Abstract: Considering that the defense capability of substation is more and more important in maintaining the safe and stable operation of power grid in an increasingly complex network security environment， this paper proposes a method for modeling the attack/defense strategy of substation network on the basis of Markov decision process（MDP）. Firstly， the detailed steps of the network attack are introduced and the possible paths of successful intrusion into the substation are analyzed in depth. Then， the probability model of successful network attack is established from the perspective of attacker and defender respectively. Finally， according to the characteristics of the target substation， Markov decision process modeling is used to solve the optimal action strategy of both attack and defense. The method comprehensively considers the key characteristics of the target substation and the technical capabilities of the attack/defense sides， and provides a theoretical basis for the attack/defense of both sides in the behavior design of the power cyber-physical system（CPS）in network security scenario.

Key words:  Markov decision process（MDP）, substation automation system, network security, power cyber-physical systems（CPS）