## 3 Deliberate Attacks on IECPS
### Cyberattacks
#### 3.1.3 False Data Injection Attacks
\right.\] (10) \[\eta_{FL,j}=\left\{ \begin{array}{ll}0&\Delta F_{L,j}=0\\ 1&\Delta F_{L,j}\
eq 0\end{array} \right.\] (11) \[\sum_{i=1}^{N_{d}}\eta_{D,i}+2\sum_{j=1}^{N_{l}}\eta_{FL,j}\leq N_{a}^{\max},\] (12) where \(\eta_{D,i}\) is the 0-1 integer variable corresponding to the first load node; \(\eta_{FL,j}\) is the amount of current modification on the first line; \(N_{l}\) is the number of lines; and \(N_{a}^{\max}\) is the maximum number of attacks. * **False topology attackmodel*
* It is crucial to emphasize that, once the attacker manipulates the system topology, a false disconnection arises within the network. This manipulation leads to a discrepancy between the system topology information and the operational data. To evade detection by the system, the attacker must also alter the pipeline data. Taking the power system false topology attack as an example, the attack model actually comprises two parts: topology tampering and power tampering [43]. 1. The topology tampering part involves an attacker trying to fake the disconnection of a transformer branch by tampering with the transformer protection action information, thereby disconnecting the circuit breakers at both ends: \[\psi^{\rm T}_{(0)}=0\Rightarrow\psi^{\rm T}_{(1)}=1\rightarrow\left\{ \begin{array} []{l}\zeta^{\rm CB,\it f}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it f}_{(1)}=1\\ \zeta^{\rm CB,\it f}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it f}_{(1)}=1\end{array}  \right.,\] (13) where \(\psi^{\rm T}_{(0)}\) and \(\psi^{\rm T}_{(1)}\), respectively, indicate the protection action state of the transformer branch before and after the attack; \(\zeta^{\rm CB,\it f}_{(0)}\) and \(\zeta^{\rm CB,\it f}_{(1)}\), respectively, indicate the state of the front-end circuit breaker of the transformer before and after the attack, with a value of 0 indicating that the circuit breaker is open; \(\zeta^{\rm CB,\it f}_{(0)}\) and \(\zeta^{\rm CB,\it f}_{(1)}\), respectively, indicate the state of the back-end circuit breaker of the transformer before and after the attack, with a value of 0 indicating that the circuit breaker is closed and a value of 1 indicating that the circuit breaker is open. In contrast to transformer protection, when an attacker simulates a transmission line fault, it is necessary to alter the information of two distinct protection devices. These two sets of devices control the state of two separate circuit breakers:  
\[\left\{ \begin{array}{l}\psi^{\rm L,\it f}_{(0)}=0\Rightarrow\psi^{\rm L,\it f }_{(1)}=1\rightarrow\zeta^{\rm CB,\it f}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it f }_{(1)}=1\\ \psi^{\rm L,\it f}_{(0)}=0\Rightarrow\psi^{\rm L,\it f}_{(1)}=1\rightarrow\zeta ^{\rm CB,\it f}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it f}_{(1)}=1\end{array}  \right., \tag{14}\]  
where \(\psi^{\rm L,\it f}_{(0)}\) and \(\psi^{\rm L,\it f}_{(0)}\) denote the operational states of the protective devices at each end of the transmission line, while \(\zeta^{\rm CB,\it f}_{(0)}\) and \(\zeta^{\rm CB,\it f}_{(0)}\) represent the states of the corresponding circuit breakers at the respective locations. When all branch circuits connected to a bus need to be disconnected by an attacker, the action information of the bus protection needs to be tampered with, thus changing the breaker state:  
\[\psi^{\rm B}_{(0)}=0\Rightarrow\psi^{\rm B}_{(1)}=1\rightarrow\left\{ \begin{array} []{l}\zeta^{\rm CB,\it 1}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it 1}_{(1)}=1\\ \zeta^{\rm CB,\it 2}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it 2}_{(1)}=1\\ \ldots\ldots\\ \zeta^{\rm CB,\it n}_{(0)}=0\Rightarrow\zeta^{\rm CB,\it n}_{(1)}=1\end{array}  \right., \tag{15}\]  
where \(\psi^{\rm B}_{(0)}\) is the state of the busbar protection device. 2.