Resilient Cybersecurity and DDoS Attack Classification for AMI Smart Meter Networks in Smart Grid Environments

This article introduces a multilayer cyber–physical security system to protect advanced metering infrastructure (AMI) networks from growing cyber threats, integrating detection, control, communication security, and edge deployment. Key contributions of this article comprise anomaly detection using long short-term memory (LSTM) with multilayer perceptron (MLP) for classification of normal and attack data, achieving an average accuracy of 98%, and multiclass classification using attentive interpretable tabular learning (TabNet) with MLP, achieving an average of 95% accuracy across multiple datasets. Adversarial machine learning (evasion attacks) were tested with logistic regression and CatBoost, with logistic regression maintaining 98.49% accuracy under adversarial conditions. The models were deployed on PYNQ-Z2 and Coral Dev TPU boards, achieving 660 and 15~μ s per instance, respectively. A hybrid encryption mechanism leveraging advanced encryption standard-Galois counter mode (AES-GCM) encryption, module-lattice key encapsulation mechanism (ML-KEM), honey fallback, and hash-based message authentication code (HMAC) is proposed, with ciphertext-plaintext correlation of 0.14 and Shannon entropy of 6.87, ensuring quantum-resistant, secure communication. In addition, dynamic rate limiting and IP blacklisting offer real-time distributed denial-of-service (DDoS) attack mitigation, and zero-knowledge proofs (ZKPs) reassure privacy and verifiability in anomaly detection. The framework displays exceptional performance, scalability, and robustness, making it a practical solution for securing AMI networks against a wide range of cyber threats.