# The Role of Deep Learning in Advancing Proactive Cybersecurity Measures for
Smart Grid Networks: A Survey

Nima Abdi, Abdullatif Albaseer, Mohamed Abdallah Nima Abdi, Abdullatif
Albaseer, and Mohamed Abdallah are with the Division of Information and
Computing Technology, College of Science and Engineering, Hamad Bin Khalifa
University, Doha, Qatar {niab52126,aalbaseer<EMAIL_ADDRESS>
###### Abstract

As smart grids (SG) increasingly rely on advanced technologies like sensors
and communication systems for efficient energy generation, distribution, and
consumption, they become enticing targets for sophisticated cyber-attacks.
These evolving threats demand robust security measures to maintain the
stability and resilience of modern energy systems. While extensive research
has been conducted, a comprehensive exploration of proactive cyber defense
strategies utilizing Deep Learning (DL) in SG remains scarce in the
literature. This survey bridges this gap, studying the latest DL techniques
for proactive cyber defense. The survey begins with an overview of related
works and our distinct contributions, followed by an examination of SG
infrastructure. Next, we classify various cyber defense techniques into
reactive and proactive categories. A significant focus is placed on DL-enabled
proactive defenses, where we provide a comprehensive taxonomy of DL
approaches, highlighting their roles and relevance in the proactive security
of SG. Subsequently, we analyze the most significant DL-based methods
currently in use. Further, we explore Moving Target Defense, a proactive
defense strategy, and its interactions with DL methodologies. We then provide
an overview of benchmark datasets used in this domain to substantiate the
discourse. This is followed by a critical discussion on their practical
implications and broader impact on cybersecurity in Smart Grids. The survey
finally lists the challenges associated with deploying DL-based security
systems within SG, followed by an outlook on future developments in this key
field.

Keywords: . Smart Grid, Early detection, Proactive Security, Deep Learning,
Moving Target Defense

##  I Introduction

A smart grid (SG) is an advanced electricity delivery system that leverages
digital technology to enhance the power grid’s efficiency, reliability, and
sustainability. The SG facilitates the integration of renewable energy sources
such as solar and wind power, electric vehicles, and energy storage systems,
promoting eco-friendly electricity generation. It harnesses the potential of
cutting-edge technologies such as sensors, communication networks, and
advanced control systems. This utilization enables real-time monitoring and
control over the electric power grid [1]. The role of SG is crucial in
adapting to the dynamic conditions presented by distributed generation and
renewable energy, with its advanced technologies facilitating the
bidirectional flow of electrical energy. Its objective is to establish a
flexible system capable of accommodating power demand, supply, and storage
options associated with the distribution system. The seamless exchange of data
and communication among consumers, power utilities, and system operators in SG
is made possible by implementing smart meters (SMs) in residences, buildings,
and industrial facilities, a key component of the Advanced Metering
Infrastructure (AMI). SMs observe consumers’ electricity usage and transmit
detailed readings, either through wireless [2] or wired [3] communications
methods. The data is then conveyed to the utility company for power quality
monitoring and pricing management [4]. This can help consumers monitor and
manage their energy consumption offering the potential for cost savings and a
reduced carbon footprint‘ [5]. Supervisory Control and Data Acquisition
(SCADA) system monitors and manages the transmission network. However, despite
the benefits the SG offers, it is important to address the security and
privacy issues associated with its implementation [6].

Integrating digital technology into the electric power grid introduces new
vulnerabilities that cybercriminals can exploit, which result in disruption of
power supply, theft of sensitive data, and damage to critical infrastructure
[7, 8, 9]. Cyberattacks against SG can take many forms, including customer
data theft, the failure of cyber systems, compromising communication
instruments, spreading false data and malware, and eavesdropping [10, 11].

Ensuring the security of the SG is vital to protecting the electric power
system’s reliability and public safety, as cybersecurity breaches can disrupt
the power supply and damage critical infrastructure. Implementing robust
security measures, including incident response and recovery plans, is
essential. Within the SG, communication protocols such as IEC 60870-5-104 and
DNP3 are widely utilized, providing standardized data transfer and control
commands [12, 13]. However, these protocols lack critical security measures
like authentication and integrity protection, leaving them vulnerable to
attacks such as Man-in-the-middle (MITM) [14, 15], denial-of-service (DoS)
[16], and spoofing [17]. Such vulnerabilities also extend to other common SG
protocols like DNP3 [18, 19, 20]. The extended lifetimes of power grid field
devices, like protection devices and PLCs, further exacerbate the potential
for these attacks, underlining the need for comprehensive security measures.

Some energy companies may face practical constraints when upgrading to newer
models that support protocols like IEC 61850, enabling communication with
intelligent electrical devices (IEDs) [21]. The implementation of IEC 61850
introduces vulnerabilities that necessitate attention, potentially expanding
the attack surface [22]. Modern security mechanisms must seamlessly integrate
with grid operation devices without disrupting the power supply, but some may
lack the computational capacity for additional security functions [23].
Obsolete protocols pose a security challenge, even during device upgrades
[24]. SG cybersecurity measures include secure network architectures,
communication protocols, access controls, and intrusion detection systems
(IDS) to enhance security [5].

Cyberdefense organizations employ reactive and proactive strategies. Reactive
cyber security involves responding to and mitigating attacks with
countermeasures such as IDS, incident response, and patch management [5].
Proactive cyber defense emphasizes threat intelligence analysis, security
awareness training, and continuous monitoring to prevent cyber threats before
they begin. To further enhance cybersecurity, machine learning (ML) and deep
learning (DL) techniques are employed. ML refines the performance of
countermeasures by training on large datasets [25]. DL, a more advanced subset
of ML, uses artificial neural networks for real-time detection and response to
threats. It automates feature extraction in artificial intelligence (AI),
reducing the need for manual intervention and resource allocation compared to
traditional ML methods [26]. This approach enables DL to independently tackle
complex problems, effectively manage unstructured data like images and audio,
and suit big data contexts with its ability to handle large inputs and diverse
outputs [27]. Additionally, DL surpasses traditional methods in cybersecurity
with greater precision, lower false negative rates, and higher classification
accuracy [28]. Its proficiency in managing complex, non-linear data
significantly boosts its performance in network anomaly detection. DL not only
predicts and prevents future threats by analyzing historical data to identify
patterns and trends, [29, 30] but also adapts to the dynamic nature of
cybersecurity, making it an outstanding choice for advanced, data-intensive
applications [31]. It is worth mentioning that our paper specifically
emphasizes DL-based techniques for SG security, recognizing their superior
capability in handling high-dimensional data and complex patterns. This focus
aligns with the established consensus in the literature (as in [32, 26]) on
the advanced efficacy of DL over traditional ML methods.

Figure 1: Paper organization structure.

###  I-A Related Work and Contribution

Cyberattacks on SG encompass various attack methods, exploiting
vulnerabilities with different intentions and strategies. Ding et al. [33]
studied attack strategies and their characteristics and explored the potential
of using AI and blockchain to enhance detection and prevention in SG. Other
studies, such as those cited in [34, 35, 36], focus on ML and DL applications
in cybersecurity, particularly in SG and IDS. [34] offers a comprehensive
analysis of the challenges and prospects of ML in SG cybersecurity. [35]
compares ML methods, including DL, in IDS, emphasizing DL’s benefits in
handling complex data. [36] aims to enhance detection accuracy, reduce false
alarms, and detect unknown attacks through a taxonomy framework that
categorizes IDS literature based on ML and DL approaches. Ferrag et al. [37]
discussed seven distinct DL models’ effectiveness, assessing them using
specific datasets and evaluation metrics. [38] expands on DL applications in
SG, including Federated Learning (FL), edge intelligence, and distributed
computing, highlighting significant applications like energy forecasting and
fault detection. Several authors have analyzed MTD techniques, including
classification and categorization, examining methodologies, algorithms, and
evaluation methods, but with a noticeable lack of emphasis on DL techniques
[39, 40, 41].

Previous surveys in DL-based cybersecurity and MTD have significantly
contributed, but a research gap exists in proactive security in SG
environments. While many techniques, classification methods, and evaluations
have been studied, little attention has been given to DL-based proactive
security measures specific to SG. Therefore, further research is needed to
better understand DL-based proactive security solutions for SG systems. This
will give the researcher an overview of the existing techniques and where to
use them. To differentiate between our survey (i.e., contributions) and the
existing ones, Table I presents a detailed comparison. Our study aims to
explore current DL approaches in SG proactive security, providing insights
into the strengths, weaknesses, and comparisons of primary DL approaches. We
also investigate emerging challenges and future advancements in SG and DL
models.

TABLE I: Comparison of Contributions Ref |  Attack Strategies |  AI/Blockchain |  ML/DL Applications |  SG-specific Challenges |  Benchmarking Datasets |  DL Models |  MTD Techniques |  DL-based Proactive Sec.
---|---|---|---|---|---|---|---|---
[33] | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ | ✗
[34] | ✗ | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗
[35] | ✗ | ✗ | ✓ | ✗ | ✓ | ✗ | ✗ | ✗
[36] | ✗ | ✗ | ✓ | ✗ | ✗ | ✗ | ✗ | ✗
[37] | ✗ | ✗ | ✓ | ✗ | ✓ | ✓ | ✗ | ✗
[38] | ✗ | ✗ | ✓ | ✗ | ✗ | ✓ | ✗ | ✗
[39] | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗
[40] | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗
[41] | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | ✓ | ✗
Our Survey | ✗ | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓

As for the remainder of the paper, section II provides a general overview of
SG infrastructure. Section III provides types of cyber defense techniques,
such as reactive and proactive approaches. Section IV describes the security
objectives and potential threats in SG. Section V will provide a general
overview and prominent DL models and applications utilizing DL and MTD in SG.
Section VI examines benchmark datasets widely utilized in SG. Section VII
presents a comprehensive discussion on DL and MTD’s application in SG,
providing a deeper understanding of their impact and effectiveness. Section
VIII explores challenges in implementing DL for SG cybersecurity and suggests
research directions. Lastly, the study is concluded in section IX. Fig. 1
shows the organization of our paper.

##  II SG Infrastructure

A SG represents a smart evolution of the conventional physical grid aiming for
secure, efficient, and eco-friendly transmission of power demand by utilizing
advanced sensing, communication, and decision-making technology. This section
introduces the SG infrastructure’s key components and functionalities.

####  II-1 SCADA system

SCADA systems enhance industrial automation by enabling optimized and
efficient operations. Comprising a control server, communication channels, and
field devices, they monitor, control, and transmit signals to electrical
devices. The control center processes, stores, and displays data on an HMI.
However, increased interconnectivity and remote access introduce security
vulnerabilities, making SCADA systems susceptible to real-time communication
breaches [42].

####  II-2 Distribution automation

Distribution automation monitors network conditions, detecting faults and
reducing outage duration. Fig. 2 illustrates the integration within SG
architecture, showcasing energy generation, distribution, and consumption.

####  II-3 Distributed energy resources (DERs)

DERs are compact power sources crucial in meeting electricity needs. These
solutions, including storage systems and renewable technologies, support power
demand. Distributed generation encompasses technologies like wind turbines,
solar panels, and batteries, but the integration also requires managing vast
volumes of data [43, 44].

####  II-4 Energy storage systems (ESSs)

ESSs address the imbalance between variable energy generation and fluctuating
demand [45]. Users can reduce energy costs by storing and discharging excess
energy to meet increased load. ESSs effectively alleviate the disparity
between production and consumption, ensuring renewable energy sources’
reliability [46].

####  II-5 Advanced Metering Infrastructure

AMI represents a comprehensive system enhancing SMs by enabling bidirectional
communication, accurate billing, and energy consumption management. It goes
beyond simple meter reading, incorporating devices and systems for advanced
data management, communication, and analysis [47].

####  II-6 Microgrids

Microgrids are networks of connected loads and dispersed energy sources,
controlling the grid using renewable energy sources. They provide better power
quality, enhancing the grid efficiency and reducing environmental impact [48].

####  II-7 Internet of Things (IoT)

The SG can integrate devices, sensors, and systems via IoT, resulting in a
network of interconnected components. It acquires and transmits real-time data
from various sources. However, integrating IoT introduces potential
vulnerabilities and security risks, such as susceptibility to cyberattacks
[49, 50].

####  II-8 Edge computing

The SG establishes an efficient energy transmission network, incorporating
various IoT devices. Edge computing deploys servers near data sources,
enabling localized services and optimized data analysis and processing tasks
from IoT devices, improving overall efficiency within the power grid [51].

Figure 2: SG Architecture

##  III Cyber Defense in SG

Cyber attacks pose a significant challenge for organizations, including SG.
Reactive cybersecurity measures, while foundational, sometimes require support
from a proactive defense approach. This section examines both reactive and
proactive cyber defense approaches in SG.

###  III-A Reactive Cyber Defense

Reactive cybersecurity focuses on detecting and countering threats, often
using IDS that alert organizations after incidents have occurred.

####  III-A1 Rule-Based Approaches

Initially, rule-based systems were prevalent, operating by established attack
patterns. However, their limitations led to more advanced techniques such as
knowledge-based and anomaly-based methods in SG [52, 53].

####  III-A2 Knowledge-based (signature-based) IDS

This approach stores predefined intrusion patterns, achieving high detection
accuracy but failing to identify novel attacks. It requires frequent updates
in dynamic settings [54, 55, 56].

####  III-A3 Anomaly-based techniques

Anomaly-based IDS identifies malicious activities by analyzing deviations from
normal behavior. Effective in identifying unseen attacks, it can lead to a
high rate of false alarms, and defining the threshold of normal behavior is
challenging [57, 58, 59, 60].

####  III-A4 Deception

Deception techniques, such as honeypots, have gained popularity. These
techniques are categorized based on their level of interaction with attackers.
They serve as a reactive strategy for identifying and addressing ongoing
attacks and also enable the collection of forensic evidence [61, 62, 63, 64,
65].

Figure 3: IDS and IPS Framework

###  III-B Proactive Cyber Defense

Proactive security measures enhance resilience and defend against online
attacks, ensuring the integrity and reliability of SG operations. These
measures enable effective threat identification, prompt accident response, and
anticipating attackers’ activities. Let’s examine proactive cyber defense
strategies that improve SG security.

####  III-B1 Intrusion prevention systems

Intrusion prevention systems (IPS) involve conducting intrusion detection and
making efforts to halt potential incidents that have been identified. IPS
often incorporate IDS functionality as part of their framework and may utilize
a combination of these techniques to detect and mitigate potential malicious
behavior within a network [66, 67]. While IPS and IDS are commonly discussed
together, it is important to note that they are distinct tools with different
primary focuses. See Fig. 3 for an illustration depicting the relationship
between the IDS and IPS response.

####  III-B2 Encryption

Encryption secures data by changing its structure, preventing unauthorized
access and false information injection. The data becomes incomprehensible
without the encryption key, thereby discouraging unauthorized exploitation.
This method safeguards against eavesdropping or tampering, ensuring
confidentiality and integrity [68]. Garg et al. introduced an authentication
scheme for SMs, utilizing various cryptographic techniques [68]. Syed et al.
[69] proposed a privacy-preserving DL model for SG applications, using
homomorphic encryption. While crucial, encryption must be complemented by
other defensive measures for comprehensive cyber threat protection.

####  III-B3 Moving Target Defense (MTD)

MTD is a proactive security approach that constantly modifies the system’s
attack surface, making it difficult for attackers to exploit vulnerabilities
[39, 40]. This includes changing IP addresses [70], diversifying operating
systems [71], implementing redundancy measures [72], and employing deceptive
techniques like honeypots [73]. By doing so, MTD diminishes the effectiveness
of pre-attack reconnaissance, hindering the attackers’ intelligence gathering
[39, 40]. Unlike other cyber deception techniques, MTD focuses on system
modification rather than misinformation [74]. It has been integrated with
decision-making approaches like game theory [75, 76, 77], Markov Decision
Process [78, 79, 80, 81], and DL schemes [82, 83, 84, 85, 86, 87].

MTD was recently explored for enhancing the defense of state estimation (SE)
in cyber-physical power systems [88, 89]. Implementing MTD increases the
complexity for attackers by introducing uncertainty and elevating the attack
cost. This is achieved through the random modification of measurements and
topology concerning line admittances, and the utilization of Distributed
Flexible AC Transmission System (D-FACTS) devices to perturb line parameters
[90, 91], as shown in Fig. 4. This randomization must be carefully managed to
maintain system stability and reliability [88, 89]. The full placement
strategy using D-FACTS devices provides a more robust defense but at a higher
cost [39]. A comparison of SG cyber defense approaches is provided in Table
II.

TABLE II: Comparison of Cyber Defense Approaches for SG Cyber Defense Approach |  Description |  Advantages |  Limitations |  SG Application
---|---|---|---|---
Reactive Cyber Defense |  This approach focuses on autonomously detecting threats and identifying potential vulnerabilities, which allows for rapid notifications to organizations about cybersecurity incidents, facilitating prompt, efficient response and assisting post-incident measures. |  Provides continuous protection, reducing the need for constant human intervention. Efficient in minimizing exposure to known threats. |  Lacks proactive threat hunting capability, hence can be ineffective against novel or evolving threats. It only responds once a threat has occurred. |  A foundational part of any SG cybersecurity strategy. Effective for dealing with known threats but can struggle with unidentified or novel threats.
Proactive Cyber Defense |  Proactive Defense in SG setting is about being one step ahead of potential threats. This includes measures such as threat hunting, which actively searches for and counters threats before they can impact the SG. |  Enables the anticipation and prevention of threats before they affect the SG. Enables early detection through proactive activities. |  This approach can be resource-intensive and requires specialized expertise. Requires deep knowledge of the constantly evolving threat landscape. |  Despite being resource-intensive, it’s the most comprehensive defense method. It’s crucial for ensuring the highest level of security in SG by pre-empting threats before they occur.
Figure 4: Applying MTD to Mitigate Injection Attacks in Smart Grids [88].

####  III-B4 DL-based proactive measures

DL-based anomaly detection enables early detection and prevention of cyber
threats. These approaches allow organizations to take timely actions and
enhance their overall cyber security by analyzing large volumes of data. There
are various methods by which DL can improve physical and cybersecurity in SG:

##### Network security

leveraging DL algorithms makes it possible to identify and block malicious
traffic on the network, which can prevent cyber attacks like DoS attacks that
disrupt services [92].

##### Access control

DL algorithms can detect and prevent unauthorized access to SG assets,
enhancing access control and protecting against cyber attacks compromising the
electric power system’s security [93, 94].

##### Intrusion detection

DL algorithms can identify and respond to cyber threats in real-time,
mitigating the risks of cyber attacks that aim to compromise the security of
the electric power system [29, 95].

##### Alert prioritization

DL algorithms can analyze and prioritize security alerts, enabling security
teams to concentrate their resources on the most critical threats.

##### Physical security

DL-based techniques can analyze video footage from security cameras to detect
unusual behavior or physical tampering with power grid assets, which can aid
in protecting against physical threats to the electric power system [96].

###  III-C Types of IDS

##### Host-based intrusion detection systems (HIDS)

HIDS monitor and analyze internal system activity and behavior at the single
host level. They detect internal attacks like malware infections and
unauthorized access attempts, collecting data from host event logs. IDS alerts
system administrators, end users, or both when anomalous behavior is detected,
allowing restrictions on user requests [97].

##### Network-based Intrusion Detection System (NIDS)

NIDS monitors network traffic to protect against network-borne threats. It
analyzes data using network components like switches, routers, or sensors,
identifying intrusions targeting nodes or devices, including port scanning,
DoS, and Distributed DoS (DDoS) attacks. NIDS logs information in system
records [98].

##### Hybrid IDS

It integrates network-based and host-based systems to enhance intrusive
activity detection in distributed environments. This improves security for
hosts and networks, but managing both detection functions within a single IDS
can be challenging [97].

##  IV SG Security Objectives and Threats

The deployment of SG requires integrating numerous devices, including SM,
sensors, and renewable energy sources that communicate by sharing control
commands and information. However, this increased interaction and integration
makes the SG more susceptible to potential attacks, threatening its stability
and safety. Therefore, the US National Institute of Standards and Technology
(NIST) created a framework to thwart cyberattacks to reduce the occurrence and
impact of cyber-attacks on crucial SG infrastructure. The SG must thus
integrate security mechanisms, continuous monitoring, and proactive risk
mitigation strategies to achieve the following NIST security objectives. Fig.
5 visually illustrates potential attack locations within the SG system,
presenting a comprehensive overview of attack and defense aspects. It
showcases the areas where various cyber-physical attacks can be simulated and
analyzed, including the defense mechanisms surveyed in Section III.

The objectives of security include availability, integrity, and
confidentiality. Masquerade attacks, in particular, pose a significant threat
to all these objectives, unlike various other attacks that may compromise only
one or two. The attacker can bypass security measures and gain access to
sensitive information by exploiting valid credentials or unauthorized
knowledge of the target’s identity, undermining the system’s overall security.
Fig. 6 depicts various attacks targeting the security objectives, compromising
the system’s overall security.

###  IV-A Availability

SG security focuses on availability, ensuring reliable, timely customer
information access. This contributes to the power supply’s efficiency by
providing customers’ uninterrupted power supply.

##### DoS and DDoS attacks

DoS and DDoS attacks disrupt wireless communication networks in SG by
overwhelming systems with excessive traffic or requests, preventing legitimate
users from accessing them. An example of such attacks is flooding attacks,
which can cause system crashes or render the network unresponsive [7].

##### Jamming attacks

These attacks disrupt communication systems by continuously broadcasting
signals or using deceptive techniques, compromising availability and hindering
communication among authorized devices [99, 100]. Attackers employ various
types of jammers, including constant, random, deceptive, and reactive jammers,
to interfere with the communication channel and block the transmission and
reception of information [101].

##### Buffer overflow attacks

The attacks here occur when a vulnerability in a system or application within
the grid allows an attacker to flood a buffer with excessive data. This
overflow can lead to critical data corruption, disrupt system operations, and
create the potential for cascading failures, ultimately resulting in system
crashes [8].

Figure 5: Illustration of cyber-physical attacks defense mechanisms in SG.

###  IV-B Integrity

Cybercriminals may attempt to gain unauthorized access to SG assets, such as
control systems, to compromise the security of the electric power system.
Integrity refers to protecting against unauthorized change or destruction of
information or resources to maintain the accuracy and efficiency of data flow
throughout the system operation. Examples of integrity attacks include:

##### Malware

Cybercriminals may use malware, such as viruses and ransomware, to compromise
the security of SG systems and disrupt power supply [102].

##### MITM attacks

MITM attacks allow attackers to interrupt and alter the communication between
devices, such as SM and the energy management system. Modifying the
transmitted information might interfere with electricity distribution and harm
the grid infrastructure [100].

##### False Data Injection (FDI) attacks

FDI attacks aims to manipulate the data in a network or system; this includes
altering sensor readings of critical infrastructure systems like power grids.
By doing so, the system believes it is functioning properly when it is not,
causing significant harm or damage [103].

##### Spoofing

Spoofing involves impersonating a legitimate party to deceive others into
disclosing sensitive information through packet exchange with network devices.
Attackers can introduce false or misleading data, potentially causing
incorrect decisions and transmitting unauthorized content [104].

##### An intrusion attack

The attacks herein occur when an adversary exploits network vulnerabilities to
gain unauthorized access to the network’s nodes. This unauthorized access
allows attackers to tamper with files, inject malicious code, or manipulate
configurations, potentially compromising the reliability and usability of the
system [105].

##### Brute-force attacks

These attacks compromise the integrity of the SG control system by targeting
unauthorized access. In SG, the central control system and various devices
rely on secure protocols with encryption for communication. However, the
brute-force attack undermines the system’s security measures, exploiting
vulnerabilities and jeopardizing the integrity of the control system [106].

##### Tampering attacks

The attacks here involve unauthorized modification of data or systems [9].

###  IV-C Confidentiality

Confidentiality attempts to secure personal privacy by ensuring that only
legitimate individuals can access sensitive information while such information
is not exposed to others without proper authorization.

##### Eavesdropping

Eavesdropping allows unauthorized attackers to access confidential information
exchanged between authorized parties by monitoring communication channels
without engaging in packet exchange or active participation. Through
eavesdropping, attackers can gain sensitive data, exploit vulnerabilities, and
access confidential information [9].

##### MITM attack:

The attacker positions themselves between two communicating parties, enabling
them to intercept the data flow. This interception allows the attacker to
monitor the conversation and illicitly obtain confidential data covertly
[100].

##### An intrusion attack

An intrusion attack compromises SG data confidentiality by unauthorized access
to communication channels and central control systems. The attacker gains
access to sensitive information, causing privacy violations and vulnerability
exposure, potentially exploiting in future attacks [105].

##### Brute-force attacks

Brute-force attacks on SG can compromise its confidentiality by systematically
attempting various combinations of credentials to gain unauthorized access to
sensitive data.

##### Spoofing attacks

Spoofing attacks compromise information security, privacy, and trust, allowing
unauthorized access.

##### Social engineering

attackers use persuasion and communication techniques to gain victims’ trust,
obtaining private information like passwords and personal identification
numbers for unauthorized access to target systems. Common methods include
pretexting, phishing, and tailgating attacks [107].

##### Traffic analysis attacks

Traffic analysis attacks monitor message timing and size to determine hosts’
identities and locations. The attacker extracts communication patterns between
nodes by sniffing and examining messages, aiming to manipulate the SG network
[108].

Figure 6: Illustration of attacks intersection on security objectives:
Integrity, Confidentiality, and Availability.

(a) Autoencoder

(b) LSTM

(c) DRL

(d) CNN

(e) GNN

(f) Transformer

Figure 7: Common deep neural networks used in security and intrusion detection
applications.

##  V Deep Learning Approaches

This section aims to provide a concise taxonomy of prominent DL approaches and
explore their recent related work, specifically in the context of proactive
security techniques in SG. DL techniques have shown promise in addressing SG
security challenges. As illustrated in Fig. 7, we can identify the
methodologies and architectures successfully applied in proactive security
measures for SG. Additionally, discussing the recent related work allows us to
highlight the advancements in DL-based security techniques that have enhanced
the resilience and protection of SG infrastructure against cyber threats.

###  V-A Taxonomy of Deep Learning Approaches

####  V-A1 Autoencoders

DL autoencoders (AE) are powerful tools for acquiring efficient unlabeled data
representations. These architectures consist of an encoder network that
compresses input data into a lower-dimensional latent representation and a
decoder network that reconstructs the original input from the compressed
representation. Bottleneck refers to a network with a hidden layer containing
key data characteristics, significantly smaller than input and output layers
[109, 92]. The AE can learn to recognize variations from expected patterns by
adjusting model weights and minimizing reconstruction errors during training.

####  V-A2 Recurrence Neural Networks

Recurrence neural networks (RNNs) are specific types of neural networks
capable of handling sequential data. These networks are designed to retain
information from previous inputs, allowing them to account for context and
dependencies between different time steps. LSTM networks and Gated Recurrent
Units (GRU) are two examples of the various types of RNNs. LSTMs and GRUs were
developed to tackle the “vanishing gradients” issue in recurrent neural
networks [110], which arises when the gradients of the network’s weights
become very small, making it hard for the network to learn. LSTMs use
specialized memory cells with gating mechanisms to control the flow of
information, allowing for access to long-term dependencies [111]. On the other
hand, GRUs use a simpler gating mechanism relying on a single “update gate” to
regulate the flow of information, which allows for faster training and less
memory usage but may not be as effective in capturing long-term dependencies
[112]. Nonetheless, they are still capable of retaining long-term
dependencies. Compared to LSTMs, GRUs are faster to train and require fewer
parameters, making them more efficient for specific tasks. However, the
performance of each model variant relies on the particular task and dataset
being utilized.

####  V-A3 Convolutional Neural Networks

Convolutional Neural Networks (CNN) are a powerful type of neural network that
has revolutionized the field of computer vision [113]. These networks use a
hierarchical structure of layers to automatically learn increasingly complex
features from input data, such as images. The layers perform various
functions, including convolution, pooling, and classification. Convolutional
layers use filters to learn features such as edges and shapes. These features
are then passed to pooling layers, which reduce spatial dimensions, speeding
up computation and lowering the risk of overfitting. Pooling layers extract
crucial features that enhance image recognition and classification
performance. Finally, fully connected layers use these refined features for
image classification.

####  V-A4 Deep Reinforcement Learning

Deep Reinforcement Learning (DRL) is a MLstrategy that combines deep neural
networks and reinforcement learning techniques [114]. This combination enables
the agent to learn from its environment through trial and error. DRL is
categorized primarily into two groups: value-based and policy-based. Value-
based methods in DRL primarily concentrate on acquiring an optimal value
function or Q-value function of various states. This function predicts the
anticipated cumulative reward the agent can obtain by selecting a specific
action in a specific state. Deep Q-learning (DQL) is a prevalent value-based
DRL algorithm that utilizes a deep neural network to estimate the Q-value
function. It is an extension of Q-learning. Double Deep Q-learning (DDQL) and
Dueling Deep Q-learning (DDDQL) are further extensions of DQL that improve its
performance by addressing challenges such as reducing the computation required
for training and overestimation bias. Conversely, policy-based DRL algorithms
focus on directly finding the optimal policy by mapping states to actions
using a neural network. Actor-critic, a frequently used DRL algorithm,
combines an actor-network that learns the policy and a critic-network that
learns the value function [115, 116].

####  V-A5 Transformers

The transformer network, proposed by Ashish Vaswani et al. [117] has gained
significant success in Natural Language Processing (NLP) applications. It
employs multi-head attention and self-attention, addressing the challenge of
capturing long-range dependencies in sequential data [118]. Transformers have
been adapted to computer vision domains and have significantly impacted NLP
tasks. The transformer architecture includes an encoder and decoder, each
playing a distinct role in the network’s operations. The encoder layer
transforms input sequences into continuous representations, capturing
information through multi-headed attention and a fully connected network. The
decoder layer generates text sequences. It utilizes two multi-headed attention
layers, a pointwise feed-forward layer, and residual connections.
Additionally, it includes a linear layer as a classifier and a softmax
operation for word probabilities. Table III provides an extensive overview of
various DL approaches for cybersecurity applications, including information on
their specific approach, suitable use cases, advantages, disadvantages, and
relevant research papers.

####  V-A6 Graph Neural Networks

Graph Neural Networks (GNNs) are DL models that capture intricate
relationships and dependencies in data organized in a graph structure. They
learn about nodes and edges by collecting information from neighboring nodes
and adjusting node features based on this amalgamated information. GNNs use
node properties and connections stored in adjacency matrices to generate
embeddings that capture both the structure and characteristics of nodes. These
embeddings are useful for making predictions at the individual node and graph
levels [119]. GNNs have various variants, each with distinct capabilities for
modeling and analyzing graph-structured data. Recurrent GNNs (RecGNNs) use
recurrent neural architectures to acquire node representations through
continuous information exchange. Convolutional GNNs (ConvGNNs) expand upon
convolution to incorporate graph data, aggregating nodes, and neighboring
features.

TABLE III: Overview of DL Approaches for Cybersecurity Applications. Approach |  Where to Use |  Pros |  Cons |  Papers
---|---|---|---|---
Autoencoders |  DDoS attack detection, network flow characteristics, intrusion detection, zero-day malware detection, anomaly detection in Battery Electrical Storage Systems, hierarchical detection approach. |  High prediction accuracy, effectiveness in identifying anomalies, robust to adversarial attacks, ability to detect anomalies with small variations over time, ability to learn complex correlations between measures. |  Accurate estimation of the state of charge remains a limitation. |  [120, 121, 29, 10, 95, 122, 123]
DRL |  Data integrity threats in AC power systems, data integrity breaches, FDI attacks in the SG, data integrity attacks in AC power systems, FDI attacks on dispersed networks, FDI attacks on energy pricing. |  High learning efficiency, improve detection performance, identify FDI attacks and engage in more rewarding actions, reduce power losses in the SG. |  Continuous attacks have a long-term influence on system SE, making it challenging for detection systems to capture them. |  [124, 125, 103, 126, 30, 127, 128, 129]
RNN |  Two-phase learner-based FDI attacks detection technique, real-time detection mechanism within the physical microgrid, AGC systems SE, DC microgrid vulnerability to FDI attacks on the DC bus voltage, electricity theft. |  Captures non-linear data features, real-time evaluation, reduces the impact of FDI attacks, accurately estimates the attack signal and outperforms classical neural networks in disturbance rejection and tracking performance. |  RNN models are complex and process sequential data, leading to training complexity. They have limited interpretability, making explaining predictions or identifying patterns difficult. Long sequences, like time series data in SG, can introduce computational and memory limitations, affecting performance and efficiency. |  [130, 131, 11, 132, 133, 134, 135, 136]
CNN |  Use CNN for detection of energy theft in SG. They are effective against DoS, FDI attacks, jamming, and hybrid attacks. Additionally, CNN can be applied to HVDC systems and detect FDI attacks on Phasor Measurement Unit (PMU) data. |  CNN efficiently identifies abnormal patterns, learns relevant features, simplifies training, and create deep networks with low computational demands. |  CNN lacks sequence modeling capabilities to capture long-term dependencies in sequential data. Handling variable-length sequences also poses challenges for CNNs. |  [94, 137, 138, 139, 140]
GNNs |  Detecting cyber attacks, identifying attacks, identifying cyber vulnerabilities in grid-connected photovoltaic (PV) inverters, detecting FDI attacks on smart power grids. |  considering both temporal measurements and topological connectivity, captures the spatial correlations of SG data, integrates the spatial aspects of power system topology into the detection mechanism. |  Lacks temporal information, limiting timely response and accuracy. The model’s real-time applicability is constrained, and its capacity for dynamic parameter tuning is limited. Less reliable for scenarios with varying attack locations and intensities. |  [141, 142, 143, 144, 145]
CNN + LSTM |  Identify cyber vulnerabilities in grid-connected PV inverters, identify energy theft in AMI systems, identify stronger correlations between Time-varying data. |  Minimize the spectral fluctuation across several variables, minimize temporal fluctuation in the data, capture spatial features using the convolutional layer and temporal features using the LSTM. |  The complexity of CNN-LSTM models necessitates additional data and resources for training. Tuning hyperparameters becomes a time-consuming task. Interpretability is challenging due to complex intermediate representations. |  [146, 147, 148, 149, 93]
Transformers |  Anomaly detection of Time Series Data, Advanced Persistent Threat (APT) attacks in IIoT systems, DDoS attacks in SDN, and detecting stealthy FDI attacks in SG. |  Transformer-based sequence modeling and forecasting architecture offer parallel efficiency and long-distance context information. It addresses FDI attack detection challenges and captures long-term correlations, APT attacks, and contextual information in IoT systems, enhancing computational efficiency and scalability. |  Transformers prioritize global relationships, which may limit their ability to capture local patterns and temporal dependencies effectively. They are computationally expensive, slow, and time-consuming, making them challenging for large-scale time series data and experimentation. |  [150, 151, 152, 153, 154, 155, 156, 157]

###  V-B DL-based Prominent Approaches

####  V-B1 Autoencoders

AE models can extract relevant features, making them valuable in detecting
anomalies by distinguishing between signal and noise components. This makes
them popular for fault and intrusion detection [120, 121]. The authors in
[120] proposed a DDoS attack detection system using multilevel shallow and
deep AE. The model employed an unsupervised technique to encode training data
for dimensionality reduction and use multiple kernel learning to combine
encoded features. This approach improves detection accuracy by automatically
considering AE-based characteristics, surpassing LSTM and random forest.

Andresini et al. [121] used 1D arrays of network flow characteristics to train
intrusion detection models. They assessed the effectiveness of 1D CNNs, AEs,
and multi-channel convolutions. They integrated supervised and unsupervised
multi-channel feature learning to identify feature dependencies and enhance
detection effectiveness by learning the impact of each channel and utilizing
existing patterns among channels.

Authors in [29] presented ICVAE-DNN for intrusion detection, combining ICVAE
with DNN to identify sparse representations in large datasets. The ICVAE
encoder sets DNN hidden layer weights, enabling fast training and avoiding
local minima. It generates unidentified attack samples to balance the training
data and increase variability, allowing DNN to extract high-level features and
reduce input dimensionality.

Kim et al. [10] introduced an AE-based semi-supervised model and One-Class
classification algorithm for zero-day malware detection, combining VAE and CNN
AE(1D) models. The method is resilient against evasion and adversarial
attacks, demonstrating the potential for identifying new and unseen malware
without manual configuration.

The authors in [95] propose an anomaly detection algorithm for Battery
Electrical Storage Systems in DERs. The algorithm utilizes an AE to detect
dangerous working conditions by observing the physical behavior of the system.
It outperforms traditional One-Class Support Vector Machines in detecting
unsafe conditions, unusual behavior, partial attacks, and bad data injection.
However, accuracy in estimating charge remains a limitation.

Kye et al. [122] introduced a hierarchical detection approach using multiple
stages to identify extreme anomalies based on abnormality levels. The NIDS
solution improves detection performance without relying on scarce abnormal
data. It uses the autoencoder’s hidden space, specialized anomaly scores, and
self-supervision signals during training. The detection process evaluates
anomaly scores and triggers alarms based on a predefined threshold. The first
stage identifies extreme outliers using meta-representation, while the second
stage amplifies the reconstruction error and detects anomalies missed in the
first stage [122]. Song et al. [123] investigated network intrusion detection
using AE models and found that model capacity significantly impacts
effectiveness. Models with larger capacities performed better, but the number
of hidden layers did not correlate substantially with its efficacy, suggesting
the need for a suitable model structure and latent size.

####  V-B2 DRL

The Deep-Q-Network Detection (DQND) algorithm has been a crucial technique
utilized in various studies to enhance cybersecurity in power systems. Authors
in [124] applied the DQND technique to improve the defensive approach against
data integrity threats in AC power systems SE. The effectiveness of the
learning process was investigated using a quantification of the observation
space sliding window. Meanwhile, Lee et al. [127] developed a DQND algorithm
to reduce detection delays in cyberattacks on SG, ensuring rapid and precise
threat identification. Authors in [125] proposed a DRL-based method for
detecting data integrity breaches using an LSTM network to assess power grid
attacks. The weights are subjected to noise for agent exploration, and a
multi-step reward function improves Q-value accuracy. Continuous attacks have
a long-term impact on system SE, making detection challenging compared to
discontinuous attacks, which can only be detected at discrete time steps.

Huang et al. [103] proposed an attention-based DRL detection model to identify
FDI attacks in the SG. The model uses an attention mechanism to extract state
information, assigning weights to state features and learning the significance
of each measurement point. This enables the agent to make informed decisions
by focusing on significant pre- and post-attack state features. Using multi-
sourced data, Hu et al. [30] adaptive feature boosting method for intrusion
detection in SG. The technique employs weighted feature sampling and a series
of AE to capture critical features and train them to a random forest
classifier. The Deep Deterministic Policy Gradient (DDPG) determines feature
sampling probability. The ensembled AE and classifier sequence differentiate
between normal, fault, and attack events. Abianeh et al. [128] developed a
DDPG multiagent DRL to analyze index-based detection algorithm vulnerabilities
against stealthy destabilizing FDI attacks on dispersed networks and launch
coordinated disruptive FDI attacks on cyber-secured DC microgrids. The
algorithm integrated a sniffer feature to detect and resolve disconnections
but failed to detect the coordinated FDI attacks. An additional RL DQN
detection algorithm was presented to improve the reliability of index-based
FDI attacks susceptibilities detection algorithms, yielding a fully cyber-
secure system. Zhang et al. [129] developed a two-stage defensive approach to
address security risks in FDI attacks on energy pricing. They combined
recursive least-square methods with a radial basis function neural network to
improve learning efficiency. The distributed DDPG approach splits actor
networks into multiple subproblems, enabling microgrids to learn their best
action schemes independently while collaborating with nearby microgrids.
Similarly, Selim et al. [126] proposed an approach to address voltage
violations and reduce power losses in the SG by regulating DERs and tie-
switches. The original soft actor-critic (SAC) technique has been expanded to
accommodate both discrete and continuous actions for scenarios, including
regulating DERs’ setpoints and network switches.

TABLE IV: DL countermeasures for cybersecurity in power systems. Paper |  Security Issue | AE | DRL | RNN | CNN | GNNs | Transformers
---|---|---|---|---|---|---|---
| DQN | DDQN | SAC | DDPG | RNN | LSTM | GRU |  |  |
[120] |  DDoS attack detection | ✓ |  |  |  |  |  |  |  |  |  |
[121] |  Intrusion detection | ✓ |  |  |  |  |  |  |  | ✓ |  |
[29] |  Intrusion detection | ✓ |  |  |  |  |  |  |  |  |  |
[10] |  Zero-day malware detection | ✓ |  |  |  |  |  |  |  | ✓ |  |
[95] |  Anomaly detection for battery systems | ✓ |  |  |  |  |  |  |  |  |  |
[122] |  Extreme anomalies detection | ✓ |  |  |  |  |  |  |  |  |  |
[123] |  AE for network intrusion detection | ✓ |  |  |  |  |  |  |  |  |  |
[124] |  Data integrity in AC power systems |  | ✓ |  |  |  |  |  |  |  |  |
[125] |  Data integrity breaches |  | ✓ |  |  |  |  | ✓ |  |  |  |
[103] |  False Data Injection Attacks (FDI attacks) |  |  | ✓ |  |  |  |  |  |  |  |
[126] |  Intrusion detection in SG |  |  |  | ✓ |  |  |  |  |  |  |
[30] |  Data integrity attacks in AC power system | ✓ |  |  |  | ✓ |  |  |  |  |  |
[127] |  FDI attacks on dispersed networks |  |  | ✓ |  |  |  |  |  |  |  |
[128] |  FDI attacks on energy pricing |  |  |  |  | ✓ |  |  |  |  |  |
[129] |  FDI attacks on energy pricing |  |  |  |  | ✓ |  |  |  |  |  |
[130] |  FDI attacks detection |  |  |  |  |  |  | ✓ |  |  |  |
[131] |  FDI attacks on smart microgrids |  |  |  |  |  | ✓ |  |  |  |  |
[11] |  Impact of FDI attacks and TD attacks on AGC |  |  |  |  |  |  | ✓ |  |  |  |
[132] |  TD attacks detection |  |  |  |  |  |  | ✓ |  |  |  |
[133] |  FDI attacks on the DC bus voltage |  |  |  |  |  |  |  | ✓ |  |  |
[135] |  Electricity theft in SG |  |  |  |  |  | ✓ |  | ✓ |  |  |
[136] |  Electricity theft in SG |  |  |  |  |  |  | ✓ | ✓ |  |  |
[134] |  SDN-based defense against SG cyber-attacks |  |  |  |  |  |  |  | ✓ |  |  |
[146] |  Cyber vulnerabilities in grid-connected PV inverters |  |  |  |  |  |  | ✓ |  | ✓ |  |
[147] |  Energy theft in AMI systems |  |  |  |  |  |  | ✓ |  | ✓ |  |
[148] |  ETD |  |  |  |  |  |  | ✓ |  | ✓ |  |
[149] |  Electricity theft in SG |  |  |  |  |  |  | ✓ |  | ✓ |  |
[93] |  Vulnerability of SCADA systems to FDI attacks |  |  |  |  |  |  | ✓ |  | ✓ |  |
[158] |  Cyber-attacks affecting energy generation readings |  |  |  |  |  |  |  | ✓ | ✓ |  |
[94] |  Cyber-attacks on PMU-based HVDC Ancillary Service Control |  |  |  |  |  |  |  | ✓ | ✓ |  |
[139] |  Multiple cyber-attacks on Cyber-Physical Power Systems | ✓ |  |  |  |  |  |  |  | ✓ |  |
[137] |  Energy theft detection |  |  |  |  |  |  |  |  | ✓ |  |
[138] |  Energy theft detection |  |  |  |  |  |  |  |  | ✓ |  |
[140] |  Privacy-preserving electricity theft detection |  |  |  |  |  |  |  |  | ✓ |  |
[141] |  Attack identification and localization |  |  |  |  |  |  |  | ✓ |  | ✓ |
[142] |  FDI attacks detection |  |  |  |  |  |  |  |  | ✓ | ✓ |
[143] |  Cyberattack identification |  |  |  |  |  |  |  |  |  | ✓ |
[144] |  Large-scale AC power grid FDI attacks detection |  |  |  |  |  |  |  |  |  | ✓ |
[145] |  FDI attacks detection on smart power grids |  |  |  |  |  |  |  |  | ✓ | ✓ |
[150] |  APT attack detection |  |  |  |  |  |  |  |  |  |  | ✓
[151] |  IoT anomaly detection |  |  |  |  |  |  |  |  |  | ✓ | ✓
[152] |  DDoS attack detection on SDN |  |  |  |  |  |  |  |  | ✓ |  | ✓
[153] |  FDI attacks detection in SG |  |  |  |  |  |  |  |  |  |  | ✓
[154] |  IDS for high-dimensional anomaly data |  |  |  |  |  |  |  |  |  |  | ✓
[155] |  Anomaly detection on time series data |  |  |  |  |  |  |  |  |  |  | ✓
[156] |  Time series anomaly detection |  |  |  |  |  |  |  |  | ✓ |  | ✓
[157] |  Intrusion detection |  |  |  |  |  |  |  |  |  |  | ✓

####  V-B3 RNN

Wang et al. [130] introduced the KFRNN system, a two-phase learner-based FDI
attacks detection technique. The first phase utilizes RNN to capture non-
linear data features and the Kalman filter for linear data features. The
second-phase learner dynamically merges the outcomes of the two initial
learners using a fully connected layer and backpropagation module. Results
show that the KFRNN approach outperformed the conventional Bad Data Detector
and R2N2_variant. Naderi et al. [131] proposed a remedial action scheme to
combat severe FDI attacks targeting smart microgrids. The scheme uses a
hardware-in-the-loop integrated with an RNN for real-time detection within the
physical microgrid. The model includes six parallel RNN units, two for each
device type. Microgrid sensors provide inputs, including voltage and current
readings injected with FDI attacks. The RNN units use identical layer
structures for predictions, estimating new readings, and comparing them to
sensors’ values. Authors in [11] explored the impact of nonlinearities on
AGC’s response to FDI attacks and Time Delay (TD) attacks, highlighting the
need to consider these factors during AGC system design and implementation.
The model consists of two stages: detecting and identifying attacks using an
LSTM model trained on a normal AGC operation dataset, and reducing the impact
of FDI attacks using another LSTM model. This technique uses compromised
signals from the first step to produce a rectified signal and employs Root
Mean Square Error (RMSE) to assess its effectiveness. Ganesh et al. [132]
developed a hierarchical LSTM model to monitor and detect TD attacks online,
processing raw data streams from sensors. The model consists of two layers
linked sequentially, segmenting input data into shorter sub-sequences and
extracting local properties independently. The upper level evaluates local
features to obtain temporal properties for the entire sequence. This
hierarchical structure captures both short-term and long-term dependencies,
enhancing its effectiveness in recognizing TD attacks. In [133], the authors
proposed a GRU-based framework to address DC microgrid vulnerability to FDI
attacks on the DC bus voltage. The framework consists of two parts: an
offline-trained GRU network for real-time evaluation of the DC bus voltage,
which serves as the estimation strategy, and a GRU network combined with a PI
controller to counteract FDI attacks, known as the mitigation strategy.

Authors have investigated the integration of various RNN variants and other DL
techniques to tackle different cyber-attacks in SG, including the combination
of CNN and LSTM methods [146, 147, 148]. Mao et al. [146] developed a CNN-LSTM
technique to identify cyber vulnerabilities in grid-connected PV inverters,
reducing cybersecurity threats from the growing use of renewable energy in
power systems. CNN layers minimize spectral fluctuation across variables,
allowing flexible interpretation after reshaping, while LSTM layers minimize
temporal fluctuations. Input de-redundancy and hyperparameter selection
maximize detection. Adhure et al. [147] designed an Electricity Theft
Detection (ETD) model for identifying energy theft in AMI systems using a CNN-
LSTM stack. The model utilizes one-dimensional convolutional layer data as
input with a kernel size of five and five filters. It includes two LSTM layers
(48 and 24 neurons) with 20% dropout layers. The study in [148] introduces a
ConvLSTM-based model for ETD, incorporating a reshaped 2D matrix of
consumption data and ConvLSTM with embedded CNN and batch normalization. The
model replaces the pooling layer with LSTM to identify stronger correlations
in time-varying data, capturing spatial and temporal features. It improves
dataset balancing, captures local electricity usage, and uses batch
normalization for efficient deployment. The work proposed in [149] aims to
combat electricity theft in SG by installing central observer meters in
communities. The technique analyzes users’ electricity consumption patterns by
transforming time series data into a structured representation, considering
temporal elements and variations across neighboring periods and days. This
approach addresses localized theft concerns and enhances the efficiency of SG.
In [93], a two-stage framework is introduced to tackle the vulnerability of
SCADA systems in SG to FDI attacks. It combines real-time data forecasting
through a CNN-LSTM autoencoder sequence-to-sequence architecture with anomaly
detection based on the forecast. The model accurately estimates the power
consumption state and incorporates an adaptive threshold to identify abnormal
behavior. Ismail et al. [158] developed an ETD system using deep neural
networks to identify cyber-attacks affecting energy generation readings. They
explored three architectures: deep feed forward, deep recurrent, and deep
convolutional-recurrent neural networks. The deep feed-forward network
processed energy generation readings, while the deep recurrent network with
GRUs captured temporal correlations, processed data, and predicted class
labels. The convolutional-recurrent neural network (C-RNN) hybrid architecture
combined convolutional and max-pooling layers for feature extraction and class
label prediction. Electricity theft in SG using a GRU-RNN model was optimized
for time-series data utilizing month and weekday features, focusing on small
perturbation attacks and showing superior performance even with minor energy
reporting modifications [135]. While [136] uses GRU and Bidirectional LSTM for
detecting theft in solar and wind in distributed generation units, with GRU
for single fuel types and BLSTM for complex hybrid fuel scenarios. Kumar et
al. [134] developed a model that integrates a blockchain-based authentication
scheme with a DL-based IDS within an SDN framework to improve cybersecurity in
SG networks. The model uses a self-attention mechanism and a Bi-Gated
Recurrent Unit for temporal dependencies classification.

####  V-B4 CNN

Authors in [94] introduced a SE-DCNN variant to improve PMU-based HVDC
Ancillary Service Control (HASC) reliability in cyber-attack-prone
environments. This CNN structure combines time and frequency domain
information for feature extraction, addressing redundant features. A Squeeze-
Excitation structure addressed redundant features by assigning weights to
useful ones and reducing redundant ones. The SE-DCNN model explicitly models
channel interdependencies, enhancing sensitivity to informative attack
characteristics and enabling more accurate and secure detection. The RL-CNN
approach focuses on intelligent attack localization and recovery in Cyber-
Physical Power Systems under multiple cyber-attacks [139]. It involves a
complex system consisting of a representation-learning-based DL model, deep
AE, and a CNN architecture. The detection problem involves multilabel
classification, and system recovery is performed based on attack information.
The MMSE estimator minimizes mean-squared error and provides conditional
expectations for the system state.

Several authors addressed the problem of energy theft detection in the SG
[137, 138, 140]. Yao et al. [137] proposed an approach that combines privacy
preservation and DL techniques. They utilize Paillier Homomorphic Encryption
to protect energy usage privacy and employ a combined CNN model for analyzing
decrypted SM data. The model classifies the data as either theft or normal. It
employs preprocessing techniques to format the data into image-like
structures, allowing the CNN model to extract relevant features for accurate
classification. In [138], the authors present a novel ETD approach using a
large dataset of energy usage records from smart meters. They use a deep CNN
model with convolution and pooling layers for feature extraction and
classification. This approach emphasizes analyzing power usage patterns to
differentiate between normal consumers and potential energy thieves,
addressing data augmentation challenges. The p2Detect framework improves
privacy-preserving ETD by optimizing model efficiency and accuracy through
homomorphic encryption-friendly training, addressing limitations in
approximations and clustering [140]. It employs secure cryptographic
protocols, ciphertext blinding, and padding embedding to safeguard data and
model privacy. However, it fails to consider security threats from dynamic
cyberattacks. Integrating online learning and using captured samples for
incremental learning is recommended. Secure inferencing using encrypted neural
networks faces declining efficiency due to growing homomorphic encryption
parameters [140].

####  V-B5 GNN

Since the power system can be modeled as a graph, with buses represented as
vertices and transmission lines as edges, many researchers have explored using
GNNs to detect cyber attacks [141, 142]. Haghshenas et al. [141] proposed a
TGNN framework that considers temporal measurements and topological
connectivity to identify attacks. The model uses GNNs with a message-passing
technique, a GRU for temporal data, and a residual block for vanishing
gradients. The effectiveness is assessed using ramp attack and FDI attack
data, revealing high accuracy in identifying and locating attacks. The study
also evaluates the model’s sensitivity to attack location and severity,
revealing areas where attacks are harder to detect. Similarly, authors in
[142] proposed a scalable and real-time FDI attack detector as an early
detection and identification system. Ruan et al. [143] proposed a strategy
using spatiotemporal graph DL (STGDL) to identify cyberattacks. The approach
extracts spatiotemporal features using graph convolution and temporal gated
convolution. Quantile regression training is utilized to create safe
boundaries for state variables in SE to identify abnormalities caused by
cyberattacks. The proposed super-resolution perception network improves
temporal learning by creating high-frequency data using low-frequency SE
results. Boyaci et al. [145] proposed a Chebyshev Graph Convolutional Networks
(CGCN) detector to capture the spatial correlations of SG data and efficiently
model the graph structure of large-scale AC power grids addressing FDI
attacks. The suggested architecture’s autonomous training method eliminates
the need for any optimization steps, making it more suitable for practical
applications. The work in [144] proposed a GNN-based FDI attack detection
strategy on smart power grids using a topology-aware GAE. It addresses the
shortcomings of existing detectors, including the lack of spatial embedding or
detection of only types of FDI attacks found in the training set. The strategy
integrates power system topology spatial aspects to better detect unseen FDI
attacks enhancing generalization abilities. Table IV summarizes the existing
works on DL countermeasures for enhancing cybersecurity in power systems.

####  V-B6 Transformers

The transformer DL technique has been widely used for anomaly detection. BERT
is a proactive APT detection scheme for IIoT systems, overcoming limitations
in traditional representations like word2vec [150]. It models global
dependencies and encodes the APT attack sequence dataset using BERT’s
bidirectional transformer encoder. A Softmax regression classifier trains the
model for accurate classification, leveraging BERT’s transformer architecture
and contextual understanding. The GTA framework, presented in [151], employs a
transformer-based architecture for IoT anomaly detection. It incorporates a
connection learning policy using Gumbel-softmax sampling to automatically
learn the graph structure, revealing hidden associations for accurate
forecasting. The framework also limits the neighborhood scope of each node,
enabling efficient anomaly detection. An Influence Propagation convolution is
introduced to capture anomaly information flow. Wang et al. [152] proposed
DDosTC, a novel hybrid neural network model designed to detect DDoS attacks on
SDN. By integrating scalable transformers and CNN architecture, this model
effectively addresses vulnerabilities and mitigates the risk of potential
network collapse. DDosTC comprises a transformer layer, CNN layer, and dense
layer for feature extraction. Li et al. [153] proposed a method for detecting
FDI attacks in SG using transformer, FL, and the Paillier cryptosystem.
Distributed detection with edge node detectors eliminates central workstation
and communication delays. The transformer model analyzes electrical quantities
at edge nodes, allowing precise FDI attack detection. The FL and the Paillier
cryptosystem encrypt exchanged data, enhancing security and ensuring
confidentiality against hackers. The Robust Transformer-based Intrusion
Detection System (RTIDS) is an efficient and accurate IDS for high-dimensional
anomaly data [154]. It uses techniques like positional embedding, stacked
encoder-decoder neural networks, and self-attention mechanisms to reconstruct
feature representations and classify network traffic. The framework consists
of three modules: data preparation, RTIDS model construction, and real-time
detection. The authors in [155] proposed TGAN-AD to address the challenges in
anomaly detection on time series data. It combines Generative Adversarial
Networks (GANs) and transformers to extract contextual features from time
series data and employs a discriminator to identify abnormal data. TGAN-AD
demonstrates high accuracy in anomaly detection across multiple datasets, such
as SWaT, WADI, and KDDCup99. DCT-GAN is a novel approach for time series
anomaly detection, overcoming challenges like model collapse, low
generalization capability, and poor accuracy [156]. It employs multiple
generators and a single discriminator, enabling the extraction of fine-grained
and coarse-grained information from time series data. It also incorporates a
weight-based mechanism to balance the contributions of different generators.
The authors in [157] proposed RUIDS, a robust unsupervised intrusion detection
system incorporating a masked context reconstruction module into a
transformer-based self-supervised learning scheme. It aims to capture temporal
context and mitigate anomaly contamination in network intrusion data. The
scheme learns intrinsic relationships within contexts using learnable
transformations and a transformer module, improving system robustness and
showing promise in enhancing intrusion detection using novel techniques.

###  V-C MTD DL-based Approaches

Integrating MTD and DL techniques in SG offers a promising enhanced security
and robustness strategy. MTD dynamically changes system configurations, while
DL allows SG to learn and detect anomalous patterns adaptively, enabling
proactive threat mitigation and rapid response. This synergy enhances SG
security, protects critical infrastructure, preserves data integrity, ensures
privacy, and maintains an uninterrupted energy supply.

Several approaches included using MTD to enhance the robustness of DL models
against adversarial attacks. The work of [159], aims to address the
susceptibility of DL-based visual sensing systems to adversarial example
attacks using MTD strategy. The proposed approach deploys multiple models that
work collaboratively to detect adversarial example attacks and then use MTD to
generate new models. Serial data fusion with early stopping is also employed
to improve defense effectiveness and efficiency by reducing inference time and
enhancing real-time performance. Morphence employs adversarial training on a
subset of the model pool [160]. It increases the number of models to challenge
adversaries through weight perturbation, data transformations, and
integration. A scheduling strategy selects the most confident model for
predictions, and the model pool is automatically renewed within a
predetermined query budget. It also provides an effective defense against
repeated and correlated attacks. Li et al. [161] introduced the wAdvMTD
approach, using pre-built models like 3-layer CNN and ResNet18 for
classification. The mechanism generates functionally equivalent but
structurally different models, making the attack vector ineffective against
most models, regardless of adversary knowledge of model selection. It consists
of training and discrimination stages, with multiple candidate models working
together and using differential voting to mitigate perturbations and ensure
system resilience against single-point failures. Xu et al. [162] proposed an
approach to counter stealthy FDI attacks in power system SE. The approach uses
LSTM-AE to analyze and learn spatiotemporal correlations among adjacent
measurements, improving detection accuracy and controlling false alarms. It
uses iterative normality projection to identify attack vector parts. The MTD
algorithm uses D-FACTS devices to inject unknown reactance into the grid and
verify detector decisions. Xu et al. [163] developed a framework combining a
data-driven detector and physics-based MTD. The framework uses a single LSTM-
AE DL model and power system physics data for accuracy. If a positive alarm is
raised, a neural network-based attack detection technique is applied, and a
robust MTD algorithm is initiated to confirm the alert. It improves detection
performance and achieves a high True Positive Rate while minimizing false
positive rates and rejecting false alarms in real-time.

##  VI Benchmark Datasets

The selected datasets below provide a distinct range of diverse attacks
commonly used for IDS research. While some may fail to include current traffic
patterns and emerging attacks, others have been generated recently to address
these limitations. We will also discuss the limitations associated with these
datasets.

###  VI-A KDDCUP99

The KDDCUP99 dataset is widely used for evaluating network intrusion detection
methods. It contains network traffic data with both normal and attack
instances, categorized into four types: DoS, User to Root (U2R), Remote to
Local (R2L), and Probing [164]. Each category represents a distinct attack
scenario, and 41 features are available for each connection record. This
dataset is a benchmark for intrusion detection research, facilitating
supervised learning and algorithm evaluation. However, it is essential to
acknowledge that the dataset is synthesized based on DARPA’98 data, which
introduces concerns about its representation of real network traffic. The
dataset’s coverage of attack types and variations may be limited, and its
distribution of attack types is imbalanced, which can impact its ability to
generalize to new patterns. The presence of duplicate records further distorts
the evaluation of detection algorithms, potentially yielding biased results
and restricted generalization capabilities [165]. These characteristics
highlight the non-stationary nature of the dataset and emphasize the need to
account for such divergence to improve the performance of intrusion detection
techniques [166].

TABLE V: Comprehensive Analysis of Cyber Defense Strategies in Smart Grids paper |  Compromised Security Objectives |  Attack Type |  Features |  Level |  Dataset |  Results |  Limitations
---|---|---|---|---|---|---|---
[29] |  Availability
Integrity
Confidentiality |  DoS, U2R, R2L, Worms, Shellcode |  Network traffic: protocol type, service type, flag status, port numbers, traffic stats: packet count, size, inter-arrival times, etc. |  Network |  UNSW-NB15, KDDTest, KDDTest-21 |  KDDTest+ dataset:
Recall: 0.7743,
Precision: 0.9739,
FPR: 2.74%,
F1-score: 86.27%,
Accuracy: 85.97%.
UNSW-NB15 dataset:
Recall: 0.9568,
Precision: 0.8605,
FPR: 19.01%,
F1-score: 90.61%,
Accuracy: 89.08%. |  Possible deviation of generated attacks from actual network behavior, KL-vanishing phenomenon might impact the quality of the generated samples, model performance might be sensitive to the training sample size, attack class reconstruction loss must be carefully calculated for new sample generation.
[95] |  Availability
Integrity |  Improper working condition, Data manipulation, Attacks on SCADA system |  Battery state of charge, terminal voltage, cell current, DC link voltage, and AC side phase voltages and currents, etc. |  End-User, Control Systems, Data Centers/Cloud |  – |  The proposed autoencoder outperforms OCSVM swiftly and accurately detects attacks. |  Limitations, especially in detecting sophisticated attacks on the State of Charge measure.
[121] |  Availability
Integrity
Confidentiality |  Network-based cyber-attacks: DDoS, Malware, Phishing, MitM, etc. |  Various types of network traffic |  End-User, Networks, Control Systems, Data Centers/Cloud |  KDDCUP991, UNSW-NB15, CICIDS2017 |  KDDCUP991:
Accuracy: 92.49%,
F1-score: 95.13%.
UNSW-NB15:
Accuracy: 93.4%,
F1-score: 95.29%.
CICIDS2017:
Accuracy: 97.9%,
F-score: 94.93%. |  Model’s performance varies with dataset characteristics; outperforms on UNSW-NB15Test but second to DNN 4 Layers on KDDCUP99Test, indicating potential dataset-specific optimization needs.
[122] |  Integrity |  Network Intrusion Detection |  Network traffic data |  LAN Communication Networks |  NSL-KDD, CSE-CIC-IDS2018 |  NSL-KDD:
Recall: 0.9927,
Precision: 0.9648,
F1-score: 96.14%,
Accuracy: 98.71%.
CSE-CIC-IDS2018:
Recall: 0.9999,
Precision: 0.9994,
F1-score: 99.98%,
Accuracy: 99.99%. |  Additional delay at the final reexamination stage, especially with deeper autoencoders.
[128] |  Integrity |  FDI attacks |  - |  Control Systems |  - |  Detects stealthy FDI attacks within 2-3s, maintaining low discordant terms, outperforming the discordant method |  Potential vulnerability to novel attack vectors not covered in training, dependency on the chosen timestep for detection, and the need to maintain low discordant terms which may be complex in dynamically changing network conditions.
[132] |  Integrity |  TD attack |  PPCS: pressure, temperature, and electricity generation AGC: tie-line flow measurements |  Control Systems |  Simulated datasets using Thermopower for PPCS and PowerWorld AGC. |  Best performing method is 2 HLSTMs+Multi-Task:
PPCS:
MAE: 2.02,
RMSE: 5.53,
Accuracy: 93.03%.
AGC:
MAE: 0.47,
RMSE: 0.91,
Accuracy: 99.09%. |  Optimal model performance dependent on the correct choice of n and $\beta$ parameters; FNs can be high for low $\tau$ values; complexity in balancing error rate and reaction latency.
[133] |  Availability |  FDI attacks, DC bias injection and time-varying attacks |  DC bus voltage, converter output voltage and current |  End-user Device and DC microgrid Control Systems |  SGCC Time-series data of output voltage and current from converters within a DC microgrid. |  Surpasses classical, Kalman, H-infinity, and hybrid methods in stability, attack mitigation, and disturbance rejection |  -
Table V: Comprehensive Analysis of Cyber Defense Strategies in Smart Grids paper |  Compromised Security Objectives |  Attack Type |  Features |  Level |  Dataset |  Results |  Limitations
---|---|---|---|---|---|---|---
[137] |  Integrity
Confidentiality |  Energy theft attacks |  Periodicity and group similarity of energy usage |  End-user device and control systems |  SGCC |  Accuracy: 92.67% |  -
[139] |  Availability
Integrity
Confidentiality |  FDI attacks, DoS, Jamming, Hybrid |  Grid topology data, voltage magnitudes, phase angles, bus measurements. |  Communication networks and control systems |  Simulation results of IEEE bus systems |  14-Bus Accuracy:
DoS: 96.90%,
FDI: 93.30%,
Jamming: 98.40%,
Hybrid: 98.40%.
30-Bus Accuracy:
DoS: 95.80%,
FDI: 90.50%,
Jamming: 92.10%,
Hybrid: 94.80%. |  -
[140] |  Integrity |  Energy theft attacks |  Time series electricity consumption data. |  Control systems and end-user device |  SGCC |  Optimized Model
AUC: 0.7682.
F1-score Range: 28.2% to 30.9% (depends on training ratio) |  Reduced model complexity for secure inferencing may affect dynamic attack detection; further real-world testing is needed.
[141] |  Integrity |  FDI attacks, Ramp attacks |  Real and reactive power injections, bus voltage, injected bus current, frequency, power injection as time-varying signal. |  End-user device, communication networks and control systems |  MATPOWER 7.0, NYISO, PSSE |  FDI attack:
Accuracy: 99.50%,
F1-score: 100%,
False Alarm Rate: 0.00%.
Ramp attack:
Accuracy: 88.10-89.91%,
F1-score: 99.98%,
False Alarm Rate: 0.02%. |  Sensitivity to attack location, lower detection accuracy for certain buses, some delay in ramp attack detection.
[142] |  Availability
Integrity
Confidentiality |  Stealth FDI attacks |  Active and reactive power bus injections, and active and reactive power flows on branches obtained from remote terminal units. |  Communication networks and control systems |  Synthetic datasets for IEEE bus systems |  IEEE 14 F1-score: 90.14%
IEEE 118 F1-score: 94.07%
IEEE 300 F1-score: 97.67% |  -
[143] |  Integrity |  FDI attacks |  Bus voltage, active and reactive powers. |  Control systems |  Realistic electric load data from the California Independent System Operator 2019 |  SRP-STGDL (quantile) excels, surpassing MLP, CNN, LSTM, GRU. Achieved perfect scores on IEEE 30-bus and IEEE 118-bus benchmarks. |  -
[145] |  Integrity |  FDI attacks |  Power measurements: voltage, current, and power flow information. |  Utility and control systems |  Synthetic dataset generated for a 2848-bus test system with 36,000 samples, balanced for attacked/non-attacked data |  Detection Rate: 95.53%,
False Alarm Rate: 0.33%,
CGCN Detection Time: 3.25 ms, outperforming FCN, RNN, CNN. |  No access to real-world datasets due to privacy reasons, possible discrepancies between synthetic and real-world data.
[147] |  Integrity |  Energy theft attacks |  Power consumption patterns. |  Control systems |  Irish CER |  MAE: 0.04541
MSE: 0.01426 |  Increased computational complexity from CNN-LSTM.
Table V: Comprehensive Analysis of Cyber Defense Strategies in Smart Grids paper |  Compromised Security Objectives |  Attack Type |  Features |  Level |  Dataset |  Results |  Limitations
---|---|---|---|---|---|---|---
[152] |  Availability |  DDoS |  IP flow data, excluding source and destination IPs, ports, timestamps, and flow identification, focusing instead on packet characteristics |  Control systems |  CICDDoS2019 |  Accuracy: 99.70%,
Precision: 0.9998,
F1-score: 99.84%,
AUC: 0.9990. |  -
[154] |  Availability |  DoS, DDoS attacks |  Network traffic data |  End-user devices, communication networks, control systems, and data centers/cloud infrastructure |  CICIDS2017
CIC-DDoS2019 |  CICIDS2017:
Accuracy: 99.35%,
Precision: 0.9898,
Recall: 0.9883,
F1-Score: 99.17%,
CIC-DDoS2019:
Accuracy: 98.58%,
Precision: 0.9882,
Recall: 0.9866,
F1-Score: 98.48%. |  Performance drop on detecting SQL Injection. Challenges in choosing a threshold for high detection accuracy or low false alarm rate for specific traffic types. Less ideal performance on class types ”Web-DDoS” and ”SSDP” due to similar characteristics between them.
[151] |  Integrity |  Various network attack types |  IoT sensors time-series data |  End-user devices, communication networks, control systems, and data centers/cloud infrastructure |  SWaT,
WADI,
SMAP,
MSL |  SWaT:
F1-score: 91%,
Recall: 0.881,
Precision: 0.7491.
WADI:
F1-score: 84%,
Recall: 0.836,
Precision: 0.839 |  Limitations in modeling long-term dependencies with recurrent mechanisms; less effective on datasets with weak feature dependencies like SMAP, MSL
[157] |  Availability
Integrity
Confidentiality |  Intrusion detection |  Network traffic time-series data |  End-user device, communication networks, control systems, data centers, and Cloud Infrastructure |  KDD,
UNSW-NB15,
CICIDS-WED,
CICIDS-FRI |  KDD:
Accuracy: 99.98%,
F1-score: 99.97%,
AUC: 0.9997
UNSW-NB15:
Accuracy: 92.62%,
F1-score: 95.44%,
AUC = 0.8802
CICIDS-WED:
Accuracy: 98.02%,
F1-score: 98.15%,
AUC: 0.9801 |  Transformer-based self-supervised learning, masked context reconstruction, two-part loss function, robust to contamination, parameter sensitivity analysis
[123] |  Availability
Integrity
Confidentiality |  Network Intrusions: zero-day attacks, DoS, DDoS, MITM, SQL Injection, Malware etc. |  Network traffic: Protocol type, service type, flag status, port numbers, traffic stats: packet count, size, inter-arrival times, etc. |  End-user device, communication networks and control systems |  NSL-KDD,
IoTID20,
N-BaIoT |  NSL-KDD:
MCC: 0.712,
F1-score: 89.5%,
IoTID20:
MCC: 0.595
F1-score: 97.4%
N-BaIoT: MCC varies per device. |  Variable optimal model configurations and latent sizes. Threshold determination challenges. Limited model depth exploration; the need for further large-scale studies
[134] |  Availability
Integrity
Confidentiality |  Various security threats in SG environment |  - |  End user divide, control systems and networks |  N-BaIoT |  Accuracy: 99.73%,
Precision: 0.973,
Recall: 0.9795,
F1-score: 97.56% |  -

###  VI-B NSL-KDD

The NSL-KDD dataset is an improved version of the original KDDCUP99 dataset
and is widely used as a benchmark dataset in network intrusion detection
[166]. It addresses limitations and evaluates the performance of IDS. This
dataset contains essential records from the complete KDD dataset, ensuring
sufficient records for comprehensive experiments. The selection of records
from each difficulty level is proportional to their percentage in the original
dataset. Each record in the NSL-KDD dataset consists of 41 attributes
representing different flow features and a label indicating the presence of an
attack or normal behavior [167]. The NSL-KDD dataset comprises various network
traffic features extracted from a simulated environment, including TCP/IP
connections with different attack types and normal behaviors. It provides
separate training and test data files. The training dataset shares the same
four attack types as the KDDCUP99 dataset[168]. To overcome the limitations of
the KDDCUP99 dataset, NSL-KDD eliminates redundant and unrealistic instances,
and it offers a more balanced distribution of attack types, addressing the
problem of high-class imbalance. This enhancement aims to produce an unbiased
classifier and reduce false-positive results [169].

###  VI-C UNSW-NB15

The dataset was created and gathered by the Center for Cyber Security (ACCS)
at the University of New South Wales (UNSW) in Canberra, Australia. It
contains network traffic data representing recent normal activities and
synthetic attacks [165]. The data was collected by capturing raw network
packets using the Tcpdump tool and processed with Argus, Bro-IDS tool, and 12
algorithms. This process extracted 49 features, including class labels such as
source IP, destination IP, source port, destination port, transaction
protocol, duration, and attack category. The dataset is divided into a
training set (UNSW_NB15_training-set.csv) and a test set (UNSW_NB15_testing-
set.csv). It consists of 43 attributes, including the class label, with ten
categories, including one for normal activities and nine for different types
of attacks. The UNSW-NB15 dataset offers a broader range of features, allowing
for more effective feature selection than the KDD dataset, which serves as a
comprehensive benchmark for evaluating IDS methods [170].

###  VI-D CICIDS

The CICIDS dataset by the Canadian Institutes for Cybersecurity is a valuable
resource for evaluating intrusion detection systems, accurately reflecting
real-world network traffic with 84 features per sample and covering 14 attack
types. It captures distinct behavioral patterns of 25 users, facilitating
multi-stage attack simulations. However, processing challenges arise due to
fragmented data distribution. The CICIDS 2017 version addresses system
complexity and dataset scarcity, creating diverse datasets for network-based
anomaly detection. It includes user behavior profiles, abstract
representations of network events, and seven attack scenarios, incorporating
network traffic, system logs, and 80 extracted features. The 2018 version
improves upon its predecessor by allowing more simulated clients and
addressing class imbalance [171]. The subsequent CSE-CIC-IDS-2019 dataset also
enhances DDoS attack classification by including benign traffic and up-to-date
attack scenarios[172].

###  VI-E N-BaIoT

The N-BaIoT dataset, available in the UCI MLRepository, comprises two well-
known IoT botnets: BASHLITE (Gafgyt) and Mirai [102]. It offers a
significantly larger number of features compared to the NSL-KDD and CICIDS
datasets. This dataset examines the characteristics of these botnets by
collecting traffic data before and after infection, encompassing both normal
and attack data from IoT botnet attacks. The dataset consists of 115 features.
It represents the behavior of these botnets on a range of nine IoT devices,
including thermostats, cameras, and doorbells. It provides traffic statistics
for each node in a real IoT network, including packet sizes, data packet
counts, and time intervals between packet arrivals.

###  VI-F SGCC dataset

The dataset examines the behavior of 42,372 customers from January 1, 2014, to
October 31, 2016, using genuine electricity consumption data obtained from the
State Grid Corporation of China (SGCC) [173]. It encompasses these customers’
daily kilowatt-hour (kWh) consumption records, comprising 38,757 regular users
and 3,615 individuals flagged as electricity thieves. The dataset also
includes ground truth information, revealing a severe issue in China where 9%
of customers commit electricity theft. The dataset has missing or inaccurate
values that require preprocessing techniques due to various factors such as
malfunctioning smart meters, imprecise measurement data, system maintenance,
and data storage challenges. These missing values can misguide the classifier
and lead to the misidentification of fraudulent consumers [148, 93]. It is
worth mentioning that this dataset is imbalanced, posing a significant
challenge in ETD, as it can lead to a biased classifier and hinder overall
performance.

###  VI-G Irish CER dataset

The Irish CER Smart Metering Project dataset consists of load profiles from
over 5000 residential users and small to medium-sized enterprises in Ireland.
This dataset offers detailed information at 30-minute intervals collected over
500 days from July 2009 to December 2010. In addition to the smart meter data,
a questionnaire was administered to participants, capturing data on various
aspects such as occupant socio-demographic status, consumption behavior,
household properties, and home appliances. The dataset includes 4,232
participants who actively took part in the research project. The questionnaire
aimed to thoroughly comprehend households’ attributes and actions concerning
their electricity usage [174].

##  VII Discussion

DL methods have made significant progress in detecting cyber threats in SG,
including sophisticated malware and DoS/DDoS attacks. However, their practical
application faces challenges, particularly scalability and real-time data
processing within the vast, dynamic SG networks. The models are particularly
susceptible to rapid detection of threats, but their extensive computational
requirements hinder their deployment in real-time environments. This indicates
variability in the efficacy of the AE and One-Class Classification
methodology, which is contingent upon the specific model selected—such as PAE,
VAE, CNNAE(1D), CNNAE(2D)—and the volume of training data incorporated [10].
As SG evolves, the demand for models to adapt to new connections and data
without losing accuracy or requiring more resources intensifies. While
techniques such as DDPG and Multiagent DRL show promise in threat detection
and response, their performance in more extensive and diverse grid contexts is
yet to be extensively validated [30, 128, 129].

Models like LSTM, KFRNN, and CNN have effectively detected specific types of
attacks within SG, including FDI attacks and energy theft. Nevertheless, since
these models can adapt to various SG configurations and levels of complexity,
their performance may vary. For example, the KFRNN architecture [130]
integrates unique features useful for proactive security measures by combining
the temporal pattern recognition capabilities of RNN with the predictive
capability of Kalman Filters. Additionally, evaluating advanced cybersecurity
models like DCT-GAN, TGAN-AD, and RTIDS in SG cybersecurity is critical due to
concerns about their effectiveness in controlled scenarios and lack of real-
world operational testing. The complexity of specific models, such as GNNs for
identifying FDI attacks, can present difficulties when deployed in real-time,
potentially affecting their scalability and adaptability.

Models like RUIDS are efficient in SG cybersecurity due to their self-
supervised learning capabilities, enabling reliable threat detection. However,
determining how resilient these strategies are to varying attack vectors
remains a challenge, particularly in the face of constantly changing and
adapting to sophisticated cyber threats. Continuous improvement is crucial to
overcome challenges like overfitting and assumptions in training data.
Although AE show promise in feature selection, their reliability across
different scenarios and attack vectors needs to be proven. They may face
challenges in generalizing across various attack types, which could limit
their scalability in diverse grid environments. Effective DL methods for SG
must deliver consistent performance, adaptability to emerging threats, and
evolve alongside the grid’s advancements. Table V provides a comprehensive
analysis of cyber defense strategies in SG, emphasizing communication and
power delivery networks. It categorizes cyberattacks, identifies specific
aspects of SG infrastructure they target for security enhancement, and
outlines the levels of SG operations susceptible to these attacks.
Additionally, the table lists data features utilized in DL models for cyber
defense and identifies security objectives at risk. It provides a thorough
overview of the current status of SG cyber defense and addresses the drawbacks
of these approaches.

DeepMTD and Morphence enhance security in DL models against adversarial
examples. However, the complexity involved in deploying several models after
initial setup might pose challenges for practical applications. While
Morphence’s strategy of renewing its model pool proves effective against
various attacks, relying on a predetermined query limit could lead to
potential operational challenges. While ”wAdvMTD” employs heterogeneous models
to counter adversarial white-box examples, its accuracy may be compromised in
complex tasks. A strategy uses physics-based MTD to counter FDI attacks in
power systems. However, in high-noise environments, its probabilistic
detection may be difficult. Another approach combines data-driven techniques
with physics-based methods, but its implementation complexity could affect its
effectiveness in real-time situations.

Additionally, models that utilize datasets such as Meraz’18 and Drebin lack
specificity for the SG domain, affecting their relevance and applicability.
While they detect known threats, their ability to generalize and recognize new
cyber threats remains crucial for their applicability. Models showing high
accuracy on generic datasets such as KDDCup99 and CICDDoS2019 do not guarantee
effectiveness in SG environments. Tailored datasets such as SGCC and Irish CER
are critical for training models to tackle the specific security challenges of
SG. Consequently, datasets with current and varied attack vectors, like UNSW-
NB15 and the more recent iterations of CICIDS, align with the necessities of
modern IDS. The datasets create more accurate and realistic environments,
enabling models to demonstrate their effectiveness in real-world scenarios.

##  VIII Challenges and Future Work

Several challenges emerge to enhance the security and robustness of SG through
integrating MTD and DL techniques. These challenges and potential future
directions are discussed in this section to provide a roadmap for researchers
and practitioners. Specifically, using DL-based approaches, integrating MTD
and DL techniques in SG, and applying various benchmark datasets present
challenges and opportunities for future work.

###  VIII-A Challenges

##### Model Complexity

The complexity and computational intensity of DL models can hinder real-time
performance, particularly in SG where rapid response to threats is crucial.
The challenge lies in developing lightweight yet effective models operating
efficiently in real-time environments.

##### Adversarial Attacks

DL models are susceptible to adversarial attacks, which can significantly
degrade their performance. The challenge is to enhance the robustness of these
models against such attacks, which requires a deep understanding of
adversarial strategies and the development of effective countermeasures.

##### Data Quality

The effectiveness of DL models relies heavily on the quality of the input
data. Datasets with missing or inaccurate values, imbalanced classes, or
outdated attack patterns can lead to biased or ineffective models. The
challenge is to develop effective data preprocessing, cleaning, and
augmentation techniques to improve the quality of input data.

##### Dataset Specificity

Most existing datasets are not specifically tailored for SG networks with
unique characteristics and requirements. The challenge is to develop and
maintain datasets that accurately reflect the dynamics of SG networks,
including their normal operation and various types of attacks.

###  VIII-B Future Work

##### Model Optimization

Future research could focus on optimizing DL models to reduce their complexity
and computational requirements, making them more suitable for real-time SG
applications. This could involve the development of new algorithms, the
refinement of existing ones, or the application of techniques such as model
pruning or quantization.

##### Robustness Against Adversarial Attacks

Developing new strategies and techniques to enhance the robustness of DL
models against adversarial attacks is a promising area for future work. This
could involve using adversarial training, defensive distillation, or other
techniques.

##### Data Preprocessing and Augmentation

Techniques for effective data preprocessing and augmentation can help improve
the quality of input data, leading to more accurate and reliable models.
Future work could focus on developing new methods for data cleaning,
imputation, and augmentation, as well as the application of techniques such as
synthetic minority over-sampling (SMOTE) for addressing class imbalance.

##### Dataset Development

There is a need for datasets that are specifically tailored for SG networks.
Future work could focus on developing such datasets, which would involve
collecting network traffic data from real-world SG environments, simulating
various types of attacks, and continuously updating the datasets to reflect
evolving attack patterns.

##### Real-world Testing

More extensive testing of these techniques in real-world SG environments can
help validate their effectiveness and identify areas for improvement. Future
work could involve deploying these techniques in pilot SG networks, collecting
performance data, and refining the techniques based on the results of these
tests.

##  IX Conclusion

In this paper, we explored how SG and the IIoT have increasingly relied on
cutting-edge technologies, becoming enticing targets for intricate cyber-
attacks. A comprehensive examination of the current state of proactive cyber
defense strategies utilizing DL in SG and IIoT was conducted, as such a broad
exploration was previously scarce in the literature. We began with an overview
of related works and our unique contributions, delving into an examination of
SG infrastructure. Various cyber defense techniques were classified into
reactive and proactive categories, with a marked emphasis on DL-enabled
proactive defenses. We also briefly discussed the intricacies of IDS.
Subsequently, we highlight potential vulnerabilities and corresponding
security objectives, underscoring the importance of continuous monitoring and
proactive risk mitigation against evolving cyber threats. A thorough taxonomy
of DL approaches was provided, underlining their functions and significance in
the proactive protection of SG and IIoT. We analyzed the most substantial DL-
based methods currently in use and explored the interaction between Moving
Target Defense, a proactive defense strategy, and DL methodologies. The
inclusion of an overview of benchmark datasets substantiated the discourse.
The advancements and limitations of sophisticated approaches in cyber threat
detection are then discussed, addressing concerns such as scalability and
real-time reaction in dynamic network settings. The paper concluded by
addressing the challenges of implementing DL-based security systems within SG
and IIoT and providing a forward-looking perspective on future developments in
this crucial field. The insights gleaned underscored the potential of DL in
transforming the security landscape of SG and IIoT, highlighting the necessity
for ongoing innovation and multidisciplinary collaboration.

## References

  * [1] A. U. Rehman, G. Hafeez, F. R. Albogamy, Z. Wadud, F. Ali, I. Khan, G. Rukh, and S. Khan, “An efficient energy management in smart grid considering demand response program and renewable energy sources,” _IEEE Access_ , vol. 9, pp. 148 821–148 844, 2021.
  * [2] M. I. Ibrahem, M. Mahmoud, M. M. Fouda, F. Alsolami, W. Alasmary, and X. Shen, “Privacy preserving and efficient data collection scheme for ami networks using deep learning,” _IEEE Internet of Things Journal_ , vol. 8, no. 23, pp. 17 131–17 146, 2021.
  * [3] M. Yigit, V. C. Gungor, G. Tuna, M. Rangoussi, and E. Fadel, “Power line communication technologies for smart grid applications: A review of advances and challenges,” _Computer Networks_ , vol. 70, pp. 366–383, 2014.
  * [4] A. Alsharif, M. Nabil, A. Sherif, M. Mahmoud, and M. Song, “Mdms: Efficient and privacy-preserving multidimension and multisubset data collection for ami networks,” _IEEE Internet of Things Journal_ , vol. 6, no. 6, pp. 10 363–10 374, 2019.
  * [5] P. Kumar, Y. Lin, G. Bai, A. Paverd, J. S. Dong, and A. Martin, “Smart grid metering networks: A survey on security, privacy and open research issues,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 3, pp. 2886–2927, 2019.
  * [6] A. Alsharif, M. Nabil, M. M. Mahmoud, and M. Abdallah, “Epda: Efficient and privacy-preserving data collection and access control scheme for multi-recipient ami networks,” _IEEE Access_ , vol. 7, pp. 27 829–27 845, 2019.
  * [7] K. N. Mallikarjunan, K. Muthupriya, and S. M. Shalinie, “A survey of distributed denial of service attack,” in _2016 10th International Conference on Intelligent Systems and Control (ISCO)_. IEEE, 2016, pp. 1–6.
  * [8] D. Jin, D. M. Nicol, and G. Yan, “An event buffer flooding attack in dnp3 controlled scada systems,” in _Proceedings of the 2011 Winter Simulation Conference (WSC)_. IEEE, 2011, pp. 2614–2626.
  * [9] N. Komninos, E. Philippou, and A. Pitsillides, “Survey in smart grid and smart home security: Issues, challenges and countermeasures,” _IEEE Communications Surveys & Tutorials_, vol. 16, no. 4, pp. 1933–1954, 2014.
  * [10] C. Kim, S.-Y. Chang, J. Kim, D. Lee, and J. Kim, “Automated, reliable zero-day malware detection based on autoencoding architecture,” _IEEE Transactions on Network and Service Management_ , 2023.
  * [11] A. Ayad, M. Khalaf, M. Salama, and E. F. El-Saadany, “Mitigation of false data injection attacks on automatic generation control considering nonlinearities,” _Electric Power Systems Research_ , vol. 209, p. 107958, 2022.
  * [12] A. Segall, “Distributed network protocols,” _IEEE transactions on Information Theory_ , vol. 29, no. 1, pp. 23–35, 1983.
  * [13] Y. Yang, K. McLaughlin, T. Littler, S. Sezer, B. Pranggono, and H. Wang, “Intrusion detection system for iec 60870-5-104 based scada networks,” in _2013 IEEE power & energy society general meeting_. IEEE, 2013, pp. 1–5.
  * [14] P. Maynard, K. McLaughlin, and B. Haberler, “Towards understanding man-in-the-middle attacks on iec 60870-5-104 scada networks,” in _2nd International Symposium for ICS & SCADA Cyber Security Research 2014 (ICS-CSR 2014) 2_, 2014, pp. 30–42.
  * [15] S. Ponpuram Sathar, S. Al-Kuwari, A. Albaseer, M. Qaraqe, and M. M. Abdallah, “Mitigating IEC-60870-5-104 vulnerabilities: Anomaly detection in smart grid based on LSTM autoencoder,” in _2023 International Symposium on Networks, Computers and Communications (ISNCC): Trust, Security and Privacy (ISNCC-2023 TSP)_ , October 2023, p. 6.
  * [16] P. Radoglou-Grammatikis, P. Sarigiannidis, I. Giannoulakis, E. Kafetzakis, and E. Panaousis, “Attacking iec-60870-5-104 scada systems,” in _2019 IEEE World Congress on Services (SERVICES)_ , vol. 2642. IEEE, 2019, pp. 41–46.
  * [17] E. Hodo, S. Grebeniuk, H. Ruotsalainen, and P. Tavolato, “Anomaly detection for simulated iec-60870-5-104 trafiic,” in _Proceedings of the 12th international conference on availability, reliability and security_ , 2017, pp. 1–7.
  * [18] Y. Xu, Y. Yang, T. Li, J. Ju, and Q. Wang, “Review on cyber vulnerabilities of communication protocols in industrial control systems,” in _2017 IEEE Conference on Energy Internet and Energy System Integration (EI2)_. IEEE, 2017, pp. 1–6.
  * [19] I. Darwish, O. Igbe, O. Celebi, T. Saadawi, and J. Soryal, “Smart grid dnp3 vulnerability analysis and experimentation,” in _2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing_. IEEE, 2015, pp. 141–147.
  * [20] A. Elmasry, A. Albaseer, and M. M. Abdallah, “OpenPLC and lib61850 smart grid testbed: Performance evaluation and analysis of GOOSE communication,” in _2023 International Symposium on Networks, Computers and Communications (ISNCC): Trust, Security and Privacy (ISNCC-2023 TSP)_ , October 2023, p. 6.
  * [21] C. Wilkerson and M. El Hariri, “Iec 61850-based renewable energy systems: A survey on cybersecurity aspects,” in _2022 IEEE International Conference on Environment and Electrical Engineering and 2022 IEEE Industrial and Commercial Power Systems Europe (EEEIC/I &CPS Europe)_. IEEE, 2022, pp. 1–6.
  * [22] M. K. Hasan, A. A. Habib, Z. Shukur, F. Ibrahim, S. Islam, and M. A. Razzaque, “Review on cyber-physical and cyber-security system in smart grid: Standards, protocols, constraints, and recommendations,” _Journal of Network and Computer Applications_ , p. 103540, 2022.
  * [23] J. Hiller, M. Henze, M. Serror, E. Wagner, J. N. Richter, and K. Wehrle, “Secure low latency communication for constrained industrial iot scenarios,” in _2018 IEEE 43rd Conference on Local Computer Networks (LCN)_. IEEE, 2018, pp. 614–622.
  * [24] T. Krause, R. Ernst, B. Klaer, I. Hacker, and M. Henze, “Cybersecurity in power grids: challenges and opportunities,” _Sensors_ , vol. 21, no. 18, p. 6225, 2021.
  * [25] H. Teryak, A. Albaseer, M. Abdallah, S. Al-Kuwari, and M. Qaraqe, “Double-edged defense: Thwarting cyber attacks and adversarial machine learning in iec 60870-5-104 smart grids,” _IEEE Open Journal of the Industrial Electronics Society_ , vol. 4, pp. 629–642, 2023.
  * [26] Y. Xin, L. Kong, Z. Liu, Y. Chen, Y. Li, H. Zhu, M. Gao, H. Hou, and C. Wang, “Machine learning and deep learning methods for cybersecurity,” _Ieee access_ , vol. 6, pp. 35 365–35 381, 2018.
  * [27] A. Halbouni, T. S. Gunawan, M. H. Habaebi, M. Halbouni, M. Kartiwi, and R. Ahmad, “Machine learning and deep learning approaches for cybersecurity: A review,” _IEEE Access_ , vol. 10, pp. 19 572–19 585, 2022.
  * [28] P. Podder, S. Bharati, M. Mondal, P. K. Paul, and U. Kose, “Artificial neural network for cybersecurity: A comprehensive review,” _arXiv preprint arXiv:2107.01185_ , 2021.
  * [29] Y. Yang, K. Zheng, C. Wu, and Y. Yang, “Improving the classification effectiveness of intrusion detection by using improved conditional variational autoencoder and deep neural network,” _Sensors_ , vol. 19, no. 11, p. 2528, 2019.
  * [30] C. Hu, J. Yan, and X. Liu, “Reinforcement learning-based adaptive feature boosting for smart grid intrusion detection,” _IEEE Transactions on Smart Grid_ , 2022.
  * [31] H. Chaudhary, A. Detroja, P. Prajapati, and P. Shah, “A review of various challenges in cybersecurity using artificial intelligence,” in _2020 3rd International Conference on Intelligent Sustainable Systems (ICISS)_. IEEE, 2020, pp. 829–836.
  * [32] L. Deng, D. Yu _et al._ , “Deep learning: methods and applications,” _Foundations and trends® in signal processing_ , vol. 7, no. 3–4, pp. 197–387, 2014.
  * [33] J. Ding, A. Qammar, Z. Zhang, A. Karim, and H. Ning, “Cyber threats to smart grids: Review, taxonomy, potential solutions, and future directions,” _Energies_ , vol. 15, no. 18, p. 6799, 2022.
  * [34] T. Berghout, M. Benbouzid, and S. Muyeen, “Machine learning for cybersecurity in smart grids: A comprehensive review-based study on methods, solutions, and prospects,” _International Journal of Critical Infrastructure Protection_ , p. 100547, 2022.
  * [35] G. Kocher and G. Kumar, “Machine learning and deep learning methods for intrusion detection systems: recent developments and challenges,” _Soft Computing_ , vol. 25, no. 15, pp. 9731–9763, 2021.
  * [36] H. Liu and B. Lang, “Machine learning and deep learning methods for intrusion detection systems: A survey,” _applied sciences_ , vol. 9, no. 20, p. 4396, 2019.
  * [37] M. A. Ferrag, L. Maglaras, S. Moschoyiannis, and H. Janicke, “Deep learning for cyber security intrusion detection: Approaches, datasets, and comparative study,” _Journal of Information Security and Applications_ , vol. 50, p. 102419, 2020.
  * [38] M. Massaoudi, H. Abu-Rub, S. S. Refaat, I. Chihi, and F. S. Oueslati, “Deep learning in smart grid technology: A review of recent advancements and future prospects,” _IEEE Access_ , vol. 9, pp. 54 558–54 578, 2021.
  * [39] J.-H. Cho, D. P. Sharma, H. Alavizadeh, S. Yoon, N. Ben-Asher, T. J. Moore, D. S. Kim, H. Lim, and F. F. Nelson, “Toward proactive, adaptive defense: A survey on moving target defense,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 1, pp. 709–745, 2020.
  * [40] R. E. Navas, F. Cuppens, N. B. Cuppens, L. Toutain, and G. Z. Papadopoulos, “Mtd, where art thou? a systematic review of moving target defense techniques for iot,” _IEEE internet of things journal_ , vol. 8, no. 10, pp. 7818–7832, 2020.
  * [41] R. Sun, Y. Zhu, J. Fei, and X. Chen, “A survey on moving target defense: Intelligently affordable, optimized and self-adaptive,” _Applied Sciences_ , vol. 13, no. 9, p. 5367, 2023.
  * [42] D. Upadhyay and S. Sampalli, “Scada (supervisory control and data acquisition) systems: Vulnerability assessment and security recommendations,” _Computers & Security_, vol. 89, p. 101666, 2020.
  * [43] P. Siano, “Demand response and smart grids—a survey,” _Renewable and sustainable energy reviews_ , vol. 30, pp. 461–478, 2014.
  * [44] P. Kumar, Y. Lin, G. Bai, A. Paverd, J. S. Dong, and A. Martin, “Smart grid metering networks: A survey on security, privacy and open research issues,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 3, pp. 2886–2927, 2019.
  * [45] J. Jo and J. Park, “Demand-side management with shared energy storage system in smart grid,” _IEEE Transactions on Smart Grid_ , vol. 11, no. 5, pp. 4466–4476, 2020.
  * [46] W. Zhong, K. Xie, Y. Liu, C. Yang, S. Xie, and Y. Zhang, “Online control and near-optimal algorithm for distributed energy storage sharing in smart grid,” _IEEE Transactions on Smart Grid_ , vol. 11, no. 3, pp. 2552–2562, 2019.
  * [47] A. Ghosal and M. Conti, “Key management systems for smart grid advanced metering infrastructure: A survey,” _IEEE Communications Surveys & Tutorials_, vol. 21, no. 3, pp. 2831–2848, 2019.
  * [48] Z. Shuai, Y. Sun, Z. J. Shen, W. Tian, C. Tu, Y. Li, and X. Yin, “Microgrid stability: Classification and a review,” _Renewable and Sustainable Energy Reviews_ , vol. 58, pp. 167–179, 2016.
  * [49] Y. Li and J. Yan, “Cybersecurity of smart inverters in the smart grid: A survey,” _IEEE Transactions on Power Electronics_ , vol. 38, no. 2, pp. 2364–2383, 2023.
  * [50] Y. Shah and S. Sengupta, “A survey on classification of cyber-attacks on iot and iiot devices,” in _2020 11th IEEE Annual Ubiquitous Computing, Electronics & Mobile Communication Conference (UEMCON)_. IEEE, 2020, pp. 0406–0413.
  * [51] B. Tang, Z. Chen, G. Hefferman, S. Pei, T. Wei, H. He, and Q. Yang, “Incorporating intelligence in fog computing for big data analysis in smart cities,” _IEEE Transactions on Industrial informatics_ , vol. 13, no. 5, pp. 2140–2150, 2017.
  * [52] R. Mitchell and R. Chen, “Behavior-rule based intrusion detection systems for safety critical smart grid applications,” _IEEE Transactions on Smart Grid_ , vol. 4, no. 3, pp. 1254–1263, 2013.
  * [53] H. Bao, R. Lu, B. Li, and R. Deng, “Blithe: Behavior rule-based insider threat detection for smart grid,” _IEEE Internet of Things Journal_ , vol. 3, no. 2, pp. 190–205, 2015.
  * [54] Y. Li, Y. Qin, P. Zhang, and A. Herzberg, “Sdn-enabled cyber-physical security in networked microgrids,” _IEEE Transactions on Sustainable Energy_ , vol. 10, no. 3, pp. 1613–1622, 2018.
  * [55] K. Jhala, P. Pradhan, and B. Natarajan, “Perturbation-based diagnosis of false data injection attack using distributed energy resources,” _IEEE Transactions on Smart Grid_ , vol. 12, no. 2, pp. 1589–1601, 2020.
  * [56] M. A. Faisal, Z. Aung, J. R. Williams, and A. Sanchez, “Securing advanced metering infrastructure using intrusion detection system with data stream mining,” in _Intelligence and Security Informatics: Pacific Asia Workshop, PAISI 2012, Kuala Lumpur, Malaysia, May 29, 2012. Proceedings_. Springer, 2012, pp. 96–111.
  * [57] ——, “Data-stream-based intrusion detection system for advanced metering infrastructure in smart grid: A feasibility study,” _IEEE Systems Journal_ , vol. 9, no. 1, pp. 31–44, 2015.
  * [58] R. Vijayanand, D. Devaraj, and B. Kannapiran, “Support vector machine based intrusion detection system with reduced input features for advanced metering infrastructure of smart grid,” in _2017 4th International Conference on Advanced Computing and Communication Systems (ICACCS)_ , 2017, pp. 1–7.
  * [59] I. Ullah and Q. H. Mahmoud, “An intrusion detection framework for the smart grid,” in _2017 IEEE 30th Canadian Conference on Electrical and Computer Engineering (CCECE)_ , 2017, pp. 1–5.
  * [60] R. Samrin and D. Vasumathi, “Review on anomaly based network intrusion detection system,” in _2017 international conference on electrical, electronics, communication, computer, and optimization techniques (ICEECCOT)_. IEEE, 2017, pp. 141–147.
  * [61] P.-H. Wang, I.-E. Liao, K.-F. Kao, and J.-Y. Huang, “An intrusion detection method based on log sequence clustering of honeypot for modbus tcp protocol,” in _2018 IEEE International Conference on Applied System Invention (ICASI)_ , 2018, pp. 255–258.
  * [62] J. Franco, A. Aris, B. Canberk, and A. S. Uluagac, “A survey of honeypots and honeynets for internet of things, industrial internet of things, and cyber-physical systems,” _IEEE Communications Surveys & Tutorials_, vol. 23, no. 4, pp. 2351–2383, 2021.
  * [63] A. Albaseer and M. Abdallah, “Fine-tuned lstm-based model for efficient honeypot-based network intrusion detection system in smart grid networks,” in _2022 5th International Conference on Communications, Signal Processing, and their Applications (ICCSPA)_. IEEE, 2022, pp. 1–6.
  * [64] ——, “Privacy-preserving honeypot-based detector in smart grid networks: A new design for quality-assurance and fair incentives federated learning framework,” in _2023 IEEE 20th Consumer Communications & Networking Conference (CCNC)_. IEEE, 2023, pp. 722–727.
  * [65] W. Tian, M. Du, X. Ji, G. Liu, Y. Dai, and Z. Han, “Honeypot detection strategy against advanced persistent threats in industrial internet of things: A prospect theoretic game,” _IEEE Internet of Things Journal_ , vol. 8, no. 24, pp. 17 372–17 381, 2021.
  * [66] A. Patel, H. Alhussian, J. M. Pedersen, B. Bounabat, J. C. Júnior, and S. Katsikas, “A nifty collaborative intrusion detection and prevention architecture for smart grid ecosystems,” _Computers & Security_, vol. 64, pp. 92–109, 2017.
  * [67] P. Jokar and V. C. Leung, “Intrusion detection and prevention for zigbee-based home area networks in smart grids,” _IEEE Transactions on Smart Grid_ , vol. 9, no. 3, pp. 1800–1811, 2016.
  * [68] S. Garg, K. Kaur, G. Kaddoum, J. J. Rodrigues, and M. Guizani, “Secure and lightweight authentication scheme for smart metering infrastructure in smart grid,” _IEEE Transactions on Industrial Informatics_ , vol. 16, no. 5, pp. 3548–3557, 2019.
  * [69] D. Syed, S. S. Refaat, and O. Bouhali, “Privacy preservation of data-driven models in smart grids using homomorphic encryption,” _Information_ , vol. 11, no. 7, p. 357, 2020.
  * [70] C. Dishington, D. P. Sharma, D. S. Kim, J.-H. Cho, T. J. Moore, and F. F. Nelson, “Security and performance assessment of ip multiplexing moving target defence in software defined networks,” in _2019 18th IEEE International Conference On Trust, Security And Privacy In Computing And Communications/13th IEEE International Conference On Big Data Science And Engineering (TrustCom/BigDataSE)_. IEEE, 2019, pp. 288–295.
  * [71] H. Alavizadeh, J. B. Hong, J. Jang-Jaccard, and D. S. Kim, “Comprehensive security assessment of combined mtd techniques for the cloud,” in _Proceedings of the 5th ACM Workshop on Moving Target Defense_ , 2018, pp. 11–20.
  * [72] H. Alavizadeh, J. B. Hong, D. S. Kim, and J. Jang-Jaccard, “Evaluating the effectiveness of shuffle and redundancy mtd techniques in the cloud,” _Computers & Security_, vol. 102, p. 102091, 2021.
  * [73] D. Ma, Z. Tang, X. Sun, L. Guo, L. Wang, and K. Chen, “Game theory approaches for evaluating the deception-based moving target defense,” in _Proceedings of the 9th ACM Workshop on Moving Target Defense_ , 2022, pp. 67–77.
  * [74] J.-H. Cho, D. P. Sharma, H. Alavizadeh, S. Yoon, N. Ben-Asher, T. J. Moore, D. S. Kim, H. Lim, and F. F. Nelson, “Toward proactive, adaptive defense: A survey on moving target defense,” _IEEE Communications Surveys & Tutorials_, vol. 22, no. 1, pp. 709–745, 2020.
  * [75] S. Sengupta and S. Kambhampati, “Multi-agent reinforcement learning in bayesian stackelberg markov games for adaptive moving target defense,” _arXiv preprint arXiv:2007.10457_ , 2020.
  * [76] K. Ferguson-Walter, S. Fugate, J. Mauger, and M. Major, “Game theory for adaptive defensive cyber deception,” in _Proceedings of the 6th Annual Symposium on Hot Topics in the Science of Security_ , 2019, pp. 1–8.
  * [77] H. Li and Z. Zheng, “Optimal timing of moving target defense: A stackelberg game model,” in _MILCOM 2019-2019 IEEE Military Communications Conference (MILCOM)_. IEEE, 2019, pp. 1–6.
  * [78] M. A. R. Al Amin, S. Shetty, L. Njilla, D. K. Tosh, and C. Kamhoua, “Hidden markov model and cyber deception for the prevention of adversarial lateral movement,” _IEEE Access_ , vol. 9, pp. 49 662–49 682, 2021.
  * [79] C. Lei, D.-H. Ma, and H.-Q. Zhang, “Optimal strategy selection for moving target defense based on markov game,” _IEEE Access_ , vol. 5, pp. 156–169, 2017.
  * [80] J. Zheng and A. Siami Namin, “A markov decision process to determine optimal policies in moving target,” in _Proceedings of the 2018 ACM SIGSAC conference on computer and communications security_ , 2018, pp. 2321–2323.
  * [81] X.-L. Xiong, L. Yang, and G.-S. Zhao, “Effectiveness evaluation model of moving target defense based on system attack surface,” _IEEE Access_ , vol. 7, pp. 9998–10 014, 2019.
  * [82] A. Amich and B. Eshete, “Morphence: Moving target defense against adversarial examples,” in _Annual Computer Security Applications Conference_ , 2021, pp. 61–75.
  * [83] X. Xu, H. Hu, Y. Liu, J. Tan, H. Zhang, and H. Song, “Moving target defense of routing randomization with deep reinforcement learning against eavesdropping attack,” _Digital Communications and Networks_ , vol. 8, no. 3, pp. 373–387, 2022.
  * [84] Q. Song, Z. Yan, and R. Tan, “Deepmtd: Moving target defense for deep visual sensing against adversarial examples,” _ACM Transactions on Sensor Networks (TOSN)_ , vol. 18, no. 1, pp. 1–32, 2021.
  * [85] S. Yoon, J.-H. Cho, D. S. Kim, T. J. Moore, F. Free-Nelson, and H. Lim, “Desolater: Deep reinforcement learning-based resource allocation and moving target defense deployment framework,” _IEEE Access_ , vol. 9, pp. 70 700–70 714, 2021.
  * [86] S. Kim, S. Yoon, J.-H. Cho, D. S. Kim, T. J. Moore, F. Free-Nelson, and H. Lim, “Divergence: deep reinforcement learning-based adaptive traffic inspection and moving target defense countermeasure framework,” _IEEE Transactions on Network and Service Management_ , vol. 19, no. 4, pp. 4834–4846, 2022.
  * [87] S. Sengupta, T. Chakraborti, and S. Kambhampati, “Mtdeep: boosting the security of deep neural nets against adversarial attacks with moving target defense,” in _Decision and Game Theory for Security: 10th International Conference, GameSec 2019, Stockholm, Sweden, October 30–November 1, 2019, Proceedings 10_. Springer, 2019, pp. 479–491.
  * [88] W. Xu, I. M. Jaimoukha, and F. Teng, “Robust moving target defence against false data injection attacks in power grids,” _IEEE Transactions on Information Forensics and Security_ , vol. 18, pp. 29–40, 2022.
  * [89] M. A. Rahman, E. Al-Shaer, and R. B. Bobba, “Moving target defense for hardening the security of the power system state estimation,” in _Proceedings of the First ACM Workshop on Moving Target Defense_ , 2014, pp. 59–68.
  * [90] O. Gomis-Bellmunt, J. Sau-Bassols, E. Prieto-Araujo, and M. Cheah-Mane, “Flexible converters for meshed hvdc grids: From flexible ac transmission systems (facts) to flexible dc grids,” _IEEE Transactions on Power Delivery_ , vol. 35, no. 1, pp. 2–15, 2019.
  * [91] K. Rogers and T. J. Overbye, “Some applications of distributed flexible ac transmission system (d-facts) devices in power systems,” in _2008 40th North American Power Symposium_. IEEE, 2008, pp. 1–8.
  * [92] J. Schmidhuber, “Deep learning in neural networks: An overview,” _Neural networks_ , vol. 61, pp. 85–117, 2015.
  * [93] A. Mahi-Al-rashid, F. Hossain, A. Anwar, and S. Azam, “False data injection attack detection in smart grid using energy consumption forecasting,” _Energies_ , vol. 15, no. 13, p. 4877, 2022.
  * [94] K. Sun, W. Qiu, W. Yao, S. You, H. Yin, and Y. Liu, “Frequency injection based hvdc attack-defense control via squeeze-excitation double cnn,” _IEEE Transactions on Power Systems_ , vol. 36, no. 6, pp. 5305–5316, 2021.
  * [95] G. B. Gaggero, R. Caviglia, A. Armellin, M. Rossi, P. Girdinio, and M. Marchese, “Detecting cyberattacks on electrical storage systems through neural network based anomaly detection algorithm,” _Sensors_ , vol. 22, no. 10, p. 3933, 2022.
  * [96] S.-Q. Liu, X. Lan, and P. C. Yuen, “Learning temporal similarity of remote photoplethysmography for fast 3d mask face presentation attack detection,” _IEEE Transactions on Information Forensics and Security_ , vol. 17, pp. 3195–3210, 2022.
  * [97] M. Rani _et al._ , “A review of intrusion detection system in cloud computing,” in _Proceedings of International Conference on Sustainable Computing in Science, Technology and Management (SUSCOM), Amity University Rajasthan, Jaipur-India_ , 2019.
  * [98] K. Ariyapala, G. Do Hoang, N. A. Huynh, K. N. Wee, and M. Conti, “A host and network based intrusion detection for android smartphones,” in _2016 30th International Conference on Advanced Information Networking and Applications Workshops (WAINA)_. IEEE, 2016, pp. 849–854.
  * [99] K. Gai, M. Qiu, Z. Ming, H. Zhao, and L. Qiu, “Spoofing-jamming attack strategy using optimal power distributions in wireless smart grid networks,” _IEEE Transactions on Smart Grid_ , vol. 8, no. 5, pp. 2431–2439, 2017.
  * [100] Z. El Mrabet, N. Kaabouch, H. El Ghazi, and H. El Ghazi, “Cyber-security in smart grid: Survey and challenges,” _Computers & Electrical Engineering_, vol. 67, pp. 469–482, 2018.
  * [101] A. Mpitziopoulos, D. Gavalas, C. Konstantopoulos, and G. Pantziou, “A survey on jamming attacks and countermeasures in wsns,” _IEEE communications surveys & tutorials_, vol. 11, no. 4, pp. 42–56, 2009.
  * [102] Y. Meidan, M. Bohadana, Y. Mathov, Y. Mirsky, A. Shabtai, D. Breitenbacher, and Y. Elovici, “N-baiot—network-based detection of iot botnet attacks using deep autoencoders,” _IEEE Pervasive Computing_ , vol. 17, no. 3, pp. 12–22, 2018.
  * [103] R. Huang, Y. Li, and X. Wang, “Attention-aware deep reinforcement learning for detecting false data injection attacks in smart grids,” _International Journal of Electrical Power & Energy Systems_, vol. 147, p. 108815, 2023.
  * [104] P. Risbud, N. Gatsis, and A. Taha, “Vulnerability analysis of smart grids to gps spoofing,” _IEEE Transactions on Smart Grid_ , vol. 10, no. 4, pp. 3535–3548, 2018.
  * [105] S. Wang, S. Zhu, and Y. Zhang, “Blockchain-based mutual authentication security protocol for distributed rfid systems,” in _2018 IEEE Symposium on Computers and Communications (ISCC)_. IEEE, 2018, pp. 00 074–00 077.
  * [106] M. M. Najafabadi, T. M. Khoshgoftaar, C. Kemp, N. Seliya, and R. Zuech, “Machine learning for detecting brute force attacks at the network level,” in _2014 IEEE International Conference on Bioinformatics and Bioengineering_. IEEE, 2014, pp. 379–385.
  * [107] F. Salahdine and N. Kaabouch, “Social engineering attacks: A survey,” _Future internet_ , vol. 11, no. 4, p. 89, 2019.
  * [108] N. Komninos, E. Philippou, and A. Pitsillides, “Survey in smart grid and smart home security: Issues, challenges and countermeasures,” _IEEE Communications Surveys & Tutorials_, vol. 16, no. 4, pp. 1933–1954, 2014.
  * [109] D. E. Rumelhart, J. L. McClelland, and C. PDP Research Group, _Parallel distributed processing: Explorations in the microstructure of cognition, Vol. 1: Foundations_. MIT press, 1986.
  * [110] Y. Bengio, P. Simard, and P. Frasconi, “Learning long-term dependencies with gradient descent is difficult,” _IEEE transactions on neural networks_ , vol. 5, no. 2, pp. 157–166, 1994.
  * [111] S. Hochreiter and J. Schmidhuber, “Long short-term memory,” _Neural computation_ , vol. 9, no. 8, pp. 1735–1780, 1997.
  * [112] K. Cho, B. van Merrienboer, C. Gulcehre, D. Bahdanau, F. Bougares, H. Schwenk, and Y. Bengio, “Learning phrase representations using rnn encoder–decoder for statistical machine translation,” in _Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing (EMNLP)_. Association for Computational Linguistics, 2014, p. 1724.
  * [113] Y. LeCun, K. Kavukcuoglu, and C. Farabet, “Convolutional networks and applications in vision,” in _Proceedings of 2010 IEEE International Symposium on Circuits and Systems_ , 2010, pp. 253–256.
  * [114] V. Mnih, K. Kavukcuoglu, D. Silver, A. A. Rusu, J. Veness, M. G. Bellemare, A. Graves, M. Riedmiller, A. K. Fidjeland, G. Ostrovski _et al._ , “Human-level control through deep reinforcement learning,” _nature_ , vol. 518, no. 7540, pp. 529–533, 2015.
  * [115] S. Gupta, G. Singal, and D. Garg, “Deep reinforcement learning techniques in diversified domains: a survey,” _Archives of Computational Methods in Engineering_ , vol. 28, no. 7, pp. 4715–4754, 2021.
  * [116] S. Levine, A. Kumar, G. Tucker, and J. Fu, “Offline reinforcement learning: Tutorial, review, and perspectives on open problems,” _arXiv preprint arXiv:2005.01643_ , 2020.
  * [117] A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” _Advances in neural information processing systems_ , vol. 30, 2017.
  * [118] T. Shao, Y. Guo, H. Chen, and Z. Hao, “Transformer-based neural network for answer selection in question answering,” _IEEE Access_ , vol. 7, pp. 26 146–26 156, 2019.
  * [119] F. Scarselli, M. Gori, A. C. Tsoi, M. Hagenbuchner, and G. Monfardini, “The graph neural network model,” _IEEE transactions on neural networks_ , vol. 20, no. 1, pp. 61–80, 2008.
  * [120] S. Ali and Y. Li, “Learning multilevel auto-encoders for ddos attack detection in smart grid network,” _IEEE Access_ , vol. 7, pp. 108 647–108 659, 2019\.
  * [121] G. Andresini, A. Appice, N. Di Mauro, C. Loglisci, and D. Malerba, “Multi-channel deep feature learning for intrusion detection,” _IEEE Access_ , vol. 8, pp. 53 346–53 359, 2020.
  * [122] H. Kye, M. Kim, and M. Kwon, “Hierarchical detection of network anomalies: A self-supervised learning approach,” _IEEE Signal Processing Letters_ , vol. 29, pp. 1908–1912, 2022.
  * [123] Y. Song, S. Hyun, and Y.-G. Cheong, “Analysis of autoencoders for network intrusion detection,” _Sensors_ , vol. 21, no. 13, p. 4294, 2021.
  * [124] D. An, Q. Yang, W. Liu, and Y. Zhang, “Defending against data integrity attacks in smart grid: A deep reinforcement learning-based approach,” _IEEE Access_ , vol. 7, pp. 110 835–110 845, 2019.
  * [125] D. An, F. Zhang, Q. Yang, and C. Zhang, “Data integrity attack in dynamic state estimation of smart grid: Attack model and countermeasures,” _IEEE Transactions on Automation Science and Engineering_ , vol. 19, no. 3, pp. 1631–1644, 2022.
  * [126] A. Selim, J. Zhao, F. Ding, F. Miao, and S.-Y. Park, “Deep reinforcement learning for distribution system cyber attack defense with ders,” in _2023 IEEE Power & Energy Society Innovative Smart Grid Technologies Conference (ISGT)_. IEEE, 2023, pp. 1–5.