A method for detecting abnormality in power grid dispatching instruction sequences

Abstract

The present invention proposes a method and system for detecting abnormalities in a power grid dispatch instruction sequence, comprising: obtaining a power grid dispatch instruction sequence; converting the power grid dispatch instruction sequence into a power grid dispatch instruction sequence in a preset data format based on the position of each instruction in the power grid dispatch instruction sequence; inputting the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility and output the position credibility of each instruction; and determining whether each instruction is abnormal based on a comparison result of the position credibility of each instruction with a preset threshold. The present invention solves the technical problem that existing abnormal instruction detection methods rely on manual identification, which poses a risk of tampering with digital power grid dispatch instructions during transmission and execution, and cannot improve the accuracy of abnormal instruction detection.

Description

Technical Field

[0001] The present invention relates to the field of electric power technology, and in particular to a method for detecting abnormalities in a power grid dispatching instruction sequence. Background Art

[0002] The introduction of the Global Energy Interconnection strategy has led to the continuous expansion of grid interconnection and the deepening application of information and communication technologies within the grid. This has resulted in increasing security threats to grid industrial control systems. Compared to traditional grid industrial control systems, source-grid-load interactive industrial control systems require more frequent interaction with users and carry an increasing workload, further exacerbating cybersecurity threats. If the system is attacked by malicious actors, resulting in tampering with operational instructions or incorrect input by personnel, security risks could arise, ultimately causing the grid industrial control system to malfunction or even leading to serious grid security incidents.

[0003] In power grid dispatching systems, dispatching tasks often require a series of dispatching instructions, which are time-sequential. It's impossible to effectively determine whether a single instruction is abnormal based on a single instruction; it's necessary to consider both the previous and subsequent instructions, known as serialization features. Existing methods for detecting abnormal instructions rely on manual identification, which exposes the risk of tampering during the transmission and execution of digital dispatching instructions for power grid dispatch, making it difficult to accurately detect abnormal instructions. Summary of the Invention

[0004] The purpose of the present invention is to propose a method for detecting anomalies in power grid dispatching instruction sequences, so as to solve the technical problems that the existing abnormal instruction inspection method relies on manual identification, the digital dispatching instructions of power grid dispatching are at risk of being tampered with during transmission and execution, and the accuracy of abnormal instruction detection cannot be improved.

[0005] To achieve the above object, the present invention proposes a method for detecting abnormality in a power grid dispatching instruction sequence, the method comprising the following steps:

[0006] Obtaining power grid dispatch instruction sequence;

[0007] Converting the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence;

[0008] Input the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility and output the position credibility of each instruction;

[0009] Whether each instruction is abnormal is determined based on a comparison result between the position credibility of each instruction and a preset threshold.

[0010] Preferably, before executing the step of converting the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence, the following steps are executed:

[0011] Determining the number T of instructions included in the power grid dispatch instruction sequence;

[0012] When the instruction number T is 1, it is determined that the power grid dispatch instruction sequence is normal;

[0013] When the number of instructions T is greater than 1, the step of converting the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence is executed.

[0014] Preferably, the step of inputting the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction location credibility and outputting the location credibility of each instruction includes:

[0015] When the number T of instructions in the power grid dispatch instruction sequence is 2, the position credibility of the first instruction is calculated through the second instruction; and the position credibility of the second instruction is calculated through the first instruction.

[0016] Preferably, the step of inputting the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction location credibility and outputting the location credibility of each instruction includes:

[0017] When the number of instructions T in the power grid dispatching instruction sequence is greater than 2, the position credibility of the first instruction is obtained by reverse calculation of the second to T-th instructions; the position credibility of the T-th instruction is obtained by forward calculation of the first to T-1-th instructions; any instruction from the second to T-1-th is obtained by forward calculation of one or more instructions before the any instruction and by reverse calculation of one or more instructions after the any instruction.

[0018] Preferably, judging whether each instruction is abnormal based on a comparison result of the position credibility of each instruction with a preset threshold value includes:

[0019] When the position credibility of any instruction is greater than or equal to the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is normal;

[0020] When the position credibility of any instruction is less than the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is abnormal;

[0021] When the position of any instruction in the grid dispatching instruction sequence is abnormal, the grid dispatching instruction sequence is determined to be abnormal and the execution of the grid dispatching instruction sequence is prohibited; when the positions of all instructions in the grid dispatching instruction sequence are normal, the grid dispatching instruction sequence is determined to be normal and the execution of the grid dispatching instruction sequence is allowed.

[0022] The present invention also provides a power grid dispatch instruction sequence anomaly detection system, the system comprising:

[0023] An instruction acquisition unit, used to acquire a power grid dispatch instruction sequence;

[0024] a format conversion unit, configured to convert the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence;

[0025] A prediction unit, configured to input the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to perform instruction position credibility prediction and output the position credibility of each instruction;

[0026] The judgment unit is used to judge whether each instruction is abnormal based on the comparison result of the position credibility of each instruction and a preset threshold.

[0027] Preferably, the system further comprises:

[0028] An instruction quantity T determination unit, configured to determine the instruction quantity T included in the power grid dispatch instruction sequence;

[0029] When the instruction number T is 1, the judgment unit determines that the power grid dispatch instruction sequence is normal;

[0030] When the number of instructions T is greater than 1, the format conversion unit converts the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence.

[0031] Preferably, the prediction unit is specifically configured to:

[0032] When the number T of instructions in the power grid dispatch instruction sequence is 2, the position credibility of the first instruction is calculated through the second instruction; and the position credibility of the second instruction is calculated through the first instruction.

[0033] Preferably, the prediction unit is specifically configured to:

[0034] When the number of instructions T in the power grid dispatching instruction sequence is greater than 2, the position credibility of the first instruction is obtained by reverse calculation of the second to T-th instructions; the position credibility of the T-th instruction is obtained by forward calculation of the first to T-1-th instructions; any instruction from the second to T-1-th is obtained by forward calculation of one or more instructions before the any instruction and by reverse calculation of one or more instructions after the any instruction.

[0035] Preferably, the judgment unit is specifically configured to:

[0036] When the position credibility of any instruction is greater than or equal to the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is normal;

[0037] When the position credibility of any instruction is less than the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is abnormal;

[0038] When the position of any instruction in the grid dispatching instruction sequence is abnormal, the grid dispatching instruction sequence is determined to be abnormal and the execution of the grid dispatching instruction sequence is prohibited; when the positions of all instructions in the grid dispatching instruction sequence are normal, the grid dispatching instruction sequence is determined to be normal and the execution of the grid dispatching instruction sequence is allowed.

[0039] The present invention discloses a method and system for detecting abnormalities in power grid dispatching instruction sequences, which has the following beneficial effects:

[0040] The system can understand the relationship between the various instructions in the power grid dispatching instruction sequence based on the position of each instruction in the power grid dispatching instruction sequence and the bidirectional LSTM model, thereby predicting the position credibility of each instruction in the power grid dispatching instruction sequence and determining whether it is abnormal based on the position credibility; thereby solving the technical problem that the existing abnormal instruction inspection method relies on manual identification, the digital dispatching instructions of the power grid dispatching are at risk of being tampered with during the transmission and execution process, and the accuracy of abnormal instruction detection cannot be improved.

[0041] Other features and advantages of the present invention will be set forth in the description that follows. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1The figure is a flow chart of a method for detecting abnormality in a power grid dispatching instruction sequence according to an embodiment of the present invention.

[0044] Figure 2 It is the traditional single-item LSTM basic unit and internal structure.

[0045] Figure 3 This is the structure of the traditional two-layer LSTM model.

[0046] Figure 4 This is the structure of the staggered bidirectional LSTM model of an embodiment of the present invention.

[0047] Figure 5 Schematic diagram of the structure of a power grid dispatching instruction sequence anomaly detection system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0048] Various exemplary embodiments, features, and aspects of the present disclosure will be described in detail below with reference to the accompanying drawings. In addition, numerous specific details are provided in the following specific examples to better illustrate the present invention. Those skilled in the art will appreciate that the present invention can be practiced without certain specific details. In some instances, means well known to those skilled in the art are not described in detail in order to highlight the main points of the present invention.

[0049] See Figure 1 An embodiment of the present invention provides a method for detecting abnormalities in a power grid dispatching instruction sequence, the method comprising the following steps:

[0050] Step S10: obtaining a power grid dispatch instruction sequence;

[0051] Step S20: converting the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence;

[0052] Specifically, the instruction carries an instruction number, and the preset data format is: assuming that the power grid dispatch instruction sequence has a total of N instructions, for a certain instruction, assuming it is the nth instruction, its position in the power grid dispatch sequence is t, then the nth instruction can be represented as a column vector, X <t>< / t> =[0,…,1,…,0], in X <t>< / t> =[0,…,1,…,0], where the nth dimension is 1 and all other dimensions are 0;

[0053] For example, a power grid dispatch instruction sequence can be transformed into:

[0054]

[0055] Wherein, T is the number of sequentially arranged instructions in the grid dispatch instruction sequence, t = 1, 2, …, T;

[0056] Step S30: Input the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility, and output the position credibility of each instruction;

[0057] Specifically, since the operation instructions of the power grid dispatching system have serial characteristics, when judging the current instruction X <t>< / t> When determining whether it is an abnormal instruction, it is necessary to consider the instruction sequence preceding the instruction and the instruction sequence following the instruction in order to draw a conclusion on whether the instruction is an abnormal instruction. Since instruction sequences vary in length, in some long instruction sequences, the instruction at the beginning may affect the instructions following the instruction sequence, while the middle scheduling instructions have little to do with the previous scheduling instructions. Therefore, if the traditional recurrent neural network method is simply used, its characteristics can only retain a certain time series during the fitting process. The use of the LSTM method allows the model to fully consider the impact of the initial power grid scheduling instructions on it when checking the subsequent power grid scheduling instructions. Therefore, an embodiment of the present invention proposes a new LSTM model, which is specifically described as a staggered bidirectional LSTM model. Figure 2 The traditional single LSTM basic unit and internal structure are shown. Figure 3 shows the structure of the traditional two-layer LSTM model, Figure 4 The structure of the staggered bidirectional LSTM model according to an embodiment of the present invention is shown;

[0058] When the number T of instructions in the power grid dispatch instruction sequence is 2, the position credibility of the first instruction is calculated through the second instruction; and the position credibility of the second instruction is calculated through the first instruction.

[0059] When the number of instructions T in the power grid dispatch instruction sequence is 2, the position credibility of the first instruction is calculated by the second instruction; the position credibility of the second instruction is calculated by the first instruction;

[0060] When the number of instructions T in the power grid dispatching instruction sequence is greater than 2, the position credibility of the first instruction is obtained by reverse calculation of the second to T-th instructions; the position credibility of the T-th instruction is obtained by forward calculation of the first to T-1-th instructions; any instruction from the second to T-1-th is obtained by forward calculation of one or more instructions before the any instruction and by reverse calculation of one or more instructions after the any instruction.

[0061] Specifically, the staggered bidirectional LSTM model of this embodiment includes four hidden layers. Figure 4 Each LSTM unit in contains Figure 1The 4-layer LSTM basic unit A in the sequence x <1> ,x <2> ,…,x <t-1>< / t-1> As the forward LSTM input, calculate the output intermediate value Sequence x <t>< / t> ,x <t-1>< / t-1> ,…,x <t+1> As the reverse LSTM input, calculate the output intermediate value Finally and Stacked together to form a new matrix In the exception detection, this staggered method uses the preceding and following instructions in the instruction sequence to participate in the operation, but does not include the instruction itself.

[0062] For the entire instruction series, Y = Sigmoid(W×A+B). The Sigmoid function can be used to compress the value range of the final linear operation to (0,1). The Sigmoid function can also ensure that the normal probabilities represented by each instruction are independent of each other. The Sigmoid function is defined as follows:

[0063]

[0064] The embodiment of the present invention uses a unidirectional LSTM algorithm to calculate the first and last two instructions, that is, only the instruction sequence x <1> ,x <2> ,…,x <t-1>< / t-1> To detect x <t>< / t> ; It can be understood that when T=2, t=1, only the reverse LSTM input is used; when T=2, t=2, only the forward LSTM input is used;

[0065] In step S30, when the number of instructions T in the power grid dispatch instruction sequence is 2, the final result Y=[Y <1> Y <2> ] as shown below:

[0066] Y <1> =Sigmoid(W <1> ×A <1> +B <1> )

[0067] Y <2> =Sigmoid(W <2> ×A <2> +B <2> )

[0068] Among them, W <1> and W <2> 、B <1> and B <2>For training, A <1＞ and A ＜2＞ To be calculated;

[0069] When the number of instructions T in the power grid dispatch instruction sequence is greater than 2, the final result

[0070] Y=[Y <1> Y <2,3,…,T-1> Y <t>< / t> ] as shown below:

[0071] Y <1＞ =Sigmoid(W <1> ×A <1> +B <1> )

[0072] Y <t>< / t> =Sigmoid(W <t>< / t> ×A <T＞ +B ＜T> )

[0073] Y ＜2,3,..,T-1＞ =Sigmoid(W×A <2,3,..,T-1＞ )

[0074] Step S40: determining whether each instruction is abnormal based on a comparison result between the position credibility of each instruction and a preset threshold;

[0075] The step S40 includes:

[0076] When the position credibility of any instruction is greater than or equal to the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is normal;

[0077] When the position credibility of any instruction is less than the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is abnormal;

[0078] When the position of any instruction in the grid dispatching instruction sequence is abnormal, the grid dispatching instruction sequence is determined to be abnormal and the execution of the grid dispatching instruction sequence is prohibited; when the positions of all instructions in the grid dispatching instruction sequence are normal, the grid dispatching instruction sequence is determined to be normal and the execution of the grid dispatching instruction sequence is allowed.

[0079] Specifically, in the N×T dimensional matrix output by the model, each N-dimensional vector Represents the probability of instruction n appearing at position t in the instruction sequence. If If the probability of instruction n appearing here is greater than or equal to 50%, it is normal. This means that the probability of instruction n appearing here is less than 50%, so it is an exception.

[0080] Preferably, before executing step S20, the following step S11 is executed:

[0081] Step S11, determining the number T of instructions included in the power grid dispatch instruction sequence;

[0082] Step S12: When the instruction quantity T is 1, it is determined that the power grid dispatch instruction sequence is normal;

[0083] Step S13: When the instruction quantity T is greater than 1, proceed to execute step S20.

[0084] Another embodiment of the present invention further provides a power grid dispatch instruction sequence anomaly detection system, the system comprising the following multiple functional units, which can be used to perform corresponding steps of the method of the above embodiment;

[0085] See Figure 5 , the system comprising:

[0086] Instruction acquisition unit 1, used to acquire a power grid dispatch instruction sequence;

[0087] a format conversion unit 2, configured to convert the grid dispatch instruction sequence into a grid dispatch instruction sequence in a preset data format according to the position of each instruction in the grid dispatch instruction sequence;

[0088] Prediction unit 3, used for inputting the power grid dispatch instruction sequence in the preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility and output the position credibility of each instruction;

[0089] The judgment unit 4 is configured to judge whether each instruction is abnormal based on a comparison result between the position credibility of each instruction and a preset threshold.

[0090] Preferably, the system further comprises:

[0091] An instruction quantity T determination unit, configured to determine the instruction quantity T included in the power grid dispatch instruction sequence;

[0092] When the instruction number T is 1, the judgment unit 4 determines that the power grid dispatch instruction sequence is normal;

[0093] When the number of instructions T is greater than 1, the format conversion unit 2 converts the grid dispatching instruction sequence into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence.

[0094] Preferably, the prediction unit 3 is specifically configured to:

[0095] When the number T of instructions in the power grid dispatch instruction sequence is 2, the position credibility of the first instruction is calculated through the second instruction; and the position credibility of the second instruction is calculated through the first instruction.

[0096] Preferably, the prediction unit 3 is specifically configured to:

[0097] When the number of instructions T in the power grid dispatching instruction sequence is greater than 2, the position credibility of the first instruction is obtained by reverse calculation of the second to T-th instructions; the position credibility of the T-th instruction is obtained by forward calculation of the first to T-1-th instructions; any instruction from the second to T-1-th is obtained by forward calculation of one or more instructions before the any instruction and by reverse calculation of one or more instructions after the any instruction.

[0098] Preferably, the judging unit 4 is specifically configured to:

[0099] When the position credibility of any instruction is greater than or equal to the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is normal;

[0100] When the position credibility of any instruction is less than the preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is abnormal;

[0101] When the position of any instruction in the grid dispatching instruction sequence is abnormal, the grid dispatching instruction sequence is determined to be abnormal and the execution of the grid dispatching instruction sequence is prohibited; when the positions of all instructions in the grid dispatching instruction sequence are normal, the grid dispatching instruction sequence is determined to be normal and the execution of the grid dispatching instruction sequence is allowed.

[0102] The systems of the embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the system solutions of the embodiments.

[0103] It should be noted that the system of the above embodiment corresponds to the method of the above embodiment. Therefore, the undescribed part of the system of the above embodiment can be obtained by referring to the content of the method of the above embodiment. That is, the specific steps recorded in the method of the above embodiment can be understood as the functions that can be achieved by the system of the above embodiment, and will not be repeated here.

[0104] Furthermore, if the system of the above embodiment is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.

[0105] It can be seen from the description of the above embodiments that the embodiments of the present invention have the following advantages:

[0106] The system can understand the relationship between the various instructions in the power grid dispatching instruction sequence based on the position of each instruction in the power grid dispatching instruction sequence and the bidirectional LSTM model, thereby predicting the position credibility of each instruction in the power grid dispatching instruction sequence and determining whether it is abnormal based on the position credibility; thereby solving the technical problem that the existing abnormal instruction inspection method relies on manual identification, the digital dispatching instructions of the power grid dispatching are at risk of being tampered with during the transmission and execution process, and the accuracy of abnormal instruction detection cannot be improved.

[0107] While various embodiments of the present invention have been described above, the above descriptions are intended to be illustrative, non-exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, their practical applications, or technological improvements in the marketplace, or to enable others skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for detecting abnormality in a power grid dispatching instruction sequence, characterized in that: The following steps are involved: Obtaining power grid dispatch instruction sequence; Determine the number of instructions T included in the power grid dispatch instruction sequence; When T is 1, it is determined that the power grid dispatch instruction sequence is normal; When T is greater than 1, the grid dispatching instruction sequence is converted into a grid dispatching instruction sequence in a preset data format according to the position of each instruction in the grid dispatching instruction sequence; Input a grid dispatch instruction sequence in a preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility and output the position credibility of each instruction, including: when T is 2, the position credibility of the first instruction is inferred from the second instruction; the position credibility of the second instruction is inferred from the first instruction; when T is greater than 2, the position credibility of the first instruction is inferred from the second to the Tth instructions; the position credibility of the Tth instruction is inferred from the first to the T-1th instructions; any instruction from the second to the T-1th is inferred from one or more instructions before the instruction and from one or more instructions after the instruction. When the position credibility of any instruction is greater than or equal to a preset threshold, it is determined that the position of the instruction in the power grid dispatching instruction sequence is normal; When the position credibility of any instruction is less than a preset threshold, it is determined that the position of the instruction in the power grid dispatch instruction sequence is abnormal; When the position of any instruction in the grid dispatching instruction sequence is abnormal, the grid dispatching instruction sequence is judged to be abnormal and the execution of the grid dispatching instruction sequence is prohibited; when the positions of all instructions in the grid dispatching instruction sequence are normal, the grid dispatching instruction sequence is judged to be normal and the execution of the grid dispatching instruction sequence is allowed.

2. A power grid dispatching instruction sequence anomaly detection system, characterized in that: include: An instruction acquisition unit, used to acquire a power grid dispatch instruction sequence; An instruction quantity T judging unit is used to judge the instruction quantity T contained in the power grid dispatch instruction sequence. When T is 1, it is judged that the power grid dispatch instruction sequence is normal. a format conversion unit, configured to convert the grid dispatch instruction sequence into a grid dispatch instruction sequence of a preset data format according to the position of each instruction in the grid dispatch instruction sequence when T is greater than 1; A prediction unit is configured to input a power grid dispatch instruction sequence in a preset data format into a pre-trained bidirectional LSTM model to predict the instruction position credibility and output the position credibility of each instruction; when T is 2, the position credibility of the first instruction is inferred from the second instruction; the position credibility of the second instruction is inferred from the first instruction; when T is greater than 2, the position credibility of the first instruction is inferred from the second to the Tth instructions by reverse inference; the position credibility of the Tth instruction is inferred from the first to the T-1th instructions by forward inference; any instruction from the second to the T-1th is inferred from one or more instructions before the instruction and from one or more instructions after the instruction by reverse inference; a judgment unit, configured to judge that the position of any instruction in the power grid dispatching instruction sequence is normal when the position credibility of the instruction is greater than or equal to a preset threshold; When the position credibility of any instruction is less than a preset threshold, the position of the instruction in the power grid dispatching instruction sequence is determined to be abnormal; when the position of any instruction in the power grid dispatching instruction sequence is abnormal, the power grid dispatching instruction sequence is determined to be abnormal and the execution of the power grid dispatching instruction sequence is prohibited; when the positions of all instructions in the power grid dispatching instruction sequence are normal, the power grid dispatching instruction sequence is determined to be normal and the execution of the power grid dispatching instruction sequence is allowed.

Images