## 6 Issues and Challenges in the Defense Against Deliberate Attacks on IECPS
### Difficulties in Attack Detection and Early Warning  
IECPS plays a crucial role in achieving efficient energy collaboration and actively promotes the development of a diversified energy market. In this process, a large number of emerging producers and consumers have emerged, whose participation enhances the competitiveness of the energy market while also posing new security challenges to the system. At the same time, to improve operators' system awareness and users' energy quality, a large number of IoT devices have been widely deployed within IECPS. IoT devices play an indispensable role in enhancing the intelligence and automation of the system; however, they also open up additional intrusion channels for potential attackers, making it difficult to detect and prevent small attacks originating from system terminals in a timely and effective manner. Especially in the case of massive interconnection among producers, consumers, and IoT devices, attackers can exploit the complexity and diversity of the system to easily bypass traditional security measures.  
With the large-scale integration of renewable energy, the source side is highly influenced by extreme weather, potentially resulting in significant power fluctuations in a short period. If an attacker launches a deliberate attack during this period, hiding the attack data within normal system fluctuations, the attack can easily bypass system detection. Moreover, during extreme disasters, the perception capability of IECPS diminishes significantly, and the focus at the scheduling level shifts to disaster recovery efforts. At this point, attackers can easily carry out cyber-physical collaborative attacks. This can lead to erroneous system scheduling, thereby expanding the scope of system damage.  
Whether it is due to the system's complex architecture or frequent external extreme events that make attack detection more difficult, the fundamental issue is the limited adaptability of existing attack detection algorithms to unknown attacks. Although some AI algorithms can dynamically adjust model parameters to counter unknown attacks, existing research has proven that attackers can manipulate the construction, training, and deployment processes of AI detection algorithms through backdoor attacks, thereby decreasing the probability of detecting deliberate attacks and faulty data. Compared to directly attacking the physical power grid system, embedding backdoors into the model constitutes a more covert form of attack. By altering the algorithm's application in business decision-making systems, this behavior can cause far more severe consequences [230; 231].  
The challenges of attack detection and early warning reduce the speed and intensity of the execution of response strategies during the incident. On the one hand, diverse attack patterns and complex system characteristics make attack detection increasingly difficult. In order to avoid the occurrence of false detection, the existing detection methods cannot eliminate all malicious attacks. On the other hand, with the increase in uncertainties, the system has to set up multiple links to verify the normal operation of the system, which slows down the speed of the system's early warning. In addition, the backwardness of attack detection technology will also affect the accuracy of attack source tracing and analysis, and some advanced combined attacks may be completely ignored.