Power system network attack multi-stage detection method and device based on topology switching

Abstract

The application belongs to the technical field of attack detection, and more particularly relates to a power system network attack multi-stage detection method and device based on topology switching. The method comprises the following steps: defining a detection capability quantitative index, deducing a detection capability evaluation matrix; based on the matrix, evaluating the influence of line switching on the detection capability; establishing a multi-stage topology switching optimization model, maximizing the detection capability while reducing the power generation cost; constructing a topology switching-D-FACTS device joint mobile target defense framework in which line switching is performed after electric reactance disturbance; solving the optimization model to determine the transmission line set disconnected in each stage, performing topology switching operation according to the optimization result, and updating the matrix rank to realize attack detection. The application maximizes the detection capability while minimizing the power generation cost, and cooperates with the mobile target defense based on D-FACTS to break through the detection limit of a single method, and can also achieve the detection upper bound in a system in which the D-FACTS device fails to cover all the required lines.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of attack detection, and more particularly to a power system network attack multi-stage detection method and device based on topology switching. BACKGROUND

[0002] Modern power grids as a key cyber-physical system (CPS) are facing growing cyber-attack threats, among which false data injection attacks (FDIAs) have been extensively studied in the past decade. Attackers can bypass traditional bad data detection (BDD) mechanisms by stealthily manipulating sensor measurements or control commands, leading to false state estimation, misleading system operation decisions, and even triggering catastrophic cascading failures. Traditional static defense strategies rely on fixed network configurations and deterministic anomaly detection mechanisms, which are increasingly vulnerable to adaptive adversaries capable of reverse-engineering system network configurations. This inherent limitation has prompted the adoption of mobile target defense (MTD), which, as an active defense means, reduces attack surfaces by dynamically adjusting system parameters and constantly changing system states.

[0003] Chinese patent document CN117220972A discloses a multi-stage power grid mobile target defense dynamic response method. The method first obtains the maximum detection capability of the mobile target defense of the power system based on the D-FACTS device; generates a multi-stage MTD scheme corresponding to the power system based on the obtained maximum detection capability of the mobile target defense of the power system based on the D-FACTS device; and applies the detection capability corresponding to the obtained multi-stage MTD scheme to the power grid false data injection attack detection of the power system at a set initial detection frequency.

[0004] Existing power system mobile target defense research mainly focuses on the parameter perturbation level, while few involve the topology switching level. Most current work focuses on achieving parameter perturbation through D-FACTS devices. By changing the impedance of the line in a random manner, the attacker's prior knowledge of the system admittance matrix becomes invalid, thereby interfering with the attacker's ability to construct a stealthy FDIA. Although it is very promising in theory, there are some key challenges in implementing mobile target defense (MTD) based on D-FACTS devices in power systems: (1) If the power system is upgraded to support mobile target defense design, the installation of D-FACTS devices will be affected if the original system has a high line device density, and full coverage of the required lines cannot be achieved. (2) If the coverage of the line D-FACTS devices required to achieve the detection upper bound is not achieved, the detection capability will be severely affected, making the system vulnerable to attacks by attackers. SUMMARY

[0005] The present application aims to overcome at least one of the above-mentioned defects of the prior art, and provides a power system network attack multi-stage detection method based on topology switching, which innovatively models the multi-stage topology switching as an optimization problem, maximizes the detection capability while minimizing the power generation cost, and cooperates with the D-FACTS-based mobile target defense to break through the detection limit of a single method, and can achieve the upper bound of detection in a system where the D-FACTS device fails to cover all required lines.

[0006] The present application also discloses a device loaded with a power system network attack multi-stage detection method based on topology switching.

[0007] The detailed technical solutions of the present application are as follows:

[0008] A power system network attack multi-stage detection method based on topology switching, the method comprising:

[0009] S1, defining a detection capability quantitative index, evaluating the attack space based on the dimension of the intersection of the measurement matrix array space, and deriving a detection capability evaluation matrix ;

[0010] S2, based on the matrix, evaluating the influence of line switching on the detection capability;

[0011] S3, establishing a multi-stage topology switching optimization model, taking minimizing the power generation cost as an optimization problem, maximizing the detection capability while reducing the power generation cost; the constraint conditions of the model include node power balance constraint, line phase angle difference constraint, line connectivity constraint, line disconnection number constraint, line power flow limit constraint, and generator output limit constraint;

[0012] S4, constructing a topology switching-D-FACTS device joint mobile target defense framework of first performing reactance disturbance and then performing line switching;

[0013] S5, solving the optimization model to determine the set of transmission lines disconnected at each stage, performing topology switching operation according to the optimization result, and updating the rank of the matrix to realize attack detection.

[0014] According to the present application, the specific steps of step S1 are as follows:

[0015] The relationship between the measurement vector and the state variable can be represented as a linear equation:

[0016] (1)

[0017] wherein is the measurement vector, is a measurement matrix determined by the power grid topology structure and the line admittance, and the dimension is , is the number of lines, n is the number of stages except the reference node; is the measurement error, and the measurement errors are independent and subject to Gaussian distribution; is the state vector describing the phase angles of each node in the power system. The matrix can be decomposed as:

[0018] (2)

[0019] wherein, is a diagonal matrix whose diagonal elements are line impedances; the matrix is the incidence matrix of the power grid topology, whose rows represent buses and columns represent branches, and contains elements , element is 1 when bus is the starting node of line , is -1 when bus is the ending node of line , and is 0 otherwise; the matrix is the matrix obtained by removing the corresponding row of the reference bus, and the superscript T is the transpose operation;

[0020] Given a multi-stage mobile target defense (MTD) with a measurement matrix and an original matrix , the column space intersection is denoted as , and the dimension of the column space intersection reflects the detection capability of the multi-stage MTD scheme. The smaller the intersection dimension, the more limited the potential attack space dimension that the attacker can implement;

[0021] The detection capability evaluation matrix is defined as follows , which represents the dimension of the column space intersection, i.e., the size of the attack space, and is specifically as follows:

[0022] The matrix composed of the null space basis vectors of the matrix is , and we have: or equivalently ; therefore, if the attack vector satisfies , is the state variable injected by the attacker, then ; for a multi-stage MTD with t measurement matrices, the matrix , wherein represents the matrix composed of the null space basis vectors of the matrix , and the matrix needs to satisfy:

[0023] (3)

[0024] The attack space dimension is represented by the rank of the matrix , which reflects the detection capability of the multi-stage MTD.

[0025] According to the application, in the step S2, the influence of the line switching on the detection capability is evaluated based on the matrix The specific steps are as follows:

[0026] S21, the matrix corresponding to the topology change is found , and the specific steps are as follows:

[0027] The matrix is decomposable, and the row vector represents the basic loop of the system, The null space basis matrix is defined by the following conditions:

[0028] (4)

[0029] wherein is the basis of the null space, and let , then the equation is simplified as , which means Therefore can be expressed as a linear combination of the incidence matrix The null space basis matrix is: Thus, it is derived that: , that is, ;

[0030] S22, the influence of the line topology switching on the detection capability, i.e., the rank of the matrix , is derived:

[0031] The matrix is composed of the null space basis of the incidence matrix , which is called the basic loop matrix, and each column represents a basic loop, and the dimension is ; in the multi-stage topology switching MTD, the physical meaning changes, and a new loop matrix is formed after the topology switching, which represents the remaining basic loop and the unit vector corresponding to the behavior 1 of the corresponding switching line;

[0032] The specific operation of the topology switching is as follows: for a given load curve within stages, the topology is switched by disconnecting or connecting the line, in order to maintain the consistency of the dimension of the measurement matrix, the operation of disconnecting the line corresponds to setting the corresponding row of the measurement matrix to zero, i.e., clearing the corresponding column, and the matrix The system branch, the zero corresponding column after getting , Solve the equation Get:

[0033] (5)

[0034] Where Can take any value, the corresponding base is a unit vector , The remaining part corresponds to the basic loop of the disconnected line subgraph, and its base is denoted as Therefore ;

[0035] The rank of the matrix Is:

[0036] (6)

[0037] Therefore, the disconnected line increases the rank of the matrix by adding a unit vector To the matrix.

[0038] According to the preferred embodiment of the present application, in order to ensure the connectivity of the system, the independent line not in any loop cannot be switched, so when the rank of the matrix Satisfies:

[0039] (7)

[0040] The detection capability reaches the upper limit, and the number of lines to be disconnected is: Where Indicates the number of independent lines not in any loop.

[0041] According to the preferred embodiment of the present application, in step S3, the multi-stage topology switching optimization model is established, and the specific steps are as follows:

[0042] For the typical load curve of Period, this optimization model minimizes the generation cost as an optimization problem, and the objective function of the optimization problem is as formula (8):

[0043] (8)

[0044] Where Is the output of the Stage generator, And And Is the cost coefficient, Is the connected generator set.

[0045] The power balance of each stage bus satisfies formula (9): ​

[0046] (9)

[0047] where is the bus load, is the line power flow, is the set of lines with bus as the head, with bus as the tail,

[0048] The line power flow and phase angle satisfy equation (10):

[0049] (10)

[0050] where and are the line , binary variable indicates the line is connected, is disconnected; M is a large enough positive number to represent the inequality relationship; represents the power flow on line at time t;

[0051] The line disconnection operation is described by a set of inequalities. Equation (11) indicates that a line can be disconnected at most once in phase , and remains connected in other phases; equation (12) ensures that each bus is connected to at least one line to maintain connectivity, where is the set of all lines connected to bus ; equation (13) limits the number of disconnected lines, indicating that the number of disconnected lines is exactly the amount needed to reach the upper limit of detection, as follows:

[0052] (11)

[0053] (12)

[0054] (13)

[0055] Equations (14) and (15) represent the line thermal stability limit and generator output limit, respectively:

[0056] (14)

[0057] (15)

[0058] where, are upper and lower bounds constants; are connected line sets;

[0059] The optimization model enables the defense party to schedule line disconnections at each stage, maximize detection capability while minimizing generation cost under a given period typical load curve, and after each stage, each line is disconnected once, except for independent lines, to achieve the maximum rank of the matrix.

[0060] According to the present application, preferably, the specific steps of step S4 are as follows:

[0061] S41, derive the relationship between D-FACTS devices and line switching in the joint mobile target defense framework:

[0062] The three stages of MTD are stage 1 original state, stage 2 line impedance change, and stage 3 topology change, and the measurement matrices corresponding to the three stages are respectively: original state , line impedance change and topology change , and the mathematical expressions are:

[0063] (16)

[0064] Wherein is the original impedance diagonal matrix, and the impedance diagonal matrix in stage 1 only modifies the position impedance of to , is the original power grid topology correlation matrix, and the power grid topology correlation matrix in stage 2 sets the first column to zero to represent disconnected lines ;

[0065] The null space basis vector matrix corresponding to the three stages of MTD is:

[0066] (17)

[0067] Wherein and are the null space matrices of and respectively;

[0068] According to the above, it is derived that when the disconnected line in is the same as the adjusted impedance line in , that is , there is , indicating that the attack space has not been reduced;

[0069] S42, implementing a joint mobile target defense framework based on the relationship between the D-FACTS device and the line switching:

[0070] The mobile target defense based on the D-FACTS device is The detection limit determined by the D-FACTS device and the system topology after the phase reaches the detection limit, and the transmission line set equipped with the D-FACTS device is As mentioned earlier, the switching line in the topology switching phase should be excluded Therefore, the topology switching constraint is modified, that is, based on formulas (11) and (13), a new constraint excluding is added, and the following formulas (18) and (19) are obtained:

[0071] (18)

[0072] (19)

[0073] The mobile target defense based on the D-FACTS device includes a continuous phase, which implements the reactance disturbance MMTD, adjusts the line impedance matrix X using the D-FACTS device to improve the rank of the L matrix;

[0074] The subsequent phase implements topology switching through the circuit breaker, which solves the optimization problem of formula (8) based on the modified topology switching constraints (18) and (19), thereby solving the problem of limited detection capability caused by the number limitation of the D-FACTS device, and making the L matrix reach the theoretical upper bound rank.

[0075] According to the present application, preferably, in step S41, the derivation process is as follows:

[0076] The first phase adjusts the first line impedance, which can be represented as:

[0077] (20)

[0078] where is a diagonal matrix with all zeros except position is equal to ;

[0079] After disconnecting the line , is represented as:

[0080] (21)

[0081] Here Column vector represents open line Post-remaining basic loop, For Unit vector of position 1, where the, Can be represented by Linear representation, because any basic loop in the new topology must be linearly related to the original loop.

[0082] Therefore, the detection capability evaluation matrix corresponding to stages 1 and 2 And In:

[0083] (22)

[0084] If Can be represented by

[0085] (23)

[0086] Column vector linear representation, the attack space is invariant;

[0087] Specifically, because For only the first Row non-zero matrix, when There must be a vector Make , so Can be represented by Linear representation, and vice versa when It is easy to prove .

[0088] In another aspect of the present application, a device loaded with a multi-stage detection method for power system network attacks based on topology switching is provided, and the device comprises:

[0089] D-FACTS device, for dynamically adjusting line impedance;

[0090] Circuit breaker, for opening the power system transmission line;

[0091] Memory for storing instructions executed by the processor;

[0092] Processor for executing the instructions to implement the multi-stage detection method for power system network attacks based on topology switching as described above.

[0093] In another aspect of the present application, an electronic device is also provided, comprising:

[0094] At least one processor; and

[0095] a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the multi-stage detection method of cyber-attack on power system network based on topology switching as described above.

[0096] In another aspect of the present application, there is also provided a machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the multi-stage detection method of cyber-attack on power system network based on topology switching as described above.

[0097] Compared with the prior art, the present application has the following beneficial effects:

[0098] (1) The present application proposes a mobile target defense method based on line topology change, which decides line opening through multi-stage line topology switching optimization problem, maximizes detection capability while minimizing generation cost, and is easy to upgrade even for systems with obsolete facilities that cannot install D-FACTS devices, as the implementation only requires circuit breakers.

[0099] (2) The scheme proposed by the present application can break through the detection limit of a single method in cooperation with D-FACTS-based mobile target defense, and can achieve the upper bound of detection in systems where D-FACTS devices fail to cover all required lines, and can complement each other with D-FACTS devices to build a security defense line. BRIEF DESCRIPTION OF DRAWINGS

[0100] Figure 1 is a flowchart of the multi-stage detection method of cyber-attack on power system network based on topology switching described in the present application.

[0101] Figure 2 is an attack space variation diagram of the multi-stage detection method of cyber-attack on power system network based on topology switching in the 14-node test system in Example 1 of the present application.

[0102] Figure 3 is a LESI variation and cost variation diagram of the multi-stage detection method of cyber-attack on power system network based on topology switching in the 14-node test system in Example 1 of the present application.

[0103] Figure 4 is an attack space variation diagram of the joint detection method based on D-FACTS devices and topology switching in the 14-node test system in Example 1 of the present application.

[0104] Figure 5 is a LESI variation and cost variation diagram of the joint detection method based on D-FACTS devices and topology switching in the 14-node test system in Example 1 of the present application. DETAILED DESCRIPTION

[0105] The present disclosure will be further described below in conjunction with the accompanying drawings and embodiments.

[0106] Embodiment 1,

[0107] The embodiment provides a power system network attack multi-stage detection method based on topology switching, proposes a concept of topology switching and D-FACTS device cooperating to carry out mobile target defense, solves the established optimization problem to maximize the detection capability while minimizing the power generation cost, can also achieve the upper bound of detection in the system in which the D-FACTS device fails to cover all the required lines, significantly improves the detection capability of the system, and guarantees the safety of the power system.

[0108] Figure 1 A schematic diagram of the power system network attack multi-stage detection method based on topology switching in the embodiment is given. The method comprises the following steps:

[0109] Step S1: defining a detection capability quantitative index, based on the dimension of the intersection of the measurement matrix array space Evaluating the attack space and deriving the detection capability evaluation matrix ;

[0110] Step S2: based on The matrix evaluates the influence of line switching on the detection capability.

[0111] Step S3: establishing a multi-stage topology switching optimization model, taking the minimum power generation cost as the optimization problem, maximizing the detection capability while reducing the power generation cost; the constraint conditions of the model include: node power balance constraint, line phase angle difference constraint, line connectivity constraint, line disconnection quantity constraint, line power flow limit constraint, and generator output limit constraint.

[0112] Step S4: constructing a topology switching-D-FACTS device joint mobile target defense framework in which the electric reactance disturbance is performed first and then the line switching is performed;

[0113] Step S5: solving the optimization model to determine the set of transmission lines disconnected in each stage , and then performing the topology switching operation according to the optimization result to update The rank of the matrix to realize attack detection.

[0114] The specific steps of S1 are as follows: the direct current state estimation model in the power system is a simplified state estimation method mainly used for fast analysis of the operation state of the power system. The core idea is to linearize the AC power flow equation, ignore the influence of reactive power and voltage amplitude, and only focus on the relationship between active power and node voltage phase angle. The relationship between the measurement vector (such as node injection power and line power flow) and the state variable can be expressed as a linear equation:

[0115] (1)

[0116] where is the measurement vector, is the measurement matrix determined by the grid topology and line admittance, with dimension , is the number of lines, and n is the number of stages except the reference node; is the measurement error, and the measurement errors are independent and follow Gaussian distribution; is the state vector describing the phase angles of each node in the power system. The matrix can be decomposed as:

[0117] (2)

[0118] where is a diagonal matrix whose diagonal elements are line impedances. The matrix is the incidence matrix of the grid topology, whose rows represent buses and columns represent branches, and its elements are 1 when bus is the starting node of line , -1 when bus is the ending node of line , and 0 otherwise. The matrix is the matrix obtained by removing the corresponding row of the reference bus. The superscript T is the transpose operation. The optimal state estimation can be obtained by minimizing the weighted residual sum of squares:

[0119] (3)

[0120] where is the weight matrix, which is a symmetric matrix composed of the inverses of the measurement error variances.

[0121] Current research shows that bad data detection (BDD) has limitations, especially in effectively responding to false data injection attacks. Typically, BDD detects abnormalities by calculating the residual error between the measurement data and the state estimation. If the residual error exceeds the preset threshold , it is determined that there is bad data:

[0122] (4)

[0123] If the attack vector satisfies , is the state variable injected by the attacker, then the residual error can be kept at the level of undisturbed data, thereby bypassing traditional BDD detection. Such attacks can manipulate SCADA system measurement data, leading to incorrect state estimation and threatening grid security.

[0124] Obviously, the attack vector that can bypass the BDD detection is a linear combination of column vectors, i.e. . Given a multi-stage MTD with measurement matrices and original matrices , the intersection of their column spaces is denoted as , the dimension of which reflects the detection capability of the multi-stage MTD scheme, and the smaller the intersection dimension, the more limited the potential attack space dimension that the attacker can implement.

[0125] To characterize the dimension of the intersection of column spaces, i.e., the size of the corresponding attack space, the following detection capability evaluation matrix is defined . Assuming that the matrix composed of the null space basis vectors of the matrix is , then: or equivalently . Therefore, if the attack vector satisfies , then . For a multi-stage MTD with t measurement matrices, the matrix must satisfy:

[0126] (5)

[0127] The dimension of the attack space can be represented by the rank of the matrix , which reflects the detection capability of the multi-stage MTD.

[0128] The specific steps of S2 are as follows:

[0129] S21: Use the decomposable matrix to find the matrix corresponding to the topological change:

[0130] The matrix is decomposable, and its row vectors represent the basic loops of the system, the null space basis matrix of is defined by the following condition:

[0131] (6)

[0132] where is the basis of the null space, and let , then the equation simplifies to , which means . Therefore can be represented as a linear combination of the null space basis matrix of the incidence matrix : . From this, we derive: , i.e. .

[0133] S22: Derive the influence of line topology switching on detection capability, i.e. the rank of matrix .

[0134] Through the above derivation, the matrix is decomposed, where the matrix is composed of the null space basis of the incidence matrix , called the loop matrix or the basic loop matrix, and each column represents a basic loop, and the dimension is . However, in the multi-stage topology switching (MTD), the physical meaning of changes, and a new loop matrix is formed after topology switching, which represents the remaining basic loops and the unit vector corresponding to the behavior 1 of the switching line pair;

[0135] The specific operation of topology switching is as follows: for a given load curve within the stage, topology switching is performed by disconnecting or connecting lines. In order to maintain the consistency of the dimension of the measurement matrix, the operation of disconnecting the line corresponds to setting the corresponding row of the measurement matrix to zero, i.e. clearing the corresponding column. The matrix represents the system branch. After setting the corresponding column to zero, we get , . The solution of equation is:

[0136] (7)

[0137] where can take any value, and the corresponding basis is the unit vector (the first behavior 1). The remaining part corresponds to the basic loop of the subgraph after the line is disconnected, and the basis is denoted as , so .

[0138] The rank of the matrix is:

[0139] (8)

[0140] Therefore, disconnecting the line increases the rank of the matrix by adding the unit vector to the matrix.

[0141] In order to ensure the connectivity of the system, the independent line that is not in any loop cannot be switched. Therefore, when the rank of the matrix satisfies:

[0142] (9)

[0143] When the detection capacity reaches its limit, the number of lines that need to be disconnected is: ,in This represents the number of independent lines that are not in any loop.

[0144] The specific steps for establishing a multi-stage topology switching optimization model in S3, with minimizing power generation cost as the objective function, are as follows:

[0145] Traditional power system mobile target defense modifies line impedance using D-FACTS devices, changing... A matrix is ​​used to achieve attack detection. However, D-FACTS is difficult to deploy in networks with congested line equipment. This is because line switching can affect... To enhance detection capabilities through matrix rank-based optimization, as shown in step S2, this invention proposes a multi-stage topology switching optimization to maximize the effectiveness of detection after a certain number of moving target defense stages at the lowest cost. Matrix rank.

[0146] The following (10)-(17) are multi-stage topology switching optimization models. This optimization model enables the defender to schedule line disconnection at each stage, given... Under typical load curves during a given period, the goal is to maximize detection capabilities while minimizing power generation costs. After the phase, each line (except for independent lines) is disconnected once to achieve... Maximum rank of a matrix.

[0147] against The typical load curve for the time period is given. This optimization model takes minimizing the power generation cost as the optimization problem, and the objective function of the optimization problem is shown in formula (10):

[0148] (10)

[0149] in For the first Stage generator of efforts, and This is the cost coefficient. A collection of connected generators;

[0150] The power balance of the bus at each stage satisfies formula (11):

[0151] (11)

[0152] in busbar load, For the line trend, For busbar a set of lines connected to the head bus, a set of lines connected to the tail bus, a set of lines connected to the tail bus, a set of connected loads;

[0153] The line power flow and phase angle satisfy equation (12):

[0154] (12)

[0155] where and are the line head and tail phase angles, binary variables represent the line state: connected, disconnected; M is a sufficiently large normal number to represent its inequality relationship; represent the power flow on the line at time t;

[0156] The line disconnection operation is described by a set of inequalities. Equation (13) indicates that the line is disconnected at most once in the phase, and remains connected in the rest of the phases; equation (14) ensures that each bus is connected to at least one line to maintain connectivity, where is the set of all lines connected to bus ; equation (15) limits the number of disconnected lines, indicating that the number of disconnected lines is exactly the amount needed to reach the detection upper limit, as follows:

[0157] (13)

[0158] (14)

[0159] (15)

[0160] Equations (16) and (17) represent the line thermal stability limit and the generator output limit, respectively:

[0161] (16)

[0162] (17)

[0163] where are the upper and lower bound constants; is the set of connected lines;

[0164] The specific steps of S4 to build the mobile target defense framework of the topology switching-D-FACTS device combination are as follows:

[0165] Both moving target defense based on D-FACTS devices and topology switching moving target defense methods have limitations in practical deployment. In actual power systems, the installation of D-FACTS devices that dynamically adjust line impedance is subject to multiple constraints, including substation construction restrictions, standardization of equipment rated power, and the economic willingness of local distribution companies. Therefore, the effectiveness of moving target defense with a limited number of D-FACTS devices must be carefully evaluated. In contrast, topology switching methods involving line disconnection, while directly affecting power flow and voltage stability, are relatively easy to implement in practice because they can make full use of existing infrastructure such as circuit breakers on power lines.

[0166] In summary, the practical strategy is to first implement reactive disturbance mitigation (MMTD) using a limited number of D-FACTS devices. Because the deployment of D-FACTS devices is pre-planned and cannot be adjusted after installation, it's impossible to perform a topology switch first and then deploy D-FACTS devices based on subsequent conditions. Therefore, reactive disturbance mitigation must be implemented before topology switching. Due to the limited number of devices, the detection capability achievable by a single D-FACTS device is usually lower than the theoretical upper limit determined by the network topology. This upper limit can be achieved through a moving target defense method based on topology switching. Therefore, D-FACTS-based moving target defense and line topology switching-based moving target defense complement each other, jointly improving the overall system security.

[0167] S41: Deriving the relationship between D-FACTS equipment and line handover in the Joint Moving Target Defense Framework:

[0168] Considering the three stages of MTD (Mean Transmission Method), namely Stage 1 (Original State), Stage 2 (Line Impedance Change), and Stage 3 (Topology Change), the corresponding measurement matrices for the three stages are as follows: Original State Line impedance variation and topology changes Its mathematical expression is:

[0169] (18)

[0170] in The original impedance diagonal matrix, the impedance diagonal matrix in stage 1 Only of Position impedance modified to , The original power grid topology correlation matrix, and the power grid topology correlation matrix in Phase 2. Will No. Setting a column to zero indicates that the line is disconnected. .

[0171] The null space basis vector matrices corresponding to the three stages of MTD are:

[0172] (19)

[0173] where and are and the null space matrix of

[0174] According to the above, it is derived that when the open line is the same as the adjusted impedance line, i.e. , there is , indicating that the attack space is not reduced, therefore, the transmission line equipped with D-FACTS devices should be excluded in the topology switching stage; the specific derivation process is as follows:

[0175] After adjusting the impedance of the first line in the first stage, it can be expressed as:

[0176] (20)

[0177] where is a diagonal matrix with all zeros except the position equal to ;

[0178] After the open line , it is expressed as:

[0179] (21)

[0180] Here is a column vector representing the remaining basic loop after the open line , is the unit vector at position 1, where the connection is broken, which can be linearly represented by , because any basic loop in the new topology must be linearly related to the original loop.

[0181] Therefore, in the detection capability evaluation matrices and corresponding to stages 1 and 2:

[0182] (22)

[0183] If can be linearly represented by

[0184] (23)

[0185] the attack space is unchanged. Specifically, because For only the first row nonzero matrix, there must exist a vector such that , so , therefore can be linearly represented by . Conversely, when , it is easy to prove .

[0186] S42: Implement a joint mobile target defense framework based on the relationship between D-FACTS devices and line switching:

[0187] Assume that the mobile target defense based on D-FACTS devices reaches the detection limit determined by the D-FACTS devices and the system topology after the phase. Let the set of transmission lines equipped with D-FACTS devices be . As mentioned earlier, the switching lines in the topology switching phase should exclude . Therefore, the topology switching constraint is modified, that is, based on formulas (13) and (15), a new constraint excluding is added, obtaining the following formulas (24) and (25):

[0188] (24)

[0189] (25)

[0190] The mobile target defense based on D-FACTS devices includes a continuous phase, which implements the reactance disturbance MMTD, and adjusts the line impedance matrix X using D-FACTS devices to improve the rank of the L matrix;

[0191] The subsequent phase implements topology switching through circuit breakers, which is based on the modified topology switching constraints (24) and (25) to solve the optimization problem of formula (10), thereby solving the problem of limited detection capability caused by the number limitation of D-FACTS devices, and making the L matrix reach the theoretical upper bound rank.

[0192] To verify the detection capability of the multi-stage detection method and device for power system network attacks based on topology switching proposed in the present application, the NYISO real load data is used to first verify the mobile target defense method based on topology switching in the IEEE 14-node test system; then the same NYISO real load data is used to verify the joint mobile target defense method based on D-FACTS devices and topology switching in the IEEE 14-node test system.

[0193] First, the mobile target defense method based on topology switching is quantitatively evaluated. The detection capability of different phase numbers Impact on attack detection capabilities and system operating costs. Figure 2 Demonstrates the normalized attack space / n random The changing trend, where the attack space is defined as the intersection dimension of the column spaces. .

[0194] Experimental results show that by sequentially disconnecting transmission lines, the attack space dimension decreases in stages. For example... Figure 2 As shown, when At that time, the normalized attack space decreased to 0.5 in stage 1, 0.357 in stage 2, and further to 0.071 in stage 3. It is worth noting that the smaller... The value can accelerate the approximation of the theoretical upper limit of detection capability, while a larger value... This would require more stages to achieve the same detection efficiency.

[0195] To quantify efficiency, the Line Switching Efficiency Index (LESI) is defined:

[0196]

[0197]

[0198] In the formula This represents the total number of phases in the MTD implementation. . Molecular representation The LESI value represents the rank increment of the matrix compared to the previous stage, with the denominator indicating the distance between the current rank value and the theoretical upper bound. A higher LESI value indicates a more efficient switching strategy.

[0199] Figure 3 Revealing differences The trade-off between incremental operating costs and LESI: when At that time, LESI reached a peak of 0.56, but the increase in operating costs was as high as $331.56 / MWh; The incremental cost dropped sharply to $133.6 / MWh, and the LESI decreased to 0.35; further increases... While this can further reduce operating costs, it comes at the cost of a continuous decline in LESI. System operators can determine the optimal number of stages based on demand using the efficiency-cost trade-off curve.

[0200] Subsequently, simulation verification was conducted on a joint moving target defense method based on D-FACTS devices and topology switching for scenarios where the number of D-FACTS devices is limited. Figure 4 and Figure 5 Configuration scheme corresponding to 4 D-FACTS devices. Figure 4 Showing different Set the change rule of the normalized attack space Attack space / n. As shown in Figure 4 When , the detection capability cannot reach the theoretical upper bound when only the MMTD strategy is adopted. Specifically, after single-stage defense, the normalized attack space Attack space / n remains at 0.643 and no longer converges, indicating that the pure impedance adjustment scheme has a detection capability bottleneck. The introduction of the topology switching mechanism can effectively make up for this defect: when , the system can achieve the theoretical detection upper bound, and only the number of stages required to reach the upper bound differs.

[0201] Figure 5 Further quantifies the line switching efficiency index LESI and the incremental cost under different . When only impedance switching costs, such as 3.1 $ / MWh, are generated, they can be ignored; when , the cost significantly increases to 780.4 $ / MWh due to the completion of single-stage full line switching, but the LESI remains at a high level. Notably, the synergy of D-FACTS devices reduces the number of line switches required to reach the detection upper bound, thereby optimizing cost efficiency: as shown in Figure 5 When , the cost increment is 0, while the cost of a pure topology switching scheme with the same number of stages is 133.076 $ / MWh, as shown in Figure 3 This phenomenon confirms the economic advantage of the hybrid strategy in resource-constrained scenarios.

[0202] In summary, the power system network attack multi-stage detection method based on topology switching designed in the application first deduces the impact of line topology switching on detection capability, then models it as a topology switching multi-stage optimization problem, and proposes a joint mobile target defense method based on D-FACTS devices and topology switching. The simulation results in the IEEE 14-node test system verify the performance and effectiveness of the proposed mobile target defense detection method.

[0203] Embodiment 2,

[0204] The embodiment provides a device loaded with a power system network attack multi-stage detection method based on topology switching, and the device comprises:

[0205] D-FACTS devices for dynamically adjusting line impedance;

[0206] Circuit breakers for breaking power system transmission lines;

[0207] A memory for storing instructions executed by a processor;

[0208] a processor configured to execute the instructions to implement the topology-switching-based multi-stage detection method of cyber attacks on power system networks as described above.

[0209] Embodiment 3,

[0210] The embodiment also provides an electronic device comprising:

[0211] at least one processor; and

[0212] a memory storing instructions that, when executed by the at least one processor, cause the at least one processor to perform the topology-switching-based multi-stage detection method of cyber attacks on power system networks as described above.

[0213] In the embodiment, the electronic device can include, but is not limited to, a personal computer, a server computer, a workstation, a desktop computer, a laptop computer, a notebook computer, a mobile computing device, a smart phone, a tablet computer, a cellular phone, a personal digital assistant (PDA), a handheld device, a messaging device, a wearable computing device, a consumer electronic device, and the like.

[0214] Embodiment 4,

[0215] The embodiment also provides a machine-readable storage medium storing executable instructions that, when executed, cause the machine to perform the topology-switching-based multi-stage detection method of cyber attacks on power system networks as described above.

[0216] Specifically, a system or apparatus equipped with a readable storage medium on which a software program code implementing the functions of any of the above embodiments is stored, and causing a computer or processor of the system or apparatus to read and execute the instructions stored in the readable storage medium can be provided.

[0217] In this case, the program code read from the readable medium itself can implement the functions of any of the above embodiments, and thus the machine-readable code and the readable storage medium storing the machine-readable code constitute a part of the present specification.

[0218] Embodiments of the readable storage medium include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as a CD-ROM, a CD-R, a CD-RW, a DVD-ROM, a DVD-RAM, a DVD- RW, a DVD-RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer or the cloud over a communication network.

[0219] Obviously, the above embodiments of the present application are only examples for clearly illustrating the technical solutions of the present application, and are not intended to limit the specific implementation of the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A multi-stage detection method for cyber attacks on power system networks based on topology switching, characterized in that, The method comprises: S1, define the detection capability quantitative index, evaluate the attack space based on the dimension of the measurement matrix array space intersection, and deduce the detection capability evaluation matrix The specific steps are as follows: The relationship between the measurement vector and the state variable can be represented as a linear equation: （1） wherein is a measurement vector, is a measurement matrix determined by the power grid topology and line admittance, which has a dimension of , is the number of lines, and n is the number of stages except for the reference node; is a measurement error, and the measurement errors are mutually independent and subject to a Gaussian distribution, is a state vector describing the phase angles of each node in the power system; Matrix may be decomposed into: （2） wherein, is a diagonal matrix whose diagonal elements are line impedances; matrix is a connection matrix of the power grid topology; matrix is a matrix obtained by removing the rows corresponding to the reference buses; the superscript T is a transposition operation; Given a multi-stage mobile target defense (MTD) and original matrix with a measurement matrix , let the column space intersection be denoted as ; The detection capability evaluation matrix is defined as follows The dimension of the intersection of the column spaces, i.e. the size of the corresponding attack space, is characterized as follows: Let be the matrix consisting of the null space basis vectors of the matrix , then we have: or equivalently ; therefore, if the attack vector satisfies , is the state variable injected by the attacker, then ; for a multi-stage MTD with t measurement matrices, the matrix , where is the matrix consisting of the null space basis vectors of the matrix , while the matrix needs to satisfy: （3） The attack space dimension is characterized by the rank of the matrix ​ S2, based on Matrix evaluation of the impact of line switching on detection capability; S3, a multi-stage topology switching optimization model is established to minimize the power generation cost as an optimization problem, maximize the detection capability while reducing the power generation cost; the constraint conditions of the model include node power balance constraint, line phase angle difference constraint, line connectivity constraint, line disconnection number constraint, line power flow limit constraint, generator output limit constraint; In S3, the multi-stage topology switching optimization model is established, and the specific steps are as follows: For The optimization model takes the minimum generation cost as the optimization problem, and the objective function of the optimization problem is as formula (8): （8） wherein is the first stage generator output, and is the cost coefficient, is the set of connected generators; The bus power balance of each stage satisfies formula (9): （9） wherein is a bus a load, is a line a power flow, is a set of lines with bus as a head, is a set of lines with bus as a tail, is a set of connected loads; The line power flow and phase angle satisfy formula (10): （10） wherein and are line initial and final end phase angles, binary variables denote phase lines State: is connected, is disconnected; M is a sufficiently large normal number to represent its inequality relationship; denotes the power flow on the line at time t. The line disconnection operation is described by inequalities, with equation (11) indicating that at most one line is disconnected in phase and the rest remain connected; equation (12) ensures that each bus is connected to at least one line to maintain connectivity, where is the set of all lines connected to bus ; and equation (13) limits the number of disconnected lines, indicating that the number of disconnected lines is just enough to reach the detection threshold, as follows: （11） （12） （13） Formula (14) and (15) represent the line thermal stability limit and the generator output limit respectively: （14） （15） wherein, are upper and lower bound constants; is a set of connected lines; The optimization model enables the defender to schedule line disconnections at each stage, maximizing detection capability while minimizing generation cost under a given periodic load curve, after each stage, each line is disconnected once, achieving the maximum rank of the matrix. S4, a topology switching-D-FACTS device joint mobile target defense framework is constructed, and the specific steps are as follows: S41, the relationship between the D-FACTS device and the line switching in the joint mobile target defense framework is derived: The three stages of the MTD are stage 1 original state, stage 2 line impedance change, and stage 3 topology change. The measurement matrices corresponding to the three stages are: original state , line impedance change , and topology change , and the mathematical expressions are: （16） wherein is the original impedance diagonal matrix, the impedance diagonal matrix in stage 1 only the of the position impedance is modified to , is the original grid topology incidence matrix, the grid topology incidence matrix in stage 2 the first column is set to zero indicating an open line ; The zero space basis vector matrix corresponding to the three stages of MTD is: （17） wherein and are respectively and null space matrices; From the above, it is deduced that when the interrupting line is the same as the intermediate regulating impedance line, i.e. , there is , indicating that the attack space is not reduced; S42, the joint mobile target defense framework is implemented based on the relationship between the D-FACTS device and the line switching: Mobile target defense based on D-FACTS equipment After the phase reaches the detection limit determined by the D-FACTS equipment and system topology, the transmission line set equipped with the D-FACTS equipment is As mentioned earlier, the switching line of the topology switching phase should exclude Therefore, the topology switching constraint is modified, that is, on the basis of formulas (11) and (13), new constraints excluding are added, and the following formulas (18) and (19) are obtained: （18） （19） Mobile target defense based on D-FACTS devices comprises a succession of phases, the phases implementing a reactive disturbance MMTD, adjusting the line impedance matrix X with D-FACTS devices to increase the rank of the L matrix; Subsequent The topology switching is implemented by circuit breakers, which solves the optimization problem of formula (8) based on the modified topology switching constraints (18) and (19), so as to solve the problem of limited detection capability caused by the number limitation of D-FACTS devices, and make the L matrix reach the theoretical upper bound rank. S5, solving the optimization model to determine the set of transmission lines disconnected at each stage, performing a topology switching operation according to the optimization result, updating The matrix rank is used to implement attack detection.

2. The topology switch based power system network attack multi-stage detection method of claim 1, wherein, In S2, based on The matrix evaluates the impact of line switching on the detection capability in the following specific steps: S21, using decomposable matrices finding a matrix corresponding to the topology change as follows: matrix is decomposable, its row vector represents the basic loop of the system, of the null space of defined by the following conditions: （4） in, Let be a basis of the null space. Then the equation simplifies to ,mean ,therefore It can be represented as an incidence matrix Null basis matrix Linear combination: Therefore, we can deduce that: ,Right now ; S22, deduce the line topology switching detection capability, namely matrix Impact of rank: The matrix From the correlation matrix The null space basis is composed of what is called the fundamental circuit matrix, where each column represents a fundamental circuit, and its dimension is... In multi-stage topology handover (MTD), The physical meaning changes, and a new loop matrix is ​​formed after the topology switch. The list represents the remaining basic loops and the unit vectors with corresponding switching lines as behavior 1; The specific operation of topology switching is as follows: for For a given load curve in the phase, topology switching is performed by disconnecting or connecting the line, in order to maintain the consistency of the dimension of the measurement matrix, the operation of disconnecting the line corresponds to setting the measurement matrix to zero, i.e., clearing the corresponding row , the matrix , represents the branch of the system, and after setting the corresponding column to zero, the following is obtained , （5） wherein may take any value, the corresponding basis is the unit vector , The remaining part corresponds to the fundamental circuits of the subgraph after the broken line, whose basis is denoted by , therefore ; Matrix rank of is: （6） Thus, the disconnected line increases the rank of the matrix by adding a unit vector to the matrix ​​ 3. The multi-stage detection method of power system network attacks based on topology switch according to claim 2, characterized in that, The matrix of the rank satisfies: （7） The number of lines to be disconnected when the detection capacity reaches the upper limit is: wherein represents the number of independent lines not in any loop.

4. The topology switch based power system network attack multi-stage detection method of claim 1, wherein, The derivation process is as follows: The first stage adjusts the after the line impedance, may be expressed as: （20） wherein is a diagonal matrix with all zeros except position is equal to a diagonal matrix with all zeros except disconnection line after, is represented as: （21） Here Column vector represents open circuit Post remaining basic loop, For Unit vector of position 1, where the, 'Can be linearly represented by Linear representation, because any basic loop in the new topology must be linearly related to the original loop; Thus, the phase 1 and 2 corresponding detection capability assessment matrices and in: （22） If may be derived from （23） The column vector is linearly represented, and the attack space is invariant; Specifically, because For only the first A matrix with non-zero rows, when There must exist a vector make Therefore can be Linear representation, and conversely when Shi Yizheng .

5. An apparatus loaded with a multi-stage detection method for topology switch based cyber attack on power system network, characterized in that, The device comprises: D-FACTS device, for dynamically adjusting the line impedance; Circuit breaker, for breaking the transmission line of the power system; Memory, for storing instructions executed by the processor; The processor is used to execute the instructions to realize the multi-stage detection method of power system network attack based on topology switching according to any one of claims 1-4.

6. An electronic device, comprising: The electronic device comprises: At least one processor; and Memory, the memory stores instructions, when the instructions are executed by the at least one processor, the at least one processor executes the multi-stage detection method of power system network attack based on topology switching according to any one of claims 1-4.

7. A machine-readable storage medium, characterized in that, The machine readable storage medium stores executable instructions, the instructions when executed cause the machine to execute the multi-stage detection method of power system network attack based on topology switching according to any one of claims 1-4.

Images