In this paper, we propose an efficient and lightweight attack detection mechanism for a smart grid Neighborhood Area Network (NAN) that combine between distributed and centralized intrusion detection. A NAN includes the customers' appliances, smart meters and collectors. The smart meters measure the power consumption of each appliance and the collectors aggregate the measures and forward them to the control center for analysis. Intrusion Detection System (IDS) agents, proposed in our framework, run in a distributed fashion at smart meters level and in a centralized fashion at collector and control center nodes. A combination between a rule-based detection and a learning algorithm for training and classification is proposed to detect intruders that want to either inject false measurements or exhaust the energy of the grid, or inject Denial of Service (DoS) attacks. Simulation results confirm that our intruder detection framework outperforms the current cyber detection mechanisms since these sophisticated attacks are detected with efficient energy consumption.