## 3 Deliberate Attacks on IECPS  
IECPS effectively enhances energy utilization through advanced communication technologies and energy management systems. However, its complex coupling characteristics render it highly vulnerable to deliberate attacks by malicious actors. On one hand, the system's precise control depends on the efficient processing of data; however, extensive data exchanges increase the burden of data detection, enabling attackers to falsify, tamper with, or disrupt data transmissions, which may lead the system to issue erroneous scheduling commands. On the other hand, a minor fault in one system can be amplified through repeated propagation across multiple systems, potentially causing the collapse of the entire integrated energy system. As a result, the impact of system failures is significantly amplified.  
Exploiting the aforementioned IECPS weaknesses, the attacker executes the invasion method depicted in Figure 2. In the physical layer, the attacker may employ aggressive tactics to damage critical energy infrastructure, including the destruction of energy stations, transmission pipelines, measurement devices, and other essential facilities. This can lead to both single-point and multi-point failures that can trigger a cascading chain of failures, fulfilling the attack's objective. The communication layer is typically divided into the communication and control layers, based on their distinct functions. Attackers within the communication layer may block or destroy communication links, delay or prevent the transmission of operational data, and obstruct the issuance of control commands,  
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Year** & **Target of Attack** & **Attack Method** & **Result** & **Ref.** \\ \hline
2015 & Electricity Company of Ukraine & Blank Energy malware & A major power outage that lasted several hours & [7] \\ \hline
2020 & Light S.A. Electricity Company, Brazil & Sodinokibi ransomware & Extortion of USD 14 million. & [10] \\ \hline
2020 & EDP Energy, Portugal & Ragnar Locker & Extortion of USD 10.9 million & [11] \\ \hline
2021 & Colonial Pipeline, USA & - &
\begin{tabular}{c} All pipelines stopped and some services shut \\ down \\ \end{tabular} & [12] \\ \hline
2022 &
\begin{tabular}{c} High voltage \\ substations in Ukraine \\ \end{tabular} & Industroyer2 malware & Stopped before causing an actual accident & [13] \\ \hline
2023 & Acea, Italy & Black Basta ransomware & Web service crash & [14] \\ \hline \hline \end{tabular}
\end{table}
Table 1: Attacks against energy systems in the last decade.  
thereby accomplishing the desired attack objectives. In the control layer, attackers can implant malware to gain system privileges, modify operational data, and ultimately induce erroneous decisions within the system. In practice, attackers often coordinate both cyber and physical attacks when planning IECPS assaults, significantly enhancing the stealth and impact of the attack, thereby causing maximum damage to IECPS. Consequently, this section examines the attack patterns and modeling techniques of deliberate attacks on IECPS from three perspectives: cyberattacks, physical attacks, and CCPAs. By analyzing these attack patterns and models, this section can provide insights into formulating defense strategies against deliberate attacks.