# Research on Power Cyber-Physical Cross-Domain Attack Paths Based on Graph Knowledge
###### Abstract  
Against the background of the construction of new power systems, power generation, transmission, distribution, and dispatching services are open to the outside world for interaction, and the accessibility of attack paths has been significantly enhanced. We are facing cyber-physical cross-domain attacks with the characteristics of strong targeting, high concealment, and cross-space threats. This paper proposes a quantitative analysis method for the influence of power cyber-physical cross-domain attack paths based on graph knowledge. First, a layered attack graph was constructed based on the cross-space and strong coupling characteristics of the power cyber-physical system business and the vertical architecture of network security protection focusing on border protection. The attack graph included cyber-physical cross-domain attacks, control master stations, measurement and control equipment failures, transient stable node disturbances, and other vertices, and achieved a comprehensive depiction of the attack path. Second, the out-degree, in-degree, vertex betweenness, etc., of each vertex in the attack graph were comprehensively considered to calculate the vertex vulnerability, and by defining the cyber-physical coupling degree and edge weights, the risk of each attack path was analyzed in detail. Finally, the IEEE RTS79 and RTS96 node systems were selected, and the impact of risk conduction on the cascading failures of the physical space system under typical attack paths was analyzed using examples, verifying the effectiveness of the proposed method. graph theory; cyber-physics cross-domain attacks; power cascading failures; risk conduction across space +
Footnote †: journal:  
cyber-physical cross-domain attacks that occur in the information domain clearly affect targets in the physical domain and can cause systemic paralysis of power infrastructure, trigger large-scale power outages, and even endanger national security [2; 3]. In previous years, power systems effectively resisted attack threats from the internet by establishing three deep boundary isolation and protection systems: the internet, the information network, and the control network [4]. However, with the increasing application and development of advanced energy technologies, new power systems are becoming more open, information-physical coupling interactions are becoming more complex, and the boundaries of traditional network security protection are further extended. The network boundary security protection measures based on physical isolation make it difficult to penetrate deeply into the periphery; however, the security responsibility boundary crosses the network region boundary, and security protection based on border protection is difficult to continue to apply. The threat of information-physical cross-domain attacks is greater. Therefore, in recent years, research on power cyber-physical cross-domain attacks has become a hot topic in the industry. The two most typical characteristics of electric power cyber-physical cross-domain attacks are the cross-space characteristics of the path and the temporal causality characteristics of attack load delivery. Therefore, the analysis and evaluation of electric power cyber-physical cross-domain attack paths are the focus of this article. Graph knowledge is a widely used basic theory of vulnerability exploitation analysis, from which concepts such as attack graphs are derived [5]. An attack graph can help analyze the security threats to the power cyber-physical integration system from the perspective of vulnerability exploitation, and is an effective security analysis approach. It takes an attacker's perspective and analyzes the dependencies between vulnerabilities that can be exploited based on the vulnerability information of cyber-physical nodes to find out all possible attack paths [6; 7] so that administrators can take necessary measures to resist security risks. At the same time, research on power cyber-physical network attack paths based on graph knowledge has emerged in the industry.