# Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System
## 4 Security-Oriented Cyber-Physical Risk Assessment for CPPDS
### Analysis and Calculation of Physical Consequence under Cyberattack
#### 4.3.2 Physical Consequence Calculation
(3) Physical consequences of adjacent switch misoperate  
For SS, assume that a physical fault occurs at its front feeder section. During the fault location and diagnosis, because the fault current is detected by the upstream FRTU and not detected by the downstream FRTU, the two SSs at both ends of the fault feeder are disconnected to isolate the fault. Attackers temper with the measurement data of the downstream FRTU of the fault position to mistakenly detect the fault current. Therefore, the new fault position is located in the downstream feeder section adjacent to the actual fault position. The SSs of the downstream feeder section are disconnected to cut off the fault part. Additionally, the consumers of this feeder section are out of power with type \(b=2\). In addition, due to the fact that the actual physical fault has not been removed, the CB of this feeder will disconnect again and maintain the locking state after reclosing. Therefore, the consumers from the CB position to the actual physical fault are out of power with type \(b=2\). As shown in Figure 5, assume that the attack target is SS 2 and a fault occurs at feeder section 2. According to the above analysis, the fault is mistakenly located at feeder section 3. The consumers on feeder section 3 are out of power with type \(b=2\). The actual physical fault is not removed, so the consumers on feeder sections 1 and 2 are also out of power. It should be pointed out that when calculating the physical consequence caused by a cyberattack, the actual fault consequence need not be included. Similarly, if a fault occurs at feeder section 3, FRTU 2, which should have detected the fault current, does not detect the fault current due to the cyberattack. Thus, the fault position is located at feeder section 2, and the consumers on feeder section 2 are out of power. After the downstream consumers recover power supply by other feeders, the feeder providing the transfer capacity needs to complete another process of fault diagnosis, isolation, and restoration of power supply in nonfault areas due to the remaining existing actual physical fault. The consumers on feeder section 4 of feeder 1 and all consumers on feeder 2 are out of power with type \(b=3\). In conclusion, the total physical consequence of attacking SS is calculated by  
\[ \begin{split} C_{switch,g}&=\sum_{j=g+1}^{N_{f_{ j}}}C_{f_{i},j}^{TR}+\lambda_{f_{i},g}C_{f_{i},g+1}^{TR}+\lambda_{f_{i},g+1}C_{f_{i},g}^{ TR}+\lambda_{f_{i},g}\left(\sum_{j=1}^{g+1}C_{f_{i},j}^{TR}-C_{f_{i},g}^{TR} \right)\\ &\quad+\lambda_{f_{i},g+1}\left(C_{f_{i},g}^{TR}+\sum_{j=g+2}^{ N_{f_{i}}}C_{f_{i},j}^{TR}+\sum_{k=1}^{N_{f_{i}}^{T_{i}}}C_{f_{i},k}^{TR}\right) \end{split}  \tag{17}\]  
In summary, the proposed research framework of a quantitative security risk assessment method for cyberattacks on CPPDS is shown in Figure 6. On the cyber side, we establish a detailed attack model based on the attack graph and vulnerability analysis. Onthe physical side, a physical consequence computation method is proposed. In addition, based on MDP, the risk index can be obtained considering both the cyber reward and the physical reward during attacking. Additionally, considering the attack-defense game, the optimal allocation strategy of the defense resource is obtained by our proposed method.