## 4 Defense Strategies Against Deliberate Attacks on IECPS
### Process Response
#### 4.2.1 Deliberate Attack Detection
Considering the problem of less quantitative measurements in distribution networks, which is difficult to meet the demand of state estimation, in [117], a pseudo-quantity side load model is established for state estimation, and then it is combined with adaptive untraceable KF for FDIA detection, and the results show that this method has a higher detection capability compared to the traditional detection methods. Although introducing KF into BBD can improve the detection rate of FDIA, this approach still has drawbacks. On the one hand, the accuracy of attack detection relies on the accuracy of KF prediction, which may lead to false positives; on the other hand, the attacker has sufficient time to learn about the system and constructs false data to satisfy the threshold after obtaining the threshold setting of the system. These problems can be attributed to the static characteristics of traditional cyber systems [110]. To address this shortcoming, researchers have attempted to make it impossible for attack vectors to bypass detection mechanisms, such as BBD, by altering the system parameters required for attackers to construct attack vectors. Based on this, the moving target defense (MTD) attack detection methodology is proposed. The principle of MTD is to actively change the transmission line parameters by controlling the distributed flexible AC transmission system devices deployed on the transmission line. This invalidates the parameter information used by the attacker to construct the attack vectors, making them more easily recognizable by FDIA detection algorithms. In [118], the authors derive the feasibility of MTD in FDIA detection and provide a completeness analysis for implementing MTD. In [119], the authors change the transmission line parameters without affecting the normal operation of the system, significantly reducing the likelihood of false detections. Although MTD is able to improve the detection probability of the attack, it increases the system loss because it changes the system parameters. Therefore, in [120; 121], planning and operational methods to reduce the cost of implementing MTD within the system are explored from an economic perspective. * **Statistical model-based detection methods** In addition to utilizing state estimation models for detecting deliberate attacks, statistical models can also be employed to identify such attacks effectively. Currently, several widely adopted detection models include the generalized likelihood ratio (GLR) detection model, the Bayesian test model, and the quickest change detection (QCD), among others. The GLR detection model is used to detect cyberattacks in power systems through statistical likelihood ratios. It is generally used for weak FDIA detection because it cannot detect a large number of compromised samples [110]. In [122], based on the GLR model, it is proposed to use the \(l_{1}\) paradigm to realize the attack detection, and it is pointed out that with the increase in detection samples, the GLR model has a better detection effect for the same FDIA. Literature [123] combines GLR model with the square root traceless KF and achieves the detection of general imperfect FDIAs by testing the sequential dynamic event regularization distance obtained from the square root traceless KF. From the above description, it is evident that this detection method has significant limitations. Additionally, literature [124] specifies that this detection method does not work properly when the system measurements are corrupted by non-Gaussian noise distributions. The Bayesian test model-based detection method focuses on identifying a priori information and deriving probabilities using Bayesian theory, once the probability of the FDIA vectors has been determined through Bayesian inference, it is able to derive Bayesian based recursive predictions using system measurements and predictions to perform attack detection. In literature [125], the authors designed Bayesian detectors for each monitoring node to enable attack detection in distributed systems.