Method and system for detecting false data injection attack of power system

Abstract

The invention discloses a power system false data injection attack detection method and system. Measurement data of a power distribution system are acquired; constructing an attack sequence, and injecting the constructed attack sequence into the obtained measurement data to simulate a false data attack; constructing a false data injection attack detection model based on the expansion causal convolution and the recurrent neural network to analyze the state change of the power distribution system; and judging an attack behavior according to the analyzed state of the power distribution system. According to the method, time sequence data can be processed, the long-term dependency relationship and the complex mode can be captured, and the response capability to the complex attack mode can be improved, so that the false data injection attack can be effectively detected and prevented, and the safety and reliability of the power distribution system can be maintained.

Description

Technical Field

[0001] The present invention relates to the field of network security of energy power systems, and in particular to a method and system for detecting false data injection attacks in power systems. Background Art

[0002] With the continuous development of energy and power systems, more and more intelligent devices and automation technologies have been introduced into distribution systems, which have improved the operating efficiency and reliability of the systems. However, with the development of these technologies, the security of the system is also facing greater challenges, especially the threat of false data injection attacks (FDIA). FDIA attackers tamper with the system's measurement data and interfere with the system's state estimation, which may lead to unstable operation of the power system and even cause serious consequences such as large-scale power outages. Therefore, how to effectively detect and prevent FDIA has become an important research topic in the current field of power system security.

[0003] Traditional state estimation methods mainly rely on weighted least squares (WLS), which assumes that the measurement error follows a Gaussian distribution and obtains the optimal state of the system by minimizing the difference between the measurement error and the estimated value. However, the traditional WLS method has poor robustness against FDIA attacks and is difficult to detect highly concealed false attacks. Although the bad data detection (BDD) technology based on residual analysis can detect abnormal data to a certain extent, it has limited effect in the face of carefully designed covert FDIA attacks.

[0004] In recent years, deep learning technology has shown significant advantages in processing complex time series data and has become an emerging direction for false data detection in power systems. Deep learning methods such as dilated causal convolutions and recurrent neural networks (RNN) can effectively capture long-term dependencies and complex patterns in time series data and have strong attack detection capabilities. In addition, combining traditional WLS state estimation methods with deep learning technology can further improve the accuracy and robustness of system state estimation and enhance the detection capability of FDIA attacks.

[0005] Real-time monitoring of distribution systems is essential to maintaining the safety and reliability of the system. Distribution system operators monitor the various components of the distribution system through meters and report the readings to the control center, which estimates the system status based on these measurements. However, FDIA attackers are able to bypass traditional detection mechanisms and put the system into an unsafe state. Therefore, a comprehensive detection solution that combines traditional methods and deep learning technology is urgently needed to improve the detection and prevention capabilities of FDIA attacks in distribution systems.

[0006] CN202311719887.5A provides a network attack resilience detection and recovery method and system based on deep Jacobi. After establishing the electrical and thermal network model and energy distribution map of the integrated energy system, the present invention considers the interference of DOS attacks and FDI attacks, uses the neural network parallel CNNBILSTM model to detect the attack type, and finally resists the impact of the attack through the deep Jacobi descent algorithm to achieve energy control within the network and between networks. The invention has a high computational complexity and may result in poor real-time performance, especially in large-scale integrated energy systems, where the computational burden will increase significantly. Robustness issues: For different types of attacks, this method needs to adjust the model parameters to ensure the effect, and lacks versatility and robustness for diversified attack scenarios. Dependence on the accuracy of the energy distribution map: The method relies on an accurate energy distribution map. If the model or data is inaccurate, it may lead to misdetection or incomplete recovery.

[0007] CN202210258426.1A provides a false data injection detection method for power grid based on CNN-GRU. Under the characteristics of high dimension, large quantity and many types of power system data, it can use the collected historical data and real-time data to accurately and quickly detect and judge whether the power grid has false data injection attack. The method mainly includes the design of three parts: spatial feature extractor, temporal feature extractor and attack detector. The invention adds a bidirectional gated recurrent unit layer GRU to the convolutional neural network CNN, constructs a CNN-GRU hybrid network, utilizes the excellent extraction ability of the recurrent convolutional network for data temporal features, and extracts the spatial features of power grid data by fusing the convolutional neural network. After that, the redundant data of the power grid is used to train the model, and the spatiotemporal feature library of the attacked data is obtained. Finally, the acquired real-time power grid data is input into the model for verification and classification. The invention relies on the redundant data of the power grid for training and detection. If the data redundancy is insufficient or the data quality is low, the accuracy of the detection is affected. Model complexity: Although the CNN-GRU hybrid model improves the ability to extract spatiotemporal features, the complex model structure may lead to long training time, excessive consumption of computing resources, and may encounter practical application challenges during deployment. Limited generalization ability: The generalization ability of this method may be insufficient when facing different types or sizes of power grids, and the model needs to be adjusted or retrained more frequently.

[0008] CN202010143003.6A provides a false data injection detection method for power grids based on GEP-CNN. In a power system with large data volume, multiple dimensions, and multiple data types, it can use existing big data information to timely and accurately detect whether there is a false data injection attack in the power grid. It mainly includes three parts: a neural network optimizer, a sample trainer, and a detection classifier. The invention adds the GEP algorithm to the CNN network, constructs a GEP-CNN hybrid network, and uses the global search capability of the GEP algorithm to optimize the initial weights of the CNN network. Then, the historical data in the historical database is used for learning and training to obtain the attack data feature library, and finally the collected real-time data is detected and classified. The GEP-CNN method in the invention relies on the GEP algorithm for initial weight optimization. If the initial weight is not selected well, it may cause the network training to fall into a local optimum, affecting the detection performance. Long training time for big data: Since the method needs to use big data for training, the training time is long when the data volume is large and the data dimension is high, which may affect the real-time performance of the method. Dependence on detection classifier: This method relies on the detection classifier for final detection and classification, but if the design of the classifier is not optimized or the data feature library is incomplete, it may lead to false positives or false negatives. Summary of the invention

[0009] In order to address the deficiencies in the prior art, the present invention proposes a method for detecting false data injection attacks in power systems. By studying attack simulation and identification, deep learning applications, and combining WLS state estimation with deep learning, the detection and prevention capabilities of the distribution system against FDIA attacks are effectively improved, thereby ensuring the safe and stable operation of the system.

[0010] The present invention adopts the following technical solution.

[0011] A method for detecting false data injection attacks in a power system, characterized in that the method comprises the following steps:

[0012] Step 1: Obtain measurement data of the power distribution system;

[0013] Step 2: Construct an attack sequence and inject the constructed attack sequence into the measurement data obtained in step 1 to simulate the injection of false data to attack the distribution system;

[0014] Step 3: Build a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the state of the distribution system attacked by injecting false data in step 2;

[0015] Step 4: Determine the attack behavior based on the status of the power distribution system analyzed in step 3.

[0016] More preferably,

[0017] In step 1, the measurement data of the power distribution system includes real-time measurement data, pseudo measurement data and virtual measurement data;

[0018] The real-time measurement data includes real-time voltage, real-time current and power measurement data from distribution automation systems, SCADA systems, smart meters and smart electronic devices;

[0019] The pseudo measurement data includes pseudo power on the feeder bus;

[0020] The virtual measurement data includes zero voltage drop in enclosed switchgear, zero power flow, and zero bus injection measurements at switchyard nodes.

[0021] More preferably,

[0022] In step 2, the attack sequence construction formula is as follows:

[0023]

[0024] Where a represents an attack vector; c represents a non-zero vector, Represents the distribution system measurement data, represents the measurement function of the power distribution system, Represents the measurement function of the power distribution system after being attacked.

[0025] More preferably,

[0026] In step 2, the constructed attack sequence is injected into the measurement data of the distribution system to simulate the false data injection attack, including constructing false data according to the following formula:

[0027] z bad =z+a

[0028] Where z represents the measured data of the power distribution system, z bad Indicates false data.

[0029] More preferably,

[0030] In step 3, a false data injection attack detection model is constructed based on dilated causal convolution and recurrent neural network to analyze the state changes of the distribution system, including:

[0031] Step 3.1: Use dilated causal convolution to capture long-term dependencies. Use 32 filters to perform causal convolution on the measurement data injected with false data at each time step to create a dense sequence at each time step. The dense sequence includes attack sequences or normal sequences.

[0032] Step 3.2: Create memory based on recurrent neural network; predict the next state of the power system by creating memory and using previous inputs and outputs;

[0033] Step 3.3 uses the output of the recurrent neural network as the input of the least squares method to estimate the state of the distribution system;

[0034] Step 3.4 introduces residual blocks to solve the gradient vanishing problem and optimize the training process of the false data injection attack detection model;

[0035] Step 3.5: Select the best hyperparameter combination through random search method to train and verify the false data injection attack detection model.

[0036] More preferably,

[0037] In step 3.1, dilated causal convolution is used to capture long-term dependencies including:

[0038] Extraction of spatial and temporal information is performed using standard convolution kernels through dilution;

[0039] Each time step is causally convolved separately using 32 filters to create a dense representation of each time step in a high-dimensional space.

[0040] More preferably,

[0041] In step 3.3, the output of the recursive neural network is used as the input of the least square method to estimate the state of the distribution system, including solving the state estimation of the distribution system according to the following formula:

[0042]

[0043] Among them, J(x) is the objective function, z i is the ith measurement value, z is the observation vector containing all m observations, and h i (x) is the predicted value of the ith measurement, x is the state vector, σ i is the standard deviation of the ith measurement. W is the weight matrix,

[0044] σ i =(0.02a+0.0052b) / 3, a is the measured value, b is the full scale value.

[0045] More preferably,

[0046] In step 3.4, the residual block is introduced to solve the gradient disappearance problem, including:

[0047] The residual block feeds the output of the causal convolutional layer deep into the network, allowing the input to bypass the dilated convolution operation, and then adds the shortcut connection and dilated convolution output together to form the output of the entire residual block.

[0048] More preferably,

[0049] In step 3.5, the hyperparameters include optimizer type, learning rate, batch size, and false data injection attack detection model depth.

[0050] At the same time, the present invention also requests protection for a false data injection attack detection system for a power system, including a measurement data acquisition module, an attack sequence construction module, an attack detection model construction module, and a system status judgment module;

[0051] A measurement data acquisition module, used to acquire measurement data of the power distribution system;

[0052] An attack sequence construction module is used to construct an attack sequence and inject the constructed attack sequence into the acquired measurement data to simulate the injection of false data to attack the distribution system;

[0053] The attack detection model building module builds a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the status of the distribution system injected with false data attacks;

[0054] The system status judgment module judges the attack behavior based on the obtained status of the power distribution system.

[0055] A terminal comprises a processor and a storage medium; the storage medium is used to store instructions; the processor is used to operate according to the instructions to execute the steps of any one of the methods.

[0056] A computer-readable storage medium stores a computer program, which implements the steps of any one of the methods when executed by a processor.

[0057] The beneficial effect of the present invention is that, compared with the prior art, the present invention generates invisible attack sequences and bypasses traditional detection mechanisms to identify and defend against false attacks on sensors and actuators, thus preventing the system from entering an unsafe state. RNN performs well in detecting well-constructed FDIA attacks and can use historical data for prediction, effectively improving the detection capability of false attacks and enhancing the overall security and stability of the system;

[0058] The dilated causal convolution of this method can capture long-term dependencies while maintaining computational efficiency, ensuring the model's detection capabilities at high precision. By introducing residual blocks to solve the gradient vanishing problem, it ensures the effective training of deep neural networks, improves the robustness and convergence speed of the model, and enables it to cope with complex and changing attack modes;

[0059] The present invention optimizes the model performance through hyperparameter adjustment and random search method, so that it can achieve the best performance under different conditions. The method of combining dilated causal convolution with RNN can not only effectively detect false data injection attacks, but also adapt to changes in system states and provide more accurate state estimation and early warning capabilities. When renewable energy is added, the method can handle the spatiotemporal complexity of the system state and improve the detection rate and accuracy of diversified attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 A partial structural diagram of a symmetrical balanced power distribution system in an embodiment of the present invention;

[0061] Figure 2 A schematic diagram of the popularity of renewable energy in an embodiment of the present invention;

[0062] Figure 3 Schematic diagram of dilated convolution in an embodiment of the present invention;

[0063] Figure 4 Schematic diagram of the structure of the residual block in an embodiment of the present invention;

[0064] Figure 5 Schematic diagram of an IEEE 14 bus power supply test system in an embodiment of the present invention;

[0065] Figure 6 The present invention is a flowchart of a false data injection attack detection method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0066] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0067] The present invention provides a method for detecting false data injection attacks in a power system, the method comprising the following steps:

[0068] Step 1: Obtain measurement data of the power distribution system.

[0069] In one embodiment of the present invention, the measurement data of the power distribution system in step 1 includes real-time measurement data, pseudo measurement data and virtual measurement data.

[0070] In this embodiment, the real-time measurement data includes real-time voltage, real-time current and real-time power measurements from distribution automation DA, SCADA system, smart meter and intelligent electronic device IED. Pseudo-measurement data includes pseudo-power (load) on the feeder bus. Pseudo-measurement data and pseudo-power are virtual data used to supplement or approximate real measurement data in power system analysis. Their main purpose is to help model and analyze power grid operation when data is missing or insufficient.

[0071] Pseudo-measurement data: refers to approximate data generated to supplement actual measurement data, usually based on historical data, typical load curves or other statistical methods. Its purpose is to simulate or estimate the operation of the power system in certain time periods, especially when there is not enough real-time data.

[0072] Pseudo power: This is a specific example of pseudo measurement data, which is often used to estimate the power of a load. It may be generated based on historical load curves, customer billing data, or other methods. Pseudo power data is not actually measured, but rather is derived through statistical inference. It can be defined as a Gaussian distribution with a mean of half the transformer rating, or it can be determined based on customer billing data and typical load curves.

[0073] Virtual measurement data refers to zero voltage drop in enclosed switchgear, zero power flow in open switchgear, and zero busbar injection at switchyard nodes. In power systems, virtual measurement data is used to supplement actual measurement data to help with system modeling, analysis, and monitoring. When certain devices are in a specific state (such as when the switchgear is closed or open), some virtual measurement values ​​need to be set to zero in order to simplify the model or reflect the actual operating state.

[0074] Zero power flow: Zero power flow refers to the situation where the active and reactive power on a branch or line in a power system is set to zero under certain conditions (such as when the switchgear is in the open state). When a switchgear (such as a circuit breaker) is in the open state, the circuit breaker disconnects the line or branch, resulting in no current flowing in that branch. To reflect this state, the power flow in the system is set to zero. By setting the power flow on the unpowered branch to zero, the mathematical model of the power system can be simplified and the computational complexity can be reduced. Accurately reflect the system state: Ensure that system analysis (such as power flow calculations) accurately reflects the actual operating state of the switchgear to avoid incorrect power distribution calculations.

[0075] Zero bus injection measurement value: Zero bus injection means that at certain buses (nodes), it is assumed that there is no net power injection or extraction, that is, the active and reactive power injection values ​​of the bus are both zero. At some nodes in the switch station, actual power injection may not be required due to equipment configuration or operating status. These nodes are set to "zero bus injection" to reflect their actual operating conditions. Some buses are set as reference nodes (balancing nodes), and their power injection values ​​are automatically adjusted by the system and may be considered zero in specific analyses. In the absence of actual measurement data, the data is supplemented by setting zero injection values ​​to ensure the integrity of the system model. Help maintain the power balance of the system and ensure that the overall power demand and supply of the system remain consistent when performing power flow calculations or other analyses.

[0076] "Zero power flow" and "zero bus injection measurement value" in virtual measurement data are used to reflect the status of the equipment. Zero power flow accurately reflects whether the switchgear (such as circuit breakers) is turned on, ensuring that the system model is consistent with the actual operating status. Zero bus injection reflects the power injection situation of specific nodes, ensuring that the system does not introduce additional power load or supply at these nodes. Simplified system modeling: By setting certain parameters to zero, the mathematical model of the power system can be simplified, the amount of calculation can be reduced, and the analysis efficiency can be improved. In the case of insufficient or missing actual measurement data, virtual measurement data provides a reasonable supplement to ensure the continuity and accuracy of system analysis. "Zero power flow" and "zero bus injection measurement value" are commonly used virtual measurement data in power systems, which are used to accurately reflect the status of equipment, simplify system modeling and complete missing data. By setting these virtual values ​​reasonably, the accuracy and efficiency of power system analysis can be improved, and the reliability and stability of system operation can be ensured.

[0077] Step 2: Construct an attack sequence and inject the constructed attack sequence into the measurement data obtained in step 1 to simulate the injection of false data to attack the distribution system.

[0078] In one embodiment of the present invention, in step 2, the attack sequence construction formula is as follows:

[0079]

[0080] Where a represents an attack vector; c represents a non-zero vector, Indicates the power distribution system status data, represents the measurement function of the power distribution system, Represents the measurement function of the distribution system after the attack. The selection of the c vector is crucial to the effect of the attack. In this application, it is selected based on the following considerations:

[0081] Stealthiness: The attack vector c usually needs to be chosen small enough so that it will not be discovered by conventional detection mechanisms in the system (such as bad data detection algorithms in state estimation). This means that c needs to be within the noise range of the system's measurement data or follow a certain statistical distribution to avoid being identified.

[0082] Target specificity: The attacker will choose the value of c based on their goal. If the goal is to tamper with a specific measurement (such as the voltage or load at a node), then c will be adjusted to target those specific state variables.

[0083] Attack strategy: Some attackers may generate c based on known system load curves or measurement history to more accurately implement the attack. For example, the attacker can learn from historical data and choose an appropriate c to deviate from the true state but not deviate too much to be detected.

[0084] Measurement function Source: is a function that describes the relationship between the measurement and the system state. Specifically, in the power system, the measurement function Usually represents: A mathematical expression of a physical measurement: In power systems, measurement functions are often related to power flow equations. For example, voltage and current measurements in a system may be described by certain nonlinear power flow equations, which are measurement functions. System characteristics and measurement equipment responses: It reflects the response of various devices (such as voltmeters and power meters) in the power system to the system status. The specific measurement function can be obtained through the system topology and the technical parameters of the equipment. In practice, the measurement function It is known and can be obtained by mathematically modeling the physical model of the power system. Common measurement quantities include: node voltage, branch current, active power, reactive power, and current phase angle. The relationship between the measurement data and status data of the distribution system: distribution system status data State data usually refers to the internal state of the distribution system, such as the voltage and current of each node. State estimation is to derive these state parameters from the measurement data. Measurement data is physical data directly obtained by sensors in the system (such as voltmeters, ammeters, and power meters). Measurement data depends on system status data, but measurement data may contain noise or be subject to other interference.

[0085] The state data of the power distribution system are internal parameters obtained through state estimation, such as node voltage and current. The measurement data of the power distribution system are physical quantities read from actual sensors, such as the readings of voltmeters and ammeters. The value of the c vector needs to be selected according to the attack target, which should be both concealed and targeted. It is a function that describes the relationship between measurement data and system status data, usually obtained based on the power flow equation or measurement equipment characteristics.

[0086] In this embodiment, the distribution system state data is a set of variables (usually voltage amplitude and phase angle). If these variables are known, all other quantities of the distribution system can be calculated. These quantities include current, power, and flow, which reflect the operation of the system. The branch current is the current flowing through the distribution line, which can be calculated by the state variable of the node voltage. The node power refers to the active power and reactive power injected into a node of the system, which is calculated by the amplitude and phase angle of the node voltage. The line power refers to the power transmitted through a certain line, which is usually divided into active flow and reactive flow. The node current refers to the total current flowing into or out of a node, which can be calculated by the node voltage and the admittance matrix. The power loss refers to the power loss caused by resistance and inductance during the transmission process on the line, which is divided into active loss and reactive loss. Therefore, the system state basically determines the operating point of the distribution system.

[0087] In this embodiment, the voltage amplitude and phase angle of each node in the distribution system are the most basic state quantities. Branch current: the current passing through the distribution line is another key state quantity. Power: includes active power and reactive power, usually calculated by voltage and current. Phase angle: the phase angle of voltage or current, which reflects the electrical distance and load distribution of the system. Method for estimating the state of the distribution system based on instrument measurement values: The state estimation of the distribution system usually uses the following measurement values: Voltage measurement: voltage measurement value provided by the voltage transformer (VT) installed in the distribution system. Current measurement: current measurement value provided by the current transformer (CT). Power measurement: includes direct measurement of active power and reactive power or calculation through voltage and current. Phasor measurement unit (PMU): can measure the amplitude and phase angle of voltage and current of multiple nodes in the system, providing higher precision state measurement.

[0088] A distribution system with state variables is monitored by meters (usually m>s meaning measurement redundancy). These meters measure in a way that makes the distribution system observable, i.e. it is possible to determine all state variables from the meter measurements. State estimation is done in the presence of independent random measurement noise. (distribution with a mean of zero) condition, according to the meter measurement value Estimating state variables The mathematical relationship between the meter measurement value and the state variable is:

[0089] z=h(x)+e (2)

[0090] Where: represents the measurement function of the state variable x, and m is the total number of measurements, that is, the number of meters. Specifically, m represents the dimension of the vector z, which is also the dimension of the function vector h(x). Each meter corresponds to a measurement value z i and a function h i (x). s here represents the number of system state variables. i represents the number of meters or measured values, where i ranges from 1 to m. Therefore, h i (x) represents the functional relationship between the ith measurement value and the system state variable x. i (x) This is a function that represents the value z of the ith meter. i The mathematical relationship between h and the system state variable x. In other words, h i (x) is the i-th predicted measurement value calculated based on the state variable x. Depending on the specific measurement type, the measurement type includes direct measurement and indirect measurement; direct measurement includes physical quantity measurement and sensor measurement; wherein, direct measurement is a physical quantity directly related to the state variable. In the power system, the voltage and current of the node can be directly measured. Sensor measurement is the use of sensor technology to directly obtain the value of the state variable; the sensor can be a temperature sensor, a pressure sensor, a displacement sensor, and different types of sensors are selected for measurement according to system requirements. Indirect measurement includes computational derivation and observer estimation; computational derivation means measuring other quantities indirectly related to the state variable and deriving the value of the state variable through mathematical formulas or algorithms; this method is very useful when the state variable cannot be measured directly. Observer estimation means using observer technology to estimate the value of the state variable through an algorithm based on the input and output data of the system. The observer can be a Kalman filter or a particle filter, which can handle noise and uncertainty and provide a more accurate state estimate.

[0091] In another embodiment of the present invention, the measurement type also includes multi-source fusion measurement and data fusion algorithm. Multi-sensor fusion means that when there are multiple sensors in the system, the measurement data of multiple sensors can be fused through multi-sensor fusion technology to improve the measurement accuracy and reliability of state variables. The data fusion algorithm means using a data fusion algorithm, such as a weighted average method and a Kalman filter fusion algorithm, to fuse data from different sources to obtain a more accurate estimate of the state variable, and involves the network topology and parameters of the distribution system.

[0092] In one embodiment of the present invention, in step 2, injecting the constructed attack sequence into the measurement data of the power distribution system to simulate the false data attack includes constructing the false data according to the following formula:

[0093] z bad =z+a (3)

[0094] Where z represents the measured data of the power distribution system, z bad Indicates false data.

[0095] In this embodiment, let represents the attack vector (injecting false data into the instrument). Then, the bad measurement value with false data a is represented by z bad =z+a means, let Indicates the use of false measurement data z bad The estimated value of x, It can be expressed as in is a non-zero vector reflecting the estimation error injected by the attacker.

[0096] The BDD algorithm uses the residual to check whether there is bad measurement, the residual vector after the false data injection attack:

[0097]

[0098] Where z represents the original measurement value vector, the system measurement data collected without false data injection, and r bad Represents the residual vector after the false data injection attack. The residual refers to the difference between the actual measured value and the estimated value. represents the functional relationship between system state estimation and false injection, h(.) represents the nonlinear measurement function of the system, is the estimated system state variable, c represents the impact of injected false disturbance on the state estimate, represents the estimated measurement vector with attack.

[0099] Generally speaking, if the false data a is unstructured, the attack vector is likely to be detected by BDD because r bad ≠r, however, if the attack vector a is well-structured, such as:

[0100]

[0101] Then the bad measurement result is bad BDD can be avoided because z bad The measurement residual of is the same as the measurement residual of z. Assuming that the original measurement value z can pass BDD, if the structure of the attack vector a is as shown in formula (5), the false measurement z bad=z+a can also pass BDD.

[0102] Substituting (5) into (4), z bad The deviation measurement residual vector of That is, the measurement residual vector with bias is the same as the measurement residual vector without false data a, so as long as the original measurement value z can pass the BDD, z bad It will not be detected.

[0103] The attack whose attack vector a is structured as shown in formula (5) is called FDI attack. By launching FDI attack, the deviation value It will be mistaken by the control center as a valid state estimate, so the attacker can inject arbitrary estimation errors without being detected.

[0104] As can be seen from formula (5), the construction of attack vector a depends on the following strong conditions.

[0105] Strong condition: To corrupt the state estimation in a power distribution system, the attacker needs to know the system state That is, all PQ nodes The voltage amplitude on and phase angle

[0106] Intuitively, this condition can be achieved by directly measuring the quantity using any available meter, which includes existing meters hacked by the attacker and / or new meters temporarily deployed by the attacker. The challenge lies in how to deal with the voltage phase angle. Although PMUs can directly measure the voltage phase angle, the number of installed PMUs is not enough to provide such information. On the other hand, the cost of deploying PMUs to obtain such information is also high.

[0107]

[0108] in, Representation Node The power vector at , which usually includes the complex representation of active power and reactive power, Represented by the node The voltage vector The diagonal matrix is ​​composed of . is a complex vector representing the voltage at node L. Putting this vector into a diagonal matrix means that the diagonal is elements, the rest are zero, represents the conjugate complex number of the current vector at node L. The current vector is also a complex vector, usually related to the voltage vector Together they are used to calculate the power. The branch admittance matrix through the line The matrix gives the linear relationship between the line current and voltage in the form of:

[0109]

[0110] in, Representation Node The complex conjugate of the current vector at , represents the voltage phasor at the reference or slack bus (bus 0), Represents the voltage phasor on other buses, branch admittance matrix satisfy:

[0111]

[0112] Among them, 1 represents a vector of all 1s, and 0 represents a vector of all 0s.

[0113] Considering the same partition as voltage, the branch admittance matrix can be correspondingly Partitioning is performed and (7) can be rewritten as:

[0114]

[0115] in, represents the admittance between the load bus and the reference bus or the slack bus (bus 0), It is a pseudo-inversion. Using (8) and (9), we can get:

[0116]

[0117] Among them, the branch impedance matrix yes The pseudo-inverse of .

[0118] From formula (6), we can get:

[0119]

[0120] The following approximations are based on two typical observations of power distribution systems:

[0121] In distribution systems, voltage magnitudes are very close, with a typical range of 0.95 to 1.05 under most operating conditions.

[0122] Due to the small power flows and short distances, the voltage phase angle differences in the distribution system are very small. For example, the typical phase angle difference of a distribution feeder at full load may be 0.1° / mile, which is one to two orders of magnitude smaller than the phase angle difference between transmission nodes (one tenth of a degree instead of tens of degrees).

[0123] Therefore, in the power distribution system, the line current It can be approximated as:

[0124]

[0125] Then, using (10) and (11), we can derive Voltage It can be approximated as:

[0126]

[0127] From the above, we can see that the system status and The power flow can be measured based on With PCC voltage amplitude V 0 and phase angle θ 0 An approximate estimate is made for reference.

[0128] Define the vectors separately and entries Then, (25) can be written in a compact form as:

[0129]

[0130] Through the node admittance matrix (also called a Y bus) modeling the line, the matrix gives the linear relationship between the current and voltage at the reference node mentioned above, and its form is:

[0131]

[0132] in, represents the admittance matrix, It usually refers to the current injected at the reference bus or slack bus (bus 0). It refers to the current phasor of other buses in the network. The Y bus corresponds to a weighted Laplace matrix, whose edge weight is equal to the admittance of the corresponding line. The node admittance matrix satisfies:

[0133]

[0134] Considering the same partitioning as for node currents and voltages, the node admittance matrix can be partitioned accordingly And rewrite (14) as:

[0135]

[0136] in, is reversible. Using (15) and (16), we can obtain:

[0137]

[0138] Among them, the node impedance matrix The definition is

[0139] Note that from (13) we can derive:

[0140]

[0141] As mentioned above, in the power distribution system, the node current Can be approximated as

[0142]

[0143] Then, using (17) and (18), we can derive the following comments.

[0144] According to the power injection measurement Voltage It can be approximated as:

[0145]

[0146] From the above, we can see that the system status and The power injection measurement value can be With PCC voltage amplitude V 0 and phase angle θ 0 An approximate estimate is made for reference.

[0147] Step 3: Construct a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the state of the distribution system attacked by injecting false data in step 2.

[0148] In one embodiment of the present invention, in step 3, constructing a false data injection attack detection model based on dilated causal convolution and recursive neural network to analyze the state change of the power distribution system includes:

[0149] Step 3.1: Use dilated causal convolution to capture long-term dependencies and maintain the input resolution and computational efficiency of the model;

[0150] The present invention uses 32 filters to perform causal convolution at each time step on the measurement data injected with false data to create a dense sequence at each time step in a high-dimensional space, and the dense sequence includes an attack sequence or a normal sequence.

[0151] Step 3.2: Create memory based on recurrent neural network; By creating memory and predicting the next state of the power system using previous inputs and outputs, effective detection of well-constructed FDI attacks is performed by implicitly considering historical data by analyzing the dynamics of measurement changes.

[0152] Step 3.3: Use the output of the recurrent neural network as the input of the least squares method to estimate the state of the distribution system;

[0153]

[0154] Among them, J(x) is the objective function, z i is the ith measurement value, z is the observation vector containing all m observations, and h i (x) is the predicted value of the ith measurement, x is the state vector, σ i is the standard deviation of the ith measurement. W is the weight matrix,

[0155] In a preferred embodiment of the present invention, σ i =(0.02a+0.0052b) / 3, a is the measured value, b is the full scale value.

[0156] The solution to the optimization problem (22) gives the best estimated state, which must satisfy the following optimization conditions (first-order necessary conditions):

[0157]

[0158] in is the Jacob matrix h(x) of the measurement function; the number of rows and columns of the Jacob matrix are equal to the number of rows and columns of the meter measurement values ​​and state variables, respectively, and the entry in the i-th row and j-th column of the Jacob matrix represents the derivative of the i-th measurement value with respect to the j-th state variable.

[0159] When the distribution system starts smoothly, all voltage amplitudes are set to 1p.u. and all phase angles are set to 0, that is, x 0 = [1; 0]. Then, in each iteration a linear equation of the following type is solved to calculate the correction Δx k :

[0160]

[0161] in, represents the iteration index; Formula (4) is called the canonical equation of state estimation based on WLS, where G(x) represents the gain function, which is usually selected as

[0162]

[0163] Then, x k+1 =x k +Δx k The Jacob matrix H(x) will be used to update the next iteration k+1 ), Jacob matrix H(x k +1) is updated in the honest Gauss-Newton method, and in the dishonest Gauss-Newton method, the Jacob matrix H(x 0 ) starts updating at the gentle start and remains unchanged during the entire iteration process. The above steps are repeated until the state variables converge to a fixed point. The convergence criterion is ||Δx k || ∞ ≤0.001 and |J(x k+1 )-J(x k )|<1.

[0164] In this embodiment, an important practical limitation of FDI attack on the distribution system is the influence of voltage-volt-ampere control (VVC), which includes voltage regulation of load tap changer (LTC) and reactive power regulation of capacitor bank; the settings of LTC and capacitor bank directly determine the parameters of distribution system (such as reference voltage and shunt admittance), and thus the measurement function h(x). Thus, if the VVC settings are changed and the attacker is unaware of these changes, the FDI attack will be detected.

[0165] The measurement function h(x) is based on the representation of the distribution system. The emphasis is on symmetrical and balanced distribution systems, which usually use a single-phase feeder model. Figure 1 As shown, special consideration is given to the part of the distribution system that is connected to the grid at one point - the distribution substation, or point of common coupling (PCC), which delivers power to several nodes. represents a node set, where index 0 represents PCC, Indicates other nodes; Represents a line set. Each line k∈L consists of a set of two nodes denoted as k={i,j}.

[0166] The present invention is limited to the stable state of the power distribution system, that is, all voltages are sinusoidal signals with the same frequency. Therefore, each signal can be represented by a complex number (·) = |·|e j∠· To express it, the absolute value of the complex number |·| is equivalent to the RMS value of the signal, and the phase ∠ of the complex number is equivalent to the phase of the signal relative to an arbitrary global reference.

[0167] The PCC is modeled as a reference (relaxed) node where a voltage The other nodes are modeled as PQ nodes, and the composite power injection is applied in the reference node as follows:

[0168]

[0169] in, represents the complex current at node i, represents the complex power (apparent power) of node i, represents the complex voltage at node i, yes The complex conjugate of , then each line is associated with a complex power flow as shown in the following formula:

[0170]

[0171] in, represents the complex power from node i to node j, Represents the conjugate complex number of the current from node i to node j.

[0172] Assuming that the shunt admittance at each reference node can be ignored, under this assumption, there is a reference node current as shown in the following formula:

[0173]

[0174] in, represents the current from node i to node j, Represents the set of all adjacent nodes of node i. By recursion, we can get a row of currents:

[0175]

[0176] In the single-phase feeder model, the voltage between the terminals {i,j} of the line is described as and The terminal equation related to the line current {i,j} is as follows:

[0177]

[0178] in, is the impedance of the {i, j} line. When performing state estimation in the single-phase feeder model, the voltage is selected as the state variable, that is, in and All PQ nodes are To calculate the voltage amplitude and phase angle on the , we need to rearrange the terminal equation (29) and convert it into the following admittance form:

[0179]

[0180] The measurement function h(x) can be written in terms of the considered meter measurements, namely (i) power flow (forward and reverse), (ii) power injection (i.e., load), and (iii) voltage amplitude measurements: in, and All lines Forward and reverse power flow measurements on and All PQ nodes are The power injection and voltage amplitude measurement on the PCB are as follows:

[0181] If the meter measurement is the power flow measurement P on line {i,j} ij , Q ij , then according to (26) and (30), we can conclude that:

[0182]

[0183] If the meter measurement is the power injection measurement P at node i i , Q i , then according to (25), (27) and (30), we can conclude that:

[0184]

[0185] The voltage amplitude measurement value V at node i i It can be expressed as:

[0186]

[0187] Except for (33), the measurement functions (31) and (32) are nonlinear functions of the state variables. The Jacob matrices associated with these measurement functions can be found in .

[0188] Bad measurements may be generated due to meter failure or false attacks. Intuitively, normal meter measurements usually give state variable estimates close to the true values, while abnormal measurements make the estimated state "deviate" from the actual state. Therefore, there is usually an "inconsistency" between good and bad measurements. Distribution system operators use detectors based on measurement residuals to ensure the accuracy of state estimation. The measurement residual vector is the difference between the observed measurement value and the estimated measurement value. Right now The residual (total error or bias) is its constant, that is, r = ||r|| 2 .

[0189] Residual-based BDD compares the residual r with a predetermined threshold τ to identify bad measurements (outliers); specifically, if r>τ, a bad measurement is assumed to exist; otherwise z is considered a normal measurement.

[0190] When the instrument measurement noise e is assumed to follow a normal distribution, then r 2 It obeys the rank square distribution with degrees of freedom (ms), that is, The threshold τ is predetermined by hypothesis testing with a significance level α, in other words, r>τ detects bad measurements with a false alarm probability α.

[0191] According to the research of Fred Schweppe, a pioneer in state estimation, a state estimator can be defined as a data processing algorithm used to convert redundant measurement data and other available data of the power system into an accurate estimate of the system state. According to the power flow model used in the representation, three main state estimators have been developed: AC, decoupled and DC state estimators. Most of the related work in the field of FDIA focuses on DC state estimators, which are widely used in daily power system operation due to their low computational burden. However, the accuracy of DC current analysis is closely related to the specific situation. Under certain conditions, DC state estimators will bring inaccurate results for critical power flows. In addition, with the continuous improvement of the computing power of modern computers, the advantages of using DC state estimators over AC state estimators in terms of computational burden may become negligible. Therefore, the present invention adopts a state estimator based on the AC power flow equation.

[0192] Where z=(z 1 ,z 2 ,…,z m ) T is the measurement vector, x=(x 1 ,x 2 ,…,x n ) T is the state vector, h is the nonlinear vector function between the measured value and the system state, e=(e 1 ,e 2 ,…,e m ) T is the random measurement error vector, with a Gaussian distribution with mean 0, and the corresponding variance matrix

[0193] Furthermore, the state estimation problem in step 3) is usually solved in the form of an overdetermined (m>n) weighted least squares problem, and its mathematical expression is:

[0194]

[0195] After applying the first-order optimality condition to the performance indicator J(x), a Gauss-Newton iteration scheme is generated, resulting in the system state The best estimate of .

[0196] The weighted least squares method assumes that the measurement errors follow a Gaussian distribution. However, since the power system is a dynamic environment with a large number of uncontrollable influencing factors, it is not uncommon for large errors in the input data to occur. In order to cope with the emergence of bad data, a variety of different BDD techniques have been developed. The most commonly used BDD technique relies on the analysis of the residual vector r. After determining the optimal estimate of the system state, the residual vector r = (r 1 ,r 2 ,…,r m ) T It can be determined as follows:

[0197]

[0198] Measurements affected by high noise, reverse polarity or instrument failure are characterized by high residual values ​​and can therefore be easily identified and excluded from the state estimation process.

[0199] FDIA can be defined as a situation where an adversary changes one or more meter readings, thereby changing the estimated values ​​of the system state variables. FDIAs can be either random or targeted. In a random attack, the adversary injects arbitrary errors into the estimates of the state variables, while in a targeted attack, specific errors are injected into the estimates of specific state variables. However, the more important classification is based on the adversary's knowledge of the system before conducting the attack. Therefore, FDIA can be complete or incomplete. As the name suggests, in a complete FDIA, the adversary has complete knowledge of the power system. Complete FDIAs are more critical than incomplete FDIAs because they lead to inaccurate estimates of the system state while bypassing traditional residual-based BDD techniques. This may cause the system operator to take control actions that may jeopardize the safe operation of the power system. Due to their hidden nature, this type of FDIA is often called "stealth."

[0200] However, the assumptions about the adversary knowledge and capabilities required to launch a covert FDIA seem strong. The coordinated cyberattack that caused the blackout was achieved through a carefully planned series of multiple attacks that served as decoys while the adversary organization hijacked the SCADA system. The mathematical model for the stealth FDIA for state estimation is as follows.

[0201] let represents the measurement data set z that is corrupted by processing a = z + a determined system state estimate. Attack vector a = (a 1 ,a 2 ,…,a m ) T represents the measurement deviation caused by FDIA. Under FDIA, the residual vector can be determined as

[0202]

[0203] This is usually different from a normal residual vector. However, if the attack vector has the following structure:

[0204]

[0205] Compared with normal situation (r a = r), the residual vector remains unchanged. In other words, when the nonlinear vector function h(·) and the system state estimate When the adversary is aware of the error, it can bypass the traditional residual-based BDD technique and construct an attack vector to obtain an incorrect estimate of the system state.

[0206] The performance of two groups of FDIA detection methods, namely machine learning and deep learning methods, is discussed on a simple custom case. The analyzed test system is a simple dual-bus system with a synchronous generator supplying power to the user through a short power line. In addition to this, the user has installed a wind turbine to supply part of its load, which varies according to the actual load curve. In addition, a realistic power generation curve is assigned to the wind turbine. The simulated 3-month time resolution is 5 minutes and the dataset is about 25,000 samples, each representing a state vector generated during the state estimation process. During the entire 3-month period, the invisible FDIA is randomly executed, where about a part of the samples are corrupted. Among the machine learning methods, three commonly used techniques are considered, namely SVM, KNN, and Random Forest (RF).

[0207] As shown in Table 1, in the absence of wind power generation, SVM, KNN, and RF are able to detect attacks with high accuracy. The same is true for the deep learning techniques of LSTM and GRU. However, in the case where wind power generation does not exceed the load active power, the performance of the machine learning detection methods drops significantly, while the deep learning methods show excellent performance.

[0208] Table 1 Detection rate of false data injection attack

[0209]

[0210] The accuracy of the analytical method is further affected by the higher complexity and frequent topological changes of real-world power systems. In addition, the performance of the analytical method depends on the installed capacity of renewable energy. With the transition to renewable energy and the realization of global goals to reduce the carbon footprint of the power industry, it is clear that existing machine learning methods are an unreliable solution for detecting FDIA in modern power systems, while deep learning methods appear to be more robust.

[0211] Step 3.4: Introduce residual blocks to solve the gradient vanishing problem and optimize the training process of the false data injection attack detection model;

[0212] The introduction of residual blocks to solve the gradient vanishing problem includes: the residual block sends the output of the causal convolution layer deep into the network, allowing the input to bypass the dilated convolution operation, and then adds the shortcut connection and the dilated convolution output together to form the output of the entire residual block.

[0213] In this embodiment, the residual block allows the gradient to pass directly during the back propagation process by introducing a skip connection. This helps solve the gradient vanishing problem in deep networks, allowing the model to be better trained and maintain higher accuracy. Residual block design: The dilated causal convolution is integrated into the residual block, and a residual block is constructed using two dilated causal convolution layers and a skip connection. In this way, the output not only includes the features after the dilated convolution, but also retains the features of the original input, thereby further improving the stability of the model.

[0214] Step 3.5: Select the best hyperparameter combination through random search method to train and verify the false data injection attack detection model.

[0215] Hyperparameters include optimizer type, learning rate, batch size, and false data injection attack detection model depth.

[0216] In this embodiment, cross-validation is used to adjust hyperparameters, such as the number of filters in the convolutional layer, the dilation factor, the number of hidden units in the RNN layer, and the learning rate. Model evaluation and validation: Model evaluation: Use the validation set to evaluate the performance of the model and calculate the loss and accuracy of the model on the validation set. Adjust the hyperparameters of the model to optimize its performance.

[0217] In this embodiment, the construction of the false data injection attack detection model specifically includes:

[0218] 1. Data preprocessing: Data collection: Collect historical data and real-time data from the power system, including various sensor data such as voltage, current, and power. Data cleaning: Process missing values ​​and noisy data to ensure the quality of input data. Data standardization: Normalize or standardize the data to eliminate the dimensional differences between different data dimensions and promote rapid convergence of the model.

[0219] 2. Construct dilated causal convolution layer: Convolution design: Design dilated causal convolution layer to extract local temporal features of input data. Dilated causal convolution is a convolutional neural network that can capture longer temporal dependencies with fewer parameters through dilation factor while maintaining causality. Convolution configuration: Select appropriate convolution kernel size and dilation factor to cover the temporal range of input data. Use multiple layers of dilated causal convolution to extract features at a deeper level while maintaining the causality of temporal data. Feature extraction: Extract local temporal features through dilated causal convolution layer.

[0220] 3. Build a recursive neural network layer: RNN selection: Build a recursive neural network layer on the extracted time series features. You can choose variants such as LSTM (Long Short-Term Memory Network) or GRU (Gated Recurrent Unit). Time series feature capture: Use RNN to process the features of the dilated causal convolution output to capture deeper time series dependencies in the data. Multi-layer structure: You can build a multi-layer RNN to further enhance the modeling ability of complex time series dependencies.

[0221] 4. Model integration and output: Model integration: Integrate the output features of the dilated causal convolution and RNN. A fully connected layer can be used to map the extracted features to the final attack detection results. Classifier design: Design a classifier to output the detection results of the false data injection attack. You can use the Softmax function for multi-classification output, or the Sigmoid function for binary classification output (with or without attack).

[0222] 5. Model training: Loss function: Select an appropriate loss function (such as cross entropy loss) and define the optimization target. Optimizer: Use a suitable optimizer (such as Adam, SGD, etc.) to train the model and adjust the model parameters to minimize the loss function. Training process: Perform model training and supervise learning using historical data and labels. Use cross-validation or leave out validation sets to evaluate the performance of the model and adjust hyperparameters to improve the detection accuracy and robustness of the model.

[0223] 6. Model testing and verification: Model testing: Evaluate the performance of the model on the test data set, especially focusing on the accuracy, recall and F1 score of the model in the actual scenario. Model verification: Verify the model to ensure its effectiveness and stability under different attack types and different power system conditions.

[0224] 7. Model deployment and application: Real-time monitoring: Deploy the trained model to the real-time monitoring platform of the power system to detect in real time whether there is a false data injection attack. Alarm system: Design an alarm mechanism based on the model output to notify the operator to take countermeasures in a timely manner. System maintenance: Update the model regularly, and use the newly collected data to retrain or fine-tune the model to adapt to changes in the power system.

[0225] In one embodiment of the present invention, in step 3, the status of the distribution system includes normal operation, power imbalance, voltage anomaly, frequency anomaly, topology error identification, line overload, disguised fault, economic dispatch failure, energy management anomaly, reduced transient stability of the power grid, false safety situation awareness and control strategy failure.

[0226] Step 4: Determine the attack behavior based on the status of the power distribution system analyzed in step 3.

[0227] In one embodiment of the present invention, in step 4, judging the attack behavior according to the analyzed state of the power distribution system includes: establishing a corresponding relationship between the attack behavior and the state of the power distribution system, and obtaining the attack behavior according to the analyzed state of the power distribution system. In this embodiment, the corresponding relationship between the state of the power distribution system and the attack behavior is described as follows:

[0228] Power imbalance, status description: The balance condition of active power or reactive power in the system is broken, resulting in a serious imbalance in power supply and demand at some nodes. Corresponding attack behavior: The attacker injects false load or power generation data, causing the distribution system to mistakenly believe that some areas need to increase or decrease power, thereby causing local power imbalance. This may cause voltage fluctuations, frequency anomalies, or load tripping.

[0229] Abnormal voltage, status description: Abnormal voltage occurs at some nodes in the system, such as voltage that is too high, too low, or fluctuates violently. Corresponding attack behavior: The attacker forges node voltage measurement data and induces the control system to make incorrect dispatch decisions, such as improperly adjusting reactive power, resulting in abnormal voltage. This may cause equipment damage or affect the stability of the power system.

[0230] Frequency anomaly, status description: The power system frequency deviates from the normal value, and frequency fluctuation or frequency drift occurs. Corresponding attack behavior: The attacker may inject false data to make the system mistakenly believe that power generation or load has changed, thereby triggering improper frequency regulation measures. This may cause system frequency instability or even cause system crash.

[0231] Topology misidentification, status description: The system mistakenly believes that the network topology has changed, such as line disconnection or new line access. Corresponding attack behavior: The attacker modifies the data of the circuit breaker status or line switch status, causing the system to misidentify the current topology. This behavior may cause the system to take incorrect scheduling measures in emergency situations, affecting power supply reliability.

[0232] Line overload, status description: Some transmission lines or distribution lines are overloaded, exceeding the current or power limit for safe operation. Corresponding attack behavior: The attacker tampers with the line load data or power flow data, causing the system to think that some lines have low loads, while the actual loads are high. This may result in failure to take load limiting or adjustment measures in a timely manner, ultimately causing line overload.

[0233] Fake fault, status description: The system mistakenly believes that a device failure has occurred, such as a generator failure or transformer failure. Corresponding attack behavior: The attacker forges the device status or the alarm signal of the protection device, causing the system to misjudge the device failure and trigger unnecessary protection actions, such as disconnecting the line or equipment. This fake fault may cause power outages or instability in some areas of the power grid.

[0234] Economic dispatch failure, state description: The optimization goal of economic dispatch of the power grid has not been achieved, and the dispatch result deviates from the optimal economic state, resulting in increased power generation costs or reduced operating efficiency. Corresponding attack behavior: The attacker tampers with the cost function or generator status information, causing the system to mistakenly believe that the operating cost of some generators or power sources is lower or higher, thereby affecting the accuracy of economic dispatch. This attack may increase the operating cost of the power system.

[0235] Energy management anomaly, status description: The energy management system (EMS) shows abnormal energy allocation results, which may lead to unbalanced power supply or energy storage scheduling. Corresponding attack behavior: The attacker injects false measurements to make the EMS incorrectly allocate energy, such as incorrectly scheduling energy storage systems or distributed generation resources. This anomaly may reduce the overall operating efficiency of the power system and increase energy losses.

[0236] The transient stability of the power grid is reduced. Status description: The system exhibits unstable transient behavior after encountering a disturbance, such as continuous oscillation or rapid voltage drop. Corresponding attack behavior: The attacker forges dynamic state data (such as rotor angle, speed, etc.) to induce the system to make an incorrect response, thereby affecting transient stability. Especially in emergency situations, this attack may aggravate the instability of the system.

[0237] False security situation awareness, status description: The system security situation awareness function displays a "safe" status, but there are actually potential serious threats. Corresponding attack behavior: The attacker injects carefully designed false data to make the situation awareness system fail to identify certain potential risks or identify them as low risks. This behavior may cause the system to fail to respond in time when the actual threat comes, resulting in serious consequences.

[0238] Control strategy failure, status description: The system cannot effectively execute the predetermined control strategy, or the control strategy execution result is contrary to expectations. Corresponding attack behavior: The attacker may modify the control input data or control output data to cause the actual control measures to fail or be executed incorrectly. For example, in the automatic voltage control (AVC) or automatic generation control (AGC) process, false data may cause the control strategy to fail or be executed in reverse, thereby causing system operation problems.

[0239] In one embodiment of the present invention, by applying dilated causal convolution and recursive neural network, using dilated causal convolutions and recursive neural networks (such as LSTM and GRU) to perform deep learning analysis on system status also includes:

[0240] 1) Data preparation: Data collection and preprocessing: Collect time series data from the target system, which may include sensor data, state variables, control inputs, etc. Perform data cleaning and handle missing values, outliers, noise, etc. Normalize or standardize the data to ensure that the data range is consistent, thereby improving the convergence speed and prediction accuracy of the model. Data segmentation: Divide the data into training set, validation set and test set, usually with a split ratio of 70% training set, 15% validation set, and 15% test set.

[0241] 2) False Data Injection Attack Detection Model Selection and Architecture Design: Dilated Causal Convolutions: Dilated causal convolutions are a special type of convolution that allows the model to expand the receptive field without increasing computational complexity. It is suitable for processing time series data with long-term dependencies. Dilated causal convolutions can be applied on the time dimension of the input data to capture long-range dependencies.

[0242] 3) Recurrent Neural Network (RNN) and its variants (LSTM / GRU): LSTM (Long Short-Term Memory) and GRU (Gated Recurrent Unit) are improved versions of RNN, specifically designed to handle long dependencies in sequence data. LSTM / GRU can be used to further extract temporal patterns in the sequence after the data has been subjected to dilated causal convolution.

[0243] 4) False data injection attack detection model construction and training: Model architecture: Build a combined model that combines dilated causal convolution and LSTM / GRU. First, extract features through the dilated causal convolution layer, and then pass the features to the LSTM / GRU layer for time series modeling. Loss function and optimizer: Select an appropriate loss function (such as mean square error MSE or cross entropy loss) and optimizer (such as Adam or RMSprop). Regularization measures should be considered when designing the model to avoid overfitting. Hyperparameter adjustment: Adjust hyperparameters such as the number of filters in the convolution layer, the dilation factor, the number of hidden units in the RNN layer, and the learning rate through cross-validation. Model evaluation and verification: Model evaluation: Use the validation set to evaluate the performance of the model and calculate the loss and accuracy of the model on the validation set. Adjust the hyperparameters of the model to optimize its performance. Interpretability analysis: Analyze the outputs of the dilated causal convolution and LSTM / GRU layers to understand how the model captures the key patterns in the system state. Model testing and deployment: Test set verification: Use unseen test set data to evaluate the generalization ability of the model. Ensure that the model can maintain good performance in practical applications.

[0244] 5) Model deployment: Deploy the model to the actual system for real-time monitoring and prediction. The model can be further fine-tuned based on the feedback from the system. Continuous learning: After deployment, the performance of the model is continuously monitored and the model is updated regularly to adapt to changes in the system status. These technologies can process time series data, detect invisible attacks, and improve the ability to respond to complex attack patterns;

[0245] 6) Combining WLS-based state estimation with deep learning. Based on the traditional weighted least squares (WLS) state estimation method, it is improved by combining it with a deep learning algorithm. Based on the measurement data and deep learning model, the state of the distribution system is estimated more accurately, thereby improving the detection and prevention capabilities of false data injection attacks.

[0246] In one embodiment of the present invention, dilated causal convolution is the backbone operation of WaveNet. By diluting the use of standard convolution kernels to perform spatial and temporal information extraction (1×1), the diluted convolution increases the receptive field of the convolution operation, allowing the learning process to capture long-term dependencies without increasing the amount of computation; stacked dilated convolutions allow the network to have a very large receptive field with only a few layers while maintaining the input resolution and computational efficiency of the entire network; in this embodiment, the same dilation factor as the original architecture is used, while the depth is increased to 10 layers, that is, the dilation factor of each layer is doubled until the set maximum value is reached, and then repeated cyclically (for example, 1,2,4,...,512,1024; 1,2,4,......,512,1024). This configuration exponentially increases the dilation factor, causing the receptive field to grow exponentially with depth. In addition, compared with ordinary convolution operations, dilated convolutions can capture compact representations in hierarchical structures. For example Figure 3 As shown in , each input passes through a different hidden unit in each expansion layer, so that the model has a diverse learning representation. Figure 3 As shown, each layer skips one step, allowing past time steps to be computed in parallel and modeling short-term and long-term dependencies with a dilation rate of 2 as the layer depth increases.

[0247] On the other hand, causal convolution ensures that the network does not violate the input order, because the output prediction depends entirely on the previous time step. The present invention uses 32 filters to perform causal convolution on each time step to create a dense representation of each time step in a high-dimensional space. In addition, each dense sequence is regarded as an attack sequence or a normal sequence, where the prediction value issued by the false data injection attack detection model at the time step with a sequence length equal to k is p(y t ∣x t-k ,x t-k+1 …,x t ).

[0248] The hierarchy of diluted causal convolutions mimics the sequence processing capabilities of RNNs, LSTMs, and GRUs because their outputs have a fairly large receptive field without the need for additional computation. WaveNet is very similar to LSTMs and GRUs because there are two gates after the dilated convolution, an activation gate and a binary gate, similar to the two gates of LSTM, the Tanh "gate is similar to the input update gate, and the "Sigmoid" gate is similar to the forget gate, however, since LSTMs need to backpropagate through a large number of steps, which can lead to problems such as gradient vanishing, dilated convolutions are considered a better approach, so training dilated convolutions is much simpler. In addition, a major difference between RNNs and dilated convolutions is the shared parameters in the RNN architecture, that is, the same parameters are used in each time step; while in dilated convolutions, a set of parameters will change in different time periods of the input time series data, with different filters, which can be understood as different representations of the same time interval, which helps the network capture different attack changes.

[0249] Gradient vanishing is a major problem in deep neural networks. The gradients of early blocks in the network will disappear as more blocks are stacked later. Residual blocks are used to send the output of the causal convolution layer deep into the network, thus solving the problem of gradient vanishing. This shortcut connection allows the input to bypass the dilated convolution operation, and then the shortcut connection and the dilated convolution output are added together to form the output of the entire residual block, thereby facilitating the back propagation of gradients throughout the network. Residual blocks can alleviate the gradient vanishing problem, accelerate and stabilize training, and in addition, residual connections pass the original input information, which helps the convergence of the deep network training process.

[0250] Due to the complexity of the dataset, the original WaveNet architecture was adjusted, such as Figure 4 As shown in Figure 2, the proposed fake data injection attack detection model has three different internal branches within the residual block to capture different ranges of inter-feature dependencies. Each branch has dilated convolution kernels of different sizes: 3, 6, and 9, respectively. Figure 2 Shown is a dilated causal convolution with kernel size 3.

[0251] Furthermore, in step 3), several hyperparameters are considered to effectively train the proposed model, namely: optimizer type, learning rate, batch size, model depth and sequence size; the tuning process starts with initializing the weights using Glorot uniform distribution. According to the convergence of the training process and the probability of overfitting, the optimal number of epochs is set to 30. During the tuning process, five different optimizers are considered, namely Adam, AdaGrad, AdaDelta, RMSprop and SGD; the possible learning rates are set to 10 -2 , 10 -3 , 10 -4and 10 -5 , batch sizes are 16, 32, 64, 128, and 256 respectively; model depth varies from 9 to 16, with a step size of 1; candidate sequence sizes are 4, 8, 16, 32, and 64 respectively; after defining the search space, a random search method is used to create possible combinations and select the best hyperparameter combination to train and validate the model; this method saves time and memory, and is more controllable than using a grid search to test each hyperparameter value combination; test results show that the best performing optimizer is Adam, with a learning rate of 10 -4 , the batch size is 128, the sequence size is 32, and the depth (number of blocks) is 10.

[0252] The test system used to verify the proposed method is a modified version of the IEEE 14-bus system, e.g. Figure 5 shown.

[0253] The partition load data provided by NYISO has a resolution of 5 minutes, so there are 288 samples in 24 hours; the deep learning model used requires a larger training data set to achieve peak performance. Therefore, the present invention uses the partition load data from the first three months of 2019 for training and verification, and obtained 25,920 samples, of which training data and verification data each account for half. The data set is split to ensure that the model is tested on unseen data to prove its generalization ability and to ensure that overfitting does not occur. In addition, the amount of data generated is sufficient to prevent overfitting that may occur when training complex models. The partition load data is normalized using the peak load of each partition and scaled according to the rated active and reactive power requirements of each load to keep the system close to its rated operating state.

[0254] In addition to the above modifications, renewable energy sources are added to different buses to analyze the impact of renewable energy generation on the detection rate and accuracy of the developed model. The renewable energy generation curves for the three-month period are also extracted from the generation portfolio provided by the New York Information Systems Office with a resolution of 5 minutes; Figure 2 The figure shows a schematic diagram of the penetration of renewable energy. Specifically, the bus with the largest change in system state after connecting renewable energy is selected. The reason for adopting this method is that the introduction of fluctuating wind and solar power generation will cause a large change in the system state. Therefore, the expected range of the system state increases, which means that the state affected by FDIA may still be within the expected value range, making it difficult for existing models to detect the attack, that is, the connection method of RES increases the spatiotemporal complexity of the system state; sensitivity analysis is used to determine the bus with the greatest impact on the power system; the analysis results show that busbars 8, 11, 12 and 14 are key busbars, which will be used as connection points for renewable energy.

[0255] Figure 6It is a flow chart of the false data injection attack detection method in the embodiment of the present invention; the first step is to use the system data of the demand and power generation curves, the demand curve: the demand curve (Load Curve) is a curve that describes the load demand changes of the power system within a certain period of time. It usually takes time as the horizontal axis and load (power) as the vertical axis to show the power demand at different time points. Main content: Peak load: It indicates the maximum load demand of the system at a certain moment, which is the highest demand that the power system must meet. Peak load usually occurs during the peak power consumption period during the day or evening. Valley load: It indicates the minimum load demand of the system at a certain moment, which generally occurs during the low valley period at night. Daily load change: By observing the demand curve, the change law of load demand within a day can be analyzed, and the peak, flat peak and low valley periods can be identified. Load growth trend: Through the demand curves of multiple days or months, the growth or decrease trend of load demand can be analyzed to help formulate future power supply plans. Power generation curve: The power generation curve (Generation Curve) shows the changes in power generation of various power generation units in the power system within a certain period of time. This curve also takes time as the horizontal axis and power generation as the vertical axis, reflecting the power generation capacity of the system and its scheduling. Main content: Total power generation: The total power generation of the system at a certain moment or in a certain period of time, which can be obtained by summing the power generation of various types of generators. Power generation structure: The power generation curve can be subdivided into different types of power generation curves, such as thermal power, nuclear power, hydropower, wind power, photovoltaic power, etc., reflecting the power generation energy structure of the system. Peak shaving capacity: By observing the changes in the power generation curve, especially the ability to increase power generation during peak hours, the peak shaving capacity of the power system, that is, the ability to cope with load fluctuations, can be judged. Reserve capacity: The difference between the power generation curve and the demand curve represents the reserve capacity, which is used to cope with emergencies such as sudden load increase or generator failure. Proportion of clean energy generation: Through the proportion of various types of power generation, we can see the proportion of clean energy (such as wind power and photovoltaic power) in the total power generation, which reflects the sustainable development capacity of the system. Power flow analysis is performed to determine the measurement values ​​required for state estimation; after determining the measurement values, a Gaussian noise vector with a mean of zero and a standard deviation of 0.02 is added to the measurement values ​​to simulate the inevitable measurement errors. The noise measurement results are sent to the state estimator to provide the final estimation results of the system state. To change the perspective of a certain state, the adversary must be able to manipulate all the measurement values ​​related to the state. Assuming this is true, after the state estimation, only the value of a certain state needs to be changed to simulate FDIA; determine whether the system data has completed power flow analysis, state estimation, and false data injection. The model is the false data injection attack detection model developed by the present invention. The ability of the discussed method to detect attacks is analyzed, which are manifested as a 10% decrease in the system state (θ 2 ,θ 3 ,…,θ N ,V1 ,V 2 ,…,V N ) and several scenarios where multiple attacks occur simultaneously. The same attack scenarios are considered for all case studies, with FDIAs conducted every five days. To ensure that both peak and non-peak load conditions are considered, attacks are conducted randomly between 1-6am, 12-5pm, or throughout the day. A complete dataset consisting of 25,920 system state observations is used to train and validate the performance of the analysis methods; power system simulations, including power flow analysis, state estimation, and FDIAs simulations, are performed in MATLAB. On the other hand, the benchmark detection techniques and the proposed methods are implemented using Keras, a top-level library built on TensorFlow; all experiments are performed on a workstation equipped with an Nvidia K-80 GPU and 16GB of memory.

[0256] At the same time, the present invention realizes a false data injection attack detection system, including a measurement data acquisition module, an attack sequence construction module, an attack detection model construction module and a system status judgment module:

[0257] A measurement data acquisition module, used to acquire measurement data of the power distribution system;

[0258] An attack sequence construction module is used to construct an attack sequence and inject the constructed attack sequence into the acquired measurement data to simulate the injection of false data to attack the distribution system;

[0259] The attack detection model building module builds a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the status of the distribution system injected with false data attacks;

[0260] The system status judgment module judges the attack behavior based on the obtained status of the power distribution system.

[0261] The specific implementation methods of the present invention are not exhaustive and do not constitute a limitation on the scope of protection of the claims. Based on the inspiration obtained from the embodiments of the present invention, those skilled in the art can think of other substantially equivalent alternatives without creative work, all of which are within the scope of protection of the present invention.

[0262] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0263] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0264] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0265] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0266] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting false data injection attacks in a power system, characterized in that: The method comprises the following steps: Step 1: Obtain measurement data of the power distribution system; Step 2: Construct an attack sequence and inject the constructed attack sequence into the measurement data obtained in step 1 to simulate the injection of false data to attack the distribution system; Step 3: Build a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the state of the distribution system attacked by injecting false data in step 2; Step 4: Determine the attack behavior based on the status of the power distribution system analyzed in step 3.

2. The false data injection attack detection method according to claim 1, characterized in that: In step 1, the measurement data of the power distribution system includes real-time measurement data, pseudo measurement data and virtual measurement data; The real-time measurement data includes real-time voltage, real-time current and power measurement data from distribution automation systems, SCADA systems, smart meters and smart electronic devices; The pseudo measurement data includes pseudo power on the feeder bus; The virtual measurement data includes zero voltage drop in enclosed switchgear, zero power flow, and zero bus injection measurements at switchyard nodes.

3. The false data injection attack detection method according to claim 1, characterized in that: In step 2, the attack sequence construction formula is as follows: Where a represents an attack vector; c represents a non-zero vector, Represents the distribution system measurement data, represents the measurement function of the power distribution system, Represents the measurement function of the power distribution system after being attacked.

4. The false data injection attack detection method according to claim 3 is characterized in that: In step 2, the constructed attack sequence is injected into the measurement data of the distribution system to simulate the false data injection attack, including constructing false data according to the following formula: from bad =z+a Where z represents the measured data of the power distribution system, z bad Indicates false data.

5. The false data injection attack detection method according to claim 1, characterized in that: In step 3, a false data injection attack detection model is constructed based on dilated causal convolution and recurrent neural network to analyze the state changes of the distribution system, including: Step 3.1: Use dilated causal convolution to capture long-term dependencies. Use 32 filters to perform causal convolution on the measurement data injected with false data at each time step to create a dense sequence at each time step. The dense sequence includes attack sequences or normal sequences. Step 3.2: Create memory based on recurrent neural network; predict the next state of the power system by creating memory and using previous inputs and outputs; Step 3.3 uses the output of the recurrent neural network as the input of the least squares method to estimate the state of the distribution system; Step 3.4 introduces residual blocks to solve the gradient vanishing problem and optimize the training process of the false data injection attack detection model; Step 3.5: Select the best hyperparameter combination through random search method to train and verify the false data injection attack detection model.

6. The false data injection attack detection method according to claim 5, characterized in that: In step 3.1, dilated causal convolution is used to capture long-term dependencies including: Extraction of spatial and temporal information is performed using standard convolution kernels through dilution; Each time step is causally convolved separately using 32 filters to create a dense representation of each time step in a high-dimensional space.

7. The false data injection attack detection method according to claim 5, characterized in that: In step 3.3, the output of the recursive neural network is used as the input of the least square method to estimate the state of the distribution system, including solving the state estimation of the distribution system according to the following formula: Among them, J(x) is the objective function, z i is the ith measurement value, z is the observation vector containing all m observations, and h i (x) is the predicted value of the ith measurement, x is the state vector, σ i is the standard deviation of the ith measurement. W is the weight matrix, σ i =(0.02a+0.0052b) / 3, a is the measured value, b is the full scale value.

8. The false data injection attack detection method according to claim 5, characterized in that: In step 3.4, the residual block is introduced to solve the gradient disappearance problem, including: The residual block feeds the output of the causal convolutional layer deep into the network, allowing the input to bypass the dilated convolution operation, and then adds the shortcut connection and dilated convolution output together to form the output of the entire residual block.

9. The false data injection attack detection method according to claim 5, characterized in that: In step 3.5, the hyperparameters include optimizer type, learning rate, batch size, and false data injection attack detection model depth.

10. A false data injection attack detection system using the method according to any one of claims 1 to 9, comprising a measurement data acquisition module, an attack sequence construction module, an attack detection model construction module and a system status judgment module, characterized in that: A measurement data acquisition module, used to acquire measurement data of the power distribution system; An attack sequence construction module is used to construct an attack sequence and inject the constructed attack sequence into the acquired measurement data to simulate the injection of false data to attack the distribution system; The attack detection model building module builds a false data injection attack detection model based on dilated causal convolution and recurrent neural network to analyze the status of the distribution system injected with false data attacks; The system status judgment module judges the attack behavior based on the obtained status of the power distribution system.

11. A terminal comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is configured to operate according to the instructions to execute the steps of the method according to any one of claims 1-9.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the method according to any one of claims 1 to 9 are implemented.

Images