# Security-Oriented Cyber-Physical Risk Assessment for Cyberattacks on Distribution System
## 4 Security-Oriented Cyber-Physical Risk Assessment for CPPDS  
### Risk Assessment Based on MDP  
Attackers mainly exploit the security vulnerability to invade the information equipment and obtain the authority of the corresponding functional nodes so as to continuously penetrate the information system of CPPDS. Experienced hackers further exploit the vulnerabilities of the communication protocol to tamper with the control instructions and destroy the normal operation of the IEDs, resulting in the power failure of the distribution system. Therefore, we called it cross-domain attack from the information domain to the physical domain. Generally, each cyberattack path is composed of an escalating series of malicious actions by the attackers. In order to elaborate the cyberattack path, an information model composed of logic nodes for the slave distribution station is built. The corresponding logical node functions and the information flow are illustrated in Figure 3. It is usually necessary to execute a multistep attack to achieve the final purpose. Adversaries first exploit the security vulnerabilities of monitor host, remote interface, or terminal devices to obtain the control authority. Then they further exploit the protocol vulnerabilities to affect the functions of logical nodes and realize the transfer of control states so as to sabotage the fault location, isolation, and service restoration (FLISR). To enumerate all possible attack scenarios, based on the above information model, we model the cyberattack process using a discrete Markov decision process [36]. A standard MDP is denoted as a tuple (\(S\), \(A\), \(R\), \(P\), \(\gamma\)). \(S\) is the attack state space. \(A\) is the set of the attack actions of adversarial vulnerability exploitations. For each \(s\in S\), \(A(s)\subset A\) denotes the set of all possible attack actions at state \(s\). \(R\) is the reward function. \(P\) is the transition probability function. \(P(s^{\prime}|s,a)\) denotes that the probability of state \(s\) transferring to state \(s^{\prime}\) when taking an attack action \(a\in A(s)\). \(\gamma\) is the discounting factor, commonly \(0<\gamma<1\). The MDP state transfer graph is built as shown in Figure 4. The red dashed square denotes the final attack target. The initial state \(S_{0}\) is set as 'Attacker', and the final target state \(S_{\text{F}}\) is 'XCBR' or 'XSWI'. The attack entrances include the monitor host, the remote control interface, and the field terminal devices. The yellow circles denote the security vulnerabilities \(v_{i}\), which can be exploited in the cyber network. The blue ellipses denote the logic nodes, which are taken as the intermediate states. The current state may transfer  
Figure 3: Information model of logical nodes for slave distribution station. into the other states when an attack action is taken, namely, exploiting the vulnerabilities. The transition probability, namely, the success attack probability is estimated based on the vulnerabilities that are still unpatched in CPPDS. A more realistic probability model considering the age of vulnerability and the CVSS vulnerability scores is established. CVSS is currently the most widely used vulnerability scoring system. It is part of the secure content automation protocol, and is supported by the US national vulnerability library (NVD). The age of vulnerability is modeled by the Pareto distribution. The CVSS vulnerability scores are adopted from a CVSS system. The transition probability is calculated by [13]  
\[P\big{(}s^{\prime}|s,a_{v_{i}}\big{)}=\left(1-\frac{k}{t_{v_{i}}}\right)^{ \alpha}\times AV_{v_{i}}\times AC_{v_{i}}\times AT_{v_{i}} \tag{1}\]  
where \(t_{v_{i}}\) is the age of the vulnerability \(v_{i}\), which is calculated by the released date of CVSS scores. \(AV_{v_{i}}\), \(AC_{v_{i}}\), and \(AT_{v_{i}}\) represent the attack vector, attack complexity, and authentication of \(v_{i}\), respectively.