## 3 Deliberate Attacks on IECPS
### Cyberattacks
#### 3.1.5 DoS Attacks  
DoS attack is a form of network-based assault that renders a service unavailable to legitimate users by overwhelming the target computer, network, or service with excessive resource demands [47]. Figure 7 illustrates a simple DoS attack based on the ping command, which causes a buffer overflow on the target host by sending packets exceeding the maximum allowed size, which in turn triggers the target host to crash or reboot. Based on this DoS attack, in [48], researchers focused on analyzing its impact on the load frequency control system and constructed a DoS attack model that blocks the transmission of packets to the data center. In [49], the possibility of launching DoS attacks on multiple AC regions within a multi-terminal high voltage direct current system is investigated, and a DoS attack scheme for frequency restoration and power allocation is proposed. In [50], the authors expanded their perspective to integrated energy systems, qualitatively analyzing the impact of DoS attacks on the economic scheduling of integrated energy systems, and proposed a DoS attack scheme comprising an optimal attack sequence and attack nodes. Furthermore, to enhance the economic damage capability of the attack, an FDIA is also launched on the measurement equipment and communication links. In [51], the authors provide a comprehensive introduction to various attack methods, including DoS attacks, and modeling approaches targeting load frequency control systems.  
Distribution denial of service (DDoS) attack is a more stealthy attack compared to DoS attack. The attacker obtains the control of the hosts distributed in different locations, and then collaborates to control these hosts to send a large number of requests to the server. This leads to traffic congestion, causing the server to lose the ability to interact with the normal equipment. In [52], it is illustrated how vulnerabilities in wide-area measurement systems can be exploited to launch DDoS attacks against distributed generators. In [53; 54], the authors hindered the energy transfer between the grid and electric vehicles (EVs) by launching a DDoS attack on an EV charging pile. In [55], a non-zero-sum game-theoretic model considering DDoS attacks is designed to study the resource allocation between attackers and defenders. In [56], while investigating cyberattacks in the electric vehicle sector, the authors specifically highlight the impact of DDoS attacks on electric vehicles.  
Currently, most research focuses on simulating the behavior of DoS attacks rather than directly establishing mathematical models for them. If DoS attacks are treated as data traffic, for example, assuming that the attack traffic exhibits bursty traffic, this traffic can be regarded as an impulse function:  
\[R(t)=\left\{\begin{array}{ll}s&\text{if }t\in[t_{0},t_{0}+\mu]\\ 0&\text{otherwise}\end{array}\right., \tag{20}\]  
where \(R(t)\) is the number of requests of DoS attack traffic at the time; \(s\) is the attack strength; \(t_{0}\) and \(\mu\) are the attack start time and duration, respectively.  
Figure 7: Diagram of Ping of Death attack.  
If the attack is described as a loss of packets, the attack can be represented using state equations for discrete systems [47]:  
\[x_{k+1}=Ax_{k}+Bu_{k}+\omega_{k} \tag{21}\]  
\[M_{k}=\{\lambda_{1}x_{1},\lambda_{2}x_{2},\ldots,\lambda_{k}x_{k}\}, \tag{22}\]  
where \(x_{k}\) is the \(k\) momentary state quantity; \(u_{k}\) is the \(k\) momentary control signal; \(\omega_{k}\) is the error term; \(M_{k}\) is the monitoring dataset; and \(\lambda_{k}\) indicates whether the monitoring system collects system measurements or not, and if the value is 0, it means that the DoS attack has caused packet loss.