In ARSA, control over relay settings can be gained by attackers. The pickup current setting I r T h can be maliciously modified, causing the relay to incorrectly judge the system as being in an overload or short-circuit state, thereby sending erroneous trip signals. The pickup current setting determines the current level at which the relay automatically triggers a trip when detected. By lowering this setting to a level far below normal operating currents, attackers can trigger relay trips during normal system operation, leading to circuit breaker openings and power supply interruptions in the system.

This type of attack mechanism relies on adjusting relay parameters and can be described by the following formula: I r T h , b b = χ a I r T h , χ a < I r , g I r T h − δ where I r T h , b b represents the pickup current of relay r after ARSA, χ a is the scaling factor of ARSA, and δ represents the tolerance for measurement errors in the system. The attacker adjusts χ a and δ to ensure that the relay’s setting is reduced to an extremely unreasonable level, causing the relay to incorrectly detect a fault and trip even in the absence of an actual fault.

These attacks often directly impact downstream loads in the system. When relays trigger tripping, the downstream circuit breakers are forced to open, causing a sudden disconnection of large loads. The power outage in downstream loads affects end users and may further trigger cascading reactions such as system voltage imbalance or frequency fluctuations, increasing system operational instability. The immediate nature of ARSA implies that once successful, the system will instantly enter an abnormal state, placing higher demands on the real-time monitoring and response capabilities of maintenance personnel.

In distribution systems, the destructive nature of ARSA is manifested in the erroneous tripping behavior of the relays themselves and potentially more severe consequences through coordinated actions between relays, circuit breakers, and reclosers. Typically, the tripping of one relay can trigger a chain reaction in related equipment, rapidly expanding the fault area. For large-scale distribution systems, a single relay’s erroneous operation may lead to power outages across entire regions. Particularly during high-load periods, power outages caused by such attacks affect downstream equipment and adversely impact upstream power supply equipment, further exacerbating system instability.

In PRSA, relay settings are modified by attackers to prevent expected operation during system faults. The characteristic of these attacks is that their effects are not immediately apparent. Instead, they cause relay failures when future system faults occur, leading to delayed or incorrect tripping, thereby expanding the impact range of faults. These attacks often involve adjustments to the relay’s time dial and pickup current settings, causing the relay to fail to respond promptly under fault conditions and disrupting relay coordination.

The key mechanism of PRSA is to violate the time coordination constraints between relays by adjusting their operation times. Suppose relay r is responsible for protecting a certain line segment, with relay r ′ as its backup. The time coordination relationship between them can be expressed by the following constraint: T r ′ , g − T r , g ≥ ∆ T , ∀ r ′ ∈ S r where T r ′ , g is the operation time delay of the backup relay r ′ when a fault g occurs downstream of relay r , T r , g is the operation time of relay r , and ∆ T is the required time coordination margin between them. Under normal conditions, the primary relay r will trip first, and the backup relay r ′ will only operate if the primary relay fails.

In a Passive Relay Setting Attack (PRSA), the attacker manipulates the settings of relay r , increasing its operation time delay T r , g , causing the backup relay r ′ to trip before the primary relay. The attacker disrupts the time coordination by altering the parameter ∆ T b , as shown in the following equation: T r , g b b = T r , g + ∆ T b , ∆ T b > ∆ T + δ where T r , g b b is the operation time delay of relay r after the attack, and ∆ T b is the additional delay introduced by the attack. δ represents the tolerance for measurement errors in the system. By increasing the operation delay, PRSA prevents the primary relay from responding in time to faults, causing the downstream backup relay to trip prematurely and thus widening the scope of the outage.

The impact of PRSA on power distribution systems lies in its increase of system vulnerability during fault conditions. The consequences of the attack are manifested only when the system experiences short circuits or other faults after relay settings have been modified. Compared to active attacks, PRSA is more covert. Attackers can quietly alter relay parameters without triggering immediate anomalies. The effects of the attack are revealed only through relay failures during fault occurrences, often exacerbating the scope and severity of accidents.

This attack method endangers not only single relays but can also aggravate fault consequences by affecting multiple relays across the entire distribution system. Particularly when time settings of multiple relays are simultaneously tampered with, widespread power outages may occur.

Relays in power distribution systems are typically connected to control centers via Wide Area Networks (WAN) and use standard communication protocols (such as IEC104 and IEC61850) for data transmission. The extensive coverage of these communication networks exposes them to multiple potential attack entry points. The overall failure probability of the system is: P f a i l = P a t t a c k · P r e l a y · 1 − R r e s p o n s e where P f a i l represents the system failure probability, P r e l a y indicates the probability that the attacker controls the relay, R r e s p o n s e denotes the emergency response capability of the control center, and P a t t a c k is the total attack success probability. The total attack success probability is calculated as: P a t t a c k = 1 − S n e t · S p r o t o c o l · S p h y s i c a l where S n e t refers to the security of the network layer, S p r o t o c o l refers to the security of the protocol layer, and S p h y s i c a l refers to the security of the physical layer.

System networks can be infiltrated by attackers through firewall vulnerabilities or other weaknesses. Upon successful infiltration, network protection measures can be bypassed, allowing direct access to relay control interfaces and alteration of settings (Reda et al. 2022). This may result in relay failures during actual faults. For instance, relay pickup current or time dial settings can be modified by attackers, preventing normal tripping during actual faults (Zhou et al., 2021).

Communication network vulnerabilities are not limited to the physical layer but are closely related to the security of software, protocols, and data transmission (Ghiasi et al., 2023). Remote attack methods may be employed by attackers, such as Distributed Denial of Service (DDoS) or man-in-the-middle attacks (Wang et al., 2024). These attacks can sever the connection between control centers and relays, affecting the normal protective functions of the system.

The firmware of relays, which serves as their core operating logic, can be targeted by attackers through the injection of malicious code. Firmware attacks may occur during the production, installation phases, or even during firmware updates. The final probability of a successful firmware tampering can be expressed as: P s u c c e s s = P t a m p e r · R a t t a c k e r · L k n o w l e d g e E s e c u r i t y where R a t t a c k e r represents the resources available to the attacker, E s e c u r i t y denotes the effectiveness of security measures, L k n o w l e d g e reflects the depth of the attacker’s understanding of the firmware logic, and P t a m p e r is the probability of firmware tampering.

The probability of firmware tampering is calculated as: P t a m p e r = 1 − S u p d a t e · 1 − P i m p l a n t where S u p d a t e represents the security of the firmware update channel, and P i m p l a n t indicates the probability of successfully implanting malicious code by the attacker.

As firmware updates for many relays are conducted through online channels, malware can be intercepted and implanted by attackers during updates (Amin et al., 2021). Malicious firmware typically includes triggers and payloads. Triggers activate malicious operations based on specific events or signals, while payloads are the actual attack behaviors (Li et al., 2024). Once firmware is tampered with, relays can be remotely controlled or triggered at specific times by attackers, causing malfunctions or erroneous actions at critical moments (Trevizan et al., 2022). For instance, relay response times might be delayed by attackers, preventing timely tripping during system faults and disrupting protection coordination (Wang et al., 2021). To defend against such attacks, digital signatures and encryption can be used to verify the integrity of firmware updates. Regular auditing and upgrading of firmware can also reduce the possibility of malicious code implantation.

Although many relay devices are located within physically well-protected substations, relays distributed along distribution lines often lack strict physical protection (Vahidi et al., 2023). Through physical contact, attackers can directly connect to device interfaces and modify relay settings (Rajkumar et al., 2020). In some cases, attackers might even use techniques such as electromagnetic interference to disrupt internal circuits or data storage of relays, leading to abnormal device operation (Trevizan et al., 2022). The formula for calculating the probability of successful local attacks is: P l o c a l = N p r o t s · P E M I E p h y s i c a l where E p h y s i c a l represents the effectiveness of physical protection measures, N p r o t s refers to the number of exposed physical ports, and P E M I denotes the success rate of electromagnetic interference (EMI) attacks.

Direct connection to device interfaces and modification of relay settings can be achieved by attackers through physical contact (Wlazlo et al., 2021). In some cases, techniques such as electromagnetic interference might be used by attackers to disrupt internal circuits or data storage of relays, leading to abnormal device operation. Although local access attacks require physical contact, they pose higher risks in unattended outdoor equipment. Relay normal operation can be affected by attackers through forceful damage or high-tech tools like electromagnetic pulses. Additionally, exposed physical ports provide attackers with ways to bypass other protective measures (Kampourakis et al., 2023). To defend against local attacks, measures can be taken to strengthen relay external packaging, install anti-tampering detection devices, or reduce the possibility of local attacks through more advanced physical protection means (Yu et al., 2023).

The strategic interaction between defenders and attackers can be described using game theory models. The defender’s goal is to reduce the Expected Energy Not Supplied (EENS) under attack through rational budget allocation. The attacker aims to maximize system losses by selecting specific attack strategies. The strategies of defenders and attackers interact: the defender’s budget allocation directly affects the attacker’s success rate, while the attacker’s strategy selection influences the system’s operational state and security.

The interaction between defenders and attackers is described by the three-layer optimization model. It integrates defense budget allocation, attack strategy selection, and system loss calculation into a comprehensive optimization framework. The three-layer structure consists of:

(1) Defense Budget allocation Layer (First Layer): The defender’s probability of relay failure is reduced through the allocation of limited defense budgets. The decision variable for the defender is the budget allocation d r , for each relay, with the objective of minimizing the system’s EENS. The defender’s budget allocation is represented by the vector d = d 1 , .   .   . , d r , .   .   . , d R , where d r represents the defense budget allocated to relay r . The defender’s total budget D max is subject to the following constraint:

The total budget constraint is represented by the set D : D = d ∈ R + R | ∑ r = 1 R d r ≤ D max

This set indicates that the defender’s total budget D max needs to be allocated across all relays, and the sum of budget allocations cannot exceed the defender’s available budget.

The EENS calculation formula is: E E N S = ∑ r ∈ S ρ r d r , d s · θ r where d r represents the defense budget allocated to relay r , d s represents the system-level defense budget, and θ r is the load loss caused by the failure of relay r . S is the index set of all relays r in the power system, where failures or losses may occur. The higher the EENS, the greater the power supply loss under attack. Therefore, the defense strategy should prioritize reinforcing high-load nodes.

Defense strategies are typically divided into device-level and system-level. Device-level defense aims to enhance the local security of each relay, mainly including strengthening physical barriers, upgrading firmware security, introducing multi-factor authentication, adding firewalls for each relay, etc. These measures improve overall system security by reducing the failure probability ρ r d r of specific relays, typically described using an exponential decay model: ρ r d r = e − μ r d r where μ r is the sensitivity coefficient of relay r , representing the degree to which the defense budget allocated to that relay affects its failure probability.

System-level defense focuses on the security of the entire system, mainly including encryption of network-wide communication, system monitoring upgrades, integration of attack detection systems, etc. The system-level defense budget d s System-level defense focuses on the security of the entire system, mainly including encryption of network-wide communication, system monitoring upgrades, integration of attack detection systems, etc. The system-level defense budget ρ r d r , d s = β e − μ r d r + 1 − β e − ξ d s where β is the weighting factor between the device-level and system-level budgets, ξ represents the effectiveness parameter of system-level defense, d r is the local defense budget allocated to each relay to reduce its failure probability, and d s is the system-level defense budget used to enhance the protection capability of the entire system. Reasonable allocation of defense budgets requires a balance between device-level and system-level to minimize overall failure probability.

(2) Attacker’s Strategy Selection Layer (Second Layer): k ∈ K = 1 , ⋯ , K is defined as the attack scenario, where K is the set of all attack scenarios, and K is the total number of scenarios. The number of possible attack combinations is calculated by:

The attacker selects one or more relays as attack targets within the limited resource constraint. The attacker’s goal is to disrupt the system by maximizing load loss. The attacker selects the attack target set S c and optimizes their attack strategy to maximize system loss. The specific optimization problem is described as: max S c ∑ r ∈ S c ρ r d r , d s · θ r subject to: ∑ r ∈ S c c r ≤ C where θ r represents the load loss caused by the failure of relay r . The attacker’s selection is limited by the total available resources C , and c r denotes the resources required to attack relay r . The attacker maximizes system loss by selecting the relay set S c .

Due to limited resources, both the defender and attacker need to make optimal decisions within their budgets. The attacker selects the target relay combination S c to maximize the system’s load loss θ r , while the defender allocates budget d r to reduce the relay failure probability ρ r d r , d s to minimize losses.

(3) System Loss Calculation Layer (Third Layer): The system loss ϕ c d is jointly determined by the defense budget d and attack strategy S c . The loss function is expressed as:

The core problem of the entire three-layer structure can be represented by a typical Min-Max optimization problem. The defender’s goal is to minimize system loss under the worst-case attack scenario: min d ∈ D max k ∈ K ϕ c d · T R d t where the system recovery time T R d t represents the time required for the system to return to normal operation after an attack. It depends on the budget d t allocated by the defender for identifying and restoring the system. By optimizing d t , the defender can accelerate the recovery process and reduce the total system loss. After an attack, the defender must also consider how to optimize the recovery time T R d t , which is related to the identification system’s budget d t : T R d t = T i − T d t T d t = 2 ∆ T R 1 + e − γ d t − D t where T i represents the recovery time of the distribution system without an identification system, T d t is the time reduced by deploying an identification system, ∆ T R is the reduced recovery time after installing the identification system, D t is the minimum budget required to install the identification system, and γ is a parameter controlling the smoothness of the function. When the budget d t exceeds a certain threshold D t , the identification system can significantly shorten the recovery time. However, when the budget is insufficient, the reduction in recovery time is limited. By optimizing d t , the defender can accelerate system recovery speed, thereby reducing the total system loss.

In the budget allocation problem, defenders need to find a balance between device-level and system-level defenses to minimize the EENS of the entire system.

The defender’s core objective is to minimize the system’s expected loss by rationally allocating budgets d r and d s within the budget constraint D max . The optimization problem can be formulated as the following min-max problem: min d ∈ D max k ∈ K ∑ r ∈ S c ρ r d r , d s · θ r

Where the attacker maximizes the system’s load loss θ r by selecting attack scenarios S c , while the defender minimizes these losses through budget allocation strategies d r and d s .

To simplify this bi-level optimization problem, it can be assumed that the attacker chooses the worst-case attack scenario S c * , i.e., the attack strategy that maximizes system loss. Under this assumption, the defender’s goal is transformed into minimizing system loss under the worst-case attack scenario: min d ∈ D ∑ r ∈ S c * ρ r d r , d s · θ r

The defender’s optimization process can be solved using standard optimization algorithms (such as linear programming or nonlinear programming). Based on the importance of each relay and its load loss after failure, the defender rationally allocates defense budgets d r and d s to ensure system loss is minimized when an attack occurs.

In scenarios with incomplete information, defenders and attackers may not accurately understand each other’s full strategies. Therefore, traditional complete information game models fail to accurately reflect real situations. In such cases, randomness and expectation analysis in decision-making become particularly important. Defenders can dynamically adjust their defense strategies based on risk assessments of potential attack targets, while attackers can choose optimal attack paths by inferring the defender’s strategy from historical data. To more precisely characterize this uncertainty, a Bayesian game model is introduced in this paper, enabling defenders to make optimal decisions under uncertainty.

The Bayesian game model is used to describe how participants make optimal strategic decisions based on each other’s behaviors and type information under incomplete information conditions. In Bayesian games, each participant’s type is private information, and other participants can only make strategic decisions based on known type distributions.

Let the attacker’s type be θ A and the defender’s type be θ D , both drawn from their respective type spaces with known distributions. Each participant chooses the optimal strategy based on their observed type and expectations of other participants’ types. This framework better aligns with real-world power systems, as defenders may not know the attacker’s exact targets, and attackers may be unclear about the specific protection strength for certain relays.

The defender’s goal is to minimize system loss under incomplete information. Assuming the attacker’s attack intensity on each relay depends on their type θ A , the defender allocates defense budgets d r and d s according to their type θ D . The defender’s loss function can be expressed as: L D d , θ D = ∑ r ∈ S ρ r d r , d s · θ r

Under incomplete information, the defender can only estimate expected losses based on the distribution of the attacker’s type P θ A . Thus, the defender’s expected loss function is: E θ A L D d , θ A = ∫ θ A L D d , θ A P θ A d θ A

This expected loss function considers the loss weights brought by different attacker types θ A and is an important basis for the defender’s decision-making.

The attacker’s goal is to choose the optimal attack strategy S c to maximize system loss. Assuming the attacker attacks based on the defender’s type θ D and defense strategy d r , their loss function L A d , θ A is expressed as: L A d , θ A = ∑ r ∈ S ρ r d r , d s · θ r

Under incomplete information, the attacker does not know the defender’s exact defense strategy and can only estimate expected losses based on the distribution of the defender’s type P θ D . Therefore, the attacker’s expected utility is: E θ D L A d , θ D = ∫ θ D L A d , θ D P θ D d θ D

Based on this expected loss, the attacker chooses the optimal attack combination S c without knowing the defender’s strategy.

In the Bayesian game model, participants make optimal decisions based on their own types and beliefs about other participants’ types. Defenders and attackers make decisions based on expected losses and utilities, aiming to find the Bayesian Nash Equilibrium. The Bayesian Nash Equilibrium is the optimal strategy combination made by participants after considering all information (including the distribution of the opponent’s type and their own type).

The conditions for Bayesian equilibrium can be expressed as: d * = arg min d ∈ D E θ A L D d , θ A S c * = arg max S c ∈ K L A d , θ D

Under Bayesian equilibrium conditions, the defender’s strategy d * minimizes expected losses across all possible attack types, while the attacker’s strategy S c * maximizes expected losses across all possible defense types.

In practical scenarios, complete and incomplete information games are applicable to different situations. For cases where both attackers and defenders have a clear understanding of each other’s resources and strategies, the incomplete information game can be simplified to a complete information game. In complete information games, as both parties have consistent knowledge of system parameters, resources, and strategies, uncertainty need not be considered, and the game can be directly transformed into a zero-sum game problem. Next, the simplification of the bi-level optimization problem using the Lagrange multiplier method within the complete information game framework will be explored.

To transform the attacker’s budget constraint into a constraint in the defender’s optimization process, the Lagrange multiplier λ_c is introduced, forming the following Lagrangian function: L d , λ c = ∑ r ∈ S c ρ r d r , d s · θ r + λ c C − ∑ r ∈ S c c r

This Lagrangian function transforms the bi-level optimization problem into a single-level optimization problem under the attacker’s resource constraint ∑ r ∈ S c c r ≤ C . The defender chooses the optimal budget allocation strategy considering all possible attack scenarios S c , minimizing system losses in the worst-case scenario. Through this approach, the defender can solve complex game problems through simpler computational methods, enhancing system security and robustness.

In addition to relay setting attacks, the optimization framework could be extended to address other types of cyber threats, including False Data Injection Attacks (FDIA) and Denial of Service (DoS) attacks. FDIA, which manipulates data to mislead system operations, could be integrated into the second layer of the model by adding mechanisms for data validation and anomaly detection. Meanwhile, DoS attacks, which impair communication networks, could be addressed by incorporating network redundancy and prioritizing critical communication channels in the system-level defense budget allocation.

In the experiments, the performance changes of individual relays under attack were first analyzed. By comparing the performance of various relays under ARSA and PRSA, the differences in the impact of different attacks on system load loss were determined.

Figure 2 shows the Load Loss (LL) for each relay under ARSA and PRSA with no defense measures. The figure reveals that PRSA causes significantly higher load losses for relays R2, R5, R6, and R7 compared to ARSA. For instance, PRSA attacks on R2 result in load losses approaching 2.2MW, while ARSA losses are about 1.2 MW. This indicates that R2 is more significantly affected under PRSA attacks, especially when this relay is upstream, where PRSA can easily cause more widespread cascading outages. For relay R3, the situation is reversed, with ARSA causing greater load losses than PRSA, mainly because R3 is downstream and its load is more directly affected by ARSA.

The experimental results reveal differences in the vulnerability of single relays under different attack types, with PRSA being more destructive to the system. Therefore, system protection strategies should allocate different defense resources based on the importance of different relays, with priority measures taken for critical relays such as R2 and R5 to reduce their vulnerability under PRSA.

In addition to single-relay attacks, multi-relay simultaneous attacks were simulated to analyze their impact on system EENS. Three groups of relays were selected for simultaneous attacks, comparing the destructive power of ARSA and PRSA in these scenarios.

Figure 3 illustrates the maximum EENS changes when one, two, or three relays are simultaneously attacked. The results indicate that in multi-relay attack scenarios, PRSA’s destructive power significantly exceeds that of ARSA. For instance, when R3, R6, and R7 are simultaneously subjected to PRSA attacks, the EENS reaches 17 MWh, while the same relay combination under ARSA attacks only results in an EENS of 16 MWh. Particularly in the combined attack on R2, R3, and R5, the load loss caused by PRSA nearly reaches the system’s maximum limit, reflecting the high risk of multi-relay PRSA attacks to the system.

The experimental results demonstrate that under multi-relay attacks, PRSA is often more destructive than ARSA, especially when multiple critical relays are simultaneously attacked. The chain reaction caused by PRSA may lead to global power supply interruptions. Therefore, when formulating defense strategies, the system should adequately respond to the special effects of PRSA, ensuring high system stability even when multiple relays are simultaneously attacked.

To further enhance the system’s attack resistance, the performance of optimal and non-optimal budget allocation strategies under different attack scenarios was evaluated through experiments. The results indicate that rational budget allocation strategies can significantly reduce EENS and improve the system’s defense effectiveness.

(1) Comparison of Optimal and Non-optimal Allocation Strategies

Figure 4 compares the impact of ARSA and PRSA on system EENS under different budget allocation strategies. The figure shows EENS changes under three different budget allocation strategies. The red solid line represents the optimal allocation strategy considering both ARSA and PRSA. As the budget increases, EENS gradually decreases. When the budget reaches 30, the EENS reduction is most significant, indicating that the system’s defense effect reaches its optimal state at this point. As the budget further increases, EENS changes become more gradual, indicating that the system’s overall recovery capability is significantly improved under higher budgets. The blue dashed line represents the defense strategy considering only ARSA. Under higher budgets, this strategy shows good control over system EENS, but at lower budgets, EENS exhibits higher values, especially when the budget approaches 30, where the defense effect is clearly inferior to the optimal allocation strategy. When only ARSA is considered, the system shows greater vulnerability to PRSA attacks and cannot effectively reduce EENS. The green dashed line represents the defense strategy considering only PRSA. This strategy performs excellently at lower budgets, with a large decrease in EENS, but as the budget increases, its defense effect gradually approaches that of the optimal allocation strategy. In terms of overall defense effectiveness, it is still slightly inferior to the optimal strategy considering both ARSA and PRSA. When the budget reaches higher values, the PRSA strategy cannot achieve the optimal defense effect.

(2) Optimization Direction of Defense Strategies

Figure 5 illustrates the resource allocation proportions for various systems and relays under different budget levels. The vertical axis represents the budget allocation percentage for each defense measure, ranging from 0% to 100%. The horizontal axis represents budget size, varying from 50 to 500 units. Different colored areas correspond to relays and systems, showing their dynamic allocation proportions in the total budget as the budget changes.

At low budgets, the attack identification system ( d t ) occupies the majority of the allocation proportion. As the budget increases, the proportion of d t gradually decreases. This trend reflects that under limited resources, defense strategies focus more on ensuring basic attack identification capabilities. However, as the budget increases, the resources required for d t gradually decrease, shifting the focus of resource allocation.

Concurrently, the allocation proportion for system-wide defense measures ( d s ) significantly increases with budget growth. At low budgets, d s receives almost no resource allocation, but as the budget increases, its proportion gradually expands, eventually becoming the main object of resource allocation in high-budget situations. This indicates a gradual shift in defense strategy from single-point protection to comprehensive system protection to improve overall defense levels.

Critical relays such as d 2 , d 3 , and d 5 maintain relatively stable allocation proportions across the entire budget range. Regardless of budget increases, these relays consistently receive certain resources, reflecting their continued importance in system security. In contrast, d 4 , d 6 , and d 7 have smaller resource allocation proportions but receive some resources as the budget increases, reflecting further expansion of system defense at higher budgets.

To further assess the robustness of the proposed defense model, a sensitivity analysis was conducted to explore the effects of varying budget levels and allocation strategies on system resilience. Three different budget scenarios were considered: low-budget, medium-budget, and high-budget. The sensitivity analysis revealed that while higher budgets naturally lead to improved resilience and lower EENS, the allocation strategy plays a critical role in maximizing the effectiveness of the defense. Under low-budget conditions, focusing resources on critical relays such as those near the main substation resulted in significant reductions in EENS, while in higher-budget scenarios, more resources could be distributed across secondary relays, further improving system resilience.

The three-layer optimization defense model offers practical applicability in various power system environments, especially those facing resource constraints. By dynamically allocating the defense budget across device-level and system-level protections, the model ensures that critical relays receive priority in budget allocation, while also addressing system-wide security measures. This adaptability allows the model to be deployed in real-world scenarios, where resource availability may fluctuate. Additionally, the model can be easily integrated with existing power system security frameworks due to its modular nature.