# Power Grid Reliability Evaluation Considering Wind Farm Cyber Security and Ramping Events
## 3 Attack-Defense Model of Vulnerability
### System Defense Model  
The contribution of a system defense can be also measured in terms of time. Generally, the defense mechanism of a power system keeps patching the vulnerabilities of the system network. According to Verizon's 2017 Data Breach Investigations Report [24], most organizations complete their vulnerabilities patching in 12 weeks. Each patching process could be presented as two indices: The area under the  
Figure 2: Typical time relationship of attacking capacity.  
curve (AUC) and the percentage completed on time (COT), as shown in Figure 3. The AUC reveals the overall input of defense progress in 12 weeks, while the COT is the amount of vulnerabilities patched at the cut-off time. Figure 3 illustrates how the vulnerability scan findings of two typical organizations are fixed. The top line represents the performance of an organization with an excellent cyber-defense mechanism. The bottom line is the normal performance of most organizations. As the figure shows, the time feature of vulnerability fixing is similar to a step process. It qualitatively changes after a fixed period, such as the first week and the fourth week. Once the system defense agency patches the vulnerability, the related attack is prevented immediately. In this manner, the defense process of a power system is extracted as a multi-segmented step function, given by (3). According to the investigation of fixing vulnerabilities in [24], four typical system defense parameters are extracted in Table 1. Thus, the security state of system \(S_{a}\) could be described by the difference of attack and defense time as Equation (4), namely the difference of \(F_{a}^{-1}\) and \(F_{d}^{-1}\), which are the results of inverse functions in Equations (2) and (3), respectively. By sampling the times of \(S_{a}=-1\), the probability of cyber-attack can be estimated. For example, if the MTTC is 80 days and the scale parameter of Laplace distribution is 50, the probabilities of a cyber-attack can be estimated as listed in Table 2.  
\[F_{d}(t_{d})=\left\{\begin{array}{ll}\alpha_{0}&t_{d}\leq t_{1}\\ \alpha_{1}&t_{1}<t_{d}\leq t_{2}\\ \alpha_{2}&t_{2}<t_{d}\leq t_{3}\\ \beta&t_{d}>t_{3}\end{array}\right. \tag{3}\]  
\[S_{a}=\text{sgn}\Big{(}F_{a}^{-1}(x)-F_{d}^{-1}(x)\Big{)},0\leq x\leq 1 \tag{4}\]  
where \(F_{d}\) is the probability for the system to fix the vulnerability with time \(t_{d}\). The \(t_{1}\), \(t_{2}\), and \(t_{3}\) are the duration for different stages of the system defense. Generally, the defense capability of a cyber-system changes by a week, a month, and the third month. \(\alpha_{0}\), \(\alpha_{1}\), \(\alpha_{2}\) and \(\beta\) are the probabilities to fix the vulnerability on different stages. \(x\) is the probability of time for attack or defense. When \(S_{a}\) is positive, it means the time of attack is longer than the defense, so the system defense is successful.  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Defense Capability** & \(\mathbf{\alpha}\mathbf{0}\) & \(\mathbf{\alpha}\mathbf{1}\) & \(\mathbf{\alpha}\mathbf{2}\) & \(\mathbf{\beta}\) \\ \hline Weak & 0 & 0 & 0.2 & 0.8 \\ Normal & 0 & 0.2 & 0.2 & 0.6 \\ Good & 0.2 & 0.3 & 0.4 & 0.1 \\ Perfect & 0.7 & 0.2 & 0.1 & 0 \\ \hline \hline \end{tabular}
\end{table}
Table 1: Defense parameters of different systems.  
Figure 3: The performance of vulnerability fixing in a typical system.