Game Attack–Defense Graph Approach for Modeling and Analysis of Cyberattacks and Defenses in Local Metering System

We propose a game attack–defense graph (GADG) approach that integrates the attack–defense graph and the game theory to model and analyze cyberattacks and defenses in the local metering system (LMS). Different from previous studies concentrating on static analyses of cybervulnerabilities, the GADG method considers correlations among these vulnerabilities. Besides, to avoid the uncertainty brought by unilateral analysis, we introduce the game theory for the interaction analysis between the attacker and the defender. The mixed-strategy Nash equilibrium that they finally reach can serve as the input for the inference of system states. We also propose two eliminating algorithms to reduce the complexity of solving mixed-strategy Nash equilibrium on large-scale LMS. In the case study, our GADG model has been conducted on a real LMS, and the results prove its efficiency. This research aims to assist the power company in optimizing the allocation of limited defensive resources, especially specific in attacking steps. Note to Practitioners—This article is motivated by the practical demand of protecting the cybersecurity of the local metering system (LMS), which is a critical subsystem of the smart grid and has been widely deployed to collect and transmit time-stamped information. Different from typical research works on local metering cybersecurity, which focuses on the analysis and identification of cybervulnerabilities, in this study, real experiments considering the interactive scenarios between the attacker and the defender are conducted on the LMS. Based on this, we developed the attack graph to clearly illustrate various cyberattack paths and their corresponding effects. We then applied the game theory model on the attack graph to obtain the optimal attack and defense strategy under each attack scenario. Based on this, the defender, i.e., power company, can optimally allocate limited defense resources among various attacking steps according to our model. The proposed model and method are demonstrated on one exemplar LMS used by our industrial partner China Southern Grid (CSG). Given the generalizability of the proposed model and method, they can be applied to other similar cyber–physical systems.