The integrated energy system (IES) plays a key role in energy conservation and emission reduction. In order to realize the low-carbon economic dispatch of the IES, current studies usually utilize the fixed and the ladder-type pricing mechanism-based carbon emission unit cost (CEUC) in the optimal dispatch model. However, those mechanisms fail to take carbon emissions levels of the system into account, and the relevant parameters, such as the interval length, are hard to set. In order to tackle this challenge, a CEUC model with a dynamic reward and penalty pricing mechanism (DRPPM) is constructed. And then an optimal dispatch model to minimize the comprehensive operation cost, including the carbon emission cost, the energy purchasing cost, and the equipment operation cost, is proposed. At last, an actual electricity–heat–cooling–gas IES is employed to analyze the impact of parameters of the CEUC model on the dispatch.

Cyber‐attack has become one of the main threats to the safe operation of the load control system in the distribution network. Currently, a large number of methods are developed to detect cyber‐attacks. However, most of these methods make decisions based on information from a single cyber layer or physical layer. If the decision is wrong, there is no way to verify it. Therefore, if the separate decisions can be made in the cyber layer and physical layer at the same time, and a final judgment is received throughout the two decisions, then the accuracy and credibility of cyber‐attack detection can be improved. First, the particle swarm optimization‐based backpropagation neural network is adopted to detect attacks in the cyber layer, at the same time, the criteria importance though intercrieria correlation‐based grey relational analysis is adopted for the assessment of node risk level in the physical layer. Then, based on the incidence matrix model between the cyber layer and the physical layer, a crosscheck mechanism is proposed to detect the cyber‐attack through the verification of the two decisions. Finally, taking the IEEE 33‐node system as an example, the validity of the proposed method to detect the denial of service attack is verified.