## 5 Build an Optimal Security Strategy
### Framework of RODE
When the population size is large enough, the reinforcement learning in RODE can speed up the convergence rate; when the population size is relatively small, the opposition-based learning in RODE can increase the diversity of the population, thereby improving the ability to jump out of the local optimal solution and avoid the situation of premature convergence. A simplified water distribution system is used to validate the RODE algorithm. The experimental results show that the algorithm has better robustness than other algorithms of the same type, and it can find the optimal security strategy accurately and quickly. At present, our research is suitable for policy construction before the attack to minimize the loss of the attack, but it still has great shortcomings in dealing with the dynamic attack problem. To this end, in the future, we work on combining the RODE algorithm with policy selection in the face of dynamic attacks. Conceptualization, D.Z. ; methodology, Y.Y. ; software, Y.Y. ; validation, L.X. and Y.Z. ; formal analysis, L.X. and Y.Z. ; writing--original draft preparation, Y.Y. ; writing--review and editing, L.X. All authors have read and agreed to the published version of the manuscript. This work was supported by the National Key Research and Development Project of China (2020 AAA0107700), the National Natural Science Foundation of China (62172244), the Shandong Provincial Natural Science Foundation (ZR2020 YQ06, ZR2021 MF132), and the Young innovation team of colleges and universities in Shandong province (2021 KJ001). Not applicable. ## Conflicts of Interest: The authors declare no conflict of interest. ## Appendix A

## References

* [PERSON] and [PERSON] (2011) [PERSON]; [PERSON] Lessons from Stuxnet. _Computer_**2011**, _44_, 91-93. Available online: [[https://ieeexplore.ieee.org/abstract/document/5742014](https://ieeexplore.ieee.org/abstract/document/5742014)]([https://ieeexplore.ieee.org/abstract/document/5742014](https://ieeexplore.ieee.org/abstract/document/5742014)) (accessed on 17 September 2022). [CrossRef]
* [PERSON] (2016) [PERSON] Analysis of the cyber attack on the Ukrainian power grid. _Electr. Inf. Shar. Anal. Cent. (E-ISAC)_**2016**, _388_, 1-29. Available online: [[https://arficautc.org/wp-content/uploads/2018/05/E-ISAC_SANS_Ukraine_DUC_5.pdf](https://arficautc.org/wp-content/uploads/2018/05/E-ISAC_SANS_Ukraine_DUC_5.pdf)]([https://arficautc.org/wp-content/uploads/2018/05/E-ISAC_SANS_Ukraine_DUC_5.pdf](https://arficautc.org/wp-content/uploads/2018/05/E-ISAC_SANS_Ukraine_DUC_5.pdf)) (accessed on 17 September 2022). * [PERSON] et al. (2017) [PERSON]; [PERSON]; [PERSON]; [PERSON] Optimal countermeasures selection against cyber attacks: A comprehensive survey on reaction frameworks. _IEEE Commun. Surv. Tutorials_**2017**, _20_, 1361-1396. Available online: [[https://ieeexplore.ieee.org/abstract/document/8169023](https://ieeexplore.ieee.org/abstract/document/8169023)]([https://ieeexplore.ieee.org/abstract/document/8169023](https://ieeexplore.ieee.org/abstract/document/8169023)) (accessed on 17 September 2022). [CrossRef]
* [PERSON] et al. (2018) [PERSON]; [PERSON]; [PERSON]; [PERSON] Virus propagation and patch distribution in multiplex networks: Modeling, analysis, and optimal allocation. _IEEE Trans. Inf. Forensics Secur._**2018**, _14_, 1755-1767. Available online: [[https://ieeexplore.ieee.org/abstract/document/8565928](https://ieeexplore.ieee.org/abstract/document/8565928)]([https://ieeexplore.ieee.org/abstract/document/8565928](https://ieeexplore.ieee.org/abstract/document/8565928)) (accessed on 17 September 2022). [CrossRef]
* [PERSON] et al. (2022) [PERSON]; [PERSON]; [PERSON]; [PERSON] Development of a cyberattack response planning method for nuclear power plants by using the Markov decision process model. _Ann. Nucl. Energy_**2022**, _166_, 108725.