies using bloom filters in SCADA networks. They also suggested an algorithm for secure feature extraction and multi-level anomaly detection. Their experimental results show that the proposed approach can achieve an accuracy of 97%. In [81], the authors compare filtering techniques with some other detecting techniques to detect some social engineering attacks. In this work, the authors highlighted filtering techniques as easy techniques to use, but ineffective and costly. Despite their limitations, these techniques, particularly bloom filters, are known as space efficiency techniques, which are useful in specific scenarios in a smart grid.

Intrusion detection systems (IDS) are considered as one of the main techniques to detect cyber-attacks in smart grid infrastructure [12]. These systems can audit and analyze security information to detect any possible malicious vulnerabilities. One of the important benefits of these systems is to detect unknown or zero-day attacks effectively [137].

Several studies have been proposed to detect cyber-attacks using IDS. For example, the authors of [138] propose a hierarchical distributed IDS based on a distributed fog architecture. This system consists of three different layers of architecture, namely home area networks, residential area networks, and fog operation center networks. Their proposed system demonstrated good performance results over different conditions of the smart grid infrastructure.

In [137], the authors propose an IDS system to detect operational data. For this purpose, they used real power plant data and described a new architecture for the proposed system. Their simulation results proved that this system has some benefits compared to other existing systems. In [139], the authors propose a network-based IDS system based on a moving target defense technique in the smart grid. In this study, the authors mainly focused on IPV6 advanced metering infrastructure. The authors of [140] also developed an IDS system, called ARIES, which is able to detect any cyber-attacks, such as DoS, brute-force, port scanning, and bots attacks, against network flows, Modbus/Transmission Control Protocol (TCP), and operational data. They highlighted that the proposed system provides a high efficiency in detecting cyber-attacks. In addition, some works primarily attempted to improve signature-based IDS systems. In [141], the authors compare different types of IDS systems, including anomaly-based and signature-based. In particular, the authors focused on the improvement of signature-based IDS. To address this challenge, they employed Snort using a layered dataset.

In [142], the authors propose a signature-based IDS system that can detect DoS attacks in a network. For this purpose, they simulated different types of DoS attacks, such as Hello flooding attacks using Cooja simulator and IPV6 routing (RPL) protocol. Their proposed system provided effective results. In addition to these traditional methods, some studies used hybrid methods that combine IDS with other techniques. For instance, in [143], the authors apply a hybrid model to detect cyber-attacks. This model combines AI-based algorithms, including decision tree, K Nearest Neighbor (KNN), and Support Vector Machine (SVM), along with an IDS system to improve the performance of this system. Their results showed that their proposed system achieves high performance results. The authors of [144] propose an IDS system that is capable of detecting lethal. The proposed system uses the Cumulative Sum (CUSUM) algorithm with the characteristics of IDS systems. Their achieved detection rate is high, while the false positive rate is relatively low.

To be prepared for potential cyber-attacks in smart grid network, it is important to understand the different categories of countermeasures. This section only considers computer-based countermeasures that mainly focus on Information technology and software aspects of countermeasures. We will briefly discuss each of these categories with several suggested solutions for smart grid.

1) Secure protocols and Standards

Secure protocols, such as IPsec, transport layer security (TLS), secure sockets layer (SSL), and secure DNP3, play critical roles in data transmission’s security and integrity in smart grid network. However, DNP3 and secure DNP3 are the most widely used protocols as industrial protocols without any other security mechanism [7]. The authors of [55] suggest these protocols for dealing with several attacks, such as man-in-the-middle, jamming, and eavesdropping attacks in networks.

In [148], the IEEE 802.1 1i protocol is proposed for more confidentiality, integrity, authentication, and availability in a smart grid network. This protocol was designed to replace the Wired Equivalent Privacy (WEP) in the original IEEE 802.11 with AES-CCM, which has multiple confidentiality and integrity issues [149]. However, even after all the enhancements, the IEEE 802.1 1i protocol remained vulnerable to different attacks. In [148], the authors propose a Smart Grid Secure Protocol (SGSP) solution that creates a more secure node-server connection to achieve DoS resistance. In [150], the authors describe a new security protocol that adds authentication and preserves integrity and confidentiality. This protocol controls smart grid transmission lines in a sensor network, and it preserves the network connectivity during node failures.

In addition, the authors of [151] propose a protocol called scalable, secure transport protocol (SSTP) for smart grid data collection. They stated that integration of transmission control protocol (TCP) with transport layer security (TLS) protocol could provide some scalability issues. Their simulation results based on SSTP showed a high level of security and scalability for smart grid. They also showed that this protocol can reduce memory overhead exponentially. In [152], the authors propose a lightweight protocol for reliable communication in smart grid network. This protocol solved the security issues of some other protocols, such as IEC 62351 and IEC 61850. Their results show a reduction of the communication cost, solving overhead issues, and improving the privacy and security of data exchange.

In [153], the authors also discuss a countermeasure that uses IPSec and secure neighbor discovery (SEND) protocols. This study focused on using these protocols to prevent any vulnerabilities that may occur in communication with other protocols, such as IPV4 and IPV6. In [154], the authors describe compressed transport protocols, such as the datagram transport layer (DTL) in the network layer, which can be considered a good protection mechanism against cyber-attacks in networks. This protocol can mainly protect networks against cyber-attacks that influence data integrity and confidentiality.

Several other studies also introduced and discussed the standards in smart grid as efficient techniques to mitigate the detected cyber-attacks in a network. For example, the author of [155] highlight some standards, including The US Nuclear Regulatory Commission (NRC) Regulatory Guide (RG) 5.71 (NRC RG 5.71), IEEE Std 1686 - 2013 IEEE Standard for Intelligent Electronic Devices Cyber Security Capabilities (IEEE 1686), Security Profile for Advanced Metering Infrastructure (security profile for AMI), and the ISO/IEC 27000 series (or ISO27k for short, such as ISO 27001, and ISO 27002) as critical countermeasures in smart grid infrastructure. In general, NRC RG 5.71 is mainly able to establish a comprehensive analysis for computer systems and smart grid networks, identifying the necessary digital assets, and deploying the required security controls. This security measure can mitigate the detected attacks in scope of nuclear infrastructure of smart grid networks.

Another important standard in smart grid is the IEEE 1686, which can provide a complete security control in a network. This standard can mitigate any detected vulnerability in the network. In addition, some other standards, like security profile for AMI, can provide baseline controls for AMI systems in smart grid infrastructures. Also, ISO27k series standards are critical security controls for managing information through conducting information security management system (ISMS). These standards are capable of identifying the detected threats during the testing and assessment process in the network.

In addition [156], the authors of describe a few other standards, such as IEC 62443 -3-3 and IEEE C37.240. For instance, they discuss in-depth the importance of security controls, such as IEC 62443 -3-3 and IEEE C37.240, which can perform security controls and reliable countermeasures mostly through SCADA systems in the network. Other standards include NISTIR 7628, IEEE 1686, IEEEE C37.240, IEEE 1402, IEC 62056, and ISO/IEC 19790. An overview of essential standards as security controls are provided in Table 4.

2) Cryptographic and Authentication

As previously mentioned, one other basic type of countermeasure techniques in smart grid is cryptography and authentication. Most of these techniques aim to protect data integrity, privacy, and confidentiality. In this section, we discuss most common cryptographic functions and authentication methods.

In general, there are two types of cryptographic functions: symmetric and asymmetric functions. In symmetric functions, the encryption and decryption keys are the same or a transformation of one another. The well-known algorithms used as symmetric methods are advanced encryption standard (AES), one-time pad (OTP), and data encryption standard (DES). In asymmetric methods, different keys are used for encryption or decryption: a public key and a private key.

The most known asymmetric algorithm is RSA (Rivest, Shamir, and Adleman) [121] [122]. In fact, these techniques’ efficiency depends on various factors, such as computational resources, processing time, and time complexity. Another technique is elliptic curve cryptosystems. The authors of [92] introduce elliptic curve cryptosystems as a public-key cryptography with the same power as RSA, despite its key size smaller than RSA [123].

Key management techniques play an important role in encryption and authentication approaches. Public key infrastructure (PKI) is a type of key management that guarantees authentication through a network. In [125], the authors discuss some smart grid requirements regarding key management approaches, such as secure management, scalability, evaluability, and efficiency. These requirements must be followed in order to establish a secure key management scheme. Several examples of key management frameworks are provided in [7] as key establishment scheme for SCADA systems (SKE), key management architecture for SCADA systems (SKMA), advanced key management architecture for SCADA (ASKMA), advanced ASKM (ASKMA+), and scalable method of cryptographic key management (SMOCK).

Authentication methods are widely applied in smart grids as countermeasures. In [124], the authors introduce a privacy-preserving data aggregation scheme using authentication methods in the smart grid. Another countermeasure in smart grid is blockchain which is a new emerging technology [126] that can bring considerable advantages to the smart grid’s cyber-security. In blockchain technology, distributed structures or ledgers can store digital data without any central authority in peer-to-peer networks. It provides potential solutions as a countermeasure approach, particularly for preventing or eliminating different cyber-attacks, such as man-in-the-middle attacks [127] [128] [129] [130] and eavesdropping attacks [128] [130].

3) Intrusion Prevention

Any malicious activity in the network, called intrusion, has to be prevented or eliminated to enhance smart grid performance. One of the traditional methods of preventing attacks on any system is to use firewalls and antivirus. The authors of [131] define firewalls as a software or hardware systems that can monitor network activities by using several protocols or policies; however, using firewalls and antivirus cannot effectively deal with unknown or sophisticated cyber-attacks. For this purpose, other security techniques, such as network data loss prevention (DLP), intrusion prevention systems (IPS), security information and event management systems (SIEM), File integrity monitoring (FIM), and automated security compliance have been proposed to diminish or prevent the impacts of cyber-attacks on the network [159].

In general, DLP is a system that can prevent the theft or loss of data through the network, while IPS is an intrusion system that can prevent the identified attacks in the network. IPS and DLP observe the network continuously, identifying malicious activities and abnormalities, and reporting them to the network administrator to prevent them. In [160], the authors evaluate thirty-seven different IPS for smart grid in terms of their architecture, intrusion methodology, and programming characteristics. They also specified that none of these IPS has a self-healing mechanism that they can help during emergencies. In [161], the authors propose an IPS that mainly protects ZigBee-based home area networks in the smart grid against multiple attack types. Their simulation results demonstrate that this proposed system secures the network against multiple attacks, such as spoofing, eavesdropping, and DoS attacks.

In addition, a few studies used DLP systems as techniques to prevent cyber-attacks in the network. For example, the authors of [162] mention DLP as a monitoring system that can diminish the impact of any breach or vulnerabilities in the network; however, this technique usually cannot ensure security for heterogeneous networks such as a smart grid. To address this issue, several other security mechanisms, such as security information and event management systems (SIEM) and automated security compliance, have been proposed to prevent possible intrusions in a network and reduce the risk of cyber-attacks in smart grid [163]. For instance, SIEM can connect security information management (SIM) and security event management (SEM) system. This system constantly analyzes events and provides security alerts if anything unusual occurs [163]. In [164], the authors state that this system can be used as a good technology to prevent cyber-attacks.

Another practical solution to prevent intrusion in a network is file integrity monitoring (FIM) that prevents any changes in sensitive data and files and determines the possible breaches in the network. In [165], the authors apply the FIM system to protect the integrity of consumers’ sensitive data and privacy in smart grid networks. In [166], the authors introduce another technique, called automated security compliance, which is considered an automated tool in the network. The proposed automated security compliance can check through smart grid components in order to guarantee the system configurations are updated. This tool can show a fault in any smart grid component, leading to a security breach in other components. Another practical solution to mitigate the detected intrusion in smart grid network is to sanitize the dataset. For instance, SQL injection attacks mainly happen when a malicious SQL statement is submitted to a web form. To prevent such attacks, sanitizing the dataset can be effective approach in the network [167].

Address space layout randomization (ASLR) is yet another countermeasure in smart grid networks. ALSR is defined as a memory-protection technique for any network against buffer-overflow attacks. These techniques can insert an address space target in any unpredictable locations of the network. Hence, ASLR can reduce or even prevent the risk of memory corruptions in smart grid network. Other simple mitigation techniques for detecting cyber-attacks are web browser extensions (for users), Spam Ware, and moving-target defense. Moving-target defense techniques (MTD) consist of several technologies which are required to increase their security resilience through improving their software diversity. MTD techniques in smart grid are considered as crucial techniques to defer any blended cyber-attacks. For instance, the authors of [168] propose an MTD-based technique that is considered as a defense technique in order to mitigate detected false data injection attacks in the network. Their simulation results demonstrated that the proposed approach can reduce the attacker’s ability to estimate the underlying space model, and that can prevent such cyber-attacks in network [168].

4) Education

In smart grid, utility services play a significant role in preventing cyber-attacks. For this purpose, the authors of [133] recommend that suitable security training and education for both employees and customers can efficiently prevent the impact of some attacks on networks. For example, tailgating attacks, a common type of social engineering attacks, can be prevented by training professionals. More precisely, employees are trained to never give access to any users who do not have badges [159]. Moreover, employees may be required to discard sensitive data and materials and important files to avoid such attacks.

Some companies implemented security defense frameworks to analyze and mitigate cyber-attacks in their networks. Using these frameworks, they can analyze consumers’ profiles to show the existing threats and attacks in smart grid. However, this is not sufficient to minimize the impacts of cyber-attacks. They also need to increase the awareness of employees about cyber-attacks, such as social engineering, and how to prevent them. Another security education is to report security incidents to the IT support team. Reporting incident procedures may help the utility services identify possible vulnerabilities and malicious actions for further reference and avoid that they happen in the future. In addition to employee education, users are responsible for preventing cyber-attacks on smart grid networks. Users must avoid letting someone use their personal ID or password. They also need to be check if they are using legitimate websites before entering any personnel information. Another important venue for cyber-attacks are emails; users and employees have to verify that the email is coming from the utility company before clicking on any link embedded in the email [81].

5) Access Control and Cyber-Security Policies

There are a variety of strategies that are effective in managing smart grid networks and determining privileges’ access to users and employees. These strategies mainly manage permissions along with providing assurance for an enterprise in a scalable solution. For example, policy-based access control techniques, also known as attribute-based access control, are practical solutions to tackle data security and management. In smart grid infrastructure, authorized employees are required to define some authorization policies in order to give permissions to other employees and users. These policies mostly show the regulations for individuals to provide protection against physical vulnerabilities or cyber-attacks.

Furthermore, integrity checking policy is another method to check if the data has been altered. Therefore, any changes to the network can be observed, and a set of core controls can be applied. Integrity checking in smart grid networks can be performed as a security countermeasure and an indicator of malicious activity. Integrity checking methods can be monitored by authorized employees. Another countermeasure in this category is associated with physical protections. A physical protection is a set of hardware, software, data, and network that protect a network from external or internal vulnerabilities [169] - [181] and actions that may cause serious loss or damage to the infrastructure. In addition, a physical protection is an efficient approach in dealing with meter measurement modification attacks that can happen accidentally or intentionally when AMI reports incorrect measurements [167] - [173].

Security policies can also improve the security of a smart grid network and reduce the impact of cyber-attacks. These policies are primarily defined by authorized mangers or higher authorities, and they change over time. Such security policies include acceptable user policies, risk assessment standards, personnel security policies, end user key protection controls, and monitoring and logging policies. Although these policies usually focus on providing confidentiality and integrity, they cannot individually guarantee efficient protection in smart grid. Therefore, using several other security controls are considered as necessary steps to secure the network [173].

In this section, we discuss two main categories of protective-based countermeasures, namely spread spectrum and game theory-based techniques.

1) Spread Spectrum Techniques

In smart grid, spread spectrum techniques are defined as a major approach in which a generated signal with specific bandwidth is deliberately spread in a frequency domain leading to a wider bandwidth. Spread spectrum techniques are known as effective techniques to prevent jamming attacks in networks. These techniques can be divided into frequency hopping (FHSS) and direct sequence (DSSS). In the following, we briefly describe these two types in the scope of smart grid infrastructure.

In FHSS techniques, signals are transmitted by changing a carrier frequency among several distinct occupied frequencies. In [174] [175], the authors introduce an FHSS technique to provide protection against jamming and collision attacks in the network. Their results showed that the total required bandwidth of this technique is wider than similar data with a single carrier frequency. In [60], the authors mention the advantages of FHSS techniques as countermeasures, including dealing effectively with the multipath effect.

DSSS techniques are used to decrease the overall signal interference. The direct sequence creates the transmitted signals much higher than the information signals. For example, in [176], the authors use a DHSS-based approach to mitigate the detected jamming attacks in the network. In this study, the authors conducted their approach according to the dynamic tree-based scheme; however, it generates a huge maintenance overhead. Although the proposed method provided good protection against jamming attacks at the physical layer, this technique required very expensive computational resources. In [177], the authors also investigate the use of a DSSS technique by applying code division multiple access (CDMA) to prevent jamming attacks in the network. In [178], the authors recommend a hybrid approach that combines FHSS and DSSS to protect the network against jamming attacks. The authors compared their results with FHSS and DSSS, and concluded that a hybrid of FHSS/DSSS can provide a low probability of detection, low probability of interception, and improvement of the ability to deal with near far problems.

2) Game Theory-Based Techniques

Game theory-based techniques are considered as mathematical models that have strategic interactions among rational decision makers [179]. In [180], the authors propose a two-layer game theory prevention technique for false data injection attacks in smart grid. In this study, they used data from multiple sources in order to increase the prevention rates of attacks. So, they developed a zero-sum static game theory that optimizes the deployment of various defense resources. The authors of [181] also propose a game theory model based on the minimax regret method. This multi-level game theoretic framework provides a cost-effective and computationally efficient approach for large-scale power systems and smart grid infrastructure.

In [182], the authors introduce an approach based on game theory for defending against cyber-attacks in smart grid. In this work, they applied a game theory-based method which can identify cyber-attacks for smart energy scheduling of smart grid. The authors of [183] also designed a game theory approach to prevent against dynamic cyber-attacks in smart grid networks. Their model strategically identifies the chronological order of cyber-attacks that can occur, then protects the network against these attacks. Their simulation results proved that the proposed model is good and effective in detecting cyber-attacks.

The authors of [184] developed a game theory-based technique for smart grid, which according to their results, is 4.5 times faster than other existing studies. This technique also achieves a low communication and storage cost. In [185], the authors also propose a system, using dynamic game theory technique, as countermeasure that analyzes the attacks in cyber-physical system of the network. They mostly used a hybrid model that combines particle swarm optimization technique, game theory, and sequential quadratic programming technique to validate their model.