Inclusion of SCADA Cyber Vulnerability in Power System Reliability Assessment Considering Optimal Resources Allocation

With sufficient resources, attackers might be able to intrude into multiple substation-level networks of the supervisory control and data acquisition (SCADA) system and send fabricated commands to the local field devices. In this paper, cyberattacks against the SCADA system in the substations of the power system are modeled by a modified semi-Markov process (SMP). The optimal allocation of offensive and defensive resources is modeled as a Colonel Blotto game, and the probabilities of successful cyberattacks on 24 substations are calculated. With the optimal allocated resources, the mean time-to-compromise (MTTCs) of cyberattacks on each substation are calculated, and the loss of load probabilities (LOLP) and expected energy not supplied (EENS) are estimated with the IEEE reliability test system 79 (RTS79). When more offensive or less defensive resources are allocated to the targets, the probabilities of breaker trips resulted by the cyber attacks are increased, less MTTCs are needed on each substation and the power system becomes less reliable.

I. Introduction

As the information and communication technology (ICT) is being more widely applied to the power system, real-time communication will be realized among the cyber networks of the power system with higher efficiency. However, the cybersecurity of power systems will be impacted as more cyberattacks may occur in the supervisory control and data acquisition (SCADA) system of power grids [1]. Malicious code such as Stuxnet has successfully intruded into the industrial SCADA system and resulted in severe impacts [2]. As more zero-day vulnerabilities are being exploited, attacks may be launched against control systems without being detected on time, which will bring more serious impacts to the power system. For instance, the advanced persistent threat (APT) takes advantage of the zero-day vulnerabilities and social engineering to gain the access to a target network, and the attacker then covertly resides in the network and plans for attacks [3]. With the successful intrusions into the control system of the power grid, undesirable impact may be caused on the power system, which can be reflected by the reduced asset resource for the compromised target. Since the aim of the attacker is to maximize the loss and the defender of the power system is to minimize the loss, different resource allocation strategies can be created by attackers and defenders. In [4], a strategic model of the defensive resource allocation is proposed, and it is found that the defender prefers to allocate the resource in a centralized manner when the equilibrium is achieved. A zero-sum game between terrorists and defenders is modeled in [5]. The resources of the attacker and defender are allocated following the minimax theorem, and the probabilities of the optimal attack are calculated. And in [6], a competitive defender and attack risk model is proposed based on the model of the optimal resource allocation in [5], it improved the model by considering a dual exponential relationship between the resources of the defender and attacker allocation, and the network risk is minimized.