A Generation Method of New Power System APT Attack Graph Based on DQN

Abstract

Background: The new power system is more vulnerable to Advanced Persistent Threat (APT) than the traditional power system. Objective: This study aims to grasp the intent of the APT attack better; a new generation method of power system APT attack graph based on DQN is proposed. Methods: First, the network topology of the new power system was extracted by Nessus scanning as the model input. Secondly, the agent in DQN was trained for multiple rounds. Starting from the set initial state, the agent selected the action with the highest Q value to act on the system in each round, and then the system entered the next state. Then the Q network function value was updated according to the obtained system feedback value until the target state appeared. Results: After multiple rounds of training agents, multiple APT attack paths were finally obtained, thus an APT attack graph can be generated. Conclusion: The experimental results showed that the efficiency of generating an APT attack graph based on the DQN method is obviously superior to the existing methods for the large-scale industrial control system, such as the new power system.