# Research on Power Cyber-Physical Cross-Domain Attack Paths Based on Graph Knowledge
###### Abstract
Therefore, graph knowledge can provide important support for the analysis and quantitative assessment of cyber-physical cross-domain attack paths in power systems. In existing network security research based on graph knowledge, attack graph construction is a popular direction. In existing research, according to the different meanings represented by nodes and edges in the attack graph, attack graphs are divided into two categories: state attack graphs and causal relationship graphs [8]. The nodes in the state attack graph represent the global state of the target network and the attacker, and the directed edges represent the state transitions caused by a single attack behavior [9; 10]. Due to the state space explosion problem, state attack graphs are not suitable for security analysis of large-scale systems. In a causal relationship graph [8; 9], nodes represent system attributes and atomic attacks, and directed edges represent causal relationships between nodes. The causal relationship diagram overcomes the state combination explosion problem of the state attack graph, has better scalability, and can be used for large-scale network security analysis. Most current attack graphs [8; 9; 10] are causal relationship diagrams. Based on the coverage of attack paths in the attack graph, the attack graph can be divided into network attack graphs and sub-attack graphs. The network attack graph displays all possible attack paths in the business scenario, and the sub-attack graph displays only the attack paths related to specific security threats. The network attack graph is suitable for identifying various vulnerability exploitation threats in business scenarios that may affect the security attributes of the business system, and helps to assess the overall security or situation of the business system. However, network attack graphs [9; 10] are often very large and are not suitable for analysis of a specific vulnerability exploitation threat. Sub-attack graphs [11] are suitable for targeted analysis and disposal of specific vulnerability exploitation threats. In specific security analysis scenarios, in view of the different business importance of the system and the impact of factors such as limited resources and cost, it is often necessary to further analyze the various identified vulnerabilities and generate sub-attack graphs corresponding to each vulnerability risk, and finally determine the priority order of vulnerability exploitation threats to reasonably allocate security resources. Most of the above studies carried out attack graph construction and analysis from an attack perspective. The applicability of power cyber-physical fusion systems is not strong due to characteristics such as cross-space, strong coupling, and boundary protection. Attack graph construction and cyber-physical cross-domain attack methods that lack a business perspective and meet the characteristics of power cyber-physical fusion systems. The authors of [12] constructed a dependency graph called an object instance graph into a hypergraph by analyzing system calls, and built a Bayesian network based on the instance graph to achieve zero-day attack path characterization and identification. [PERSON] et al. considered the degree of hazard correlation between subsystems and attack paths, analyzed attack paths and determined the priority of the paths, which were used to discover and analyze attack paths in interconnected cyber-physical systems of equal scale in the real world [13]. The authors of [14] applied risk flow to represent the network and attack scenarios, and then fed it to the network flow model to calculate the risk flow. Finally, a dual-objective ranking algorithm was used to automatically infer the priority of the risk transmission path and perform fuzzy comprehensive evaluation to determine the risk severity.