# Cybersecurity of Microgrid: State-of-the-Art Review and Possible Directions of Future Research
## 2 The Microgrid Architecture
### Cyberattacks on Microgrid  
In general, the attack on and control over a system involves four steps: reconnaissance, scanning, exploitation, and maintaining access [33]. During reconnaissance, the attacker gathers information on the target. Scanning is the second step, where the attacker attempts to identify vulnerabilities in the system. These activities are intended to identify open ports and services that run on each port as well as their weaknesses. The exploitation involves the attacker attempting to compromise and gain complete control of the target. Before proceeding to maintain access, which is the final step, the administrative access enjoyed by the target needs to be achieved. Access is maintained by installing a hidden program in the system that enables the attacker(s) to return to the it in the future. 1. Reconnaissance Reconnaissance for attacks is carried out in the form of social engineering and traffic analysis. Social engineering (SE) relies on social skills and human interaction rather than technical skills. In this stage, the attacker uses communication and persuasion to win the trust of a legitimate user. This is done to obtain the user's credentials and confidential information, such as passwords or PIN numbers, to log on into a particular system. Some examples of popular techniques used in SE are phishing and password pilering [33]. In a traffic analysis-based attack, the traffic is listened to and analysed to determine the device and hosts connected to the network, together with their IP addresses. In traffic analysis and social engineering, the compromise primarily involves confidential information. 2. Scanning Scanning is performed to identify live hosts and devices of the network. According to [33], there are four types of scans: those on ports, IPs, vulnerabilities, and services. Typically, an IP scan is conducted first to identify the hosts connected to the network together with their IP addresses. This is followed by the scanning of ports to identify an open port. Each host on the network is scanned. The attacker then performs a service scan to identify the system or service that operates behind each open port. For instance, if port 102 is detected as open on a system, the hacker can infer that this system is used for substation automation control or messaging. On the contrary, the phasor measurement unit (PMU) is the target system if port 4713 is open. Identifying vulnerabilities and weaknesses related to each service on the target machine for further exploitation is the aim of the vulnerability scan, which is the final step of scanning. The DNP3 and Modbus are two industrial protocols that are susceptible to scanning attacks. The Modbus/TCP is susceptible to an attack known as Modbus network scanning because it is designed for communication rather than security. In this attack, a benign message is sent to all devices connected to the network to collect information on them. An open Modbus/TCP is detected and slave IDs of the device together with their IP addresses are identified by Modscan, which is a SCADA Modbus network scanner [34]. Modscan scans the DNP3 protocol and determines the hosts: in particular, the slaves, their DNP3 addresses, and their corresponding master. It is thus clear that the target of these attacks is primarily confidential information on the smart grid. 3. Exploitation Exploitation features harmful activities to exploit the smart grid's vulnerable components and gain control of it. Popping the human-machine interface (HMI), Trojan horse, integrity violation, man-in-the-middle (MITM) attack, jamming the channel, privacy violation, worm, virus, replay attack, and DOS attack are examples of harmful activities. The infection attack on a particular system or device in a smart grid is performed using a program called the virus. On the contrary, a worm is a self-replicating program, and spreads by copying itself to infect other devices and systems by using the network.