Two-stage defense strategy for cyber-physical distribution systems under dual uncertainties of attack scenario probability and location

The rapid deployment of intelligent terminal devices in distribution networks has significantly expanded the attack surface of Cyber-Physical Distribution Systems (CPDS), making them more vulnerable to coordinated attacks. Traditional defense models can only address uncertainties in attack locations and are incapable of handling coordinated attacks with uncertain attack scenario probabilities, resulting in insufficient robustness of defensive strategies under complex and evolving attack environments. Therefore, this paper proposes a two-stage defense strategy for CPDS that considers dual uncertainties in both attack scenario probabilities and attack locations, enabling more targeted and robust defensive decision-making. First, a composite feature mapping framework is developed by integrating attack cost, effect, and cost-effectiveness, enabling the identification of representative attack scenarios and their probabilities via clustering. Then, a four-layer DAAD (Defender-Attacker-Attacker-Defender) defense model is constructed. In the first layer, the defender conducts pre-disaster planning of hardening resources and cross-domain flexibility resources. In the second layer, the attacker optimizes the probability distribution over the representative attack scenarios within a distributionally robust optimization (DRO) framework to derive the worst-case scenario probability distribution that maximizes the defender's expected loss. In the third layer, the attacker identifies the worst-case attack strategy that maximizes the defender's system operating loss under the given attack resource budget constraints. In the fourth layer, the defender implements emergency response measures. To handle the binary variables introduced by flexibility resources and system operational status constraints, an improved C&CG algorithm is developed to enhance computational efficiency. Case studies based on the IEEE 33- and 123-bus systems show that the proposed model identifies and weights high-risk scenarios, optimizes defensive resource allocation, and effectively enhances system robustness, providing practical decision support for defense investment planning and resilience enhancement of CPDS under coordinated attack threats. In addition, compared with NC&CG algorithm, the solution efficiency improves by approximately 2.05 times.