[Paper Review] A Comprehensive Survey on the Cyber-Security of Smart Grids: Cyber-Attacks, Detection, Countermeasure Techniques, and Future Directions

Tala Talaei Khoei, Hadjar Ould Slimane+1 more|arXiv (Cornell University)|Jun 22, 2022

Smart Grid Security and ResilienceEngineering19 citations

TL;DR

This survey presents a novel classification of cyber-attacks on smart grids based on the Open Systems Interconnection (OSI) model, addressing limitations in prior work that overlooked accountability and conflated application and physical layers. It proposes new taxonomies for detection and countermeasure techniques, offering a comprehensive analysis of threats, detection methods, and mitigation strategies, with insights into future research directions in smart grid security.

ABSTRACT

One of the significant challenges that smart grid networks face is cyber-security. Several studies have been conducted to highlight those security challenges. However, the majority of these surveys classify attacks based on the security requirements, confidentiality, integrity, and availability, without taking into consideration the accountability requirement. In addition, some of these surveys focused on the Transmission Control Protocol/Internet Protocol (TCP/IP) model, which does not differentiate between the application, session, and presentation and the data link and physical layers of the Open System Interconnection (OSI) model. In this survey paper, we provide a classification of attacks based on the OSI model and discuss in more detail the cyber-attacks that can target the different layers of smart grid networks communication. We also propose new classifications for the detection and countermeasure techniques and describe existing techniques under each category. Finally, we discuss challenges and future research directions.

Motivation & Objective

• Address the gap in existing surveys that fail to incorporate the accountability security requirement in classifying cyber-attacks on smart grids.
• Provide a detailed, layer-specific analysis of cyber-attacks across all seven layers of the OSI model in smart grid communication networks.
• Propose new, refined taxonomies for cyber-attack detection and countermeasure techniques beyond traditional confidentiality, integrity, and availability (CIA) triad.
• Highlight limitations in current TCP/IP-based classification models that obscure distinctions between application, session, and presentation layers.
• Identify key challenges and outline future research directions for enhancing smart grid cyber-security.

Proposed method

• Classify cyber-attacks based on the seven-layer OSI model, enabling granular analysis of threats at each communication layer in smart grids.
• Introduce a new framework for categorizing detection techniques, distinguishing between signature-based, anomaly-based, and hybrid detection methods.
• Propose a structured taxonomy for countermeasure techniques, including encryption, firewalls, intrusion detection systems (IDS), and access control mechanisms.
• Analyze existing detection and mitigation methods under each proposed category, emphasizing their applicability across different OSI layers.
• Use a systematic review approach to synthesize findings from recent literature (2010–2022) on smart grid security, focusing on technical and architectural aspects.
• Integrate insights from both cryptography and artificial intelligence to evaluate emerging defense strategies, including AI-driven anomaly detection and secure authentication protocols.

Experimental results

Research questions

• RQ1 How can cyber-attacks on smart grids be systematically classified using the OSI model to improve threat modeling and defense design?
• RQ2 What are the limitations of existing cyber-attack classification schemes that rely solely on the CIA triad and TCP/IP model?
• RQ3 What novel detection techniques are available for identifying attacks at different layers of the smart grid communication stack?
• RQ4 How do current countermeasure techniques vary in effectiveness across different OSI layers in smart grid networks?
• RQ5 What are the key open challenges and future research directions in securing smart grid cyber-physical systems?

Key findings

• The proposed OSI-based classification provides a more granular and accurate framework for analyzing cyber-attacks compared to traditional CIA-based or TCP/IP-based models.
• Accountability is identified as a critical but often overlooked security requirement in smart grid cyber-security, necessitating formal access logging and audit mechanisms.
• Anomaly-based detection techniques show higher adaptability in identifying zero-day and advanced persistent threats (APTs) in smart grid environments.
• Hybrid detection systems combining machine learning and rule-based methods demonstrate improved accuracy and reduced false positives in real-time monitoring.
• Countermeasure techniques such as lightweight cryptography and blockchain-based access control are emerging as effective solutions for securing resource-constrained smart grid devices.
• Future research must focus on integrating AI/ML with formal verification and zero-trust architectures to enhance resilience against evolving cyber threats.