# A Comprehensive Analysis of Smart Grid Systems against Cyber-Physical Attacks
## 9 Conclusions  
In this paper, we described the risk assessment methodology for any CPS. The risk assessment methodology depends on the likelihood and the impact of the attack on the CPS. To compute the likelihood of attack, we presented the BAGS tool. BAGS quantifies the PoC of cyber functions (which control various physical processes) of the SG. We incorporate the dynamic nature of system vulnerabilities into a Bayesian Network and use belief propagation to calculate the PoC. To analyze the impact of CPA, we perform transient contingency simulations in the PowerWorld simulator using the IEEE 9-bus model. We evaluated the resilience of the SG in the presence of CPA using the function-based methodology that abstracts the wide variety of attacks and narrows down the focus of analysis on one primary function, which is power delivery.  
Furthermore, we described how CPA originate and what the attack vectors associated with the system are. The area frequency is used as a metric to analyze the system status, and it is used to define the qualitative values for the consequence. We combine the results of the BAGS and transient contingency simulations to determine risk for each cyber function. Risk assessment of each function assists system engineers to understand which system component is most vulnerable and easily compromised, and have a significant impact on the stability of the grid. By combining the vulnerabilities of the cyber system of SG and the impact of attacks on the grid, we provide an in-depth study of risk analysis of the SG. Risk analysis will help engineers to decide the security budget to protect systems. For instance, if cyber systems are vulnerable and likely to get compromised, they have to increase the employee hours to perform vulnerability assessment and patch management. Therefore, the results will help engineers to shape the grid's operational needs.  
We extend the functionality of the BAGS tool to perform optimal resource allocation to secure SG in the presence of attacks using reinforcement learning algorithms (RL-BAGS). We implement two RL algorithms over BAGS, Q-learning and SARSA learning, on the generated BN to learn optimal policies. The results showed that it is possible to learn the policy using model-free RL algorithms. One of the most important parameters is function importance, which must be calculated carefully. We discussed how Q-learning provides an optimal policy by exploiting the best possible action rather than following the current exploration policy, as in the case of SARSA learning. The results of this simulation assist engineers to make an efficient decision subject to budget constraints. Finally, we described some countermeasures to maintain the resilience of SG in the presence of CPA. Power engineers must know the total number of DERs in a given region and the average amount of power generated by them. They should maintain sufficient resources (such as power storage) to mitigate an attack on a certain number of DERs so that the area's frequency never diverge beyond protective thresholds. We hope this comprehensive analysis of SG security assists engineers to protect the grid against future cyber-physical attacks.