Advanced metering infrastructure (AMI) is one of the key elements in smart grid, which facilitates the communication of metering data to a substation in one direction and control messages in the reverse direction. Using wireless technologies and communication devices (e.g., smart meters), which are located in the physically insecure places, makes the AMI vulnerable to cyber attacks. In order to ensure the reliability and security of AMI, attack prevention techniques and intrusion detection systems (IDSs) should be in place to protect the AMI communications from malicious attacks and security breaches, respectively. In this paper, we discuss the security requirements and vulnerabilities of AMI and review the existing threat prevention and detection solutions. We propose an IDS for neighborhood area network (NAN) in AMI, taking into account the NAN-specific requirements. Copyright © 2012 John Wiley & Sons, Ltd.