Grid Cyber-Security Strategy in an Attacker-Defender Model

This paper uses the Probabilistic, Learning Attacker, Dynamic Defender (PLADD) model to analyze the evolution of cyber-attacks on a power grid infrastructure. PLADD was created to evaluate the effectiveness of moving target defense (MTD) techniques. We utilize the PLADD model to evaluate AND as well as OR configurations for attack scenarios in the power grid. The paper introduces a strategy that can help cyber-security managers optimize their defense strategies. Our analysis of PLADD games in AND and OR configurations provides mathematical proofs and insight into when access controls (such as passwords, internet protocol addresses, session keys, etc.) should be reset to minimize the probability of a successful attack. In particular, we provide a mathematical proof for the OR configuration of multiple PLADD games showing that it is best if all access controls for all of the PLADD games are reset at the same time. We also provide a proof to show that it is best (in terms of minimizing the attacker's average probability of success) for the AND configuration of multiple PLADD games that the resets are equally spaced apart.