Method and device for detecting false data injection attack

Abstract

The application discloses a kind of false data injection attack detection method and device. Among them, the method includes: obtaining power grid measurement data, wherein the power grid measurement data includes multiple types of power data;The power grid measurement data is analyzed by integrated classification detection model, and the output vector value is obtained, wherein the integrated classification detection model is obtained by machine learning training from multiple groups of data, each group of data in the multiple groups of data includes historical power grid measurement data and the label whether historical power grid measurement data is false data injection attack data;Whether the power grid measurement data is attacked is determined according to the size of output vector value, and the attacked data is processed.The application solves the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the contaminated power grid state quantity.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a false data injection attack detection method and device, a computer readable storage medium and an electronic device. BACKGROUND

[0002] With the rapid development of new power systems, the power system is changing from fossil energy dominance to clean energy dominance. The large-scale access of new energy makes the regulation capacity of the power system decrease and the control difficulty increase. Virtual power plants optimize the regulation and control of distributed flexible resources through communication information technology, coordinate and integrate them into a flexible whole, and then achieve the goals of automatic distribution, optimized power generation, demand response and centralized control. However, virtual power plants interact highly with external network environments, and potential network attack risks seriously threaten the safe and stable operation of the power system.

[0003] False data injection attack is a network attack method against power system state estimation. By tampering with the power grid measurement data collected by the Supervisory Control and Data Acquisition (SCADA) and Phasor Measurement Unit (PMU), the state quantity calculated by the state estimation program is polluted, so that the dispatch center cannot obtain reliable power grid state information, ultimately interfering with the safe and stable operation of the power system, and causing huge economic losses. Therefore, actively detecting false data injection attacks is an important means to improve the network security defense capability of the power system.

[0004] The classifier used in the traditional false data injection attack detection method based on machine learning has insufficient fitting ability for complex power measurement data, and can only identify whether a false data injection attack exists, but cannot accurately identify the power grid state quantity polluted by false data.

[0005] To solve the above problems, no effective solutions have been proposed so far. SUMMARY

[0006] The embodiments of the present application provide a false data injection attack detection method, device, computer readable storage medium and electronic device to at least solve the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the polluted power grid state quantity.

[0007] According to an aspect of the embodiments of the present application, a method for detecting a false data injection attack is provided, including: obtaining power grid measurement data, wherein the power grid measurement data includes multiple types of power data; analyzing the power grid measurement data by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training of multiple sets of data, each set of data including historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; determining whether the power grid measurement data is attacked according to the size of the output vector value, and processing the attacked data.

[0008] Optionally, before analyzing the power grid measurement data by the integrated classification detection model, the method for detecting a false data injection attack further includes: establishing a data matrix of the power grid measurement data as wherein Z represents the data matrix, d represents the number of the power grid measurement data, and m represents the dimension of the power grid measurement data; dividing the data matrix into multiple sub-matrices by cross division, dividing the multiple sub-matrices into a training set and a test set; obtaining an initial integrated classification detection model, training the initial integrated classification detection model by the training set, testing the trained initial integrated classification detection model by the test set, and obtaining the integrated classification detection model in the case of passing the test.

[0009] Optionally, determining whether the power grid measurement data is attacked according to the size of the output vector value includes: converting the output vector value by a multi-label encoding mode to obtain a binary code of each output vector value; determining that the power grid measurement data is attacked when the binary code is 1; and determining that the power grid measurement data is not attacked when the binary code is 0.

[0010] Optionally, converting the output vector value by the multi-label encoding mode includes: converting the output vector value by the multi-label encoding mode through a formula wherein b i is the i-th output vector,

[0011] is the binary code corresponding to the i-th output vector after conversion by the multi-label encoding mode.

[0012] Optionally, converting the output vector value by the multi-label encoding mode further includes: converting the voltage amplitude and the voltage phase of nodes other than balanced nodes by the multi-label encoding mode.

[0013] Optionally, the power grid measurement data is obtained, including: obtaining first power grid measurement data of a supervisory control and data acquisition system, wherein the first power grid measurement data at least includes node active power injection, node reactive power injection, branch active power flow data and branch reactive power flow data; and obtaining second power grid measurement data of a synchrophasor measurement unit, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0014] Optionally, the integrated classification detection model includes multiple base classifiers.

[0015] According to another aspect of the embodiment of the present application, a false data injection attack detection device is also provided, including: an obtaining unit configured to obtain power grid measurement data, wherein the power grid measurement data includes multiple types of power data; an analyzing unit configured to analyze the power grid measurement data by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training of multiple sets of data, each set of data including historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; and a determining unit configured to determine whether the power grid measurement data is attacked according to a size of the output vector value and process the attacked data.

[0016] Optionally, the false data injection attack detection device further includes: an establishing unit configured to establish a data matrix of the power grid measurement data as Z = (z1, z2, …, zd)T before analyzing the power grid measurement data by the integrated classification detection model, wherein Z represents the data matrix, d represents a number of the power grid measurement data, and m represents a dimension of the power grid measurement data. The data matrix is divided into multiple sub-matrices by cross division, and the multiple sub-matrices are divided into a training set and a test set; a processing unit configured to obtain an initial integrated classification detection model, train the initial integrated classification detection model by the training set, test the trained initial integrated classification detection model by the test set, and obtain the integrated classification detection model in a case where the test is passed.

[0017] Optionally, the determining unit includes: a first conversion sub-unit configured to convert each output vector value by a multi-label encoding mode to obtain a binary code of each output vector value; a first determining sub-unit configured to determine that the power grid measurement data is attacked in a case where the binary code is 1; and a second determining sub-unit configured to determine that the power grid measurement data is not attacked in a case where the binary code is 0.

[0018] Optionally, the first conversion sub-unit includes: a second conversion sub-unit configured to convert each output vector value by a multi-label encoding mode through a formula y = log (1 + e x). performing label conversion, wherein b i is the i-th output vector, is the binary code corresponding to the i-th output vector converted by using the multi-label encoding mode.

[0019] Optionally, the first conversion subunit further comprises a third conversion subunit configured to perform label conversion on the voltage amplitude and the voltage phase of the nodes other than the balanced nodes by using the multi-label encoding mode.

[0020] Optionally, the acquisition unit comprises a first acquisition subunit configured to acquire first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data at least comprises node active power injection, node reactive power injection, branch active power flow data and branch reactive power flow data; and a second acquisition subunit configured to acquire second power grid measurement data of a synchronous phasor measurement unit, wherein the second power grid measurement data at least comprises node voltage phasor data and branch current phasor data.

[0021] Optionally, the integrated classification detection model comprises a plurality of base classifiers.

[0022] According to another aspect of the embodiments of the present application, a computer readable storage medium is also provided, which includes a stored program, wherein the program, when executed, controls a device where the computer readable storage medium is located to perform any of the above-mentioned false data injection attack detection methods.

[0023] According to another aspect of the embodiments of the present application, an electronic device is also provided, which comprises one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs comprise a program for performing any of the above-mentioned false data injection attack detection methods.

[0024] In the embodiment of the present application, power grid measurement data is acquired, wherein the power grid measurement data includes multiple types of power data; the power grid measurement data is analyzed by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training of multiple groups of data, each group of data in the multiple groups of data including historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; whether the power grid measurement data is attacked is determined according to the size of the output vector value, and the attacked data is processed. Through the technical scheme provided by the present application, the mixed power grid measurement data is processed by using the cross division method, the integrated classification detection model is constructed, and the output vector of the integrated classification detection model is converted by multi-label coding, so that the technical effect of effectively identifying the power grid state quantity polluted by the false data injection attack is realized, the fitting ability and accuracy of the model are improved, and the technical problems that the false data injection attack detection method for the power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the polluted power grid state quantity are solved. BRIEF DESCRIPTION OF DRAWINGS

[0025] The accompanying drawings, which are included to provide a further understanding of the application and are incorporated in and constitute a part of this application, illustrate embodiments of the present application and serve to explain the present application, and do not constitute improper limitations on the present application. In the drawings:

[0026] Figure 1 is a hardware structure block diagram of a mobile terminal of a false data injection attack detection method according to an embodiment of the present application;

[0027] Figure 2 is a flowchart of a false data injection attack detection method according to an embodiment of the present application;

[0028] Figure 3 is a flowchart of an optional false data injection attack detection method according to an embodiment of the present application;

[0029] Figure 4 is a flowchart of another optional false data injection attack detection method according to an embodiment of the present application;

[0030] Figure 5 is a schematic diagram of an integrated classification detection model construction flow according to an embodiment of the present application;

[0031] Figure 6 is a schematic diagram of a false data injection attack detection device according to an embodiment of the present application. DETAILED DESCRIPTION

[0032] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0034] As described in the background section, existing methods for detecting spoofing data injection attacks in power system state estimation suffer from insufficient fitting ability and cannot accurately identify contaminated power grid state variables. To address these shortcomings, embodiments of the present invention provide a method, apparatus, computer-readable storage medium, and electronic device for detecting spoofing data injection attacks.

[0035] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0036] The methods and embodiments provided in this invention can be executed on a mobile terminal, a computer terminal, or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 This is a hardware structure block diagram of a mobile terminal for a method of detecting fake data injection attacks according to an embodiment of the present invention. Figure 1 As shown, a mobile terminal may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. The mobile terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the mobile terminal described above. For example, the mobile terminal may also include components that are more...Figure 1 The more or fewer components shown, or having the same Figure 1 The different configurations shown.

[0037] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the method for detecting fake data injection attacks in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer programs stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. The transmission device 106 is used to receive or send data via a network. Specific examples of the aforementioned networks may include wireless networks provided by the mobile terminal's communication provider. In one instance, the transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] According to an embodiment of the present invention, a method embodiment for detecting fake data injection attacks is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0039] Figure 2 This is a flowchart of a method for detecting fake data injection attacks according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0040] Step S202: Obtain power grid measurement data, which includes various types of power data.

[0041] In this embodiment, power grid measurement data can be acquired. By collecting various types of power data from the power grid, the operating status of the power grid can be comprehensively monitored, and any anomalies that may exist in the power grid can be detected in a timely manner.

[0042] Figure 3is a flowchart of an optional false data injection attack detection method according to an embodiment of the present application, as shown Figure 3 The power grid measurement data can include SCADA (Supervisory Control and Data Acquisition) measurement data and PMU (Phasor Measurement Unit) measurement data.

[0043] In step S204, the power grid measurement data is analyzed by the integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is trained by machine learning from a plurality of sets of data, each set of data including historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data.

[0044] In this embodiment, by analyzing the power grid measurement data and obtaining the output vector value, the integrated classification detection model can detect whether a false data injection attack has occurred and take appropriate measures in a timely manner to protect the safety and stability of the power grid system.

[0045] In step S206, it is determined whether the power grid measurement data has been attacked according to the size of the output vector value, and the attacked data is processed.

[0046] In this embodiment, determining whether the power grid measurement data has been attacked according to the size of the output vector value can help the system to discover possible attack behaviors in a timely manner, and by analyzing and comparing the size of the output vector value, the attacked data can be effectively identified and appropriate measures can be taken in a timely manner.

[0047] As described above, in the embodiment of the present application, power grid measurement data is obtained, wherein the power grid measurement data includes a plurality of types of power data; the power grid measurement data is analyzed by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is trained by machine learning from a plurality of sets of data, each set of data including historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; and it is determined whether the power grid measurement data has been attacked according to the size of the output vector value, and the attacked data is processed, thereby achieving the purpose of processing mixed power grid measurement data using a cross-division method, constructing an integrated classification detection model, and converting the output vector of the model through multi-label encoding, thereby achieving the technical effect of effectively identifying power grid state quantities contaminated by false data injection attacks, and improving the fitting ability and accuracy of the model.

[0048] The technical scheme provided by the embodiment of the present application solves the technical problem of the existing false data injection attack detection method for power system state estimation, which has insufficient fitting capacity and cannot accurately identify the contaminated power grid state quantity.

[0049] According to the above embodiment of the present application, before the power grid measurement data is analyzed by the integrated classification detection model, the false data injection attack detection method further comprises: establishing a data matrix of the power grid measurement data as Wherein, Z represents the data matrix, d represents the number of power grid measurement data, and m represents the dimension of the power grid measurement data; the data matrix is divided into multiple sub-matrices by cross division, and the multiple sub-matrices are divided into a training set and a test set; an initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and in the case of passing the test, the integrated classification detection model is obtained.

[0050] In this embodiment, by constructing the power grid measurement data into a data matrix, a large amount of data can be processed more systematically, and through cross division, the diversity and representativeness of the training set and test set data can be ensured, the overfitting phenomenon can be avoided, and the generalization ability of the model can be improved. The robustness of the model can be verified by testing the trained model through the test set, and the integrated classification detection model can be continuously trained and updated according to new power grid data to adapt to changes in power grid state and new attack modes, and the timeliness and effectiveness of the detection system can be maintained.

[0051] Figure 4 is a flow chart of another optional false data injection attack detection method according to the embodiment of the present application, as shown in Figure 4 According to the measurement matrix composed of SCADA and PMU original measurement data, the measurement matrix is divided into 5 independent subsets by cross division, one of which is a test set and the rest is a training set, and an integrated classification detection model is constructed according to the training set and the test set.

[0052] Figure 5 is a schematic diagram of the integrated classification detection model construction process according to the embodiment of the present application, as shown in Figure 5As shown, the measurement matrix composed of SCADA and PMU measurement data is divided into five groups of training sets and test sets by cross method, the first set of the first group is the test set, and the remaining four are the training set; the second set of the second group is the test set, and the remaining four are the training set; the third set of the third group is the test set, and the remaining four are the training set; the fourth set of the fourth group is the test set, and the remaining four are the training set; the fifth set of the fifth group is the test set, and the remaining four are the training set. The integrated detection classifier includes nine heterogeneous base classifiers such as RandomForest, ExtraTrees, XGBoost, SVM, GaussianNB, LogisticRegression, MLP, CNN and Kneighbors, which are aggregated by base classifiers to form the final integrated classification detection model, and finally output a vector through the integrated detection model.

[0053] It should be noted that, in order to improve the fitting ability of the detection model to the complex power grid measurement data, the above integrated classification detection model includes nine heterogeneous base classifiers, wherein the RandomForest base classifier can select a random subset and use the optimal attribute for division to increase the difference between the base classifiers; the ExtraTrees base classifier uses random threshold for attribute division and does not depend on the selection of optimal subset attribute; each decision tree classifier in the XGBoost base classifier updates the residual information, and has high detection effect after multiple iterations; the SVM base classifier uses the principle of structural risk minimization, has certain robustness to noise and abnormal points in data, and reduces the detection error of the model; the GaussianNB base classifier classifies data by calculating conditional probability, has high processing efficiency for large-scale data; the LogisticRegression base classifier is based on a probability model, learns parameters by minimizing a loss function, is easy to calculate in parallel processing, and has fast fitting speed; the MLP base classifier has strong nonlinear fitting ability and can handle complex input-output relationships; the CNN base classifier automatically learns local features and global features in data through multi-layer convolution operation, thereby capturing hidden attack features in data, and has high attack feature extraction capability; the Kneighbors base classifier compares features in data to find the most similar classification label of the features in the data, and has the advantage of high precision.

[0054] Specifically, the above RandomForest model is as follows: Wherein, Y(x) is the output result of RandomForest, m i is the i-th decision tree, and n is the output variable of the i-th decision tree; the model of the above ExtraTrees is as follows: Wherein, L is the output result of ExtraTrees, y m = j represents the output result of the mth decision tree is j, and λ(·) represents the number of conditions satisfied; the model of the above XGBoost is as follows: Wherein, p is the output result of the model; Q is the number of decision trees, f q is a decision tree function, and F represents the decision space of all decision trees.

[0055] Optionally, the above MLP can include at least 5 hidden layers, and the number of neurons of each hidden layer is at least 50; the above CNN can include at least 2 convolutional layers, 2 pooling layers and 1 fully connected layer.

[0056] As shown in Figure 3 , the original measurement data is constructed into a training set and a test set through cross division, so as to construct an integrated classification detection model according to the training set and the test set.

[0057] According to the above embodiment of the application, whether the power grid measurement data is attacked is determined according to the size of the output vector value, comprising: label conversion is performed on the output vector value by using a multi-label encoding method to obtain binary encoding of each output vector value; when the binary encoding is 1, it is determined that the power grid measurement data is attacked; when the binary encoding is 0, it is determined that the power grid measurement data is not attacked.

[0058] In this embodiment, the multi-label encoding method is used for label conversion of the output vector value, so that multiple labels in the output vector value can be binary encoded, and then it is determined whether the power grid measurement data corresponding to each label is attacked, the binary encoding can accurately identify which specific power grid measurement data points are attacked, simplifies the decision process of judging whether the power grid data is attacked, so that the detection process can be executed faster, which is helpful for post-analysis and improvement of security strategy.

[0059] As shown in Figure 4 , the power grid real-time measurement data to be detected is obtained, the power grid real-time measurement data is input into the integrated classification detection model, an output vector of the detection model is obtained, then the output of the integrated classification detection model is converted by using multi-label encoding, wherein binary encoding of 1 indicates that the power grid state quantity is attacked, and binary encoding of 0 indicates that the power grid state quantity is not attacked.

[0060] As shown in Figure 3 , after the integrated classification detection model is constructed, the power grid real-time measurement data to be detected is obtained, the power grid real-time measurement data is input into the integrated classification detection model, and the output vector of the integrated classification detection model is converted by using multi-label encoding to obtain the detection result of the power grid state quantity polluted by false data in the power grid real-time measurement data.

[0061] In the above embodiment of the present application, the multi-label encoding method is used for label conversion of the output vector value, including: using the multi-label encoding method to perform label conversion through the formula , wherein b i is the i th output vector, is the binary code corresponding to the i th output vector converted by the multi-label encoding method.

[0062] In this embodiment, the multi-label encoding method is used to perform label conversion through the formula, which can help the model more accurately identify and distinguish which grid measurement data is attacked and which is not attacked. By binary encoding the output vector, the data representation is more intuitive and easy to understand. Some specific labels can be inserted into the data, so that the corresponding output vector changes, so that data that may exist false data injection attack can be detected.

[0063] It should be noted that, since the elements in the output vector of the integrated classification detection model are discrete values between [0, 1], binary label conversion needs to be performed according to the formula.

[0064] In the above embodiment of the present application, the multi-label encoding method is used for label conversion of the output vector value, including: using the multi-label encoding method to perform label conversion through the formula

[0065] In this embodiment, the multi-label encoding method can be used to perform label conversion on the voltage amplitude and phase of the nodes except the balance node, which can improve the data discrimination ability of the detection algorithm. The multi-label encoding method can process the voltage amplitude and phase data of different nodes in a unified format, which is convenient for comparison and analysis, and helps to improve the analysis and processing ability of grid data.

[0066] Specifically, the multi-label encoding method is as follows Figure 4 The last step: the voltage phase angle and the voltage amplitude of all nodes except the balance node are respectively mapped using a binary label, and then binary code identifying the state quantity contaminated by false data injection attack is obtained, so as to obtain the detection result of the grid state quantity contaminated by false data.

[0067] According to the above embodiment of the present application, the grid measurement data is obtained, including: obtaining first grid measurement data of a data acquisition and monitoring system, wherein the first grid measurement data at least includes node injected active power, node injected reactive power, branch active flow data and branch reactive flow data; obtaining second grid measurement data of a synchronous phasor measurement unit, wherein the second grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0068] In this embodiment, the first power grid measurement data of the data acquisition and monitoring system and the second power grid measurement data of the synchronous phasor measurement unit can be obtained as raw data for comparison and analysis with actual data, which can provide more comprehensive power grid state information.

[0069] As shown in Figure 4 SCADA measurement data (i.e., first power grid measurement data) and PMU measurement data (i.e., second power grid measurement data) are obtained.

[0070] According to the above embodiment of the present application, the integrated classification detection model includes multiple base classifiers.

[0071] In this embodiment, the accuracy of the overall classification can be improved by integrating multiple base classifiers. A single classifier may be overfitting to the training data, and the ensemble method can reduce overfitting by averaging the prediction results of multiple models to improve the generalization ability of the model, which can effectively identify important features.

[0072] The technical solution provided by the above embodiment of the present application improves the fitting ability of the detection model for complex power measurement data. The output vector of the integrated classification detection model is converted using multi-label encoding to obtain a binary code that identifies the state quantity contaminated by the false data injection attack. Thus, the technical problem of the conventional machine learning-based detection model, which has insufficient fitting ability for complex power measurement data and cannot accurately identify the power grid state quantity contaminated by false data, is solved. The SCADA and PMU power grid measurement data types are considered, and a virtual power plant false data injection attack detection method is proposed, which has strong fitting ability for complex power measurement data and can effectively identify the power grid state quantity contaminated by the false data injection attack. This is not common in existing virtual power plant false data injection attack detection methods.

[0073] As can be seen from the above, in the embodiment of the present application, an attack detection method for identifying the contaminated power grid state quantity in the virtual power plant false data injection attack is proposed, which particularly focuses on the problem of complex power data fitting ability and considers a detection model containing SCADA and PMU hybrid power grid measurement data. The training set and test set are constructed by cross division, and the final integrated classification detection model is constructed using multiple training sets and test sets, which avoids the overfitting phenomenon caused by the common learning of multiple base classifiers in the integrated classification detection model.

[0074] That is, the above technical solution provided by the embodiment of the present application comprehensively considers various factors, adopts a cross division method to process SCADA and PMU power grid measurement data to obtain a training set and a test set, constructs an integrated classification detection model according to the training set and the test set, the integrated detection classifier includes nine heterogeneous base classifiers of RandomForest, ExtraTrees, SVM, Kneighbors, GaussianNB, LogisticRegression, MLP, CNN and XGBoost, and the output vector of the integrated classification detection model is converted through multi-label encoding, compared with a detection method that can only identify whether a virtual power plant false data injection attack exists, the power grid state quantity information polluted by the false data can be provided.

[0075] It should be noted that, for the foregoing method embodiments, in order to simply describe, they are all expressed as a series of action combinations, but those skilled in the art should know that the present application is not limited to the action sequence described, because according to the present application, certain steps can be performed in other sequences or simultaneously. Secondly, those skilled in the art should know that the embodiments described in the specification all belong to preferred embodiments, and the actions and modules involved are not necessarily necessary for the present application.

[0076] From the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be realized by means of software and necessary general hardware platforms, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, or network device, etc.) execute the method of each embodiment of the present application.

[0077] According to the embodiment of the present application, a false data injection attack detection device for implementing the above false data injection attack detection method is also provided, Figure 6 is a schematic diagram of the false data injection attack detection device according to the embodiment of the present application, as Figure 6 shown, the device includes an acquisition unit 601, an analysis unit 603 and a determination unit 605. The false data injection attack detection device will be described below.

[0078] The acquisition unit 601 is configured to acquire power grid measurement data, wherein the power grid measurement data includes various types of power data.

[0079] The analysis unit 603 is configured to analyze the power grid measurement data by using the integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training on a plurality of sets of data, and each set of data in the plurality of sets of data includes historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data.

[0080] The determination unit 605 is configured to determine whether the power grid measurement data is attacked according to the size of the output vector value, and to process the attacked data.

[0081] It should be noted that the obtaining unit 601, the analysis unit 603, and the determination unit 605 correspond to steps S202 to S206 in the above embodiment, and the three modules have the same instances and application scenarios as the corresponding steps, but are not limited to the content disclosed in the above embodiment.

[0082] As can be seen from the above, in the scheme described in the above embodiment of the present application, first, the obtaining unit can be used to obtain power grid measurement data, wherein the power grid measurement data includes a plurality of types of power data; then the analysis unit can be used to analyze the power grid measurement data by using the integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training on a plurality of sets of data, and each set of data in the plurality of sets of data includes historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; finally, the determination unit can be used to determine whether the power grid measurement data is attacked according to the size of the output vector value, and to process the attacked data, thereby achieving the purpose of using the cross partition method to process mixed power grid measurement data, constructing an integrated classification detection model, and converting the output vector of the model through multi-label encoding, thereby realizing the technical effect of effectively identifying the power grid state quantity polluted by false data injection attack, and improving the fitting ability and accuracy of the model.

[0083] Through the above technical scheme provided in the embodiment of the present application, the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the polluted power grid state quantity is solved.

[0084] In an optional embodiment, the false data injection attack detection device further includes an establishment unit configured to establish a data matrix of the power grid measurement data as Wherein, Z represents a data matrix, d represents a number of power grid measurement data, and m represents a dimension of the power grid measurement data; a division unit is configured to divide the data matrix into a plurality of sub-matrices through cross division, divide the plurality of sub-matrices into a training set and a test set; and a processing unit is configured to obtain an initial integrated classification detection model, train the initial integrated classification detection model through the training set, test the initial integrated classification detection model after training through the test set, and obtain an integrated classification detection model in a case where the test is passed.

[0085] In an optional embodiment, the determining unit comprises: a first conversion sub-unit configured to perform label conversion on the output vector values in a multi-label encoding manner to obtain binary encoding of each output vector value; a first determining sub-unit configured to determine that the power grid measurement data is attacked when the binary encoding is 1; and a second determining sub-unit configured to determine that the power grid measurement data is not attacked when the binary encoding is 0.

[0086] In an optional embodiment, the first conversion sub-unit comprises: a second conversion sub-unit configured to perform label conversion in a multi-label encoding manner through a formula wherein, b i is the i th output vector,

[0087] is the binary encoding corresponding to the i th output vector after conversion in a multi-label encoding manner.

[0088] In an optional embodiment, the first conversion sub-unit further comprises: a third conversion sub-unit configured to perform label conversion on voltage amplitudes and voltage phases of nodes other than balanced nodes in a multi-label encoding manner.

[0089] In an optional embodiment, the obtaining unit comprises: a first obtaining sub-unit configured to obtain first power grid measurement data of a supervisory control and data acquisition system, wherein the first power grid measurement data at least comprises node injected active power, node injected reactive power, branch active power flow data, and branch reactive power flow data; and a second obtaining sub-unit configured to obtain second power grid measurement data of a phasor measurement unit, wherein the second power grid measurement data at least comprises node voltage phasor data and branch current phasor data.

[0090] In an optional embodiment, the integrated classification detection model comprises a plurality of base classifiers.

[0091] According to another aspect of the embodiments of the present application, an electronic device is provided, which includes one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs include a program code for performing the method for detecting a false data injection attack according to any one of the above.

[0092] According to another aspect of the embodiments of the present application, a processor is provided, which is configured to run a program, wherein the program is configured to perform the method for detecting a false data injection attack according to any one of the above.

[0093] According to another aspect of the embodiments of the present application, a computer program product is provided, which includes computer instructions configured to perform the method for detecting a false data injection attack according to any one of the above.

[0094] According to another aspect of the embodiments of the present application, a computer readable storage medium is provided, which includes a stored program, wherein the program is configured to control a device in which the computer readable storage medium is located to perform the method for detecting a false data injection attack according to any one of the above.

[0095] Optionally, in the embodiment, the computer readable storage medium can be located in any one of a group of computer terminals in a computer network, or in any one of a group of communication devices.

[0096] Optionally, in the embodiment, the computer readable storage medium is configured to store program codes for performing the following steps: obtaining power grid measurement data, wherein the power grid measurement data includes multiple types of power data; analyzing the power grid measurement data by using an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is trained by using multiple groups of data through machine learning, each group of data in the multiple groups of data includes historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; determining whether the power grid measurement data is attacked according to a size of the output vector value, and processing the attacked data.

[0097] Optionally, in the embodiment, the computer readable storage medium is configured to store program codes for performing the following steps: establishing a data matrix of the power grid measurement data as Wherein, Z represents a data matrix, d represents the number of power grid measurement data, and m represents the dimension of power grid measurement data;The data matrix is divided into multiple sub-matrices through cross division, and the multiple sub-matrices are divided into a training set and a test set;An initial integrated classification detection model is obtained, the initial integrated classification detection model is trained through the training set, and the trained initial integrated classification detection model is tested through the test set, and in the case of passing the test, an integrated classification detection model is obtained.

[0098] Optionally, in the embodiment, the computer readable storage medium is configured to store program code for performing the following steps: adopting a multi-label encoding method to convert the output vector value to obtain binary encoding of each output vector value;When the binary encoding is 1, it is determined that the power grid measurement data is attacked;When the binary encoding is 0, it is determined that the power grid measurement data is not attacked.

[0099] Optionally, in the embodiment, the computer readable storage medium is configured to store program code for performing the following steps: adopting a multi-label encoding method to convert the output vector value to obtain binary encoding of each output vector value;When the binary encoding is 1, it is determined that the power grid measurement data is attacked;When the binary encoding is 0, it is determined that the power grid measurement data is not attacked. i is the i-th output vector, is the binary encoding corresponding to the i-th output vector after conversion by the multi-label encoding method.

[0100] Optionally, in the embodiment, the computer readable storage medium is configured to store program code for performing the following steps: adopting a multi-label encoding method to convert the output vector value to obtain binary encoding of each output vector value;When the binary encoding is 1, it is determined that the power grid measurement data is attacked;When the binary encoding is 0, it is determined that the power grid measurement data is not attacked.

[0101] Optionally, in the embodiment, the computer readable storage medium is configured to store program code for performing the following steps: obtaining first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data at least includes node injection active power, node injection reactive power, branch active power flow data and branch reactive power flow data;Obtain the second power grid measurement data of the synchronous phasor measurement unit, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0102] The above-mentioned serial numbers of the embodiments of the application are only for description, and do not represent the advantages and disadvantages of the embodiments.

[0103] In the above-mentioned embodiments of the application, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0104] ​In several embodiments provided in the present application, it should be understood that the disclosed technology can be implemented by other means. Among them, the above-mentioned device embodiments are only schematic, for example, the division of the units can be a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the displayed or discussed each other can be through some interface, indirect coupling or communication connection between units or modules, which can be electrical or other forms.

[0105] The units described as separate components can or can not be physically separated, and the components shown as units can or can not be physical units, that is, they can be located in one place, or they can be distributed to multiple units. Part or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0106] In addition, each functional unit in each embodiment of the present application can be integrated into a processing unit, or each unit can exist physically, or two or more units can be integrated into one unit. The integrated unit can be realized in the form of hardware or in the form of a software functional unit.

[0107] The integrated unit, if realized in the form of a software functional unit and sold or used as an independent product, can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or the whole or part of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium, including a plurality of instructions for causing a computer device (which can be a personal computer, a server or a network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: a U disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a mobile hard disk, a magnetic disk or an optical disk, and various media that can store program codes.

[0108] The above is only the preferred embodiment of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, a number of improvements and refinements can be made, and these improvements and refinements should be considered as the protection scope of the present application.

Claims

1. A method for detecting a false data injection attack, the method comprising: The method comprises: acquiring power grid measurement data, wherein the power grid measurement data comprises multiple types of power data; analyzing the power grid measurement data by using an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple sets of data through machine learning, and each set of data in the multiple sets of data comprises historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; determining whether the power grid measurement data is attacked according to the size of the output vector value, and processing the attacked data, Before analyzing the power grid measurement data by the integrated classification detection model, the method further comprises: establishing a data matrix of the power grid measurement data as wherein, Z represents the data matrix, d represents the number of the power grid measurement data, and m represents the dimension of the power grid measurement data; the data matrix is divided into a plurality of sub-matrices by cross division, the plurality of sub-matrices are divided into a training set and a test set; an initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and in the case of passing the test, the integrated classification detection model is obtained, determining whether the power grid measurement data is attacked according to the size of the output vector value comprises: converting the labels of the output vector value by using a multi-label encoding method to obtain binary encoding of each output vector value; when the binary encoding is 1, it is determined that the power grid measurement data is attacked; when the binary encoding is 0, it is determined that the power grid measurement data is not attacked, acquiring power grid measurement data comprises: acquiring first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data at least comprises node injected active power, node injected reactive power, branch active power flow data and branch reactive power flow data; and acquiring second power grid measurement data of a synchronous phasor measurement unit, wherein the second power grid measurement data at least comprises node voltage phasor data and branch current phasor data.

2. The method of detecting a false data injection attack according to claim 1, wherein, converting the labels of the output vector value by using a multi-label encoding method comprises: The label conversion is performed by a formula where b i is the i-th output vector, is the binary code corresponding to the i-th output vector converted by using the multi-label encoding mode.

3. The method of detecting a false data injection attack of claim 1, wherein, converting the labels of the output vector value by using a multi-label encoding method further comprises: the voltage amplitude and the voltage phase of a node other than a balanced node are converted into labels by using the multi-label encoding method respectively.

4. The method of detecting a false data injection attack of claim 1, wherein, The integrated classification detection model comprises multiple base classifiers.

5. A detection device for fake data injection attacks, characterized in that, The method comprises: an acquisition unit configured to acquire power grid measurement data, wherein the power grid measurement data comprises multiple types of power data; an analysis unit configured to analyze the power grid measurement data by using an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple sets of data through machine learning, and each set of data in the multiple sets of data comprises historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; a determination unit configured to determine whether the power grid measurement data is attacked according to the size of the output vector value, and process the attacked data, The detection device of the false data injection attack further comprises: a establishing unit configured to establish a data matrix of the power grid measurement data before analyzing the power grid measurement data by using an integrated classification detection model wherein Z represents the data matrix, d represents a number of the power grid measurement data, and m represents a dimension of the power grid measurement data; a dividing unit configured to divide the data matrix into a plurality of sub-matrices by cross division, divide the plurality of sub-matrices into a training set and a test set; and a processing unit configured to obtain an initial integrated classification detection model, train the initial integrated classification detection model by using the training set, test the trained initial integrated classification detection model by using the test set, and obtain the integrated classification detection model in a case where the test is passed. the determination unit comprises: a first conversion subunit configured to convert the labels of the output vector value by using a multi-label encoding method to obtain binary encoding of each output vector value; a first determination subunit configured to determine that the power grid measurement data is attacked when the binary encoding is 1; and a second determination subunit configured to determine that the power grid measurement data is not attacked when the binary encoding is 0, The acquisition unit comprises: a first acquisition sub-unit, configured to acquire first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data at least comprises node active power injection, node reactive power injection, branch active power flow data and branch reactive power flow data; and a second acquisition sub-unit, configured to acquire second power grid measurement data of a synchronous phasor measurement unit, wherein the second power grid measurement data at least comprises node voltage phasor data and branch current phasor data.

6. A computer-readable storage medium, characterized in that, The computer readable storage medium comprises a stored program, wherein the program, when executed, controls a device in which the computer readable storage medium is located to perform the method for detecting a false data injection attack according to any one of claims 1 to 4.

7. An electronic device, comprising: comprise: one or more processors, memory, and one or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, and the one or more programs comprise a program for performing the method for detecting a false data injection attack according to any one of claims 1 to 4.

Images