Dynamic attacks on smart meters over wireless channels in smart grid and the corresponding defensive policy: A Bayesian game model approach

Overview of smart meter systems and security research

Several scholars have explored the security issues of smart meter systems. Bhattacharjee et al. ²⁵ used false injection attacks to manipulate consumption data, while Kumar et al. ²⁶ focused on denial-of-service attacks on commercial-grade smart meters. Díaz Redondo et al. ²⁷ investigated vulnerabilities by conducting denial-of-service and malicious software attacks on residential smart meters. Studies on grid attacks have examined various attack types, including man-in-the-middle attacks on smart meters, ²⁸ denial-of-service attacks, ²⁹ and electricity load attacks, showing that authentication alone does not protect meters. ³⁰

While most existing research focuses on technical vulnerabilities and attack strategies, relatively little attention has been paid to the resource cost of attackers. However, attacker resource consumption (such as computation and communication overhead) can affect the sustainability of large-scale attacks. Considering these factors can provide a more realistic perspective for defense strategy design, although this paper primarily emphasizes the defense efficiency under limited defender resources. as it relates to the sustainability, cost, and potential impacts of attacks. Research should not only focus on technical attack details and system vulnerabilities, but also consider the resources attackers use during implementation. Modeling attacker resource consumption will offer new insights for power system security research, helping to develop more comprehensive and sustainable defense strategies.

Application of game theory in power systems

Game theory, widely used in fields like operations research, economics, and ecology, focuses on decision-making methods to maximize individual interests. Recently, game theory has been applied to smart grids,^31–33 particularly in power system security. Hasan et al. ³⁴ used game theory to design an attacker-defender model where attackers determine attack timings to maximize system damage. Ge et al. ³⁵ proposed a resource allocation method based on game theory for defending against potential network attacks in smart grids. Pilz et al. ³⁶ introduced a false data injection attack on demand prediction data and its effects on system parameters, with proposed monitoring strategies and game theory support for utility companies’ defense resource allocation.

Existing research mainly focuses on the benefits of both sides in the game, but lacks in-depth analysis of target node values and the actual capabilities of attackers and defenders. More research is needed to explore these elements in the dynamic game process to improve understanding and help develop more effective defense strategies for power systems.

Attacks and defenses in wireless channels for smart meters

Strategic interaction

In the two-stage attack-defense game model, the strategic interaction between defenders and attacker present a complex dynamic relationship. In smart meter systems, the defender’s task is to monitor and protect the meter from illegal operations, while the attacker attempts to implement illegal operations through various means. Figure 2 illustrates the four possible scenarios of strategic interaction between the two sides.

OPEN IN VIEWER

Figure 2.

illustrates the strategic interaction between defenders and attacker.

Figure 2 shows four strategic interactions between defender and attacker. The defender monitors meters, while the attacker attempts illegal actions. Figure (a) illustrates a successful defense, where the attacker is discovered and penalized. Figure (b) illustrates the absence of monitoring, allowing the attacker to attack undetected. Figure (c) illustrates wasted resources, as the defender monitors but the attacker’s actions are not carried out. Figure (d) shows no attack or monitoring. These scenarios highlight the interdependence of strategies, where defenders aim to optimize monitoring, and attacker adapt to avoid detection.

Model parameters

The game model defines the strategic interaction between the attacker and the defender (power distribution company). The attacker attempt to disrupt smart meter energy data through signal jamming, while the defender aims to detect and punish such behavior through monitoring. The model parameters are defined as follows:

G = { N , A , H , P , Ω , μ }

(1)

N (Players): Represents the set of participants in the game. Each participant may have different strategies and information. In this model, there are two participants: the attacker and the defender (referred to as the power distribution company).

A (Actions): Represents the set of actions or strategies that each participant can take. In this model, the attacker’s strategy set includes channel monitoring, signal interference, and no attack, while the defender’s strategy set includes defense and non-defense.

H(Information): Represents the set of information each participant has when making decisions. This could be complete or incomplete information. The model in this paper belongs to the incomplete information model because the defender does not know whether the attacker has obtained information about the meter.

P(Payoffs): Represents the payoff of each participant in each state. Typically represented as a function that maps the action combinations of each participant to their payoff values.

Ω (States): Represents the set of states the game could be in. Before the attacker engages in signal interference, we consider the attacker’s behavior in obtaining information about the meter. Specifically, we divide the state set into two states: Non-Eavesdropped and Eavesdropped. The definitions of the two states and the corresponding game payoff matrix for each stage are described below:

In the Non-Eavesdropped State (T1), the attacker has not monitored the channel and lacks information about the meter. The attacker can choose to monitor or not, while the defender can choose to defend or not. The corresponding payoff matrix is as follows:

In this context, l a i represents the cost incurred by the attacker for wireless channel eavesdropping, I i is the value of the information obtained when eavesdropping goes undetected, c d i denotes the defense cost for the defender, and v i signifies the penalty imposed on the attacker upon successful defense.

In state T1, the payoffs for both the attacker and the defender are determined by their respective strategy combinations. Firstly, suppose the attacker chooses to eavesdrop on the channel while the defender opts for defense. In that case, the attacker’s payoff is the eavesdropping cost − l a i minus the penalty v i incurred upon detection, resulting in a total payoff of − l a i − v i . The defender’s payoff, on the other hand, is the defense cost − c d i plus the value of the information obtained I i , yielding a total payoff of − c d i + I i . Secondly, suppose the attacker chooses to eavesdrop while the defender decides not to defend, the attacker’s payoff is the eavesdropping cost − l a i plus the value of the information obtained I i , resulting in a total payoff of − l a i + I i . In this scenario, the defender incurs no defense cost but loses the value of the information, leading to a total payoff of − I i . Lastly, if the attacker opts not to eavesdrop, regardless of whether the defender chooses to defend or not, the attacker experiences no gain or loss. The defender, if choosing to defend, incurs the defense cost − c d i ; if choosing not to defend, neither gains nor loses.

Eavesdropped State (T2) In this state, the attacker has successfully eavesdropped on the channel and obtained information about the smart meter. They might have learned the operating patterns, communication protocols, and potential vulnerabilities of the meter. This enables the attacker to devise and execute a signal interference strategy more effectively to achieve their objectives. Therefore, in the T2 state, the attacker can choose to interfere with the signal or not, and the defender can choose to defend or not. Table 3 presents the payoff matrix for the participants in the T2 state. Here, c a i represents the cost incurred by the attacker for executing signal interference, and w i denotes the value of the target smart meter:

In the T2 state, the payoffs for both the attacker and the defender are determined by their respective strategy combinations. Firstly, if the attacker chooses to interfere with the signal while the defender opts for defense. In that case, the attacker’s payoff is the interference cost − c a i minus the penalty v i incurred upon detection, resulting in a total payoff of − c a i − v i . The defender’s payoff is the defense cost − c d i plus the value of the smart meter w i , yielding a total payoff of − c d i + w i . Secondly, if the attacker chooses to interfere with the signal while the defender decides not to defend. In that case, the attacker’s payoff is the interference cost − c a i plus the value of the smart meter w i , resulting in a total payoff of − c a i + w i . In this scenario, the defender incurs no defense cost but loses the value of the smart meter, leading to a total payoff of − w i . Lastly, if the attacker opts not to interfere with the signal, regardless of whether the defender chooses to defend or not, the attacker experiences no gain or loss. The defender, if choosing to defend, incurs the defense cost − c d i ; if choosing not to defend, neither gains nor loses.

μ (Belief Function): This represents each participant’s belief or probability distribution regarding the actions of other participants. It reflects the subjective perception of the likelihood of other participants’ behaviors. For this model, μ represents the defender’s belief that the attacker has not yet obtained relevant information about the smart meter, indicating that the current game is still in the T1 stage. Conversely, 1 − μ represents the defender’s belief that the attacker has already obtained the relevant information, and the game has entered the T2 stage.

μ 0 (Prior Belief Function): This represents the defender’s prior belief regarding the game being in Stage T1 (i.e. the attacker has not yet intercepted the smart meter information). Its primary functions include:

Belief Function: μ 0 provides the defender with an initial belief foundation, guiding strategic decisions during the early phase of the game. For example, a higher value of μ 0 indicates that the defender is more likely to believe the attacker has not intercepted the meter information, potentially leading to a more conservative monitoring strategy. Conversely, a lower μ 0 suggests that the defender believes the attacker has already acquired the information, which may prompt an increase in monitoring efforts.

Utility Weighting: The utility function, μ 0 is used to weigh the utility values across different game states, enabling the model to account for the strategic interactions between Stage T1 and Stage T2, thus influencing the overall utility outcome.

Based on the situations in Tables 2 and 3, we have derived the final utility functions for both the attacker and the defender in each round of the game. Here, i = 1 represents the attacker executing the corresponding behavior for the game state, and j = 1 represents the defender choosing to defend. n denotes the number of smart meters, and the final utilities for both sides are obtained by summing the situations for each meter.

OPEN IN VIEWER

Table 2.

Payoff matrix for the T1 stage game.

Attacker\defender	Defense	No defense
Channel sensing	− l a i − v i , − c d i + I i	− l a i + I i , − I i
No sensing	0 , − c d i	0 , 0

OPEN IN VIEWER

Table 3.

Payoff matrix for the T2 stage game.

Attacker\defender	Defense	No defense
Signal interference	− c a i − v i , − c d i + w i	− c a i + w i , − w i
No interference	0 , − c d i	0 , 0

Calculation of Attacker’s Payoff in the Non-Eavesdropped State (equation (2)):

U a T 1 = ∑ i = 1 , j = 1 n ( − l a i − v i ) + ∑ i = 1 , j = 0 n ( − l a i + I i )

(2)

Here, l a i is the cost incurred by the attacker for wireless channel eavesdropping, v i is the value of the information obtained when eavesdropping goes undetected, and I i represents the attacker’s payoff when the smart meter information is not obtained. In the non-eavesdropped state, the attacker can choose to eavesdrop on the channel or not. If the attacker chooses to eavesdrop and the defender chooses to defend, the attacker’s payoff is the eavesdropping cost minus the penalty upon detection, that is, − l a i − v i . If the attacker chooses to eavesdrop and the defender chooses not to defend, the attacker’s payoff is the eavesdropping cost plus the value of the information obtained, that is, − l a i + I i . The total payoff for the attacker in the non-eavesdropped state is the sum of the payoffs in these two scenarios.

Then the calculation of Attacker’s Payoff in the Eavesdropped State (equation (3)):

U a T 2 = ∑ i = 1 , j = 1 n ( − c a i − v i ) + ∑ i = 1 , j = 0 n ( − c a i + w i )

(3)

Here, c a i is the cost incurred by the attacker for executing signal interference, and w i is the value of the target smart meter. In the eavesdropped state, the attacker can choose to interfere with the signal or not. If the attacker chooses to interfere with the signal and the defender chooses to defend, the attacker’s payoff is the interference cost minus the penalty upon detection, that is, − c a i − v i . If the attacker chooses to interfere with the signal and the defender chooses not to defend, the attacker’s payoff is the interference cost plus the value of the smart meter, that is, − c a i + w i . The total payoff for the attacker in the eavesdropped state is the sum of the payoffs in these two scenarios.

The total Utility Function of the Attacker can be calculated by equations (2) and (3) (equation (4)):

U a = μ 0 U a T 1 + ( 1 − μ 0 ) U a T 2

(4)

This equation is derived based on the payoff matrix in the game model, which includes costs and benefits for different action combinations. The attacker can choose different actions in each state and obtain corresponding payoffs or incur costs based on the outcomes of these actions. Ultimately, the total utility of the attacker is obtained by weighting the payoffs in each state, where the weights are determined by the defender’s belief function μ 0 .

Following calculation of Defender’s Payoff in the Non-Eavesdropped State (equation (5)):

U d T 1 = ∑ i = 1 , j = 1 n ( − c d i + I i ) + ∑ i = 1 , j = 0 n ( − I i ) + ∑ i = 0 , j = 1 n ( − c d i )

(5)

In the non-eavesdropped state, the defender can choose to defend or not. If the defender chooses to defend and the attacker chooses to eavesdrop on the channel, the defender’s payoff is the defense cost minus the penalty upon detection, that is, − c d i + I i . If the defender chooses to defend but the attacker chooses not to eavesdrop, the defender’s payoff is the negative value of the obtained information, that is, − I i . If the defender chooses not to defend, the defender’s payoff is the negative value of the defense cost, that is, − c d i . The total payoff for the defender in the non-eavesdropped state is the sum of the payoffs in these three scenarios.

Defender’s Payoff in the Eavesdropped State (equation (6)):

U d T 2 = ∑ i = 1 , j = 1 n ( − c d i + w i ) + ∑ i = 1 , j = 0 n ( − w i ) + ∑ i = 0 , j = 1 n ( − c d i )

(6)

In the eavesdropped state, the defender can also choose to defend or not. If the defender chooses to defend and the attacker chooses to interfere with the signal, the defender’s payoff is the defense cost minus the penalty upon detection, that is, − c d i + w i . If the defender chooses to defend but the attacker chooses not to interfere, the defender’s payoff is the negative value of the smart meter, that is, − w i . If the defender chooses not to defend, the defender’s payoff is the negative value of the defense cost, that is, − c d i . The total payoff for the defender in the eavesdropped state is the sum of the payoffs in these three scenarios.

Finally, the total utility function of the defender is obtained by weighting the payoffs in the non-eavesdropped and eavesdropped states according to the defender’s belief about the attacker’s behavior:

U d = μ 0 U d T 1 + ( 1 − μ 0 ) U d T 2 .

(7)

This equation integrates the defender’s payoffs in different states, considering the defender’s beliefs about the attacker’s behavior, to derive the defender’s total utility.

In equations (4) and (7), μ 0 is used to weight the utility values across different game states, thereby integrating the strategic interactions between Stage T1 and Stage T2 into the overall utility. This weighting mechanism allows the model to reflect the defender’s subjective assessment of the current game state in an uncertain environment, guiding both the defender and the attacker in adopting optimal strategies at different stages. In traditional static, single-stage games, the value of μ₀ is typically set based on historical data and statistical analysis, system characteristics, asset values, expert knowledge, and experience. In the Bayesian model we propose, a dynamic updating method based on Bayesian algorithms will be introduced.

Dynamic Bayesian game model

While the static game in Subsection 3.2 solves the strategy selection problem between defenders and attackers in a single stage, dynamic games more accurately reflect the evolution and adjustment of strategies in real-world attack-defense scenarios. Therefore, this section extends the single-stage game into a dynamic Bayesian game model to better describe defenders’ decision-making in multi-round games.

To better describe the decision-making process of the defender in multi-round games, we employ Bayesian statistical methods and the Beta distribution to dynamically update the defender’s judgment of the current game state, making the model more flexible and adaptive. Specifically, we use Bayesian statistics to analyze the attacker’s historical behavior in order to determine whether the current game is in Stage T1 or T2. Bayesian statistics update the posterior probability of the current game state by considering the attacker’s historical actions, combining prior probabilities, and observed data, allowing the defender to assess the current game status more accurately.

In this model, the Beta distribution is used to calculate the prior probability, which represents the defender’s initial estimation of the attacker’s behavior patterns. The Beta distribution is flexible and adaptive, and its parameters α and β can be adjusted based on the defender’s experience and historical attack data, reflecting different beliefs about the attacker’s behavior. The choice of the Beta distribution is motivated by the following reasons:

Suitable for Describing Probability Distributions: The domain of the Beta distribution lies within the range [0, 1], making it particularly appropriate for describing probabilistic variables. In this model, we aim to represent the defender’s belief regarding the likelihood that the attacker will initiate an attack, which naturally aligns with a probability distribution within the range [0, 1]. Therefore, the Beta distribution provides an ideal mathematical framework for our purpose.

Flexibility and Adjustability: The Beta distribution has two parameters, α and β , allowing it to flexibly represent different shapes of probability distributions depending on the values chosen. For instance, when the defender lacks sufficient prior knowledge about the attacker’s behavior, α and β can be set to small values, indicating greater uncertainty. Conversely, when the defender has gathered more accurate attack patterns from historical data, α and β can be increased, thereby reducing uncertainty. Thus, the Beta distribution can be adjusted based on the defender’s experiential knowledge and historical observations, perfectly matching the model’s need for dynamic defense strategy adjustment.

Integration with Historical Data: By appropriately selecting values for α and β , the Beta distribution can effectively combine historical attack behaviors and observational data for dynamic updates. The defender’s beliefs are not only based on prior knowledge but also adjusted according to the data from each round of the game. This allows the defense strategy to evolve flexibly with real-time information, improving the accuracy of predictions.

Conjugacy and Simplicity: The Beta distribution is the conjugate prior for the Binomial distribution, providing computational simplicity in Bayesian inference. If we choose the Beta distribution as the prior, after observing new data, the posterior distribution will remain a Beta distribution following Bayesian updating. This conjugacy makes the belief updating process highly efficient, avoiding complex numerical calculations, and enhancing the model’s practicality and real-time applicability.

This flexibility makes the Beta distribution an ideal choice for modeling the defender’s beliefs within the Bayesian framework, as it not only reflects the defender’s prior knowledge but can also be adjusted based on observational data, thereby improving the accuracy of decision-making.

In each round of the game, the observed data of the attacker are used to update the posterior probability. The attacker’s behavior in each round is recorded using the definition (8) H a , where a 1 , … … a n record the strategies chosen by the attacker in round i .

H a = { a 1 , … … a n }

(8)

The prior probability reflects the defender’s subjective judgment on whether the attacker will execute an attack in the current round. We will use a Beta . distribution to model it as in equation (9):

μ H ( T | H a ) = Beta ( α , β )

(9)

Here, α and β are parameters of the Beta distribution. The selection of these two parameters may be influenced by empirical knowledge and historical attack behavior.

We use Bayes’ theorem to construct the belief update formula for the defender (equation (10)):

μ H ( T | H a , a n ) = P ( a n | T , H a ) · μ H ( T | H a ) ∑ i = 1 N P ( a i | H a ) · μ H ( T | H a )

(10)

Here, μ H ( T | H a , a n ) represents the posterior probability that the defender believes the current game type is T after observing the attacker’s behavior a n . P ( a n | T , H a ) denotes the probability of the attacker acting a n given the game type T and the observed historical behavior H a . ∑ i = 1 N P ( a i | H a ) · μ H ( T | H a ) represents the sum of all possible attacker behaviors a i weighted by their probabilities P ( a i | H a ) and the prior probability μ H ( T | H a ) . This term serves as a normalization factor to ensure that the posterior probabilities sum up to 1.

In equation (10), the defender updates their belief about the current game state based on the observed attacker behavior, combining prior knowledge with new information to make an updated assessment of the game state.

To intuitively illustrate the belief update process and the transition between game states, we present a flowchart in Figure 3. The flowchart shows how the game transitions from the Non-Eavesdropped state (T1) to the Eavesdropped state (T2) based on the attacker’s behavior, and how the defender dynamically updates its belief using the Beta distribution.

OPEN IN VIEWER

Figure 3.

Dynamic Bayesian game tree for smart meter security.

Figure 3 illustrates the dynamic Bayesian game process between the attacker and the defender in a wireless smart meter environment. The game begins with the defender’s belief state μ t , representing the probability that the attacker has not yet obtained meter information. Depending on the belief, the game proceeds to either Stage T1 (non-eavesdropped) or Stage T2 (eavesdropped). In each stage, the attacker chooses an action—either to sense or not (in T1), or to interfere or not (in T2)—and the defender responds by deciding whether to defend. The outcome of these interactions feeds back into the defender’s belief, which is updated using a Bayesian inference mechanism (specifically, a Beta distribution). This updated belief μ t + 1 is then used to guide the next round of strategic interaction. The tree structure captures the recursive nature of the game and highlights how both players adapt over time based on incomplete information and observed behavior.

Nash equilibrium

This subsection will explore the important concept in game theory -the Nash equilibrium. First, the basic concept and definition of Nash equilibrium will be introduced. Then, the possibility of a pure strategy Nash equilibrium will be discussed in detail and analyzed accordingly. Next, the concept of mixed strategy Bayesian Nash equilibrium will be introduced, and the equilibrium point that may exist between the two parties in the game will be sought through mathematical derivation and analysis. Finally, the results will be explained and discussed to understand better the possible game behaviors in the smart meter system.

Attack and defense costs under different node capabilities

In Subsection 3.3, a Bayesian game model was constructed, and the stable solution of the smart meter system under Nash equilibrium was discussed in Subsection 3.4. However, it was found that the model did not take into account the ability differences between participants and the connections between participants and various types of meters, which may be important influencing factors in practical applications. Therefore, these factors will be further explored in Subsections 3.5–3.7. Specifically, the value assessment method of smart meters and the cost analysis of the attacker and defender under the difference in node capabilities will be focused on.

First, we analyze the value of smart meters, focusing on the power load and the connection between the meter and key equipment. In order to quantify the value of smart meters, we introduce the following calculation equation (11):

V = γ × P + δ × C

(11)

Here, γ × P reflects the impact of the power load borne by the smart meter on its value. Where γ is the weighting coefficient of the power load, P is the power load borne by the smart meter. δ is the weighting coefficient of the connectivity of key devices, C is the connectivity between the smart meter and key devices. V represents the total value of the smart meter. Equation (11) comprehensively considers the power load and the connectivity with key devices, providing a more comprehensive perspective on the value of smart meters for attackers and defenders. Such a value concept can help evaluate the importance of smart meters in attack-defense games and provide strong support for formulating optimal security strategies and resource allocation strategies.

Cost analysis of attackers under node capability differences

In the cost analysis of attackers in smart meter systems, the attackers’ behavior patterns and their impact on the system are studied in depth. When conducting eavesdropping, attackers may be more focused on collecting information rather than launching attacks directly, so the capability differences between nodes are relatively small. Therefore, the model does not particularly emphasize the cost and utility in this scenario, but focuses on the game strategy of attackers when implementing signal interference attacks and the cost-benefit relationship between the two parties. By introducing the channel attenuation model and analyzing the energy consumption of signal interference attacks, the costs and benefits of attackers’ interference behaviors can be more accurately evaluated. In addition, by incorporating the attacker’s benefits under wireless channel modeling into the utility function of the game model, the differences in attacker attributes can be considered, so as to better understand the actual costs of the attackers. Next, we will study in depth how the channel attenuation model and energy consumption-related factors affect the attacker’s cost, and how to calculate the attacker’s benefits under wireless channel modeling. The signal attenuation model considers factors such as the distance between system nodes, and the calculation method of the signal strength of the wireless channel in the normal smart meter system is given based on the free path loss formula in the wireless channel. See Appendix 4. The calculation method of Signal Interference Attack Energy Consumption Analysis is shown in Appendix 5. The whole process and calculation of Attacker Profit under Wireless Channel Modeling shown in Appendix 6.

Defender’s cost analysis under node capability differences

In the environment of wireless channel interference, defenders face challenges that involve not only effectively detecting and preventing attacks but also managing the associated costs. This section provides a detailed analysis of the energy consumption of defenders in detecting interference attacks and the costs under different wireless channel conditions. By establishing energy consumption and cost models, we can gain a deeper understanding of the economic benefits of defense strategies, providing theoretical basis and practical guidance for devising more effective defense measures.

Bipartite graph construction

The Hungarian algorithm is a mature graph theory method that is widely used to solve the maximum weight matching problem. Its application in game theory models can more efficiently match participants and smart meters, thereby improving the overall performance of the system. Based on previous research, a Bayesian game model was developed that takes into account the differences in node capabilities. In each round of target selection, the traditional strategy of “more capability, more workload” may not be able to obtain the optimal strategy. Therefore, the Hungarian algorithm was introduced to optimize the strategies of the attacker and defender in each round of target device selection.

In the game model, two bipartite graphs: one for attackers and smart meters, and another for defenders and smart meters, as illustrated in Figure 4. In the bipartite graph of attackers and smart meters, attackers are represented as one set of nodes, while smart meters constitute the other set. An edge exists between an attacker and a smart meter if the attacker can target the smart meter. Similarly, in the bipartite graph of defenders and smart meters, defenders form one set of nodes and smart meters the other. An edge exists between a defender and a smart meter if the defender needs to protect the smart meter.

OPEN IN VIEWER

Figure 4.

Bipartite graph model.

Applying the Hungarian algorithm facilitates optimal resource matching during the attack and defense process, thereby improving system efficiency and overall performance. By optimizing the matching between participants and smart meters, we can better address the challenges of attacks and defenses, achieving optimal results within the game model. This approach provides robust support for system coordination and optimization, ensuring the effective utilization of resources throughout the attack and defense process.

Edge weight design

Updating posterior probabilities with observed data

In each round of the game, the observed attack and defense behavior data are used to update the posterior probabilities. By defining H a , H d to record the number of attempts and successes of attack and defense actions in each round, the posterior probability distributions for attackers and defenders can be dynamically updated using the observed data.

Specifically, the posterior probability P a i for attackers and P d i for defenders can be obtained through the update rules of the Beta distribution (equation (12)):

P a i = Beta ( α a + s a i , β a + a i − s a i ) , P d i = Beta ( α d + s d i , β d + d i − s d i ) , H a = { a 1 , … … a n , s a 1 … … s a n } , H d = { d 1 , … … , d n , s d 1 … … s d n }

(12)

Here, α a , β a , α d , β d are the parameters of the prior distributions. The lengths of H a , H d are both 2 n , which is twice the number of smart meters. The first n entries record the total number of attacks or defenses for each smart meter, while the latter n entries record the number of successful attacks or defenses for each smart meter. Variables a i , d i , s a i , s d i respectively represent the attack and defense actions and their success counts for the i smart meter.

The advantage of dynamic updating is that it not only relies on static prior probabilities but also allows the probability distributions to be adjusted based on actual observed data, more accurately reflecting the capabilities of both attackers and defenders. This makes the model more adaptive and flexible, better capturing the changes in real-world scenarios.

Weight matrix

To achieve more effective matching, we introduce weight values, assigning weights to the edges between attackers and smart meters, as well as defenders and smart meters. This weight matrix more accurately reflects the preferences of participants in selecting target devices. The weight matrix considers the relationships between attackers and defenders and incorporates various factors from the game process.

In the weight matrix, each element w i , k represents the weight of attacker k attacking smart meter i , and w j , k represents the weight of defender k defending smart meter j . The methods for determining w i , j , w j , k are as follows:

First, use equation (12) and Appendix 8 to derive the attack cost matrix C a and the defense cost matrix C d . Next, we calculate the net gain matrix I based on the value of the smart meters and the incurred costs. Additionally, we calculate the posterior probability matrices of successful attacks P a and successful defenses P d using equation (13).

w i , k = ( I k − c a k i ) P a k i V k , w j , k = ( I k − c d k j ) P d k j V k

(13)

Equation (13) provide the methods for determining w i , k and w j , k , respectively. Taking w i , k as an example, it represents the weight of the k attacker attacking the i smart meter, where I k is the value of the k smart meter, c a k i is the cost incurred by the k attacker in attacking the i smart meter, and P a k i is the posterior probability of a successful attack by the k attacker on the i smart meter.

Establishing this weight matrix provides effective input data for the subsequent application of the Hungarian algorithm, making the matching process more precise and better reflecting the strategic choices of the participants.

Multi-to-multi matching optimization

We have optimized the virtual node method in applying the Hungarian algorithm for multi-target attack scenarios. Traditional methods assign virtual nodes the maximum weight to prioritize actual nodes, but this approach fails to represent an attacker’s intentions when targeting multiple smart meters.

Our solution introduces multiple virtual attacker nodes for a single attacker, where each virtual node represents a distinct attack instance, allowing the attacker to target multiple meters simultaneously. If there are fewer attackers than smart meters, we replicate attacker nodes to match the number of smart meters. Similarly, defender nodes are also replicated to enable one defender to protect multiple meters.

The weight of the edges for virtual nodes is now calculated based on equation (13), ensuring accurate representation of attack and defense strategies in multi-target scenarios while preserving the bipartite structure required by the Hungarian algorithm. This optimization enables flexible many-to-many matching between attackers, defenders, and smart meters, improving resource allocation efficiency.

By enhancing the model’s flexibility and applicability, this optimization ensures the Hungarian algorithm performs well in multi-target matching, thus supporting the overall security and resource efficiency of the system.

Analysis of optimal strategies in the game

In this subsection, we will describe in detail the algorithmic process for determining the optimal strategies for both attackers and defenders, including their decision-making processes.

Obtaining attack and defense sequences

To reduce the size of matrix calculations and speed up computation, we propose setting a threshold X and assigning a weight of 0 to elements with posterior probabilities P ≤ X . This approach is justified by the following reasons: if the posterior probability is too low, it indicates a high probability of attack or defense failure. Under resource constraints, these elements can be excluded to reduce computational complexity while maximizing gains.

Using the Hungarian algorithm, we optimize the calculated weight matrix to obtain the optimal attack and defense sequences:

S A = ( A 1 , … … , A N ) , S D = ( D 1 , … … , D N )

(14)

Here, A i , D i denote the actions of the i participant toward the A i smart meter, where 0 represents no action and represents acting.

By setting the threshold X and employing the Hungarian algorithm, we successfully obtain the optimized attack and defense sequences. This ensures that under resource constraints, the system can more efficiently respond to attacks and implement defenses. This step provides a more practical solution for the system, meeting the needs for optimal decision-making under resource limitations.

Generation of optimal strategies

For participants, the core of the optimal strategy is to select attack or defense sequences that achieve the maximum gain with the minimum cost. Our goal is to achieve this, and based on the previous analysis, we propose Algorithm 1 for determining the optimal strategies for attackers and defenders in each round of the game.

OPEN IN VIEWER

Algorithm 1.

Wireless Smart Meter Channel Game Optimal Strategy

Input: n a , n d , n s , I Output: attack sequence, defend sequence Initialize W a , W d , H a = { a 1 , … … a n , s a 1 … … s a n } , H d = { d 1 , … … , d n , s d 1 … … s d n } for i =1, 2, …, n a ; j =1, 2, …, n d ; k =1, 2, …, n s do calculate cost c a k i , P a i , w i , k , c d k j , P d i , w j , k w i , k , w j , k update W a , W d H a , H d ← H a + { a i , s a i } , H d + { a d , s d i } end for Add virtual nodes to W a , W d attack sequence , defend sequence = Hungarian Algorithm ( W a , W d ) return attack sequence , defend sequence

Figure 5 shows the flowchart of the optimal strategy generation algorithm. The specific algorithmic process is as follows: Firstly, input parameters for the current round of the game, including the number of participants and the number of smart meters. Then, iterate over attackers (or defenders) and smart meters to calculate the cost matrix and gain matrix. Based on this data, compute the posterior probability matrix. Using the cost matrix and posterior probability matrix, compute the weight matrix for attackers or defenders regarding smart meters. Inputting the obtained weight matrix into the Hungarian algorithm for optimization, ultimately yielding the optimal attack or defense sequence. This optimal sequence represents the best decisions made by both attackers and defenders in the current round, enhancing the overall efficiency and performance of the system.

OPEN IN VIEWER

Figure 5.

Wireless smart meter channel game optimal strategy flow chart.

Analysis of game results under Bayesian equilibrium

Analysis of defense success rate under different strategies

In the Bayesian game model, we set the strategies of both attackers and defenders to Bayesian equilibrium. We compared the defense success rate of this strategy with that of full defense and random defense strategies, as shown in Figure 6.

OPEN IN VIEWER

Figure 6.

Comparison of defense success rates under different strategies.

Figure 6 presents the comparison of defense success rates under different defense strategies. Our proposed optimal strategy significantly outperforms the random defense strategy. In the long term, the defense success rate stabilizes at around 0.85. Specifically, in the initial stages, the defense success rate is higher as attackers have not fully understood the defense strategy. However, as the game progresses, attackers optimize their attack strategies, causing some fluctuation in the defense success rate, but it remains consistently high.

Analysis of defense costs under different strategies

We compared the defense costs under different strategies, as shown in Figure 7.

OPEN IN VIEWER

Figure 7.

Comparison of defense costs under different strategies.

From the Figure 7, the defense cost required by our proposed strategy is significantly lower than that of the full defense strategy. In the early stages of the game, the cost of our strategy is like that of the random defense strategy. However, in the later stages of the game, due to the increasing number of targets attacked by the attackers, the cost of the Bayesian defense strategy becomes higher than that of the random defense strategy, but remains much lower than the cost of the full defense strategy.

Analysis of defense benefits under the same cost

Previous sections have analyzed the defense success rates and associated costs of different strategies. In practical applications, defense resources are typically limited, making the cost-effectiveness of defense strategies particularly important. To further highlight the superiority of the proposed algorithm, this study compares the benefits of various defense strategies under a fixed cost threshold, thereby demonstrating the differences in effectiveness of different defense methods with identical resource investments.

As illustrated in Figure 8, although the comprehensive defense strategy exhibits strong defensive capabilities, its high costs limit its application under a fixed cost constraint, resulting in defense success benefits that are significantly lower than those of the proposed strategy. In contrast, the random defense strategy, while incurring lower costs than the comprehensive strategy, suffers from the randomness and lack of targeting in its defensive approach, leading to defense success benefits that are also inferior to those of the proposed strategy.

OPEN IN VIEWER

Figure 8.

Comparison of the benefits of different strategies at the same cost.

In stark contrast, the Bayesian game strategy achieves considerably higher defense benefits under the same cost conditions. This is primarily because the Bayesian game strategy can dynamically adjust defense decisions based on real-time game information, thereby flexibly optimizing limited defense resources. This approach enhances the success rate of defenses without incurring additional costs.

In summary, under the same cost threshold, the Bayesian game strategy not only effectively increases the defense success rate but also maximizes resource utilization, providing higher defense benefits. These analytical results indicate that the Bayesian game strategy offers an efficient and cost-effective defense option in practical applications, especially in environments with limited defense resources.

The impact of confidence levels on defense success rate

Attackers need only obtain the meter information once to launch an attack. If the attacker successfully monitors in the T1 state, the game proceeds to the second phase, where subsequent attacks are signal interference attacks. This implies that most attacks occur during the T2 phase. Therefore, if the current calculated μ is below a certain threshold, the defender considers the game to be in the T2 phase; otherwise, it is in the T1 phase. Increasing the confidence threshold allows defenders to classify more games as being in the T2 phase, thereby enabling them to adopt more effective defense strategies.

We set μ as the defender’s confidence level in the current game phase and tested its impact on the defense success rate, as shown in Figure 9. From Figure 9, it is evident that the defense success rate increases with the rise in confidence level, which aligns with our analysis. However, we do not recommend setting the confidence threshold to 1 in the experiments. This is because monitoring always occurs before an attack, and monitoring causes less harm to the meter. To prevent the game from advancing to the second phase, it is necessary for the defender to try to stop the attacker from successfully monitoring during the T1 phase.

OPEN IN VIEWER

Figure 9.

The impact of confidence on defense success rate.

Factors influencing optimal decision making under node ability discrepancy

Impact of interference source distance on power theft costs

In smart metering systems, the distance between the interference source and the electric meter is a crucial factor affecting the cost allocation for power attack. This influence can be studied by configuring different distance settings and interference intensities.

As shown in Figure 10, the authors categorized the distance between the interference source and the electricity meter into several levels and calculated the total cost incurred by the attacker during the game. The results show that as the distance increases, the attacker’s cost decreases. The reason is that for attackers, attacking a meter located farther away is more difficult and requires more resources and effort. Therefore, attackers typically avoid targeting meters that are farther away and tend to focus on meters that are closer, as the attack cost is lower for these meters. This analysis helps us understand that when selecting targets, attackers will exclude meters that are farther away due to the higher attack cost involved. As a result, overall, as the distance increases, the attacker’s cost decreases because meters located at a greater distance are excluded from the attack range.

OPEN IN VIEWER

Figure 10.

Influence of distance on attacker’s resource allocation.

Sensitivity analysis of node capability based on interference distance

To systematically analyze the influence of node capability differences on optimal resource allocation, we perform a sensitivity analysis by varying the distance between the attacker and smart meters. Specifically, we simulate a range of distances from 5 to 100 m, with increments of 5 m. Using Appendices 4 and 5, we compute the required interference signal strength and the corresponding attack cost at each distance.

As shown in Figure 11, the attack cost increases exponentially as the distance grows, reflecting the path loss characteristics of wireless channels. This trend significantly affects the attacker’s selection strategy. When the distance is short, the required interference power is low, making those meters more attractive targets. As distance increases, attack cost rises sharply, resulting in lower probabilities of selection in the matching process.

OPEN IN VIEWER

Figure 11.

Impact of distance on attack cost.

This sensitivity analysis highlights that the spatial distribution of smart meters plays a critical role in the resource allocation of both attackers and defenders. It further demonstrates the importance of considering physical-layer constraints in designing adaptive security strategies for smart grid systems.

Impact of smart meter value on cost allocation for both parties

In Subsection 3.5, we calculated the value of smart meters using equation (11), which comprehensively considers the power load P and the connectivity degree C with critical infrastructure. To validate the impact of smart meter value on defense benefits, we compared the defense benefits with and without the incorporation of smart meter value under identical cost conditions.

As shown in Figure 12, the introduction of smart meter value significantly enhances the defense benefits. This improvement is primarily because, during the game-theoretic process, smart meters with higher value coefficients receive more defensive resources, thereby achieving greater benefits. Specifically, the high value of smart meters reflects their importance within the distribution network, prompting defenders to allocate more resources to these critical meters to ensure their security, thus increasing the overall defense benefits.

OPEN IN VIEWER

Figure 12.

Impact of smart meter value on defense benefits.

To further investigate the influence of the smart meter value coefficient on the cost allocation for both attackers and defenders, we normalized the values of all smart meters. The authors divided them into five equal levels, designated as Level 1 through Level 5. This categorization allows for a comparative analysis of resource investment and cost allocation by both parties across different value levels.

Figure 13 illustrates how the smart meter value coefficient impacts the cost allocation between attackers and defenders. The experimental results show that as the smart meter value increases, the costs for both parties rise significantly. This indicates that high-value smart meters are more attractive targets, leading both attackers and defenders to focus their resources on these critical assets. On the other hand, smart meters with lower value levels receive less resource investment due to their reduced importance.

OPEN IN VIEWER

Figure 13.

Impact of smart meter value on cost allocation for attackers and defenders.

These findings validate the model’s assumption that the value of smart meters plays a crucial role in regulating the attack-defense game. High-value smart meters become primary targets, influencing resource allocation and cost investment for both attackers and defenders.

By categorizing smart meters into five value levels and analyzing the cost allocations for each, we gain insights into how smart meter value affects strategies. This provides a foundation for more precise attack-defense strategies, optimized resource allocation, and enhanced security in distribution networks. Defenders can allocate resources based on the value levels of meters, while attackers can target high-value meters to maximize benefits and optimize their strategies under resource constraints.

Performance evaluation of Hungarian optimization strategy

Comparison of attacker strategy optimization effects

The authors compared the costs incurred and the pure profits obtained between the random attack strategy, Bayesian attack strategy, and our proposed optimal strategy in each round of the game process.

Figure 14 illustrates the costs borne by attackers in each round across the three strategies. The results show that the proposed strategy has the lowest per-round expenditure cost. Moreover, this strategy reduces the total expenditure cost by half compared to the other two strategies. Furthermore, the attacker’s net profit under different strategies is presented. The strategy optimized by the Hungarian algorithm demonstrates robust profitability, particularly in the latter stages of the game, significantly outperforming both random and traditional Bayesian game strategies.

OPEN IN VIEWER

Figure 14.

Comparison of attack costs and income for different strategies.

Comparison of defender strategy optimization effects

To compare the effects of defense strategy optimization, the author conducted experiments to compare the defense costs and pure profits of the random defense strategy, Bayesian defense strategy, and the defense strategy proposed in this paper.

In Figure 15, compares the attack costs and returns under different defense strategies. From a cost perspective, the author proposed optimal strategy significantly outperforms both random defense and mixed Bayesian Nash equilibrium strategies. Specifically, the author optimal strategy shows remarkable cost-effectiveness by substantially reducing the economic burden on attackers. Regarding returns, while initially the author strategy yielded slightly lower returns compared to random defense, it demonstrated a pronounced upward trend with increasing game rounds, surpassing the returns of random defense. This indicates the author optimal strategy’s ability to adapt dynamically to changes in the game, adjusting strategies promptly to achieve cost control and optimize returns simultaneously. In this way, the authors not only effectively mitigate attack costs but also ensure sustainable growth in long-term returns, showcasing the significant advantages of their strategy in applied game theory.

OPEN IN VIEWER

Figure 15.

Comparison of defense costs for different strategies.

Comparison with popular defense methods

To further evaluate the effectiveness of our proposed scheme in resource-constrained environments, the authors design a comparative experiment against several popular defense strategies.

Under the same dataset and attack settings, the authors compare the defense cost and defense benefit in each round. The results are shown in Figures 15 and 16.

OPEN IN VIEWER

Figure 16.

Cost comparison of different defense solutions.

As shown in Figure 16, XGBoost incurs relatively high defense costs (ranging from 323.25 to 356.14) due to its lack of adaptability and vulnerability to false positives. Although the Zero-Sum Game strategy incorporates cost into the Nash equilibrium calculation, it relies on static strategies and lacks dynamic adjustment capability. The Agent-based IDS-IPS scheme uses rule-based updates and starts with a low cost, but the cost gradually increases over time, reaching an average of 286.31. In contrast, the author proposed scheme maintains consistently low resource consumption throughout the entire game process (with an average cost below 232.53), thanks to belief updating and the optimization of resource allocation using the maximum weight matching algorithm.

In terms of defense benefit (Figure 17), XGBoost shows relatively low performance due to frequent misjudgments, with benefits ranging from 913.21 to 1227.75. The Zero-Sum Game offers slightly better results, but is still limited by its static strategy. Agent-based IDS-IPS demonstrates improved performance in the later stages, but still falls short of the ideal outcome achieved by Full Defense. The authors proposed scheme surpasses all comparison methods after round 45 and closely approaches the defense performance of Full Defense in later stages, ultimately reaching a total benefit of 3523.74.

OPEN IN VIEWER

Figure 17.

Comparison of benefits of different defense solutions.

In summary, under the context of complex attack behaviors and limited computational resources in smart grid environments, Bayesian game-based defense scheme achieves better performance than traditional data-driven methods. Data-driven approaches often rely on large-scale labeled datasets and static detection thresholds, making them less effective in data-scarce or dynamic scenarios. In contrast, the authors scheme requires no large-scale training, and can perform adaptive defense through belief updating and strategy optimization, ensuring both efficiency and interpretability while enhancing the system’s overall security.

Limitations

Despite the effectiveness of the proposed Bayesian game model and the Hungarian algorithm optimization in enhancing smart meter system security, several limitations remain:

These limitations suggest opportunities for future research, such as incorporating adaptive learning techniques (e.g. reinforcement learning), modeling richer network interactions, and introducing robust estimation methods under uncertainty.

Future work

This paper proposes a dynamic game theory-based attack-defense model for smart meters to address current protection shortcomings. The main contributions include dynamically modeling the capabilities of attackers and defenders using Bayesian game methods and achieving optimal attack-defense target matching through the Hungarian algorithm. Based on this model, we designed an optimal strategy algorithm to maximize cost-effectiveness and pure profit by optimizing the decisions of attackers and defenders. Simulation experiments validate the effectiveness of the model, showing that the proposed algorithm effectively reduces attack costs and increases overall pure profits.

Future work could focus on the following aspects:

This study assumes that wireless channel interference can be modeled and predicted to a certain extent, but in actual scenarios, complex communication environment factors such as channel fading, shielding effects, and non-Gaussian interference may cause model performance to degrade. Therefore, in the future, robust optimization or deep reinforcement learning methods can be introduced to improve robustness and generalization capabilities under uncertain conditions.

Although this study takes smart meters as the starting point, the dynamic Bayesian game model constructed has strong versatility and can be extended to key infrastructures such as electric vehicle charging piles and power Internet of Things devices that also rely on wireless communications in the future to build a unified game-driven security protection framework.

This paper adopts a one-to-one match between defense resources “node-protection measures” and does not consider multi-dimensional resource constraints such as deployment cost, communication delay, computing resources, and real-time constraints. In the future, multi-objective constraints can be introduced into the optimization model to form a multi-objective combination optimization model or a resource allocation strategy for task scheduling to improve the feasibility of real deployment.