  An adversary looking to disrupt a power grid may look to target certain
substations and sources of power generation to initiate a cascading failure
that maximizes the number of customers without electricity. This is
particularly an important concern when the enemy has the capability to launch
cyber-attacks as practical concerns (i.e. avoiding disruption of service,
presence of legacy systems, etc.) may hinder security. Hence, a defender can
harden the security posture at certain power stations but may lack the time and
resources to do this for the entire power grid. We model a power grid as a
graph and introduce the cascading failure game in which both the defender and
attacker choose a subset of power stations such as to minimize (maximize) the
number of consumers having access to producers of power. We formalize problems
for identifying both mixed and deterministic strategies for both players, prove
complexity results under a variety of different scenarios, identify tractable
cases, and develop algorithms for these problems. We also perform an
experimental evaluation of the model and game on a real-world power grid
network. Empirically, we noted that the game favors the attacker as he benefits
more from increased resources than the defender. Further, the minimax defense
produces roughly the same expected payoff as an easy-to-compute deterministic
load based (DLB) defense when played against a minimax attack strategy.
However, DLB performs more poorly than minimax defense when faced with the
attacker's best response to DLB. This is likely due to the presence of low-load
yet high-payoff nodes, which we also found in our empirical analysis.
