Coordinated Cyber–Physical Attack Strategies in Power Systems Considering Defense Resource Allocation and Emergency Dispatch Responses

Deliberate coordinated cyber–physical attacks, which combine cyber intrusions with physical disruptions, pose growing risks to the secure and reliable operation of power systems. To identify highly disruptive coordinated cyber–physical attack strategies under pre-attack defense allocation and post-attack emergency dispatch responses, a tri-level defender–attacker–defender (DAD)-based attack strategy optimization model is proposed. First, based on the association between substation automation control systems and transmission line operation, the mechanism of breaker-tripping attacks (BTAs) through compromised digital relays in substations is investigated. Second, a tri-level DAD model is developed to optimize coordinated BTA and physical line attack strategies while accounting for pre-attack cyber and physical defense, cascading failure propagation, and post-attack emergency dispatch responses. Then, based on duality theory, network flow models, and the column-and-constraint generation (C&CG) algorithm, an iterative solution framework consisting of a defense master problem and an attack-dispatch subproblem is constructed to capture post-attack topology updates, cascading line outages, generator redispatch and load-shedding responses. Finally, the proposed method is validated using the IEEE 39 bus and IEEE 118 bus power systems. Case study results demonstrate that the proposed model identifies the most damaging coordinated cyber–physical attack strategies and that BTA-induced topology changes and cascading failure propagation significantly affect attack target selection. The proposed solution method obtains the accurate optimal objective value while reducing computational time by 92.91% for IEEE 39 bus power system, and it successfully obtains a converged solution for IEEE 118 bus power system.