# A Comprehensive Analysis of Smart Grid Systems against Cyber-Physical Attacks
## 7 Resource Allocation in the Smart Grid
### System Description  
Agent: The defender is the only agent in the system. Although there could be multiple defenders trying to protect the system, we consider only one defender that abstracts all other defenders. The main goal of the agent is to patch all the cyber functions of the SG. The defender has no idea of the state of the system. He/she should scan (perform vulnerability assessment) the nodes to know their vulnerability status and perform patching (remove those vulnerabilities by updating the secure version of a software). We have not considered an attacker in this work. Instead, we specify the function states as Hacked. The agent has two actions for each node X: scan-X and patch-X. Since we have seven nodes in the system (according to Section 5.2), there are 14 total actions (for this section, consider S5 as vendor specifc head and S6 as MDM, rest is unchanged).  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Cyber Components** & **PoC** & **Likelihood** & **Consequence** & **Risk** \\ \hline Smart Meter Collector & 0.6644 & Likely & Minor & E \\ Smart Meter & 0.5880 & Possible & Minor & E \\ Billing Engine & 0.3588 & Unlikely & Insignificant & L \\ Smart Meter Head & 0.4983 & Possible & Insignificant & L \\ Vendor Specific Server & 0.6489 & Likely & Insignificant & H \\ MDM & 0.4786 & Possible & Minor & E \\ OMS & 0.1484 & Rare & Major & E \\ ECC & 0.1157 & Rare & Major & E \\ \hline \hline \end{tabular}
\end{table}
Table 5: Risk levels of the cyber components of the smart grid. MDM, Meter Data Management; OMS, Outage Management System; ECC, Electricity Control Center; PoC, Probability of Compromise.  
System Description: Function Bayesian Network (FBN) built in the BAGS represents the state of the system. In order to discover the set of vulnerabilities of a node, SA must perform the vulnerability assessment. From the vulnerabilities discovered, BAGS computes the probability of compromise for each function using the CVSS score [39]. A function can stay in any one of the following states: [Unknown, Vulnerable, Hacked, Patched]. The initial state (s\({}_{\text{i}}\)) of the system is when all the functions' status is Unknown. SA does not know the status of any function. The terminal states (s\({}_{\text{t}}\)) of the system are as follows: (1) Terminal State 1: all functions' status is Patched and, (2) Terminal State 2: Function S7 is Hacked.  
State Transition and Rewards: Table 6 represents how the status of the function changes and what rewards SA will receive for acting. If SA performs the scan function and the previous status of the function is Hacked, the new status will remain Hacked. SA receives \(-200\) rewards since it is a bad move. If the previous state is Unknown, with a random distribution, we decide whether it is Patched, Vulnerable or Hacked. If it is Patched, SA receives zero rewards because it was not worth scanning it, and if it turns out to be Vulnerable or Hacked, SA receives function importance rewards. If SA performs Patch function and the previous status is Hacked or Vulnerable, the next status will be Patched. It is possible that a node which is in the Patched state can be found in the Vulnerable or Hacked state.  
Function Significance: The functional significance is precomputed in the system, and it changes with the change in one of the following factors: (1) Asset Value (AV), (2) Rate of Occurrence (RO) of attacks, (3) Risk Exposure (RE), (4) Probability of Compromise (PoC), (5) Influence Of Function (IOF) and (6) Cost (C). For more details, refer to [14]. If the PoC is not known, we can remove it from the equation and compute importance based on other parameters that are assigned by SA based on his/her experience and the system's historical attack data. The reward of a function f is represented by:  
\[\text{Importance(f)}=\text{AV}\ ^{*}\ \text{RO}\ ^{*}\ \text{RE}\ ^{*}\ \text{PoC}\ ^{*}\ \text{IOF}\ -\ \text{C} \tag{2}\]