Low-overhead moving target defense method and device for false data injection attack

Abstract

The invention relates to a low-overhead moving target defense method and device for false data injection attacks, and the method comprises the steps: constructing a topological structure of a power grid bus and branches based on actual intelligent power grid data, and associating the branches with an initial admittance value; establishing an initial measurement matrix based on the initial admittance value and the topological structure of the power grid bus and the branches, and constructing a moving target defense strategy based on the initial measurement matrix; based on an invalid branch identification criterion and a topological structure of a power grid bus and a branch, determining an invalid branch in the power grid; based on invalid branches and a greedy selection mechanism, traversing the bus to screen valid branches, and obtaining a modified branch set; and changing admittance values of branches in the branch set based on a moving target defense strategy, changing a measurement matrix, and realizing low-overhead moving target defense. Compared with the prior art, on the premise that the high detection probability is maintained, the number of branches needing to modify admittance and the calculation time are remarkably reduced, and therefore the system defense cost is reduced.

Description

Technical Field

[0001] This invention relates to the intersection of network security and smart grid technologies, and in particular to a low-overhead method and device for defending against fake data injection attacks on moving targets. Background Technology

[0002] As traditional power grids evolve into smart grids, the integration of technologies such as two-way communication, advanced sensing, and precision control has significantly improved the grid's operational efficiency, reliability, and renewable energy integration capabilities. However, this transformation has also brought new cybersecurity challenges, among which False Data Injection Attacks (FDIAs) are particularly prominent. These attacks mislead system operators by tampering with sensor measurement data and can circumvent traditional malicious data detection mechanisms. It should be noted that the successful execution of such attacks often heavily relies on the attacker's mastery of internal system information (such as the Jacobian matrix).

[0003] To address emerging threats such as FDIA, Moving Target Defense (MTD) has been introduced into the power system field as an advanced proactive defense strategy. The core idea of ​​MTD is to dynamically alter the system's configuration or key operating parameters (e.g., dynamically modifying the equivalent branch admittance of transmission lines by deploying Distributed Flexible AC Transmission Systems (D-FACTS) equipment) to increase system uncertainty, thereby significantly increasing the difficulty for attackers to obtain accurate system information and construct effective attack payloads.

[0004] However, existing MTD strategies generally face a trade-off between effectiveness, efficiency, and cost in practical applications. Chinese patent CN115378699B discloses a method for defending against spoofed data attacks in grid state topology coordination. This method identifies attacked data based on a spatiotemporal feature prediction model and then confirms the scope of the attack from the attacked data. Its protection method is a passive defense after an attack. To improve the detection rate of FDIA (Fault-Do-Check-Act), this type of defense usually requires modifying more line admittances over a wider range, leading to a significant increase in the deployment cost of D-FACTS (Device-Based Detection and Analysis) equipment. Simultaneously, frequent and large-scale network parameter disturbances may have a significant negative impact on the steady-state operation of the power grid, power quality, and even transient stability. In terms of efficiency, some MTD strategies involve complex optimization calculations, resulting in high computational complexity and difficulty in meeting real-time defense requirements. Furthermore, existing heuristic strategies and graph-based branch selection methods suffer from insufficient global optimality and resource waste due to ineffective branch modifications (such as modifying leaf node branches or branches forming loops).

[0005] Therefore, there is an urgent need for a mobile target defense method that can achieve efficient FDIA active defense with fewer branch modifications and shorter computation time. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the prior art by providing a low-overhead mobile target defense method and device against fake data injection attacks, thereby maximizing resource utilization while improving system defense performance.

[0007] The objective of this invention can be achieved through the following technical solutions:

[0008] A low-overhead method for defending against fake data injection attacks on moving targets, the method comprising:

[0009] Based on actual smart grid data, the topology of the grid bus and branches is constructed, and the branches are associated with the initial admittance value;

[0010] Based on the initial admittance value and the topology of the power grid bus and branches, an initial measurement matrix is ​​established, and a moving target defense strategy is constructed based on the initial measurement matrix.

[0011] Based on the invalid branch identification criteria and the topology of the power grid buses and branches, invalid branches in the power grid are identified.

[0012] Based on the aforementioned invalid branches and greedy selection mechanism, the main line is traversed to filter valid branches and obtain the modified branch set;

[0013] Based on the moving target defense strategy, the admittance value of the branch in the modified branch set is modified, and the measurement matrix is ​​changed to achieve low-overhead moving target defense.

[0014] Furthermore, the topology of the power grid bus and branches is a connected graph, and its expression is:

[0015]

[0016]

[0017] e ij ∈ε

[0018] in, Let ε be the set of parent lines; ε be the set of branches; and each branch e ij Connect bus V respectively i and v j And associated admittance value b ij .

[0019] Furthermore, the measurement matrix is ​​a Jacobian matrix calculated based on the topology of the power grid bus and branches and the initial admittance value.

[0020] Furthermore, the process of constructing the mobile target defense strategy includes:

[0021] Based on actual smart grid data and the topology of grid buses and branches, a system model under normal operating conditions is constructed;

[0022] Based on the system model under normal operating conditions, the attacker's attack vector is constructed, and the system model under attack conditions is obtained.

[0023] Based on the attacker's attack vector, a mobile target defense strategy is constructed.

[0024] Furthermore, the expression for the system model under normal operating conditions is:

[0025] y = Hx + z

[0026] Where y is the active power of the measured value vector, y∈R m This includes the net active power injection into the bus and the active power flowing bidirectionally along the transmission line; x is the system state variable vector, x∈R n The state variable corresponds to the voltage angle of the bus; H is the measurement matrix, H∈R m×n z represents system noise, z∈R m ;

[0027] The expression for the system model under attack is:

[0028] y a =Hx+z+a

[0029] Among them, y a For the tampered measurement vector, y a ∈R m ;a is an attack vector that can evade detection and cause the estimated state to deviate from the original value, a∈R m ;

[0030] a∈col(H)

[0031] a = Hc

[0032] Where col(*) represents the column space; c is the error injected by the attacker into the state variable x, c∈R n An attack vector a that satisfies the conditions a∈col(H) and a=Hc can bypass the system's bad data detection mechanism.

[0033] Furthermore, the moving target defense strategy is to generate a new measurement matrix by changing the branch admittance, thereby reducing the dimension of the covert attack space and increasing the probability of detecting injection attacks.

[0034] The expression for the hidden attack space is:

[0035] S a =col(H)∩col(H′)

[0036] Among them, S a H represents the concealed attack space; H is the initial measurement matrix; H′ is the new measurement matrix, H′∈R m×n col(*) represents column space;

[0037] The expression for the dimension of the concealed attack space is:

[0038] dim(S a ) = 2n - rank[H|ΔH]

[0039] ΔH=HH′

[0040] Where n is the number of busbars; [H|ΔH] is the augmented matrix.

[0041] Furthermore, the invalid branch identification criteria include:

[0042] Branches whose connecting busbars are only connected to the power grid through this branch are classified as invalid branches;

[0043] Branches that, when added to the modification branch set, would form a loop with existing modification branches in the modification branch set would be classified as invalid branches.

[0044] Branches whose connecting buses are connected to the power grid through multiple branches, and whose branches other than the current branch have all been modified, are classified as invalid branches.

[0045] Furthermore, the admittance value of the branch in the modified branch set is modified using the D-FACTS device.

[0046] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the steps of the low-overhead mobile target defense method against spoofing data injection attacks as described above.

[0047] A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the low-overhead mobile target defense method against spoofing data injection attacks as described above.

[0048] Compared with the prior art, the beneficial effects of the present invention include:

[0049] 1. This invention, based on actual smart grid data, constructs a modified branch set, modifies the admittance values ​​of branches in the modified branch set based on a moving target defense strategy, changes the measurement matrix, and eliminates invalid branches. This maximizes resource utilization while simultaneously maximizing the rank of the augmented Jacobian matrix, significantly reducing the dimensionality of the stealth attack space, effectively suppressing the evasion and detection capabilities of spoofed data injection attacks, achieving low-overhead moving target defense, and improving system defense performance. The defense method of this invention is an active defense, enhancing defense capabilities under the assumption of injection attacks, exhibiting strong proactivity. Furthermore, the establishment of the modified branch set avoids large-scale modification of branch admittances, reduces grid parameter disturbances, lowers the impact on operational stability, reduces the number of D-FACTS devices deployed for defense, and reduces hardware costs.

[0050] 2. This invention has high resource utilization efficiency and can accurately identify invalid branches in the system, including leaf node branches, branches forming loops, and fully associative branches on a single busbar, avoiding unnecessary branch modifications and reducing the number of D-FACTS devices deployed and their impact on system operation.

[0051] 3. This invention has lower computational costs by employing a greedy selection mechanism based on bus traversal, avoiding complex global optimization and significantly shortening the computation time of the MTD strategy. In large-scale power grids, such as the IEEE 300 bus system, the computation time is reduced by more than 80% compared to the optimal MTD strategy.

[0052] 4. This invention is robust and insensitive to the randomness of the initial bus selection. It can converge to the same minimum attack space dimension in different experiments and can be applied to smart grid topologies of different scales. Attached Figure Description

[0053] Figure 1 This is a flowchart of the method of the present invention;

[0054] Figure 2 This is the topology of the IEEE 14-bus system in an embodiment of the present invention;

[0055] Figure 3 This demonstrates the performance of the present invention in a 6-busbar testing system.

[0056] Figure 4 This demonstrates the performance of the present invention in a 14-busbar testing system.

[0057] Figure 5 This demonstrates the performance of the present invention in a 39-bus test system.

[0058] Figure 6 This demonstrates the performance of the present invention in a 57-busbar testing system.

[0059] Figure 7This demonstrates the performance of the present invention in a 118 busbar testing system.

[0060] Figure 8 This is a demonstration of the performance of the present invention in a 300 busbar testing system. Detailed Implementation

[0061] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0062] Example 1

[0063] This embodiment discloses a low-overhead moving target defense method against false data injection attacks. In this method, the moving target refers to the branch admittance value of the key operating parameter of the smart grid system. By dynamically modifying this parameter, the core configuration of the system can be dynamically changed, which can break the attacker's static cognition of system information.

[0064] The operation of a smart grid depends on state estimation, which involves using measurement data collected by sensors and combining it with a system model to calculate the actual operating state of the power grid, providing a basis for decisions such as scheduling and protection.

[0065] The false data injection attack targeted by this method refers to an attacker maliciously tampering with sensor measurement data to inject false information, causing the power grid state estimation results to deviate from the true value, while bypassing traditional bad data detection mechanisms, thereby achieving a covert and destructive attack.

[0066] This method is as follows: Figure 1 As shown, the specific method includes steps S1-S5, and the details of each step are as follows:

[0067] Step S1: Based on actual smart grid data, construct the smart grid topology, that is, the topology of the grid bus and branches, and associate the branches with the initial admittance value.

[0068] The smart grid topology is described as a connected graph, and the topological structure expression of the grid bus and branches is as follows:

[0069]

[0070]

[0071] ε={e 11 ,e 12 ,…,e ij}

[0072] Where v is the set of busbars, containing n busbars; ε is the set of branches, containing l branches, each branch e ij Connect bus V respectively i and v j And associated admittance value b ij .

[0073] Define bus v i The associated branch set is Its degree, that is, the number of related branches, is

[0074] Step S2: Based on the initial admittance value and the topology of the power grid bus and branches, establish an initial measurement matrix, and construct a moving target defense strategy based on the initial measurement matrix.

[0075] The measurement matrix is ​​a Jacobian matrix calculated based on the topology of the power grid bus and branches and the initial admittance value.

[0076] The process of constructing a mobile target defense strategy includes:

[0077] Based on actual smart grid data and the topology of grid buses and branches, a system model under normal operating conditions is constructed;

[0078] Based on the system model under normal operating conditions, construct the attacker's attack vector and obtain the system model under attack conditions;

[0079] Based on the attacker's attack vector, construct a defense strategy for moving targets.

[0080] The expression for the system model under normal operating conditions is:

[0081] y = Hx + z

[0082] Where, y∈R m The measured value vector specifically includes the net active power injection into the bus and the active power flowing bidirectionally along the transmission line; x∈R n This is the system state variable vector, where the state variables correspond to the voltage angles of the bus; H∈R m×n Let z be the measurement matrix (Jacobi matrix); z∈R m The system noise is typically represented by a random variable vector Z. m ∈R m The realized value, and ∑ is the noise covariance matrix.

[0083] The expression for the system model under attack is:

[0084] y a =Hx+z+a

[0085] Among them, y ais the vector of tampered measurement values; a is the attack vector that can evade detection and cause the estimated state to deviate from the original value;

[0086] a∈col(H)

[0087] a = Hc

[0088] Where col(*) represents the column space; c∈R n It is the error that the attacker injects into the state variable x.

[0089] If an attacker knows the Jacobian matrix H and constructs an attack vector a = Hc that satisfies a ∈ col(H), then the attacker can bypass the system's bad data detection mechanism.

[0090] Therefore, the moving target defense strategy is to generate a new measurement matrix by changing the branch admittance, thereby reducing the dimension of the hidden attack space and increasing the probability of detecting injection attacks.

[0091] The lower the dimension of the attack space, the higher the probability of the system detecting the attack, and the stronger the security.

[0092] The expression for the hidden attack space is:

[0093] S a =col(H)∩col(H′)

[0094] Among them, S a The attack space is concealed; H is the initial measurement matrix, H′∈R m×n This is the new measurement matrix; col(*) represents the column space;

[0095] The expression for the dimension of the stealth attack space is:

[0096] dim(S a ) = 2n - rank[H|ΔH]

[0097] ΔH=HH′

[0098] Where n is the number of busbars; [H|ΔH] is the augmented matrix.

[0099] Step S3: Based on the invalid branch identification criteria and the topology of the power grid buses and branches, determine the invalid branches in the power grid.

[0100] If modifying the admittance of a branch fails to increase the rank of the augmented matrix [H|ΔH], i.e. fails to reduce the dimension of the hidden attack space, then the branch is classified as an invalid branch.

[0101] Therefore, the invalid branch identification criteria can be obtained, including:

[0102] Branches whose connecting busbars are only connected to the power grid through this branch are classified as invalid branches;

[0103] Branches that, when added to the modification branch set, would form a loop with existing modification branches in the modification branch set would be classified as invalid branches.

[0104] Branches whose connecting buses are connected to the power grid through multiple branches, and whose branches other than the current branch have all been modified, are classified as invalid branches.

[0105] Identifying and excluding these branches can effectively reduce unnecessary admittance modifications.

[0106] Step S4: Based on the invalid branch and greedy selection mechanism, traverse the main line to filter valid branches and obtain the modified branch set.

[0107] The process of traversing the busbar and selecting valid branches includes:

[0108] Initialize candidate set and parameters: Define and modify branch set Candidate bus set Covering branch set

[0109] The power grid topology is preprocessed to eliminate the first type of invalid branches, and leaf nodes with a degree of 1 (i.e., buses connected to only one branch) and their associated branches are iteratively removed:

[0110] For any busbar If deg(v) i If ) = 1, then remove it from the parent set. Removed from the middle, its only associated branch e ij Marked as "covered" (added to the covered branch set ε) c ), and update the adjacent bus v j Related branch set And its degree; repeat this process until the degree of the remaining buses is greater than 1, to obtain the simplified system topology:

[0111]

[0112] Subsequently, from simplified topology Randomly select the starting bus v i Add to candidate bus set

[0113] From candidate bus set Choose the bus v with the smallest out-degree (i.e., the smallest number of associated branches). i and from Remove from;

[0114] For bus v i Related branches Sort by adjacent busbar degrees in ascending order to obtain a sorted list.

[0115] Traversing the list branch e ij Determine if it is a second type of invalid branch: if e ij Add ε m If it does not form a ring structure, then add ε. m and ε c and adjacent busbar v j join in At the same time from and Remove e from middle ij and update v i and v j The degree;

[0116] Check bus V i and v j The associated branches are identified, and a third type of invalid branch is identified: if the bus degree drops to 1, then it is removed from the list of invalid branches. Removed from the middle, its remaining related branches are marked as "overwritten" and added to ε. c Update the associated branch set and degree of adjacent buses;

[0117] Iterate until all branches are covered (i.e., |ε) c |=|ε|).

[0118] Step S5: Based on the moving target defense strategy, modify the admittance value of the branch in the modified branch set, change the measurement matrix, and achieve low-overhead moving target defense.

[0119] Specifically, the admittance value of a branch in the branch set is modified using the D-FACTS device.

[0120] Example 2

[0121] This embodiment, based on Embodiment 1 above, discloses a specific application example of a low-overhead mobile target defense method against fake data injection attacks.

[0122] 1) Based on the physical system characteristics in the smart grid, construct the smart grid topology, establish the measurement matrix, and create a system model under normal operating conditions:

[0123] Model the IEEE 14-bus system topology as a connected graph:

[0124]

[0125] in, For the set of generatrices; ε = {e 12 ,e 15 ,…,e 1314} represents the branch set (the IEEE 14-bus system contains 14 buses and 20 branches), and each branch e ij Connecting bus V i and v j And associated admittance value b ij For brevity, branch e will be referred to by its branch number in the following text. ij For example, ε = {1, 2, ..., 20}; define the bus v i The associated branch set is Its degree is

[0126] The system model is represented as follows:

[0127] y = Hx + z

[0128] The measurement vector y includes the active power injection of the bus and the power flow of the line, the state variable x is the voltage angle of the bus, and H is constructed from the system topology and admittance value.

[0129] 2) Establish criteria for identifying invalid branches:

[0130] For the first type of invalid branch, if the parent node is a leaf node of degree 1, then remove the parent node and add its associated branches to the cover set;

[0131] For the second type of invalid branches, if adding a branch to the modified branch set would create a loop, then only add it to the cover set;

[0132] For the third type of invalid branch, if all other branches of a certain bus line have been covered and its degree has dropped to 1, then the bus line is removed from the candidate set and the remaining branches are added to the coverage set.

[0133] 3) Based on the invalid branch identification criteria and smart grid topology, determine invalid branches in the power grid:

[0134] Initialize the candidate set and parameters, including initializing the modified branch set. Candidate bus set Covering branch set

[0135] Identify the first type of invalid branch, find that the parent branch v8 is a leaf node of degree 1 (deg(v8)=1), remove it, and add its associated branch 14 to ε. c At this point, the degree of all remaining busbars is greater than 1, the simplification process ends, and the simplified topology is obtained.

[0136] at this time And ε={1,…,13,15,…,20}.

[0137] Based on the new topology, a starting bus is randomly selected and the branch to be modified is iteratively selected, and other parameters are updated until all 20 branches are covered;

[0138] In this embodiment, bus 4 is randomly selected as the starting bus and added to the candidate set. Because of |ε c Therefore, we first start with the candidate bus set. Select the bus with the lowest degree of selection, i.e., the unique bus v4, and then select it from... Removed from the middle.

[0139] Associated branches of bus v4 Sort by adjacent busbar degrees in ascending order to obtain a sorted list. At this point, iterate through the list. In the middle, add branches 8, 6, 4, and 7 to ε in sequence. m and ε c Branch 9 was identified as a second-type invalid branch, and only ε was added. c Buses 7, 3, 2, 5, and 9 were then added to the candidate set. In the middle, at this time

[0140] For the main branch in the candidate set, from its associated branch set and Remove e from middle ij and update v i and v j The degree of invalidity is then determined, and the existence of a third type of invalid branch is then identified.

[0141] For example, branch 8 from and After removal, the degrees of buses 4 and 7 each decreased by 1. Inspection revealed that the degree of bus 7 had dropped to 1, and the remaining branch belonged to the third type of invalid branch. Remove the bus and add its associated branch 15 to the cover branch set ε. c Busbar 4 has a degree greater than 1 and is not processed. Subsequent branches 6, 4, 7, and 9 are processed in the same way.

[0142] The processed parameters are as follows:

[0143] ε c ={14,8,15,6,3,4,7,9};ε m ={8,6,4,7}.

[0144] The bus degrees in the candidate bus set are 2, 2, and 3 respectively, and the associated branch for bus v2 is... Sort by adjacent busbar degrees in ascending order to obtain a sorted list. Branch 1 adds ε m and ε cBranch 5 was determined to be a second-type invalid branch, and only ε was added. c Subsequently, bus 1 was added to the candidate set. Busbar 5 is already in the candidate set, at this time Update their degrees to 1, 2, and 2 respectively. At this point, branch 2 associated with bus 1 is a third type of invalid branch. Branch 5 is handled similarly, and the parameters are:

[0145] ε c ={14,8,15,6,3,4,7,9,1,2,5,10};ε m ={8,6,4,7,1}.

[0146] The bus degrees in the candidate bus set are 2 and 3 respectively. The associated branch of bus v9 will be... Sort by ascending order of adjacent bus length, and get Following the above procedure, ε is added to branch 16. m Then, continuously remove the single-degree branches connected to it until bus 13 and 6 are added, and bus 6 is already in the candidate set. At this time, the parameters are:

[0147] ε c ={14,8,15,6,3,4,7,9,1,2,5,10,16,17,18,11,20};ε m ={8,6,4,7,1,16}.

[0148] The bus degrees in the candidate bus set are 2 and 2 respectively. The associated branch of bus v6 will be... Sort by ascending order of adjacent bus length, and get Branch 13 adds ε m and ε c Branch 19, associated with bus 13, belongs to the third type of invalid branch. Remove bus 13 and add branch 19 to ε. c The bus 12 connected to branch 12 is also a single-degree line, and is handled in the same way. At this time, |ε c |=|ε|;ε m ={8,6,4,7,1,16,13}; Iteration complete.

[0149] At this point, the final ε obtained in step 3) m This refers to the branch set where mobile target defense needs to be deployed, such as... Figure 2 Branches 8, 6, 4, 7, 1, 16, and 13 marked in blue represent the deployment scheme of this method in the IEEE 14 bus system.

[0150] To verify the performance of this method, simulations were performed on the IEEE test system, with each test system repeated 50 times to balance statistical reliability and computational burden. m Modifications to the branch admittance are all limited to the scope of physical constraints.

[0151] The performance of the algorithm is as follows Figure 3-8 As shown, the vertical axis represents the stealth attack space dim(S) a The dimension of ε is represented by the horizontal axis, where the horizontal axis represents the number of iterations. Each iteration corresponds to one execution of step 3), during which one or more branches are added to ε. m In the middle, when multiple trials yield the same result in the same iteration, only one intersection point is displayed. It can be seen that as the iteration progresses, dim(S) a The continuous decline indicates that the present invention can effectively select influential branches, avoid redundancy, and improve computational and resource efficiency.

[0152] The specific performance varies slightly depending on the system size: for small-scale systems, such as... Figure 3 China 6 busbar and Figure 4 The method converges to the minimum dimension in just a few iterations with 14 busbars, demonstrating its effectiveness in small systems; in large systems, the dimension reduction is approximately linear.

[0153] Figures 3-8 It also shows that the random selection of the starting bus does not affect convergence, and all experiments converge to the same minimum dimension, proving the robustness of the proposed method.

[0154] Table 1 below compares this method with the following three MTD strategies:

[0155] PFDD strategy (B.Li, G.Xiao, et.al.On feasibility and limitations of detecting false data injection attacks on power grid state estimation usingD-FACTS devices[J]. IEEE Transactions on Industrial Informatics, 2020,16(2):854-864);

[0156] Optimal MTD strategy (B. Liu, H. Wu. Optimal planning and operation of hidden moving target defense for maximal detection effectiveness [J]. IEEE Transactions on Smart Grid, 2021, 12 (5): 4447-4459);

[0157] Robust MTD strategy (W. Xu, IM Jaimoukha, et.al. Robust moving target defense against false data injection attacks in power grids[J]. IEEE Transactions on Information Forensics and Security, 2023, 18: 29-40).

[0158] The performance of each strategy is evaluated using the following three metrics:

[0159] Security effectiveness, through the final stealth attack space dim(S a ) to measure;

[0160] Resource cost is measured by the number of branches that need to be modified, i.e., |ε m |;

[0161] The cost of computation is measured in execution time (in seconds).

[0162] Table 1. Comparison of this method with other MTD strategies.

[0163]

[0164] Table 1 shows that the proposed method outperforms the other three strategies in most test cases. Except in the 6-bus system where the proposed method exhibits the same performance across all metrics as the other strategies, in the remaining systems, the proposed method outperforms the comparative strategies in at least one metric, with the remaining metrics showing comparable performance. Especially in large-scale systems, the proposed method can significantly reduce resource costs without sacrificing security.

[0165] Example 3

[0166] Based on Embodiment 1, this embodiment provides an electronic device, including: one or more processors and a memory, wherein the memory stores one or more programs, the one or more programs including instructions for executing the aforementioned low-overhead mobile target defense method against fake data injection attacks.

[0167] At the hardware level, the electronic device includes a processor, internal bus, network interface, memory, and non-volatile memory, and may also include other hardware required for business operations. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement the aforementioned low-overhead mobile target defense method against spoofed data injection attacks. Of course, in addition to software implementation, this invention does not exclude other implementation methods, such as logic devices or a combination of hardware and software, etc. That is to say, the execution subject of the following processing flow is not limited to individual logic units, but can also be hardware or logic devices.

[0168] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0169] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0170] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A low-overhead method for defending against fake data injection attacks on moving targets, characterized in that, The method includes: Based on actual smart grid data, the topology of the grid bus and branches is constructed, and the branches are associated with the initial admittance value; Based on the initial admittance value and the topology of the power grid bus and branches, an initial measurement matrix is ​​established, and a moving target defense strategy is constructed based on the initial measurement matrix. Based on the invalid branch identification criteria and the topology of the power grid buses and branches, invalid branches in the power grid are identified. Based on the aforementioned invalid branches and greedy selection mechanism, the main line is traversed to filter valid branches and obtain the modified branch set; Based on the moving target defense strategy, the admittance value of the branch in the modified branch set is modified, and the measurement matrix is ​​changed to achieve low-overhead moving target defense.

2. The low-overhead mobile target defense method against spoofing data injection attacks according to claim 1, characterized in that, The topology of the power grid bus and branches is a connected graph, and its expression is: and ij ∈ε in, ε is the set of parent lines; ε is the set of branches, and each branch e ij Connect bus V respectively i and v j And associated admittance value b ij .

3. The low-overhead mobile target defense method against spoofing data injection attacks according to claim 1, characterized in that, The measurement matrix is ​​a Jacobian matrix calculated based on the topology of the power grid bus and branches and the initial admittance value.

4. The low-overhead mobile target defense method against spoofing data injection attacks according to claim 1, characterized in that, The process of constructing the mobile target defense strategy includes: Based on actual smart grid data and the topology of grid buses and branches, a system model under normal operating conditions is constructed; Based on the system model under normal operating conditions, the attacker's attack vector is constructed, and the system model under attack conditions is obtained. Based on the attacker's attack vector, a mobile target defense strategy is constructed.

5. A low-overhead mobile target defense method against spoofing data injection attacks according to claim 4, characterized in that, The expression for the system model under normal operating conditions is: y = Hx + z Where y is the active power of the measured value vector, y∈R m This includes the net active power injection into the bus and the active power flowing bidirectionally along the transmission line; x is the system state variable vector, x∈R n The state variable corresponds to the voltage angle of the bus; H is the measurement matrix, H∈R m×n z represents system noise, z∈R m ; The expression for the system model under attack is: and a =Hx+z+a Among them, y a For the tampered measurement vector, y a ∈R m ;a is an attack vector that can evade detection and cause the estimated state to deviate from the original value, a∈R m ; a∈col(H) a = Hc Where col(*) represents the column space; c is the error injected by the attacker into the state variable x, c∈R n An attack vector a that satisfies the conditions a∈col(H) and a=Hc can bypass the system's bad data detection mechanism.

6. A low-overhead mobile target defense method against spoofed data injection attacks according to claim 1, characterized in that, The moving target defense strategy is to generate a new measurement matrix by changing the branch admittance, thereby reducing the dimension of the covert attack space and increasing the probability of detecting injection attacks. The expression for the hidden attack space is: S a =col(H)∩col(H′) Among them, S a H represents the concealed attack space; H is the initial measurement matrix; H′ is the new measurement matrix, H′∈R m×n col(*) represents column space; The expression for the dimension of the concealed attack space is: dim(S a )=2n-rank[H|ΔH] ΔH=HH′ Where n is the number of busbars; [H|ΔH] is the augmented matrix.

7. A low-overhead mobile target defense method against spoofing data injection attacks according to claim 1, characterized in that, The invalid branch identification criteria include: Branches whose connecting busbars are only connected to the power grid through this branch are classified as invalid branches; Branches that, when added to the modification branch set, would form a loop with existing modification branches in the modification branch set would be classified as invalid branches. Branches whose connecting buses are connected to the power grid through multiple branches, and whose branches other than the current branch have all been modified, are classified as invalid branches.

8. A low-overhead mobile target defense method against spoofing data injection attacks according to claim 1, characterized in that, The admittance value of the branch in the modified branch set is modified using the D-FACTS device.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the low-overhead mobile target defense method against false data injection attacks as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the low-overhead mobile target defense method against spoofing data injection attacks as described in any one of claims 1-8.

Images