Abstract:Cyber vulnerabilities become ever more critical in modern industrial systems since the attacker can utilize the vulnerabilities to degrade their performance or even cause disasters. In 2015, a series of sequential and well-organized cyber attacks intruded into the Ukrainian power grid, compromised access to the control system, and interrupted the power supply system, finally causing a widespread power outage. To assist the defender, e.g., power grid operator, to allocate protection resources against cyber attacks, existing studies have devoted considerable efforts to risk and reliability analysis and interaction analysis using game theory. The defender's protection strategy includes preevent defense strategy and postevent repair strategy. The strategy spaces of both players were static in previous studies. However, facing Ukrainian-style cyber attacks, the strategy spaces could variate during the attacker–defender confrontation. In other words, the vulnerability compromised by the attacker in one stage could expose the subsequential vulnerabilities, leading to the change of strategy spaces. In this work, a multistage attack–defense graph game model is proposed to assist the defender in allocating protection resources optimally against sequential cyber attacks during multiple stages. In addition, we consider the existence of the rationality evolution of the attacker, which mainly results from asymmetric information, capacity limitation, and progressive learning during the confrontation. Compared to previous studies based on static strategy spaces and static rationalities, our model is more practical and effective in dealing with Ukrainian-style cyber attacks. The simulation results show the superiority of our approach, and some notable observations and practical suggestions are summarized for the defender.

Defending a Cyber System with Early Warning Mechanism

How Effective Are the Prevailing Attack-Defense Models for Cybersecurity Anyway?

Evolving Defense Mechanism for Future Network Security

Cascading Failures of Power System with the Consideration of Cyber Attacks.

Proactive Security Defense of Dynamic Network

Cyber Protection for Malware Attack Resistance in Cyber-Physical Power Systems

Risk Assessment and Defense Resource Allocation of Cyber-Physical Distribution Systems under Denial-of-Service Attacks

Optimizing Active Cyber Defense

Dual-structural network of active defense

Monitoring Network And Defending Against Worm Attacks

Dynamic defenses in cyber security: Techniques, methods and challenges

Secure Strategy Design for Networked Control Systems under Multiple Cyber-attacks over a Multi-channel Framework

Approach to Early Detection and Defense Against Internet Worms

Mitigating the Risk of Advanced Cyber Attacks: The Role of Quality, Covertness and Intensity of Use of Cyber Weapons

Design for Dual Network Defense System

Multistage Attack–Defense Graph Game Analysis for Protection Resources Allocation Optimization Against Cyber Attacks Considering Rationality Evolution

An Active Cooperation Defense Model for Large Scale Network

Modeling Network Systems under Simultaneous Cyber-Attacks

Robust Substation Enhancement Strategy for Allocating the Defensive Resource Against the Cyber-Attacks on IEDs

Optimal Strategy for Cyberspace Mimic Defense Based on Game Theory

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN