Over the past decade, the number of cyber attack incidents targeting critical infrastructures such as the electrical power system has increased. To assess the risk of cyber attacks on the cyber-physical system, a holistic approach is needed that considers both system layers. However, the existing risk assessment methods are either qualitative in nature or employ probabilistic models to study the impact on only one system layer. Hence, in this work, we propose a quantitative risk assessment method for cyber-physical systems based on probabilistic and deterministic techniques. The former uses attack graphs to evaluate the attack likelihood, while the latter analyzes the potential cyber-physical impact. This is achieved through a dynamic cyber-physical power system model, i.e., digital twin, able to simulate power system cascading failures caused by cyber attacks. Additionally, we propose a domainspecific language to describe the assets of digital substations and thereby model the attack graphs. Using the proposed method, combined risk metrics are calculated that consider the likelihood and impact of cyber threat scenarios. The risk assessment is conducted using the IEEE 39-bus system, consisting of 27 user-defined digital substations. These substations serve as the backbone of the examined cyber system layer and as entry-points for the attackers. Results indicate that cyber attacks on specific substations can cause major cascading failures or even a blackout. Thereby, the proposed method identifies the most critical substations and assets that must be cyber secured.

The security issues of Cyber-Physical power Systems (CPS) have attracted widespread attention from scholars. Vulnerability assessment emerges as an effective method to identify the critical components and thus increase the system resilience. While efforts have been made to study the vulnerability features of power systems under the occurrence of a single, discrete disturbance or failure at a specific time instant, this paper focuses on identifying the critical components of the cyber-physical system considering time-varying operational states. To investigate the potentially ever-changing CPS vulnerability features, in this paper we construct a database of cascading failure chains using quasidynamic simulations to capture the vulnerability relationships among components under time-varying operational states. Then, by adopting sequential mining algorithms, we mine the most frequent cascading failure patterns and identify the critical components based on the data mining results. Simulation studies are conducted on IEEE 39-bus and IEEE RTS-96 systems to evaluate the effectiveness of the proposed method for the identification of critical components at both cyber and physical layers.