## 1 Introduction  
With the increase in energy consumption and the growth in the penetration of distributed generators (DGs) in the power grid, there is a necessity for the transition from the conventional power grid to the smart grid [1]. Initiatives for smart grids aim to overlay the current electric grid with a more robust communication, processing, and sensing infrastructure, allowing the grid to accommodate a higher penetration of renewable energy sources besides contributing to sustainability by improving energy efficiency and the quality of service [2]. With the increase in the interaction between power grids and communication technologies, power systems have become cyber-physical power systems (CPPS) that include both power and communication networks. As a result, considering the interdependence between both networks is essential when studying the performance of the power or communication networks. Nevertheless, this integration intensifies vulnerability and cyber-attack threats [3]. With the increase in the dependency of CPPS on communication networks, several vulnerabilities can affect the system's performance in terms of communication interruptions, network congestion-induced delay, and packet loss [4], impacting the power system performance and leading to system failures. Cyber attackers can adopt cyber-attacks to hack the communication network by manipulating or blocking the transmitted signals in the form of a false data injection (FDI) attack or distributed denial of service (DDoS) attack, causing system instability [5]. More details about FDI attacks are available in [6; 7]; this paper focuses on modeling the DDoS attack behavior and studying its impact on power system performance. DDoS attacks can cause significant corruption in communication networks by overwhelming them with excessive traffic from diverse sources. Two types can define the categorization of DDoS attacks; the first is network/transport layer DDoS attacks, which overwhelm the network by flooding it with traffic. The second is application-layer DDoS attacks targeting higher-layer protocols [8]. Regarding network/transport layer DDoS attacks, TCP SYN flooding is an attack created by transmitting excessive TCP SYN connection requests to overwhelm the server [9]. To start the attack, the attacker sends packets with random source IP addresses, and each packet has a SYN flag set for creating a connection with the server. Then, the victim responds to the spoof IP address and stands for authorization, which never comes. After receiving them, the victim responds to spoof IP addresses and waits for confirmation, which never comes. Consequently, the TCP SYN packets overwhelm the server, fulfilling its table, and it cannot accept new connections. As a result, the authorized cannot reach the server. Turning to the UDP (User Datagram Protocol) flooding, it does not require a connection setup for transmitting data. Thus, the attacker sends random UDP packets to the targeted system's ports [10]. After that, the victim checks which application stands for the response's target port. If it does not find anyone, it will send an ICMP packet to the faked source address with the message of destination unreachability, leading to system collapse [9]. Thus, cyber-attacks on power systems affect the physical components, degrade the system's behavior, and interrupt the communication surface, leading to the system's instability. Therefore, while investigating the performance of power systems, it is necessary to consider the operation characteristics of the communication systems and the cyber threats [11]. Therefore, simulation is a proper solution for studying the performance of cyber-physical power systems, including the impact of communication and cyber-attacks on system performance. MATLAB/Simulink, Power World, and RT-LAB are the most popular simulation tools for the simulation of power systems. For communication network infrastructures, OMNET++, ns2, ns3, and OPNET are well-known communication simulators [12].