Hidden Markov Model-Based Cyberattack Prediction in Power Systems

The deep coupling between the information domain and the physical domain in power systems has increased the risk of cyberattacks on power systems. Determining an attacker’s intention immediately following an attack is crucial for security personnel in choosing corresponding defending strategies. In order to accurately predict the attacker’s intent, we propose a dynamic prediction method that takes into account the evolving nature of cyberattack intent in power systems. Initially, we use an attribute selection and clustering algorithm to reduce the amount of alarm data. Then, by leveraging the game characteristics of the attack-defense process, we introduce a dynamic hidden Markov model prediction model that is suitable for attack scenarios in a real power system. Finally, we establish a fully physical cyberattack simulation platform and test the proposed prediction model using an alarm dataset generated from a real 126-node system. The experimental results validate the effectiveness of our method in cyberattack prediction for power systems and demonstrate its superiority compared with other prediction methods.