## 1 Introduction  
With the advance of information and network technologies, the Internet of Things (IoT) has revolutionized many conventional areas, including smart home, intelligent transportation and smart grid [1; 2; 3]. As one of the significant implementations of IoT, the smart grid has attracted growing attention [4]. The smart grid, also denoted as the next generation of the power grid, can provide reliable, secure and efficient energy transmission and distribution [5]. Smart measurement devices (e.g., smart meters), deployed on the user side of the smart grid and applied to measure the power usage information, can not only enhance the interactivity between utilities and customers, but also can increase the efficiency of energy consumption. Nonetheless, measurement devices (e.g., meters or sensors) can be compromised by cyber attacks (e.g., malicious code injection, _etc._) launched by adversaries, because they may be connected through computer networks [6]. Using compromised devices, the adversary can launch additional attacks (e.g., injecting false energy demand information) to disrupt the operations of the smart grid (e.g., the dispatch of energy [7], the electricity market [8], _etc._). As the smart grid consists of a large number of measurement devices, how to detect compromised remote devices efficiently and accurately is a critical issue. A number of research efforts have been conducted to detect malicious measurement devices through remote software-based attestations [9; 10; 11; 12; 13; 14; 15; 16; 17]. All aforementioned attestation schemes detecting compromised devices remotely are based on the additional computation time in the verification procedure, which is commonly raised by memory forge attacks [18]. These existing schemes only considered the single remote attestation and ignored the impact of network delay on the detection of remote nodes. In the smart grid, for an easy deployment, smart measurement devices could establish a wireless mesh network to support data transmission. When the smart measurement device is far from the verifier or the network is under malicious attacks (e.g., denial-of-service attacks [19; 20], selective forwarding attacks [21; 22], _etc._), the end-to-end delay will increase rapidly and cannot be ignored. To accurately detect compromised devices, existing schemes have to significantly increase the iterations of the verification procedure on remote devices in order to make an increased computation time, which can be distinguished from the data transmission delay. As a consequence of the increased number of verifications, the remote nodes will consume more time on computing the checksum. In addition, when the number of nodes increases, the number of attestations conducted by the verifier will increase, as well. Therefore, the verifier has to generate many attestations for a large system. In this paper, we propose a low-cost remote memory attestation scheme (LRMA) to verify remote nodes in the advanced metering infrastructure (AMI) network in the smart grid. LRMA takes into account the impact of real-time network delay in the remote attestation and achieves a better attestation performance with a lower overhead. Our approach is an enhanced software-based attestation scheme based on SWATT (SoftWare-based ATTestation technique) [11]. Particularly, in the \"challenge-response\" verification process, relay nodes will report time differences between their reception of the challenge and response. With these time differences, the verifier can derive the real-time network delay and achieve a better performance without the impact of network delay. In addition, the number of attestation failures on remote nodes will be considered as an indicator to raise the risk level, which is used to show the probability of being compromised. Then, the verifier will arrange the appropriate number of attestations to remote nodes according to their risk level, so that strong nodes will receive less attestations than weak ones.