Attack Graph driven Discrete Event Simulation for Security Assessment in Power Systems

As power grids transition into decentralized Cyber-Physical Power Systems, the digitalization of legacy devices has dramatically multiplied the potential entry points for cyber adversaries. To accurately assess these threats, security models must capture both detailed attack steps and network timing effects. However, obtaining real-world cyber incident data to parameterize these models is rarely possible due to strict privacy and confidentiality constraints within utility companies. To overcome this limitation, we present a simulation-based framework that integrates Attack Graphs (AGs) with the OMNeT++ Discrete Event Simulation environment and Dynamic Bayesian Networks (DBNs). Attack step logic is modeled through Control Finite State Machines, allowing for dynamic interactions between attacker behavior and simulated network components. The simulation automatically generates time-series data used to train AG-derived DBNs used to answer probabilistic queries on attack progression. We present a case study on a Distributed Energy Resource cyberattack which demonstrates that the framework captures complex temporal dependencies and maintains high predictive accuracy supporting cybersecurity assessment for critical energy infrastructures. The code and models implemented in this work are available here: https://github.com/Dosclic98/dbn-sim-learning.git.