基于马尔可夫决策过程的变电站网络安全攻防策略

Research on Attack and Defense Strategy of Substation Network Security Applying Markov Decision Process

考虑到在越来越复杂的网络安全环境中变电站的防御能力对于维持电网安全稳定运行具有重要意义,文章提出了一种基于马尔可夫决策过程(Markov decision process,MDP)的变电站网络攻/防策略建模方法。首先,介绍了网络攻击的详细步骤并深入分析了成功入侵变电站的可能路径。然后,基于此,分别从攻击者和防御者的视角建立了网络攻击成功的概率模型。最后,在考虑了目标变电站特性的基础上,利用马尔可夫决策过程建模求解攻/防双方的最优行动策略。该方法综合考虑了目标变电站的关键特性、攻/防双方的技术能力,为攻/防双方在电力信息物理系统(cyber-physical systems,CPS)网络安全场景设计中的行为选择提供了理论依据。

Considering that the defense capability of substation is more and more important in maintaining the safe and stable operation of power grid in an increasingly complex network security environment,this paper proposes a method for modeling the attack/defense strategy of substation network on the basis of Markov decision process(MDP).Firstly,the detailed steps of the network attack are introduced and the possible paths of successful intrusion into the substation are analyzed in depth.Then,the probability model of successful network attack is established from the perspective of attacker and defender respectively.Finally,according to the characteristics of the target substation,Markov decision process modeling is used to solve the optimal action strategy of both attack and defense.The method comprehensively considers the key characteristics of the target substation and the technical capabilities of the attack/defense sides,and provides a theoretical basis for the attack/defense of both sides in the behavior design of the power cyber-physical system(CPS)in network security scenario.