# Power Grid Reliability Evaluation Considering Wind Farm Cyber Security and Ramping Events
## 3 Attack-Defense Model of Vulnerability  
### Stochastic Model Based on MTTC  
The mean time-to-compromise (MTTC) [12] under a specific condition is defined to represent the average time required for cyber-attacks. The attack could be an exploiting of the vulnerabilities of a target. For a single known/unknown vulnerability, its potential impacts and complexity could be preliminary evaluated by the Common Vulnerability Scoring System (CVSS) [21]. The scores of vulnerabilities have been used as empirical data [12] to evaluate the time for compromising vulnerabilities. When the attack  
Figure 1: The supervisory control and data acquisition (SCADA) network in a wind farm.  
paths of a specific network are determined, the mean time to compromise all the vulnerabilities leading to the goal could be quantified as the time to attack the entire network [16]. The MTTC can be defined as:  
\[MTTC(c)=\frac{\sum_{x_{i}\in X}T(x_{i})p(x_{i}\wedge c)}{p(c)} \tag{1}\]  
where \(T(x_{i})\) is the time for exploiting the vulnerability \(x_{i}\), \(p(x_{i}\wedge c)\) is the probability that the vulnerability \(x_{i}\) which leads to the attack target is compromised, and \(p(c)\) represents the probability that the attack target is reached.  
Though the MTTC model provides a reference for estimating the time of attacks, it is limited by the specific attack graph which is challenging to apply to generic conditions. Additionally, the MTTC does not consider the process of system defense. During the attack, if some of the vulnerabilities are patched by defense software, the cyber-attack will be delayed or prevented. Thus, both the attack and defense process should be considered in estimating the occurrence of attacks. Based on the existing MTTC, a flexible cumulative distribution function (CDF) of attack time is developed for the reliability evaluation. In this paper, the attack and defense process were modeled separately.  
Based on the behavior of attacker, [22] divided the attack process into three different phases. According to the typical attacking process introduced in [22], the relationship between the time and attack capability is shown as Figure 2. For a malicious intrusion, a low-skilled attacker would start by raising the skill level. In the learning phase, the attackers have no threats for the target system. After a period of time, the attackers are ready for documented vulnerabilities and available codes in the standard phase. Their destructive capacity increases exponentially. When all standard attack methods are tested, the attacking process enters a bottleneck phase. In this phase, the attackers must find new solutions and try to exploit unknown vulnerabilities. The whole relationship between time and attack capacity approximately conforms to the Laplace distribution [23]. To represent the time characteristics of a cyber-attack in different stages, the equation for estimating the attack probability spending \(t_{a}\) is proposed as Equation (2). The probability follows a Laplace distribution \(t_{a}\)-\(L(\mu\),\(b)\).  
\[F_{a}(t_{a})=\frac{1}{2}+\frac{1}{2}\text{sgn}(t_{a}-\mu)\Bigg{(}1-\text{exp}(- \frac{\left|t_{a}-\mu\right|}{b})\Bigg{)} \tag{2}\]  
where \(F_{a}(t_{a})\) is the probability for attacker spending \(t_{a}\) to compromise the vulnerability, \(\mu\) is the MTTC provided by the history records, and \(b\) is the scale parameter of Laplace distribution. A smaller \(b\) means a higher probability that \(t>\) MTTC.