# A Comprehensive Analysis of Smart Grid Systems against Cyber-Physical Attacks
## 1 Introduction  
Cyber-Physical Systems (CPS) refer to a generation of systems where physical processes are monitored and controlled from the cyber domain through advanced computation and communication technologies with humans in the loop [1]. The prosperity of any nation is highly dependent on its energy sector: CPS for electricity, petroleum and natural gas. They serve hospitals, military, transportation, the production of goods and many more. CPS of the energy sector are interdependent, for instance, natural gas-operated electric plants that generate power; on the other hand, components of the natural gas plant require power for operation. The advancement of information technology provides the ability to system engineers to control critical physical processes remotely. An activity performed in the cyber domain affects the physical infrastructure or vice versa [2]. For instance, if a system in the cyber domain controls and monitors the pressure of the natural gas in a pipeline and sends commands to change the pressure (increase the pressure via compressor station: physical domain) beyond maximum allowable operating pressure, this may allow gas to leak or destroy the walls of the pipeline, causing an explosion [3]. Motivation: The growing interdependence between the cyber and physical domain has imposed extraordinary challenges on the security of CPS such as the Smart Grid (SG). A Stuxnet-style attack on the U.S. SG could cost $1 trillion to the U.S. economy [4]. Recent attacks on the Ukraine power grid [5] and a U.S. gas pipeline [6] indicate that Cyber-Physical Attacks (CPA) on CPS will be frequent. Such scenarios clearly show how vulnerable CPS are to CPA, and thus, it is crucial to identify, understand and evaluate the resilience of the CPS. Most researchers [7; 8; 9; 10; 11; 12] assess the resilience of SG by considering an adversary controlling a cyber system that controls a physical process. The researchers then perform sensitivity analysis in a power simulator by manipulating a particular power grid functionality on behalf of an adversary. For instance, one can manipulate the power demand and supply to make the area frequency diverge beyond a secure threshold, which destabilizes the underlying power grid [10; 11; 12]. To the best of our knowledge, no tool assists power engineers in monitoring the security status and quantifying the likelihood of the compromise of a cyber component of SG in real-time and guides them to allocate security resources efficiently. We are among the first to present a Bayesian Attack Graph for Smart Grid (BAGS) tool that performs these tasks. Our key contribution is to show how this tool assists power engineers in improving the security status of the cyber domain of the grid. Furthermore, we combine the results of the tool with the results of the transient stability analysis of the power grid (using the function-based methodology) to quantify the overall risk. In this paper, we present a comprehensive study of Smart Grid Resilience (SGR) in the presence of multiple CPA on its distinct functional components. We enlarge the surface area of attack by considering gas pipeline systems that supply fuel to Gas-operated Peaker Plants (GPP). We discuss: (1) the function-based methodology to evaluate SGR [9; 10; 11; 12], (2) Bayesian Attack Graph for Smart Grid (BAGS) to compute the likelihood of the compromise of cyber components of SG [13], (3) the risk analysis methodology, which combines the results of the function-based methodology and BAGS to compute risk for each cyber component and (4) efficient resource allocation using Reinforcement learning on the SG Bayesian graph (BAGS) [14] to compute optimal policies about whether to perform vulnerability assessment or patch a cyber component of SG whose vulnerability has already been discovered. The results and analysis of these approaches help power engineers develop more resilient power systems and improve situational awareness and the response of the system to ongoing CPA.