## 4 Defense Strategies Against Deliberate Attacks on IECPS
### Post-Event Recovery and Summarizing
#### 4.3.1 Incident Assessment and Reconstruction  
Unlike the recovery and reconstruction of single systems, the recovery and reconstruction of IECPS is characterized by significant complexity and multidimensionality. This complexity arises from the coupling of multiple energy subsystems and the high degree of interaction and dependency between cyber and physical systems within IECPS. Specifically, the recovery and reconstruction efforts must not only assess the damage to various energy subsystems, such as electricity, thermal, and natural gas, but also consider the interdependencies between these systems. For example, a fault in the power system may trigger a chain reaction in the thermal system, while a disruption in natural gas supply may further affect the normal operation of power generation equipment. Furthermore, forcibly restoring the load of a heavily impacted system may result in more severe load shedding in coupled systems, and focusing solely on the repair of one subsystem is often insufficient to meet the comprehensive recovery requirements of IECPS. In addition to the coupling of physical systems, IECPS also integrates physical systems with cyber systems. Cyber systems play a key role in energy flow, equipment scheduling, and system monitoring and are prime targets for deliberate attacks. Consequently, cyber systems may also be damaged following a failure. As a result, the recovery efforts must comprehensively consider the damage to both physical coupling and cyber-physical coupling. Under this background, a detailed assessment of IECPS following a deliberate attack is crucial. The assessment of physical coupling focuses on the integrity of energy flow and the functionality of equipment, while the evaluation of cyber-physical coupling emphasizesthe reliability of information transmission, the effectiveness of control signals, and the coherence of system operations. Through detailed post-disaster assessment, a comprehensive understanding of the specific damage to the system, including equipment failures, network disruptions, and abnormal energy flows, can provide precise guidance for the recovery and reconstruction efforts. This not only helps in formulating targeted repair strategies but also improves resource allocation efficiency, ensures clear prioritization of reconstruction efforts, and ultimately achieves the rapid and comprehensive recovery of IECPS. Although researchers have recognized the importance of the cyber-physical coupling relationship in post-disaster reconstruction, related studies remain relatively scarce and predominantly concentrate on post-event recovery in power systems. In [180], the interaction recovery between cyber systems and physical systems was initially studied. A model for cyber-physical coordinated recovery was developed by analyzing the impact of cyber systems on generator output adjustment, power line instability, and recovery delays. The study results indicate that neglecting the constraints imposed by cyber systems on physical system recovery may lead to operational discoordination and even cause secondary blackouts. However, this approach only explored the constraints of cyber systems on physical system recovery and did not consider in depth the impact of physical system faults on cyber system recovery. To address this limitation, Ref. [181] further incorporates the dual failures of both cyber and physical systems into the research scope. By examining the interactions between maintenance scheduling, cyber system operations, and power system operations, it establishes a collaborative restoration model for the transmission system. This approach significantly enhances the coordination and reliability of the restoration process. Meanwhile, in [182], the research scope was expanded to not only focus on the interactive coordination of cyber and physical systems but also include the uncertainty of new energy output in the recovery process framework.