Machine learning for cybersecurity in smart grids: A comprehensive review-based study on methods, solutions, and prospects

• The main contributions of this review paper are:–Introducing a general solution on how to solve any attack detection problem using machine learning tools to remedy model selection issues. • Providing a very useful flowchart to select the appropriate learning model type for each specific data with different characteristics. • Rank machine learning tools according to CIA security attributes to provide a better and accurate projection of machine learning models for smart grids cybersecurity. • Introducing best-known classification of machine learning tools according to two model complexity criteria (i.e., conventional and deep learnings) to help distinguish modeling complexity in processed data. • Addressing all types of learning paradigms, including supervised, unsupervised, and reinforcement learning, in addition to modeling architectures such as ordinary, hybrid, and ensemble. In modern Smart Grids (SGs) ruled by advanced computing and networking technologies, condition monitoring relies on secure cyberphysical connectivity. Due to this connection, a portion of transported data, containing confidential information, must be protected as it is vulnerable and subject to several cyber threats. SG cyberspace adversaries attempt to gain access through networking platforms to commit several criminal activities such as disrupting or malicious manipulation of whole electricity delivery process including generation, distribution, and even customer services such as billing, leading to serious damage, including financial losses and loss of reputation. Therefore, human awareness training and software technologies are necessary precautions to ensure the reliability of data traffic and power transmission. By exploring the available literature, it is undeniable that Machine Learning (ML) has become the latest in the timeline and one of the leading artificial intelligence technologies capable of detecting, identifying, and responding by mitigating adversary attacks in SGs. In this context, the main objective of this paper is to review different ML tools used in recent years for cyberattacks analysis in SGs. It also provides important guidelines on ML model selection as a global solution when building an attack predictive model. A detailed classification is therefore developed with respect to data security triad, i.e., Confidentiality, Integrity, and Availability (CIA) within different types of cyber threats, systems, and datasets. Furthermore, this review highlights the various encountered challenges, drawbacks, and possible solutions as future prospects for ML cybersecurity applications in SGs.