Abstract
The growing reliance on Cyber technology for Smart Grid and other Cyber-Physical Systems (CPS) applications increases high assurance challenges. Advanced Metering Infrastructure (AMI) is a critical part of smart grid and failure to address security risks in it might disrupt utilities in their mission to deliver power reliably. The objective of this paper is to find mitigation actions for attacks that might be launched against AMI. The paper introduces a tool called SecAMI that calculates the relationship between the speed at which an attack spreads, the speed at which it can be detected, and the consequences on the availability of the AMI. The results from SecAMI can be used as a performance metric to significantly improve the development and the deployment of Intrusion Detection Systems (IDSs) in an AMI environment. Experimental results with an IDS called Amilyzer show that centralized IDS might not work efficiently in scalable systems comparing with distributed IDS in term of detection time, especially with a Distributed Denial of Service (DDoS) attack or remote disconnects on the AMI.