Power fdia detection method and system based on multi-granularity dynamic graph

Abstract

This invention discloses a power FDIA detection method and system based on multi-granularity dynamic graphs. The method includes: dynamically constructing a two-layer power grid topology graph at the device and region levels based on real-time switch states, and calculating a weighted adjacency matrix; inputting power grid measurement data and the graph structure into the spatiotemporal feature extraction module of the detection model, extracting and fusing spatiotemporal features through a graph attention network and a temporal convolutional network; outputting anomaly probability scores and physical interpretability indicators such as node power imbalance and line power flow anomaly amplitude through a physical consistency constraint module; employing a hierarchical inference strategy for efficient detection, and combining an online incremental learning mechanism to enable the model to continuously adapt to new attacks and topology changes. This invention, by deeply integrating power grid physical constraints and spatiotemporal deep learning, significantly improves the detection accuracy, robustness, and interpretability of covert spoofing attacks, and possesses adaptive capabilities to dynamic topologies.

Description

Technical Field

[0001] This invention belongs to the field of power automation technology, and particularly relates to a power FDIA detection method and system based on multi-granularity dynamic graphs. Background Technology

[0002] With the deep integration of power systems and information networks, power cyber-physical systems face increasingly severe cybersecurity threats. False Data Injection Attack (FDIA) is an advanced attack method that maliciously alters measurement data to cause state estimation results to deviate from the true values, thereby misleading scheduling decisions and disrupting the stable operation of the system. Traditional FDIA detection methods based on residual chi-square tests are largely ineffective against carefully crafted "stealth attacks" that satisfy the physical constraints of power flow equations.

[0003] In recent years, deep learning-based methods have provided new ideas for FDIA detection. However, most existing methods have the following limitations: (1) They are mostly data-driven and fail to explicitly embed the strong physical constraints of the power system (such as power flow equations and power balance) into the model, resulting in poor robustness against stealth attacks; (2) They usually assume that the power grid topology is fixed, making it difficult to adapt to the dynamic changes in the topology caused by switching operations and line switching in actual operation; (3) The model output is mostly a "black box" anomaly score, lacking specific explanations of the attack location and violation of physical laws, which is not conducive to the rapid location and handling by operation and maintenance personnel.

[0004] Therefore, there is an urgent need for an intelligent FDIA detection method that can integrate physical laws, adapt to dynamic topological changes, and provide interpretable results. Summary of the Invention

[0005] This invention aims to overcome the shortcomings of the prior art and provide a power FDIA detection method and system based on multi-granularity dynamic graphs. This invention achieves high-precision, adaptive, and interpretable detection of spoofed data injection attacks by dynamically constructing a two-layer, multi-granularity power grid topology graph and designing a deep learning model that integrates physical consistency constraints.

[0006] In a first aspect, the present invention provides a power FDIA detection method based on multi-granularity dynamic graphs, comprising: The power system obtains the switching status information at a preset time and dynamically constructs a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with substations or regions as nodes. The edge weights between nodes are calculated based on line impedance and power transmission, and a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph are generated in real time. The measurement information of power equipment at a preset time is obtained. The measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix are input into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively. The spatial topological features and time series features are then fused to obtain spatiotemporal joint features. The spatiotemporal joint features are input into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitude. Determine whether the anomaly probability score is greater than a preset threshold; If the value exceeds a preset threshold, a fake data injection attack is determined to have occurred at the preset time, and an attack alarm, location information, and physical interpretability index at the preset time are output.

[0007] Secondly, the present invention provides a power FDIA detection system based on multi-granularity dynamic graphs, comprising: The module is configured to acquire the switching status information of the power system at a preset time and dynamically construct a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with power plants or regions as nodes. The generation module is configured to calculate the edge weights between nodes based on line impedance and power transmission, and generate in real time a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph. The fusion module is configured to acquire measurement information of power equipment at a preset time, and input the measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively, and fuses the spatial topological features and time series features to obtain spatiotemporal joint features. The output module is configured to input the spatiotemporal joint features into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitudes. The judgment module is configured to determine whether the abnormal probability score is greater than a preset threshold. The determination module is configured to determine if a false data injection attack has occurred at the preset time if the value exceeds a preset threshold, and output an attack alarm, location information, and physical interpretability index at the preset time.

[0008] Thirdly, an electronic device is provided, comprising: at least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the steps of the power FDIA detection method based on multi-granularity dynamic graphs according to any embodiment of the present invention.

[0009] Fourthly, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the steps of the power FDIA detection method based on multi-granularity dynamic graphs according to any embodiment of the present invention.

[0010] This application presents a power FDIA detection method and system based on multi-granularity dynamic graphs. It dynamically constructs a two-layer power grid topology graph at the device and regional levels based on real-time switch states and calculates a weighted adjacency matrix. Power grid measurement data and the graph structure are input into the spatiotemporal feature extraction module of the detection model. Spatiotemporal features are extracted and fused through a graph attention network and a temporal convolutional network. A physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators such as node power imbalance and line power flow anomaly amplitude. A hierarchical inference strategy is employed for efficient detection, and an online incremental learning mechanism is combined to enable the model to continuously adapt to new attacks and topology changes. This invention significantly improves the detection accuracy, robustness, and interpretability of covert spoofing attacks by deeply integrating power grid physical constraints and spatiotemporal deep learning, and possesses adaptive capabilities to dynamic topologies. Attached Figure Description

[0011] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 A flowchart of a power FDIA detection method based on multi-granularity dynamic graphs is provided as an embodiment of the present invention; Figure 2 This is a structural block diagram of a power FDIA detection system based on multi-granularity dynamic graphs, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] Please see Figure 1 The diagram shows a flowchart of a power FDIA detection method based on multi-granularity dynamic graphs according to this application.

[0015] like Figure 1 As shown, the power FDIA detection method based on multi-granularity dynamic graphs specifically includes the following steps: Step S101: Obtain the switching status information of the power system at a preset time, and dynamically construct a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with substations or regions as nodes.

[0016] In this step, sensors and monitoring systems deployed at substations, power plants, and other sites are used to synchronously collect real-time operating data of the power system at time t. The data mainly includes two categories: 1) Measurement information: voltage amplitude at each node. Phase angle (or equivalent active power) reactive power ), current ,frequency 2) Switch Status Information (SOE): Records the opening and closing status of equipment such as circuit breakers and disconnectors, used to characterize the topological connection relationship of the power grid.

[0017] The collected raw measurement information is standardized to eliminate dimensional differences. The formula is as follows: ,in and These represent the historical mean and standard deviation of this type of data, respectively. The processed data constitutes the set of normalized node feature vectors at time t. .

[0018] It should be noted that the equipment-level diagram is used to describe the fine-grained physical connection relationships between equipment within the power grid. Nodes include power equipment such as busbars, circuit breakers, disconnect switches, transformers, generators, and transmission line terminals, while edges represent the direct electrical connection relationships between equipment. Regional-level maps are used to describe the macroscopic power interaction relationships between different substations or power supply areas. They aggregate equipment-level nodes within the same substation, power plant, or preset geographical area to form regional-level nodes. Regional-level nodes are connected by interconnecting lines, and regional-level edge relationships are constructed based on the power exchange between regions. The aforementioned two-layer, multi-granularity topology structure can characterize both the real-time coupling relationship between local devices and the cross-regional power transmission characteristics, thereby enhancing the modeling capability for complex FDIA attacks.

[0019] Step S102: Calculate the edge weights between nodes based on line impedance and power transmission amount, and generate in real time a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph.

[0020] In this step, the step of calculating the edge weights between nodes based on line impedance and power transmission, and generating in real time the device-level weighted adjacency matrix corresponding to the device-level graph, and the region-level weighted adjacency matrix corresponding to the region-level graph, includes: Based on the real-time collected switch operation event information, a device-level diagram is generated at time t. ,in, For a set of nodes, Let be the set of edges at time t. Let be the device-level adjacency matrix at time t; Define aggregation matrix The aggregation matrix is ​​a matrix consisting of the number of region nodes multiplied by the number of device-level nodes. The device-level graph is mapped to the region-level graph based on this aggregation matrix. The region-level node features in the region-level graph are represented as follows: The region-level adjacency matrix is ​​represented as , Represents a set of region nodes. Let be the device-level node feature matrix at time t. This is the matrix transpose operator; For nodes i and j, based on the line impedance magnitude With active power transmission Calculate edge weights And calculate the corresponding elements of the device-level adjacency matrix and the region-level adjacency matrix respectively; When the switch operation event is triggered, update the function. and The device-level weighted adjacency matrix and the region-level weighted adjacency matrix are dynamically updated, wherein, Let be the set of open / closed states of all switching devices in the power system at time t. This is the adjacency matrix update function.

[0021] Step S103: Obtain measurement information of power equipment at a preset time. Input the measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively. Then, it fuses the spatial topological features and the time series features to obtain spatiotemporal joint features.

[0022] In this step, for the device-level graph and the region-level graph, a graph attention network is used to update the features of each node i to obtain spatial topology features, expressed as: , , , , In the formula, Let i be the spatial topological feature vector of node i in the (t+1)th layer. It is a non-linear activation function. Let be the set of neighboring nodes of node i at time t, that is, all nodes that have a physical connection with node i. Let be the attention coefficient of node i at layer t to its neighbor node j. This is the trainable first feature transformation matrix, used to map the features of neighboring nodes to the representation space of the current layer. Let j be the spatial topological feature vector of node j in layer t. This is a modified linear unit activation function with leakage, used to alleviate the vanishing gradient problem and enhance the nonlinear expression of the model. This is the transpose of the attention vector 'a', used to calculate the attention weights of nodes for features. Let i be the spatial topological feature vector of node i in layer t. The unnormalized attention score between node i and its neighbor j at time t. The unnormalized attention score between node i and its neighbor k at time t. The temperature coefficient at time t is used to adjust the smoothness of the attention distribution. The trainable second feature transformation matrix maps node features to the attention computation space. These are preset weighting coefficients used to balance the importance of topological physical information and node characteristics. Let be the edge weight between node i and node j at time t. The hyperbolic tangent activation function is used. The trainable third feature transformation matrix maps the edge feature vectors to an appropriate dimension. Let be the feature vector of the edge between node i and node j at time t. The preset scaling factor. This is the initial value of the temperature coefficient. It is a sigmoid activation function. Indicates a time step. The attenuation rate constant is In order to be in At time t, the L2 norm of the nodal active power imbalance vector represents the overall magnitude of the deviation between the predicted and measured active power values ​​for all nodes. In order to be in At any given time, the L2 norm of the power flow anomaly amplitude vector represents the overall magnitude of the deviation between the predicted and measured power flow values ​​for all lines. This is a vector concatenation operation; By performing causal dilated convolution through a temporal convolutional network, the time series of node measurements is modeled to obtain time series features, expressed as: , , In the formula, Let t be the time-series feature vector output by the temporal convolutional network. This is a one-dimensional convolution operation used to capture local dependency patterns in time series data. It is a multilayer perceptron. Given the input sequence at time step [tk,t], The kernel size is [size]. These are the convolution kernel parameters that are dynamically generated based on the characteristics of the input sequence.

[0023] Step S104: Input the spatiotemporal joint features into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitudes.

[0024] In this step, the physical consistency constraint module includes an equation hard constraint layer, a physical consistency comparison loss layer, and a physical factor output layer. The hard constraint layer of the equations is used to embed differentiable nodal active and reactive power flow equations to calculate predicted state variables. With measurement value Physical deviation loss between The expression is: , , , In the formula, This represents the total number of nodes to be calculated in the power system. Let be the predicted active power value for node i. Let be the measured value of active power at node i. Let i be the predicted reactive power value. Let be the reactive power measurement value of node i. Let be the voltage amplitude at node i. Let J be the voltage magnitude at node j. Let i be the electrical conductance between node i and node j. The voltage phase angle difference between node i and node j. The susceptance between node i and node j; The physical consistency comparison loss layer is used to construct the comparison loss function. ,in This is the adjacency matrix update function. For distance measurement, and These represent physically consistent and inconsistent samples, respectively. It is the interval constant; The physical factor output layer outputs anomaly probability scores based on the spatiotemporal joint features. , This is the spatiotemporal joint feature vector input to the physical factor output layer. This is the transpose of the trainable weight vector of the physical factor output layer, and it synchronously outputs the active power imbalance value of the nodes. Node reactive power imbalance value and the amplitude of abnormal power flow in the line As an interpretability indicator, Here is the predicted power flow value for line ij. The measured value of the power flow in line ij.

[0025] Step S105: Determine whether the abnormal probability score is greater than a preset threshold.

[0026] In this step, at the edge, the fake data injection attack detection model is used to calculate the real-time measurement data to obtain a preliminary anomaly score. ,when At that time, the corresponding sample is marked as a suspected abnormal sample, where, To preset the edge threshold, For the edge output layer bias term, This is the transpose of the weight vector of the output layer at the edge, used for linear mapping of the edge features. The local feature vector extracted from the edge at time t. Use the Sigmoid activation function; At the central end, the suspected abnormal samples are precisely analyzed using the fake data injection attack detection model to obtain a refined anomaly score. ,in, This is a mapping function for full-precision attack detection at the center end. The input sample at time t includes real-time measurement data, a two-layer multi-granularity power grid topology structure, and spatiotemporal joint features; Weights are adaptively calculated based on operating load. , This is an adaptive adjustment coefficient used to control the smoothness of weight changes with load. The real-time operating load at time t, The preliminary anomaly score and the refined anomaly score are weighted and fused to obtain the anomaly probability score, based on a preset load baseline threshold. ; Exponentially weighted moving average based on historical outlier scores with standard deviation Calculate the preset threshold , These are the sensitivity adjustment parameters.

[0027] Step S106: If the value is greater than a preset threshold, it is determined that a false data injection attack has occurred at the preset time, and an attack alarm, location information, and physical interpretability index at the preset time are output.

[0028] In summary, the method in this application dynamically constructs a two-layer, multi-granularity power grid topology graph at both the device and regional levels, and updates its weighted adjacency matrix in real time. This enables the detection model to accurately characterize the physical connections and regional power exchange relationships of the power grid, and to adapt to dynamic topology changes caused by switching operations and line switching, thereby overcoming the performance degradation problem of traditional static models under topology changes. Furthermore, by explicitly embedding hard constraints of differentiable power flow equations and physical consistency comparison loss in the backend of the spatiotemporal feature extraction module that integrates graph attention networks and temporal convolutional networks, the physical laws of the power system are deeply integrated into the model training. This allows the model to not only learn data patterns but also to analyze the power grid state in a way that conforms to physical laws, thus possessing unprecedented high sensitivity and strong robustness against carefully constructed "invisible" false data injection attacks that satisfy traditional residual detection. In addition, the model innovatively synchronizes... The system outputs physical interpretability indicators such as node power imbalance values ​​and line power flow anomalies, transforming traditional "black box" anomaly scores into intuitive and concrete evidence of physical violations. This greatly assists maintenance personnel in quickly locating the source of attacks and analyzing attack methods, improving the credibility of detection results and processing efficiency. At the deployment and application level, a layered inference strategy is adopted, combining lightweight initial screening at the edge and full-precision verification at the center. An adaptive score fusion and dynamic threshold determination mechanism based on operational load is introduced, significantly reducing the average system processing latency while ensuring high detection accuracy, meeting the stringent real-time requirements of power monitoring systems. In summary, this invention provides an intelligent detection solution for power spoofing attacks that integrates high precision, strong adaptability, real-time response, interpretability, and continuous evolution capabilities, effectively improving the proactive defense and secure operation level of power cyber-physical systems.

[0029] Please see Figure 2The diagram shows a structural block diagram of a power FDIA detection system based on multi-granularity dynamic graphs according to this application.

[0030] like Figure 2 As shown, the power FDIA detection system 200 includes a construction module 210, a generation module 220, a fusion module 230, an output module 240, a judgment module 250, and a determination module 260.

[0031] The construction module 210 is configured to acquire the switching state information of the power system at a preset time, and dynamically construct a two-layer multi-granularity power grid topology structure based on the switching state information. The two-layer multi-granularity power grid topology structure includes a device-level graph with electrical equipment endpoints as nodes and a region-level graph with substations or regions as nodes. The generation module 220 is configured to calculate the edge weights between nodes based on line impedance and power transmission, and generate in real time a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph. The fusion module 230 is configured to acquire the measurement information of the power equipment at a preset time, and input the measurement information, the two-layer multi-granularity power grid topology structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix into the spatiotemporal feature extraction module of a pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module is based on the device-level weighted adjacency matrix... The array and the region-level weighted adjacency matrix are used to extract spatial topological features through a graph attention network and temporal series features through a temporal convolutional network. The spatial topological features and temporal series features are then fused to obtain spatiotemporal joint features. Output module 240 is configured to input the spatiotemporal joint features into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indices based on hard constraint loss of differentiable power flow equations and physical consistency comparison loss based on feature comparison. The physical interpretability indices include node power imbalance values ​​and line power flow anomaly amplitudes. Judgment module 250 is configured to determine whether the anomaly probability score is greater than a preset threshold. Determination module 260 is configured to determine that a fake data injection attack has occurred at a preset time if the score is greater than the preset threshold, and output attack alarms, location information, and physical interpretability indices at the preset time.

[0032] It should be understood that Figure 2 The modules and references described in the document Figure 1 The steps described in the text correspond to those in the method described above. Therefore, the operations, features, and corresponding technical effects described above also apply to the method described in the text. Figure 2 The various modules in the document will not be described in detail here.

[0033] In other embodiments, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the program instructions are executed by a processor, the processor performs the power FDIA detection method based on multi-granularity dynamic graphs in any of the above method embodiments. In one embodiment, the computer-readable storage medium of the present invention stores computer-executable instructions, which are configured as follows: The power system obtains the switching status information at a preset time and dynamically constructs a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with substations or regions as nodes. The edge weights between nodes are calculated based on line impedance and power transmission, and a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph are generated in real time. The measurement information of power equipment at a preset time is obtained. The measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix are input into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively. The spatial topological features and time series features are then fused to obtain spatiotemporal joint features. The spatiotemporal joint features are input into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitude. Determine whether the anomaly probability score is greater than a preset threshold; If the value exceeds a preset threshold, a fake data injection attack is determined to have occurred at the preset time, and an attack alarm, location information, and physical interpretability index at the preset time are output.

[0034] Computer-readable storage media may include a stored program area and a stored data area, wherein the stored program area may store an operating system and an application program required for at least one function; the stored data area may store data created based on the use of the multi-granularity dynamic graph-based power FDIA inspection system, etc. Furthermore, the computer-readable storage medium may include high-speed random access memory, and may also include memory, such as at least one disk storage device, flash memory device, or other non-volatile solid-state storage device. In some embodiments, the computer-readable storage medium may optionally include memory remotely configured relative to a processor, which can be connected to the multi-granularity dynamic graph-based power FDIA inspection system via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0035] Figure 3 This is a schematic diagram of the structure of the electronic device provided in the embodiment of the present invention, such as... Figure 3 As shown, the device includes a processor 310 and a memory 320. The electronic device may also include an input device 330 and an output device 340. The processor 310, memory 320, input device 330, and output device 340 can be connected via a bus or other means. Figure 3 Taking a bus connection as an example, the memory 320 is the computer-readable storage medium described above. The processor 310 executes various server functions and data processing by running non-volatile software programs, instructions, and modules stored in the memory 320, thereby implementing the power FDIA detection method based on multi-granularity dynamic graphs described in the above method embodiment. The input device 330 can receive input digital or character information and generate key signal inputs related to user settings and function control of the power FDIA detection system based on multi-granularity dynamic graphs. The output device 340 may include a display device such as a screen.

[0036] The aforementioned electronic device can execute the method provided in the embodiments of the present invention, and has the corresponding functional modules and beneficial effects for executing the method. Technical details not described in detail in this embodiment can be found in the method provided in the embodiments of the present invention.

[0037] In one implementation, the above-described electronic device is applied to a power FDIA detection system based on multi-granularity dynamic graphs, serving as a client, and includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to: The power system obtains the switching status information at a preset time and dynamically constructs a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with substations or regions as nodes. The edge weights between nodes are calculated based on line impedance and power transmission, and a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph are generated in real time. The measurement information of power equipment at a preset time is obtained. The measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix are input into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively. The spatial topological features and time series features are then fused to obtain spatiotemporal joint features. The spatiotemporal joint features are input into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitude. Determine whether the anomaly probability score is greater than a preset threshold; If the value exceeds a preset threshold, a fake data injection attack is determined to have occurred at the preset time, and an attack alarm, location information, and physical interpretability index at the preset time are output.

[0038] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., including several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods of various embodiments or some parts of embodiments.

[0039] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A multi-granularity dynamic graph based power FDIA detection method, characterized in that, include: The power system obtains the switching status information at a preset time and dynamically constructs a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with substations or regions as nodes. The edge weights between nodes are calculated based on line impedance and power transmission, and a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph are generated in real time. The measurement information of power equipment at a preset time is obtained. The measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix are input into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively. The spatial topological features and time series features are then fused to obtain spatiotemporal joint features. The spatiotemporal joint features are input into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitude. Determine whether the anomaly probability score is greater than a preset threshold; If the value exceeds a preset threshold, a fake data injection attack is determined to have occurred at the preset time, and an attack alarm, location information, and physical interpretability index at the preset time are output.

2. The method of claim 1, wherein, The step of calculating the edge weights between nodes based on line impedance and power transmission, and generating in real time a device-level weighted adjacency matrix corresponding to the device-level graph, and a region-level weighted adjacency matrix corresponding to the region-level graph, includes: According to the real-time collected switch operation event information, a device level graph is generated at time t wherein, is a node set, is an edge set at time t, is a device level adjacency matrix at time t; Defining an aggregation matrix , the aggregation matrix is a matrix of the number of regional nodes x the number of device-level nodes, the device-level graph is mapped to a regional-level graph according to the aggregation matrix, wherein a regional-level node feature in the regional-level graph is represented as , a regional-level adjacency matrix is represented as , , a regional node set is represented as , a device-level node feature matrix at time t is represented as , a matrix transposition operator symbol is represented as For nodes i and j, based on the line impedance magnitude... With active power transmission Calculate edge weights And calculate the corresponding elements of the device-level adjacency matrix and the region-level adjacency matrix respectively; When the switch operation event is triggered, update the function. and The device-level weighted adjacency matrix and the region-level weighted adjacency matrix are dynamically updated, wherein, Let be the set of open / closed states of all switching devices in the power system at time t. This is the adjacency matrix update function.

3. The power FDIA detection method based on multi-granularity dynamic graphs according to claim 1, characterized in that, The step of extracting spatial topological features through a graph attention network and extracting time-series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix includes: For the device-level graph and the region-level graph, a graph attention network is used to update the features of each node i to obtain spatial topology features, expressed as: ， ， ， ， In the formula, Let i be the spatial topological feature vector of node i in the (t+1)th layer. It is a non-linear activation function. Let be the set of neighboring nodes of node i at time t, that is, all nodes that have a physical connection with node i. Let be the attention coefficient of node i at layer t to its neighbor node j. This is the trainable first feature transformation matrix, used to map the features of neighboring nodes to the representation space of the current layer. Let j be the spatial topological feature vector of node j in layer t. This is a modified linear unit activation function with leakage, used to alleviate the vanishing gradient problem and enhance the nonlinear expression of the model. This is the transpose of the attention vector 'a', used to calculate the attention weights of nodes for features. Let i be the spatial topological feature vector of node i in layer t. The unnormalized attention score between node i and its neighbor j at time t. The unnormalized attention score between node i and its neighbor k at time t. The temperature coefficient at time t is used to adjust the smoothness of the attention distribution. The trainable second feature transformation matrix maps node features to the attention computation space. These are preset weighting coefficients used to balance the importance of topological physical information and node characteristics. Let be the edge weight between node i and node j at time t. The hyperbolic tangent activation function is used. The trainable third feature transformation matrix maps the edge feature vectors to an appropriate dimension. Let be the feature vector of the edge between node i and node j at time t. The preset scaling factor. This is the initial value of the temperature coefficient. It is a sigmoid activation function. Indicates a time step. The attenuation rate constant is In order to be in At time t, the L2 norm of the nodal active power imbalance vector represents the overall magnitude of the deviation between the predicted and measured active power values ​​for all nodes. In order to be in At any given time, the L2 norm of the power flow anomaly amplitude vector represents the overall magnitude of the deviation between the predicted and measured power flow values ​​for all lines. This is a vector concatenation operation; By performing causal dilated convolution through a temporal convolutional network, the time series of node measurements is modeled to obtain time series features, expressed as: ， ， In the formula, Let t be the time-series feature vector output by the temporal convolutional network. This is a one-dimensional convolution operation used to capture local dependency patterns in time series data. It is a multilayer perceptron. Given the input sequence at time step [tk,t], The kernel size is [size]. These are the convolution kernel parameters that are dynamically generated based on the characteristics of the input sequence.

4. The power FDIA detection method based on multi-granularity dynamic graphs according to claim 1, characterized in that, The physical consistency constraint module includes an equation hard constraint layer, a physical consistency comparison loss layer, and a physical factor output layer. The hard constraint layer of the equations is used to embed differentiable nodal active and reactive power flow equations to calculate predicted state variables. With measurement value Physical deviation loss between The expression is: ， ， ， In the formula, This represents the total number of nodes to be calculated in the power system. Let be the predicted active power value for node i. Let be the measured value of active power at node i. Let i be the predicted reactive power value. Let be the reactive power measurement value of node i. Let be the voltage magnitude at node i. Let J be the voltage magnitude at node j. Let i be the electrical conductance between node i and node j. The voltage phase angle difference between node i and node j. The susceptance between node i and node j; The physical consistency comparison loss layer is used to construct the comparison loss function. ,in This is the adjacency matrix update function. For distance measurement, and These represent physically consistent and inconsistent samples, respectively. It is the interval constant; The physical factor output layer outputs anomaly probability scores based on the spatiotemporal joint features. , This is the spatiotemporal joint feature vector input to the physical factor output layer. This is the transpose of the trainable weight vector of the physical factor output layer, and it synchronously outputs the active power imbalance value of the nodes. Node reactive power imbalance value and the magnitude of abnormal power flow in the line As an interpretability indicator, Here is the predicted power flow value for line ij. The measured value of the power flow in line ij.

5. The power FDIA detection method based on multi-granularity dynamic graphs according to claim 1, characterized in that, Before determining whether the anomaly probability score is greater than a preset threshold, the method further includes: At the edge, the aforementioned fake data injection attack detection model is used to calculate real-time measurement data to obtain a preliminary anomaly score. ,when At that time, the corresponding sample is marked as a suspected abnormal sample, where, To preset the edge threshold, For the edge output layer bias term, This is the transpose of the weight vector of the output layer at the edge, used for linear mapping of edge features. The local feature vector extracted from the edge at time t. Use the Sigmoid activation function; At the central end, the suspected abnormal samples are precisely analyzed using the fake data injection attack detection model to obtain a refined anomaly score. ,in, This is a mapping function for full-precision attack detection at the center end. The input sample at time t includes real-time measurement data, a two-layer multi-granularity power grid topology structure, and spatiotemporal joint features. Weights are adaptively calculated based on operating load. , This is an adaptive adjustment coefficient used to control the smoothness of weight changes with load. The real-time operating load at time t, The preliminary anomaly score and the refined anomaly score are weighted and fused to obtain the anomaly probability score, based on a preset load baseline threshold. ; Exponentially weighted moving average based on historical outlier scores with standard deviation Calculate the preset threshold , These are the sensitivity adjustment parameters.

6. A power FDIA detection system based on multi-granularity dynamic graphs, characterized in that, include: The module is configured to acquire the switching status information of the power system at a preset time and dynamically construct a two-layer multi-granularity power grid topology structure based on the switching status information. The two-layer multi-granularity power grid topology structure includes a device-level diagram with electrical equipment endpoints as nodes and a region-level diagram with power plants or regions as nodes. The generation module is configured to calculate the edge weights between nodes based on line impedance and power transmission, and generate in real time a device-level weighted adjacency matrix corresponding to the device-level graph and a region-level weighted adjacency matrix corresponding to the region-level graph. The fusion module is configured to acquire measurement information of power equipment at a preset time, and input the measurement information, the two-layer multi-granularity power grid topology graph structure, the device-level weighted adjacency matrix, and the region-level weighted adjacency matrix into the spatiotemporal feature extraction module of the pre-constructed fake data injection attack detection model. The spatiotemporal feature extraction module extracts spatial topological features through a graph attention network and extracts time series features through a temporal convolutional network based on the device-level weighted adjacency matrix and the region-level weighted adjacency matrix, respectively, and fuses the spatial topological features and time series features to obtain spatiotemporal joint features. The output module is configured to input the spatiotemporal joint features into the physical consistency constraint module of the fake data injection attack detection model. The physical consistency constraint module outputs anomaly probability scores and physical interpretability indicators based on the hard constraint loss of the differentiable power flow equation and the physical consistency comparison loss based on feature comparison. The physical interpretability indicators include node power imbalance values ​​and line power flow anomaly amplitudes. The judgment module is configured to determine whether the abnormal probability score is greater than a preset threshold. The determination module is configured to determine if a false data injection attack has occurred at the preset time if the value exceeds a preset threshold, and output an attack alarm, location information, and physical interpretability index at the preset time.

7. An electronic device, characterized in that, include: At least one processor, and a memory communicatively connected to the at least one processor, wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method described in any one of claims 1 to 5.

Images