A substation network resilience assessment method under attack and defense game

Abstract

The present invention discloses a method for evaluating the network resilience of a substation under an attack and defense game, comprising the following steps: obtaining the target node of the substation that is attacked and performing an importance evaluation to obtain the node importance; obtaining the average damage loss of the target node, and constructing a substation network attack and defense game model based on the node importance and the average damage loss; allocating defense resources to the target node based on the substation network attack and defense game model, and performing iterative processing until the game Nash equilibrium state is reached, thereby completing the evaluation of the substation network resilience. The network resilience evaluation method of the present invention is timely, and each time the substation network suffers a damage attack, a new attack and defense game strategy will be implemented and defense scheduling will be performed. This dynamic evaluation method helps to steadily improve the resilience of the substation network, and also provides more sufficient preparation time for defense scheduling.

Description

Technical Field

[0001] The present invention belongs to the technical field of substation network resilience assessment, and in particular relates to a substation network resilience assessment method under attack and defense game. Background Art

[0002] Substations are a crucial component of power cyber-physical convergence systems. They house both ICT-based computer network infrastructure and numerous physical devices from the primary and secondary power grid systems. Substation network security is crucial for ensuring the stable operation of power systems. The security situation in China's power system is severe, with the average daily number of attacks increasing year by year. A method for assessing substation network resilience is urgently needed.

[0003] With the rapid development of communication networks, cyberattacks are becoming increasingly complex. Destructive cyberattacks exploit opportunistic communication between nodes to attack network nodes, causing them to fail in a short period of time. This poses significant challenges to network security protocol design and network data processing. Scientifically and effectively assessing the damage of target nodes has long been a key focus of cybersecurity assessment research both domestically and internationally. With the advancement of network information-based reconnaissance equipment, diverse reconnaissance methods have enabled faster and more accurate investigations of link damage, network traffic volume, and node connectivity, providing more comprehensive insights and improving substation network resilience. However, with the increasing amount of information available on both sides of the cyberattack game, cyberattack and defense are no longer simply technical confrontations, but rather information games. Attacks often target vulnerable network nodes, making them more subtle and difficult to assess their damage effectiveness, posing a serious threat to substation network security.

[0004] Existing network node resilience assessment methods only consider network node resilience under static conditions, and do not consider the impact of resource allocation and tactical changes in the substation attack and defense process on node resilience. They do not flexibly consider the game process from the perspective of both the network attacker and the defender, resulting in a possible gap between the resilience assessment results and actual needs. Existing node resilience assessment methods only consider the attributes of the target node itself, but do not consider the recovery ability and degree of damage after the target is damaged, resulting in low accuracy of the assessment results. Existing substation-oriented network resilience assessment methods fail to consider the game interests of the substation network attacker and defender, and only consider the network resilience assessment results obtained under the substation's own defense conditions, making it difficult to be objective. After the node resilience assessment is performed, there is a lack of corresponding attack risk level classification standards and effective recovery measures.

[0005] Therefore, it is urgent to propose a substation network resilience assessment method under attack and defense game. In the resilience assessment, the resilience of network nodes under different recovery conditions is evaluated according to the functional characteristics of the substation network and historical attack and defense results, and the optimal defense strategy is obtained by using limited defense resources, providing more reasonable and practical decision-making guidance for the defense operations of the power network. Summary of the Invention

[0006] The purpose of the present invention is to provide a substation network resilience assessment method under attack and defense game. By establishing a substation network attack and defense game model based on the substation network nodes, setting the node importance and damage loss amount, considering the primary and secondary system characteristics of the substation and the defense resource cost, the network attack damage degree and the recovery ability of the target node after damage are analyzed, so that the resilience assessment results are more in line with the actual functional status of the substation network, timely preventing the direct impact and potential risks caused by network attacks, and enhancing the resilience of the substation network to solve the problems existing in the above-mentioned existing technologies.

[0007] To achieve the above objectives, the present invention provides a method for evaluating substation network resilience under an attack-defense game, comprising the following steps:

[0008] Obtain the target nodes of the substation under attack and perform importance assessment to obtain the node importance;

[0009] Obtaining the average damage loss of the target node, and constructing a substation network attack and defense game model based on the node importance and the average damage loss;

[0010] Based on the substation network attack and defense game model, defense resources are allocated to the target node, and iterative processing is performed until the game Nash equilibrium state is reached, completing the assessment of the substation network resilience.

[0011] Optionally, the process of obtaining node importance includes: setting an evaluation cycle for substation network resilience based on target node characteristics, historical attack records, and frequency of attacks; obtaining the cumulative number of times the target node was attacked in the previous evaluation cycle before this evaluation cycle, and the minimum number of times the target node was attacked in the historical evaluation cycle, and subtracting them to obtain a first difference; obtaining the maximum and minimum number of times the target node was attacked in the historical evaluation cycle, and subtracting them to obtain a second difference, multiplying the second difference by the total number of target nodes to obtain a product; and obtaining the node importance of each target node based on the ratio of the first difference to the product.

[0012] Optionally, the process of obtaining the average damage loss of the target node includes: dividing the attack risk level coefficient based on the degree of damage suffered by the target node; and obtaining the average damage loss of each target node based on the attack risk level coefficient of each target node, the cumulative number of attacks suffered, and the total number of target nodes.

[0013] Optionally, the process of constructing the substation attack and defense game model includes: constructing a strategy set for both the attacker and the defender based on the node importance of each target node; obtaining the strategy benefits for both the attacker and the defender based on the average damage loss of each target node; solving the Nash equilibrium state of the game based on the strategy set and the strategy benefits of both the attacker and the defender, thereby completing the construction of the substation attack and defense game model.

[0014] Optionally, the process of constructing the attack and defense strategy sets includes: obtaining the attack selection probability of each target node and constructing the attack strategy set; constructing the defense strategy set based on the node importance of each target node; and obtaining the attack and defense strategy sets based on the attack strategy set and the defense strategy set.

[0015] Optionally, the process of obtaining the strategic benefits of both the attacker and the defender includes: obtaining the probability of the target node being undefended, the probability of the target node being attacked and selected, and the overall loss of the substation network; obtaining the attacker's benefit based on the target node being undefended, the target node being attacked and selected, and the overall loss of the substation network; obtaining the defender's defense loss based on the attacker's benefit, and thus obtaining the strategic benefits of both the attacker and the defender.

[0016] Optionally, the process of obtaining the target node undefended probability includes: obtaining the target node undefended probability based on the damage probability of the target node when it does not obtain enhanced defense resources, the defense action factor of the unit defense resource and the node importance of the target node.

[0017] Optionally, the process of solving the Nash equilibrium state of the game includes: the attacker selects the optimal target node to attack to obtain maximum benefit, and the defender obtains minimum defense loss through optimal allocation of defense resources; based on the maximum benefit and minimum defense loss, the game Nash equilibrium state is reached.

[0018] Optionally, the process of evaluating the resilience of the substation network includes: evaluating the resilience of the substation network based on the substation network attack and defense game model, obtaining the damage loss of the target node in this attack based on the node importance of the target node, and then obtaining the importance in this attack and defense game; sorting the importance in this attack and defense game, and allocating defense resources to each target node based on the order of high and low, and performing iterative processing until the game Nash equilibrium state is reached.

[0019] Optionally, the process of evaluating the substation network resilience also includes: in the game Nash equilibrium state, the iteration ends when the defense cost reaches the upper limit or the number of iterations reaches the preset number, and the substation network resilience under the optimal defense strategy is obtained based on the final iteration result to complete the evaluation of the substation network resilience.

[0020] The technical effects of the present invention are:

[0021] Based on the historical attacks on substation network nodes, the present invention establishes an attack and defense game model for the substation network, obtains the importance of each node in the Nash equilibrium state, and then realizes global defense resource scheduling. It takes into account both the characteristics of each node and the security requirements of the global network. After repeated iterations, it gives more important network nodes appropriate defense resources, reduces the waste of defense resources and enables the substation network to achieve optimal network resilience.

[0022] The network resilience assessment method of the present invention is timely. Every time the substation network suffers damage, a new attack and defense game strategy will be implemented and defense scheduling will be carried out. This dynamic assessment method helps to steadily improve the resilience of the substation network and also provides more sufficient preparation time for defense scheduling. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The accompanying drawings, which constitute part of this application, are intended to provide a further understanding of this application. The exemplary embodiments and descriptions of this application are intended to explain this application and do not constitute an improper limitation on this application. In the accompanying drawings:

[0024] Figure 1 A flowchart of a method for constructing a network attack and defense strategy game model in an embodiment of the present invention;

[0025] Figure 2 Schematic diagram of the substation network resilience assessment process in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] It should be noted that, in the absence of conflict, the embodiments and features of the embodiments in this application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0027] It should be noted that the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and that, although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0028] Example 1

[0029] This embodiment proposes a substation network resilience assessment method under an attack and defense game, which can improve the power network's ability to resist external attacks and disturbances, as well as its recovery ability after damage. This embodiment is used in a substation network attack and defense game scenario to study the dynamic attack and defense game strategy after each substation network attack that causes damage. First, the importance of the substation network nodes is evaluated, and then a substation network attack and defense game model is established to solve the Nash equilibrium state of the attack and defense strategy game. From the two perspectives of attack protection and damage recovery, a substation network damage resilience assessment method is established, which can provide a more objective and complete decision-making basis for the effective defense and rapid recovery of the substation network.

[0030] In this embodiment, each node that could potentially cause damage to the substation network is targeted for cyberattacks. By quantifying these indicators, the importance of network nodes in historical attack-defense games is determined. Attack risk levels are then categorized to determine the average loss suffered by the nodes. Starting from the attributes of network nodes in this cyberattack scenario, the global substation network attack-defense game is studied. Based on the substation network attack-defense game model, the most likely Nash equilibrium state for both attackers and defenders is determined. Limited resources are then prioritized to defend against target nodes with the highest threat and the greatest damage losses in this attack-defense game, taking into account both defense and recovery costs. This ensures that resource allocation achieves or approaches a Nash equilibrium state, thereby improving the resilience of the substation network.

[0031] The specific process of this embodiment is as follows:

[0032] Step 1: Target each network node that could cause network damage and assess its importance. Determining the importance of network nodes is a crucial prerequisite for assessing substation network node resilience. The greater the importance of a node, the greater its impact on the overall substation network, significantly influencing the target selection of both attackers and defenders. Nodes of varying importance have significantly different probabilities of being attacked. Accurately assessing node importance is crucial for developing objective attack and defense strategies. Otherwise, resource misallocation will occur, reducing substation network resilience.

[0033] By analyzing the characteristics of network nodes and historical attack records, and combining the frequency of substation attacks, we set the substation network resilience assessment period V, collect data on the nodes that have been attacked during the historical assessment period, and calculate the importance of the network node i that may be attacked, i.e., the probability M′. i Make a prediction:

[0034]

[0035] Among them, M i M is the cumulative number of attacks suffered by this type of network node in the previous evaluation cycle before this evaluation cycle. i,maxand M i,min are the maximum and minimum times that this type of node has been attacked in the historical evaluation period, respectively. q is the total number of equivalent nodes of the same type as node i. Since the probability of nodes of the same type being attacked is equal, the probability that each network node may be attacked can be obtained by averaging the attack probabilities of nodes of the same type.

[0036] The degree of damage X suffered by each node in a network attack is divided into three attack risk level coefficients: A, B, and C. The average loss D suffered by each node in this type of attack is estimated based on historical data. i :

[0037]

[0038] where X l is the attack risk level coefficient of the node of this type when it is attacked for the lth time, and e is the cumulative number of attacks suffered by this type of node.

[0039] Step 2: After obtaining the node importance and average damage loss, the attack and defense game strategies will be deduced based on this, and a strategy game model for the attack and defense strategies will be established. The modeling method is as follows: Figure 1 As shown in the figure, the specific modeling process is as follows:

[0040] The three elements of a strategy are clearly defined: the game participants, the attacking and defending strategies, and the payoffs. The game participants are the attackers and defenders of the substation network. The attacking and defending strategies are the equilibrium point of the game after seeking a Nash equilibrium. The strategy set at this point is the optimal counterstrategy chosen by either party based on the other's strategy. The payoffs are the effectiveness of both parties' offensive and defensive objectives under the premise of a zero-sum game.

[0041] Establishing a game scenario: In real-world games, both attackers and defenders base their decisions on valid information, such as their opponent's strategy set and payoffs. Therefore, the game model assumes a fully informed game, where both attackers and defenders possess crucial information, such as each other's strategy set and payoffs. However, the specific attack targets and defense nodes are unknown. This game is static, where the strategy sets chosen by both parties in a given attack and defense game are unknown, and only the strategy sets established before the current game are known. This game is zero-sum, where the gains from attacking a target node are equal to the losses of the defender. Any gain for one party is necessarily accompanied by a loss for the other.

[0042] Establishing a set of attack and defense strategies: In a substation network attack scenario, the attacker first needs to obtain the potential benefits of attacking each node in the substation network, the characteristics of each node, and the possible defense strategies that the defender can adopt before launching the attack. For a substation network with n network nodes, the set of strategies G that the attacker can choose can be expressed as:

[0043]

[0044] Where G is the attacking strategy; g i (i=1, 2, ..., n) is the attack selection probability of target node i, and n is the total number of network units.

[0045] The defender optimizes the allocation of limited resources according to the importance of the nodes to minimize its own losses. After completing the relevant information collection work, the formed defender strategy set F can be expressed as:

[0046]

[0047] Where F is the defender's strategy; M' i (i=1, 2, ..., n) Node importance, that is, the ratio of protection resources invested by node i to the total protection resources, and n is the total number of network units.

[0048] The attack and defense benefits of both sides can be described by the probability of network nodes being damaged. The specific benefit (loss) calculation is determined by three parts: the attack selection probability, the defense resource selection, and the damage loss. Therefore, the benefit (loss) calculation for a specific target node in the substation network can be expressed as:

[0049] R i =g i ×p i (M′ i )×D i (4)

[0050] Where: R i is the attack gain (defense loss) of node i, g i is the probability of selecting target node i, p i (M′ i ) represents the probability that the target node is not defended, D i is the average loss caused by damage to node i.

[0051] According to the marginal utility characteristic, as the protection resources of node i increase, the attack benefit (defense loss) of the node will decrease, and the rate of change will slow down. Therefore, the probability of node i being successfully attacked and damaged can be expressed as:

[0052]

[0053] Where: represents the probability of damage to node i when it does not receive enhanced defense resources, and γ is the defense effect factor of unit defense resources.

[0054] When g i =1, which is the inherent damage loss Z of node i when it is attacked.i , which can be expressed as:

[0055] Z i =p i (M′ i )×D i (6)

[0056] In the attack-defense game, the attacker chooses the most suitable target node to maximize the profit, and its profit can be expressed as:

[0057]

[0058] Where: Y G is the attacker's profit, ΔD i is the loss caused by an attack on node i.

[0059] Since the attack and defense game is a zero-sum game, the defense loss of the defender is Y F =-Y G .

[0060] The loss ΔD caused by an attack on node i i Calculated based on the change in the overall loss of the substation network before and after it was damaged:

[0061] ΔD i =D0-D i (8)

[0062] Where D0 represents the loss of the substation network before the attack.

[0063] Solving the Nash equilibrium state of the game: The network attack and defense game is a typical non-cooperative game. Both the attacker and the defender try to maximize their own benefits through strategy selection. The attacker's target node is to obtain the maximum expected benefit by selecting the appropriate attack node. Therefore, the attacker's optimal strategy can be expressed as:

[0064]

[0065] The defender wants to minimize the defense loss by optimizing the allocation of defense resources. The optimal strategy of the defender is expressed as:

[0066]

[0067] Finally, the Nash equilibrium point of static balance is reached, satisfying the following constraints:

[0068]

[0069] Where: g i ″ is the probability of node i being attacked under Nash equilibrium, p i (M″i ) is the probability of node i causing damage under Nash equilibrium.

[0070] Step 3: After obtaining the substation attack and defense game model, the network damage resilience is evaluated. Based on the importance of network nodes, the loss impact of node i being attacked and damaged is studied, and the importance of network nodes in this attack and defense game r is obtained. i , which is calculated as follows:

[0071]

[0072] It is easy to know that when node i is damaged, ΔD i The larger the value, the more important the node is in this game. Therefore, before the attack comes, it is necessary to strengthen ΔD i The network node defense resources with larger values ​​are used, and damage recovery plans and recovery cost budgets are actively designed for them. In the design of damage recovery plans, factors such as human resources, emergency repair equipment, and emergency repair difficulty should be considered. The assessment of the resilience of substation network nodes requires a sufficient number of iterations. Each iteration allocates resources to the node considering the actual status of a node and the global status of the network. Due to the large number of network nodes, a balance state is achieved by performing iterations far exceeding the number of nodes, so that the system resilience reaches the best achievable state. The order of resource allocation is determined by the order of importance. In this game, nodes with high importance are more likely to suffer network damage attacks and suffer greater losses. In the case of limited resources, their defense resource needs must be met first so that their defense resources reach the Nash equilibrium state standard. When the defense resources of the node exceed the Nash equilibrium state, the excess resources are recovered and supplied to subsequent nodes. At the same time, a recovery cost budget is performed, considering the funds and component materials required to restore the normal operation of the network node. The iterative process ends when the defense cost reaches the upper limit or the number of iterations reaches h times. According to the final iterative result, the substation network resilience under the best defense strategy is obtained, and the substation network node resilience assessment is completed. The assessment process is as follows: Figure 2 shown.

[0073] This example focuses on the strategic benefits of both attackers and defenders in a substation network, and establishes a substation network attack and defense game model based on historical attack and defense data. Compared with traditional methods that focus on assessing the network resilience of the defender itself, this significantly improves the objectivity and effectiveness of the assessment.

[0074] This embodiment is based on the existing substation network defense situation and combines the Nash equilibrium state calculated by the network attack and defense game model to prioritize the provision of limited defense resources to more important network nodes, so that the substation network can achieve the best network resilience state that resources can support.

[0075] The network resilience assessment method proposed in this embodiment is timely. Every time the substation network suffers damage, a new attack and defense game strategy will be implemented and defense scheduling will be carried out. This dynamic assessment method helps to steadily improve the resilience of the substation network and also provides more sufficient preparation time for defense scheduling.

[0076] This implementation fully exploits and utilizes historical substation cyber attack data to analyze potential targets and methods of attack by attackers, improving both offensive and defensive capabilities in substation cyberattacks. Gaining an information advantage in cyberattack and defense is crucial. By continuously generating new cyberattack and defense strategies and optimizing cyber defense resources, we can help maintain a more proactive position in future information-based operations.

[0077] The above description is merely a preferred embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included in the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

Claims

1. A method for evaluating substation network resilience under attack and defense game, characterized in that: The following steps are involved: Obtain the target nodes of the substation under attack and perform importance assessment to obtain the node importance; Obtaining the average damage loss of the target node, and constructing a substation network attack and defense game model based on the node importance and the average damage loss; Based on the substation network attack and defense game model, defense resources are allocated to the target node and iterative processing is performed until the game Nash equilibrium state is reached, completing the assessment of the substation network resilience; The process of obtaining node importance includes: setting an evaluation cycle for substation network resilience based on target node characteristics, historical attack records, and the frequency of attacks; obtaining the cumulative number of attacks on the target node in the previous evaluation cycle before the current evaluation cycle, and the minimum number of attacks on the target node in the historical evaluation cycle, and performing subtraction to obtain a first difference; obtaining the maximum and minimum number of attacks on the target node in the historical evaluation cycle, and performing subtraction to obtain a second difference, and multiplying the second difference by the total number of target nodes to obtain a product; and obtaining the node importance of each target node based on the ratio of the first difference to the product; The process of obtaining the average damage loss of the target node includes: dividing the attack risk level coefficient based on the damage degree suffered by the target node; obtaining the average damage loss of each target node based on the attack risk level coefficient of each target node, the cumulative number of attacks suffered, and the total number of target nodes; The process of constructing a substation attack and defense game model includes: constructing a strategy set for both attackers and defenders based on the node importance of each target node; obtaining the strategy benefits of both attackers and defenders based on the average damage loss of each target node; solving the Nash equilibrium state of the game based on the strategy set and strategy benefits of both attackers and defenders, thereby completing the construction of the substation attack and defense game model.

2. The substation network resilience assessment method under attack and defense game according to claim 1 is characterized in that: The process of constructing the attack and defense strategy sets includes: obtaining the attack selection probability of each target node and constructing the attack strategy set; constructing the defense strategy set based on the node importance of each target node; and obtaining the attack and defense strategy sets based on the attack strategy set and the defense strategy set.

3. The substation network resilience assessment method under attack and defense game according to claim 1 is characterized in that: The process of obtaining the strategic benefits of both the attacker and the defender includes: obtaining the probability of the target node being undefended, the probability of the target node being attacked and selected, and the overall loss of the substation network; obtaining the attacker's benefits based on the target node being undefended, the target node being attacked and selected, and the overall loss of the substation network; obtaining the defender's defense loss based on the attacker's benefits, and thus obtaining the strategic benefits of both the attacker and the defender.

4. The substation network resilience assessment method under attack and defense game according to claim 3 is characterized in that: The process of obtaining the target node undefended probability includes: obtaining the target node undefended probability based on the damage probability of the target node when it does not obtain enhanced defense resources, the defense action factor of the unit defense resource, and the node importance of the target node.

5. The substation network resilience assessment method under attack and defense game according to claim 1 is characterized in that: The process of solving the Nash equilibrium state of the game includes: the attacker selects the optimal target node to attack to obtain maximum benefits, while the defender obtains the minimum defense loss through the optimal allocation of defense resources; based on the maximum benefits and minimum defense losses, the Nash equilibrium state of the game is reached.

6. The substation network resilience assessment method under attack and defense game according to claim 1 is characterized in that: The process of evaluating the resilience of the substation network includes: evaluating the resilience of the substation network based on the substation network attack and defense game model, obtaining the damage loss of the target node in this attack based on the node importance of the target node, and then obtaining the importance in this attack and defense game; sorting the importance in this attack and defense game, and allocating defense resources to each target node based on the order of high and low, and iterating until the game Nash equilibrium state is reached.

7. The method for evaluating substation network resilience under attack and defense game according to claim 6 is characterized in that: The process of evaluating the substation network resilience also includes: in the game Nash equilibrium state, when the defense cost reaches the upper limit or the number of iterations reaches the preset number, the iteration ends, and based on the final iteration result, the substation network resilience under the optimal defense strategy is obtained to complete the evaluation of the substation network resilience.

Images