# Toward Secure Smart Grid Systems: Risks, Threats, Challenges, and Future Directions
## 5 Smart Grid Attacks
### Non-Cryptography Solutions
#### 7.2.3. Honeypot Solutions  
Using honeypots in smart grids can be an effective security strategy to detect cyberattacks and identify their source by creating a dummy system that tricks the attacker and collects data about them instead [8]. Honeypots can be deployed at various points within the smart grid's critical infrastructure, including networks and their edges. In this paper, several honeypot-based solutions are presented (see Table 27). In [267], [PERSON] et al. presented a DL-based model with a Long Short-Term Memory Recurrent Neural Network (LSTM RNN) architecture as a method that addresses the vast amount of gathered data by log files and the limited smart grid devices' capacity using deep-learning-based (DL) technology while combining weak labels to preserve their contribution during training. The experimental results show that it achieves 99.8% test accuracy while using only 25% of the features. In [268], [PERSON] et al. deployed a GridPot honeypot to collect threat data targeting the smart grid system. They analyzed the collected threat data by mapping them to the MITRE ATT&CK for the Industrial Control System (ICS) framework to show how real these threats can be at harming the smart grid. In [269], [PERSON] et al. deployed a scalable low-interaction honeypot in Amazon Elastic Compute Cloud (AWS EC2) instance across six different regions to determine the current threat landscape and the knowledge to compromise Industrial Control System (ICS). In [270], [PERSON] et al. enhanced the HosTaGe honeypot specifically for IoT communication protocols over public networks for mobile Android devices. This protocol honeypot utilizes the cellular network to establish decentralized, simulated infrastructures of IoT systems across various types of IoT network protocols. The virtualized honeypot networks capture logs and analyze real-world public attacks on them. In [271], [PERSON] et al. developed a privacy-preserving honeypot-based detector and cost-effective federated learning (FL) framework for efficient security model development, where two verification steps are required before forming the global model. In this model, the Traditional Power Retailers (TPRs) encourage the Small-scale Power Suppliers (SPSs) to share their collected honeypot logs by designing proper rewards. The extensive simulations show that the presented solution outperforms existing approaches. In [272], [PERSON] et al. presented HoneyTrack as a lightweight and very efficient tool that can be easily and quickly installed in any system to help reach the roots of the attacker. The honeypot was set up in the Microsoft Azure cloud to monitor the attacks that targeted the authors' server. The testing results show that companies can launch security policies based on the results of the HoneyTrack. In [273], [PERSON] et al. proposed a Directed Acyclic Graph (DAG) blockchain architecture, where IoT mobile users in the 5G network are authenticated via the Access Points (APs). The experimental results show that this model outperforms existing QoS approaches, including bandwidth, response time, delay, packet loss, detection accuracy, and authentication time. To facilitate proactive threat intelligence and forensic investigation, honeypot solutions serve as decoys to deceive and track attackers without disclosing real smart grid assets. Placing honeypots within AMI to imitate vulnerable endpoints and record malicious activity without interfering with core operations is one popular deployment method. \begin{table}
\begin{tabular}{c c c c c c c c c c} \hline \hline
**Year** & **Ref. ** & **Type** & **Description** & **Characteristics** & **Accessages** & **Downloads** & **Limitations** & **Challenges** & **Improvements** \\ \hline
2002 & [26] & [27] & DL/Anomaly Detection & \begin{tabular}{c} ISTM ENN-based control \\ for single-based anomaly \\ detection within \\ \end{tabular}  & \begin{tabular}{c} Deep learning, work \\ level (1,STM with only 25%) features \\ \end{tabular}  & \begin{tabular}{c} High accuracy (90.9K) \\ with only 25% features \\ \end{tabular}