The growing demand for electrical energy at a global scale highlights the need for more reliable, secure, and environmentally friendly power systems. For this purpose, both research and industry communities in several parts of the world (e.g. U.S., E.U., China, Australia, etc.) (Bamberger et al., 2006; U.S. Department of Energy, 2018b) focus their efforts on “smartening” the grid, in order to effectively accommodate the needs of all users, i.e., producers, consumers and prosumers. Smart Grids (SGs) are electricity networks that use advanced information and communication technologies (ICT) such as sensors, software applications, computer networks, and data analytics to provide efficient and sustainable energy services. ICT facilitates the monitoring and control of the power grid, which means that it can provide a better overview about the state of the grid and regulate its operation in an optimal manner.

While ICT offers a wide range of benefits, it also exposes SGs to several critical security challenges (European Union Agency for Cybersecurity (ENISA), 2018; U.S. Department of Energy, 2018a). The vulnerable spots that arise from the digital transformation of the power grid, pave the way for different types of cyberattacks. Examples of such vulnerable spots are the heterogeneous communication technologies used in SGs, such as ZigBee, wireless mesh networks, cellular network communication and powerline communication, etc. (Gungor et al., 2011). Their complex interconnections along with the possible protocol incompatibilities can result in serious security gaps. In addition, the operation of power systems is still heavily dependent on proprietary and legacy technologies, such as conventional Supervisory Control and Data Acquisition (SCADA) systems whose design did not originally account for security measures. As a consequence, infrastructures that extensively utilize SCADA systems, such as SGs, are exposed to numerous digital risks (Gunduz and Das, 2020). Moreover, securing modern power systems in terms of cybersecurity is more challenging compared to the typical ICT-based infrastructures, due to their strict operational requirements and their criticality level (Alcaraz and Lopez, 2012).

Successful cyberattacks against Cyber-Physical Systems (CPS) have been already recorded, like the well-known case of the Ukrainian power system in December 2015. This large-scale incident is extensively reported by the SANS institute, the Electricity Information Sharing and Analysis Center (E-ISAC) and other power companies (Lee et al., 2016). The coordinated attack consisted of malware installation via spear phishing emails, unauthorized access and SCADA system hijacking, which opened several circuit breakers remotely to interrupt the electricity supply to consumers. It also involved Denial of Service (DoS) attacks on telephone systems to prevent customers from emergency reporting to the operators. The power disruptions caused by this attack approximately affected 225,000 customers. Another notorious software, called Stuxnet, was uncovered in 2010 (Falliere et al., 2011). Stuxnet worm targeted the hosts of specific industrial control systems that were running on Windows environment and it mainly affected Iranian nuclear facilities (Karnouskos, 2011). For this reason, protecting SG systems from malicious activities is currently an active research area (National Institute of Standards and Technology (NIST), 2018), relevant for governments (U.S. Department of Energy, 2018a), international organizations such as the European Union Agency for Cybersecurity (ENISA) (2018) and the National Institute of Standards and Technology (NIST) (Pillitteri and Brewer, 2014; National Institute of Standards and Technology (NIST), 2018), and the academic community.

The severity of digital threats and the criticality of power grids necessiate the investigation of their cyber resilience. Typically, resilience in power grids involves the capability of the system to withstand and recover from external, high-impact and low-probability event, such as extreme weather events. However, this definition does not take into consideration the cyber risks that arise from the digitalization of power grids. This paper attempts to establish a universal framework that can adequately describe the cyber resilience of SGs. To achieve this, the definition of cybersecurity is established, along with an analysis the state-of-the-art methodologies that enhance it. For a better guidance of the reader through this research domain, a series of classifications are formulated regarding several important factors of cyber resilience. The limitations of the published cyber resilience methods for SGs are discussed while conclusions and ideas for future directions are drawn.

The importance of SGs has inspired several researchers to establish guidelines and specifications regarding their cyber resilience. More specifically, a taxonomy of the standard cyberattacks against SGs is defined in Li et al. (2012), which serves as a study of sophisticated attack behaviors, alongside a presentation of fundamental cyber security techniques. Moreover, a universal cyber security understanding of the SGs framework is introduced in Peng et al. (2019), together with an investigation of attacks scenarios and detection/protection methodologies from both communication and control viewpoints. Similarly, a discussion is provided in Nguyen et al. (2020) about directions and recent advancements in detection techniques, equipment protection plans, and mitigation strategies that enhance SGs resilience and operational endurance against cyberattacks. In Nazir et al. (2015) and Yadav et al. (2016), a review is presented regarding the digital vulnerabilities of SGs, the key objectives of cybersecurity in such infrastructures and the proposed cyber resilience approaches that aim to protect them. Finally, the types of cyberattacks that can be launched against SGs are introduced and classified in Gunduz and Das (2018) and Alsuwian et al. (2022) along with the challenges faced and the drawbacks in existing solutions.

Despite the significant efforts toward the development of a common understanding about the cyber resilience of SGs, existing works demonstrate significant limitations. For example, the cyberattack classifications proposed in Li et al. (2012), Gunduz and Das (2018), and Alsuwian et al. (2022) are based only on a single feature, i.e., the Confidentiality-Integrity-Availability (CIA) principle, and fail to provide any other type of attack categorization, e.g., based on attack location. Furthermore, a solid definition about the cyber resilience term is introduced in this paper, a critical feature that none of the related works has. Similarly, the majority of the related works provide a detailed analysis of the existing cyber security solutions for SGs but they neither discuss their limitations nor they propose any classification of them. Finally, only few related works (Li et al., 2012) make suggestions about emerging technologies that could strengthen the cyber resilience of SGs, as the introduced work does. To highlight the novelties of the proposed paper and enhance its comprehensibility, the contributions and the limitations of the related works are shown in Table 1. More specifically, “✓” annotation indicates that the paper makes the corresponding contributions while “ × ” symbol declares that it does not.

This paper provides an in-depth analysis of the state-of-the-art scientific methods that are proposed for the cyber resilience enhancement of SGs. This analysis is accompanied by a series of classifications to reveal the underlying patterns of the cybersecurity for SGs. The main contributions of this paper are summarized as follows:

The organization and the concept of the proposed work are briefly provided in this subsection. For better comprehension, the layout of the paper is illustrated Table 2 which also explains the relationship between the different sections and reveals the reason of their existence. More specifically, the paper starts with the introduction of the cyber resilience term for SGs to declare its motivation (Step 1.). Then, several research works that investigate the cyber resilience of SGs are analyzed to identify the research gaps (Step 2.). in the next subsection, the contributions of this paper are summarized (Step 3.). Since this approach investigates cyber threats against SGs, two types of attack categorization are performed (Step 4.) to understand the root cause of cyber resilience. Next, the cyber resilience of SGs is defined along with its different phases (Step 5.) to establish a common understanding about it. Afterwards, the current solutions toward the enhancement of the cyber resilience in SGs are classified based on the utilized models (Step 6.) to facilitate the investigation of this field. A comprehensive review of these existing solutions follows (Step 7.) that analyze the deployed algorithms in this domain. Finally, the limitations of the existing solutions are discussed per category (Step 8.) in order to provide directions and suggestions for future works (Step 9.).

Before presenting the cyberattack classification based on the targeted cybersecurity objective, it is important to provide a brief analysis of these objectives. The main cybersecurity objectives when designing ICT-based systems are Confidentiality, Integrity, and Availability, also known as the CIA triad. The CIA triad defines which system characteristics does a cybersecurity mechanism enhance or oppositely, which system features are exposed to cyber risks. Particularly, availability ensures that data and services are accessible when needed and focuses on preventing disruptions or downtimes, integrity refers to the accuracy and trustworthiness of the data and confidentiality focuses on protecting the exchanged information from unauthorized access. Now that the cybersecurity objectives are defined, the relevant cyberattack categorization can be constructed, as shown in Figure 1.

The different types of cyberattacks presented in Figure 1 are briefly explained in the following:

Regarding the cyberattack categorization based on the location of the attack, it is useful to firstly analyze the distinct components of a remote automation system. In this way, the process of identifying the vulnerable points (in terms of cybersecurity) across a power grid is significantly facilitated. To this end, the standard control loop of a power system is depicted in Figure 2, where the vulnerable ICT parts are accompanied by an adversary symbol. The vulnerable spots are derived based on the reasonable assumption that all the ICT parts that compose a remote automation system are directly threatened by cyberattacks.

In the next paragraphs, a detailed breakdown of the power system components susceptible to digital threats is provided:

According to the previous analysis, the categorization of cyberattacks based on the attack location are the following: sensor attacks, measurement channel attacks, control center attacks, control command attacks and actuator attacks.

Resilience is one of the most important attributes of the power grid as it ensures the uninterrupted delivery of the electrical energy. Currently, there is an extensive list of definitions for the power system resilience, provided by international institutions and organizations (N. Council, 2009; Chaudry et al., 2011; Severe Impact Resilience Task Force, 2012; EPRI, 2013). According to Panteli and Mancarella (2015), the majority of these definitions agree that power system resilience is the capability of a system to endure, assimilate, and promptly recuperate from an external catastrophic incident characterized by high impact but low probability.

As electrical systems evolve rapidly over time and move into the Smart Grids era, new types of undesired events affect their resilience, such as cyberattacks. Thus, it is critical to reconsider the typical concept of power system resilience in order to include the impact of these emerging incidents. To this end, the definition of resilience provided by Panteli and Mancarella (2015) is extended in Syrmakesis et al. (2022) in order to include the cyber part of SGs, establishing the attribute of cyber resilience. Based on Syrmakesis et al. (2022), cyber resilience is viewed as the ability of a system to preserve its operational state in the presence of successful cyberattacks. More specifically, cyber resilience focuses on the minimization of the cyberattack impact on power grids and the prompt recovery from these incidents.

To provide more insights on the term of cyber resilience, the typical power system resilience curve presented in Panteli and Mancarella (2015) is modified and adjusted in Syrmakesis et al. (2022) for the case of cyberattacks. This cyber resilience curve for SGs is depicted in Figure 3. In this graph, the evolution of the system performance in the event of a cyberattack is illustrated. This visualization provides a deeper understanding of the different cyber resilience states along with their corresponding defensive measures, such as: robustness/resistance, resourcefulness/redundancy, adaptive self-organization, etc. The level of each resilience state is calculated based on selected resilience metrics, e.g., the number of customers affected or the number of residents in a population impacted, which quantitatively express the system reliability or power quality.

A detailed analysis of the different states that describe the concept of cyber resilience is presented in what follows:

The cyber resilience of SG control systems is typically improved by detecting and estimating the launched FDIAs and then mitigating their destructive impact. Based on the presented literature review, it has been identified that the related works can be classified into three main categories: (i) model-based, (ii) observer-based, and (iii) data-driven approaches. In model-based methods, algorithms that process system knowledge are usually developed to tackle the effects of cyberattacks; observer-based techniques leverage the generated estimation errors to provide FDIA approximation formulas and attack-resilient SG control architectures; data-driven approaches use deep learning architectures for capturing the dynamic behavior of SG control systems under healthy and attack conditions in order to eliminate the FDIA impact. These categories are illustrated in Figure 4 that follows:

The aforementioned categories are thoroughly explained in what follows:

Various control mechanisms have been developed as active cyberattack response mechanisms for power systems and CPS in general. In the following, several of these methods are grouped accordingly.

Model-based approaches are extensively used for increasing the cyber resilience of power systems and CPSs. A significant subcategory of theses techniques is the model-based response (Syrmakesis et al., 2022), where the compromised data are replaced by estimated ones. Particularly, a representative linear model is developed in Cárdenas et al. (2011) to provide a cyberattack detection baseline and replace the tampered system data. This model is obtained by linearizing the Tennessee-Eastman process model (Ricker, 1993) about the steady-state operating conditions. Similarly, in Murillo Piedrahita et al. (2018) a SCADA system with software defined networking (SDN) (Belmonte Martin et al., 2015) assistance is presented, which replaces the compromised measurements with estimated ones. For evaluation, an extension of the MiniCPS (Antonioli and Tippenhauer, 2015) is developed in order to provide SDN functionalities for both supervisory and field networks. In the same context, an algorithm is proposed in Tan et al. (2017) that estimates which sensor data links have been affected by cyberattacks. If any attack is identified, the power export deviation is accounted for the ACE computation, otherwise an attack-mitigating state estimation program is initiated. The performance of this algorithm is evaluated on a 37-bus power system model simulated in PowerWorld (PowerWorld Corporation, 2016).

Forecasting methods are also widely adopted to support the cyber resilience of modern power grids. For example, a statistical approach is presented in Sridhar and Govindarasu (2014) for SG control systems. This defense mechanism uses the real-time load forecasts to approximate SG control signals, which replace the actual ones in case of cyberattacks. In Roy and Debbarma (2020), a cyber-attack detection and mitigation platform is introduced that utilizes the forecasted data of the area control error for identification and mitigation of cyberattacks. Another model-based FDIA method for power systems is presented in Zhao et al. (2017) which uses short-term state forecasting along with a statistics-based measurement consistency test method between the forecasted and received measurements. Furthermore, a multi-sensor track-level fusion-based model prediction technique is introduced in Khalid and Peng (2017) to tackle intentional injections of false synchrophasor measurements in wide-area monitoring systems (WAMS), a typical infrastructure deployed in SGs. Finally, the online information acquired by load forecasts, generation schedules and PMUs is leveraged in Ashok et al. (2018) to detect attack-tampered measurements.

State estimation filters is another effective solution toward the strengthening of the cyber resilience for of SGs. More specifically, the limitations of Kalman filter are overcome in Khalaf et al. (2019) by an input/state estimation-based algorithm which is developed to detect and approximate measurement FDIAs in the LFC system. Similarly, an attack-resilient frequency control scheme is introduced in Alhalali et al. (2019) based on attack detection through state estimation. Another cyberattack detection technique is proposed in Liu et al. (2014) which handles the state estimation of the grid as a matrix separation problem between nominal power grid states and anomalies. The Kullback-Leibler distance is used in Chaojun et al. (2015) to calculate the difference of the probability distributions between online measurement and the historical data to identify cyberattacks against alternating current (AC) state estimation. Moreover, a mixture density-based maximum likelihood estimation algorithm is proposed in Khalid et al. (2023b) to identify cyberattack vectors for WAMS. In Khalid et al. (2023a), a median regression function-based state estimation is presented to mitigate the impact of cyberattacks in modern power grids that extensively utilize PMU measurements. Compressed sensing techniques are applied in Fawzi et al. (2014) to estimate the state of the plant during attacks.

Game theory is another scientific field that can provide defensive strategies for strengthening the cyber resilience of smart grids. To achieve this objective, game theory reveals the optimal responses to cyberattacks based on the activities of the adversaries. Particularly, game-theoretic approaches have been proposed for optimal defense resource allocation under fixed budget using a linear game framework (Ranjbar et al., 2019), a Quantal Response Equilibrium model (Shao and Li, 2021) and a zero-sum game-theoretical model (Yan et al., 2024). Furthermore, Srikantha and Kundur (2016) utilizes a non-cooperative, differential game to discover the countermeasure vector against malicious activities that stealthily compromise DER actuators. In Li et al. (2015), a zero-sum game is modeled to represent the decision-making process between a sensor node and an adversary that launches DoS attacks. A strictly competitive game is also designed in Deng et al. (2017) which approximates the interaction between the attacker and the defender in case of cyberattacks against power systems state estimation.

The design of effective observer structures is a well-studied research field and as a result, several observer-based techniques have been proposed for the cyber resilience enhancement of power systems. Particularly, a robust detection algorithm for SGs is developed in Wang et al. (2020a) using an adaptive observer that takes the stealthy characteristics of the bias load injection attack into account. Similarly, an unknown input interval observer-based detection and isolation scheme for FDIAs against the monitoring and control of SGs is introduced in Wang et al. (2020b). In Yan et al. (2022), a bank of dynamic reduced-order observers is developed to produce the necessary cyberattack detection residuals for a class of large-scale SGs systems. Furthermore, a novel detection and isolation method of FDIAs against the frequency control system of SGs is introduced in Syrmakesis et al. (2024) that employs sliding mode observation techniques. Moreover, an innovative FDIA estimation method is proposed in Syrmakesis et al. (2023a,b) for SG generation control along with an efficient cyberattack-resilient control design, using sophisticated sliding mode techniques combined with an unknown input observer. Regarding wind power systems, an observed-based dynamic event-triggered controller is presented in Yang et al. (2022) for multi-area wind farms under dual alterable aperiodic DoS attacks. Furthermore, an adaptive observer-based resilient control method for the cyber links of wind turbines is developed in Zhao et al. (2023) to defend against time-delay attacks. Observer-based techniques have been also proposed for increasing the cyber resilience of other types of CPSs. For example, an FDIA-resilient control mechanism is designed in Sargolzaei et al. (2020) for a networked control system using a Kalman filter as an observer. Additionally, an adaptive sliding mode observer is developed in Nateghi et al. (2021) to establish a resilient control for linear CPSs under compromised measurements and control commands. Furthermore, an event-triggered, observer-based control scheme is presented in Lu and Yang (2020) to detect DoS attacks in CPSs. Since Load Frequency Control (LFC) is a critical part of the power systems automation, observer-based techniques have been also adopted for the strengthening of its cyber resilience. For example, a robust adaptive observer is presented in Ye and Yu (2022) for concurrent estimation of the LFC system states and FDIAs. A Luenberger observer enhanced by the extended Kalman filter is proposed in Abbaspour et al. (2020) and a combination of switching impulsive observer and switching state observer is introduced in Chen et al. (2022) for cyberattack estimation and mitigation in LFC. Furthermore, an unknown input observer is designed in Alhelou and Cuffe (2022) that forms an attack-resilient control architecture for LFC.

Data-driven approaches are a potential solution when the SG modeling is highly complex and it is difficult to find an adequate system representation. The cyber resilience methods that fall into this category typically utilize deep neural network architectures as their core model. More specifically, a long short-term memory (LSTM) neural network is trained in Chen et al. (2021), that can reconstruct the healthy SG control signals during FDIAs, based on data extracted under normal system conditions. A similar approach is followed in Ayad et al. (2022); an LSTM neural network is designed to tackle the FDIA impact on SGs but in this case, both load disturbances and system nonlinearities are considered. In Li et al. (2019), a combination of a deep autoencoder and an extreme learning machine is employed to estimate the data missing by DoS attacks, preserving the operational state SGs. This method is evaluated on the single, two and three area LFC models provided in Bevrani (2014) using MATLAB/Simulink. Furthermore, a data clearing method based on conditional deep belief networks is investigated in He et al. (2017) as a real time cyberattack response response. Finally, a graph neural network is proposed in Boyaci et al. (2022) to detect stealthy FDIAs in SGs by leveraging underlying graph topology and spatially correlated measurement data.

Reinforcement learning is a commonly used approach for the cyber resilience enhancement of SGs. This technique is defined as the process that enables an agent to adopt the optimal behavior by interacting with a dynamic environment via trial-and-error (Kaelbling et al., 1996). To this end, a deep-Q-network detection technique is implemented in An et al. (2019). This technique offers a defense strategy against data integrity attacks in AC power systems. Furthermore, an adversarial deep reinforcement learning approach is applied in Wang and Pal (2023) against data-driven destabilizing attacks to protect inverter-based microgrids. In Wei et al. (2019), the optimal re-closing time of power transmission lines after a successful cyberattack is investigated using a deep reinforcement learning method. A reinforcement learning method is also proposed in Niu et al. (2015) to maintain the cyber resilient state of an SG that uses cognitive radio network technology. The transmitter and the receiver of this methodology follow a multi-armed bandit approach to choose the most likely available and jamming-free communication channels in case of a jamming attack.

Several issues of the cyber resilience research field have been effectively addressed by existing works; each category of these related works contributes in its own, unique way to the research field. However, there are still multiple open problems to be resolved, which are either caused by the inherent characteristics of the problem or introduced by the categories of the proposed methodologies. The contributions of the existing works in the research field along with the open problems are listed per category in what follows as advantages and limitations, respectively:

In general, finding a universal solution toward the cyber resilience enhancement of SGs against FDIAs is a highly complicated task. The analysis presented in this paper shows that each category of the proposed methodologies has its own unique features and demonstrates different benefits and drawbacks. Thus, it can be safely concluded that the selection of the methodology that properly strengthens the cyber resilience of the investigated SG control system is case-dependent. That means that the effectiveness of the chosen methodology depends on the specific characteristics, vulnerabilities, and requirements of the SCADA system being studied. Factors such as architecture of the system, technology stack, operational environment, regulatory requirements, threat landscape, and organizational capabilities influence the choice of the most appropriate cybersecurity measures.

Toward this objective, the thorough examination of the unique circumstances of the considered SCADA system is suggested. Another possible solution is the combination of the different categories of the proposed methodologies; in this way, the complementary advantages of each category will broaden the capabilities of the proposed approaches and could potentially balance their drawbacks. Finally, the continuous integration of the state-of-the-art models in each category (e.g. diffusion models in data-driven category, latest observer designs in observer-based category, etc.) will maintain the robustness of the proposed cyber resilience methodologies for SGs against the constantly evolving cyber threats.