Abstract: As substations evolve from isolated systems to complex networks spanning IT and OT,the security threats they faced are increasing,making the identification of potential attack paths in remote monitoring networks crucial.This paper presents an automated attack path planning method based on the MITRE ATT & CK framework.It treats ATT & CK techniques as attack primitives and maps attack stages using the Cyber Kill Chain.A formalized threat model is constructed,and a PDDL-based me-thod for automatic generation is proposed,transforming the attack path discovery problem into a general automated planning issue for fine-grained analysis.Experimental results show that this method reduces reliance on user expertise,generates comprehensive and practically valuable attack paths based on specific network topology,and provides strong support for automated penetration testing and security defense system development.

Key words: Substation remote monitoring network, Automated attack path discovery, Threat modeling, Planning domain definition language, MITRE ATT & CK framework