Future Generation Computer Systems 136 (2022) 358–377

Contents lists available at ScienceDirect

Future Generation Computer Systems

journal homepage: www.elsevier.com/locate/fgcs

Review article

Systematic survey of advanced metering infrastructure security:

Vulnerabilities, attacks, countermeasures, and future vision
∗
Mostafa Shokry a , Ali Ismail Awad b,c,d,e , , Mahmoud Khaled Abd-Ellah f ,
Ashraf A.M. Khalaf g
a
Department of Infrastructure and Information Security, Ministry of Electricity and Renewable Energy, Cairo, Egypt
b
College of Information Technology, United Arab Emirates University, Al Ain P.O. Box 17551, United Arab Emirates
c
Department of Computer Science, Electrical and Space Engineering, Luleå, University of Technology, 97187 Luleå, Sweden
d
Faculty of Engineering, Al-Azhar University, Qena P.O. Box 83513, Egypt
e
Centre for Security, Communications and Network Research, University of Plymouth, Plymouth PL4 8AA, UK
f
Egyptian Russian University, Cairo 11829, Egypt
g
Department of Electrical Engineering, Faculty of Engineering, Minia University, Minia 61519, Egypt

article info a b s t r a c t

Article history: There is a paradigm shift from traditional power distribution systems to smart grids (SGs) due to
Received 27 February 2022 advances in information and communication technology. An advanced metering infrastructure (AMI)
Received in revised form 22 June 2022 is one of the main components in an SG. Its relevance comes from its ability to collect, process, and
Accepted 24 June 2022
transfer data through the internet. Although the advances in AMI and SG techniques have brought
Available online 27 June 2022
new operational benefits, they introduce new security and privacy challenges. Security has emerged
Keywords: as an imperative requirement to protect an AMI from attack. Currently, ensuring security is a major
Advanced metering infrastructure challenge in the design and deployment of an AMI. This study provides a systematic survey of the
Ssmart grid security of AMI systems from diverse perspectives. It focuses on attacks, mitigation approaches, and
Cybersecurity future visions. The contributions of this article are fourfold: First, the vulnerabilities that may exist
Security vulnerability in all components of an AMI are described and analyzed. Second, it considers attacks that exploit
Security threat these vulnerabilities and the impact they can have on the performance of individual components and
Security attack
the overall AMI system. Third, it discusses various countermeasures that can protect an AMI system.
Countermeasure
Fourth, it presents the open challenges relating to AMI security as well as future research directions.
The uniqueness of this review is its comprehensive coverage of AMI components with respect to their
security vulnerabilities, attacks, and countermeasures. The future vision is described at the end.
© 2022 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY license
(http://creativecommons.org/licenses/by/4.0/).

Contents

1. Introduction....................................................................................................................................................................................................................... 359
2. Related work ..................................................................................................................................................................................................................... 359
3. AMI overview.................................................................................................................................................................................................................... 360
3.1. AMI components .................................................................................................................................................................................................. 360
3.2. AMI architecture .................................................................................................................................................................................................. 361
3.3. AMI tiers ............................................................................................................................................................................................................... 363
4. Security vulnerabilities of AMI ....................................................................................................................................................................................... 363
4.1. Vulnerabilities in the hardware layer ............................................................................................................................................................... 363
4.2. Vulnerabilities in the data layer ........................................................................................................................................................................ 364
4.3. Vulnerabilities in the communication layer ..................................................................................................................................................... 364
5. Security perimeters for AMI............................................................................................................................................................................................ 365
5.1. Data encryption.................................................................................................................................................................................................... 366
5.2. Authentication mechanisms ............................................................................................................................................................................... 366
5.3. Intrusion detection systems ............................................................................................................................................................................... 366
6. Lessons learned and discussion ...................................................................................................................................................................................... 368

∗ Corresponding author at: College of Information Technology, United Arab Emirates University, Al Ain P.O. Box 17551, United Arab Emirates.
E-mail addresses: ali.awad@uaeu.ac.ae, ali.awad@ltu.se (A.I. Awad).

https://doi.org/10.1016/j.future.2022.06.013
0167-739X/© 2022 The Author(s). Published by Elsevier B.V. This is an open access article under the CC BY license (http://creativecommons.org/licenses/by/4.0/).
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

6.1. Open challenges ................................................................................................................................................................................................... 370

6.1.1. Open challenges in securing the AMI hardware layer .................................................................................................................... 370
6.1.2. Open challenges in securing the AMI data and communication layers ........................................................................................ 370
6.2. Future vision......................................................................................................................................................................................................... 370
6.2.1. Artificial intelligence ............................................................................................................................................................................ 372
6.2.2. Cloud computing .................................................................................................................................................................................. 372
6.2.3. Big data analytics ................................................................................................................................................................................. 373
6.2.4. Blockchains............................................................................................................................................................................................ 373
7. Conclusion ......................................................................................................................................................................................................................... 373
CRediT authorship contribution statement ................................................................................................................................................................... 373
Declaration of competing interest.................................................................................................................................................................................. 374
References ......................................................................................................................................................................................................................... 374

system as a countermeasure for avoiding issues with authentica-

1. Introduction
Traditional electric power grid infrastructures that are still
in use will soon be considered to be outdated, mainly because
they do not utilize the rapid development of modern information
and communications technology (ICT) [1]. A smart grid (SG) is a
modern infrastructure based on ICT, providing enhanced services
for smart energy distribution and real-time tracking of energy
consumption. An SG is a modernization of an electricity delivery
system that enables it to monitor, protect, and automatically
optimize the operation of its interconnected elements to save
energy, reduce costs, and increase reliability and transparency [2].
A full-function SG uses a huge number of sensors throughout the
transmission and distribution grid, including smart meters (SMs).
These intelligent devices can collect and move data in real time.
They offer two-way communications for monitoring supply and
consumption. Fig. 1 illustrates how these intelligent devices are
integrated into an SG system [3].
An advanced metering infrastructure (AMI) is one of the major
components of an SG. It integrates multiple technologies and
devices to achieve a specific objective, such as collecting data
from various devices [4]. Although SGs have improved power
management by connecting generation and distribution in smart
ways, they have new security challenges due to the links between
the power system and ICT [5,6].
A successful attack of an SG may lead to either localized or
widespread denial of the electricity service, which in turn may
cause a blackout [7]. For example, on December 23, 2015, the
control centers of three Ukrainian electricity distribution compa-
nies were remotely accessed by adversaries, who took control of
the supervisory control and data acquisition systems. Malicious
actors opened breakers at some 30 distribution substations in the
capital city Kyiv and the western Ivano-Frankivsk region, causing
more than 200,000 consumers to lose power [8]. It is anticipated
that AMIs will become more widespread due to the development
of the internet of things (IoT), smart cities, and smart homes.
Thus, it is crucial to identify security vulnerabilities and attack
mitigation approaches as a preventive strategy for alleviating
attacks of AMIs.
This article provides a comprehensive survey of the security
of AMI systems. It covers the entire architecture of an AMI sys-
tem, including the hardware. It considers attacks against SMs,
data concentrators (DCs), and communication channels, as well
as the data and applications. Furthermore, to build a complete
picture, mitigation approaches and current countermeasures are
covered, along with related attacks. Since attacks and mitigation
approaches are considered in a single article, it should be easier to
identify new challenges and build a realistic vision of the future.
Although there have been many review papers on AMI secu-
rity, some have focused on only one type of countermeasure. For
example, Ghosal and Conti [9] focused on the key management
359
tion. Furthermore, Kumar et al. [10] studied attacks that violate
the privacy of the data. In addition, Pedramnia and Rahmani [11]
considered only denial-of-service (DoS) attacks against an AMI.
Finally, Tan et al. [12] analyzed the security of only the data.
The relevance and uniqueness of this survey are due to its
comprehensive coverage of the entire AMI system. It analyzes
vulnerabilities, attacks, and countermeasures. When analyzing
vulnerabilities, attacks, countermeasures, open security
challenges, and cutting-edge technologies, this survey considers
the AMI hardware layer, data layer, and communication layer. The
contributions of this paper are threefold:
• The survey is comprehensive and also focused. It reviews
security vulnerabilities that can be exploited, attacks, and
countermeasures for both the overall AMI system and its
components.
• It considers the impact of an attack, as well as defense tech-
niques and security perimeters. The article aims to provide a
full description of vulnerabilities, attacks, and countermea-
sures.
• The survey provides insights into AMI security and several
open challenges. Furthermore, at the end of the paper, rele-
vant cutting-edge technologies and possible deployments of
these technologies are described.
This article is organized into seven sections as follows. Sec-
tion 2 reviews relevant works and compares previous surveys
of AMI security. Section 3 is an overview of AMIs, including the
main components, the main architecture types, and the tiers of an
AMI system. Section 4 covers the main vulnerabilities and attacks
against the key components of an AMI system. It also discusses
the impact of these attacks. Section 5 describes some of the main
countermeasure techniques for securing an AMI system. Section 6
is the discussion and considers existing open challenges for each
layer of an AMI system. Finally, the conclusions and remarks are
in Section 7. Fig. 2 is a mind map illustrating the overall structure
and key sections of this article.
2. Related work
There have been many surveys on the state of the art of AMI
security, including on vulnerabilities, attacks, and countermea-
sures. Pealy and Matin [13] focused on attacks and mitigation
techniques for the hardware layer, which is represented only by
SMs. Kumar et al. [10] described cyberattacks against SM com-
ponents, especially attempts to steal the data being transferred
through the AMI system and threats to the privacy of the data.
Ghosal and Conti [9] focused on key management techniques that
can be used to secure an AMI from attacks, such as authentication
between AMI entities.
Desai et al. [14] gave a detailed analysis of privacy problems
relevant to an AMI and their corresponding solutions. El Mrabet
et al. [15] provided descriptions of several severe cyberattacks
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Fig. 1. Main components of an SG system, including the location of AMI components.
relating to the communication protocols used in an AMI and pro-
posed a cybersecurity strategy for detecting and countering these
attacks. Pedramnia and Rahmani [11] studied different types of
DoS attacks due to vulnerabilities in the LTE as a communica-
tion technology and also countermeasures. Hansen, Staggs, and
Shenoi [16] analyzed the security issues in an AMI system with
more than a million SMs, 100 DCs, and a two-meter data man-
agement system, as well as the impact of these attacks on the
performance of the AMI system.
Tan et al. [12] described attacks to steal the data in an AMI
system. Tong et al. [17] considered the different types of intrusion
detection system (IDS) that can be used to secure an AMI system.
Jokar, Arianpoo, and Leung [18] discussed several SG cyberattacks,
focusing on those compromising the privacy of the data in the
AMI. Saxena and Choi [19] studied the different types of authen-
tication and access control techniques that can be applied to an
AMI system to prevent unauthorized access.
Anzalchi and Sarwat [20] investigated the importance of the
authentication between an SM and a utility center (UC) and
the different authentication techniques that can be used. Fore-
man and Gurugubelli [21] discussed the attack surfaces of the
main components of an AMI system. Komninos, Philippou, and
Pitsillides [22] studied the cyberattacks that may occur against
a home area network (HAN) in an AMI system, including SMs
and other smart devices in the HAN. Mohassel et al. [23] gave
an overview of AMIs but without including the security issues.
Ancillotti, Bruno, and Conti [24] studied the attacks related to
the communication technologies used in an AMI to transfer data
between the different tiers of the AMI.
This exploration of state-of-the-art research identified several
relevant surveys that have already been published. Table 1 sum-
marizes the results of this analysis. It shows that there are still
research gaps that need to be addressed. No single previous work
has investigated existing vulnerabilities in an AMI system, the
360
Future Generation Computer Systems 136 (2022) 358–377
attacks that may exploit these vulnerabilities, the direct impact
on each AMI layer, and the overall impact on the AMI. Identifying
mitigation techniques for protecting an AMI system from attack
has not been fully covered in any previously published survey,
which demonstrates the significance and the need for this survey.
This article aims to address the drawbacks identified in the
previously published surveys by considering security vulnerabili-
ties, attacks, and countermeasures across the overall AMI system.
Another contribution of this survey is the categorization of the
security vulnerabilities, attacks, and security perimeters based on
the main AMI layers, namely the AMI hardware layer, data layer,
and communication layer.
3. AMI overview
An AMI is an intermediate system between the user domain
and the utility domain. Its main purposes are power pricing
and demand-side management. An AMI architecture is generally
composed of three main types of component: SMs, DCs, and the
central system. There are bidirectional communication networks
among those components. Fig. 3 illustrates the main components
of an AMI architecture [25].
3.1. AMI components
An SM is sometimes called a next-generation meter due to its
advanced features [26]. The main purpose of an SM is to collect
data on electricity consumption from a customer’s premises [27].
An SM has two main parts: (1) A meter records the energy
used by the customer. These meter readings are sent to the DC.
(2) Computing elements perform preconfigured tasks such as
remotely connecting or disconnecting, remotely upgrading the
firmware, and tamper and theft detection and prevention [28].
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Fig. 2. Mind map illustrating the overall structure of the article and its key sections. In addition, the figure highlights the core elements and the sub-sections.
There are multiple definitions of a DC, which are also called
smart meter gateways or data aggregators [29]. Even though
there are multiple definitions, they are still used for the same
function, which is to act as an intermediate device between the
SM and the data center in the UC. A DC performs two main
functions: forwarding data from SMs to the UC and sending
commands to SMs from the UC [30].
A UC has a data center. It is generally located within the main
facilities of the utility company. The main purposes of a UC are to
collect the data that are gathered from SMs, to send commands to
SMs through the DC to get the SMs to perform specific tasks, and
to monitor aspects of the SG, such as the amount of generated
power, the transmission lines, and the distribution centers [31].
Communication networks play an important role in an AMI.
They are responsible for connecting together all the main compo-
nents of an AMI, including SMs, DCs, and the UC [32]. Bidirectional
communication channels are used to send data from SMs to DCs
and then on to the UC and also to send commands from the
UC to the SMs [33]. The communication technologies used in an
AMI vary widely, but generally, we can classify them as wired
and wireless [34]. Using the right communication method is very
important as it has a vital role in protecting the AMI due to
the amount and sensitivity of the data transferred through the
channel [35].
361
Future Generation Computer Systems 136 (2022) 358–377
An AMI has three main layers (Fig. 4): hardware layer, data
layer, and communication layer. As illustrated in Fig. 3, the hard-
ware layer includes SMs, DCs, and the UC. The communication
layer can be wired or wireless. It is used to transfer data from
SMs to DCs, from DCs to the UC, and vice versa. The data layer
comprises data relevant to the customer, which may represent
the user’s electricity consumption or the commands sent from the
UC.
3.2. AMI architecture
Various architectures can be used to implement an AMI de-
pending on the components and the communication technol-
ogy used. The architecture must meet the main objective of the
AMI, which is sending data from SMs to DCs then forwarding
these data to the UC through a bidirectional communication
channel [36].
Generally speaking, there are two main categories of AMI
architecture: direct and indirect [37]. In a direct architecture, an
SM is connected directly to the UC through a communication
network, either wired or wireless, without the need for a DC. The
advantage of a direct architecture is the simple implementation.
This type of architecture is appropriate for a small area and
when the number of users and the amount of data is low [38].
With more users and data, a direct architecture is no longer the
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Table 1
Comparison of relevant surveys of AMI security identified in the literature review.
Ref, Year Objectives
[13], 2020 Brief overview of attacks and mitigation
techniques but covering only SMs, which are
in the hardware layer of an AMI.
[10], 2019 Surveys of real cyberattack incidents in
traditional energy networks and smart
metering networks.
[9], 2019 Highlights key security issues for AMIs and on
how key management techniques can be
utilized.
[14], 2019 Comprehensive survey of privacy-related
research on IoT-enabled SG environments.
[15], 2018 Reviews of security requirements and
descriptions of several severe cyberattacks.
[11], 2018 LTE network vulnerabilities that lead to a DoS
for legitimate subscribers in an AMI are
covered.
[16], 2017 Security analysis of AMIs.
[12], 2016 Surveys of recent security advances for SGs
using a data-driven approach and centered
around security vulnerabilities and solutions
over the entire life cycle of SG data.
[17], 2016 Analyzes potential threats to an AMI and
investigates current academic approaches to
IDS and other techniques for AMI.
[18], 2016 Introduces several SG cybersecurity and
privacy issues.
[19], 2015 Reviews of existing authentication protocols
and mutual authentication when
communicating information across an SG
network.
[20], 2015 Assessment of cybersecurity for an SG and an
AMI, as well as network vulnerabilities and
attack countermeasures.
[21], 2015 Examines cyberattack surfaces for hardware
and network configurations, protocols, and
software.
[22], 2014 Presents issues related to the security of an SG
and a smart home.
Fig. 3. Main hardware components and general architecture of an AMI.
Future Generation Computer Systems 136 (2022) 358–377
Remarks
Focuses only on attacks relevant to SMs.
Focuses only on attacks compromising
privacy.
Focuses only on authentication issues for
AMIs and key management systems.
Focuses only on privacy issues in AMIs and
the corresponding solutions.
Focuses on attacks related to the protocols
that are used in AMI communication
channels.
Discusses DoS attacks that may occur due
to using an LTE network as a
communication technology.
Describes common attacks, the
vulnerabilities of an AMI, and the impact of
these attacks on the main components of
an AMI.
Studies the security of an AMI system from
the data perspective only.
Focuses only on IDS as a countermeasure.
Focuses only on the privacy of data being
transferred through the AMI channels.
Focuses only on authentication and access
control techniques without discussing the
vulnerabilities of the main components of
the AMI system and their related attacks.
Focuses only on authentication and privacy
issues between SMs and the UC in an AMI.
Discusses only the attack surface in an AMI
without considering vulnerabilities, attacks,
or how to secure the AMI network.
Focuses on only one tier of an AMI, the
HAN.
362
Our contributions
Attacks and mitigation techniques for
the three AMI layers are introduced.
Extended countermeasure techniques
are considered, such as authentication,
encryption, and intrusion detection.
Security challenges and extended
countermeasure techniques are
considered.
Security challenges and extended
countermeasure techniques are
considered.
Considers the AMI hardware, data, and
communication layers.
Focuses on the AMI hardware, data, and
communication layers.
Mitigation techniques that can be
applied to the AMI to overcome
different security vulnerabilities and
attacks are considered.
Overview of possible attacks against all
AMI layers is introduced.
Multiple countermeasure techniques,
such as encryption and authentication,
are covered.
Attacks related to the three AMI layers
and various countermeasures are
covered.
Vulnerabilities for each AMI layer and
mitigation techniques are discussed.
Several mitigation techniques are
covered.
Security vulnerabilities, possible attacks,
and possible mitigation approaches are
described.
All tiers of the AMI system—HAN, WAN,
and NAN—are covered.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Fig. 4. Three main AMI layers and their related components.
optimum choice, so an indirect architecture would be used [39].
An indirect architecture has an intermediary between the SMs
and the UC [40]. The intermediary can be the cloud, so that the
data is forwarded to the UC by the internet. Alternatively, for an
aggregator-based architecture, there are DCs between the SMs
and the UC [41,42].
3.3. AMI tiers
An AMI has three main zones or tiers. Each zone contains
some of the components of the AMI. The three tiers of an AMI
are the HAN, neighbor area network (NAN), and wide area net-
work (WAN) (Fig. 3) [43]. Each tier in an AMI can connect the
components using different communication technologies [44].
The HAN is the first tier of an AMI. It is within the customer’s
premises, which could be a home or commercial building. It
connects intelligent end devices (IEDs) with an SM. In a HAN,
the data are the energy consumed by each IED, which are passed
to an SM through a bidirectional communication channel. As
the amount of data transferred through the HAN is low, low-
energy communication technologies can be used, such as Zigbee,
Bluetooth, and Wi-Fi [45].
The second AMI tier or stage in the AMI architecture is a NAN,
which can link to multiple HANs. The main component in a NAN
is a DC, which collects data from SMs via the HANs [46]. Due
to the increased data size and the number of customers in a
NAN compared to a HAN, the communication technology must
be able to transfer a high amount of data more securely. Thus,
cellular networks (LTE/2G-3G systems), optical fibers, and power
line communication systems are used [47].
The last stage in the AMI is the WAN, which connects all the
HANs and NANs with the UC. The WAN is linked to the meter data
management system, which collects, stores and analyzes the data
and sends commands or actions back to the NAN and then onto
the HAN. Due to the large distance between the NANs and the UC,
which may be in another city, wired communication technology
is preferred, as it can transfer the collected data faster and more
securely. Power line communications are often used to connect
HANs to NANs, then connecting NANs to WAN. [48].
4. Security vulnerabilities of AMI
An AMI is a service provided from the UC to the customer. Its
aim is to enhance both the performance of the SG and the power
service given to the customer. The security level, and hence, the
stability of this service, are assessed using three features, namely
confidentiality, integrity, and availability, which are called the CIA
triad [49].
The first of these, confidentiality, means that the data can be
accessed only by authorized users and not shared with anyone
else. Power consumption and a customer’s private data are ex-
amples of confidential data, which can be accessed only by the
363
Future Generation Computer Systems 136 (2022) 358–377
customer and the UC [50]. Second, it is important that the data
cannot be modified during transmission from the source to the
destination. Any modification would affect the integrity of the
service, whether that relates to data transferred from the SM to
the UC or vice versa [50]. Finally, the availability of the service can
be measured as the percentage of the time that a stable service
is provided to the customer [50].
As a result of integrating ICT into traditional power grids,
security is a new challenge for such SGs [51]. As we saw in the
previous sections, the AMI, which is a major component of an
SG, consists of multiple devices. Most of these components are
outside the UC, such as the SMs and DCs, so they are vulnerable
to physical attacks and cyberattacks. In this section, we will
discuss security issues related to the main components of an
AMI, including both hardware and software. We will consider
vulnerabilities, possible attacks, and the impact of an attack on
the components.
4.1. Vulnerabilities in the hardware layer
As shown in Fig. 4, the hardware layer consists of both the
SMs and the DCs in an AMI system. Because of its nature, there
are several vulnerabilities for an SM located outside the UC.
Moreover, as we discussed previously, an SM can be controlled by
a UC, as it can send commands to the SM through a bidirectional
channel. One of these commands is a remote disconnect, which
allows the UC to connect or disconnect an SM [60]. This feature
is essential but at the same time makes the SM vulnerable to
an attacker impersonating the UC. The attacker can send this
command to multiple SMs, which can lead to a denial of power
attack [61].
Lack of resources, such as internal storage, in an SM adds
another security challenge. An SM has a small amount of storage,
which is used for both the data collected from users and the
firmware. The latter is important for the functionality of the
SM. This tiny storage space can lead to another issue, as it may
prevent firmware updates, which are essential, especially security
upgrades. Moreover, the SM may not have enough space for cryp-
tographic functions. These could be deployed in extra disk storage
outside the SM chip, where they are vulnerable to both physical
and cyber-access. An attacker can exploit this vulnerability with
a buffer overflow attack by broadcasting malicious messages that
fill the SM buffer so that the SM has to stop receiving data
temporarily [62].
An important feature of an SM is that the customer can ac-
cess it through a web page, allowing them to monitor power
consumption and pay bills. This feature makes the SM vulner-
able to attacks via the web application, such as SQL injection,
DoS, and distributed denial-of-service (DDoS) attacks. Addition-
ally, this feature means that the data stored in the SM, either
the data on energy consumption or the installed firmware, are
vulnerable. An attacker can execute an authentication bypass
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Table 2
Security vulnerabilities in the AMI hardware layer and their related attacks.
References Publication year AMI Vulnerabilities
component
[52–55] 2020, 2017, 2013, SM Bidirectional
2019 communications
between the SM and
customer and between
the SM and the UC.
[56] 2012 SM Lack of resources in SM.
[57,58] 2016, 2018 SM Customer interference.
[57,59] 2016, 2019 SM Ability to log on to the
SM via a web
application.
attack. This means that even without knowing the customer’s cre-
dentials, they can steal data from or manipulate the data on the
SM, which threatens the confidentiality, privacy, and availability
of the customer’s private data [63].
These vulnerabilities and the resulting attacks against an SM
can degrade the performance and functionality of the SM and
the SG. One of the major impacts of an attack against an SM
is the theft of either the data on energy consumption or the
firmware installed on the SM. Knowing the customer’s energy
consumption over time can reveal the signatures of the electrical
appliances used by the customer, thus threatening the customer’s
privacy. Moreover, a modification of the firmware can lead to the
dysfunction of the SM, which could disable it [64].
These attacks against the SM can also be performed against
a DC, although they can have a larger impact, especially if the
AMI has an indirect or mesh topology architecture, since multiple
SMs are connected to the UC through a single DC. Attacking a DC
can affect several SMs, leading to a localized denial of power for
more than one SM simultaneously or the theft of data from all
the customers connected to the compromised DC [65].
Table 2 lists the vulnerabilities for both SMs and DCs such as
the lack of resources of the SM and the direct connection between
the customer and SM, and the attacks that can be performed due
to the exploitation of these vulnerabilities. These attacks include
buffer overflow attack and sending malicious code either to SM or
DC to affect the downloaded firmware on them, and the impact
of these attacks, either on the device or on the entire SG.
4.2. Vulnerabilities in the data layer
As previously mentioned, the main purpose of the AMI is to
collect data from SMs and forward these data through DCs to
the UC, where the data are stored and analyzed. A huge amount
of data is transferred through the AMI architecture. These data
include the users’ energy consumption and their personal infor-
mation plus the status of components within the AMI, such as
health checks or logs. These data are vulnerable to attacks such as
data manipulation, insertion, and hijacking attacks. These attacks
can be performed within any one of the three AMI tiers [66].
Table 3 summarizes the relations between the vulnerabilities
in the AMI data layer, the related attacks, and the impact of these
attacks. The most common types of attacks against the data layer
of an AMI include data manipulation due to the direct connec-
tion between the customer and the SM, firmware manipulation
because of the remote updating feature of an AMI system, and
fraudulent manipulation of a customer’s energy consumption.
If attackers can manipulate or insert data in the HAN, then
they can modify the data on power consumption or steal data,
364
Future Generation Computer Systems 136 (2022) 358–377
Attack Direct impact General impact
Attacker impersonates a UC SMs shut down. Widespread denial of
and sends malicious code to power.
SMs.
Attacker performs buffer Instability in the Localized denial of
overflow attack. operation of the SM. power.
Attacker sends malicious SM shuts down. Localized denial of
code to affect the firmware power or data theft.
of the SM or the data
stored in the SM.
SQL injection, DoS, or DDoS. Stop the SM. Localized denial of
power.
which threatens the reliability or privacy of the service. An inter-
nal or external attacker could manipulate the data in the WAN
in the UC. For example, they could modify the commands sent to
SMs, thus leading to instability of the SG and possibly causing a
denial of power [67]. Another vulnerability of an AMI is the use of
the internet protocol (IP) for transferring data, which makes the
data vulnerable to attacks that succeed against IP-based systems,
such as IP spoofing, teardrop attacks, DoS, and others, which can
lead to data theft [68].
Table 4 summarizes the various attacks that can occur against
an AMI system. Each kind of attack affects one or more of confi-
dentiality, integrity, and availability, and this must be considered
in the AMI design process. Any modification to the data or the
applications that run in the AMI affect the integrity of the system.
Attacks compromising customer data affect the confidentiality
and integrity of these data. Attacks that damage the SM or DC
due to a firmware modification affect confidentiality, integrity,
and availability.
4.3. Vulnerabilities in the communication layer
As stated previously, communication channels are used to
connect IEDs to SMs within the HAN, SMs to DCs within the NAN,
and DCs to UC within the WAN. So, due to the importance and the
amount of data transferred through the communication channels,
they are the part of the AMI system most vulnerable to threats
and attacks.
Wireless communication is used by HANs and NANs, which
makes the networks vulnerable to attacks against wireless com-
munication channels, such as man-in-the-middle (MITM) attacks.
This may lead to the theft of customer data [82]. Another vul-
nerability of the communication channels is the failure of a com-
munication line, which can occur because of interference, breaks
to the cables, path degeneration, or loss of bandwidth. This can
lead to both localized and widespread denial of power and hence,
threaten the availability of the service [83].
Table 5 lists the relations between the vulnerabilities in the
AMI communication layer, the attacks that exploit these vulnera-
bilities, and the impact on the performance and the parameters of
the AMI system. The major vulnerability in an AMI communica-
tion layer is the use of wireless transmission media between the
SMs and DCs due to the large distance between them. Wireless
communications are vulnerable to common attacks, such as ses-
sion hijacking, MITM, and communication channel failure, which
can lead to leakage or data fraud.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

Table 3
Security vulnerabilities in the AMI data layer and related attacks.
References Publication Vulnerabilities Attack Direct impact General impact
year
[33,69] 2019, 2018 Direct connection between Customer makes fraudulent Data loss or modification. High energy losses and compromised
the customer and the SM. claim for energy privacy of customer usage data.
consumption.
[70] 2017 Remote updating of Firmware manipulation. Data modification. SM and DC shut down, leading to
firmware and direct localized denial of power.
connection between the
customer and the SM.
[7,71,72] 2015, 2015, Customer interference with Injection of false data. Data modification. Attacker controls the SM and
2021 SM. compromises estimates of power system
state.
[73] 2015 Remote connection to SM DoS attack. Denial of data transfer. Localized and widespread denial of
and DC using the IP in the power.
AMI system.
[74,75] 2019, 2018 Lack of security Data manipulation by Data fabrication. Affect the integrity of or steal data.
configuration in utility data internal attacker.
center.

Table 4
Possible security threats and their impacts on an AMI.
References Publication year Threat Compromised AMI Vulnerabilities Impact:
service Integrity (I) Availability (A)
Confidentiality (C)
[53,57–59,76] 2016, 2018, 2019, Tamper with application Integrity Management applications Disruption of the communication
2019, 2017 services at AMI nodes. and services remain flow due to rerouting of all traffic to
exposed and available to all the attacker’s node for later
nodes. manipulation. (I)
[54,55,77] 2013, 2019, 2015 Masquerade as the control Integrity & Lack of authentication or Impersonation of the control center
center. Confidentiality encryption. to send unauthorized commands to
meters or read metering data. (I,C)
[78–81] 2020, 2012, 2013, Bypass authentication in Integrity & Poor implementation of Manipulation of reading parameters
2011 metering protocols. Confidentiality metering protocols. of SMs. (C,I)
[56,59] 2019, 2012 Buffer overflow in the AMI Integrity & Firmware makes System becomes unstable or freezes.
meter’s firmware. Confidentiality assumptions regarding the Parameter values in the memory
data it receives, particularly stack are changed. Arbitrary code is
the size of each message executed. (C,I)
format.
[69,70] 2019, 2017 Firmware manipulation. Integrity, Firmware architecture with Attacker executes a disconnect action
Availability, & poor access controls. and then makes the meter
Confidentiality. completely unresponsive till it is
returned to the manufacturer, thus
making it impossible for the network
operator to reverse their actions.
(C,I,A)

Table 5
Security vulnerabilities in the AMI communication layer and their related attacks.
Reference Publication year Vulnerabilities Attack Direct impact General impact
[84] 2011 Wireless communication Firmware update of the SM Leak from communication Localized and widespread
technology used. or DC. media. denial of power.
[85–87] 2021, 2015, 2013 Wireless transmission Session hijacking. Leak from security protocols Data theft or manipulation.
media. in the transmission media.
[88–90] 2020, 2017, 2019 Inadequate wireless MITM attack. Failure of a communication Data theft or manipulation.
technology security. channel.
[91,92] 2018, 2020 Interference to Bandwidth loss. Bandwidth congestion. Data congestion or loss.
communication channels.

5. Security perimeters for AMI
Countermeasures must be used to protect an AMI from attack.
Different techniques can be used for each component of the
AMI. For the data layer, encryption and integrity checking can
safeguard the data transferred between the main components.
For the hardware layer, authentication and authorization can be
used to verify the identity of entities joining the AMI network. For
the communication layer, intrusion detection techniques can be
used to detect unauthorized access to the network. This section
365
will briefly discuss some of the most common countermeasures
for each layer of the AMI and also discuss relevant works in the
literature.
This survey discusses the three countermeasures that are
the most common mitigation approaches: data encryption (data
layer), authentication (hardware layer), and IDSs (data and com-
munication layers). Preserving the privacy of the data collected
by the AMI system is essential. The data must be protected both
in transit and when stored. Encryption can prevent unauthorized
access and modification of these data.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Some AMI components are outside the premises of the elec-
tricity utility, and such physically unprotected end devices must
be protected from unauthorized access. Moreover, the AMI com-
munication layer depends on wireless communications for trans-
mitting data, which means the data are vulnerable to access or
interference by an attacker. Thus, an IDS is the optimum solution
for an AMI as a second line of defense, since it can detect any
security breaches in the system.
Attackers can exploit vulnerabilities in communication tech-
nologies. For example, by spoofing a known ID or injecting ma-
licious code, an attacker could deactivate the demand–supply
balance and steal or modify customers’ energy consumption data.
Thus, authentication is an important mitigation technique that
must be applied in an AMI system.
5.1. Data encryption
Encryption is an important method for securing the data layer
of an AMI system. It can preserve the privacy of data being
transferred through the AMI via the HAN, NAN, or WAN. It can
protect the AMI from attacks such as MITM, data hijacking, and
data sniffing.
Tonyali, Saputro, and Akkaya [77] conducted a feasibility study
on the integration of a fully homomorphic encryption (FHE) sys-
tems with the wireless communication standard IEEE 802.11s.
Their method can be used when transferring data through a
HAN. A variety of conditions were studied with the NS-3 network
simulator tool. Parvez, Islam, and Kaleem [94] proposed a sim-
ple node-to-node authentication method based on electromag-
netic signal strength using two simple servers, which includes
two-level encryption, without increasing the packet processing
overhead. One server (master) manages the encryption of data
being transferred between the SM and the UC whereas the other
server manages randomized data transfers. Ibrahem et al. [52]
proposed a privacy-preserving monitoring and billing scheme
using functional encryption (PMBFE).
Hasan and Mouftah [93] proposed an encryption service for
SG AMI using lightweight encryption of AMI data. Lee et al. [56]
proposed a system with searchable and homomorphic encryption
to protect customers’ private information and support real-time
measurements of electricity usage. Saxena, Choi, and Grijalva [53]
proposed a secure and privacy-preserving scheme based on ad-
ditive homomorphic encryption and proxy re-encryption opera-
tions. The proposed scheme can aggregate metering data without
revealing the actual individual data (identity or energy usage) to
intermediate entities or any third party, and hence, it can defend
against identity and related data theft attacks.
Alsharif et al. [76] proposed an efficient and privacy-preserving
data collection and access control scheme for multi-recipient AMI
networks. These authors developed a novel proxy re-encryption
scheme that allows data aggregation before re-encryption. It
allows either full or partial access to the aggregated data after re-
encryption as needed. Parvez et al. [57] proposed a localization-
based key management system. Meter data are encrypted by the
key associated with the coordinate of the meter and a random
key index, but keys are managed and distributed by a trusted
third party. Seo, Ding, and Bertino [54] proposed an efficient
encryption key management mechanism for end-to-end security
in an AMI by applying certificateless public key cryptography for
SM key management. This approach eliminates the overhead due
to certificate management by the utility company.
Table 6 compares published studies on encryption for an AMI.
It lists the different encryption techniques used to secure the data
layer such as the FHE system, proxy re-encryption, encrypting key
management system, and PMBFE techniques. The performance
metrics from different points of view and the possible attacks that
can be prevented with data encryption are also listed.
366
Future Generation Computer Systems 136 (2022) 358–377
5.2. Authentication mechanisms
Verifying the source of data is crucial for protecting the data
transmitted through an AMI system. Therefore, authentication
mechanisms play a vital role in securing the hardware layer of
the AMI, including both SMs and DCs. Authentication is essential
when establishing node-to-node communications. Authentication
can be used to prevent attacks where an attacker impersonates
either a UC and sends broadcast shutdown message to multiple
SMs or an SM and sends malicious code to the DC, which may
affect the firmware of the DC and affect the performance of the
DC and the overall SG.
In this section, we give an overview of various techniques
for authenticating the source of data. Lee, Hwang, and Choi [55]
proposed a unified approach for compression and authentication
of power reading signals in multicarrier systems based on com-
pressive sensing (CS) of SM readings. Robles et al. [58] developed
a combination of a blockchain and smart contracts to enable user
empowerment of data management for the HAN tier of an AMI.
Li et al. [100] presented a new authentication architecture that
boosts the utilization of a set of efficient authentication schemes
and fault diagnosis algorithms that can be used for authentication
failures.
Mustapa et al. [95] introduced a novel authentication scheme
using ring oscillator physically unclonable functions (ROPUFs),
which covers the communication between the UC and an SM.
Kamto et al. [81] proposed a mechanism based on group IDs. It
is a lightweight key distribution and management scheme that
establishes the keys for many entities for a small overhead. Chin,
Lin, and Chen [96] designed an authentication scheme for an AMI
that utilizes SMs to enable two-way communications between an
SM and the UC. The SM is authenticated globally by a public key
infrastructure (PKI) and authenticated locally with channel signa-
tures. Nabeel et al. [79] proposed an approach based on physically
unclonable functions (PUFs). It provides strong hardware-based
authentication of SMs and efficient key management between
SMs and the UC.
Nath et al. [97] proposed an authentication and key man-
agement scheme based on configurable ROPUFs implemented on
Xilinx Spartan-3E FPGA boards. Nicanfar et al. [80] proposed an
efficient scheme that mutually authenticates an SM of a HAN
and an authentication server in the UC by utilizing an initial
password. Saxena and Choi [98] developed a protocol that pro-
vides distributed and mutual authentication among communicat-
ing entities based on a certificateless cryptosystem and PKI. The
protocol is lightweight, integrated, distributed, and centrally con-
trolled and has a cloud-trusted authority. George, Nithin, and Kot-
tayil [99] used a hybrid encryption scheme for unicast, multicast,
and broadcast communications in an AMI. A key management
scheme for hybrid communication modes was proposed. Naseer,
Bhutta, and Alojail [78] developed a protocol to establish a session
key for a DC and SM after authenticating each other. It has four
phases: initialization, registration, mutual authentication, and key
exchange.
Table 7 compares published authentication techniques that
can be deployed in an AMI such as blockchain with smart con-
tracts, integration between PKI system and channel signature,
and PUF technologies. Furthermore, performance metrics from
different viewpoints and the possible types of attacks that can
be defended by authentication are listed as well.
5.3. Intrusion detection systems
An IDS is a powerful tool for securing both the data and the
communication layer of an AMI system from attackers, who could
otherwise exploit unknown system vulnerabilities and disrupt
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

Table 6
Comparison of published studies on data encryption techniques used for securing an AMI data layer.
Reference, year Target attacks Encryption Objectives Assumptions Performance Performance impact
technique metrics
[52], 2020 Collusion and PMBFE To preserve customer Compared with Communication Reduces the time required
eavesdropping privacy while homomorphic-based and for key generation,
attacks. collecting their power and inner-product computation encryption, and decryption
consumption data for functional encryption, overheads. by nearly 99%. Reduces the
monitoring and PMBFE has been time to generate the 48
billing. evaluated with monitoring keys by 98.6%
extensive and the time to generate
computer-based the 100 decryption keys for
simulations. billing by 96%.
[76], 2019 Collusion Proxy To provide N/A Computation Lower computational cost
attacks. re-encryption. fine-grained access and for each entity in the AMI
control for communication network and low
multi-recipient AMI overheads. communication overhead.
networks, so that
each recipient can
access only the data
intended for it.
[53], 2017 MITM, replay, Additive To ensure privacy N/A Computation, Low overheads because of
and homomorphic during data communication, efficient short signatures,
impersonation encryption and aggregation. and storage XOR and hash operations,
attacks. proxy overheads. as well as the transmission
re-encryption of fewer bits due to
operations with compression by pairing and
the Paillier exponential operations.
cryptosystem.
[57], 2016 Decoding Localization- To ensure data N/A N/A N/A
energy based key privacy in the AMI.
consumption management.
readings,
injecting false
data or
command
signals, and
jamming.
[77], 2015 N/A FHE To investigate the Based on wireless Encrypted data Higher latency than other
feasibility of FHE LAN 802.11s protocol size, average approaches. Has a higher
systems for an IEEE for communications completion data size compared to PHE
802.11s-based AMI with a mesh topology time, and AES that exceeds the
application while network. Simulated throughput, maximum transmission
preserving consumer using NS-3 software. and average unit. Hence, generates more
privacy. Approach compared number of fragmented packets.
with AES and PHE fragmented Completion time is good
encryption with and packets. when the max. number of
without an nodes is 81.
aggregator.
[93], 2015 N/A Lightweight To present an Compared with a PKI, Speed, cost- Lighter than hybrid
encryption. encryption service for it is completely effectiveness, approaches. Much lower
SG AMI based on the dependent on and the key generation time than
cloud. symmetric generation time an in-house PKI.
cryptography. for different
numbers of
session keys.
[94], 2014 N/A Key To enhance two-level One server (master) Packet N/A
management encryption without manages data overhead.
with two increasing packet encryption between
independent overhead. the meter and energy
and partially supplier whereas the
trusted but other manages
simple servers. randomized data
transfer over a
wireless mesh
network.
(continued on next page)

the AMI system. Various types of IDS have been implemented to
protect AMIs. Faisal et al. [112] proposed an IDS architecture for
an AMI that was placed in SMs, DCs, and the central system (the
AMI head end). They used data mining on the public KDD Cup
1999 dataset to determine the requirements for the three com-
ponents of the AMI. This extended the work of Faisal et al. [111].
Sun et al. [104] proposed a two-stage cyber-intrusion protection
367
system. The first stage of intrusion detection uses a support vector
machine (SVM) as a detection algorithm to uncover suspicious
behavior inside a SM. The second stage uses a temporal failure
propagation graph to generate attack routes for identifying attack
events.
Li, Qiu, and Jing [106] introduced an IDS based on an online-
sequence extreme learning machine (OS-ELM) to detect attacks
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Table 6 (continued).
Reference, year Target attacks Encryption Objectives
technique
[54], 2013 Spoofing, Encryption key To secure data
eavesdropping, management. transmission between
and MITM the SMs and the
attacks. utility company.
[56], 2012 Internal Searchable To prevent internal
attacks. encryption and threats in advance.
homomorphic
encryption.
against an AMI. Jokar, Nicanfar, and Leung [113] presented a
layered specification-based IDS for a HAN implemented using
Zigbee to protect the physical and medium access control layers.
Yao et al. [102] proposed an AMI intrusion detection model based
on the cross-layer feature fusion of convolutional neural networks
(CNNs) and long short-term memory (LSTM) to obtain compre-
hensive features with multi-domain characteristics based on the
KDD Cup 99 and NSL-KDD datasets. Alseiari and Aung [109]
developed a real-time distributed IDS for an AMI infrastructure
that utilizes data stream mining in a multi-layer implementation.
Vijayanand, Devaraj, and Kannapiran [107] proposed an IDS
for early detection of threats against the AMI of an SG. This
IDS has a multi-SVM classifier with a mutual information-based
feature selection technique to detect attacks against the NAN of
an SG. Huang [101] proposed an improved intrusion detection
algorithm with a generalized regression neural network (GRNN).
It has an excellent nonlinear mapping function and a high conver-
gence rate. The study used the public intrusion detection dataset
NSL-KDD to verify and analyze the proposed algorithm.
Pourfallah, Jafari, and Shahhoseini [110] proposed an IDS based
on a SVM and principal component analysis (PCA) to recog-
nize and identify intrusion and attacks in an SG. Park, Li, and
Hong [103] built a machine learning and context-aware IDS,
which was considered to be effective based on the detection rate
(DR) of anomaly signs and the possibility of process achievement
compared to previous systems.
Radoglou-Grammatikis and Sarigiannidis [105] presented a
new IDS for an AMI that utilizes machine learning capabilities
based on a decision tree to distinguish between normal and ma-
licious activities. Chekired, Khoukhi, and Mouftah [59] proposed
a hierarchical and distributed IDS based on a distributed fog
architecture using three hierarchical network levels (i.e., HAN,
residential area network, and fog operation center network). Jokar
and Leung [108] developed a novel intrusion detection and pre-
vention system for Zigbee-based HANs in an SG. It employs a
model-based IDS as well as a machine learning-based intrusion
prevention system (IPS) to protect the network against a wide
range of attack types.
Firmware manipulation can be prevented by intrusion de-
tection techniques. Jakaria, Rahman, and Hasan [69] proposed
a novel way to detect fraudulent data from SMs based on the
energy consumption patterns of consumers by utilizing deep
learning. They devised a method for detecting suspicious relay
nodes in an AMI that could manipulate the data before forwarding
it to an aggregator.
368
Future Generation Computer Systems 136 (2022) 358–377
Assumptions Performance Performance impact
metrics
Communications Computational Decreased the overhead of
between the utility overhead of the registrations.
company and SMs SM.
over a local area
network (LAN).
Performance was
compared with an
approach based on a
PUF.
Proposed system Communication N/A
protects customers’ and
private information computation
while allowing time.
real-time
measurement of
electricity usage.
Proposed AMI system
based on Zigbee
network. Surveyed
five SMs.
Table 8 compares relevant studies on IDSs that are suitable
for deployment in an AMI. The table lists the IDS techniques such
as layered specification-based IDS and IDS based on a distributed
fog architecture, the objective, the assumptions made, the per-
formance metrics, and the performance impact. Some types of
attacks that can be prevented by an IDS are also mentioned.
6. Lessons learned and discussion
The former sections of this survey evidence that an AMI is
a critical component of the smart grid system. Therefore, an
AMI system requires a high level of security against all possible
attacks. Security standards published by the National Institute of
Standards and Technology (NIST) must be taken into considera-
tion in the design and implementation of an AMI system to meet
the requirements of the CIA triad. These security standards are
essential for ensuring the robustness of an AMI system.
Despite the importance of an AMI system in improving oper-
ational efficiency and customer service and in conserving energy,
the deployment of SGs and new communication technologies has
led to new security challenges. With the increasing number of IoT
devices, such as SMs and DCs, the security risks to an AMI system
are proportionally increasing. AMI systems provide the UC with
a huge amount of data and information, and it is imperative that
the UC can protect these data from different types of attacks.
An AMI system consists of three main layers, namely, the
hardware, communication, and data layers. Each layer has its own
features and characteristics, and they are vulnerable to various
types of attack. For the hardware layer, as the number of SMs
increases, the number of attacks against them also increases, such
as injecting malicious code to steal data or modify the firmware
in the SM, which can lead to a localized DoS. The communica-
tion links that interconnect the AMI components together which
is the main component of the AMI communication layer have
vulnerabilities that can be exploited to perform attacks such as
traffic interspersion attacks, MITM attacks, and session hijacking
attacks. For the data layer, The data transferred through an AMI
network are vulnerable to unauthorized tampering, unauthorized
destruction, or theft.
Encryption countermeasure technique can be applied to the
AMI data layer to protect the data that are being transferred.
Traditional encryption techniques depend on decrypting the en-
crypted data before performing any computational process. [77].
Decrypting the data makes them vulnerable to internal and ex-
ternal attacks. Homomorphic encryption can help to preserve
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

Table 7
Comparison of published studies on authentication techniques for securing an AMI.
Ref, year Target Authentication Objective Assumptions Performance metrics Performance AMI
attack technique impact parameters
[78], 2020 N/A Four phases to To manage keys, Simulation calculated Communication Latency increased SM/UC
establish a session especially key the overhead using efficiency, delivery as the number of connection
key: Initialization, distribution. hashing with a ratio, latency, and nodes increased.
registration, 1024-byte RSA key. overhead ratio.
mutual
authentication,
and key exchange.
[55], 2019 Imperson- CS To compress and N/A Residual error of a N/A SM and DC.
ation. authenticate power received signal and
reading signals in authentication error
multicarrier systems probability.
based on CS.
[58], 2018 Modifying Blockchain and To present a use case N/A N/A N/A Data
data. smart contracts. where both blockchain
and smart contracts are
employed based on
cryptography to enable
user empowerment of
data management.
[95], 2016 N/A ROPUFs with a To secure the data being Implemented on Latency and data Storage cost of SM/UC
Hamming code. transferred from an SM Spartan 3E. storage. authentication is connection
to the UC. low.
[96], 2016 N/A PKI and channel To enable two-way Two meters collect Detection probability. N/A SM/UC
signatures. communications data and send them connection
between the SM and the to the HAN
UC. concentrator.
Machine-to-machine
authentication in the
SG occurs via a
two-layer approach,
with global and local
layers.
[97], 2016 Wireless Configurable To provide end-to-end Xilinx Spartan 3E Storage requirement N/A SM/UC
sensor ROPUFs. security for the FPGA boards. and authentication connection
network confidentiality and time.
attacks. integrity of messages
exchanged between the
UC and SMs.
[98], 2016 Insider and Attribute-based To authenticate and IEC 61850 Communication and N/A N/A
outsider access control. authorize users to client/server IED computation
attacks. mitigate outsider and simulation on a PC overheads.
insider threats in the SG with the SG ware
whenever a user Java IEC61850
accesses the devices. client/server SDK.
[99], 2016 N/A Key management To ensure confidentiality, Unicast connection Computational load N/A N/A
scheme. integrity, and between SM and UC on SM represented by
authenticity. established using TCP execution time.
over Ethernet.
Multicast and
broadcast connection
is established using
UDP.
[100], 2015 N/A N/A To boost the utilization Fault diagnoses of Communication and N/A SM and DC
of efficient authentication computation costs,
authentication schemes. failures. and payload for
authentication.
[80], 2013 N/A Identity-based To mutually authenticate Uses the security Overhead cost. N/A HAN/UC
cryptography. an SM in a HAN with an analyzer automated connection
authentication server in validation of internet
the SG. security protocols and
applications.
(continued on next page)

the privacy of data in an AMI system since computational pro-
cesses can be applied to the encrypted data without the need
for decrypting them, thus making the data more secure [114].
This encryption technique is suitable for the AMI data layer. It
enhances the security of the data, both in storage and during
transit.
369
Authentication techniques such as PKI can be applied to the
AMI hardware layer to verify the source of the data being sent
for preventing unauthorized access to an AMI system, either
internally or externally. Determining the appropriate authenti-
cation technique for an AMI is challenging because of the lack
of resources in an SM, the vulnerabilities in the communication
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Table 7 (continued).
Ref, year Target Authentication Objective
attack technique
[79], 2012 N/A PUF technology. To provide strong
hardware-based
authentication of SMs
and efficient key
management to ensure
the confidentiality and
integrity of messages
exchanged between SMs
and the utility.
[81], 2011 N/A Lightweight key To guarantee the
distribution and trustworthiness of the
management AMI.
scheme tailored to
AMI.
channels, the multiple sources of data in the system, and the huge
amount of data traversing the AMI system. The data layer must
be fully secured from any form of modification [100].
An IDS can be used as a second line of defense for an AMI
communication layer to detect external intruders, as it can de-
tect malicious behavior. Nowadays, an IPS is integrated with an
IDS to prevent an attack after detecting it [111]. Using an IPS
based on artificial intelligence (AI) is essential as it ensures the
cybersecurity requirements of confidentiality, integrity, and avail-
ability (CIA) [104]. An IPS consists of three main modules named
the agent module, analysis engine, and the response module.
There are three main types of analysis engine: signature-based,
anomaly-based, and specification-based [115]. A signature-based
IPS compares potential malicious behavior in an AMI system with
a predetermined set of signatures for different attacks [115]. An
anomaly-based intrusion detection and prevention system can
identify abnormal behavior in an AMI system using machine
learning or a neural network. Specification-based intrusion detec-
tion and prevention systems utilize predetermined policies that
prescribe the normal behavior of the AMI system.
Despite all the previously mentioned possible security coun-
termeasures and the mitigation approaches described in the lit-
erature, there are open challenges that are existing for each layer
of the AMI system that need considerable research attention.
6.1. Open challenges
6.1.1. Open challenges in securing the AMI hardware layer
For node-to-node communications, authentication and autho-
rization are the two main techniques for protecting the hardware
layer of an AMI. There are several challenges with both older and
contemporary authentication protocols with respect to efficiency,
cost, delay, and privacy. Published works mainly focus on hard-
ware authentication, and less attention has been given to user
authentication. Therefore, user authentication and authorization
protocols, either in the HAN for end users or in the UC for admins,
are considered open challenges in securing the hardware layer of
an AMI system from unauthorized access attacks, like spoofing
attacks. Authentication protocols can prevent the leakage of con-
fidential data and protect the privacy of the information of the
relevant entity, whether a home or a corporate customer. Access-
based techniques must be applied to authenticate and authorize
the source of the data.
As the SMs in an AMI system are IoT devices, any vulnerability
can result in severe threats to the AMI system, since most IoT
devices have security issues. IoT devices on the internet have very
few security mechanisms to protect them against various emerg-
ing threats. These devices can, thus, be infected by malicious
code or malware due to the absence of proper authentication
mechanisms, a lack of default credentials, the absence of a lockout
Future Generation Computer Systems 136 (2022) 358–377
Assumptions Performance metrics Performance AMI
impact parameters
Uses Xilink’s N/A N/A N/A
Spartan-6 FPGA
board, which is
connected to a PC
through a serial port.
N/A Computational and N/A HAN
storage overhead.
system, and inadequate physical security. Attackers often exploit
poorly protected devices connected to the internet to cause phys-
ical damage to a network, to wiretap into communications, or to
launch disruptive attacks, such as DDoS. Common vulnerabilities
of IoT devices relate to device memory, device physical interface,
device web interface, device firmware, device network services,
third-party back-end APIs, and local data storage.
6.1.2. Open challenges in securing the AMI data and communication
layers
The AMI data layer is the backbone of an AMI system. Main-
taining the privacy of data is important as it can contain sensi-
tive information. Encryption techniques have several challenges,
including the overhead of managing the encryption keys, the
difficulty in decrypting the data, the key exchange system, and
the integration with cloud-based systems. Integrity checks are ap-
plied after data are received to ensure that the data have not been
modified during transmission, but these too suffer from security
challenges. An open challenge for integrity check mechanisms is
the heterogeneity of data sources, especially in an AMI system
with a large number of data sources.
The AMI communication layer plays a vital role in the per-
formance of an AMI system, as it is responsible for transferring
data from the customer domain to the utility domain and vice
versa. There are several open challenges related to the type of
the transmission media, required bandwidth, latency, the used
topology, and the quality of service when designing an appro-
priate communication channel. These challenges are due to the
huge amount of data being handled and transferred through the
communication channel [116].
The required bandwidth is a very important metric in de-
signing and choosing the appropriate transmission media (optical
fiber, radio waves, etc.) and the appropriate communication tech-
nology, which can be either wired or wireless. The IEEE P2030
standard does not define the bandwidth requirements [117].
Achieving low latency is another important open challenge for
the communication layer due to the huge amount of data [118].
One of the most important parameters in designing the AMI
communication layer is determining the appropriate topology
that connects either SMs to DC or DCs to the MDM system located
on the UC. There are various network topologies that can be
used either star or mesh topology. Each network topology has its
own features and capabilities thus determining the appropriate
topology can be considered a new open challenge for the AMI
communication layer.
6.2. Future vision
Several researchers have adopted new technologies for an AMI
to enhance performance, such as by accelerating the information-
gathering process. Moreover, some recent techniques can en-
hance the analysis of the huge amount of data collected from
370
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

Table 8
Comparison of published studies on IDSs used for securing an AMI.
Ref, year Target attack Technique used Objective Assumptions Performance metrics Performance AMI
impact parameter
[101], 2021 N/A GRNN intrusion To protect the AMI Uses dataset N/A N/A Data
detection algorithm. from outside attacks NSL-KDD to verify
and analyze the
algorithm.
[102], 2021 N/A Cross-layer feature To protect the AMI Experiments based Accuracy, P, F, DR, Accuracy, DR, and Data
fusion of a CNN and from outside attacks. on the KDD Cup and false positive rate FPR of the
LSTM networks. 1999 and (FPR). proposed intrusion
NSL-KDD datasets. detection model
were improved.
[103], 2020 N/A Machine learning and To protect the AMI N/A DR and possibility of N/A Data
context-aware. from outside attacks. process achievement.
[104], 2020 N/A SVM and temporal To present a Test platform Space and time. N/A SM
failure propagation two-stage based on NS-3 to
graph. cyber-intrusion simulate an AMI
protection system. network
environment and
on single-board
computers to
emulate IEEE
802.15.4
communications
between a grid
router and an SM.
[59], 2019 False Distributed fog To protect the AMI Performance Intrusion DRs and N/A N/A
measurement architecture. from cyberattack. metrics compared communication
injection attack. with centralized overhead.
architectures.
[69], 2019 Firmware Energy consumption To detect fraudulent N/A N/A N/A Data
manipulation. patterns. data from SMs.
[105], 2018 N/A Machine learning To protect the AMI N/A Accuracy and positive Accuracy and true Data
capabilities based on from cyberattack. rate. positive rate of
a decision tree. the IDS reached
0.996 and 0.993.
[106], 2018 N/A OS-ELM To detect attacks Comparative Five indicators: N/A Data
against the AMI. analysis with Accuracy, FPR, false
other algorithms negative rate (FNR),
including training time, and
back-propagation test time.
neural network,
radial basis
function network,
extreme learning
machine, and
OS-ELM.
[107], 2017 N/A Multi-SVM classifier. To detect attacks Training and Attack DR. N/A NAN
against the NAN of testing the
an SG. classifier with the
ADFA-LD dataset.
[108], 2016 N/A Q-learning To protect the Zigbee-based N/A N/A HAN
network against a HANs in SG SEP
wide range of attack 2.0 specification as
types. well as IEEE
802.15.4 standard
to precisely
characterize the
expected normal
behavior.
[109], 2015 N/A Data stream mining To present a N/A DR, FPR, and FNR. N/A Data
in a multi-layer real-time distributed
implementation. IDS for an AMI
infrastructure.
[110], 2014 N/A SVM and PCA. To recognize and Data KDD99 and DR and the rate of Correct DR and Data
identify intrusion and numerical attack error detection. the rate of attack
attacks in an SG. simulations. error detection
work best with
PCA.
(continued on next page)

371
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al. Future Generation Computer Systems 136 (2022) 358–377

Table 8 (continued).
Ref, year Target attack Technique used Objective Assumptions Performance metrics Performance AMI
impact parameter
[111], 2014 N/A Data stream mining. To enhance the Consists of Accuracy (%), kappa N/A Data
security of an AMI individual IDSs for statistic (%), model
through IDS, a second three different size (kB), running
line of defense after levels of AMI time (seconds), model
the primary security components. KDD cost (RAM hours),
methods of Cup 1999 dataset FPR (%), and FNR (%).
encryption, is used.
authentication, and
authorization.
[112], 2012 N/A Public data stream To present an IDS IDS architecture Accuracy, kappa N/A Data
mining. architecture for an consists of three statistic, FPR, FNR,
AMI to complement local IDSs in SMs, time, and memory
other security DCs, and the consumption.
measures. central system.
KDD Cup 1999
dataset used for
analysis.
[113], 2011 N/A Layered To detect intrusion. Uses Zigbee, Detection capabilities. N/A HAN
specification-based specifically the
IDS. physical and
medium access
control layers.

SM devices, such as AI, big data analytics, blockchains, and cloud
computing, which could solve some of the open challenges al-
ready mentioned for each layer of an AMI system.
6.2.1. Artificial intelligence
One advance in smart metering is the integration with AI.
In an AI metering (AIM) system, the smart appliances and the
electricity consumption of the customer are fully controlled by
the system [119]. An AIM has additional features compared to
an AMI, such as a schedule of usage for various smart devices,
renewable energy source integration, and power quality moni-
toring [120]. An important feature provided by AIM is detecting
the location of each appliance deployed in the HAN using a smart
multi-power tap, which is an SM with an advanced multi-outlet
power strip. It provides important contextual information such as
the identity and location of electric home appliances, temporal
power consumption, and can control the power supply to those
appliances [121].
There are three main types of AI: decision tree-based, rule-
based, and data mining. Decision tree-based AI is used for fore-
casting and classification tasks, making it suitable for AMI sys-
tems. Rule-based techniques apply a set of rules and are useful
for auditing data. Data mining can uncover patterns, associations,
changes, anomalies, and statistically significant structures and
events in data [122]. Thus, AI can also be applied as a mitigation
technique for securing an AMI system. Using machine learning
and deep learning, over time, an AI system can learn the behavior
of each device in the AMI system. Thus, AI can help an AMI system
to recognize and detect malicious behavior faster than traditional
techniques. AI can detect threats masked as normal activity due
to its automated ability to skim through massive chunks of data
and traffic [123].
Because AI can perform a high-speed scan of an entire AMI
system, it can discover both known and new vulnerabilities,
which could be exploited in the future. AI is the core of many IDSs
used for detecting vulnerabilities and threats. IDSs are considered
the first line of defense for any system. However, customers
can access web servers to enter data or pay a bill, so an ex-
tra layer of security is needed to safeguard the privacy of this
sensitive information. AI can provide strong customer authenti-
cation using biometrics such as facial recognition or fingerprint
scanners [124].
372
As mentioned in the previous section, the performance of en-
cryption algorithms and key exchange systems affects the perfor-
mance of the AMI data layer. Encryption is necessary for ensuring
the security of the data traversing the AMI system and protecting
the data from unauthorized access. The use of AI in encryption
is called neural cryptography, which relies on artificial neural
networks [125].
There are some challenges for traditional signature-based,
anomaly-based, and specification-based approaches to IDS. Inte-
grating AI into an IDS could solve these issues. For example, AI can
increase the flexibility of IDS compared to using a threshold. It can
increase the adaptability and introduce additional pattern recog-
nition features. IDS enhanced with AI is faster than a conventional
IDS and also has the ability to learn [126].
6.2.2. Cloud computing
Cloud computing allows users to share pools of preconfigured
network resources, like servers, storage, and applications. These
resources can be accessed at anytime and from anywhere through
the internet [127]. As the number of SMs and the amount of
data increase, an AMI system could use a UC in the cloud instead
of a physical UC [128]. Of course, the security perimeter has
to be assessed before deploying a cloud-computing model. An
important feature of cloud computing is the default isolation of
the components in the system by clustering them into security
groups. This prevents unauthorized access or the insertion of
malicious code by attackers into an end device, as communication
between entities can be blocked by default [129].
A major weakness of an AMI system is the dependency on
the TCP/IP stack protocol, as it is vulnerable and susceptible
to different attacks due to the use of IP in the communication
channel between two entities [130]. A cloud-computing system
can solve this issue, as the identification of and communications
between entities in a cloud environment depend on asset ID
values, which harden the AMI system and prevent attackers from
performing a vulnerability scan [131].
As mentioned previously, the AMI hardware layer has an open
challenge relating to the authentication protocols needed to en-
sure the privacy and confidentiality of the data. IoT devices,
such as SMs and DCs, can be connected to the cloud, which
provides a methodology for authentication through an IP/MPLS
(internet protocol/multiprotocol label switching) core to alleviate
this issue [132].
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
6.2.3. Big data analytics
The integration of ICT into traditional power grids introduces
an additional information or data layer to conventional electric-
ity transmission and distribution networks. This data layer is
responsible for collecting, storing, and analyzing data from the
increasing number of installed SMs and other IoT devices through
a SG [133]. An effective and efficient analysis of the data collected
through an AMI system can add significant value for a utility com-
pany, such as load forecasting and load analysis. As the number
of end devices increases, the volume of data collected increases
significantly, so that it becomes big data, which makes the data
analysis more complicated and requires more accuracy [134].
Analyzing logs, network packets, and system events for foren-
sic purposes and intrusion detection has traditionally been a
significant problem, since traditional methods do not have ade-
quate tools for supporting long-term, large-scale analytics [135].
Big data analytics techniques enable the storage and analysis
of large heterogeneous datasets at an unprecedented scale and
speed. They can perform deeper analytics on the data, provide
a consolidated view of security-related information, and achieve
real-time analysis of streaming data. Note that configuring big
data analysis tools properly still requires the system architects
and analysts to have a deep knowledge of their system [136].
Big data are produced rapidly. Thus, traditional software for
storing, processing, and managing data are generally not ap-
propriate [137]. The huge amount of data must be stored and
processed by a large compute cluster. Integrating big data with
a cloud-computing environment overcomes this issue, as the
cloud can store a huge amount of data, avoiding the need for
a dedicated space and expensive computational resources [138].
Applying big data analytics to the AMI data layer has the follow-
ing benefits: better management of the collected data, prevention
of potential failures of AMI components through predictive analy-
sis, increased customer satisfaction, and higher overall efficiency
of the AMI system [139].
One of the open challenges related to the AMI data layer is
the existence of multiple data sources. Thus, a huge amount of
heterogeneous data needs to be collected and analyzed in real
time [140]. Integrating big data analytics into an AMI system
could enhance the performance of the system. Moreover, big
data can speed up decision-making processes, as follows. Big
data techniques can be divided into big data management and
big data analytics. Big data management is responsible for the
storage and integration of big data so that the data are ready
to be analyzed. Big data analytics is the analysis of the collected
data and provides information in a form useful for decision-
making [141]. Big data analytics techniques have the potential to
provide a significant advance in actionable security intelligence
by reducing the time for correlating, consolidating, and contex-
tualizing diverse security event information. It can also be used
to correlate long-term historical data for forensic purposes [142].
6.2.4. Blockchains
Blockchains are a form of distributed ledger. A blockchain
can generate trust in an untrusting environment and thus, is a
powerful new cybersecurity tool. The decentralized ledger con-
tains transactions from multiple devices. The data are encrypted
and stored by members of the blockchain to ensure data in-
tegrity [143].
Due to the distributed nature of a blockchain, it can be used
to secure the overall AMI system and its related devices by
decentralizing the administration. This approach eliminates the
dependency of each device on a central admin or authority. It
makes the end devices, such as SMs, more secure because they
can detect and take action against suspicious commands from an
unknown network [144]. With blockchain technology, since the
373
Future Generation Computer Systems 136 (2022) 358–377
data storage is decentralized, it is more difficult for an attacker
to penetrate the system and consolidate the sensitive data [145].
Unauthorized access is one of the most common attacks,
which could be prevented by integrating blockchain technology
into an AMI system due to the comprehensive encryption of a
blockchain. The data can then be securely transmitted without
attackers accessing or tampering with the data. Thus, a blockchain
could increase the confidentiality and integrity of sensitive data
transmitted and processed through an AMI [146].
As previously noted, integrity checks are used by an AMI data
layer to ensure that the data are transferred from the source to
the destination without any modification. Traditional integrity
check algorithms generally use encryption techniques that rely
on trusted third-party auditors [147]. Recently, a blockchain has
been used to implement a data integrity verifier for a large IoT
system. Since an AMI is such a system, the permissionless data
utilization features of a blockchain could be used to prevent
unauthorized access to the data [148].
The use of inadequate authentication and authorization
protocols is an open challenge for the AMI hardware layer. Au-
thentication and authorization are vital for safeguarding the main
components of an AMI system from unauthorized access. Block-
chain technology has recently been used for access control. A
blockchain consists of records (blocks) recorded in a decentral-
ized digital ledger, which stores transactions, in contrast to the
tables in a relational database [149].
7. Conclusion
The AMI plays a vital role in an SG, which aims to opti-
mize the use of the latest ICT tools. Connecting SGs and AMIs
to the cyberworld opens up new security challenges that must
be addressed. A successful attack against an SG may lead to
either localized or widespread denial of the electricity service,
which can lead to blackouts. Thus, this article provides a com-
prehensive survey of AMI security, encompassing vulnerabilities,
attacks, and countermeasures. To give a full picture of AMI se-
curity, the current challenges and future research directions are
also presented. The relevance and uniqueness of this survey are
its comprehensive coverage of AMI systems, including security
vulnerabilities, attacks, and countermeasures. Furthermore, the
impact of different attack types on AMI components and on the
entire SG has been presented as well. There should be more re-
search on emerging technologies such as AI, cloud computing, big
data analytics, and blockchains, which could be used to develop
innovative mechanisms for improving AMI security. Although
multiple countermeasure techniques can be applied to an AMI to
enhance its security, a risk assessment must first be undertaken
to determine the existing vulnerabilities and the threats and
whether the current countermeasures are adequate or whether
additional mitigation techniques must be applied. Also, it must
be determined for a known risk to an AMI whether it will be
mitigated, accepted, or transformed.
CRediT authorship contribution statement
Mostafa Shokry: Data curation, Formal analysis, Methodol-
ogy, Investigation, Resources, Validation, Visualization, Writing
– original draft, Writing – review & editing. Ali Ismail Awad:
Conceptualization, Formal analysis, Methodology, Investigation,
Project administration, Resources, Supervision, Validation, Visu-
alization, Writing – review & editing. Mahmoud Khaled Abd-
Ellah: Conceptualization, Methodology, Project administration,
Resources, Supervision, Writing – review & editing. Ashraf A.M.
Khalaf: Conceptualization, Methodology, Project administration,
Resources, Supervision; Writing – review & editing.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
Declaration of competing interest
The authors declare the following financial interests/personal
relationships which may be considered as potential competing
interests: Co-author, Ali Ismail Awad is an Associate Editor for
Future Generation Computer Systems.
References
[1] M.A. Faisal, Z. Aung, J.R. Williams, A. Sanchez, Data-stream-based intru-
sion detection system for advanced metering infrastructure in smart grid:
A feasibility study, IEEE Syst. J. 9 (1) (2015) 31–44, http://dx.doi.org/10.
1109/JSYST.2013.2294120.
[2] M. Nabeel, X. Ding, S.-H. Seo, E. Bertino, Scalable end-to-end security for
advanced metering infrastructures, Inf. Syst. 53 (2015) 213–223, http:
//dx.doi.org/10.1016/j.is.2015.01.004.
[3] S.N. Lighari, B.B. Jensen, D.M.A. Hussain, A.A. Shaikh, Attacks and their
defenses for advanced metering infrastructure, in: 2014 6th International
Congress on Ultra Modern Telecommunications and Control Systems and
Workshops, ICUMT, 2014, pp. 148–151, http://dx.doi.org/10.1109/ICUMT.
2014.7002094.
[4] P. Jokar, N. Arianpoo, V.C. Leung, Electricity theft detection in AMI using
customers’ consumption patterns, IEEE Trans. Smart Grid 7 (1) (2015)
216–226, http://dx.doi.org/10.1109/TSG.2015.2425222.
[5] K.I. Sgouras, A.D. Birda, D.P. Labridis, Cyber attack impact on critical smart
grid infrastructures, in: ISGT 2014, 2014, pp. 1–5, http://dx.doi.org/10.
1109/ISGT.2014.6816504.
[6] F. Ye, Y. Qian, R.Q. Hu, A security protocol for advanced metering infras-
tructure in smart grid, in: 2014 IEEE Global Communications Conference,
2014, pp. 649–654, http://dx.doi.org/10.1109/GLOCOM.2014.7036881.
[7] X. Liu, P. Zhu, Y. Zhang, K. Chen, A collaborative intrusion detection
mechanism against false data injection attack in advanced metering
infrastructure, IEEE Trans. Smart Grid 6 (5) (2015) 2435–2443, http:
//dx.doi.org/10.1109/TSG.2015.2418280.
[8] D.U. Case, Analysis of the cyber attack on the ukrainian power grid,
vol. 388, Tech. rep., Electricity Information Sharing and Analysis Center
(E-ISAC), 2016, URL https://africautc.org/wp-content/uploads/2018/05/E-
ISAC_SANS_Ukraine_DUC_5.pdf.
[9] A. Ghosal, M. Conti, Key management systems for smart grid advanced
metering infrastructure: A survey, IEEE Commun. Surv. Tutor. 21 (3)
(2019) 2831–2848, http://dx.doi.org/10.1109/COMST.2019.2907650.
[10] P. Kumar, Y. Lin, G. Bai, A. Paverd, J.S. Dong, A. Martin, Smart grid
metering networks: A survey on security, privacy and open research
issues, IEEE Commun. Surv. Tutor. 21 (3) (2019) 2886–2927, http://dx.
doi.org/10.1109/COMST.2019.2899354.
[11] K. Pedramnia, M. Rahmani, Survey of DoS attacks on LTE infrastruc-
ture used in AMI system and countermeasures, in: 2018 Smart Grid
Conference, SGC, IEEE, 2018, pp. 1–6, http://dx.doi.org/10.1109/SGC.2018.
8777832.
[12] S. Tan, D. De, W.-Z. Song, J. Yang, S.K. Das, Survey of security advances
in smart grid: A data driven approach, IEEE Commun. Surv. Tutor. 19 (1)
(2016) 397–422, http://dx.doi.org/10.1109/COMST.2016.2616442.
[13] S. Pealy, M.A. Matin, A survey on threats and countermeasures in
smart meter, in: 2020 IEEE International Conference on Communication,
Networks and Satellite, ComNetSat, 2020, pp. 417–422, http://dx.doi.org/
10.1109/Comnetsat50391.2020.9328943.
[14] S. Desai, R. Alhadad, N. Chilamkurti, A. Mahmood, A survey of privacy
preserving schemes in IoE enabled smart grid advanced metering infras-
tructure, Cluster Comput. 22 (1) (2019) 43–69, http://dx.doi.org/10.1007/
s10586-018-2820-9.
[15] Z. El Mrabet, N. Kaabouch, H. El Ghazi, H. El Ghazi, Cyber-security in smart
grid: Survey and challenges, Comput. Electr. Eng. 67 (2018) 469–482,
http://dx.doi.org/10.1016/j.compeleceng.2018.01.015.
[16] A. Hansen, J. Staggs, S. Shenoi, Security analysis of an advanced metering
infrastructure, Int. J. Crit. Infrastruct. Prot. 18 (2017) 3–19, http://dx.doi.
org/10.1016/j.ijcip.2017.03.004.
[17] W. Tong, L. Lu, Z. Li, J. Lin, X. Jin, A survey on intrusion detection system
for advanced metering infrastructure, in: 2016 Sixth International Confer-
ence on Instrumentation & Measurement, Computer, Communication and
Control, IMCCC, IEEE, 2016, pp. 33–37, http://dx.doi.org/10.1109/IMCCC.
2016.193.
[18] P. Jokar, N. Arianpoo, V.C. Leung, A survey on security issues in smart
grids, Secur. Commun. Netw. 9 (3) (2016) 262–273, http://dx.doi.org/10.
1002/sec.559.
[19] N. Saxena, B.J. Choi, State of the art authentication, access control, and
secure integration in smart grid, Energies 8 (10) (2015) 11883–11915,
http://dx.doi.org/10.3390/en81011883.
374
Future Generation Computer Systems 136 (2022) 358–377
[20] A. Anzalchi, A. Sarwat, A survey on security assessment of metering
infrastructure in smart grid systems, in: SoutheastCon 2015, IEEE, 2015,
pp. 1–4, http://dx.doi.org/10.1109/SECON.2015.7132989.
[21] J.C. Foreman, D. Gurugubelli, Identifying the cyber attack surface of the
advanced metering infrastructure, Electr. J. 28 (1) (2015) 94–103, http:
//dx.doi.org/10.1016/j.tej.2014.12.007.
[22] N. Komninos, E. Philippou, A. Pitsillides, Survey in smart grid and smart
home security: Issues, challenges and countermeasures, IEEE Commun.
Surv. Tutor. 16 (4) (2014) 1933–1954, http://dx.doi.org/10.1109/COMST.
2014.2320093.
[23] R. Rashed Mohassel, A. Fung, F. Mohammadi, K. Raahemifar, A survey
on advanced metering infrastructure, Int. J. Electr. Power Energy Syst. 63
(2014) 473–484, http://dx.doi.org/10.1016/j.ijepes.2014.06.025.
[24] E. Ancillotti, R. Bruno, M. Conti, The role of communication systems in
smart grids: Architectures, technical solutions and research challenges,
Comput. Commun. 36 (17–18) (2013) 1665–1697, http://dx.doi.org/10.
1016/j.comcom.2013.09.004.
[25] H. Mohammed, S. Tonyali, K. Rabieh, M. Mahmoud, K. Akkaya, Efficient
privacy-preserving data collection scheme for smart grid AMI networks,
in: 2016 IEEE Global Communications Conference, GLOBECOM, IEEE, 2016,
pp. 1–6, http://dx.doi.org/10.1109/GLOCOM.2016.7841782.
[26] M. Cebe, K. Akkaya, Efficient public-key revocation management for
secure smart meter communications using one-way cryptographic accu-
mulators, in: 2018 IEEE International Conference on Communications, ICC,
IEEE, 2018, pp. 1–6, http://dx.doi.org/10.1109/ICC.2018.8423023.
[27] A. Ghasempour, Optimized advanced metering infrastructure architecture
of smart grid based on total cost, energy, and delay, in: 2016 IEEE
Power Energy Society Innovative Smart Grid Technologies Conference,
ISGT, 2016, pp. 1–6, http://dx.doi.org/10.1109/ISGT.2016.7781250.
[28] V. Gulisano, M. Almgren, M. Papatriantafilou, Metis: a two-tier intrusion
detection system for advanced metering infrastructures, in: Interna-
tional Conference on Security and Privacy in Communication Networks,
Springer, 2014, pp. 51–68, http://dx.doi.org/10.1145/2602044.2602072.
[29] N. Saxena, B.J. Choi, R. Lu, Authentication and authorization scheme for
various user roles and devices in smart grid, IEEE Trans. Inf. Foren-
sics Secur. 11 (5) (2015) 907–921, http://dx.doi.org/10.1109/TIFS.2015.
2512525.
[30] A. Ghasempour, Optimizing the Advanced Metering Infrastructure Archi-
tecture in Smart Grid, Utah State University, 2016, http://dx.doi.org/10.
26076/7573-ab56.
[31] A.M. Khattak, S.I. Khanji, W.A. Khan, Smart meter security: Vulnerabilities,
threat impacts, and countermeasures, in: S. Lee, R. Ismail, H. Choo
(Eds.), Proceedings of the 13th International Conference on Ubiquitous
Information Management and Communication, IMCOM 2019, Springer
International Publishing, Cham, 2019, pp. 554–562, http://dx.doi.org/10.
1007/978-3-030-19063-7_44.
[32] M. Bae, K. Kim, H. Kim, Preserving privacy and efficiency in data
communication and aggregation for AMI network, J. Netw. Comput. Appl.
59 (2016) 333–344, http://dx.doi.org/10.1016/j.jnca.2015.07.005.
[33] S.K. Singh, R. Bose, A. Joshi, Entropy-based electricity theft detection in
AMI network, IET Cyber-Phys. Syst. Theory Appl. 3 (2) (2018) 99–105,
http://dx.doi.org/10.1049/iet-cps.2017.0063.
[34] S. Nimbargi, S. Mhaisne, S. Nangare, M. Sinha, Review on AMI technology
for smart meter, in: 2016 IEEE International Conference on Advances
in Electronics, Communication and Computer Technology, ICAECCT, IEEE,
2016, pp. 21–27, http://dx.doi.org/10.1109/ICAECCT.2016.7942549.
[35] Z. Ismail, J. Leneutre, D. Bateman, L. Chen, A game theoretical analysis of
data confidentiality attacks on smart-grid AMI, IEEE J. Sel. Areas Commun.
32 (7) (2014) 1486–1499, http://dx.doi.org/10.1109/JSAC.2014.2332095.
[36] M.I. Ibrahem, M. Mahmoud, M.M. Fouda, F. Alsolami, W. Alasmary, X.
Shen, Privacy-preserving and efficient data collection scheme for AMI
networks using deep learning, IEEE Internet Things J. (2021) http://dx.
doi.org/10.1109/JIOT.2021.3077897.
[37] G. Lu, X. Tian, An efficient communication intrusion detection scheme
in AMI combining feature dimensionality reduction and improved
LSTM, Secur. Commun. Netw. 2021 (2021) http://dx.doi.org/10.1155/
2021/6631075.
[38] V.B. Krishna, G.A. Weaver, W.H. Sanders, PCA-based method for detecting
integrity attacks on advanced metering infrastructure, in: International
Conference on Quantitative Evaluation of Systems, Springer, 2015, pp.
70–85, http://dx.doi.org/10.1007/978-3-319-22264-6_5.
[39] M. Erol-Kantarci, H.T. Mouftah, Energy-efficient information and com-
munication infrastructures in the smart grid: A survey on interactions
and open issues, IEEE Commun. Surv. Tutor. 17 (1) (2015) 179–197,
http://dx.doi.org/10.1109/COMST.2014.2341600.
[40] Vineeta, J.K. Thathagar, Cognitive radio communication architecture in
smart grid reconfigurability, in: 2012 1St International Conference on
Emerging Technology Trends in Electronics, Communication Networking,
2012, pp. 1–6, http://dx.doi.org/10.1109/ET2ECN.2012.6470081.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
[41] D.B. Avancini, J.J. Rodrigues, S.G. Martins, R.A. Rabêlo, J. Al-Muhtadi, P.
Solic, Energy meters evolution in smart grids: A review, J. Cleaner Prod.
217 (2019) 702–715, http://dx.doi.org/10.1016/j.jclepro.2019.01.229.
[42] V.C. Gungor, D. Sahin, T. Kocak, S. Ergut, C. Buccella, C. Cecati, G.P.
Hancke, A survey on smart grid potential applications and communication
requirements, IEEE Trans. Ind. Inf. 9 (1) (2013) 28–42, http://dx.doi.org/
10.1109/TII.2012.2218253.
[43] R.P. Díaz Redondo, A. Fernández-Vilas, G. Fernández dos Reis, Security
aspects in smart meters: Analysis and prevention, Sensors 20 (14) (2020)
3977, http://dx.doi.org/10.3390/s20143977.
[44] S. Lee, J. Bong, S. Shin, Y. Shin, A security mechanism of smart grid
AMI network through smart device mutual authentication, in: The Inter-
national Conference on Information Networking 2014, ICOIN2014, IEEE,
2014, pp. 592–595, http://dx.doi.org/10.1109/ICOIN.2014.6799750.
[45] Y. Yan, R.Q. Hu, S.K. Das, H. Sharif, Y. Qian, An efficient security protocol
for advanced metering infrastructure in smart grid, IEEE Netw. 27 (4)
(2013) 64–71, http://dx.doi.org/10.1109/MNET.2013.6574667.
[46] M. Delavar, S. Mirzakuchaki, M.H. Ameri, J. Mohajeri, PUF-based solutions
for secure communications in advanced metering infrastructure (AMI),
Int. J. Commun. Syst. 30 (9) (2017) e3195, http://dx.doi.org/10.1002/dac.
3195.
[47] I. Popović, A. Rakić, I.D. Petruševski, Multi-agent real-time advanced
metering infrastructure based on fog computing, Energies 15 (1) (2022)
373, http://dx.doi.org/10.3390/en15010373.
[48] L. Yan, Y. Chang, S. Zhang, A lightweight authentication and key agree-
ment scheme for smart grid, Int. J. Distrib. Sens. Netw. 13 (2) (2017)
1550147717694173, http://dx.doi.org/10.1177/1550147717694173.
[49] A. Ghasempour, J.H. Gunther, Finding the optimal number of aggregators
in machine-to-machine advanced metering infrastructure architecture of
smart grid based on cost, delay, and energy consumption, in: 2016 13Th
IEEE Annual Consumer Communications Networking Conference, CCNC,
2016, pp. 960–963, http://dx.doi.org/10.1109/CCNC.2016.7444917.
[50] A. Gopstein, C. Nguyen, C. O’Fallon, N. Hastings, D. Wollman, NIST
framework and roadmap for smart grid interoperability standards, release
4.0, 2021, http://dx.doi.org/10.6028/NIST.SP.1108r4.
[51] K. Balachandran, R.L. Olsen, J.M. Pedersen, Bandwidth analysis of smart
meter network infrastructure, in: 16Th International Conference on Ad-
vanced Communication Technology, 2014, pp. 928–933, http://dx.doi.org/
10.1109/ICACT.2014.6779095.
[52] M.I. Ibrahem, M.M. Badr, M.M. Fouda, M. Mahmoud, W. Alasmary, Z.M.
Fadlullah, PMBFE: Efficient and privacy-preserving monitoring and billing
using functional encryption for AMI networks, in: 2020 International
Symposium on Networks, Computers and Communications, ISNCC, IEEE,
2020, pp. 1–7, http://dx.doi.org/10.1109/ISNCC49221.2020.9297246.
[53] N. Saxena, B.J. Choi, S. Grijalva, Secure and privacy-preserving concen-
tration of metering data in AMI networks, in: 2017 IEEE International
Conference on Communications, ICC, IEEE, 2017, pp. 1–7, http://dx.doi.
org/10.1109/ICC.2017.7996874.
[54] S.-H. Seo, X. Ding, E. Bertino, Encryption key management for se-
cure communication in smart advanced metering infrastructures, in:
2013 IEEE International Conference on Smart Grid Communications
(SmartGridComm), IEEE, 2013, pp. 498–503, http://dx.doi.org/10.1109/
SmartGridComm.2013.6688007.
[55] Y. Lee, E. Hwang, J. Choi, A unified approach for compression and
authentication of smart meter reading in AMI, IEEE Access 7 (2019)
34383–34394, http://dx.doi.org/10.1109/ACCESS.2019.2903574.
[56] C. Lee, H. Yang, B. Lee, D. Won, A novel privacy-enhanced AMI system
using searchable and homomorphic encryption techniques, in: Interna-
tional Conference on Hybrid Information Technology, Springer, 2012, pp.
608–617, http://dx.doi.org/10.1007/978-3-642-32645-5_76.
[57] I. Parvez, A.I. Sarwat, L. Wei, A. Sundararajan, Securing metering infras-
tructure of smart grid: A machine learning and localization based key
management approach, Energies 9 (9) (2016) 691, http://dx.doi.org/10.
3390/en9090691.
[58] T. Robles, B. Bordel, R. Alcarria, D. Sánchez-de Rivera, Blockchain tech-
nologies for private data management in AMI environments, Multidiscip.
Digit. Publ. Inst. Proc. 2 (19) (2018) 1230, http://dx.doi.org/10.3390/
proceedings2191230.
[59] D.A. Chekired, L. Khoukhi, H.T. Mouftah, Fog-based distributed intrusion
detection system against false metering attacks in smart grid, in: ICC
2019-2019 IEEE International Conference on Communications, ICC, IEEE,
2019, pp. 1–6, http://dx.doi.org/10.1109/ICC.2019.8761752.
[60] J.L. Pesesky, The vulnerabilities of the advanced metering infrastructure
in the Smart Grid (Master’s thesis), Utica College, 2016.
[61] C. Hägerling, F.M. Kurtz, R.L. Olsen, C. Wietfeld, Communication ar-
chitecture for monitoring and control of power distribution grids
over heterogeneous ICT networks, in: 2014 IEEE International Energy
Conference, ENERGYCON, 2014, pp. 838–845, http://dx.doi.org/10.1109/
ENERGYCON.2014.6850523.
375
Future Generation Computer Systems 136 (2022) 358–377
[62] M. Milam, G. Kumar Venayagamoorthy, Smart meter deployment: US
initiatives, in: ISGT 2014, 2014, pp. 1–5, http://dx.doi.org/10.1109/ISGT.
2014.6816507.
[63] I. Petruˇ sevski, M. Živanović, A. Rakić, I. Popović, Novel AMI architecture
for real-time smart metering, in: 2014 22Nd Telecommunications Forum
Telfor (TELFOR), 2014, pp. 664–667, http://dx.doi.org/10.1109/TELFOR.
2014.7034496.
[64] K. Zhang, Z. Hu, Y. Zhan, X. Wang, K. Guo, A smart grid AMI intrusion
detection strategy based on extreme learning machine, Energies 13 (18)
(2020) 4907, http://dx.doi.org/10.3390/en13184907.
[65] A.S. Alfakeeh, S. Khan, A.H. Al-Bayatti, A multi-user, single-authentication
protocol for smart grid architectures, Sensors 20 (6) (2020) 1581, http:
//dx.doi.org/10.3390/s20061581.
[66] W. Wang, Z. Lu, Cyber security in the smart grid: Survey and challenges,
Comput. Netw. 57 (5) (2013) 1344–1371, http://dx.doi.org/10.1016/j.
comnet.2012.12.017.
[67] Y. Yan, Y. Qian, H. Sharif, D. Tipper, A survey on cyber security for smart
grid communications, IEEE Commun. Surv. Tutor. 14 (4) (2012) 998–1010,
http://dx.doi.org/10.1109/SURV.2012.010912.00035.
[68] D.D. Roy, D. Shin, Network intrusion detection in smart grids for imbal-
anced attack types using machine learning models, in: 2019 International
Conference on Information and Communication Technology Convergence,
ICTC, IEEE, 2019, pp. 576–581, http://dx.doi.org/10.1109/ICTC46691.2019.
8939744.
[69] A. Jakaria, M.A. Rahman, M.G.M.M. Hasan, Safety analysis of AMI networks
through smart fraud detection, in: 2019 IEEE Conference on Communica-
tions and Network Security, CNS, IEEE, 2019, pp. 1–7, http://dx.doi.org/
10.1109/CNS.2019.8802845.
[70] S. Tonyali, K. Akkaya, N. Saputro, X. Cheng, An attribute & network
coding-based secure multicast protocol for firmware updates in smart
grid AMI networks, in: 2017 26Th International Conference on Computer
Communication and Networks, ICCCN, IEEE, 2017, pp. 1–9, http://dx.doi.
org/10.1109/ICCCN.2017.8038415.
[71] A. Anwar, A.N. Mahmood, Z. Tari, Identification of vulnerable node
clusters against false data injection attack in an AMI based smart grid,
Inf. Syst. 53 (2015) 201–212, http://dx.doi.org/10.1016/j.is.2014.12.001.
[72] L. Na, X. Xiaohui, M. Xiaoqin, M. Xiangfu, Y. Peisen, Fake data injection
attack detection in AMI system using a hybrid method, in: 2021 IEEE Sus-
tainable Power and Energy Conference, ISPEC, IEEE, 2021, pp. 2371–2376,
http://dx.doi.org/10.1109/iSPEC53008.2021.9735875.
[73] Y. Guo, C.-W. Ten, S. Hu, W.W. Weaver, Modeling distributed denial of
service attack in advanced metering infrastructure, in: 2015 IEEE Power
& Energy Society Innovative Smart Grid Technologies Conference, ISGT,
IEEE, 2015, pp. 1–5, http://dx.doi.org/10.1109/ISGT.2015.7131828.
[74] L. Blakely, M.J. Reno, K. Ashok, AMI data quality and collection method
considerations for improving the accuracy of distribution models, in:
2019 IEEE 46th Photovoltaic Specialists Conference, PVSC, IEEE, 2019, pp.
2045–2052, http://dx.doi.org/10.1109/PVSC40753.2019.8981211.
[75] J. Wang, D. Shi, Y. Li, J. Chen, H. Ding, X. Duan, Distributed framework for
detecting PMU data manipulation attacks with deep autoencoders, IEEE
Trans. Smart Grid 10 (4) (2018) 4401–4410, http://dx.doi.org/10.1109/
TSG.2018.2859339.
[76] A. Alsharif, M. Nabil, M.M.E.A. Mahmoud, M. Abdallah, EPDA: Efficient
and privacy-preserving data collection and access control scheme for
multi-recipient AMI networks, IEEE Access 7 (2019) 27829–27845, http:
//dx.doi.org/10.1109/ACCESS.2019.2900934.
[77] S. Tonyali, N. Saputro, K. Akkaya, Assessing the feasibility of fully
homomorphic encryption for smart grid AMI networks, in: 2015 Seventh
International Conference on Ubiquitous and Future Networks, IEEE, 2015,
pp. 591–596, http://dx.doi.org/10.1109/ICUFN.2015.7182613.
[78] H. Naseer, M.N.M. Bhutta, M.A. Alojail, A key transport protocol for
advance metering infrastructure (AMI) based on public key cryptography,
in: 2020 International Conference on Cyber Warfare and Security, ICCWS,
IEEE, 2020, pp. 1–5, http://dx.doi.org/10.1109/ICCWS48432.2020.9292385.
[79] M. Nabeel, S. Kerr, X. Ding, E. Bertino, Authentication and key man-
agement for advanced metering infrastructures utilizing physically
unclonable functions, in: 2012 IEEE Third International Conference on
Smart Grid Communications, SmartGridComm, IEEE, 2012, pp. 324–329,
http://dx.doi.org/10.1109/SmartGridComm.2012.6486004.
[80] H. Nicanfar, P. Jokar, K. Beznosov, V.C. Leung, Efficient authentication and
key management mechanisms for smart grid communications, IEEE Syst.
J. 8 (2) (2013) 629–640, http://dx.doi.org/10.1109/JSYST.2013.2260942.
[81] J. Kamto, L. Qian, J. Fuller, J. Attia, Light-weight key distribution and man-
agement for advanced metering infrastructure, in: 2011 IEEE GLOBECOM
Workshops, GC Wkshps, IEEE, 2011, pp. 1216–1220, http://dx.doi.org/10.
1109/GLOCOMW.2011.6162375.
[82] M.Q. Ali, E. Al-Shaer, Randomization-based intrusion detection system
for advanced metering infrastructure, ACM Trans. Inf. Syst. Secur. 18 (2)
(2015) 1–30, http://dx.doi.org/10.1145/2814936.
[83] V.Y. Pillitteri, T.L. Brewer, Guidelines for smart grid cybersecurity, Natl.
Inst. Stand. Technol. (2014) http://dx.doi.org/10.6028/NIST.IR.7628r1.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
[84] X. Wang, P. Yi, Security framework for wireless communications in smart
distribution grid, IEEE Trans. Smart Grid 2 (4) (2011) 809–818, http:
//dx.doi.org/10.1109/TSG.2011.2167354.
[85] S.M. Alfassa, S. Nagasundari, P.B. Honnavalli, Invasion analysis of smart
meter in AMI system, in: 2021 IEEE Mysore Sub Section International
Conference, MysuruCon, IEEE, 2021, pp. 831–836, http://dx.doi.org/10.
1109/MysuruCon52639.2021.9641595.
[86] H. Suleiman, I. Alqassem, A. Diabat, E. Arnautovic, D. Svetinovic, Inte-
grated smart grid systems security threat model, Inf. Syst. 53 (2015)
147–160, http://dx.doi.org/10.1016/j.is.2014.12.002.
[87] E. Bou-Harb, C. Fachkha, M. Pourzandi, M. Debbabi, C. Assi, Communica-
tion security for smart grid distribution networks, IEEE Commun. Mag.
51 (1) (2013) 42–49, http://dx.doi.org/10.1109/MCOM.2013.6400437.
[88] S. Kulkarni, R. Rahul, R. Shreyas, S. Nagasundari, P.B. Honnavalli, MITM
intrusion analysis for advanced metering infrastructure communication in
a smart grid environment, in: International Conference on Computational
Intelligence, Security and Internet of Things, Springer, 2020, pp. 256–267,
http://dx.doi.org/10.1007/978-3-030-66763-4_22.
[89] A. Sahu, H.K. Tippanaboyana, L. Hefton, A. Goulart, Detection of rogue
nodes in AMI networks, in: 2017 19Th International Conference on
Intelligent System Application to Power Systems, ISAP, IEEE, 2017, pp.
1–6, http://dx.doi.org/10.1109/ISAP.2017.8071424.
[90] M.H. Haider, S.B. Saleem, J. Rafaqat, N. Sabahat, Threat modeling of
wireless attacks on advanced metering infrastructure, in: 2019 13Th
International Conference on Mathematics, Actuarial Science, Computer
Science and Statistics, MACS, IEEE, 2019, pp. 1–6, http://dx.doi.org/10.
1109/MACS48846.2019.9024779.
[91] E.S. Parizy, H.R. Bahrami, S. Choi, A low complexity and secure demand
response technique for peak load reduction, IEEE Trans. Smart Grid 10
(3) (2018) 3259–3268, http://dx.doi.org/10.1109/TSG.2018.2822729.
[92] W. Jiang, Z. Yang, Z. Zhou, J. Chen, Lightweight data security protection
method for AMI in power internet of things, Math. Probl. Eng. 2020
(2020) http://dx.doi.org/10.1155/2020/8896783.
[93] M.M. Hasan, H.T. Mouftah, Encryption as a service for smart grid advanced
metering infrastructure, in: 2015 IEEE Symposium on Computers and
Communication, ISCC, IEEE, 2015, pp. 216–221, http://dx.doi.org/10.1109/
ISCC.2015.7405519.
[94] I. Parvez, A. Islam, F. Kaleem, A key management-based two-level en-
cryption method for AMI, in: 2014 IEEE PES General Meeting| Conference
& Exposition, IEEE, 2014, pp. 1–5, http://dx.doi.org/10.1109/PESGM.2014.
6939551.
[95] M. Mustapa, M.Y. Niamat, A.P.D. Nath, M. Alam, Hardware-oriented au-
thentication for advanced metering infrastructure, IEEE Trans. Smart Grid
9 (2) (2016) 1261–1270, http://dx.doi.org/10.1109/TSG.2016.2582423.
[96] W.-L. Chin, Y.-H. Lin, H.-H. Chen, A framework of machine-to-machine au-
thentication in smart grid: a two-layer approach, IEEE Commun. Mag. 54
(12) (2016) 102–107, http://dx.doi.org/10.1109/MCOM.2016.1600304CM.
[97] A.P.D. Nath, F. Amsaad, M. Choudhury, M. Niamat, Hardware-based novel
authentication scheme for advanced metering infrastructure, in: 2016
IEEE National Aerospace and Electronics Conference (NAECON) and Ohio
Innovation Summit, OIS, IEEE, 2016, pp. 364–371, http://dx.doi.org/10.
1109/NAECON.2016.7856831.
[98] N. Saxena, B.J. Choi, Integrated distributed authentication protocol for
smart grid communications, IEEE Syst. J. 12 (3) (2016) 2545–2556, http:
//dx.doi.org/10.1109/JSYST.2016.2574699.
[99] N. George, S. Nithin, S.K. Kottayil, Hybrid key management scheme for
secure AMI communications, Procedia Comput. Sci. 93 (2016) 862–869,
http://dx.doi.org/10.1016/j.procs.2016.07.260.
[100] D. Li, Z. Aung, J.R. Williams, A. Sanchez, Efficient and fault-diagnosable
authentication architecture for AMI in smart grid, Secur. Commun. Netw.
8 (4) (2015) 598–616, http://dx.doi.org/10.1002/sec.1006.
[101] C. Huang, Forest management and resource monitoring based on AMI
intrusion detection algorithm and artificial intelligence, J. Ambient Intell.
Humaniz. Comput. (2021) 1–15, http://dx.doi.org/10.1007/s12652-021-
03211-y.
[102] R. Yao, N. Wang, Z. Liu, P. Chen, X. Sheng, Intrusion detection system in
the advanced metering infrastructure: A cross-layer feature-fusion CNN-
LSTM-based approach, Sensors 21 (2) (2021) 626, http://dx.doi.org/10.
3390/s21020626.
[103] S.-T. Park, G. Li, J.-C. Hong, A study on smart factory-based ambient
intelligence context-aware intrusion detection system using machine
learning, J. Ambient Intell. Humaniz. Comput. 11 (4) (2020) 1405–1412,
http://dx.doi.org/10.1007/s12652-018-0998-6.
[104] C.-C. Sun, D.J.S. Cardenas, A. Hahn, C.-C. Liu, Intrusion detection for
cybersecurity of smart meters, IEEE Trans. Smart Grid 12 (1) (2020)
612–622, http://dx.doi.org/10.1109/TSG.2020.3010230.
[105] P.I. Radoglou-Grammatikis, P.G. Sarigiannidis, An anomaly-based intrusion
detection system for the smart grid based on cart decision tree, in: 2018
Global Information Infrastructure and Networking Symposium, GIIS, IEEE,
2018, pp. 1–5, http://dx.doi.org/10.1109/GIIS.2018.8635743.
376
Future Generation Computer Systems 136 (2022) 358–377
[106] Y. Li, R. Qiu, S. Jing, Intrusion detection system using online sequence
extreme learning machine (OS-ELM) in advanced metering infrastructure
of smart grid, PLoS One 13 (2) (2018) e0192216, http://dx.doi.org/10.
1371/journal.pone.0192216.
[107] R. Vijayanand, D. Devaraj, B. Kannapiran, Support vector machine based
intrusion detection system with reduced input features for advanced
metering infrastructure of smart grid, in: 2017 4Th International Con-
ference on Advanced Computing and Communication Systems, ICACCS,
IEEE, 2017, pp. 1–7, http://dx.doi.org/10.1109/ICACCS.2017.8014590.
[108] P. Jokar, V.C. Leung, Intrusion detection and prevention for ZigBee-based
home area networks in smart grids, IEEE Trans. Smart Grid 9 (3) (2016)
1800–1811, http://dx.doi.org/10.1109/TSG.2016.2600585.
[109] F.A.A. Alseiari, Z. Aung, Real-time anomaly-based distributed intrusion
detection systems for advanced metering infrastructure utilizing stream
data mining, in: 2015 International Conference on Smart Grid and Clean
Energy Technologies, ICSGCE, IEEE, 2015, pp. 148–153, http://dx.doi.org/
10.1109/ICSGCE.2015.7454287.
[110] S. Pourfallah, A.H. Jafari, H.S. Shahhoseini, An intrusion detection algo-
rithm for AMI systems based on SVM and PCA, Int. J. Cybern. Inf. (IJCI) 3
(4) (2014) 1, http://dx.doi.org/10.5121/ijci.2014.3401.
[111] M.A. Faisal, Z. Aung, J.R. Williams, A. Sanchez, Data-stream-based intru-
sion detection system for advanced metering infrastructure in smart grid:
A feasibility study, IEEE Syst. J. 9 (1) (2014) 31–44, http://dx.doi.org/10.
1109/JSYST.2013.2294120.
[112] M.A. Faisal, Z. Aung, J.R. Williams, A. Sanchez, Securing advanced metering
infrastructure using intrusion detection system with data stream min-
ing, in: Pacific-Asia Workshop on Intelligence and Security Informatics,
Springer, 2012, pp. 96–111, http://dx.doi.org/10.1007/978-3-642-30428-
6_8.
[113] P. Jokar, H. Nicanfar, V.C. Leung, Specification-based intrusion detection
for home area networks in smart grids, in: 2011 IEEE International
Conference on Smart Grid Communications, SmartGridComm, IEEE, 2011,
pp. 208–213, http://dx.doi.org/10.1109/SmartGridComm.2011.6102320.
[114] X. Yi, R. Paulet, E. Bertino, Homomorphic encryption, in: Homomorphic
Encryption and Applications, Springer, 2014, pp. 27–46, http://dx.doi.org/
10.1007/978-3-319-12229-8.
[115] P.I. Radoglou-Grammatikis, P.G. Sarigiannidis, Securing the smart grid:
A comprehensive compilation of intrusion detection and prevention
systems, IEEE Access 7 (2019) 46595–46620, http://dx.doi.org/10.1109/
ACCESS.2019.2909807.
[116] D.S. Kim, B.J. Chung, Y.M. Chung, Analysis of AMI communication methods
in various field environments, Energies 13 (19) (2020) 5185, http://dx.doi.
org/10.3390/en13195185.
[117] T. Basso, J. Hambrick, D. DeBlasio, Update and review of IEEE P2030
smart grid interoperability and IEEE 1547 interconnection standards, in:
2012 IEEE PES Innovative Smart Grid Technologies, ISGT, 2012, pp. 1–7,
http://dx.doi.org/10.1109/ISGT.2012.6175748.
[118] D. Bian, M. Kuzlu, M. Pipattanasomporn, S. Rahman, Analysis of commu-
nication schemes for advanced metering infrastructure (AMI), in: 2014
IEEE PES General Meeting| Conference & Exposition, IEEE, 2014, pp. 1–5,
http://dx.doi.org/10.1109/PESGM.2014.6939562.
[119] A. Aziz, S. Khalid, M. Mustafa, H. Shareef, G. Aliyu, Artificial intelligent
meter development based on advanced metering infrastructure technol-
ogy, Renew. Sustain. Energy Rev. 27 (2013) 191–197, http://dx.doi.org/
10.1016/j.rser.2013.06.051.
[120] R.E. Ogu, C.I. Ikerionwu, I.I. Ayogu, Leveraging artificial intelligence of
things for anomaly detection in advanced metering infrastructures, in:
2020 IEEE 2nd International Conference on Cyberspac (CYBER NIGE-
RIA), 2021, pp. 16–20, http://dx.doi.org/10.1109/CYBERNIGERIA51635.
2021.9428792.
[121] I. Parvez, F. Abdul, A.I. Sarwat, A location based key management system
for advanced metering infrastructure of smart grid, in: 2016 IEEE Green
Technologies Conference (GreenTech), IEEE, 2016, pp. 62–67, http://dx.
doi.org/10.1109/GreenTech.2016.19.
[122] S. Otoum, B. Kantarci, H. Mouftah, A comparative study of AI-based
intrusion detection techniques in critical infrastructures, ACM Trans.
Internet Technol. (TOIT) 21 (4) (2021) 1–22, http://dx.doi.org/10.1145/
3406093.
[123] M. Zanetti, E. Jamhour, M. Pellenz, M. Penna, V. Zambenedetti, I. Chueiri,
A tunable fraud detection system for advanced metering infrastructure
using short-lived patterns, IEEE Trans. Smart Grid 10 (1) (2019) 830–840,
http://dx.doi.org/10.1109/TSG.2017.2753738.
[124] K. Song, P. Kim, V. Tyagi, S. Rajasekaran, Artificial immune system AIS
based intrusion detection system (IDS) for smart grid advanced metering
infrastructure (AMI) networks, Tech. rep., Virginia Tech, Blacksburg,
Virginia, 2018, URL http://hdl.handle.net/10919/83203.
[125] K. Inoue, M. Cho, Amplitude based keyless optical encryption system
using deep neural network, J. Vis. Commun. Image Represent. 79 (2021)
103251, http://dx.doi.org/10.1016/j.jvcir.2021.103251.
M. Shokry, A.I. Awad, M.K. Abd-Ellah et al.
[126] A. Kim, M. Park, D.H. Lee, AI-IDS: Application of deep learning to real-
time web intrusion detection, IEEE Access 8 (2020) 70245–70261, http:
//dx.doi.org/10.1109/ACCESS.2020.2986882.
[127] M. Pau, E. Patti, L. Barbierato, A. Estebsari, E. Pons, F. Ponci, A. Monti, A
cloud-based smart metering infrastructure for distribution grid services
and automation, Sustain. Energy Grids Netw. 15 (2018) 14–25, http:
//dx.doi.org/10.1016/j.segan.2017.08.001, Technologies and Methodologies
in Modern Distribution Grid Automation.
[128] K. Billewicz, The use of cloud computing in AMI system architecture,
in: 2015 Modern Electric Power Systems, MEPS, 2015, pp. 1–6, http:
//dx.doi.org/10.1109/MEPS.2015.7477213.
[129] C. Esposito, A. Castiglione, F. Pop, K.-K.R. Choo, Challenges of connecting
edge and cloud computing: A security and forensic perspective, IEEE
Cloud Comput. 4 (2) (2017) 13–17, http://dx.doi.org/10.1109/MCC.2017.
30.
[130] R.C. Diovu, J.T. Agee, Data aggregation in smart grid AMI network for
secure transfer of energy user-consumption data, Int. J. Eng. Res. Afr.
35 (2018) 108–124, http://dx.doi.org/10.4028/www.scientific.net/JERA.35.
108.
[131] N. Ahmad, Cloud computing: Technology, security issues and solutions,
in: 2017 2Nd International Conference on Anti-Cyber Crimes, ICACC,
IEEE, 2017, pp. 30–35, http://dx.doi.org/10.1109/Anti-Cybercrime.2017.
7905258.
[132] T.D.P. Bai, S.A. Rabara, Design and development of integrated, secured and
intelligent architecture for internet of things and cloud computing, in:
2015 3Rd International Conference on Future Internet of Things and Cloud,
IEEE, 2015, pp. 817–822, http://dx.doi.org/10.1109/FiCloud.2015.23.
[133] W.A. Günther, M.H. Rezazade Mehrizi, M. Huysman, F. Feldberg, Debating
big data: A literature review on realizing value from big data, J. Strateg.
Inf. Syst. 26 (3) (2017) 191–209, http://dx.doi.org/10.1016/j.jsis.2017.07.
003.
[134] J. Lv, M. Pawlak, U.D. Annakkage, Prediction of the transient stability
boundary based on nonparametric additive modeling, IEEE Trans. Power
Syst. 32 (6) (2017) 4362–4369, http://dx.doi.org/10.1109/TPWRS.2017.
2669839.
[135] J. Peppanen, M.J. Reno, R.J. Broderick, S. Grijalva, Distribution system
model calibration with big data from AMI and PV inverters, IEEE Trans.
Smart Grid 7 (5) (2016) 2497–2506, http://dx.doi.org/10.1109/TSG.2016.
2531994.
[136] S.N. Lighari, D.M.A. Hussain, Reviewing the security surveillance of AMI
using big data analytics, in: 2017 7Th International Conference on Com-
munication Systems and Network Technologies, CSNT, 2017, pp. 230–233,
http://dx.doi.org/10.1109/CSNT.2017.8418543.
[137] S.A. El-Seoud, H.F. El-Sofany, M. Abdelfattah, R. Mohamed, Big data and
cloud computing: Trends and challenges, Int. J. Interact. Mob. Technol. 11
(2) (2017) http://dx.doi.org/10.3991/ijim.v11i2.6561.
[138] C. Castelino, D. Gandhi, H.G. Narula, N.H. Chokshi, Integration of big data
and cloud computing, Int. J. Eng. Trends Technol. (IJETT) 16 (2) (2014)
100–102, http://dx.doi.org/10.14445/22315381/IJETT-V16P220.
[139] Y. Roh, G. Heo, S.E. Whang, A survey on data collection for machine learn-
ing: a big data-AI integration perspective, IEEE Trans. Knowl. Data Eng.
33 (4) (2019) 1328–1347, http://dx.doi.org/10.1109/TKDE.2019.2946162.
[140] A. Mohamed, S.S. Refaat, H. Abu-Rub, A review on big data management
and decision-making in smart grid, Power Electr. Drives 4 (1) (2019) 1–13,
http://dx.doi.org/10.2478/pead-2019-0011.
[141] P.D. Diamantoulakis, V.M. Kapinas, G.K. Karagiannidis, Big data analytics
for dynamic energy management in smart grids, Big Data Res. 2 (3) (2015)
94–101, http://dx.doi.org/10.1016/j.bdr.2015.03.003.
[142] T. Zhao, Y. Zhang, D. Zhang, Application technology of big data in smart
distribution grid and its prospect analysis, Dianwang Jishu/Power Syst.
Technol. 38 (2014) 3305–3312, http://dx.doi.org/10.13335/j.1000-3673.
pst.2014.12.006.
[143] M. Nofer, P. Gomber, O. Hinz, D. Schiereck, Blockchain, Bus. Inform. Syst.
Eng. 59 (3) (2017) 183–187, http://dx.doi.org/10.1007/s12599-017-0467-
3.
[144] Z. Zheng, S. Xie, H.-N. Dai, X. Chen, H. Wang, Blockchain challenges and
opportunities: A survey, In. J. Web Grid Serv. 14 (4) (2018) 352–375,
http://dx.doi.org/10.1504/IJWGS.2018.095647.
[145] D. Yaga, P. Mell, N. Roby, K. Scarfone, Blockchain technology overview,
2019, http://dx.doi.org/10.6028/NIST.IR.8202, arXiv preprint arXiv:1906.
11078.
[146] T.T.A. Dinh, R. Liu, M. Zhang, G. Chen, B.C. Ooi, J. Wang, Untangling
blockchain: A data processing view of blockchain systems, IEEE Trans.
Knowl. Data Eng. 30 (7) (2018) 1366–1385, http://dx.doi.org/10.1109/
TKDE.2017.2781227.
[147] C. Esposito, M. Ficco, B.B. Gupta, Blockchain-based authentication and
authorization for smart city applications, Inf. Process. Manage. 58 (2)
(2021) 102468, http://dx.doi.org/10.1016/j.ipm.2020.102468.
377
Future Generation Computer Systems 136 (2022) 358–377
[148] H. Wang, J. Zhang, Blockchain based data integrity verification for large-
scale IoT data, IEEE Access 7 (2019) 164996–165006, http://dx.doi.org/10.
1109/ACCESS.2019.2952635.
[149] K. Mudliar, H. Parekh, P. Bhavathankar, A comprehensive integration
of national identity with blockchain technology, in: 2018 International
Conference on Communication Information and Computing Technol-
ogy, ICCICT, IEEE, 2018, pp. 1–6, http://dx.doi.org/10.1109/ICCICT.2018.
8325891.
Mostafa Shokry (M.Sc.) is currently a Ph.D. candidate
at the Faculty of Engineering, Minia University, Egypt.
His research interests include cybersecurity and IoT
security with applications in advanced metering infras-
tructure and smart grids. Mostafa is currently working
as a security engineer at the Ministry of Electricity and
Renewable Energy, Cairo, Egypt.
Ali Ismail Awad (SMIEEE, Ph.D.) is currently an As-
sociate Professor with the College of Information
Technology (CIT), United Arab Emirates University
(UAEU), Al Ain, United Arab Emirates. He is also an
Associate Professor (Docent) with the Department of
Computer Science, Electrical and Space Engineering,
Luleå University of Technology, Luleå, Sweden, where
he also served as a coordinator of the Master Program
in Information Security from 2017 to 2020. He is
an Associate Professor with the Electrical Engineering
Department, Faculty of Engineering, Al-Azhar Univer-
sity at Qena, Qena, Egypt. He is also a Visiting Researcher at the University
of Plymouth, United Kingdom. His research interests include Cybersecurity,
network security, Internet of Things security, and image analysis with biometrics
and medical imaging applications. He has edited or co-edited eight books
and authored or co-authored several journal articles and conference papers
in these areas. He is an Editorial Board Member of the Future Generation
Computer Systems Journal, Computers & Security Journal, the Internet of Things,
Engineering Cyber Physical Human Systems Journal, and Health Information
Science and Systems Journal. Dr. Awad is currently an IEEE senior member.
Mahmoud Khaled Abd-Ellah (MIEEE, Ph.D.) received
the M.Sc. degree from the Electrical Engineering De-
partment, Faculty of Engineering, Assiut University,
Egypt, in 2015, and the Ph.D. degree from the Elec-
tronics and Communications Engineering Department,
Minia University, Egypt, in 2019. He is currently
an Assistant Professor of computer science at Egyp-
tian Russian University. His research interests include
biomedical imaging, image analysis with applications
in medical imaging, digital forensics, Forecasting, IoT,
computer vision, machine learning, deep learning, pat-
tern recognition, image processing, signal processing, and biometrics. He has
published several journal articles, conference papers, and one book chapter in
these areas. He has served as a Reviewer for many prestigious journals, such as
IEEE Access. Dr. Abd-Ellah is currently an IEEE member.
Ashraf A. M. Khalaf (Ph.D.) received his B.Sc. and M.Sc.
degrees in electrical engineering from Minia University,
Egypt, in 1989 and 1994, respectively. He received
the degree of ‘‘Doctor of Engineering in System Sci-
ence and Engineering’’ from the Graduate School of
Natural Science and Technology, Kanazawa University,
Japan, on March 22, 2000 (Ph.D. degree in Egypt).
His research interests include adaptive signal process-
ing, audio, and image processing, AI, Neural networks,
machine learning, and deep learning techniques. Data
communications, data security, and optical communi-
cations. He is currently a professor of DSP and Head of Electrical Engineering
Department, Faculty of Engineering, Minia University, Egypt. ORCID # is:
0000-0003-3344-5420.