## 4 Defense Strategies Against Deliberate Attacks on IECPS
### Process Response
#### 4.2.2 System Fault Isolation  
Despite extensive research on deliberate attack detection methods, these approaches may still exhibit limitations when addressing complex and diverse deliberate attacks, potentially disrupting the system's normal operation and leading to system losses. If the impact of deliberate attacks is minimal, faults induced by the attacks can be swiftly rectified through emergency system adjustments. It is important to note that although the impact of deliberate attacks may be minimal, this does not imply that the damage caused by the attack will not escalate. If a deliberate attack is not adequately addressed during the emergency  
Figure 14: Difference between supervised and semi-supervised learning detection methods. regulation phase, its impact may be amplified through the coupling of energy subsystems, as well as between cyber systems and physical systems [148]. Therefore, emergency regulation in IECPS should prioritize fault isolation and block the fault propagation path to prevent further escalation. In [149], the effects of grid fault currents and the voltage characteristics of protective devices under pre-fault, during fault, and post-fault conditions are examined, and a fault isolation method based on line and bus voltage measurements is proposed. In [150], real-time switch state data are employed to reflect dynamic changes in power system topology, and the Floyd-Warshall algorithm is used to trace the paths of circuit breaker disconnections for each electrical component, thereby formulating a fault isolation set. While the aforementioned method can effectively isolate system faults, it fails to account for tampering by deliberate attacks, which may inadvertently facilitate the attacker in achieving their objectives. In consideration of the impact of deliberate attacks on information transmission between measuring elements, the control center, and actuating elements, literature [151] achieves decentralized fault isolation by mapping the relationship table of protection devices, enabling accurate and swift isolation of faulty distribution system segments without reliance on a central controller. In [152], a novel fault isolation scheme based on active converter control is proposed, where a trapezoidal wave is injected into the converter to identify the faulted line by counting the high-level pulses of the trapezoidal current. Isolation is then performed using a corresponding DC switch during the low-level pulses. This scheme operates using DC switches without the need for communication, effectively mitigating the risk of deliberate tampering by attackers. Currently, research and engineering applications concerning fault location, treatment, and isolation in single power systems have matured [153]. However, fault isolation technologies for IECPS are still in their infancy. Since a single fault in integrated energy systems can trigger abnormal operation in other subsystems, isolating faults in each subsystem individually is not feasible; instead, a holistic approach is necessary. Researchers are currently endeavoring to establish an effective fault management framework for fault isolation in complex multi-energy coupled systems. In [154], a building-wide fault diagnosis method based on discrete Bayesian networks was proposed, aimed at accurately identifying and isolating major cross-system faults during operation. In [155], building upon this foundation, a weather- and schedule-based pattern-matching Bayesian network was further designed to diagnose and isolate cross-system faults in integrated building energy systems. To further improve the accuracy of fault diagnosis and isolation, literature [156] combined model-based and Bayesian network-based methods, achieving a 45.7% increase in fault isolation accuracy through the complementary strengths of both approaches. Although the aforementioned methods offer high accuracy in fault diagnosis and isolation, the Bayesian network-based isolation approach significantly depends on domain expert knowledge, which limits its scalability.