Advanced metering infrastructure (AMI) is the core component in smart grid. Moreover, two-way communication between the user and the power utility is realized through AMI. Composition of AMI is described. AMI security requirements are illustrated. The threats on the smart meters, communications network, and data collector are analyzed, respectively. Passive and active defenses are investigated. For the passive defense, the traditional encryption technology has low key transportation security, while the public key infrastructure (PKI) used in the whole smart grid has high cost and long computation time and current ID-based authentication mechanism does not offer mutual authentication between smart meter and smart device. When intrusion detection system (IDS) is deployed on AMI key nodes, it is possible to meet the cost effectiveness and computational efficiency and to make up for the passive security policy.