Regarding the cyber side, the defender can reduce the success probability of cyber attacks against substations by upgrading software, performing routine security checks, and purchasing data monitoring equipment. Especially in view of the fact that each substation improves its own communication network by applying for funds from the utility, and that there is an upper limit on these funds, a discrete allocation scheme of funds is designed in this paper to represent the deployment of defense funds, which is modeled as follows: S C y d = C y d i ∑ i ∈ B C y d i ≤ F C y d , C y d i ∈ 0 , C y d L 1 , C y d L 2 , C y d i ≥ 0 (3)

Regarding the physical side, the defender needs to prevent attacker from bribing substation staff and investigate the illegally installed monitoring devices around the substation to be attacked. Similarly, a discrete allocation scheme of defense funds is given as follows: S P h d = P h d i ∑ i ∈ B P h d i ≤ F P h d , P h d i ∈ 0 , P h d L 1 , P h d L 2 , P h d i ≥ 0 (4)

The set of defense fund deployment strategies for the defender can be determined after considering the allocation of funds for both cyber defense and physical security, which is given as follows: S D = d | d = S C y d , S P h d (5)

As mentioned above, the main form of cyber attacks launched by attackers on the cyber side is the FDI attacks. In order to meet the conditions under which the FDI attacks can be performed, the attack team must hire a certain number of hackers to infiltrate the cyber network and falsify data. In this paper, it is assumed that the attack team pays different hacking service fees according to the skill level of the hired hackers. In view of this, a discrete hacking service fee scheme is designed to model the deployment of attack funds on cyber side, which is expressed as S C y a = C y a i ∑ i ∈ A C y a i ≤ F C y a , C y a i ∈ C y a L 1 , C y a L 2 , C y a i > 0 (6)

To improve the success probability of performing FDI attacks against the AC/DC hybrid transmission system, it is essential to obtain some corresponding information of power grid, such as network topology and power flow data. More importantly, once the attack team obtains the SSH port number and password of measuring equipment in the target substations, it will be very easy to execute a stealthy FDI attack. Therefore, the attack team will spend certain funds to obtain power grid information by bribing substation staff and illegally installing some monitoring devices. Similarly, a discrete monitoring fee scheme is designed to model the deployment of attack funds on the physical side, which is expressed as S P h a = P h a i ∑ i ∈ A P h a i ≤ F P h a , P h a i ∈ P h a L 1 , P h a L 2 , P h a i > 0 (7)

The set of attack fund deployment strategies for the attacker can be determined after considering the allocation of funds for both cyber attacks and physical monitoring, which is given as follows: S A = a | a = S C y a , S P h a (8)

Once two players, the defender and the attacker, have deployed funds in sequential order, the probability of a successful cyber attack can be determined. Regarding the attack on the cyber side, the probability of an attacker successfully attacking the i t h substation consists of the following two items: p C y , i = p B A G , i ⋅ p c o n , i (9)

In this paper, the probability p B A G , i can be calculated by using a Bayesian attack graph model as shown in Figure 2, which can clearly indicate the path of the cyber attack.

In Figure 2, the hackers exploit the vulnerabilities < SSH1, 2>, <log2,3>, and <DB 3,4>, respectively, and get the control right of the substation, namely the right of User (4) in accordance with the <1,2>, <2,3>, and <3,4 > connectivity paths. The corresponding details of each vulnerability are shown in Table 1, and the value of each vulnerability can be calculated quantitatively based on the common vulnerability scoring system (CVSS) (National institute of standards and technology, 2022), which is a method used to provide qualitative measure of severity. In addition, the CVSS also provides a lot of information about each vulnerability, such as impact, attack vector, weakness, or other relevant technical information. The given information can help determine the number from 0 to 10 as the CVSS score, and the larger the number, the higher the severity of the vulnerability.

The final success probability of an attacker falsifying the data of the i t h substation can be obtained from the attack path given in Figure 2, which is modeled as p B A G , i = p S S H ⋅ p Log ⋅ p D B (10)

In this paper, the CVSS score is divided by 10 to implement the normalization as the success probability of a cyber attack, so the p S S H , p Log , and p D B are defined as 8%, 55% and 78%, respectively.

For the connectivity probability p c o n , i , for simplicity, it can be expressed as follows, in which it is assumed that the marginal effect of the funds invested by both the attacker and defender is taken into account: p c o n , i = 0.9 e − C y d i μ + C y a i + 0.1 (11)

It should be noted that the value of μ is related to the number of measurement devices installed in the substation.

Regarding the attack on the physical side, the attacker can not only obtain the basic information of the power grid by monitoring data or bribing staff, but also obtain SSH port information and password of substation. Therefore, we propose the following expression to model the probability of obtaining SSH port and password by non-network intrusion means p P h , i with the marginal effect taken into account: p P h , i = P h a i λ + P h a i ⋅ λ λ + P h d i (12)

It should be noted that the value of λ is related to the strength of the substation security forces.

To sum up, the actual success probability of the FDI attack on the i t h substation can be expressed as p i = 2 arctan p C y , i + p P h , i ⋅ p D B ⋅ p c o n , i π (13)

More specifically, the success probability of the attacker’s FDI attack on the AC/DC hybrid transmission system is the cumulative product of the success probability of the attack on all target substations, which can also be referred to the vulnerability of the power grid under cyber attacks V d , a given as follow: V d , a = ∏ i ∈ A p i (14)

In the Stage 1 and Stage 2, once the deployment strategies of defense and attack funds are determined, the vulnerability of the substation attacked V d , a given in (Eq. 2) becomes a constant term, and the aforementioned GARI can be rewritten as G A R I d ′ , a ′ , l = V d ′ , a ′ ⋅ C l (15)

In this situation, the defender only needs to take some actions in response to the consequence C l in Stage 3. In this paper, the following max-min optimization problem is proposed to model the consequence C l : C l = max A T K   min DEF ∑ Δ P d L ∈ DEF Δ P d L ,   l = A T K , DEF (16)

Since the target of FDI attacks in this paper is the AC/DC hybrid transmission system, the attacker constructs the attack vectors based on AC state estimation to bypass the bad data detector in EMS system. Inspired by the existing FDI attack modeling for AC state estimation (Rahman and Mohsenian-Rad, 2013; Liu and Li, 2016), the corresponding FDI attack vector set A T K is indicated as A T K = Δ P d A , Δ Q d A , Δ V m A , Δ θ A (17)

It should be noted that since the measurement devices in substation cannot measure the phase angle, so the actual attack vector does not contain Δ θ A , which is listed here only to indicate the integrity of the constraint variables. Moreover, the number of attacked substations corresponding to the FDI attack vector cannot exceed n A T K max to ensure the invisibility of FDI attacks.

To ensure that the FDI attack based on AC state estimation can bypass the bad data detector, the attacker must obey the following rules:

1) The voltage magnitude of the generator node cannot be modified;

Based on these rules described above, the FDI attack constraints are indicated as follows: − τ P d , i ≤ Δ P d A , i ≤ τ P d , i i ∈ A − τ Q d , i ≤ Δ Q d A , i ≤ τ Q d , i i ∈ A − τ V m , i ≤ Δ V m A , i ≤ τ V m , i i ∈ A − τ θ i ≤ Δ θ A , i ≤ τ θ i i ∈ A Δ V m A , k = 0 k ∈ A g Δ P d A , k = 0 k ∈ A 0 Δ Q d A , k = 0 k ∈ A 0 Δ V m A , k = 0 k ∈ A e Δ θ A , k = 0 k ∈ A e P a r t L F P d + Δ P d A , Q d + Δ Q d A , V m + Δ V m A , θ + Δ θ A , P g A , Q g A = 0 (18)

The corresponding P a r t L F constraints are specified as P i = V m , i ∑ j = 1 n A V m , j g i j cos θ i − θ j + b i j sin θ i − θ j i , j ∈ A Q i = − V m , i ∑ j = 1 n A V m , j b i j cos θ i − θ j − g i j sin θ i − θ j i , j ∈ A P i = P g , i − P d , i − Δ P d A , i + P l e q , i i ∈ A Q i = Q g , i − Q d , i − Δ Q d A , i + Q l e q , i i ∈ A P l e q , i = 0 i ∉ A e Q l e q , i = 0 i ∉ A e (19)

Similar to the FDI attack vector, the optimal load shedding vector set DEF for the AC/DC hybrid transmission system can be indicated as DEF = Δ P d L , Δ Q d L (20)

Subject to the following constraints: 0 ≤ Δ P d L , i ≤ P d , i i ∈ B Δ Q d L , i ≤ Q d , i , Δ Q d L , i ⋅ Q d , i ≥ 0 i ∈ B V m min ⁡ , i ≤ V m , i ≤ V m max ⁡ , i i ∈ B θ min ⁡ , i ≤ θ i ≤ θ max ⁡ , i i ∈ B S l , i j ≤ S l max ⁡ , i j i , j ∈ B P g min ⁡ , i ≤ P g , i ≤ P g max ⁡ , i i ∈ B Q g min ⁡ , i ≤ Q g , i ≤ Q g max ⁡ , i i ∈ B L F P d + Δ P d A − Δ P d L , Q d + Δ Q d A − Δ Q d L , V m , θ , P g , Q g = 0 (21)

The corresponding L F constraints are specified as P i = V m , i ∑ j = 1 n B V m , j g i j cos θ i − θ j + b i j sin θ i − θ j i , j ∈ B Q i = − V m , i ∑ j = 1 n V m , j b i j cos θ i − θ j − g i j sin θ i − θ j i , j ∈ B P i = P g , i − P d , i − Δ P d A , i i ∈ A Q i = Q g , i − Q d , i − Δ Q d A , i i ∈ A P i = P g , i − P d , i i ∉ A Q i = Q g , i − Q d , i i ∉ A (22)

In this paper, the line commutated converter (LCC) model as shown in Figure 3 is applied to formulate the HVDC transmission line, which is given as follows (Kundur and Malik, 2022): U d ′ = 3 2 π n ′ U ′ cos ⁡ α − 3 π X C ′ I d R e c t i f i e r U d ″ = 3 2 π n ″ U ″ cos ⁡ γ − 3 π X C ″ I d I n v e r t e r cos ⁡ φ ′ = U d ′ 3 2 π n ′ U ′ φ ′ ∈ I   Q u a d r a n t cos ⁡ φ ″ = U d ″ 3 2 π n ″ U ″ φ ″ ∈ I I   Q u a d r a n t P d ′ = U d ′ I d > 0 , Q d ′ = P d ′ tan ⁡ φ ′ > 0   P d ″ = − U d ″ I d < 0 Q d ″ = P d ″ tan ⁡ φ ″ > 0 θ I ′ = θ U ′ − φ ′ ,   θ I ″ = θ U ″ − φ ″ I ′ = 6 π n ′ I d ,   I ″ = 6 π n ″ I d , R d I d = U d ′ − U d ″ (23)

By solving the optimization problem shown in (Eq. 16) under the FDI attack vector constraints as given in (Eqs 18, 19) and the load shedding vector constraints as given in (Eqs 21–23), the optimal solutions, namely the optimal FDI attack vector set A T K * and the optimal load shedding vector set DEF * can be obtained. Once the system loss C l is determined, the GARI shown in (Eq. 15) can be used to assess the risks of the AC/DC hybrid transmission system under FDI cyber attacks.

It should be noted that the FDI attack against the AC state estimation system proposed in this paper is essentially a reconstruction form of partial power flow. According to the rules of generating FDI attack vectors described in Section 2.3, the tampered data and other data in the attack area still meet the power flow constraints, and only some inequality constraints such as voltage magnitude and line capacity are violated in the attack area. From the perspective of power grid dispatcher (the defender), it can be considered that the load changes cause some grid measurement data to exceed the limits. Therefore, the tampered data can bypass the bad data detector and affect the system state estimation.

As the tampered power grid data still meets the power flow constraints, the potential attack selections can be searched through the numerical relationship between power system unknowns and equations. If the number of unknowns in the set of all attacked target substations exceeds the number of equations, the set is considered to be suitable for FDI attacks, that is, a potential attack selection. On the one hand, since the active power, reactive power, voltage magnitude, and phase angle of each attacked target substation node need to be calculated, the number of unknowns N x can be expressed as N x = 4 N A (24)

Moreover, based on the (Eq. 18) and (Eq. 19), as well as the relationship between active power and reactive power of load, the number of the equations N e q can be expressed as N e q = 3 N A + N A g + N A 0 + N A e (25)

In this paper, a depth-first search strategy (DFS) is leveraged to search for the potential attack selections, and if the number of all attacked target substation sets meets N x > N e q , it should be added to the potential attack selection set A P = A 1 , . . . , A i , . . . , A o .

The FDI attack vectors can be constructed based on a given potential attack selection. According to (Eq. 19) and the relationship between active power and reactive power of load, it can be seen that once the active power of each attacked target substation is determined, the other three unknowns can be calculated based on the active power data, and the attack vectors can be represented by the following active power injection vectors: Δ P d A ∼ A T K (26)

For a determined A T K * , the max-min optimization problem described in (Eq. 16) can be converted into the following single-level non-linear optimization problem. C l = min DEF ∑ Δ P d L ∈ DEF , Δ P d A ∗ ∈ A T K ∗   Δ P d L Δ P d A ∗ (27)

Subject to Eqs 21–23.

In order to solve the aforementioned problem effectively, an open-source non-linear optimization solver IPOPT (Wächter and Biegler, 2006) is employed to obtain the optimal load shedding strategy of the AC/DC hybrid transmission system. The corresponding solution DEF represents the optimal load shedding vector set corresponding to A T K * .

Regarding the solution of the optimal attack vector, an IPSO is applied owing to the non-convex nonlinear characteristics of the optimization problem. It is known that the basic PSO algorithm is quite suitable for dealing with non-convex nonlinear optimization problems because of its simple implementation process and no need for gradient information (Nickabadi et al., 2011). In the PSO algorithm applied in this paper, the particles are designed as the part of the active power injection vectors Δ P d A . It should be noted that the number of independent variables in this vector is N x − N e q , which corresponds to Δ P d A one by one, so the positions of particles can be constructed as X i = Δ P d A , 1 , Δ P d A , 2 , ⋯ , Δ P d A , m , m = N x − N e q (28)

As mentioned above, the load shedding amount of each substation mainly depends on the attack vector, line capacity, node voltage, and generator output under a malicious FDI attack scenario. By analyzing the FDI attack vector, the following characteristics can be found, that is, the node with the highest amount of load shedding generally has the largest or the second largest value of the active power attack vector, which can be used to generate some specific attack vectors as initial particles to assist the PSO algorithm to find the optimal solution and accelerate the convergence speed. Considering these characteristics of the FDI vectors, an IPSO algorithm with an initial particle generation technology proposed in this paper is applied to accelerate the convergence speed of the basic PSO algorithm. Moreover, these specific attack vectors can be called auxiliary attack vectors ( A V V s ). For attack selection A i , the set of A V V s can be calculated as S A V V = arg max C Δ P d A , k + ∑ i ≠ k Δ P d A , i 2 1 2 , k ∈ A j , C = c o n s t ≫ 0 (29)

Subject to (Eq. 18) and the relationship between active power and reactive power of load.

Here, the A V V can be transformed into the positions of particles, and the initial particle placed in these positions are called auxiliary search particle ( A S P ). With the help of A S P , the pseudocode of the IPSO algorithm for solving A T K and DEF is described in Table 2.

According to the load shedding results obtained by solving the lower-level programming problem mentioned above, the corresponding consequences caused by the coordinated physical-cyber attacks can be determined. Since the number of the attack and defense strategies under certain fund constraints is limited, it is easy to calculate all the payoffs between the attacker and the defender according to (Eq. 2), (Eqs 9–14). In this paper, once the payoffs are determined, the solution of the upper-level programming problem, namely the subgame perfect Nash equilibrium, can be obtained by using the BI method.

Considering that the proposed three-stage dynamic game framework is a zero-sum game problem, the payoff of the attacker can be expressed as u a d i , a i j = G A R I d i , a i j , l = P A Y O F F i j ≥ 0 , d i ∈ S D ,   a i j ∈ S A d i , 1 ≤ i ≤ h , 1 ≤ j ≤ q (30)

The payoff function of the defender can be expressed as u d d i , a i j = − u a d i , a i j = − P A Y O F F i j (31)

Then the subgame perfect Nash equilibrium can be written as u d d * , a * ≥ u d d i , a i j , ∀ d i , a i j ∈ Ω (32) where Ω = d i , a i j a i j ∈ a * d i ,   a * d i = arg max a i j ∈ S A d i u a d i , a i j (33)

Strategy d * , a * denotes the subgame perfect Nash equilibrium.

In order to obtain the subgame perfect Nash equilibrium, the BI method is employed in this paper, which can be divided into the following two steps. In the first step, the attacker’s strategy under different defense strategy options is determined, which can be formulated as a * d i = arg max a i j ∈ S A d i u a d i , a i j (34)

In the second step, the defender predicts the attack strategies, so the second step can be formulated as d * = arg max d i ∈ S D   u d d i , a i j , a i j ∈ a * d i (35)

The solution process of the BI method for the subgame perfect Nash equilibrium can be illustrated in Figure 4.

In Figure 4, the attacker first selects the corresponding optimal attack strategy (marked by the dark red branch) based on each possible defense strategy. Once the attack strategy is determined, the payoff corresponding to the defense strategy is also determined. For example, the payoff of d i is P A Y O F F i j as the optimal attack strategy is a i j . Then, the defender selects the optimal defense strategy d i (marked by the dark blue branch) according to the payoffs of the defense strategies. After the optimal defense and attack strategies are determined, the subgame perfect Nash equilibrium can be obtained.

Once the subgame perfect Nash equilibrium is obtained, it can be used to assess the power grid risk under the FDI attack with certain fund constraints.

According to the Nash equilibrium solved in the previous section, the probabilities of different strategies selected by the attacker and defender can be obtained. Therefore, the mixed attack and defense strategies can be expressed as d * = d i , p d i ,   a * = a i j , p a j ∙ p d i , d i = S C y d , S P h d i , a i j = S C y a , S P h a i j (36)

Based on the aforementioned probabilities and strategies, the expectations of fund deployment with a certain amount of fund constraints F m = F C y d , F P h d , F C y a , F P h a can be calculated as E C y d d * = ∑ p d i ∙ S C y d i E P h d d * = ∑ p d i ∙ S P h d i E C y a a * = ∑ p d i ∙ p a j ∙ S C y a j E P h a a * = ∑ p d i ∙ p a j ∙ S P h d j (37)

Obviously, once the amount of funds changes, the expectation of fund deployment will also change. Therefore, the subgame perfect Nash equilibrium for various funds F m should be solved to obtain the deployment of funds under different fund constraints. Finally, the overall expectations of fund deployment on the cyber side and the physical side, that is the power grid risk under the coordinated physical-cyber attacks, can be calculated as R i s k C y = 1 N ∑ m = 1 N E C y d d * + E C y a a ∗ | F m R i s k P h = 1 N ∑ m = 1 N E P h d d * + E P h a a ∗ | F m (38)

Figure 5 illustrates the whole flow chart of the solutions for the upper-level and lower-level programming problems.

According to the derivation of the potential attack selections discussed in Section 3.1, a total of 772 potential attack selections can be found under the given FDI attack constraints. However, after calculating the corresponding consequences, 770 potential attack selections will only cause the changes in power flow, and the remaining two potential attack selections will lead to the load shedding. Therefore, these two attack selections are specifically utilized for load shedding analysis under FDI attack. As shown in Figure 6, there are two attack selections, namely Attack Selection I and Attack Selection II, in which the Attack Selection I contains five target substations: 6, 9, 12, 13, and 14, and the Attack Selection II contains seven target substations: 6, 9, 10, 11, 12, 13, and 14. By solving the lower programming problem described in Section 3.1, the optimal attack vector set A T K and the optimal load shedding vector set DEF corresponding to the two attack selections mentioned above are shown in Table 3 and Table 4, respectively.

From Tables 3, 4, it can be observed that under the coordinated physical-cyber attack, the total load shedding amount occurred in the Attack Selection I is 3.9511 MW, and that in the Attack Selection II is 6.8962 MW. In addition, the largest load shedding occurs at Substation 13 in the two attack selections.

In order to further validate the effectiveness of the proposed initial particle generation technology and the stability of the IPSO algorithm, the corresponding simulation analysis is carried out based on the A S P . Figure 7 shows the comparison results of the total load shedding amount of the IPSO algorithm with A S P , the basic PSO algorithm without A S P and the Grey Wolf Optimizer (GWO) algorithm under 50 independent trials. The population size and the number of iterations of all these algorithms are set to 30 and 20. According to the simulation results shown in Table 5, the standard deviation of the IPSO algorithm applied to the Attack Selection II is 5.8695 × 1 0 − 4 , which is much lower than that of the basic PSO algorithm and the GWO algorithm, which means that the proposed IPSO algorithm with A S P has good stability. All algorithms are accelerated by parallel computing technology with the help of the Parallel Computing Toolbox provided by MATLAB™, and the running time is shown in Table 5. Figure 8 demonstrates the corresponding convergence curves of the three algorithms mentioned above, and it can be seen that the IPSO algorithm with A S P shows a good acceleration effect.

In order to explore and exploit the impact of DC transmission line on system risk under the coordinated physical-cyber attacks, the corresponding comparative analysis is conducted between an AC transmission system and the AC/DC hybrid transmission system as shown in Figure 6 under FDI attacks. Regarding the AC transmission system, an AC transmission line consisting of three segments is introduced between node 1 and node 5, and the corresponding line parameters are given in Table 6. Table 7 shows the system load shedding results for the two test systems mentioned above under different attack selections. Moreover, the detailed results of the AC transmission system are provided in Supplementary Material.

It can be seen from Table 7 that when the attacker performs Attack Selection I, the total load shedding amount for the AC transmission system is 3.2388 MW, while that for the AC/DC hybrid transmission system is 3.9511 MW; when the attacker performs Attack Selection II, the total load shedding amount for the AC transmission system is 6.2373 MW, while that for the AC/DC hybrid transmission system is 6.8962 MW. It can also be found that when there is only a DC transmission line between node 1 and node 5, the total load shedding amount of the system caused by FDI attacks increases by 21.99% and 10.56%, respectively, compared with that when there is only an AC transmission line. Table 8 shows the operating conditions of the DC transmission line before and after the FDI attacks.

It can be found from Table 8 that only the ignition angle changes relatively after the attacker makes the Attack Selection II, and the other measurement data of the DC transmission line are basically not affected by the coordinated physical-cyber attacks. Since the data of DC transmission lines are considered to be untampered, the impact of the corresponding coordinated physical-cyber attack on the measurement data of the DC transmission lines is not significant. Thus, if the attacker could not directly tamper with the data of DC transmission lines, it is difficult to cause the DC blocking.

To sum up, it can be concluded that even if the DC transmission lines can be prevented from cyber attacks, the FDI attacks can still pose threat to the AC/DC hybrid transmission system, so it is necessary to conduct the security risk assessment.

Based on the risk assessment framework described in Section 2, the comprehensive system security risk is conducted in this section. In (Eq. 11), the inherent risk value μ of substation communication network is set to $3K, $6K, $4K, $8K, $7K, $6K, $5K, $2K, $7K, $5K, $5K, $5K, $6K, and $5K in the order of substation numbers. Considering that the deployment strength of substation security forces is usually similar, the inherent risk value λ of substation security forces in (Eq. 12) is set to $100K. For the defender, C y d L 1 is set to $10K, C y d L 2 is set to $20K, P h d L 1 is set to $50K, and P h d L 2 is set to $100K. For the attacker, C y a L 1 is set to $10K, C y a L 2 is set to $20K, P h a L 1 is set to $50K, and P h a L 2 is set to $100K. According to the maximum amount of funds, the range of F C y d should be from $70K to $100K, the range of F P h d should be from $250K to $400K, the range of F C y a should be from $70K to $100K, and the range of F P h a should be from $350K to $500K.

Based on the above parameter settings, the corresponding system security risk analysis is carried out, and the following simulation cases are analyzed and discussed elaborately.

1) Case 1: The relatively low budget of defense and attack funds, that is, F C y d , F P h d , F C y a , and F P h a take relatively low values;

In case 1, F C y d , F P h d , F C y a , and F P h a are set to $70K, $250K, $70K, and $350K, respectively. In this case, the total number of defense strategies is 104538, and the total number of attack strategies is 101. The corresponding subgame perfect Nash equilibrium pertinent to the fund allocation of the attacker and the defender is shown in Table 9.

From Table 9, it can be found that the attacker will choose the attack strategies performed at Attack Selection I. The active power loss expectation of the test system under the current funding limitations is 1.5919 × 1 0 − 5 MW. From the analysis of attack and defense funds on the cyber side, the total expectations of both sides of the attack and defense deployment funds for the substation 9 are tied for the highest, all of which are $40K. Accordingly, this substation is considered to be the most risky substation on the cyber side, and more attention should be paid to its communication network vulnerabilities. Similarly, on the physical side, it is also found that the substation 9 has the highest expectation for the total amount of funds deployed by the attacker and the defender, which is $150K. This means that the risk of this substation is also the highest, so special attention should be paid to its guard force. To sum up, under these fund constraints, the substations 9 is identified as the critical substation of the test system in this case. Moreover, it can be observed that the attacker tends to deploy more funds on the substation with stronger defense on cyber side to increase the success probability of a coordinated physical-cyber attack.

In case 2, F C y d , F P h d , F C y a , and F P h a are set to $80K, $300K, $90K, and $400K, respectively. In this case, the total number of defense strategies is 127,449, and the total number of attack strategies is 197. The corresponding subgame perfect Nash equilibrium pertinent to the fund allocation of the attacker and the defender is shown in Table 10.

From Table 10, it can be found that the active power loss expectation of the test system under the current funding limitations is 1.9777 × 1 0 − 5 MW. From the analysis of attack and defense funds on the cyber side, the total expectations of both sides of the attack and defense deployment funds for substations 9, 12, and 14 are tied for the highest, all of which are $40K. Accordingly, these three substations are considered to be the most risky substations on the cyber side, and more attention should be paid to their communication network vulnerabilities. Similarly, on the physical side, it is also found that the three substations have the highest expectations for the total amount of funds deployed by the attacker and the defender, which is $150K. This means that the risks of these three substations are also the highest, so special attention should be paid to their guard forces. To sum up, under these fund constraints, substations 9, 12, and 14 are identified as the critical substations of the test system in this case. Moreover, it can be observed that the attacker tends to deploy more funds on the substation with weaker defense on physical side to increase the probability of a successful coordinated physical-cyber attack.

In case 3, F C y d , F P h d , F C y a , and F P h a take the specified range as mentioned above. After obtaining all the subgame perfect Nash equilibriums of the defense and attack budget within a certain range, and according to (Eq. 38), the overall expectations of the fund deployment of the attacker and the defender can be calculated as shown in Table 11.

From Table 11, it can be seen that the overall expectation of the fund deployment on the cyber side pertinent to the substation 12 is the highest, which means that the cyber side of the substation 12 is the most critical, and it is necessary to strictly investigate the vulnerabilities in the communication network. Meanwhile, the overall expectation of the fund deployment on the physical side pertinent to the substation 12 is the highest, which means that the physical side of the substation 12 is also the most critical, and it is necessary to strictly control the personnel entering and leaving the station, as well as to check the illegal monitoring equipment regularly. To sum up, the substation 12 is identified as the critical substation in the test system.

Figure 9 illustrates the impact of changes in attack and defense funds on the risk expectations of the test system. It can be found that from the attacker’s perspective, the more funds invested in the attack, the higher the risk of the test system caused by the attack. In particular, the more funds invested on the cyber side, the more effective the attack. Similarly, from the defender’s perspective, the more funds invested in the defense, the lower the risk of the test system, and the more funds invested on the cyber side, the better the defense effect, which provides a significant reference for power grid dispatcher to deploy the optimal defense funds.