A topology attack, as a special class of false data injection attacks, tampers with topology information of a system to mislead the decision of the control center. This article conducts an in-depth study on topology attacks that aim to interfere with the judgment in topology information and pose potential damage by tampering with measurement data and protection information on branches, namely, protection-branch measurements-based topology attacks (PBT attacks). To achieve PBT attacks in actual networks, we study the protection settings and mechanisms in term of branches including transformers and transmission lines. Then, for the first time, we develop a bilevel model based on the protection configuration from the perspective of security-constrained economic dispatch. Meanwhile, since a bilevel model is constructed against dc state estimation, a conversion method in constructing attack vectors under PBT attacks against ac power system is proposed, which makes PBT attacks more suitable for actual power systems and more concealed. In a set of case studies on an IEEE 14-bus system, the simulation results verify the effectiveness of the model we proposed, analyze the vulnerability of network under PBT attacks, and then identify some critical branches that are defended to cope with PBT attacks. In addition, the comparison between PBT attacks and traditional cyber-overloaded attacks also shows a stronger threat of the studied attacks.@en