2.1. Target System: Smart Grid Paradigm

• Intrusion on Smart Grid Components This section examines the SG paradigm’s components and related communications to give a general overview. The substations play a pivotal role in the operation of SG.
  • Substation: The substations play a pivotal role in the operation of SG. Substations operate SG’s transmission and distribution processes. A Substation Automated System (SAS) with IEDs, RTUs, and computers controls modern substation operations [9]. In particular, they participate in the generated power, set up the distribution system, and manage the power expansion. They may contain various hardware and software elements, including GPS, RTUs, HMIs, and Intelligent Electronic Devices (IEDs) [10]. The substation can be one of the most significant targets for an intruder to disrupt the system’s regular operation or functionalities and the total power supply, which may cause a cascading effect on society and nations. Modern substations must address cybersecurity risks in supervisory control and data acquisition (SCADA) systems as IEC 61850 smart substations emerge. This study presents a new IDS for IEC 61850 substation cybersecurity evaluating multidimensional physical knowledge and behaviours to deliver a comprehensive and effective cyber threat mitigation solution [11]. A 500kV smart substation cyber-physical testbed implements and validates this SCADA-specific ID.
    In [12], M. Kabir-Querrec et al. provides a specification-based IDPS that centres on substation communications according to IEC 61850. In particular, IEC 61850’s data object model is the foundation for their IDPS’s architecture, including a novel intrusion detection function.
    Using the IEC 61850 standard, H. Yoo and T. Shon [13] present an anomaly-based IDPS for the substations. The proposed IDPS zeros in on MMS and GOOSE protocols using a one-class SVM classification model to zero in on patterns that correspond exclusively to regular and legitimate network traffic.
  • SCADA System: SG is a system based on SCADA systems, a part of the industrial control system and environment, that necessitate monitoring and managing the automated operation of other components. A SCADA system is made up of the following components in particular: a) measuring devices; b) logic controllers, such as programmable logic controllers or Remote Terminal Units (RTU); c) Master Terminal Units (MTU); d) communication network; and e) an HMI. Measurement instruments track objective quantities like temperature, pressure, and voltage. The primary duties of logic controllers include gathering data from the measuring devices, identifying unusual behaviours, and activating or deactivating technical components [9]. The system operator can give commands to logic controllers and receive data through MTU, a central host through which the logic controllers communicate. The communication network is used to realize the interface between MTU and the logic controllers. This communication system uses industrial protocols like Distributed Network Protocol 3 (DNP3) and Modbus. The interface between MTU and logic controllers is facilitated by HMI, a software package with graphical capabilities installed on MTU. All of the components of SCADA in the SG system are highly vulnerable to attack by any intrusion or hacking, as illustrated in Figure 3. Due to the interdependency of each component to run the whole system of SCADA, any unauthorized access to any of its members by an intruder may cripple the entire SG system. E. Hodo et al. offer an anomaly-based IDS for a SCADA-simulated environment using the IEC 60870–5-104 [109] (IEC-104) protocol in [14]. S.D. Anton et al. compare four machine learning techniques for Modbus/TCP anomaly detection in [15]. They employed Lemay and Fernandez’s dataset [16] that was separated into three sub-datasets: DS1, DS2, and DS3. DS1 contains 3319 packets of MTU-to-6 RTU network traffic, including 75 malicious occurrences. DS2 has 11166 packets, with 10 malicious ones with one MTU and six RTUs. Finally, eight datasets produced 365906 packets with 2016 harmful cases in DS3. These sub-datasets provided features for machine learning algorithm training.
    

    Figure 3. Action of intruder targeting the substation in smart grid [17].

    Figure 3. Action of intruder targeting the substation in smart grid [17].

    
  • Synchrophasor: A synchrophasor system is an emerging technology required for the functioning of the contemporary electrical grid. It primarily consists of Phasor Measurement Units (PMUs), Phasor Data Concentrators (PDCs), a communication network, and GUI software. A PMU is an instrument that performs numerous measurements from current/voltage waveforms, including frequency, phase angle, active power, and reactive power. A PDC takes on the task of compiling PMUs’ information and combining it into a single flow. The IEEE C37.118.2 and IEC 61850 [18] standards are typically used for communication between PMUs and PDCs. The GUI application’s final responsibility is to visualize the various data from PDCs properly. For synchrophasor systems that employ the IEEE C37.118 protocol, Khan et al. [19] presented a hybrid IDS primarily based on specification-based and signature-based approaches. The suggested system’s general design comprises two types of detectors, or HIDSs and NIDSs, respectively, called agents and sensors. Agents monitor PMUs and PDCs’ performance, while sensors control data flow throughout the network. In addition, a management server compiles and correlates data from all the sensors and agents. Any detection notice or warning is also documented in a database server. In [20], Y. Yang et al. proposes a specification-based IDPS that can secure IEEE C37.118-based synchrophasor systems. Access control, protocol-based, and behaviour-based rules are the three main categories of rules in their intrusion detection and prevention system (IDPS).
  • Intrusion on AMI: An AMI system comprises three basic parts: smart meters, data collectors, and a headend. Smart meters try to track the electrical appliances’ power usage and other metrics [21]. Data collectors must store the information produced by numerous smart meters in a particular region. The AMI headend, which receives, stores, and maintains the data collected by the data collectors, is the utility company’s central server. The utility firm can make the best decisions for the power generation, transmission, and distribution processes based on the information gathered on the AMI headend. In [22], the authors examined the recent academic approaches to intrusion detection systems and techniques for AMI and discussed the threats that could potentially affect this industry. Numerous contributions have been made to secure the AMI: In [23], authors created a specification-based Intrusion Detection System (IDS) for Home area networks (HANs) responsible for data transfer among smart meters and household devices. The IDS design targets ZigBee’s physical and medium access control layers and defines its normal behaviour based on extracted specifications. Any change from usual behaviour may signal an attack. In [24], authors suggest an IDS for AMI, consisting of three local IDSs in smart meters, data concentrators, and the head-end. The IDS uses stream data mining to identify network assaults. This paper introduces an IDS for the neighbourhood area network (NAN), an AMI subsystem connecting smart meters to data concentrators. The IDS uses data mining to detect malicious activities caused by blackhole attacks in this area.
    Another well-suited distributed IDS architecture for AMI is an Extreme Learning Machine (ELM). ELM’s quick training speed and robust model generalization ability are ideally suited for intrusion detection in the smart meter of the SG system. An ELM intrusion detection model based on a genetic algorithm (GA) is proposed as a solution to the issue that the ELM’s random input weights and hidden layer bias prevent the model from performing at its ideal level [25].
• Smart Grid Communication
  A generalized SG architecture separated into communication aspects is shown in Figure 3. Three different network area types—Home Area Networks (HANs), Business Area Networks (BANs), and Industry Area Networks (IANs)—are present in the first layer and are identified by the presence of consumers. The existence of smart meters, which track and communicate information about electrical appliance energy usage, is precisely the critical feature of these network areas. A network connecting a home’s electronic and intelligent gadgets is called a HAN. The second form, or BAN, is a network comprising the hardware and software needed for an organization to operate. The IAN also specifies a network that includes all the functional components needed for industry. The devices of these networks often use ZigBee and Z-wave, as shown in Figure 4. Rarely, they may also employ Power Line Communications (PLC) or IEEE 802.11 (Wi-Fi). The authors in [26] suggested a structure for IDS deployment in the smart grid. The proposed system will collect and correlate notifications from various intelligent grid sensors. In the innovative grid network, sensors might be installed in HANs, NANs, or even the vast area network. We looked at the intrusion detection classification algorithms’ results on the ISCX2012 dataset.
  

  Figure 4. The communication architecture of SG system [9].

  Figure 4. The communication architecture of SG system [9].

  

2.2. Types of Intrusion

• Cyber Attack and Threat
  Recently, the SG system is mainly prone to a crucial type of intrusion, that is, cyber-attacks or threats, which are network-based. Exploiting badly the trusted perimeter built by the set-up of firewalls with wrong inbound and wrong outbound rules is a common way for an intruder or attacker to get into the communication network system and put a malicious payload on the control system. In the first phase of this type of intrusion, the intruder gets into the network through unauthorized access, where the intruder could be either an insider or an outsider with the ill intention to do malicious action on the system and gain any profit. For instance, an intruder could wait for a legitimate user to join the trusted control system network via VPN and then take over that VPN connection. The network-based attacks mentioned above are dangerous because they allow an attacker from outside to get into the web of a trusted control system.
  Due to resource (device, deployment, and communication) constraints imposed by communication standards and sensor nodes, for a reliable hierarchical smart grid, it is essential that several communication standards can work together securely. The negative impacts of cyber-attacks can be mitigated by creating various intrusion detection and prevention system solutions.
  • Potential cyber-attacks: In terms of cyber-attacks, they can take many different forms, some of which include man-in-the-middle (MITM) attacks, denial-of-service (DoS) attacks, false data injection attacks (FDIA), and other cyber-physical assaults on the smart grid. These attacks include hacking into power plants or distribution network control systems, deceiving sensors and monitoring systems, or destabilizing communication networks that link different grid components. The evaluation of the state of the power system could be hampered by a significant class of cyber-attacks known as FDIA (False Data Injection Attack). The FDIA might compel the state estimator to give the system operator false data, which might have unforeseen consequences for the power system. The FDI attack was found in [33] after a series of attacks and a processed innocuous data set. Such injection assaults, whether they target the smart meter or the command line, can produce seriously abnormal load patterns or power consumption in Singapore, to quote one example [34,35]. The correctness of the calculation and analysis depends on how well the state is estimated [36,37]. A denial-of-service (DoS) attack, as defined by [38,39], is an attempt to overwhelm a targeted computer system or network with traffic or requests to disrupt routine operations and prevent authorized users from accessing it. In Man-in-the-Middle (MitM) cyber-attacks, the attacker intercepts a conversation between two parties to covertly listen in, manipulate, or impersonate one or both of the participants [40,41]. Two frequently utilized MITM attack strategies are ARP spoofing and DNS spoofing. In a replay attack, a hacker intercepts previously obtained data and maliciously retransmits it to pass it off as coming from the original sender and gain unauthorized access to a system or network. The attacker sends a packet of messages [42] to the victim host in the fake system.
    Another most perilous form of cyber attack is the Advanced Persistent Attack (APT). For instance, the intrusion on a Ukrainian Advanced Persistent Attack (APT) caused a blackout for more than 225,000 people, which took a prolonged period for the security specialists to coordinate in pursuit of a particular goal [3].
    Backdoors and holes in the network boundaries can be caused by IT infrastructure components that are weak or are set up wrong. Networking devices at the edge, like fax machines or modems that have been forgotten but are still connected, can be used to get around proper access control [43].
    In particular, access remote terminal units (RTUs) are used for remote management of the dial-up. Many departments don’t require a password for authentication, and the default passwords for modems attached to field equipment are often left unchangeable, making them vulnerable to attack. Also, bad guys can use the devices’ flaws to install backdoors that will let them get into the restricted area in the future. Another possible network-based entry point is through safe peer utility links.
  • Cyber-attacks on common SG protocols: smart grid components use various protocols or standards that inherit security vulnerabilities. Protocols like TCP/IP and remote procedure calls (RPC) are often used. The Modbus protocol, widely used in industrial control systems like water, oil, gas, and SG, is a SCADA protocol. Since the Modbus system wasn’t designed for highly security-critical environments, it is a noteworthy concern because there are several ways to attack it. The Modbus is a simple client-server system for low-speed serial communications in process control networks. Process control systems use this to exchange SCADA information used to run and handle industrial processes [44]. The most common Modbus attacks are as follows: 1) Baseline response replay, 2) Direct slave control, 3) Modbus network scanning, 4) Passive survey, 5) Broadcast message spoofing, 6) Rogue interloper, and 7) Response delay. Suppose an attacker can sniff network traffic using a protocol analysis tool. In that case, they can potentially intercept SG Distributed Network Protocol 3.0 (DNP3) messages and obtain unencrypted plaintext frames containing vital information like source and destination addresses. Intercepted data, such as control and setting information, could be used on another SG system or intelligent equipment device (IED) later, potentially shutting down services or, at the very least, causing service disruptions.
• Physical Threats: Along with these examples of cyber-attacks, a wide range of physical threats can have detrimental effects, such as damaging equipment and even creating power outages of the SG system. While our study does not focus on physical attacks of the SG, we do concur that the possibility of such attacks is more likely to be launched against the power lines themselves, in addition to transformers and substations [45]. Although uncommon, attacks on the power grid’s physical infrastructure, including power lines, transformers, and substations, could happen. However, the smart grid is more likely to be attacked physically through its softer entry points. For instance, smart meters are more likely to be attacked physically due to their ease of access and prevalence. According to research by Anderson and Fuloria [46], an attacker might remotely turn off millions of smart meters simultaneously.
  Apart from these, any third-party integration might cause a severe adverse impact on securing the SG system. On the other side, sometimes energy theft becomes a grave security concern for identifying intrusion in the SG system. An attacker can successfully reprogram industrial control systems by injecting malware targeting the vulnerable points of industrial control systems; one example is the Stuxnet attack [9] against the Iranian nuclear program, which exploited four zero-day vulnerabilities.
  Moreover, besides human errors, equipment failures account for numerous blackouts on the current SG system, including those in North America, Switzerland/Italy, London/West Midlands, Turkey, and South Australia. Research into systems for detecting incidents with the potential to lead to cascading failures was spurred by the North American Blackout [47].
• Threats on WSN: Wireless sensor networks (WSN) are integral to the Smart Grid’s communication framework. Smart Grid network cyber security issues and their remedies have been explored in detail elsewhere due to their unique characteristics; sensor nodes in WSN present individual attack vectors, vulnerabilities, and security requirements. Communication between sensor nodes in a WSN is more concerned with the data than the address of a specific sensor node, so address-specific security threats and remedies may not apply. One of the weakest, most convoluted, and most challenging parts of Smart Grid security is the protection of WSNs. The WSN security is a multifaceted research issue as the security of the entire Smart Grid network can be built upon this. There are various kinds of attacks and threats on WSNs. In external attacks, most hacking incidents involve an intruder located beyond the coverage area of a wireless sensor network (WSN). Jamming the network, using all available resources, or launching a denial of service (DOS) attack are examples of external aggression.
  For internal attacks, an intruder is supposed to be an insider of WSN. This type of adversary is generally performed for physical tampering of nodes, the revelation of confidential information, causing a denial of service to authorized nodes, etc. In the active type of attack, the adversary compromises the security characteristics of WSN to modify and steal the data. An attacker carries out this type of assault to perform an adversary on data by modifying packets, injecting fake data, depleting network resources, and capturing nodes. Examples of active attacks on WSN include spoofing, jamming, wormholes, hello floods, denial of service, sinkholes, etc. On the other hand, passive attacks are performed by an intruder mainly by observing network activities by performing reconnaissance attacks. This type of attack targets the confidentiality of the network. An example of such attacks is an analysis of traffic, decryption of vulnerable data, capturing information, etc.
  To implement an efficient IDS, the nature of attacks should be understood beforehand to develop countermeasures at various network layers. WSNs typically employ hierarchical network architectures, which leaves the networks extremely susceptible to routing problems while switching between topologies. This paper investigates topology control for the cyber security of wireless sensor networks as an alternative to well-studied options like intrusion detection systems and cryptographic security [48]. Many authors have been surveyed recently regarding IoT-related topics, and they all tend to focus on specific parts of IDS. A review of machine learning approaches with a particular emphasis on intrusion detection systems (IDS) for WSNs and the Internet of Things [32,49]. Research by Buczak and Guven [31] indicates several concerns with approaches, particularly for the complexity of those requiring acquisition, and discusses IDS on the general system commonly used for specialized WSN and IoT.

2.3. Intrusion Detection Techniques

• Signature-Based IDS: The second category (Signature-based) works by comparing events in a computer system against a list of known malicious patterns, or "signatures." Each action is compared to each signature, and an alert is generated if a match is found. It is essential to highlight that this method necessitates complete familiarity with the tested system’s weaknesses. Although this method has a low false-positive rate and high dependability, it cannot identify attacks that do not match any known signature. USING MATLAB, an AMI IDS incorporating temporal and geographic detection approaches, was developed by the authors of [51]. The suggested system is primarily concerned with blackhole and time delay attacks. However, the time delay attacks aim to make the packet transmissions sluggish.
  Intrusion detection methods based on signatures examine data gathered during execution to see if it matches a known pattern of malicious activity. Misuse detection, supervised detection, pattern-based detection, and intruder profiling are used to describe this technique [32].
  This means that IDS employing this technique must routinely update their signature sets to account for emerging threats. However, the second method’s usefulness is predicated on labelling anomalous actions as malicious intrusions. Bayesian networks, neural networks, and Markov models are examples of the statistical analytic procedures and machine learning techniques typically used in this approach to detect hostile actions. The application of this method is less precise than its predecessor. One benefit is that it can identify previously unseen forms of cyberattack.
• Anomaly-Based IDS:
  Intrusion detection methods that identify anomalies in runtime behaviour are called "anomaly-based." The commonplace can be defined in two ways: regarding a set of training data (semi-supervised) or the past of the test signal (unsupervised). Unsupervised machine learning is illustrated through clustering.
  Anomaly-based detection finds intrusive behaviour that deviates from the allowed range or the white list. It can identify unusual suspicious behaviour in the smart grid. An anomaly-based intrusion detection technique trains the model using a normalized baseline against which every activity is analyzed [52]. Attackers are likelier to experiment with novel approaches to undermine the intelligent grid system, and attacks are more likely to be discovered by anomaly-based intrusion detection.
  Denning [53] established the first anomaly detection model as an adjunct to misuse-based detection techniques. The purpose of statistical models that describe typical behaviours is to detect outliers. An anomaly-based IDS operates under the hypothesis that routine activities can be predicted statistically and that outliers indicate malicious intent. Point, contextual, and collective anomalies are the three deviations identified by [54]. Anomaly detection studies typically centre on point anomalies and single data instances. Each data object carries contextual attributes and behaviour characteristics, making contextual anomalies conditional anomalies. Sequence, graph, or spatial data exhibits a collective abnormality.
  ARIES, as detailed in [55], is a novel anomaly-based intrusion detection system (IDS) that can reliably safeguard SG communications against intrusion. ARIES has three detection layers—(a) network flows, (b) Modbus/Transmission Control Protocol (TCP) packets, and (c) operational data—to identify potential cyberattacks and irregularities. The ARIES Generative Adversarial Network (ARIES GAN) was built utilizing cutting-edge error reduction techniques to detect anomalies in operational data (i.e., time series electricity measurements), with a focus on the third layer (operational data-based detection).
• Specification-Based IDS Finally, the third method (Specification-based) relies on predefined rules that characterize the typical operation of the system under test. Specifications refer to these guidelines. An alert is sent when an action’s properties deviate from one of the requirements. Because it can identify potential irregularities, this approach can reveal previously unknown attacks. This method differs from the signature-based approach in that it is predicated on the idea that the system’s security policy can’t be breached if all specifications are met. However, this is different from the signature-based method. The word "hybrid" is now used to describe an IDPS combining two or more approaches mentioned above.
  A specification-based intrusion detection framework has been developed to categorize substation scenarios and detect cyber-attacks in [56]. The proposed intrusion detection approach uses Bayesian networks to graphically encode causal links among available information to build patterns with temporal state changes. This lets the proposed system identify cyber assaults and substation scenarios. A modified 2-bus 2-generator system from the IEEE 9-bus 3-generator system is used to explore the non-pilot directional over the current relay protection technique. Nine power system scenarios were devised and implemented for the case study. On the other hand, to maintain the reliability and stability of the grid’s distribution infrastructure, a specification-based intrusion detection sensor has been introduced to monitor advanced metering infrastructures (AMI) [57]. To check for device security and compliance with a security policy, this sensor analyzes network, transport, and application levels of communication between meters and access points. It detects all security policy violations by imposing limitations on C12.22 standard protocol transfers. Using a formal framework, these limitations were confirmed, and a sensor prototype was tested with genuine AMI network traffic. An associated warning is exported if an action’s characteristics don’t match one of the specifications. Because it can identify potential anomalies, this approach can identify undiscovered attacks. This technique is predicated on the presumption that the system’s security policy cannot be compromised, unlike the signature-based method, if all requirements are followed. The signature-based process, in contrast, does not rely on any such presumption. It’s important to note that the term "hybrid" is now commonly used to denote an IDPS that combines two or more approaches.

2.4. Intrusion Detection Functions and Performance Metrics

2.5. Intrusion Detection System Architecture

• Centralized Architecture: C-IDS is typically used in centralized infrastructure. Because of this, the LLN can collect and send data across international borders. As a result, centralized IDS may examine all data travelling between the LLN and the Internet. Since it is challenging to monitor each node during an ongoing attack [61], it is not sufficient to identify attacks affecting nodes within the LLN. The primary objective is to determine how to defend against a botnet attack. Kasinathan et al. [62,63] @devised a centralized placement that allows them to think about beating DDoS assaults so that even if one were to occur, the transmission of IDS data would continue unabated. Wallgren et al. [64] implemented a centralized method for detecting attacks on the physical domain in the border router.
• Distributed IDS: Every LLN node uses D-IDSs, and those used in nodes with limited resources are optimized as much as possible. Because of this, a lightweight distributed IDS was introduced. Light methodology matching attack signatures and packet payloads were identified by Oh et al. [65], and alternative methods requiring fewer matches were proposed. By assigning nodes to monitor their neighbours in the distributed placement, Lee et al. [66] provide a lightweight way of keeping tabs on a node’s power consumption. These nodes serve as "watchdogs" in a network. Cervantes et al. [67] proposed a method to detect and mitigate sinkhole attacks by combining their ideas of trust and reputation with the watchdog nodes. This method is called "Intrusion detection of Sinkhole attacks on IPv6 over Low -Power Wireless Personal- Area Networks (6LoWPAN) for IoT"(INTI). Because of this, the node’s function may shift every time the network is reconfigured or an attack occurs.
• Hybrid IDS: H-IDS uses the advantages of both centralized and distributed deployments, eliminating both limitations. The first method divides the network into clusters, with the cluster’s primary node hosting an IDS instance and then being responsible for monitoring its neighbours. This means a hybrid IDS deployment can be configured to use more resources than a standard IDS deployment [68].
  Le et al. [69] also successfully organized the network into smaller clusters, each with its cluster head, from the same number of initial nodes. Each cluster head might host an IDS instance, with nodes relaying information about themselves and their neighbours to the central node. The second method involves inserting IDS modules into the border router and many additional network nodes in addition to a centralized hub. Using the Routing Protocol Low-power and Lossy (RPL) network data, Raza et al. [70] developed the IDS they called SVELTE, in which the hosts of the border routers are tasked with processing-intensive IDS modules that are responsible for detecting any intrusion attempt. According to Pongle et al., [71], network nodes are to blame for any observable shifts in their immediate vicinity. Additionally, network nodes communicated neighbourhood details to a centrally located module hosted by a border router tasked with data storage and analysis. This facilitates the detection of intrusions and the early detection of attacks. Thanigaivelan et al. presented an IDS in [72] that divides tasks between individual nodes and the router’s perimeter. The IDS module can monitor its neighbouring nodes, looking for signs of intrusion and alerting its fellow IDS modules if it finds any.