A sensitivity analysis of cyber contingency ranking within the SOCCA framework

Cyber-infrastructure is at the heart of power system operations and is critical for maintaining reliable and stable power supply. The advent of smart grid technology will undoubtedly increase the exposure and potential avenues of cyber attack well into the future. The industry standard of contingency analysis largely focuses on accidental outages, such as natural disasters, equipment malfunction, etc. Intentional, directed attacks and cyber components are not well understood or accounted for. In response, the Security-Oriented Cyber-Physical Contingency Analysis (SOCCA) framework demonstrates that it is both prudent and practical to assess the impact of cyber events within power infrastructures. Using a new formalism to model cyber-physical interconnections and by ranking contingencies based on impact and attack complexity, SOCCA presents system operators with a detailed vulnerability landscape of their networks. SOCCA’s contingency ranking algorithm relies heavily on Markov Decision Processes. These MDPs require expert knowledge in determining the attack surface and gauging the likelihood of an attack’s success as represented by a probability. The choice of reward function and assignment of probabilities greatly influence the behavior of the MDP. Therefore, the accuracy of the ranking algorithm is called into question as it is intrinsically tied to the accuracy of the expert knowledge. This thesis aims to identify the major factors that affect the contingency ranking in an MDP model that represents an industry-standard cyber-physical power network. Probability assignments will be varied including augmenting the SOCCA framework in order to extend the probabilities associated with the MDPs to be bounded intervals rather than exact values. This way, reliance on precise expert knowledge is lessened and sensitivity analysis can be performed to provide a confidence rating to the contingency analysis. This will also give insight into how modifying or mitigating certain attack steps contributes to the overall cyber security state of the network