# Toward Secure Smart Grid Systems: Risks, Threats, Challenges, and Future Directions
## 5 Smart Grid Attacks
### Forensics Solutions  
Smart grid forensics work on collecting, preserving, examining, and analyzing digital evidence retrieved or found during a security-related or non-security-related incident [274]. This also requires exploring communication logs, inspecting and isolating suspected devices, and analyzing network traffic to identify the cause of the incident and prevent future similar events [275] based on the newly developed strategies. As a result, several smart-grid-based forensics solutions were presented (see Table 28). In [276], [PERSON] et al. conducted a study that sheds light on the development of the proposed Smart Grid Digital Forensics Investigation Framework to support digital forensics investigations, especially in cases like the Stuxnet attack, to identify the suitability of phases to be integrated in their framework. [PERSON] et al. defined and discussed the emerging area of CPS forensics and reviewed some of its presented approaches in [277]. In [278], [PERSON] et al. presented a taxonomy of possible data falsification strategies in AMI micro-grids before presenting a trust model based on Kullback-Leibler divergence to identify compromised smart meters and additive and deductive attacks. The experimental results show this model has a high true-positive detection rate, with a false alarm rate of 8%. In [279], [PERSON] et al. presented a conceptual Software-Defined Network (SDN)-based security monitoring framework that is based on SDN, Network Behavior Analysis (NBA), Deep Learning Models, and DPI attack corroboration, as well as a conceptual forensic-driven security monitoring framework with digital forensics and investigation capabilities being integrated for security monitoring. [PERSON] et al. presented a holistic approach based on the ISO/IEC 27043 [280] international standard that covers the diverse application domains and eliminates the overhead of employing ad hoc models in [281]. The model has three forensics phases: forensic readiness (proactive), forensic initialization (incident), and forensic investigation (reactive), and it supports diverse Internet of Things applications. In [282], [PERSON] et al. presented a logging architecture as a methodological framework based on the recommendations of the UK National Cyber Security Center and the result of applying the OSCAR methodology and relevant open-source tools to ensure the necessary collection and storage of forensics information, as well as the legality of evidence in courts. In [283], [PERSON] et al. presented the Secure and PrivatE smArt gRid (SPEAR) architecture to protect smart grids by enhancing situational awareness, detecting timely cyberattacks, collecting appropriate forensic evidence, and providing an anonymous cybersecurity information-sharing mechanism. In [284], [PERSON] et al. addressed data confidentiality by employing ciphertext-policy attribute-based encryption to establish a fine-grained log access control while introducing a hybrid blockchain system generating novel signature chains to achieve a private log protection system, loss prevention, tamper resistance, immutability, and non-repudiation. In [285], [PERSON] et al. presented a digital procedure that guides investigators to perform digital forensic investigation against Distributed Denial of Service (DDoS) and False Data Injection (FDI) attacks, especially in a smart grid environment to ensure the evidence's integrity during collection and analysis to be used as legal evidence in court. Cyber-physical attacks on smart grid systems can be investigated, traced, and linked with the help of forensics solutions, which facilitate post-event analysis and legal accountability. One practical scenario is the use of digital forensics in the event of a substation outage, where log data from network gateways and smart meters can be utilized to reconstruct the events and identify the source of the intrusion.