Defense Strategy Against Cyber Attacks on Substations Considering Attack Resource Uncertainty

With the rapid integration of communication and information technology into substations, the risk of cyber attacks has significantly increased. Attackers may infiltrate sub-station networks, manipulate switches, and disrupt power lines, potentially causing severe damage to the power system. To minimize such risks, this paper proposes a three-layer defender-attacker-defender (DAD) model for optimally allocating limited defensive resources to substations. To model the uncertainty surrounding the knowledge of defender of potential attacks in real-world scenarios, we employ a fuzzy analytic hierarchy process combined with the decision-making trial and evaluation laboratory (FAHP-DEMATEL). This method accounts for the attack resource uncertainty by utilizing intelligence data on factors potentially influenced by attackers, which serves as an evaluation metric to simulate the likelihood of various attack scenarios. These uncertainty probabilities are then incorporated into the substation DAD model consisting three layers of agents: the decision-maker., the attacker, and the operator. The decision-maker devises a defense strategy before the attack, while the attacker aims to identify the strategy that causes the maximum load loss. Meanwhile, the operator seeks to minimize the load loss through optimal power flow scheduling. To solve the model, the original problem is transformed into a two-layer subproblem and a single-layer master problem, which are solved iteratively using a column-and-constraint generation algorithm. Case studies conducted on the IEEE RTS-96 system and the IEEE 118-node system demonstrate the effectiveness and practicality of the proposed model. Comparative experiments further highlight the advantages of the proposed model.