This paper proposes a tri-level defense planning model to defend a power system against a coordinated cyber-physical attack (CCPA). The defense plan considers not only the standalone physical attack or the cyber attack

but also coordinated attacks. The defense strategy adopts coordinated generation and transmission expansion planning to defend against the attacks. In the process of modeling

the upper-level plan represents the perspective of the planner

aiming to minimize the critical load shedding of the planning system after the attack. The load resources available to planners are extended to flexible loads and critical loads. The middle-level plan is from the viewpoint of the attacker

and aims at generating an optimal CCPA scheme in the light of the planning strategy determined by the upper-level plan to maximize the load shedding caused by the attack. The optimal operational behavior of the operator is described by the lower-level plan

which minimizes the load shedding by defending against the CCPA. The tri-level model is analyzed by the column and constraint generation algorithm

which decomposes the defense model into a master problem and subproblem. Case studies on a modified IEEE RTS-79 system are performed to demonstrate the economic efficiency of the proposed model.