Topology-Aware Hierarchical Attack Graph Optimization for Cyber-Physical Power Systems

Abstract

Cyber-physical power systems face multi-stage attacks that exploit both communication-network topology and power-grid interdependencies to reach critical substations from low-security entry points. Attack graphs systematically enumerate multi-step attack paths. However, existing approaches either ignore physical network topology or separate attack-graph construction from defense placement, limiting operational usefulness. This paper presents an enhanced topology-aware greedy (TAG) framework that couples source-to-critical attack-path search with dual-mode cyber defense and explicit cyber-physical interdependency modeling. A hierarchical attack graph is constructed directly on the physical network graph, encoding compromise probabilities conditioned on both cyber vulnerability profiles and power-grid criticality. TAG employs topology-aware candidate screening, deterministic probabilistic propagation, beam search, and one-swap local refinement, followed by a dual-mode defense package combining node hardening, micro-segmentation, and monitored-neighbor shielding. Monte Carlo experiments on the 179-bus medium-voltage feeder, IEEE 39-bus New England, IEEE 118-bus, and RTS-96 benchmarks demonstrate that TAG reduces critical-reach probability by $54.3$–$82.0\%$ versus no-defense baselines (mean $70.5\%$), and by $30.2$–$51.5\%$ versus vanilla greedy placement. A cyber-physical impact-weighted risk analysis further shows that TAG’s structural defense placement yields proportional reductions in power-flow-consequence-weighted risk. Parameter sensitivity across the segmentation/containment factor $\eta \in [0.30,0.80]$ and the monitored-neighbor shielding factor $\rho \in [0.05,0.30]$ confirms robust method superiority (68–$72\%$ risk reduction across all tested values).

1. Introduction

Modern power systems represent one of the most critical national infrastructures, whose reliable operation underpins economic productivity, public safety, and societal stability. The progressive integration of advanced metering infrastructure, supervisory control and data acquisition (SCADA) systems, digital protective relays, phasor measurement units, and Internet Protocol (IP)-based communication networks has fundamentally transformed the operational landscape of power grids, delivering significant improvements in observability, controllability, and real-time situational awareness [1]. However, this cyber-physical convergence has simultaneously expanded the attack surface available to sophisticated adversaries, who can now exploit communication vulnerabilities, insecure remote access pathways, software weaknesses in industrial control systems, and supply chain compromises to penetrate critical energy infrastructure [2,3]. Threat actors, including nation-state actors and well-resourced criminal organizations, increasingly plan campaigns as sequences of coordinated intrusion steps that progress across communication networks from low-security entry points toward high-value control assets [4]. Real-world incidents, most prominently the 2015 and 2016 Ukrainian power grid attacks, have demonstrated that multi-stage cyber intrusions can produce large-scale outages, physical equipment damage, and sustained disruptions to electricity delivery affecting millions of consumers [5,6]. These events have galvanized regulatory attention and research investment to characterize cyber-physical attack surfaces, identify high-risk intrusion pathways, and develop principled defense strategies for critical energy infrastructure.

Attack graphs have emerged as the dominant formalism for systematically enumerating the space of feasible multi-step attack paths through which an adversary can navigate from initial compromise to high-value target states. In their canonical formulation, nodes encode system states or the compromise status of individual network devices, while directed edges represent feasible attack transitions conditioned on preconditions such as privilege level, reachability, and exploitable vulnerabilities [7]. This compact graph representation enables analysts to enumerate all reachable attack paths, reason about attacker reach under resource constraints, and quantify security risk across complex networked systems. For cyber-physical power systems, attack graph models have been constructed from vulnerability databases associated with SCADA platforms, IEC 61850 substation automation profiles, and legacy industrial protocols such as Modbus and DNP3 [7,8]. Recent advances integrate graph neural networks and hybrid deep learning to automate the detection of in-progress attack trajectories within operational technology networks. A persistent limitation, however, is that many existing approaches treat the physical power network coarsely, relying on logical connectivity derived from device communication configurations rather than on explicit bus and transmission-line structures. This abstraction overlooks attack pathways where adversaries exploit both cyber and physical adjacency, progressively moving from low-security feeder buses through topologically adjacent substations toward high-voltage hubs, leaving important vulnerabilities unquantified.

The structural properties of power networks, hub substations, bridging transmission lines, and the degree of mesh connectivity play a central role in determining both operational security margins and adversarial exploitability [9]. Graph-theoretic metrics such as betweenness centrality, electrical betweenness, and spectral connectivity have been used extensively to characterize critical nodes and edges under physical contingencies, and these methods have been extended to cyber-physical threat scenarios where coordinated attacks target multiple topological components simultaneously [10]. Graph neural network approaches exploit the spatial correlation structure of power networks to detect stealthy false-data injection attacks, while topology-aware monitoring solutions improve intrusion-detection accuracy in substation automation systems [11]. On the defense side, decisions about which substations to harden, where to deploy intrusion-detection sensors, and which remote-access interfaces to restrict are critical for maximizing security under operational budget constraints [12]. Most existing methods, however, rely on heuristics based on static node attributes such as degree centrality or subjective asset criticality scores, computed independently of actual attack dynamics. These heuristics frequently miss indirect attack paths and fail to capture how partial compromises of non-critical intermediate nodes can enable adversaries to reach high-value targets via multi-hop lateral movement [13].

Despite significant advances in both attack graph research and topology-aware security analysis, critical integration gaps remain. Most existing attack graph frameworks for critical infrastructure treat the cyber and physical layers as loosely coupled, thereby missing structural constraints imposed by power network topology, such as the fact that communication connectivity in substations commonly mirrors physical bus adjacency, and thereby underestimating the threat-propagation potential of topology-aligned attack paths [14]. Game-theoretic defense formulations model adversarial interactions in power system security and provide rational resource allocation strategies [15,16], but they often assume deterministic vulnerability profiles that do not capture the probabilistic, path-dependent nature of multi-hop attack propagation across heterogeneous physical and cyber components. Stochastic risk assessment methods, including Monte Carlo-based frameworks, offer a principled alternative for quantifying attack reachability under uncertainty, yet their integration with topology-aware attack graph construction and budget-constrained defense optimization remains largely unexplored for power system operational contexts [17]. Furthermore, evaluation benchmarks that couple distribution- or transmission-level network topologies with cyber attack graph dynamics are scarce, making rigorous comparison of topology-aware defense strategies under realistic operational conditions difficult [18,19]. Addressing these gaps requires an integrated framework that leverages physical network structure at every stage of the security analysis pipeline, from attack graph construction through risk quantification to actionable defense optimization.

This paper addresses these gaps by proposing an enhanced topology-aware hierarchical attack graph construction (TAG) method. Our key contributions are as follows.

• A topology-aware hierarchical attack graph construction method is proposed that marks critical buses/substations and encodes edge-wise compromise probabilities conditioned on node criticality and defense status. This formulation directly couples the physical power-grid topology with cyber reachability modeling. TAG builds the attack graph atop the power-flow network topology, ensuring structural bottlenecks in the transmission or distribution grid are reflected in the attack-path model.
• An explicit cyber-physical interdependency and power-flow-aware impact model is introduced that defines how cyber-node compromise maps to power-grid consequences. A physical-impact-weighted risk objective $R_{\mathrm{phys}}\left(D\right)$ is derived and validated against DC power-flow contingency analysis on the benchmark networks, complementing the cyber-only reachability metric.
• A dual-mode defense model is introduced in which each selected substation receives both incoming hardening and local micro-segmentation, reducing lateral attack propagation from protected substations while also providing modest monitored-neighbor shielding.
• An efficient TAG optimizer is developed that uses source-critical candidate screening, deterministic probabilistic propagation, beam-search portfolio construction, one-swap local refinement, and final Monte Carlo re-ranking to search beyond single-pass greedy local optima.

The remainder of this paper is organized as follows. Section 2 reviews related work. Section 3 formulates the problem, including the new cyber-physical interdependency model. Section 4 presents the TAG framework, including attack graph construction, Monte Carlo risk evaluation, and dual-mode defense optimization. Section 5 describes the experimental setup and baseline methods. Section 6 reports and analyzes the results. Section 7 discusses the findings and limitations. Section 8 concludes the paper.

2. Related Work

2.1. Attack Graphs for Cyber-Physical Systems

Attack graphs have been widely used to analyze security in enterprise networks and cyber-physical systems, modeling multi-step attacks as paths from initial conditions to goal states [20]. For power systems, attack graphs have been constructed based on vulnerabilities in SCADA networks, substation configurations, and communication channels [7]. Hybrid deep learning methods have been proposed to automate attack-graph-based situational awareness in operational technology environments, achieving high accuracy in localizing active intrusions within substations and control centers [21]. Detection of false data injection attacks, a common attack vector in cyber-physical power systems, has been advanced through graph convolutional networks that exploit physical network topology [8]. However, many works treat the physical topology coarsely, focusing on logical connectivity rather than explicit bus and line structure, which can overlook important pathways where an attacker leverages both cyber and physical adjacency to propagate.

Hierarchical attack graphs introduce abstraction layers that group low-level vulnerabilities into higher-level states (e.g., substation compromised vs. individual device compromised). Such hierarchies improve scalability and interpretability but require careful design to preserve critical dependencies between cyber and physical components.

2.2. Topology-Aware Security Analysis

Topology plays a central role in power system security analysis. Graph-based methods have been used to identify critical lines and buses, compute vulnerability metrics, and design remedial actions. Coordinated cyber-physical attacks that selectively target subsets of topological components, exploiting the n-1 security criterion, have been shown to produce cascading failures that naive security assessments miss [10]. Recent work has explored graph neural networks for cyber-physical anomaly detection, demonstrating that the spatial structure of the power network provides a strong inductive bias for identifying stealthy intrusion attempts. Dynamic probabilistic risk assessment using Monte Carlo simulation has been applied to characterize the cybersecurity posture of electric grids under multi-event attack scenarios [22]. However, fewer efforts explicitly integrate physical topology into attack graph construction and defense optimization.

Topology-aware approaches can capture how attacks on specific substations affect power flows and connectivity, and how defending particular nodes can block multiple attack paths [11]. Our work exploits this by building attack graphs directly on the physical network graph and treating defense placement as a graph-constrained optimization problem with topology-aware enhancements.

2.3. Defense Placement and Risk Optimization

Defense placement has been studied in the context of sensor deployment, firewall placement, and patch management. Common heuristics include selecting nodes with the highest degree, betweenness centrality, or asset criticality [12]. While easy to compute, these heuristics may ignore attack dynamics and the probabilistic nature of compromise. Machine learning for intrusion detection in industrial control systems has been surveyed extensively, identifying the need for context-aware, topology-informed detection strategies [7,23].

Optimization-based methods formulate defense placement as an NP-hard combinatorial problem and resort to greedy or metaheuristic algorithms [14]. Game-theoretic formulations model the attacker-defender interaction as a strategic game, enabling rational resource allocation against adaptive adversaries [24]. Reinforcement learning has also been explored for dynamic defense policy learning against persistent cyber threats [19]. In this work, we adopt an enhanced greedy algorithm (TAG) that improves upon standard greedy selection by incorporating topology-aware scoring, providing strong empirical performance with interpretable defense recommendations and manageable computational overhead.

3. Problem Formulation

3.1. Terminology

To maintain consistency with power systems conventions, we adopt the following terminology throughout this paper. A bus is an electrical node in the power-flow model, representing a point of common coupling for generators, loads, or transmission lines. A substation is the physical facility that may contain one or more buses together with cyber assets (IEDs, RTUs, communication equipment). In this work, each physical bus in the benchmark networks corresponds to a single modeled substation for attack-graph purposes. A cyber node refers to communication or control assets (SCADA servers, RTUs, relays) that appear in the attack-graph model; in our single-layer abstraction, each bus/substation maps directly to one cyber node. The term graph node is reserved for generic mathematical statements. Accordingly, buses and substations are used in power-system and physical-layer contexts; cyber node is used when referring to the attack graph or compromise state; and node is used in purely graph-theoretic statements that apply to both layers.

3.2. Physical Network Model

Let $G_{\mathrm{phys}}=(V,E)$ denote the undirected physical network graph, where V is the set of buses (electrical nodes) and E is the set of transmission lines or feeders. Each bus $v\in V$ is associated with attributes such as bus type, voltage level, and asset criticality. We denote by $\mathcal{C}\subset V$ the set of critical buses (e.g., high-voltage substations, control centers).

The physical network is obtained from detailed power-system benchmark models available in pandapower/MATPOWER. We use bus and branch connectivity (including lines, transformers, and impedance branches where available) to construct the physical topology; geospatial coordinates are not required for attack graph construction.

3.3. Hierarchical Attack Graph

We construct a directed attack graph $G_{\mathrm{atk}}=(V_{\mathrm{atk}},E_{\mathrm{atk}})$ on top of the physical network. For this work, we use a single-layer abstraction in which each physical bus corresponds to an attack-graph cyber node that represents the compromised state of that substation. Thus $V_{\mathrm{atk}}=V$, and $E_{\mathrm{atk}}$ is derived from E by considering both directions of each undirected line. Authors: the italics can be removed in all the locations. Each directed edge $(u,v)\in E_{\mathrm{atk}}$ represents a feasible attack step where an adversary that has compromised bus/cyber node u attempts to compromise bus/cyber node v via existing communication or physical connectivity. We associate with each edge a compromise probability $p_{u,v}\in (0,1)$ that captures the likelihood of a successful attack step in a single attempt.

3.4. Defense Model

We consider a set of possible defense actions that harden specific substations (e.g., deploying stronger authentication, intrusion detection systems, or segmented networks). Let $D\subseteq V$ denote the set of defended substations. Defending a substation v reduces the probability that it can be compromised by any neighbor. We assume a defense budget K limiting the number of defended substations: $\left|D\right|\le K$. Our goal is to choose D such that the probability that an attacker reaches any critical bus in $\mathcal{C}$ is minimized.

3.5. Risk Metric

We define a set of initial attack sources $S\subseteq V\setminus \mathcal{C}$ representing non-critical entry points (e.g., low-security substations, remote access points). Given an attack graph $G_{\mathrm{atk}}\left(D\right)$ parameterized by the defended set D, we consider a discrete-time attack process over T steps. At each step, compromised cyber nodes attempt to compromise their neighbors with edge-wise probabilities $p_{u,v}\left(D\right)$.

Let $R\left(D\right)$ denote the probability that at least one critical bus in $\mathcal{C}$ becomes compromised within T steps, starting from the initial compromised set S. Formally,

$$R\left(D\right)=\mathbb{P}\left(\exists t\le T,\exists c\in \mathcal{C}:{\mathrm{state}}_t\left(c\right)=1|S,D\right),$$

(1)

where ${\mathrm{state}}_t\left(c\right)=1$ indicates that cyber node c is compromised at time t. Our objective is

$$D^{*}=arg\underset{D\subseteq V,\left|D\right|\le K}{min}R\left(D\right).$$

(2)

3.6. Cyber-Physical Interdependency and Power-Flow-Aware Impact Modeling

The cyber-only risk metric $R\left(D\right)$ quantifies the probability of reaching any critical bus, but does not differentiate between critical buses based on their operational importance to the physical power grid. A bus with many incident transmission lines, high generation capacity, or a central position in the power flow has a disproportionately large physical impact if compromised. This section introduces a power-flow-aware impact score $I_{\mathrm{phys}}\left(c\right)$ and a cyber-physical risk objective $R_{\mathrm{phys}}\left(D\right)$ that combines reachability with physical consequence.

3.6.1. Cyber-Physical Mapping

Each physical bus $v\in V$ hosts one or more cyber assets (IED, RTU, communication interface) whose compromise directly impairs the monitoring, protection, or control capabilities of that bus. Specifically:

• Compromise of a transmission substation (high-degree bus with multiple incident lines) enables an adversary to manipulate protective relay settings or issue false trip commands, risking line disconnection and cascading overloads.
• Compromise of a generation bus enables manipulation of active-power setpoints, potentially causing frequency deviations or unit disconnection.
• Compromise of a distribution feeder bus (radial topology) enables voltage-regulator manipulation and targeted load-shedding.

These mappings motivate weighting reachability by the physical consequence $I_{\mathrm{phys}}\left(c\right)$ of compromising each critical bus c.

3.6.2. Physical Impact Score

We define $I_{\mathrm{phys}}\left(c\right)$ via DC power-flow contingency analysis. For each critical bus $c\in \mathcal{C}$, we solve the DC power flow on the base network, then remove all lines incident to c (simulating loss of substation control) and re-solve. The impact score aggregates three metrics:

1.

${\Delta }_{\mathrm{angle}}\left(c\right)$: number of buses exhibiting bus-angle deviation $>5^{\circ }$ after outage of c,

2.

${\Delta }_{\mathrm{overload}}\left(c\right)$: number of lines loaded above $90\%$ of thermal capacity after outage of c,

3.

${\Delta }_{\mathrm{conn}}\left(c\right)$: number of incident branches disconnected (degree of c).

The raw score is $\tilde{I}\left(c\right)={\Delta }_{\mathrm{angle}}\left(c\right)+0.5{\Delta }_{\mathrm{overload}}\left(c\right)+{\Delta }_{\mathrm{conn}}\left(c\right)$, normalized as $I_{\mathrm{phys}}\left(c\right)=\tilde{I}\left(c\right)/{max}_{c^{\prime }\in \mathcal{C}}\tilde{I}\left(c^{\prime }\right)$ so that $I_{\mathrm{phys}}\left(c\right)\in (0,1]$.

3.6.3. Cyber-Physical Risk Objective

The physical-impact-weighted risk is defined as

$$R_{\mathrm{phys}}\left(D\right)=\sum _{c\in \mathcal{C}}{P}_{\mathrm{reach}}(c\mid S,D)·I_{\mathrm{phys}}\left(c\right),$$

(3)

where $P_{\mathrm{reach}}(c\mid S,D)$ is the Monte Carlo estimate of the probability that critical bus c is reached within T steps from sources S under defended set D. When all critical buses are equally important ($I_{\mathrm{phys}}\left(c\right)=\mathrm{const}$), $R_{\mathrm{phys}}\left(D\right)$ reduces to a scaled version of $R\left(D\right)$.

The TAG optimizer minimizes the cyber-only risk $R\left(D\right)$; the physical-impact score $I_{\mathrm{phys}}\left(c\right)$ is used post hoc to evaluate and compare defense strategies in terms of power-system consequence.

4. Methodology

Figure 1 summarizes the end-to-end TAG workflow. The method begins with system inputs and probabilistic vulnerability modeling, constructs a hierarchical attack graph that links system-wide cyber-physical topology with component-level attack states, estimates risk through Monte Carlo simulation and attack-portfolio selection, and finally produces a dual-mode defense plan that combines optimized node hardening, micro-segmentation, and monitored-neighbor shielding. The subsections below formalize each stage of this workflow.

Figure 1. Overview of the TAG method. (1) System inputs and initial modeling: The physical bus/branch topology is taken as input, with critical buses marked in red and node probabilistic attributes ($p_0$, $\alpha$, $\beta$) assigned to build a statistical vulnerability profile. (2) Hierarchical TAG construction: A two-level attack graph is built on the physical network, where Level 1 captures system-wide cyber-physical connectivity with edges weighted by attack propagation probability, and Level 2 models component-specific vulnerable states linked by concrete exploit steps. (3) TAG-based risk estimation and attack portfolio selection: Monte Carlo simulation estimates the critical-reach probability $R\left(D\right)$, and a multi-stage algorithm combining beam search, one-swap local refinement, and Monte Carlo re-ranking selects the optimal defense set. (4) Outputs and dual-mode defense planning: The optimized portfolio identifies high-impact attack paths and assigns each selected substation incoming hardening ($\beta$), outgoing micro-segmentation ($\eta =0.55$), and monitored-neighbor shielding ($\rho =0.15$) across two deployment modes: node hardening with micro-segmentation (Mode 1) and monitored-neighbor shielding (Mode 2). In the figure, red nodes denote critical components, gray nodes denote other cyber-logical links or components, directed arrows indicate attack-propagation or workflow dependencies, and the symbols $p_0$, $\alpha$, $\beta$, $\eta$, and $\rho$ denote the initial compromise probability, propagation-related vulnerability parameter, incoming hardening factor, micro-segmentation factor, and monitored-neighbor shielding factor, respectively.

4.1. Topology-Aware Attack Graph Construction

Given $G_{\mathrm{phys}}$, $G_{\mathrm{atk}}$ is constructed by initializing a directed graph with node set $V_{\mathrm{atk}}=V$, then for each undirected edge $\{u,v\}\in E$ adding two directed edges $(u,v)$ and $(v,u)$ to $E_{\mathrm{atk}}$, and finally assigning a criticality flag to buses in $\mathcal{C}$ (e.g., top-k highest-degree buses, representing the most interconnected substations). A vulnerability profile is then defined with three parameters: a base compromise probability $p_0$ for non-critical, undefended cyber nodes; a criticality multiplier $\alpha \in (0,1)$ that reduces compromise probability for critical buses, modeling the stronger security controls typically deployed at high-value assets; and a defense reduction factor $\beta \in (0,1)$ representing the effect of active hardening on incoming compromise probability. For each edge $(u,v)$, we set

$$p_{u,v}\left(D\right)=max(ϵ,min(0.99,p_0·{\gamma }_v)),$$

(4)

where

$${\gamma }_v=\left\{\begin{array}{cc}(1-\alpha ),\hfill & \mathrm{if}v\in \mathcal{C},\hfill \\ 1,\hfill & \mathrm{otherwise},\hfill \end{array}\right.{\gamma }_v\leftarrow {\gamma }_v·(1-\beta )\mathrm{if}v\in D,$$

(5)

and $ϵ={10}^{-3}$ is a small constant to avoid zero probabilities. The value $ϵ={10}^{-3}$ ensures numerical stability without materially affecting risk estimates; a sensitivity analysis over $ϵ\in \{{10}^{-4},{10}^{-3},{10}^{-2}\}$ (Section 6.5.3) confirms that results are insensitive to this choice within this range.

4.2. Monte Carlo Risk Evaluation

Closed-form computation of $R\left(D\right)$ is intractable for large graphs due to the combinatorial explosion of possible attack paths; Monte Carlo simulation is therefore employed instead. The compromised set is initialized as $C_0=S$, and at each time step $t=1,\dots ,T$, every cyber node $u\in C_{t-1}$ attempts to compromise each neighbor v along outgoing edges $(u,v)$ independently with probability $p_{u,v}\left(D\right)$, updating $C_t=C_{t-1}\cup \left\{v\mathrm{compromised}\mathrm{at}\mathrm{step}t\right\}$; if $C_t\cap \mathcal{C}\ne \varnothing$, success is recorded for that trial and propagation halts. This process is repeated for $N_{\mathrm{trials}}$ independent trials, yielding the estimator

$$\widehat{R}\left(D\right)={\displaystyle \frac{1}{N_{\mathrm{trials}}}}{\displaystyle \sum _{i=1}^{N_{\mathrm{trials}}}}\mathbf{1}\left\{\mathrm{trial}i\mathrm{reaches}\mathcal{C}\right\}.$$

(6)

In all main experiments, we use $T=5$ steps and $N_{\mathrm{trials}}=800$. All strategies are evaluated using the same random seed and the same source set in each matched comparison, ensuring a fair and reproducible comparison.

Statistical Validity

With $N_{\mathrm{trials}}=800$, the standard error of the MC estimator is $\mathrm{SE}=\sqrt{\widehat{R}(1-\widehat{R})/N}\le 0.018$ for any $\widehat{R}$. Hoeffding’s inequality gives a $95\%$ confidence interval half-width of ≤$1.96\times 0.018=0.035$. The observed differences between TAG and the next-best baseline (Greedy) range from $0.10$ to $0.25$ across networks. We further validate this via 10-batch repeated evaluation in Section 6.3.

4.3. TAG Defense Optimization

The exact optimization of $D^{*}$ is combinatorial and generally NP-hard. A preliminary topology-aware greedy variant improved upon greedy primarily through centrality-aware tie-breaking, but this was not sufficient to consistently escape greedy local optima. The final TAG method therefore changes both the search procedure and the operational defense action while preserving the same node budget K.

4.3.1. Dual-Mode Defense Action

Baseline strategies model a defended substation $v\in D$ as incoming hardening only, reducing the compromise probability into v by $(1-\beta )$. TAG instead models a deployable substation security package comprising authentication/patch hardening, micro-segmentation, and local monitoring. Thus, if an edge $(u,v)$ is incident to defended substations, its effective probability is

$$p_{u,v}^{\mathrm{TAG}}\left(D\right)=p_{u,v}\left(D\right)·{(1-\eta )}^{\mathbf{1}\{u\in D\}}·{(1-\rho )}^{\mathbf{1}\{v\in \mathcal{N}(D)\setminus D\}},$$

(7)

where $\eta =0.55$ is the segmentation/containment factor for outgoing propagation from a defended substation, $\rho =0.15$ is the monitored-neighbor shielding factor, and $\mathcal{N}\left(D\right)$ is the one-hop neighborhood of defended substations. The selection of $\eta =0.55$ and $\rho =0.15$ as defaults is supported by a systematic parameter sensitivity analysis over $\eta \in [0.30,0.80]$ and $\rho \in [0.05,0.30]$ reported in Section 6.5.3. The sensitivity analysis confirms that method rankings are robust across the full tested range, and that the selected defaults lie within the region of best risk-reduction performance. The value $\eta =0.55$ reflects a residual $45\%$ lateral propagation probability from a hardened substation after micro-segmentation, consistent with the incomplete but significant containment achievable through enhanced access control. The value $\rho =0.15$ is conservative, ensuring that monitored-neighbor effects do not artificially inflate TAG’s advantage over placement-only baselines.

4.3.2. Topology-Aware Candidate Portfolio

TAG first builds a candidate pool using degree centrality, betweenness centrality, PageRank on the attack graph, source-to-critical shortest-path participation, critical-bus membership, and one-hop neighborhoods around sources and critical buses. This prevents the optimizer from wasting evaluations on substations that are topologically irrelevant to the bounded-horizon attack.

4.3.3. Fast Propagation Screening

To avoid relying exclusively on noisy Monte Carlo estimates during search, TAG uses a deterministic independent-cascade approximation. Let $q_t\left(v\right)$ denote the approximate probability that cyber node v is compromised by time t. Given defended set D, the update is

$$q_{t+1}\left(v\right)=1-(1-q_t\left(v\right))\prod _{u:(u,v)\in E_{\mathrm{atk}}}\left(1-q_t\left(u\right)p_{u,v}^{\mathrm{TAG}}\left(D\right)\right),$$

(8)

with $q_0\left(s\right)=1$ for $s\in S$. The approximate critical-reach risk is $1-{\prod }_{c\in \mathcal{C}}(1-q_T\left(c\right))$. This approximation is exact only on trees; in densely meshed networks, it may overestimate risk due to path-dependence violations, but it is used exclusively for fast candidate screening during portfolio construction, not for any reported risk value. All reported results are Monte Carlo estimates.

4.3.4. Beam Search, Local Refinement, and MC Re-Ranking

TAG constructs a portfolio of defense sets from centrality seeds, the original greedy solution, approximate greedy, beam search, and one-swap local refinement. Specifically, the portfolio is built as follows: (i) four seed sets are formed from the top-K nodes ranked by degree, betweenness, PageRank, and source-to-critical path participation, respectively; (ii) the vanilla greedy solution (incoming-hardening-only) is included; (iii) an approximate greedy with dual-mode scoring generates one more candidate; (iv) beam search with width 10 generates up to 10 beam paths; (v) the top-12 candidates under the fast approximation each receive one round of one-swap local search (accept if swap improves approximate risk by >${10}^{-6}$), producing up to 12 additional unique candidates. Duplicate sets are removed by hashing frozensets. The resulting portfolio is sorted by approximate risk, and the top 25 unique candidate sets are retained. (vi) These 25 sets are re-evaluated using the same Monte Carlo evaluator (same $N_{\mathrm{trials}}=800$, same random seed as all baselines) with the full dual-mode defense model. The set achieving the lowest MC risk is selected as the TAG-defended set $D^{\mathrm{TAG}}$. The greedy solution is always included in the final MC evaluation as a safeguard. The final MC re-ranking determines the reported TAG-defended set and risk, as shown in the Algorithm 1.

Algorithm 1 TAG Algorithm (Dual-Mode Topology-Aware Defense).

1: Input: Physical graph $G_{\mathrm{phys}}$, vulnerability profile $\{p_0,\alpha ,\beta ,\eta ,\rho ,ϵ\}$, attack sources S, budget K, horizon T, trials N  2: Output: Defended set $D^{\mathrm{TAG}}$, Monte Carlo risk history  3: Compute {degree, betweenness, PageRank, path score} on $G_{\mathrm{phys}}$/$G_{\mathrm{atk}}$  4: Build candidate pool: top-$\left(4K\right)$ by composite score, plus one-hop nbhds of S and $\mathcal{C}$  5: Generate seed sets:{top-K degree, top-K betweenness, top-K PageRank, top-K path score, vanilla greedy} (5 sets)  6: Approximate greedy with dual-mode $p_{u,v}^{\mathrm{TAG}}\left(D\right)$ over candidate pool → 1 set  7: Beam search (width = 10) over candidate pool with deterministic propagation → up to 10 sets  8: Remove duplicates (frozenset hash); retain portfolio $\mathcal{P}$  9: One-swap local search: for each of the top-12 $\mathcal{P}$ members by approximate risk, swap one node for any candidate; accept swap if $\Delta r<-{10}^{-6}$; repeat up to 3 passes → up to 12 new sets 10: Remove duplicates; keep top-25 by approximate risk (always include vanilla greedy) 11: MC re-ranking: evaluate all top-25 sets with N trials, full $p_{u,v}^{\mathrm{TAG}}\left(D\right)$, same seed as baselines 12: Order the selected set by MC marginal risk for the budget curve 13: return best MC-ranked set $D^{\mathrm{TAG}}$ and risk history

A detailed flowchart of the TAG optimization pipeline is provided in Figure 2.

Figure 2. Detailed TAG optimization flowchart. Dashed boxes indicate steps that use the deterministic propagation approximation only for screening; all reported risk values are MC estimates produced in the final re-ranking step.

4.4. Relation to Statistical Model Checking and Formal Methods

TAG uses Monte Carlo simulation to estimate $\widehat{R}\left(D\right)$, which can be interpreted within the framework of statistical model checking (SMC) [25]: given a PCTL-style reachability property $\mathcal{P}\left[\mathrm{reach}\right(\mathcal{C})\le T]\ge 1-\tau$, SMC provides a probabilistic guarantee of the form

$$\mathbb{P}\left(|\widehat{R}\left(D\right)-R\left(D\right)|\le \delta \right)\ge 1-{\alpha }_{\mathrm{SMC}},$$

(9)

where $\delta$ is the desired accuracy and ${\alpha }_{\mathrm{SMC}}$ is the acceptable error probability. By Hoeffding’s inequality, $N_{\mathrm{trials}}\ge ln(2/{\alpha }_{\mathrm{SMC}})/\left(2{\delta }^2\right)$ trials suffice. For $\delta =0.02$ and ${\alpha }_{\mathrm{SMC}}=0.05$, this requires $N_{\mathrm{trials}}\ge 1844$ trials; our choice of $N_{\mathrm{trials}}=800$ corresponds to $\delta =0.029$ at $95\%$ confidence, which is smaller than the observed performance gaps between methods (minimum gap $0.10$).

Full formal verification via probabilistic model checking offers stronger guarantees but is computationally intractable for networks with hundreds of buses: the state space grows exponentially with $\left|V\right|$, making exact symbolic computation infeasible beyond ∼20 nodes for multi-step reachability. Bounded model checking could address shorter horizons ($T\le 3$) but remains challenging for the $T=5$ horizon used here.

5. Experimental Setup

5.1. Network Topologies

To rigorously assess the generalization capability and operational relevance of the proposed TAG framework, experiments are conducted on four benchmark networks that collectively span the principal structural characteristics of real power systems, including radial distribution feeders, compact meshed transmission systems, large-scale looped networks, and multi-area reliability-oriented configurations. This breadth of evaluation is deliberately designed to stress-test TAG across substantially different topological regimes, exposing sensitivity to network diameter, hub density, and mesh redundancy. These factors fundamentally govern the feasibility and the horizon depth of multi-step attack propagation. This study considers four real or community-standard benchmark networks: The MV Feeder is a 179-bus medium-voltage distribution network with 183 topological branches, available through the pandapower network library [26]. Its predominantly radial structure creates long, low-redundancy propagation corridors from peripheral entry points toward the five critical buses designated as the top-5 highest-degree nodes. As established in the distribution systems literature, distribution feeders are structurally distinguished from transmission networks by their tree-like operational topology, with a substation at the root bus connected via sequential intermediate nodes to terminal load buses [27]. The sparse, tree-like connectivity of this feeder constrains lateral movement during bounded-horizon attack simulation, making it a structurally demanding benchmark for node-placement strategies that rely on centrality metrics derived from global graph properties rather than local attack-path geometry [9].

The IEEE 39-bus New England system is a compact but topologically realistic transmission benchmark with 39 buses, 46 branches, and 3 critical buses [26]. Despite its relatively small scale, this network exhibits a well-studied meshed topology with several high-degree hub buses, making it a standard reference for evaluating the interaction between defense placement and attack-path diversity. The moderate connectivity density produces a high undefended baseline risk, as multiple short paths connect non-critical entry points to critical generation substations [9].

The IEEE 118-bus system is a widely used community benchmark for transmission-system studies with 118 buses, 179 branches, and 6 critical buses [26]. Its dense inter-regional mesh topology and multiple parallel paths between high-degree substations make it the most structurally challenging test case among the four benchmarks: many short, overlapping attack paths simultaneously reach critical nodes, thereby both elevating the undefended baseline risk and reducing the marginal benefit of any single defense node [9]. This combination makes it a canonical stress case for assessing whether topology-aware defense optimization can yield consistent improvements over placement-only heuristics [28,29].

The RTS-96 system is composed of three RTS-24 areas interconnected by inter-area tie lines, yielding 72 buses, 111 branches, and 4 critical buses [26]. Its multi-area structure introduces bridging tie-line buses that simultaneously participate in attack paths from different source regions, creating a heterogeneous risk landscape that is qualitatively distinct from both the radial MV Feeder and the uniformly meshed IEEE 118-bus network [30]. Defending these cross-area bridge nodes has a disproportionate impact on overall risk, providing a natural test of whether TAG’s topology-aware candidate portfolio correctly identifies and prioritizes structurally critical positions that are not captured by conventional centrality rankings [9,29].

Table 1 summarizes network statistics. All experiments use the same fixed random seed for reproducibility. The selection of these four benchmarks ensures that evaluation results are neither dominated by a single topological regime nor artificially optimistic due to the use of a single well-studied graph structure. Together, they represent a systematic cross-section of network sizes, connectivity patterns, and critical-node configurations that are representative of real power system operational environments.

Table 1. Network statistics.

Network	$\left|\mathit{V}\right|$	$\left|\mathit{E}\right|$	$\left|\mathcal{C}\right|$	Type
MV Feeder	179	183	5	Real MV distribution feeder
IEEE 39-bus	39	46	3	New England transmission benchmark
IEEE 118-bus	118	179	6	Standard transmission benchmark
RTS-96	72	111	4	Reliability/security benchmark

5.2. Attack and Defense Parameters

A unified vulnerability profile is applied across all four benchmark networks to ensure that observed performance differences are attributable to topological structure rather than parameter tuning. The base compromise probability is set to $p_0=0.3$, reflecting a moderately capable adversary whose individual attack steps succeed with non-trivial but sub-dominant probability, a regime in which defense placement decisions have the highest discriminative impact. The criticality multiplier $\alpha =0.5$ models the empirically supported observation that high-value substations are typically equipped with stronger baseline authentication and access controls, reducing their per-step compromise probability by half relative to non-critical nodes. The defense reduction factor $\beta =0.6$ represents the effect of an active hardening deployment on incoming attack probability, consistent with representative values reported in prior cyber-physical risk assessment literature.

The attack simulation runs for a horizon of $T=5$ steps, starting from $\left|S\right|=3$ randomly selected non-critical entry points, with risk quantified via $N_{\mathrm{trials}}=800$ independent Monte Carlo trials per evaluation. The choice of $T=5$ is supported by the sensitivity analysis presented in Section 6.5.2, which confirms that risk profiles plateau by approximately $T=7$ steps across all tested networks, indicating that a five-step horizon captures the dominant attack-reachability dynamics without incurring unnecessary computational cost. The defense budget is fixed at $K=5$ substations throughout the main experiments, and all methods operate under the same budget constraint to ensure a fair comparison.

TAG-specific parameters are $\eta =0.55$ for the segmentation and containment factor on outgoing propagation from defended nodes, and $\rho =0.15$ for the monitored-neighbor shielding factor on adjacent undefended nodes. The justification for these defaults is provided by the parameter calibration study. All experiments use the parameters shown in Table 2.

Table 2. Experimental parameters.

Parameter	Symbol	Value
Base compromise probability	$p_0$	0.3
Criticality multiplier	$\alpha$	0.5
Defense reduction factor	$\beta$	0.6
Attack horizon	T	5 steps
Monte Carlo trials	$N_{\mathrm{trials}}$	800
Defense budget	K	5 substations
Attack sources	$\left|S\right|$	3 non-critical buses
TAG segmentation factor	$\eta$	0.55
TAG neighbor shielding	$\rho$	0.15
Probability floor	$ϵ$	${10}^{-3}$

5.3. Baseline Methods

Seven baseline strategies are evaluated to provide a comprehensive frame of reference that spans random placement, static centrality heuristics, metaheuristic optimization, and greedy sequential placement. This diversity of baselines is essential for isolating the independent contributions of (i) topology-aware candidate selection, (ii) portfolio-based search beyond single-pass greedy, and (iii) the dual-mode defense action, which jointly constitute the TAG advantage over prior approaches.

No Defense represents the undefended baseline risk $\widehat{R}(\varnothing )$ and serves as the reference against which all relative risk reductions are subsequently computed. Random averages the defended risk over five independent random selections of K nodes drawn uniformly without replacement, providing a lower bound on the benefit of any informed placement strategy. Degree, Betweenness, and PageRank defend the K nodes with the highest values of the respective static centrality metric computed on the attack graph, representing the class of single-pass heuristics that are widely deployed in practice due to their simplicity and interpretability.

Simulated annealing (SA) is a metaheuristic defense optimizer that uses a temperature schedule initialized at $T_0=1.0$ with a cooling rate of $0.90$ and 20 inner iterations per temperature level. SA is included as a representative of stochastic optimization methods that can, in principle, escape local optima but whose performance is sensitive to schedule hyperparameters and may exhibit premature convergence on high-dimensional or multimodal search landscapes. Greedy (Original) follows a standard sequential greedy procedure that selects at each step the node providing the greatest marginal reduction in Monte Carlo-estimated risk under the incoming-hardening-only defense model. This baseline is the direct precursor to TAG and provides a reference for quantifying the benefit of the TAG-specific enhancements independently of the defense model.

All methods receive identical inputs: the same physical network, vulnerability profile, attack sources S, horizon T, budget K, trial count $N_{\mathrm{trials}}$, and random seed. All methods evaluate risk using the same Monte Carlo estimator with the same seed, ensuring differences in final risk reflect the quality of the defended set rather than sampling variation. All placement-only baselines, including Greedy (Original), use the incoming-hardening-only defense model ($\beta =0.6$ reduction on incoming edges only), while TAG additionally applies the outgoing segmentation factor $\eta$ and the monitored-neighbor shielding factor $\rho$. The performance advantage of TAG is interpreted as reflecting both the richer search procedure and the stronger per-node defense action jointly enabled by the TAG substation security package.

6. Results and Analysis

6.1. Baseline Risk Without Defenses

Table 3 reports the undefended critical-reach probability $\widehat{R}(\varnothing )$ from $N_{\mathrm{trials}}=800$ Monte Carlo trials for each benchmark network, providing the baseline risk from which all relative reductions are subsequently computed. Across all four networks, the probability that an adversary starting from three randomly selected non-critical entry points reaches at least one critical bus within $T=5$ steps ranges from 0.569 to 0.940, confirming that the undefended threat level is operationally significant across all tested topological regimes. These high baseline values are structurally explained by the short average path lengths from non-critical to critical buses in meshed transmission networks: in the IEEE 118-bus case, the dense inter-regional mesh creates numerous two- and three-hop paths from peripheral nodes to high-degree critical buses, yielding the highest baseline risk of 0.940. In contrast, the radial feeder topology of the 179-bus MV network constrains propagation to predominantly long, sequential corridors, reducing the number of simultaneously active short paths and producing the lowest baseline risk of 0.569.

Table 3. Baseline critical reach probability without defenses ($N_{\mathrm{trials}}=800$, $T=5$).

Network	$\left|\mathit{V}\right|$	$\left|\mathit{E}\right|$	$\left|\mathcal{C}\right|$	$\widehat{\mathit{R}}\left(\mathit{\varnothing }\right)$
MV Feeder	179	183	5	0.569
IEEE 39-bus	39	46	3	0.905
IEEE 118-bus	118	179	6	0.940
RTS-96	72	111	4	0.680

The IEEE 39-bus system exhibits a notably high baseline risk of 0.905 despite its compact size, a consequence of the network’s well-connected meshed topology, where several critical generation buses are topologically adjacent to or within two hops of multiple non-critical sources. The RTS-96 system, with its multi-area structure and four critical buses, achieves an intermediate baseline risk of 0.680, reflecting the balance between increased critical-node coverage across three areas and the bottlenecking effect of the sparse inter-area tie lines that must be traversed for cross-area attack propagation. These structural insights directly inform the defense placement analysis: networks with high baseline risk and high topological redundancy are inherently more difficult to defend with a fixed budget, and differences in performance across strategies are amplified in precisely these cases.

6.2. Comprehensive Strategy Comparison

Table 4 reports the final risk at $K=5$ for all eight strategies and four networks, and Table 5 shows corresponding relative risk reductions with respect to the undefended baseline. Figure 3 shows the risk vs. budget curves for all strategies on IEEE 118-bus. Several structural patterns emerge from these results that go beyond a simple ranking of methods and reveal how topological structure determines the effectiveness of different placement philosophies.

Table 4. Final risk $\widehat{R}\left(D_5\right)$ at defense budget $K=5$—all strategies and networks.

Strategy	MV	IEEE 39	IEEE 118	RTS-96	Mean
No Defense	0.569	0.905	0.940	0.680	0.773
Random	0.519	0.820	0.921	0.650	0.728
Betweenness	0.569	0.568	0.940	0.649	0.681
PageRank	0.569	0.583	0.757	0.621	0.632
Degree	0.266	0.566	0.757	0.366	0.489
SA	0.295	0.537	0.840	0.311	0.496
Greedy (Original)	0.215	0.547	0.616	0.253	0.408
Proposed (TAG)	0.117	0.302	0.430	0.122	0.243

Table 5. Relative risk reduction (%) at $K=5$ vs. no-defense baseline.

Strategy	MV	IEEE 39	IEEE 118	RTS-96	Mean
Random	8.7%	9.4%	2.0%	4.4%	6.1%
Betweenness	0.0%	37.3%	0.0%	4.6%	10.5%
PageRank	0.0%	35.6%	19.4%	8.6%	15.9%
Degree	53.2%	37.4%	19.4%	46.1%	39.0%
SA	48.1%	40.6%	10.6%	54.2%	38.4%
Greedy (Original)	62.2%	39.5%	34.4%	62.9%	49.8%
Proposed (TAG)	79.3%	66.6%	54.3%	82.0%	70.5%

Figure 3. Risk vs. defense budget K for all strategies on IEEE 118-bus. TAG achieves the lowest final risk at every budget level shown, separating clearly from vanilla greedy and all static heuristics.

Figure 4 summarizes the corresponding relative risk reductions with respect to the no-defense baseline. TAG consistently achieves the highest reduction across all four networks, reaching 82% on RTS-96 and 79.3% on the MV Feeder. Static centrality methods are less reliable, with Betweenness and PageRank failing on some networks.

Figure 4. Relative risk reduction (%) at $K=5$ for all strategies across the four benchmark networks. Betweenness fails on the MV Feeder and the IEEE 118-bus (0% reduction), whereas PageRank fails on the MV Feeder, highlighting the danger of relying solely on static centrality in dynamic attack settings. TAG achieves the largest reduction across all networks, while Greedy (Original) is the strongest placement-only baseline.

TAG achieves a mean relative risk reduction of $70.5\%$ across all four networks at $K=5$, with individual network reductions of $79.3\%$ (MV Feeder), $66.6\%$ (IEEE 39-bus), $54.3\%$ (IEEE 118-bus), and $82.0\%$ (RTS-96), outperforming all baselines on every tested configuration. The variation in TAG’s absolute risk reduction across networks, strongest on the RTS-96 (0.558 absolute reduction) and MV Feeder (0.452 absolute reduction) and relatively weaker on the IEEE 118-bus (0.510 absolute reduction from a higher baseline), is structurally coherent: networks in which a small number of topologically critical nodes control a large fraction of source-to-critical attack paths permit concentrated defense packages to disrupt a disproportionate share of adversarial reach. The TAG candidate portfolio explicitly identifies such nodes through combined degree, betweenness, and path-participation scoring, enabling the dual-mode defense deployment to maximally exploit structural bottlenecks.

The Greedy (Original) method is the strongest among the placement-only baselines, achieving a mean risk of 0.408 across the four networks. TAG reduces this to 0.243, representing a $40.4\%$ improvement over vanilla greedy. This improvement is particularly pronounced on the RTS-96 ($51.5\%$ lower final risk) and MV Feeder ($45.3\%$ lower final risk), where the multi-area tie-line structure and the radial feeder topology, respectively, create structural asymmetries that single-pass greedy selection, constrained by its myopic per-step evaluation, systematically fails to exploit.

Static centrality heuristics exhibit severe failure modes on specific networks directly traceable to their topological assumptions. Betweenness centrality achieves $0\%$ relative risk reduction on both the MV Feeder and IEEE 118-bus, and PageRank achieves $0\%$ on the MV Feeder. These failures arise because betweenness and PageRank identify globally important nodes based on all-pairs shortest paths and random-walk equilibria, respectively, which are not aligned with the specific source-to-critical attack paths active under the bounded-horizon attack model.

SA achieves only a $10.6\%$ relative risk reduction on the IEEE 118-bus. This underperformance is attributable to premature convergence driven by the geometric cooling schedule: in the dense IEEE 118-bus network, the optimization landscape contains many near-equivalent local optima, and the fixed cooling rate causes the algorithm to commit to one such optimum before the global structure of the landscape has been adequately explored. TAG addresses this through portfolio diversity and deduplication, evaluating multiple structurally distinct candidate configurations before final MC re-ranking.

6.3. Statistical Validation

To assess whether the observed performance differences are statistically significant and not artifacts of Monte Carlo sampling variation, we repeat the main experiment under 10 independent random seeds (${\mathrm{seed}}_b=42+100b$, $b=0,\dots ,9$), each performing a complete strategy evaluation with $N_{\mathrm{trials}}=800$ Monte Carlo trials. Table 6 reports the mean ± standard deviation and 95% bootstrap confidence interval for TAG and the three strongest baselines. Paired Wilcoxon signed-rank tests between TAG and each baseline across the 10 batches are performed; all comparisons yield $p<0.05$, confirming that TAG’s advantage is statistically significant across all four networks at the $\alpha =0.05$ level.

Table 6. Statistical summary: mean risk ± SD and 95% CI from 10 independent MC batches (seeds $42,142,\dots ,942$; $K=5$, $N_{\mathrm{trials}}=800$ per batch).

Strategy	MV Feeder	IEEE 39	IEEE 118	RTS-96
No Defense	$0.589\pm 0.013$	$0.884\pm 0.011$	$0.875\pm 0.011$	$0.960\pm 0.006$
	[0.580, 0.598]	[0.876, 0.892]	[0.868, 0.883]	[0.956, 0.964]
Greedy	$0.245\pm 0.017$	$0.515\pm 0.018$	$0.496\pm 0.013$	$0.670\pm 0.010$
	[0.234, 0.256]	[0.503, 0.526]	[0.487, 0.505]	[0.664, 0.677]
Degree	$0.284\pm 0.019$	$0.572\pm 0.019$	$0.563\pm 0.022$	$0.703\pm 0.020$
	[0.272, 0.297]	[0.559, 0.584]	[0.547, 0.579]	[0.690, 0.717]
TAG	$\mathbf{0}.\mathbf{130}\pm \mathbf{0}.\mathbf{013}$	$\mathbf{0}.\mathbf{322}\pm \mathbf{0}.\mathbf{019}$	$\mathbf{0}.\mathbf{257}\pm \mathbf{0}.\mathbf{013}$	$\mathbf{0}.\mathbf{528}\pm \mathbf{0}.\mathbf{008}$
	[0.121, 0.140]	[0.309, 0.336]	[0.247, 0.266]	[0.522, 0.534]

6.4. Ablation Study

A controlled ablation study on the IEEE 118-bus network is presented in Figure 5 to isolate the independent contributions of the three principal TAG enhancements: betweenness-centrality tiebreaking and path-relevance candidate pruning, topology-weight scoring in the candidate portfolio, and the dual-mode defense action combining micro-segmentation with monitored-neighbor shielding.

Figure 5. Ablation study of TAG components on IEEE 118-bus. The full TAG method achieves the best final risk, showing that the portfolio search and dual-mode defense model provide a clear advantage over placement-only greedy variants.

The removal of the topology weight from the candidate scoring function (w/o topology weight variant) produces a measurable increase in final risk, particularly at intermediate budgets $K=2$–4. The w/o BC Tiebreak variant, which reduces to the vanilla greedy procedure, matches the Greedy (Original) curve and substantially underperforms both TAG variants at all budget levels. The degree baseline diverges significantly from all greedy-family methods across the full budget range.

6.5. Sensitivity Analysis

6.5.1. Sensitivity to Base Compromise Probability $p_0$

Final defended risk at $K=5$ is reported in Figure 6 as the base compromise probability $p_0$ varies from 0.1 to 0.7. TAG consistently achieves the lowest defended risk across the full $p_0$ range.

Figure 6. Sensitivity of final risk to base compromise probability $p_0$ (IEEE 118-bus, $K=5$). All strategies degrade gracefully; TAG and Greedy maintain the largest margin over No Defense and Degree across all tested values.

6.5.2. Sensitivity to Defense Reduction Factor $\beta$

The variation of final risk with $\beta \in [0.1,0.9]$ is shown in Figure 7. All strategies improve monotonically as $\beta$ increases. TAG consistently outperforms all baselines across all $\beta$ values, and strategy rankings are stable throughout the tested range.

Figure 7. Sensitivity to defense reduction factor $\beta$ (IEEE 118-bus, $K=5$).

6.5.3. TAG Parameter Calibration: $\eta$, $\rho$, and $ϵ$

Figure 8 reports TAG risk reduction as a function of the segmentation factor $\eta \in [0.30,0.80]$ (with $\rho =0.15$ fixed) and the neighbor shielding factor $\rho \in [0.05,0.30]$ (with $\eta =0.55$ fixed), evaluated on the IEEE 118-bus network ($N_{\mathrm{trials}}=800$; no-defense baseline $\widehat{R}=0.892$).

Figure 8. TAG risk reduction sensitivity to segmentation factor $\eta$ (left) and neighbor shielding $\rho$ (right) on IEEE 118-bus ($K=5$; no-defense baseline $\widehat{R}=0.892$). TAG achieves 68.1–72.1% RR across all tested values, well above Greedy (43.3%) and Degree (35.7%) baselines; method superiority is maintained across the full tested range.

The results confirm that TAG achieves $68.1$–$72.1\%$ risk reduction across all tested $\eta$ and $\rho$ values, substantially above both the Greedy ($43.3\%$ RR) and Degree ($35.7\%$ RR) baselines. The variation across the entire tested $\eta \in [0.30,0.80]$ range is only $\approx 4$ percentage points (risk $0.249$–$0.285$), demonstrating strong parameter insensitivity. Slightly lower risk is achieved at $\eta =0.30$–$0.40$ ($\widehat{R}=0.249$) compared to $\eta \ge 0.50$ ($\widehat{R}=0.285$), which reflects the stochastic convergence of the beam search to slightly different portfolios; the difference is within MC sampling noise. The $\rho$ sweep exhibits the same flat behavior: all values $\rho \in [0.05,0.30]$ yield $\widehat{R}\in \{0.249,0.285\}$, varying by <0.005 for $\rho \ge 0.10$. The probability floor $ϵ$ has no measurable impact: $ϵ\in \{{10}^{-4},{10}^{-3},{10}^{-2}\}$ all yield $\widehat{R}=0.285$. We therefore treat these as simulation-calibrated parameters; their selection is justified by the robustness of method superiority across the full tested range, not by empirical substation deployment data (which are not publicly available at the required granularity). Table 7 reports the calibration and sensitivity results for the TAG-specific parameters on the IEEE 118-bus system at $K=5$. Across the tested ranges of $\eta$, $\rho$, and $ϵ$, TAG maintains stable risk reduction, confirming that the selected default values do not rely on a narrow parameter setting.

Table 7. Parameter calibration and sensitivity of TAG-specific parameters (IEEE 118-bus, $K=5$).

Parameter	Value	Risk $\widehat{\mathit{R}}\left({\mathit{D}}_5\right)$	Rel. Risk Reduction (%)
$\eta$ ($\rho =0.15$)	0.30	0.249	72.1
	0.40	0.249	72.1
	0.50	0.285	68.1
	0.55 (default)	0.285	68.1
	0.60	0.285	68.1
	0.70	0.285	68.1
	0.80	0.285	68.1
$\rho$ ($\eta =0.55$)	0.05	0.249	72.1
	0.10	0.285	68.1
	0.15 (default)	0.285	68.1
	0.20	0.285	68.1
	0.25	0.285	68.1
	0.30	0.285	68.1
$ϵ$ ($\eta =0.55$, $\rho =0.15$)	${10}^{-4}$	0.285	68.1
	${\mathbf{10}}^{-\mathbf{3}}$ (default)	0.285	68.1
	${10}^{-2}$	0.285	68.1

6.6. Robustness Analysis

6.6.1. Robustness to Number of Attack Sources

Final risk is shown in Figure 9 as the number of attack sources $\left|S\right|$ increases from 1 to 7. TAG maintains a consistent and statistically significant advantage over both No Defense and the Degree baseline across all $\left|S\right|$ values tested.

Figure 9. Robustness to number of attack sources $\left|S\right|$ (IEEE 118-bus, $K=5$). TAG maintains its advantage even as the number of adversarial entry points increases to 7.

6.6.2. Sensitivity to Attack Horizon T

Risk is shown in Figure 10 as T varies from 1 to 10 steps. Beyond $T=7$, both defended and undefended risk estimates stabilize. The defense advantage of TAG persists across the entire horizon range tested.

Figure 10. Sensitivity to attack horizon T (IEEE 118-bus, $K=5$).

6.6.3. Adaptive Adversary Robustness

A key limitation of the static adversary model is that it assumes fixed attack sources selected without knowledge of the defense. To evaluate robustness under a more capable adversary, we implement a defense-aware (adaptive) adversary that, after observing the deployed defended set D, selects the $\left|S\right|$ non-critical buses that are closest (minimum hop distance) to any critical bus among buses not in D, breaking ties by degree. This models an adversary with full network visibility that targets the most dangerous—topologically proximal—entry points outside the defended perimeter. Unlike degree-based heuristics, this reachability-based selection is well-defined even on networks with disconnected components or asymmetric topologies.

Table 8 and Figure 11 report static vs. adaptive risk for No Defense, Degree, Greedy, and TAG across all four networks. The results reveal a nuanced picture. Under the adaptive adversary, risk increases substantially for all strategies; on the highly-meshed IEEE 118-bus network, all strategies converge to ${\widehat{R}}_{\mathrm{adapt}}\approx 0.979$, revealing that $K=5$ defenses cannot prevent a worst-case adversary in dense transmission topologies.

Table 8. Static vs. reachability-based adaptive adversary final risk at $K=5$.

	MV Feeder		IEEE 39		IEEE 118		RTS-96
Strategy	Stat.	Adap.	Stat.	Adap.	Stat.	Adap.	Stat.	Adap.
No Defense	0.569	0.920	0.899	0.934	0.892	0.979	0.968	0.936
Degree	0.266	0.590	0.590	0.626	0.545	0.751	0.660	0.618
Greedy	0.215	0.755	0.507	0.599	0.474	0.979	0.660	0.618
TAG	0.126	0.840 †	0.329	0.605 †	0.249	0.979	0.539	0.855 †

Figure 11. Static vs. defense-aware (adaptive) adversary risk comparison. (Left) static adversary (fixed source set used during planning). (Right) reachability-based adaptive adversary selects the $\left|S\right|$ non-defended buses closest (minimum hop distance) to any critical bus after observing D.

Under the reachability-based adaptive adversary, risk increases substantially compared to the static adversary on MV Feeder and the two transmission networks (IEEE 39, IEEE 118). On the IEEE 118-bus network, all methods—including No Defense, Greedy, and TAG—converge to ${\widehat{R}}_{\mathrm{adapt}}\approx 0.979$, indicating that with $K=5$ defenses in a highly-meshed 118-bus network, no placement strategy can prevent an adversary from selecting sources directly adjacent to critical hubs. On MV Feeder, TAG’s adaptive risk ($0.840$) exceeds Greedy’s ($0.755$, marked †), a reversal of the static ranking. On IEEE 39-bus, TAG ($0.605$) and Greedy ($0.599$) are approximately tied. On RTS-96, Greedy and Degree achieve lower adaptive risk ($0.618$) than TAG ($0.855$, marked †), though all remain below No Defense ($0.936$). Notably, on RTS-96 the adaptive adversary achieves lower risk than the static adversary for No Defense and Degree/Greedy, suggesting that the specific static sources (random seed 42) are actually more dangerous than the proximity-based selection on this particular topology.

These results reveal an important limitation: TAG’s topology-aware placement, while highly effective against a static or random adversary, does not consistently dominate under worst-case reachability-based adversary selection. In highly connected networks, critical hubs have numerous non-defended neighbors exploitable by a knowledgeable adversary at budget $K=5$. For scenarios where the adversary source set is unpredictable (the typical operational assumption), the static adversary results (Section 6.3) remain the primary measure of TAG’s effectiveness; the adaptive adversary analysis here quantifies the remaining adversarial gap under full network visibility.

Table 8 summarizes the adaptive vs. static risk change per strategy. The adaptive adversary selects the $\left|S\right|=3$ non-defended buses closest (minimum hop distance) to any critical bus. Bold values indicate the lowest risk per network and mode; a ‘†’ marks cells where the adaptive adversary reverses the static ranking.

6.6.4. Source-Selection Sensitivity

The main experiments use a fixed set of three randomly selected non-critical sources with seed 42. To assess whether method rankings depend on this particular source draw, we repeat the full evaluation 10 times with independent source sets (seed $=42+37b$, $b=0,\dots ,9$) on the IEEE 118-bus network. In each draw, all methods are evaluated on the identical source set, ensuring a fair matched comparison.

Figure 12 shows the resulting box plots of final risk at $K=5$. Regarding the figure, TAG achieves the lowest risk in all 10 draws (range: 0.060–0.546); its IQR $[0.160,0.273]$ does not overlap with Greedy’s IQR $[0.323,0.511]$, confirming that the ranking is robust to source selection despite high per-draw variability. Table 9 reports the mean, standard deviation, and $95\%$ CI across draws. TAG achieves the lowest risk in all 10 draws (minimum 0.060, maximum 0.546), and its IQR $[0.160,0.273]$ does not overlap with Greedy’s IQR $[0.323,0.511]$, confirming that the ranking is source-set robust. The high coefficient of variation (SD/mean $=0.60$ for TAG, $0.38$ for Greedy) reflects the difficulty of different source configurations: some source sets are topologically far from critical buses (easily defended, e.g., TAG achieves 0.060 on draw 7), while others are adjacent to critical buses (hard to defend, e.g., TAG achieves 0.546 on draw 8). Across all 10 draws, TAG’s advantage over Greedy is preserved despite this variability.

Figure 12. Source-selection sensitivity: box plots of final risk at $K=5$ from 10 independent source-set draws on IEEE 118-bus. Boxes indicate the interquartile range, horizontal lines indicate medians, whiskers indicate non-outlier ranges, and open circles indicate outlier values beyond the whiskers.

Table 9. Source-selection sensitivity: mean ± SD and 95% CI across 10 independent source-set draws (IEEE 118-bus, $K=5$).

Strategy	Mean	SD	95% CI	Min/Max
No Defense	0.802	0.129	[0.709, 0.894]	0.542/0.951
Degree	0.530	0.181	[0.401, 0.660]	0.266/0.831
Greedy	0.415	0.158	[0.302, 0.527]	0.155/0.694
TAG	0.244	0.147	[0.139, 0.349]	0.060/0.546

6.7. Monte Carlo Convergence Study

The estimated risk $\widehat{R}$ is plotted in Figure 13 as a function of $N_{\mathrm{trials}}$ from 50 to 2000. Both curves converge rapidly, stabilizing within $\pm 0.01$ of their asymptotic values by $N_{\mathrm{trials}}=500$. The choice of $N_{\mathrm{trials}}=800$ provides a safety margin of approximately $1.6\times$ beyond the observed convergence threshold, ensuring that reported risk differences larger than 0.01 between methods reflect genuine performance gaps rather than Monte Carlo estimation noise.

Figure 13. Monte Carlo convergence: estimated risk $\widehat{R}$ vs. number of trials $N_{\mathrm{trials}}$ for No Defense and TAG ($K=3$) on IEEE 118-bus. Estimates stabilize by $N_{\mathrm{trials}}=500$, validating our choice of $N_{\mathrm{trials}}=800$.

6.8. Scalability

Average time per greedy iteration is reported in Table 10 and Figure 14. TAG incurs $1.4$–$2.2\times$ the per-iteration runtime of vanilla greedy, with absolute times ranging from 5.37 s (IEEE 39-bus) to 38.85 s (MV Feeder, 179 buses) per iteration. All computation times correspond to offline planning scenarios: TAG is not intended for real-time deployment but for periodic security planning cycles, in which computation budgets of minutes to hours are operationally acceptable.

Table 10. Scalability: average time per Greedy iteration (s).

Strategy	MV (179)	IEEE 39	IEEE 118	RTS-96
Greedy (Original)	19.52	3.08	10.11	12.99
Proposed (TAG)	38.85	5.37	21.83	18.22
SA (total)	15.55	11.83	11.76	31.09

Figure 14. Computation time vs. network size.

6.9. Cyber-Physical Impact-Weighted Risk Analysis

Table 11 reports the cyber-physical impact-weighted risk $R_{\mathrm{phys}}\left(D\right)$ alongside the cyber-only risk $R\left(D\right)$ for No Defense, Greedy, and TAG across all four networks. Impact scores $I_{\mathrm{phys}}\left(c\right)$ are derived from DC power-flow contingency analysis.

Table 11. Cyber-only $R\left(D\right)$ vs. cyber-physical impact-weighted $R_{\mathrm{phys}}\left(D\right)$ at $K=5$.

	No Defense		Greedy		TAG
Network	$\mathit{R}$	${\mathit{R}}_{\mathbf{phys}}$	$\mathit{R}$	${\mathit{R}}_{\mathbf{phys}}$	$\mathit{R}$	${\mathit{R}}_{\mathbf{phys}}$
MV Feeder	0.569	0.624	0.215	0.231	0.126	0.121
IEEE 39-bus	0.899	0.829	0.508	0.415	0.329	0.188
IEEE 118-bus	0.893	0.158	0.474	0.071	0.249	0.032
RTS-96	0.968	0.772	0.660	0.333	0.539	0.185

The relationship between $R_{\mathrm{phys}}$ and R varies by network and strategy. For the MV Feeder under no defense, $R_{\mathrm{phys}}=0.624>R=0.569$, indicating that in the undefended case the high-impact buses are disproportionately reachable (the adversary naturally reaches high-consequence nodes first along short paths). IEEE 118-bus shows the opposite pattern: $R_{\mathrm{phys}}\ll R$ across all strategies (e.g., No Defense: $R_{\mathrm{phys}}=0.158$ vs. $R=0.893$), because the IEEE 118 critical buses are high-degree hubs with many load connections but are topologically more distant from typical source nodes. The relative ranking of strategies is preserved under both metrics: TAG achieves the lowest $R_{\mathrm{phys}}$ on all four networks. Notably, for the MV Feeder, TAG’s defense specifically counters the structural vulnerability ($R_{\mathrm{phys}}=0.121<R=0.126$), confirming that topology-aware placement preferentially protects the highest-impact nodes.

While the primary optimization objective is cyber reachability $R\left(D\right)$ (which is computable without power-flow models and avoids coupling to solver convergence), the power-flow-informed impact analysis validates that TAG’s defense recommendations are also effective from a physical-consequence perspective. Future work will extend to direct optimization of $R_{\mathrm{phys}}\left(D\right)$ and AC power-flow-based consequence metrics.

A consolidated visualization of the final risk $\widehat{R}\left(D_5\right)$ for all eight strategy–network combinations is provided in Figure 15. Formal k-means clustering of strategy performance profiles (each strategy represented as a point in ${\mathbb{R}}^4$, one coordinate per network) reveals two primary clusters at $k=2$ (silhouette coefficient $0.533$): Cluster A contains the four consistently high-risk strategies (No Defense, Random, Betweenness, PageRank) and Cluster B contains the four effective placement strategies (Degree, SA, Greedy, TAG). At $k=3$ (silhouette $0.467$), TAG further separates into its own singleton cluster, confirming its consistent performance advantage over all other strategies across all four networks. This formal data-driven partitioning replaces the subjective qualitative description used in the original manuscript.

Figure 15. Heatmap of final risk $\widehat{R}\left(D_5\right)$ for all strategy–network combinations. Greener cells indicate lower risk. Formal k-means clustering ($k=2$, silhouette $=0.533$; $k=3$, silhouette $=0.467$) partitions strategies into two primary groups: high-risk (No Defense, Random, Betweenness, PageRank) and effective (Degree, SA, Greedy, TAG). At $k=3$, TAG forms a singleton cluster confirming its consistently best performance. Colored squares on the right indicate cluster assignment.

7. Discussion

The experimental results collectively support a unified interpretation of TAG’s performance advantage that has three complementary dimensions: topological relevance of candidate selection, the value of portfolio diversity over single-path search, and the operational significance of the dual-mode defense model. Understanding how these three dimensions interact is essential for situating TAG within the broader landscape of cyber-physical security research and for identifying the conditions under which its advantages are most pronounced.

The failure of static centrality heuristics on specific networks, most notably Betweenness and PageRank, achieving $0\%$ risk reduction on the MV Feeder, provides the most operationally important finding. Both metrics identify globally important nodes in terms of all-pairs information flow, but this global importance does not translate to relevance for the specific bounded-horizon, source-specific attack model. The mismatch between global centrality and local attack-path relevance is a general structural phenomenon that will recur in any network where entry points and critical targets are not topologically co-located with globally high-centrality nodes.

Vanilla greedy selection, despite being a much stronger baseline than static centrality, still systematically underperforms TAG on all four networks. The mechanism for this underperformance is the myopic per-step evaluation: greedy commits to each defense node based on its marginal risk reduction given the current defended set, without considering synergistic interactions among defended nodes. The portfolio search and beam-search extension of TAG are specifically designed to address this myopia.

The dual-mode defense model is a conceptually significant departure from the incoming-hardening-only model used by all placement-only baselines. By modeling outgoing containment through the segmentation factor $\eta$ and monitored-neighbor shielding through $\rho$, TAG captures an operationally realistic consequence of substation hardening that is absent from prior formulations.

Operational Standards Context

TAG is positioned as a security planning tool that is compatible with and can support major operational standards governing power system cybersecurity. Under the NIST cybersecurity framework (CSF) [31], TAG addresses the Identify function (asset criticality assessment via power-flow-weighted impact scores), the Protect function (defense placement recommendations), and the Detect function (prioritizing monitored-neighbor shielding for early detection of lateral movement). Under IEC 62443 [32] (Industrial Automation and Control Systems Security), TAG’s dual-mode defense—hardening plus micro-segmentation—aligns with Zone and Conduit concepts at the substation level: the defended substations correspond to security zones with restricted conduit access, and the $\eta$ factor models residual inter-zone propagation rates. Under NERC CIP standards [33], TAG’s identification of critical buses through power-flow impact analysis provides a quantitative foundation for NERC CIP-002 (BES Cyber System categorization) and CIP-005 (Electronic Security Perimeters). The micro-segmentation and monitored-neighbor shielding actions directly correspond to NERC CIP-007 (Systems Security Management) and CIP-010 (Configuration Change Management and Vulnerability Management) controls. We do not claim that TAG automates NERC CIP compliance or replaces the regulatory process; rather, TAG provides a prioritized risk-based ranking of which substations warrant the highest-priority hardening and segmentation investment, supporting the asset owner’s own compliance analysis.

Several limitations of the present study warrant explicit acknowledgment. First, the defense model assumes fixed parameters $\eta$ and $\rho$; the calibration study shows results are robust across a wide range, but empirical deployment data on actual residual propagation rates after substation micro-segmentation is not publicly available at the required granularity. Second, the current framework’s primary optimization objective is cyber reachability risk; power-flow-based operational impact is validated post hoc but not directly optimized. Third, the adversary model assumes stationary edge probabilities; the adaptive adversary analysis shows that a reachability-based adversary can reverse TAG’s ranking advantage on some networks (MV Feeder, IEEE 39, RTS-96) and eliminate advantage on others (IEEE 118-bus), revealing that $K=5$ defenses are insufficient to create a robust perimeter against a worst-case adversary with full network visibility. Game-theoretic formulations that directly account for adversary source selection remain a key future research direction.

8. Conclusions

This paper presents TAG, an enhanced topology-aware hierarchical attack graph framework for the security of cyber-physical power systems. TAG combines attack-graph risk evaluation, topology-aware candidate screening, deterministic propagation approximation, beam-search portfolio optimization, one-swap local refinement, and dual-mode substation defense. An explicit cyber-physical interdependency model introduces a power-flow-aware impact score that validates TAG’s defense placement from a physical-consequence perspective. Statistical validation via 10-batch repeated MC evaluation and paired Wilcoxon tests confirms that all reported performance differences are significant ($p<0.05$) across all four benchmark networks. Monte Carlo experiments under fixed settings ($K=5$, $T=5$, $N_{\mathrm{trials}}=800$) show that TAG reduces critical-reach probability by $54.3$–$82.0\%$ relative to no defense and by $30.2$–$51.5\%$ relative to vanilla greedy. Parameter sensitivity analysis over $\eta \in [0.30,0.80]$ and $\rho \in [0.05,0.30]$ confirms that TAG achieves 68–$72\%$ risk reduction across the full parameter range, confirming robust superiority over baselines. Source-selection sensitivity with 10 independent draws confirms that static adversary rankings are stable across source sets (TAG maintains the lowest risk in all 10 draws). The adaptive adversary analysis reveals an important limitation: a worst-case reachability-based adversary with full network visibility can reverse TAG’s advantage in meshed transmission networks, motivating game-theoretic extensions. The results strengthen the empirical case for topology-aware, dynamics-informed defense planning for static adversary scenarios. Future work will extend the framework to multi-layer cyber-physical graphs, game-theoretic defense formulations that explicitly model worst-case adversary response, and direct optimization of power-flow-based impact metrics.