A method, device and system for detecting equipment attack in a power grid

Abstract

The present invention discloses a device attack detection method, device and system for a power grid. The device attack detection device includes a data acquisition unit, a model training unit and an attack detection unit. The device attack detection system includes an attack detection module and a data storage module. By performing feature selection on a first historical operation data group and a real-time operation data group of a power grid to be detected to achieve dimensionality reduction processing, and training a preset decision tree model combined with a KNN algorithm based on the historical operation data group after dimensionality reduction for attack detection on the real-time operation data group, the device attack detection method, device and system improve the convenience and efficiency of device attack behavior detection in the power grid; further, the device attack detection method, device and system for a power grid provided by the present invention also improve the interactivity and intuitiveness of the device attack detection by sending the detection results obtained by the attack detection to the user.

Description

Technical Field

[0001] The present invention relates to the field of equipment attack detection for power grids, and in particular to a method, a device and a system for equipment attack detection for power grids. Background Art

[0002] The power industry is closely related to people's living standards. With the development of the times and the advancement of science and technology, more and more power equipment has been put into the power grid system, and the power grid structure has become increasingly large and complex. Faced with a complex power grid structure, equipment management is becoming more and more difficult. Failure to make timely judgments on unknown equipment may affect the safe and stable operation of the power grid, prompting power grid companies to have a deep understanding of the safety risk factors faced by power grid operation and improve the corresponding power grid operation safety risk control measures to promote the steady development of the power industry. In recent years, with the continuous development of information technology and intelligent control technology and the continuous improvement of computer data processing capabilities, people's cognition and management of new equipment need to be greatly improved. Guided by this demand, feature-selection-based power grid equipment management came into being.

[0003] In the prior art, after an attack is discovered, the attack behavior of devices in the power grid is often identified through manual detection.

[0004] However, the existing technology still has the following defects: manual detection makes the detection efficiency of power grid equipment attack behavior low and inconvenient.

[0005] Therefore, there is a need for a method, device and system for detecting equipment attacks in a power grid, so as to overcome the above-mentioned defects in the prior art. Summary of the invention

[0006] In view of the above-mentioned existing technical problems, the object of the present invention is to provide a method, device and system for detecting device attack in a power grid, so as to improve the convenience and efficiency of detecting device attack behavior in the power grid.

[0007] The present invention provides a device attack detection method for a power grid, the device attack detection method comprising: obtaining a first historical operation data group and a real-time operation data group of a power grid to be detected, performing feature selection on the first historical operation data group to obtain a second historical operation data group; training a preset decision tree model according to the second historical operation data group, thereby obtaining a device attack model; the decision tree model is constructed based on a decision tree and a KNN algorithm; and performing attack behavior detection on the real-time operation data group according to the device attack model, thereby obtaining a detection result.

[0008] In one embodiment, feature selection is performed on the first historical operation data group to obtain a second historical operation data group, specifically including: performing numerical normalization processing on the first historical operation data group to obtain a data group to be processed, and performing feature analysis on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond one-to-one to the feature vectors in the data feature vector set; clustering analysis is performed on the data feature set by using a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and a relationship matrix is ​​constructed according to each clustering result; the co-connection matrix of each data feature in the data feature set is calculated according to the relationship matrix and a preset co-connection matrix calculation formula; cluster analysis is performed on the co-connection matrix according to a hierarchical clustering algorithm to obtain a data feature cluster; representative features are selected from the data feature cluster according to a preset selection method, and the corresponding second historical operation data group is obtained according to the representative features.

[0009] In one embodiment, according to the device attack model, the real-time operation data group is subjected to attack behavior detection to obtain a detection result, which specifically includes: according to the representative features, the real-time operation data group is subjected to dimensionality reduction processing to obtain a dimensionality reduction data group and a corresponding first support; the first data in the dimensionality reduction data group that is identical to the second historical operation data group is screened out to determine a first classification result of the first data; the dimensionality reduction data group includes the first data and second data other than the first data; according to the first support of each second data, a number of third data are screened out from the second historical operation data group in turn, and each second data and the corresponding screened third data are input into the device attack model in turn to obtain a second classification result; the first classification result and the second classification result are output as detection results.

[0010] In one embodiment, after performing attack behavior detection on the real-time operation data group according to the device attack model to obtain a detection result, the device attack detection method further includes: sending the detection result to a user.

[0011] The present invention also provides an equipment attack detection device for a power grid, which includes a data acquisition unit, a model training unit and an attack detection unit; wherein the data acquisition unit is used to acquire a first historical operation data group and a real-time operation data group of the power grid to be detected, and perform feature selection on the first historical operation data group to obtain a second historical operation data group; the model training unit is used to train a preset decision tree model according to the second historical operation data group, so as to obtain an equipment attack model; the decision tree model is constructed based on a decision tree and a KNN algorithm; the attack detection unit is used to perform attack behavior detection on the real-time operation data group according to the equipment attack model, so as to obtain a detection result.

[0012] In one embodiment, the data acquisition unit is also used to: perform numerical normalization processing on the first historical operation data group to obtain a data group to be processed, and perform feature analysis on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond one-to-one to the feature vectors in the data feature vector set; perform cluster analysis on the data feature set respectively through a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and construct a relationship matrix according to each clustering result; calculate the co-connection matrix of each data feature in the data feature set according to the relationship matrix and a preset co-connection matrix calculation formula; perform cluster analysis on the co-connection matrix according to a hierarchical clustering algorithm to obtain a data feature cluster; select representative features from the data feature cluster according to a preset selection method, and obtain the corresponding second historical operation data group according to the representative features.

[0013] In one embodiment, the attack detection unit is also used to: perform dimensionality reduction processing on the real-time operation data group according to the representative features, so as to obtain a reduced dimensionality data group and a corresponding first support; filter out the first data in the reduced dimensionality data group that is the same as the second historical operation data group, so as to determine a first classification result of the first data; the reduced dimensionality data group includes the first data and second data other than the first data; filter out a number of third data from the second historical operation data group according to the first support of each second data, and input each second data and the corresponding filtered third data into the device attack model in turn, so as to obtain a second classification result; output the first classification result and the second classification result as detection results.

[0014] In one embodiment, the device attack detection apparatus further includes a result output unit, and the result output unit is used to send the detection result to a user.

[0015] The present invention also provides a device attack detection system for a power grid, the device attack detection system comprising an attack detection module and a data storage module, the attack detection module is communicatively connected to the data storage module, the data storage module is used to store all data, and the attack detection module is used to execute the device attack detection method for the power grid as described above based on all data stored in the data storage module.

[0016] In one embodiment, the device attack detection system further includes a user interaction module, which includes a communication unit, a touch / non-touch display screen, an input keyboard, a virtual keyboard, an indicator light, a microphone or a speaker.

[0017] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0018] The present invention provides a method, device and system for detecting device attacks in a power grid. The method, device and system improve the convenience and efficiency of detecting device attack behaviors in a power grid by performing feature selection on a first historical operation data group and a real-time operation data group of a power grid to be detected to achieve dimensionality reduction processing, and training a preset decision tree model combined with a KNN algorithm based on the historical operation data group after dimensionality reduction to perform attack detection on the real-time operation data group.

[0019] Furthermore, the method, apparatus and system for detecting device attacks in a power grid provided by the present invention also improve the interactivity and intuitiveness of device attack detection results by sending the detection results obtained by the attack detection to the user. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The present invention will be further described below in conjunction with the accompanying drawings, wherein:

[0021] Figure 1 A flow chart of an embodiment of a method for detecting device attack in a power grid according to the present invention is shown;

[0022] Figure 2 A structural diagram showing an embodiment of a device for detecting attack on a power grid according to the present invention;

[0023] Figure 3 A structural diagram of an embodiment of a power grid device attack detection system according to the present invention is shown. DETAILED DESCRIPTION

[0024] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention. Specific embodiment 1

[0026] The embodiment of the present invention firstly describes a method for detecting device attacks in a power grid. Figure 1 A flow chart of an embodiment of a method for detecting device attacks in a power grid according to the present invention is shown.

[0027] like Figure 1 As shown, the device attack detection method includes the following steps:

[0028] S1: Acquire a first historical operation data group and a real-time operation data group of the power grid to be detected, and perform feature selection on the first historical operation data group to acquire a second historical operation data group.

[0029] In this technical field, since the power grid to be detected is often large in scale, manually detecting attack behaviors in the power grid is not only labor-intensive but also time-consuming, which makes the convenience and efficiency of power grid equipment attack detection insufficient. In this regard, an embodiment of the present invention proposes a method for automatically detecting equipment attacks in a power grid, by obtaining the operating data of the power grid to be detected and performing dimensionality reduction, and then using the historical operating data after dimensionality reduction to train a preset model, so as to use the trained model for automatic detection.

[0030] In the above process, it is first necessary to obtain the operating data of the power grid to be detected, wherein, in order to train the model to realize automatic detection, in addition to the real-time operating data group, it is also necessary to obtain the first historical operating data group. Since there is redundancy in the data in both the real-time operating data group and the first historical operating data group, if data dimensionality reduction is not performed, the amount of calculation in the subsequent model training process will be huge, and the accuracy of the model obtained by training will be low. Therefore, it is first necessary to perform feature selection on the first historical operating data group and the real-time operating data group to realize data dimensionality reduction.

[0031] In one embodiment, feature selection is performed on the first historical operation data group to obtain a second historical operation data group, specifically including: performing numerical normalization processing on the first historical operation data group to obtain a data group to be processed, and performing feature analysis on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond one-to-one to the feature vectors in the data feature vector set; clustering analysis is performed on the data feature set by using a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and a relationship matrix is ​​constructed according to each clustering result; the co-connection matrix of each data feature in the data feature set is calculated according to the relationship matrix and a preset co-connection matrix calculation formula; cluster analysis is performed on the co-connection matrix according to a hierarchical clustering algorithm to obtain a data feature cluster; representative features are selected from the data feature cluster according to a preset selection method, and the corresponding second historical operation data group is obtained according to the representative features.

[0032] In actual application, different numerical normalization processing methods are used for different types of data. Specifically, for numerical data, the following formula is used for processing:

[0033]

[0034] In the formula, is the sample mean, and δ is the sample mean square error.

[0035] For text data, the following formula is used for processing:

[0036]

[0037] Where D i =d n +d m .n ij The data is text type.

[0038] After the numerical normalization, data feature selection can be performed. First, let F = {I1, I2, K, I n} represents the data feature set in the power grid equipment dataset, I i ,I j represents two different features in F, α i ={x 1i ,x 2i ,K,x Ni} T ,α j ={x 1j ,x 2j ,K,x Nj} Tis the corresponding data vector. Six typical clustering algorithms are selected and expressed as The corresponding relationship between the algorithm and the symbol is shown in Table 1. The data features of the power grid equipment are clustered using the selected 6 clustering algorithms, and the clustering results are expressed as Θ = {P1, P2, ..., P6}, where P k Corresponding to the result of the k-th clustering algorithm.

[0039] Secondly, the relationship matrix of each clustering algorithm is constructed according to the obtained clustering results, as shown below:

[0040]

[0041]

[0042] Where k = 1, 2, ..., 6. Any two different matrices in and The support is calculated as:

[0043]

[0044] Again, let Calculate based on this The matrix Q k The weights are as follows

[0045]

[0046] Then calculate the final co-connectivity matrix of the data features, According to the co-connectivity matrix The hierarchical clustering algorithm is used to cluster the data features to obtain data feature clusters; then, for the data feature clusters obtained after clustering, the information entropy of the data vector corresponding to each feature in the cluster is calculated. and cluster centrality Multiply the two together The feature with the largest product in the data feature cluster is selected as the representative feature to complete feature selection, thereby achieving data dimensionality reduction.

[0047] S2: According to the second historical operation data group, a preset decision tree model is trained to obtain a device attack model.

[0048] The decision tree model is constructed based on the decision tree and the KNN algorithm.

[0049] S3: According to the device attack model, attack behavior detection is performed on the real-time operation data group to obtain a detection result.

[0050] The real-time operation data group is compared with the second historical operation data group. If the first data identical to the real-time operation data group can be found in the second historical operation data group, the classification of the first data can be determined. Specifically, it is expressed as:

[0051]

[0052] in is the data in the training set, New device characterization data.

[0053] For the second data in the real-time operation data group that is different from the second historical operation data group, the K samples with the support closest to the second in the second historical operation data group are found according to the first support, and then put into the decision tree and classified according to the following formula:

[0054]

[0055]

[0056] In the formula, argmax is the maximum value of the result, v is the set of all neighbors obtained after KNN selection, and x i are neighbors; the support calculation formula between data points is as follows:

[0057] Sup(x i ,x j )=(1+d(x i ,x j )) -s ,s>0;

[0058]

[0059] In the formula, d(x i ,x j ) represents the normalized Euclidean distance.

[0060] In one embodiment, according to the device attack model, the real-time operation data group is subjected to attack behavior detection to obtain a detection result, which specifically includes: according to the representative features, the real-time operation data group is subjected to dimensionality reduction processing to obtain a dimensionality reduction data group and a corresponding first support; the first data in the dimensionality reduction data group that is identical to the second historical operation data group is screened out to determine a first classification result of the first data; the dimensionality reduction data group includes the first data and second data other than the first data; according to the first support of each second data, a number of third data are screened out from the second historical operation data group in turn, and each second data and the corresponding screened third data are input into the device attack model in turn to obtain a second classification result; the first classification result and the second classification result are output as detection results.

[0061] In one embodiment, the device attack detection method described in the embodiment of the present invention further includes: sending the detection result to a user.

[0062] An embodiment of the present invention describes a method for detecting device attacks in a power grid. Feature selection is performed on a first historical operation data group and a real-time operation data group of a power grid to be detected to achieve dimensionality reduction processing, and a preset decision tree model combined with a KNN algorithm is trained based on the historical operation data group after dimensionality reduction for attack detection on the real-time operation data group. The method for detecting device attacks in a power grid improves the convenience and efficiency of detecting device attack behaviors in the power grid. Furthermore, the method for detecting device attacks in a power grid described in an embodiment of the present invention also improves the interactivity and intuitiveness of the device attack detection by sending the detection results obtained by the attack detection to a user. Specific embodiment 2

[0064] In addition to the above method, the embodiment of the present invention also describes a device for detecting equipment attacks in a power grid. Figure 2 A structural diagram of an embodiment of a device for detecting attack on a power grid according to the present invention is shown.

[0065] As shown in the figure, the device attack detection apparatus includes a data acquisition unit 11, a model training unit 12 and an attack detection unit 13.

[0066] The data acquisition unit 11 is used to acquire a first historical operation data group and a real-time operation data group of the power grid to be detected, and perform feature selection on the first historical operation data group to acquire a second historical operation data group.

[0067] In one embodiment, the data acquisition unit 11 is also used to: perform numerical normalization processing on the first historical operation data group to obtain a data group to be processed, and perform feature analysis on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond one-to-one to the feature vectors in the data feature vector set; perform cluster analysis on the data feature set respectively through a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and construct a relationship matrix according to each clustering result; calculate the co-connection matrix of each data feature in the data feature set according to the relationship matrix and the preset co-connection matrix calculation formula; perform cluster analysis on the co-connection matrix according to a hierarchical clustering algorithm to obtain a data feature cluster; select representative features from the data feature cluster according to a preset selection method, and obtain the corresponding second historical operation data group according to the representative features.

[0068] The model training unit 12 is used to train a preset decision tree model according to the second historical operation data group, so as to obtain a device attack model. The decision tree model is constructed based on a decision tree and a KNN algorithm.

[0069] The attack detection unit 13 is used to perform attack behavior detection on the real-time operation data group according to the device attack model, so as to obtain a detection result.

[0070] In one embodiment, the attack detection unit 13 is also used to: perform dimensionality reduction processing on the real-time operation data group according to the representative features, so as to obtain a reduced dimensionality data group and a corresponding first support; filter out the first data in the reduced dimensionality data group that is the same as the second historical operation data group, so as to determine the first classification result of the first data; the reduced dimensionality data group includes the first data and second data other than the first data; filter out a number of third data from the second historical operation data group according to the first support of each second data, and input each second data and the corresponding filtered third data into the device attack model in turn, so as to obtain a second classification result; output the first classification result and the second classification result as detection results.

[0071] When it is necessary to perform device attack detection on the power grid, first, a first historical operation data group and a real-time operation data group of the power grid to be detected are obtained through the data acquisition unit 11, and feature selection is performed on the first historical operation data group to obtain a second historical operation data group; then, the model training unit 12 trains a preset decision tree model according to the second historical operation data group to obtain a device attack model; finally, the attack detection unit 13 performs attack behavior detection on the real-time operation data group according to the device attack model to obtain a detection result.

[0072] In one embodiment, the device attack detection apparatus further includes a result output unit, and the result output unit is used to send the detection result to a user.

[0073] An embodiment of the present invention describes an equipment attack detection device for a power grid, which performs feature selection on a first historical operation data group and a real-time operation data group of a power grid to be detected to achieve dimensionality reduction processing, and trains a preset decision tree model combined with a KNN algorithm based on the historical operation data group after dimensionality reduction for attack detection on the real-time operation data group. The equipment attack detection device improves the convenience and efficiency of detecting equipment attack behaviors in the power grid; further, the equipment attack detection device for a power grid described in an embodiment of the present invention also improves the interactivity and intuitiveness of the equipment attack detection by sending the detection results obtained by the attack detection to a user. Specific embodiment three

[0075] In addition to the above method and apparatus, the embodiment of the present invention also describes a device attack detection system for a power grid. Figure 3 A structural diagram of an embodiment of a power grid device attack detection system according to the present invention is shown.

[0076] As shown in the figure, the device attack detection system includes an attack detection module 1 and a data storage module 2. The attack detection module 1 is communicatively connected to the data storage module 2. The data storage module 2 is used to store all data. The attack detection module 1 is used to execute the device attack detection method for the power grid as described above based on all data stored in the data storage module 2.

[0077] In one embodiment, the device attack detection system further includes a user interaction module, which includes a communication unit, a touch / non-touch display screen, an input keyboard, a virtual keyboard, an indicator light, a microphone or a speaker.

[0078] An embodiment of the present invention describes a device attack detection system for a power grid. The device attack detection system improves the convenience and efficiency of detecting device attack behaviors in the power grid by performing feature selection on a first historical operation data group and a real-time operation data group of the power grid to be detected to achieve dimensionality reduction processing, and trains a preset decision tree model combined with a KNN algorithm based on the historical operation data group after dimensionality reduction for attack detection on the real-time operation data group. Furthermore, the device attack detection system for a power grid described in an embodiment of the present invention also improves the interactivity and intuitiveness of the device attack detection by sending the detection results obtained by the attack detection to a user.

[0079] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. It is particularly pointed out that for those skilled in the art, any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the scope of protection of the present invention.

Claims

1. A method for detecting device attacks in a power grid, characterized in that: The device attack detection method comprises: Acquire a first historical operation data group and a real-time operation data group of the power grid to be detected, perform feature selection on the first historical operation data group to obtain a second historical operation data group; wherein, perform numerical normalization processing on the first historical operation data group to obtain a data group to be processed, and perform feature analysis on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond to the feature vectors in the data feature vector set one by one; perform cluster analysis on the data feature set respectively through a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and construct a relationship matrix according to each clustering result; calculate the co-connection matrix of each data feature in the data feature set according to the relationship matrix and the preset co-connection matrix calculation formula; perform cluster analysis on the co-connection matrix according to a hierarchical clustering algorithm to obtain a data feature cluster; select representative features from the data feature cluster according to a preset selection method, and obtain the corresponding second historical operation data group according to the representative features; According to the second historical operation data group, a preset decision tree model is trained to obtain a device attack model; the decision tree model is constructed based on a decision tree and a KNN algorithm; According to the device attack model, the real-time operation data group is subjected to attack behavior detection to obtain a detection result; wherein, according to the representative feature, the real-time operation data group is subjected to dimensionality reduction processing to obtain a dimensionality reduction data group and a corresponding first support; the first data in the dimensionality reduction data group that is identical to the second historical operation data group is screened out to determine a first classification result of the first data; the dimensionality reduction data group includes the first data and second data other than the first data; according to the first support of each second data, a number of third data are screened out from the second historical operation data group in turn, and each second data and the corresponding screened third data are input into the device attack model in turn to obtain a second classification result; the first classification result and the second classification result are output as detection results.

2. The method for detecting device attacks in a power grid according to claim 1, characterized in that: After performing attack behavior detection on the real-time operation data group according to the device attack model to obtain a detection result, the device attack detection method further includes: The detection result is sent to the user.

3. A device for detecting equipment attacks in a power grid, characterized in that: The device attack detection device comprises a data acquisition unit, a model training unit and an attack detection unit; wherein, The data acquisition unit is used to acquire a first historical operation data group and a real-time operation data group of the power grid to be detected, and perform feature selection on the first historical operation data group to obtain a second historical operation data group; wherein, the first historical operation data group is numerically normalized to obtain a data group to be processed, and feature analysis is performed on the data to be processed to obtain a data feature set and a corresponding data feature vector set; the data features in the data feature set correspond to the feature vectors in the data feature vector set one by one; cluster analysis is performed on the data feature set respectively through a plurality of preset clustering algorithms to obtain corresponding clustering results, thereby obtaining a clustering result set, and a relationship matrix is ​​constructed according to each clustering result; the co-connection matrix of each data feature in the data feature set is calculated according to the relationship matrix and the preset co-connection matrix calculation formula; the co-connection matrix is ​​clustered according to the hierarchical clustering algorithm to obtain a data feature cluster; representative features are selected from the data feature cluster according to a preset selection method, and the corresponding second historical operation data group is obtained according to the representative features; The model training unit is used to train a preset decision tree model according to the second historical operation data group, so as to obtain a device attack model; the decision tree model is constructed based on a decision tree and a KNN algorithm; The attack detection unit is used to perform attack behavior detection on the real-time operation data group according to the device attack model, so as to obtain a detection result; wherein, according to the representative characteristics, the real-time operation data group is subjected to dimensionality reduction processing, so as to obtain a dimensionality reduction data group and a corresponding first support; the first data in the dimensionality reduction data group that is the same as the second historical operation data group is screened out, so as to determine a first classification result of the first data; the dimensionality reduction data group includes the first data and second data other than the first data; according to the first support of each second data, a number of third data are screened out from the second historical operation data group in turn, and each second data and the corresponding screened third data are input into the device attack model in turn, so as to obtain a second classification result; the first classification result and the second classification result are output as detection results.

4. The device for detecting equipment attack in a power grid according to claim 3, characterized in that: The device attack detection apparatus further includes a result output unit, and the result output unit is used to send the detection result to a user.

5. A power grid equipment attack detection system, characterized in that: The device attack detection system includes an attack detection module and a data storage module. The attack detection module is communicatively connected to the data storage module. The data storage module is used to store all data. The attack detection module is used to execute the device attack detection method for the power grid as described in any one of claims 1 to 2 based on all data stored in the data storage module.

6. The power grid equipment attack detection system according to claim 5, characterized in that: The device attack detection system further includes a user interaction module, which includes a communication unit, a touch / non-touch display screen, an input keyboard, a virtual keyboard, an indicator light, a microphone or a speaker.

Images