# Research on Power Cyber-Physical Cross-Domain Attack Paths Based on Graph Knowledge
## 3 Method for Constructing Attack Graph of Electric Power Cyber-Physical Fusion System
### Cascading Failure Analysis  
In the traditional sense, cascading failure refers to any unexpected event that triggers system components to continuously exit operation without control [22]. Its main feature is that there is a causal relationship between the fault events in the time sequence. However, with the advancement of digital technology and the transformation of the energy system, the source, grid, load, and storage of the new power system are coordinated and interactive, the dynamic interaction of information flow and energy flow is frequent, and the cyber-physical space coupling is enhanced. Attackers can launch cyber-physical cross-domain attacks to trigger a series of spatiotemporally coordinated power failures on multiple power nodes, forming a cascading failure across the information domain and power domain, \begin{table}
\begin{tabular}{c c c} \hline \hline
**Index** & \multicolumn{2}{c}{**Comprehensive Assessment**} & \(\Delta\mathrm{s}\) \\ \hline \multirow{3}{*}{Attack impact} & GN & Constant value, 0.257, interval fixed value, 0.598, flexible fixed value, 0.892. \\ \cline{2-3}  & CJ & Control, 0.327, acquisition, 0.654, transparent transmission, 0.132. \\ \cline{2-3}  & JO & One-to-many, 0.172, many-to-one, 0.814, many-to-many, 0.743. \\ \hline \multirow{3}{*}{Number of fault occurrences} & Less than 7 times a week & 0.2 \\ \cline{2-3}  & Less than 15 times a week & 0.5 \\ \cline{1-1} \cline{2-3}  & More than 21 times a week & 0.7 \\ \hline \hline \end{tabular}
\end{table} 
Table 1: State transition probability between intermediate vertices. destroying the stable operation of the power system. The authors of [23] give the definition of cross-domain cascading failures. **Definition 1**. : _The attacker launches a network attack against a certain information space node of the electric power cyber-physical fusion system, and uses the coupling characteristics of the cyber-physical fusion system to destroy the operation of the secondary power system. This causes disturbances or cascading failures in the power primary system, and ultimately forms a sequence of attack behaviors spanning the information domain and the physical domain._  
**Definition 2**. : _The attack path refers to the attack sequence composed of the state nodes and action nodes in the probabilistic attack graph arranged according to a certain causal dependency relationship, recorded as \(\mathsf{path}(\mathsf{s}_{0},\,\mathsf{g})=\{\mathsf{s}_{0},\,a_{1},\,\mathsf{s }_{i},\,a_{j},\,\ldots,\,\mathsf{g}\}\). Among them, \(\{\mathsf{s}_{0},\mathsf{s}_{i},\ldots,\mathsf{g}\}\) represents the attack state transfer sequence and \(\{\mathsf{a}_{1},\mathsf{a}_{j},\ldots,\mathsf{a}_{n}\}\) represents the atomic attack behavior sequence. The probabilistic attack graph is a set containing multiple attack paths; that is, \(\mathsf{P}\mathsf{G}=\left\{\mathsf{p}\mathsf{d}h^{k}(\mathsf{s}_{0},\, \mathsf{g})\right\}\). Among them, represents the attack path numbered \(k\) from the initial state \(\mathsf{s}_{0}\) to the termination state \(\mathsf{g}\) of \(\mathsf{p}\mathsf{d}h^{k}(\mathsf{s}_{0},\,\mathsf{g})\)._  
Therefore, from the definitions of cascading faults and attack paths, it can be seen that cascading fault attack sequences and attack paths across the cyber-physical space have equivalent characteristics. For the convenience of analysis, this article uses cascading failures as attack paths to analyze subsequent chapters. On the one hand, electric power physical nodes such as power stations and substations need to provide energy flow to the information space system to provide operational support. On the other hand, information nodes such as control systems and measurement and control terminals need to provide information flows to the power system to achieve control. This paper uses the load-capacity model proposed by [PERSON] et al. to analyze the cascading failures of power systems caused by cyber-physical cross-domain attacks [24].