## 4 Defense Strategies Against Deliberate Attacks on IECPS
### Process Response
#### 4.2.1 Deliberate Attack Detection  
Because of its important position in social production activities, IECPS have become one of the main targets for lawbreakers to damage and seize benefits, and various kinds of targeted attacks are emerging [109]. In the process of continuous confrontation with deliberate attacks, researchers and scholars have proposed a variety of attack detection methods, and the deliberate attack detection mechanism has made great progress. As shown in Figure 12, IECPS deliberate attack detection methods can be classified into state estimation-based detection methods, statistical model-based detection methods, and data-driven detection methods. * **State estimation-based detection methods** Bad data detection (BDD) is widely used in various commercial energy management system software because of its ability to detect erroneous measurements due to equipment failures, communication interruptions, and other factors during system operation [110]. Its principle is realized by determining whether the residual difference between the state estimation result and the measurement result satisfies a threshold value. To prevent false detection, the residual threshold is set with a certain criterion, which is used by deliberate attackers to construct false data that satisfy the residual test, thus easily bypassing this line of defense and causing damage to the system. Faced with this situation, some studies have suggested lowering the threshold of BBD to enable FDIA detection. In [111], considering that lowering the threshold may result in false detection proposed a partitioned detection approach, which improves the possibility of attack detection by decomposing the system into multiple subsystems and lowering the BBD threshold for each subsystem separately. Partition-based detection methods can enhance the probability of FDIA detection but still do not address the shortcomings of the BBD principle. This is mainly due to the fact that traditional detection methods use steady-state estimators and lack real-time information about the system. To address this issue, scholars employ dynamic state  
Figure 12: Deliberate attack detection methods. estimation to improve the detection probability of attacks. Dynamic state estimation mainly uses kalman filter (KF) and its variants. The variants of KF include extended KF, untraceable KF, adaptive KF, integrated KF, and particle filters designed for nonlinear systems [112]. In [113], a Euclidean distance detector is used to detect the difference between the result of the KF estimation and the measured value to determine whether the system is subjected to FDIA or not. The proposed method achieves better detection accuracy than the traditional BDD; however, it possesses two limitations. First, although it applies a dynamic estimation method, it only considers time-invariant states and ignores the dynamic nature of state variables. In addition, the proposed detector cannot lack the capability to differentiate between FDIAs and faults caused by physical issues. To tackle this challenge, some scholars introduced dynamic state estimation into the BBD detection mechanism, which utilizes the principle that the state quantities of the dynamic state estimation deviate from the steady state estimation of the state quantities more after false data injection. The specific flow is shown in Figure 13. Based on this principle, in [114], the FDIA detection method for extended KF is designed. In [115], the detection method of adaptive KF is designed to realize the attack detection of vehicle-network data. Literature [116] combines the untraceable KF with extreme gradient boosting to achieve the detection of FDIA, and corrects the data tampered by FDIA through the central limit theorem.