The overall framework of the IECPS is shown in Figure 1, which is composed of electricity, heat, and gas energy. From the functional level, it can be divided into the energy layer, transmission layer, and information layer.

The transmission layer in the IECPS is mainly composed of a communication network responsible for the production control and information management of electric, heat, and gas energy. The communication network includes communication substations and communication links. For power communication network modeling, Xin et al. (2015) and Li et al. (2020) abstracted the multi-dimensional and multi-level information network as a directed graph composed of data nodes and network branches. The data node represents the dataset of input and output information of various modules in the power system, while the directed branch represents the processing and transmission process of information. According to the theory, it abstracts the communication network in the IECPS into a directed graph G composed of nodes and branches: G = v c ∪ v s ∪ v e ∪ v h ∪ v g , e c ∪ e s ∪ e e ∪ e h ∪ e g .

In order to describe the topological relationship between communication substations and communication links in the IECPS communication network, the adjacency matrix of the communication network is defined as A _G . A _G is a M _c + M _s + M _e + M _h + M _g order matrix. Its rows and columns are arranged in the order of c, s, e, h, and g. The corresponding element is represented as A G , i j = 0 i , j ∉ e k 1 i , j ∈ e k (1) where the corresponding element is 1, which means that there is a communication link between the two substation nodes; otherwise, it means that there is no communication link between the two station nodes.

The adjacency matrix A _G reflects the topology of the communication link in the IECPS communication network. When the information layer processes a certain service, the information flow flows along a certain path in the communication link, which constitutes the routing method of the information flow. As shown in Figure 2, only the flow of information flow at the communication network level is considered, and the control center and router are mapped on the same plane for analysis. Since a certain service may have multiple information flows, such as the load control service that simultaneously reduces the load of multiple nodes, and the routing methods are diverse, in order to clearly represent the multiple routing methods of a certain service information flow and consider the primary and backup routing methods of the information flow, the primary and backup routes of the service information flow are defined as matrices X _kq and Y _kq , whose structure is similar to the adjacency matrix A _G , and the corresponding elements are expressed as X k q , i j = 0 q d o e s n o t f l o w t h r o u g h i − j 1 q f l o w t h r o u g h i − j (2) Y k q , i j = 0 q d o e s n o t f l o w t h r o u g h i − j 1 q f l o w t h r o u g h i − j (3)

where k (=1, 2, 3 ⋅⋅⋅ N) represents different information layer services and N is the total number of services. q (=1, 2, 3 ⋅⋅⋅ D) indicates the different information flows of service k. D is the total number of information flows of service k. X _kq,ij is an element of the main routing matrix. If the information flow q of service k does not pass through links i–j, then the corresponding element of this matrix is 0; conversely, the element is 1.

The state of information flow is closely related to the safety and economy of IECPS operation. However, different information flows have different influences on the safety and economy of IECPS operation, which involves three different importance factors: 1) the importance of different business information flows; 2) the importance of different information flows in the same business; and 3) the importance of different routing methods. There is a one-to-many relationship between the information flow and routing mode. When the information layer optimization decision function is fixed and the communication link is normal and free from damage and interference, the importance of certain information flow is also fixed. However, the same information flow corresponds to many different routing modes, and the way to assign information flows to more important and reliable links or choose a reliable routing method for information flows is the key issue of IECPS routing optimization, while determining the importance of information flows and routing methods is the pre-requisite for routing optimization. In order to evaluate the importance of information flow, the importance index of substation information flow q of service k is defined as I k q = ∑ s ∈ S δ s ω e L e s q + ω h L h s q + ω g L g s q k = l ∑ s ∈ S δ s C e s q − C e s q ′ + C h s q − C h s q ′ + C g s q − C g s q ′ + C s s q − C s s q ′ k = d . (4)

It should be noted that since the substations, except the substations of the energy station, correspond to only one form of energy, the load reduction and nodal operating cost of the other energy forms involved in the calculation of I _kq in this case should be 0.

The importance index of information flow I _kq quantitatively indicates the importance of information flow q of service k in terms of the loss of IECPS operational safety and economy caused by physical side failures. For the load control service, the load reduction of energy network nodes corresponding to different substation information flows under different failure scenarios is different, and the sum of the load reduction penalty costs of energy network nodes corresponding to information flows q in each fault scenario is taken as the importance index of substation information flows q. For economic dispatch business, the operating cost of energy network nodes corresponding to different substation information flows in different fault scenarios is different from that of nodes under load control business. The sum of the absolute difference values of the operating costs of energy network nodes corresponding to information flow q in each fault scenario under two businesses is taken as the importance index of information flow q.

The route of information flow is composed of communication links in the communication network, and different service information flows can flow through the same communication link. In Eq.5, on the basis of the evaluation index of the information flow importance defined above, considering the joint action of the load control business and economic dispatch business, the communication link correlation business degree matrix E is defined, and the mathematical expression is expressed as E = α α + β ∑ s ∈ S δ s ∑ q = 1 N l q I l q X l q + Y l q + X l q + Y l q T + β α + β ∑ s ∈ S δ s ∑ q = 1 N d q I d q X d q + Y d q + X d q + Y d q T . (5)

In Eq. 5, α and β are the importance of load control service and economic dispatch service, respectively. Table 1 shows the “DDD” communication network planning report of the State Grid Corporation of China, which shows that α and β can be 0.94 and 0.62, respectively.

The following assumptions are made for the worst-case DoS attack scenario: the attacker will try to make the attack traffic exceed the total bandwidth, causing a service outage; the attack point location is the node with the most information flow through the shortest routing method; and the duration of the attack is limited by a linear function of time. For any t ≥ t ₀ ≥ 0, there exist τ ₀ and 1 > ζ > 0 satisfying Ξ t 0 , t ≤ τ 0 + ζ t − t 0 . (6)

The substation will lose its communication ability, and the link directly connected to the substation will fail to complete the data transmission task after being attacked by DoS. The link fault matrix under the set of DoS attack fault Φ can be defined as F _Dos,k ; when any substation k is attacked by DoS, F _Dos,k can be expressed as F Dos,k = A G ⊙ A k 0 , k ∈ Φ ∈ v k . (7)

The operation state of the communication link is reflected by the link fault matrix F _Dos,k ; if substation k is attacked by DoS, the element of F _Dos,k related to the link associated with substation k is 1, indicating that the link has lost its communication ability.

When the active and standby routes of the traffic information flow do not work due to the loss of the communication ability of the link caused by DoS attacks, the traffic flow is interrupted. In order to judge whether two types of service flows are interrupted, r _lq and r _dq are defined as the interruption discriminant variables of information flow q of load control service and economic dispatching service, respectively: r l q = ∑ i , j ∈ e k X l q ⊙ F Dos,k i , j ⋅ ∑ i , j ∈ e k Y l q ⊙ F Dos,k i , j k ∈ Φ ∈ v k , (8) r d q = ∑ i , j ∈ e k X d q ⊙ F Dos,k i , j ⋅ ∑ i , j ∈ e k Y d q ⊙ F Dos,k i , j k ∈ Φ ∈ v k . (9)

According to Eqs 8, 9, r _lq and r _dq are 0–1 discriminant variables. When the value of r _l or r _d is 0, it indicates that the service information flow is not interrupted. Otherwise, it indicates that the service information flow is interrupted. The impact of the DoS attack on communication substation k on the two types of service information flows may be different, and there are several possibilities, i.e., r l q ⋅ r d q = 0 r l q = 1 & r d q = 0 , Load control service  information flow is interrupted r l q = 0 & r d q = 1 ,  Economic dispatching  service information flow is interrupted r l q = 0 & r d q = 0 ,  Two service information  flows are not interrupted 1 ,   Two service information      flows are interrupted . (10)

In addition, DoS attacks on communication substation k will cause a communication interruption of multiple links, which may cause the interruption of multiple service information flows. So, the worst DoS attack scenario will occur under the interruption of multiple information flows, and the worst scenario under the fault set Φ of DoS attacks on a certain area of the communication network is max Φ ∑ q = 1 N l q r l q I l q + ∑ q = 1 N d q r d q I d q . (11)

It is worth noting that the attack frequency and attack duration are major influencing factors that reflect the DoS attacks.

The routing robust optimization problem of the IECPS communication network in the worst scenario of DoS attacks to improve the resilience of the IECPS in extreme scenarios is considered in this paper. The routing robust optimization problem aims to optimize the information flow routing mode of load control services and economic dispatching services so as to minimize the degree of associated services in high-risk areas of DoS attacks. The objective function is shown as follows: min x l q , i j , y l q , i j x d q , i j , y d q , i j δ ∑ q = 1 N l q I l q ∑ i , j ∈ e k x l q , i j + χ y l q , i j + δ ∑ q = 1 N d q I d q ∑ i , j ∈ e k x d q , i j + χ y d q , i j + max Φ ∑ q = 1 N l q r l q I l q + ∑ q = 1 N d q r d q I d q . (12)

The decision variables of the objective function are x _lq,ij , y _lq,ij , x _dq,ij , and y _dq,ij that determine the information flow q of the load control service and economic dispatch service. In addition, the number of information flows of load control service is different from that of economic dispatch service. Economic dispatch service only dispatches electric, heat, and gas source nodes, while load control service controls not only each load node but also electric, heat, gas, and energy station nodes. Therefore, the number of information flows of load control service is greater than that of economic dispatch service, and its corresponding decision variables are more. In Eq. (12), δ and χ are both minuteness used to set the priority of the optimization objective. The smaller δ makes the optimized routing method first meet the communication network resilience under the worst attack scenario and then reduces the associated traffic degree of the routing method. The smaller χ makes the optimized primary route meet the above objectives more preferentially than the standby route.

In order to ensure the rationality and effectiveness of the optimized active and standby routing methods, the above robust routing optimization problem should meet the following constraints.

As CNRRO is an NP-hard problem, the computational complexity increases with the increase in the number of communication network nodes. To reduce the computational complexity, the column and constraint generation (CCG) algorithm is used to solve the above model, and its principle is as follows: for convenience, the above model is expressed in standard form: min z ∈ C a z + max u ∈ Φ max g ∈ Q z , u b g , (25) s . t C = z ∈ Z m : G z ≥ c , (26) Φ = u ∈ R n × Z n ′ : H u ≤ d , (27) Q z , u = g ∈ R p : E g ≥ f − R u − D z . (28)

Eq. 26 corresponds to the communication network topology constraint (Eq. 13–14), Eq. 27 represents the uncertain fault set of the communication substation, and Eq. 28 represents the functional relationship among the internal decision variables and the external decision variables, as well as the uncertain variables, corresponding to the Eqs 20–22.

In order to solve the problem hierarchically and iteratively, the standard form of the routing robust optimization model is transformed into a main problem and a subproblem, as shown below.

Main problem: min z , ρ a z + ρ s . t G z ≥ c ρ ≥ b g l ∀ 1 ≤ l ≤ k E g l ≥ f − R u l * − D z ∀ 1 ≤ l ≤ k H u l * ≤ d ∀ 1 ≤ l ≤ k z ∈ Z , ρ ∈ R , g l ∈ R ∀ 1 ≤ l ≤ k u l * ∈ R × Z ∀ 1 ≤ l ≤ k (29)

Subproblem: ϑ z * = max u ∈ Φ max g b g s . t E g ≥ f − R u − D z * H u ≤ d g ∈ R , u ∈ R × Z (30)

The decision variable z* can minimize the degree of traffic associated with the communication link in the area subject to DoS attacks by solving the main problem and pass the optimal solution to the subproblem; then, the worst scenario u l * in the area subject to attacks can be obtained by solving the subproblem. The scenario is passed to the main problem and iterated repeatedly, so that the final obtained main and standby routing methods are robust, and the resilience to extreme scenarios is improved. The specific steps are as follows.

Algorithm 1

CCG algorithm flow.

In this case, the IECPS consists of an energy network and communication network. The energy network is combined with an IEEE 30-bus power network, 14-bus heat network, and 20-bus gas network. The communication network contains 68 communication network nodes, i.e., 30 power grid communication substations, 20 gas network communication substations, 14 heat network communication substations, 4 energy station communication substations, and 1 control center main station. The specific parameters of the example system are detailed by Shabanpour-Haghighi and Seifi (2015), and its topological structure is shown in Figure 4. The parameters of the example are set as follows: the rated bandwidth of each fiber link is 200 Mbit/s, and the rated optical path is 20 m. The outage probability of the transmission line in the physical side fault concentration is 2%, and the outage probability of the heating pipeline and the gas supply pipeline is 1%. In CNRRO, the minuscule quantities δ and χ used to distinguish priorities are both 10^–4, and the convergence threshold σ of the CCG algorithm is also 10^–4.

In order to verify the effectiveness of the IECPS routing robust optimization method proposed in this paper, the power grid part of the communication network, the heat network part of the communication network, and a certain area of the gas network part are taken as the target area of the DoS attack. All the communication substations in this area are exposed to the risk of the DoS attack. In this case, the communication link directly connected to the substation will temporarily lose its communication function. In addition, to reflect the optimization result more intuitively, assume that the link that is not directly connected to the substation in the attack area but passes through the attack area also exits the operation. In the scenario where the three areas are high-risk areas to be attacked, CNRRO is solved to optimize the routing mode of the IECPS economic dispatching service and load control service. For the convenience of comparison and optimization results, as shown in Figure 5, the former IECPS is optimized according to the shortest path to obtain the various substation economic dispatches of business information flow and information flow routing load control mode (due to the load control in the business and the corresponding electric source, heat source, and air source node flow routing with the economic operation business in the same way, it is no longer the picture). The attack areas listed in Table 2 are shown in the gray-shaded area in Figure 5. It can be seen that routing with the shortest path as the goal will cause a large number of service information flows to route through the high-risk areas and cannot avoid the risk of service interruption of the subsites and links caused by a random DoS attack.

1) Analysis of optimization results in scenario 1: The main route optimization results of the IECPS economic dispatching service and load control service under the DoS attack in the grid communication area are shown in Figure 5. According to the figure, the information flow of the two services of the optimized communication substation E8 reaches E8 through E2 and E6, thus bypassing high-risk area ϕ _e . The load control service information flow of substations E30, E29, E26, E24, E23, E20, E19, E18, E15, and E14 in the north of the communication network detours northward through the link on the east of the communication network (E8, E28) so as to avoid passing through the substations and links that may be attacked. It is worth noting that the load control service information of the two substations E17 and E16 after optimization is delivered by the link (EH3, E17) through the corresponding communication network of the heat network and gas network, because there is no safe path on the grid side to bypass to the target substation. Since area ϕ _e contains the communication substation node EH4 of the energy station, the communication link (EH4, G10) is at high risk, which threatens the smooth instruction of the control center to the economic dispatching command of the gas network substation G8. However, the economic dispatching service information flow of the optimized gas network substation G8 departs to the west and transfers the information flow to the link (E1, G12). The link (EH4, G10) was successfully avoided. However, the figure shows that after optimization, the service information flow of the communication substations E12, E11, E10, and E21 still passes through the high-risk area, because all feasible paths pass through the high-risk area. What is different from the previous optimization is that the load control service flow of the optimized E12, E10, and E21 is delivered from the north of the high-risk area. Fewer high-risk links pass through. This is because fewer high-risk links are involved in a routing mode, and the associated services of high-risk areas are lower.

2) Optimization result analysis of scenario 2: The main route optimization results of the IECPS economic dispatching service and load control service under the DoS attack in the heat network communication area are shown in Figure 5. The figure shows that the information flow of load control service and economic dispatching service of EH2 and EH3 no longer passes through the link (H13, H11) after optimization. Instead, it is delivered by E3, G18, G19, H12, and H11, thus avoiding the possibility that the information flow is threatened by the DoS attack. The economic dispatching service information from the control center to G8 via the communication substation EH4 of the energy station passes through E3, G18, G17, and G11 after optimization and is delivered after a detour, effectively avoiding the link (H13, EH4) in area ϕ _h . After optimization, the load control service flow of H7 is delivered from the northwest side, reducing the number of links flowing through high-risk areas. Compared with scenario 2, since grid area ϕ _e is no longer a high-risk area, the links in this area recover to assume service information flow after optimization. It can be seen that the optimization results of this routing robust optimization model can adaptively adjust the routing scheme according to the set high-risk area.

3) Analysis of optimization results of scenario 3: The main route optimization results of the IECPS economic dispatch service and load control service under the DoS attack in the air network communication area are shown in Figure 5. The figure shows that the information flow of economic dispatch service reaching G1, G2, and G14 after optimization no longer passes through high-risk links (G13, G14), (G12, G13), and (E1, G12). However, because G13 and G5 are located in high-risk areas, the optimized routing method of load control service information flow of their substations cannot avoid such high-risk areas and can only reduce the number of links passing through high-risk areas in the route. For energy station EH2, the information flow originally delivered by (H9, EH2) becomes roundabout and then delivered by (G1, EH2) after optimization, while the routing method of information flow of two services of energy station EH3 does not change before and after optimization. This is because EH3 is not only in a high-risk area but also the routing method before optimization has only one link path in the high-risk area, so there is no room for further optimization.

In addition, except by way of the main road, routing provides a robust optimization model to optimize the backup routing, as shown in Figures 6–8 (only substation alternate routes affected by high-risk areas are listed). It can be seen that due to the load for the routing optimization model of the effect that cannot overlap and communication network topology constraints, resulting in a large number of the routing information flow through more links and greater distances to reach the target substation or inevitably through the high-risk areas. Therefore, the optimization results are difficult to meet the requirements of reducing the degree of service association in high-risk areas and will not be described here.

In conclusion, after analyzing the optimization results of the above three scenarios, the CNRRO model established in this paper can effectively adaptively avoid high-risk areas according to their locations and provide more secure routing modes for both service information flows, thereby avoiding or reducing the risk of DoS attacks.

The routing optimization results mentioned in the above section should meet the toughness of the communication network in the worst scenario. The worst scenario before optimization determined according to Eq. 10 is shown in black in Figure 5, and the worst scenario after optimization is shown in black in Figures 9–11. The analysis of the worst scenario corresponding to the three high-risk areas is shown in Table 3.

The above table shows that, according to CNRRO, the number of unreachable service information flows, affected load, and associated service degree in the worst scenario of region ϕ _e and region ϕ _h after optimization are significantly reduced compared with those under the shortest path before optimization. However, the affected load in the worst scenario of region C before and after optimization is all 0. This is because the worst-case scenario does not affect the information flow of load control services but only that of economic scheduling services.

Specifically, according to the definition of association service degree in Eq. 5, the routing method optimized by CNRRO will change the association service degree of communication network links. According to the optimization objective, the associated service degree of the communication link in the high-risk area should be reduced after optimization compared with that before optimization so as to ensure that the service volume of the high-risk area is reduced. According to the route optimization results, the association service degree of the affected links in the above three high-risk areas of the IECPS communication network is calculated, and the comparison with the association service degree of the links in high-risk areas under the shortest path before optimization is shown in Figure 12. For the actual communication links corresponding to link numbers, see Table 4.

In Figure 12, by analysis, (a) shows that the correlation business degree of substations 1 and 2 is much higher than that of other substations in the region, which will lead to a large amount of load being affected if substation 1 is attacked. After the optimization, the correlation degree of substations 1 and 2 is significantly reduced. Substation 5 in (b) has a very high business correlation, indicating that the risk of the substation is very high. The optimization significantly reduces the risk of this substation being attacked. This is because according to CNRRO obtained by way of the main road to avoid the influence of DoS attack to bypass the high-risk areas, business information flow distribution occurs to the rest of the security link. The number of service information flows passing through high-risk areas is reduced, and the association degree of links in high-risk areas is reduced, which corresponds to the optimization goal of CNRRO. Alternate routing the suboptimal solution of the corresponding optimization, although the high-risk areas under alternate routing associated business degrees below before optimization-related business, but as a result of, the numerical example of communication network architecture itself leads to alternate routing cannot bypass the high-risk areas, lead to high-risk areas part link associated business degree is higher than the shortest path under the link associated business degrees. In summary, the route optimization method proposed in this paper can reduce the degree of service association in high-risk areas and improve the toughness of the IECPS communication network under the background of service information flow disturbance caused by DoS attacks.

The simulation results compare the routing optimization results of only load control services, only economic dispatch services, and both services. The associated service degree of the high-risk area (the sum of the associated service degree of all links in the high-risk area) in the three cases is shown in Table 5.

Different importance indexes will directly affect the route optimization results, and the regional association service degree will be different under different optimization results. According to the analysis given in the above table, the associated business degree of high-risk area ϕ _e of the power grid and high-risk area ϕ _h of the heat network under the routing robust optimization based on the importance index of dual-service information flow is significantly lower than that of the high-risk area under the routing robust optimization based on the importance index of single-service information flow. Moreover, since the number of load control information flows undertaken by the two regions is more than the number of economic dispatch service information flows, the regional association service degree considering only load control service indicators is lower than that considering economic dispatch service indicators. However, for gas network high-risk area ϕ _g and areas under load control operations only, the associated business degree is significantly lower than that in the other two cases; this is because in the gas network information flow, only four-load control and load control-only businesses would lead to a large number of communication links, and the importance index is zero, which cannot effectively evaluate the importance of the communication links. In general, the routing robust optimization method considering both security and economy is better than the routing optimization method considering only the single-service index.