A method and system for detecting fake data injection attacks in smart grids

Abstract

The present invention discloses a method for detecting false data injection attacks in a smart grid, comprising the following steps: S1, obtaining the measurement data collected by the measurement unit on each node of the power grid within a set time length and the true value of the measurement data; S2, obtaining cluster clusters under different class numbers K based on the k-means++ algorithm; S3, calculating the CH index under each K value, outputting the clustering result corresponding to the maximum CH index, and calculating the error parameter in the Gaussian mixture model GMM; S4, using the error parameter θ as the initial value of the EM algorithm, and finding the optimal error parameter based on the EM algorithm; S5, determining the measurement data attacked by the false number injection attack in the measurement unit based on the optimal error parameter. The present invention confirms the number of mixed models through the CH index, and classifies the data set by combining the k-means++ algorithm and the expectation maximization EM algorithm, so as to accurately detect and locate the false measurement data.

Description

Technical Field

[0001] The present invention belongs to the technical field of smart grids, and more specifically, to a method and system for detecting false data injection attacks in smart grids. Background Art

[0002] The operation and control of smart grids rely on a complex network of computers, software, and communication technologies. The current power system is continuously monitored by the Energy Management System (EMS) and Supervisory Control and Data Acquisition (SCADA) systems to maintain normal and safe operating conditions. In particular, the SCADA host in the control center uses a state estimator to process the received instrument measurements to obtain the best estimate of the system state. These state estimates are then passed to all EMS application functions to control the normal operation of the physical aspects of the power grid. Since the measurement components supported by smart devices (such as smart meters and sensors) play an important role in confirming the real-time physical state of the power system and are more open to external networks due to the widespread use of Internet-based protocols in communication systems, they have become the best targets for attacks.

[0003] Liu et al. first demonstrated in 2009 that the new false data injection attack (FDIA) can bypass the bad data detection (BDD) function in the current SCADA system and achieve the desired state estimation result without being detected. This is why it is called one of the most dangerous types of attacks in network attacks. The injection of malicious false data in the network attack node will inevitably have an adverse effect on the state estimation of the power system. The traditional detection method is no longer useful, which indicates that a new method is needed. The existing technology first reduces the dimension of the training data containing FDIA labels by principal component analysis (PCA) to reduce the computational complexity, and then uses the supervised learning algorithm distributed support vector machine (DSVM) to classify the data to obtain the corresponding false data classification threshold, so as to use the threshold to detect FDIA in actual experiments. The above method is to prevent and detect FDIA by predicting the system state or establishing a false data feature set. It cannot directly detect the measurement unit attacked by FDIA, and has high requirements for the credibility of power grid data. Summary of the invention

[0004] The present invention provides a smart grid false data injection attack detection method, aiming to improve the above-mentioned problem.

[0005] The present invention is implemented as follows: a method for detecting false data injection attacks in a smart grid, the method specifically comprising the following steps:

[0006] S1. Obtain the measurement data collected by the measurement unit at each node of the power grid within a set time and the true value of the measurement data;

[0007] S2, based on the k-means++ algorithm to obtain clusters with different number of classes K;

[0008] S3, calculate the CH index under each K value, output the clustering result corresponding to the maximum CH index, and calculate the error parameter θ=[α1,...,α k ,μ1,...,μ k ,∑1,...,∑ k ] T ;

[0009] S4, using the error parameter θ as the initial value of the EM algorithm, and finding the optimal error parameter based on the EM algorithm;

[0010] S5. Determine the measurement data attacked by false number injection in the measurement unit based on the optimal error parameter.

[0011] Furthermore, the measurement data is a current phasor or a voltage phasor.

[0012] Furthermore, the step S2 specifically includes the following steps:

[0013] S21, define the number of classes K in the current clustering process;

[0014] S22, randomly selecting an error sample from the error sample E as the initial cluster center;

[0015] S23, calculating the probability of the remaining error sample being selected as the cluster center based on the distance between the remaining error sample and the previous cluster center;

[0016] S24, select the next cluster center based on the roulette method, and execute step S23 repeatedly until K cluster centers are selected

[0017] S25, assigning each error sample to the corresponding cluster center according to the minimum Euclidean distance principle, updating the latent variables and cluster centers, and taking the centroid of all samples belonging to the same cluster as the cluster center of the current cluster;

[0018] S26. Repeat step S25 until the clustering result converges, and output the clustering result.

[0019] Furthermore, the method for determining the measurement unit of the false number injection attack is as follows:

[0020] The expected μ in the optimal error parameter k The smallest cluster is the cluster that has not been attacked by false data injection. The error sample data in this cluster is the data that has not been attacked by false data injection. The error sample data in other clusters are the data after being attacked by false data injection.

[0021] Furthermore, the CH index is the separation SS between the centers of each category and the center of the error data set. B The closeness SS between each point in the cluster and the cluster center W The calculation formula is as follows:

[0022]

[0023] M represents the total number of measurement units, L represents the number of sample data collected within the set time of each measurement unit, and K represents the number of classes in the clustering process.

[0024] Furthermore, the separation SS B It represents the sum of squares of the distances between various centers and the center of the error data set. The calculation formula is as follows:

[0025]

[0026] c0 represents the center of the error data set, c k represents the center of the kth class, γ m,l,k It represents the probability that the Lth measurement value of the Mth measurement unit belongs to the kth class.

[0027] Furthermore, tightness SS W It represents the sum of the squares of the distances between each point in the class and the class center. The calculation formula is as follows:

[0028]

[0029] e m,l represents the error sample of the lth sampling data of the mth measurement unit, c k represents the center of the kth class, γ m,l,k It represents the probability that the Lth measurement value of the Mth measurement unit belongs to the kth class.

[0030] Furthermore, the calculation formula for the center c0 of the error data set is as follows:

[0031]

[0032] e m,lIt represents the error sample of the lth sampling data of the mth measurement unit, M represents the total number of measurement units, and L represents the number of sample data collected within the set time length of each measurement unit.

[0033] The present invention is implemented as follows: a smart grid false data injection attack detection system, the system comprising:

[0034] A measuring unit is arranged at each node of the power grid, and the measuring unit is connected to the supervisory control and data acquisition system SCADA for communication. The measuring unit collects the measurement data of the current node and sends it to the measuring unit and the supervisory control and data acquisition system SCADA. The measuring unit and the supervisory control and data acquisition system SCADA determine the measurement data attacked by the false data injection attack in each measuring unit based on the smart grid false data injection attack detection system method.

[0035] The present invention confirms the number of mixed models through the CH (Calinski Harabaz, CH) index, and classifies the data set by combining the k-means++ algorithm and the expectation maximization (EM) algorithm, so as to accurately detect and locate false measurement data. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 A flow chart of a method for detecting false data injection attacks on a smart grid provided by an embodiment of the present invention;

[0037] Figure 2 The IEEE-14 node system topology provided by the embodiment of the present invention;

[0038] Figure 3 A measurement error distribution diagram of injected false data provided by an embodiment of the present invention;

[0039] Figure 4 A CH index variation diagram provided by an embodiment of the present invention;

[0040] Figure 5 A measurement error PDF distribution diagram provided by an embodiment of the present invention;

[0041] Figure 6 A schematic diagram of the classification results of the EM algorithm provided in an embodiment of the present invention;

[0042] Figure 7 A schematic diagram of measurement deviation of false data provided by an embodiment of the present invention;

[0043] Figure 8 A schematic diagram of the detection probability of false data provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0044] The specific implementation modes of the present invention are further explained in detail below by describing the embodiments with reference to the accompanying drawings, so as to help those skilled in the art to have a more complete, accurate and in-depth understanding of the inventive concept and technical solution of the present invention.

[0045] This paper proposes a detection method for false data injection attacks on smart grids. FDIA adds an unknown error offset to the measurement data of the smart grid system to achieve its harm to the power control of the power grid. For the measurement data with false attack vectors, its error distribution belongs to the Gaussian Mixture Model (GMM). The attack detection problem is converted into a data classification problem. Therefore, the present invention mainly uses the expectation maximization (EM) algorithm to estimate the corresponding parameters of the data model, locate the attacked measurement unit and eliminate the false data, so as to achieve the purpose of attack detection.

[0046] The general linear state equation that the voltage and current vectors in the smart grid distribution system conform to is:

[0047] z=hx+e (1)

[0048] In the formula, It is the original measurement vector of voltage or current phasor; It is the vector describing the state variables of the system; is the network topology matrix describing the vicinity of a given working point; is the measurement error caused by the measuring unit, represents an m-order complex vector, where each component phasor can be modeled as an independent and identically distributed (IID) complex Gaussian random variable with mean 0 and covariance ∑.

[0049] The main idea of ​​FDIA is to add a non-zero attack vector to the measurement vector of the power system to destroy the measurement value available to the grid operator. The tampered measurement vector is expressed as:

[0050] z a =z+a (2)

[0051] In the formula, represents the false data attack vector, Represents the measurement vector corrupted by FDIA.

[0052] In the process of stable operation of the power system, for the data set containing L (L>1) measurement vectors collected by the SCADA system, assuming that the data set has been affected by FDIA, each measurement value is a suspicious target. The error of the measurement vector becomes:

[0053] e a =e+a (3)

[0054] In the formula, Indicates the measurement error after the attack vector is injected. It can be found that the error of the measurement vector has shifted. In order to achieve the attack goal, the attacker will continuously tamper with the measurement value, thus generating a large amount of error-shifted data. By analyzing the difference between this type of data and normal data, it is helpful to detect FDIA. Therefore, the problem of discovering false data that causes error shift can be transformed into a data classification problem.

[0055] For any measurement value z m For example, the binary Gaussian distribution model of the phasor measurement error can be expressed as

[0056]

[0057] In the formula, k represents the number of clusters, e represents the measurement error, and μ k represents the expected deviation of samples within the kth cluster, ∑ k represents the covariance of the data samples in the Kth cluster. If it is the measurement error of normal data, μ1=0, k=1; otherwise, if it is the measurement error of false data, μ k =a m , k≠1.

[0058] For the convenience of calculation, an overall model is established for the ML measurement data contained in the L measurement vectors, and the following can be obtained:

[0059]

[0060] Z=[z 1,1 ,…,z 1,L ,…,z M,1 ,…,z M,L ] T (6)

[0061]

[0062] E=[e 1,1 ,…,e 1,L ,…,e M,1 ,…,e M,L ] T (8)

[0063] In the formula, represents the true value of the state variable, and They respectively represent the original measurement value, measurement true value and measurement error of L measurements of M measurement units in the power grid system.

[0064] By treating all data samples Z as a whole, the corresponding error samples E can be regarded as coming from K different clusters: only the first cluster contains the correct data samples, and the other clusters contain false data belonging to different nodes of the power system. Without detection, it is impossible to determine which measurement value samples have been tampered with by FDIA. Therefore, for each measurement value z m,l The error probability distribution can be expressed by Gaussian mixture model (GMM):

[0065]

[0066] Where θ=[α1,...,α K ,μ1,...,μ K ,∑1,...,∑ K ] T , K represents the number of clusters, α k represents the weight of the measurement error of the sample data in the kth cluster, μ k represents the expected deviation of the data sample in the kth cluster, ∑ k represents the covariance of the data samples in the kth cluster, and Therefore, by finding the classification cluster to which each measurement value error belongs, it is possible to determine whether the measurement value is false data.

[0067] The present invention obtains the measurement error GMM parameters by pursuing the asymptotic properties of the Maximum Likelihood Estimation (MLE) algorithm. The unknown parameters are solved by globally maximizing the log-likelihood function based on the known parameters related to the measured values ​​and state variables. The log-likelihood function with the parameter vector θ is obtained according to the assumed error model.

[0068]

[0069] The maximum likelihood estimate is obtained by solving

[0070]

[0071] Since solving the cost function in equation (11) is too complicated, we hope to find a way to reduce the computational complexity of the MLE algorithm. To this end, we introduce a complete data set {E,γ} to solve this problem, where γ is expressed as:

[0072]

[0073] In the formula, the γ matrix contains MKL random latent variables, and the random latent variable γ M,L,K It represents the probability that the Lth measurement value of the Mth measurement unit belongs to the Kth mixture component (cluster). Its value reflects which mixture component in the GMM any random variable in the measurement error data set E belongs to. m,l,k Defined as:

[0074]

[0075] With unobserved data γ m,l,k , then for each measurement value the measurement error e m,l , its complete data can be expressed as (e m,l ,γ m,l,1 ,…,γ m,l,K ). More specifically, in order to facilitate calculation and intuitive display, the expectations of the data sample deviations are arranged in ascending order. If e m,l is the measurement error of normal data, then it belongs to the first mixed component of GMM Then its complete data can be expressed as If e m,l is the measurement error of false data, then it belongs to other components in GMM, expressed as Then the log-likelihood function of the complete data can be expressed as:

[0076]

[0077] To avoid ambiguity, the present invention replaces the original log-likelihood function in (10) with It is called the incomplete data log-likelihood function. Obviously, the newly introduced complete data log-likelihood function The calculation method is simpler. For measurement data that conforms to GMM, the MLE can be approximated by the EM algorithm.

[0078] Figure 1 The present invention provides a flow chart of a method for detecting false data injection attacks in a smart grid, which specifically includes the following steps:

[0079] S1. Obtain the measurement data collected by the measurement unit at each node of the power grid within a set time and the true value of the measurement data;

[0080] In an embodiment of the present invention, the measuring unit is a current sensor or a voltage sensor, which is used to collect the current phasor or voltage phasor at each node in the power grid, and determine whether the current node is attacked by false data injection based on the current / voltage phasor collected within a set time period. The true value of the measuring unit, that is, the current / voltage phasor of each measuring unit when it is not attacked by false data injection, is determined based on historical data.

[0081] S2, based on the k-means++ algorithm to obtain clusters with different number of classes K, where k = 1, 2, ..., K;

[0082] Since the EM algorithm has the disadvantage of being sensitive to initial values: it requires initialization parameters θ (0) In order to proceed to the next iterative calculation, the initial estimated parameter θ is randomly selected due to the ambiguity of the basic information of the estimated parameter θ of GMM. (0) This greatly reduces the convergence efficiency and whether the global optimal solution can be obtained. The k-means++ algorithm can determine the initial estimated parameter θ of GMM in a faster iterative way than the k-means algorithm. (0) , which improves the disadvantage of k-means being sensitive to the initial cluster centers and affecting the convergence efficiency.

[0083] In the embodiment of the present invention, clustering is performed once for each class number K value using the k-means++ algorithm, and the clustering process is as follows:

[0084] S21, define the number of classes K in the current clustering process;

[0085] S22, randomly selecting an error sample from the error sample E as the initial cluster center;

[0086] S23, calculating the probability of the remaining error sample being selected as the cluster center based on the distance between the remaining error sample and the previous cluster center;

[0087] In the embodiment of the present invention, the remaining error sample data e m,l With the previous cluster center The distance between them is D(e m,l ):

[0088]

[0089] e m,l represents the error sample of the lth sampled data of the mth measurement unit, that is, the difference between the collected value and the true value. The probability table p of each error data sample being selected as the next cluster center c (e m,l ) is shown as:

[0090]

[0091] Wherein, M represents the total number of measurement units, and L represents the number of sample data collected within the set time length of each measurement unit.

[0092] S24, select the next cluster center based on the roulette method, and execute step S23 repeatedly until K cluster centers are selected

[0093] S25, assigning each error sample to the corresponding cluster center according to the minimum Euclidean distance principle, updating the latent variables and cluster centers, and taking the centroid of all samples belonging to the same cluster as the cluster center of the current cluster;

[0094] In the embodiment of the present invention, the hidden variable The update formula is as follows:

[0095]

[0096] Represents the error sample data e at the nth iteration m,l Belong to The probability of a clustering domain centered on m,l Does not belong to The clustering domain centered on The value is 0.

[0097] At the (n+1)th iteration, the cluster center update method based on the latent variable is as follows:

[0098]

[0099] S26, repeat step S25 until c (n+1) =c (n) (19), the clustering results converge and the clustering results are output.

[0100] Based on this, we also get a complete data set {E,γ} after coarse clustering. This can be set as the initialization parameter of the EM algorithm to reduce the number of iterations and shorten the running time.

[0101] S3, calculate the CH index under the above K value, output the clustering result corresponding to the maximum CH index, and calculate the error parameter θ=[α1,...,α k ,μ1,…,μ k ,∑1,…,∑ k ] T ;

[0102] Since the information about the number of FDIA tampered measurement units is unknown, the number of mixed components in GMM cannot be known in advance during the normal modeling of measurement data. Therefore, it is necessary to find a method to confirm the size of the cluster number K value. This paper selects the CH index as the evaluation indicator of the clustering results.

[0103] The CH indicator measures the closeness within a class by calculating the sum of the squares of the distances between each point in the class (cluster) and the class center (cluster center), that is, the intra-class variance SS W ; The separation of the data set is measured by calculating the sum of squares of the distances between each class center (cluster center) and the center point of the error data set, that is, the between-class variance SS B The CH index is obtained by the ratio of separation degree to compactness. Therefore, the larger the CH is, the tighter the class itself is and the more dispersed the classes are, that is, the better the clustering result. The k-means++ algorithm is used to cluster the measurement errors of the measurement data using different K values, and the CH index is used to calculate the clustering results for each time. Compare the CH index sizes of these times, and select the K value that maximizes the CH index as the number of mixed components of GMM. The functional expression of the CH index is:

[0104]

[0105]

[0106]

[0107] In the formula, the error data sample is in the error data set, c0 represents the center point of the error data set, and its calculation formula is as follows:

[0108]

[0109] S4, using the above error parameters as initial values ​​of the EM algorithm, and finding the optimal error parameters based on the EM algorithm;

[0110] Given the initial estimated parameter θ through the k-means++ algorithm, the workflow of the EM algorithm on the (η+1)th iteration is as follows:

[0111] Cost function Λ (η) The specific expression of (θ) is as follows:

[0112]

[0113] Calculated by Bayes' rule:

[0114]

[0115] In the formula, is the conditional probability A shorthand representation of the observed data e under the current model parameters m,l The probability of the kth mixture component from the GMM is called the probability of the kth mixture component for the observed data e. m,l responsiveness.

[0116] In order to maximize the parameter Λ (η) (θ) To get the estimated parameter θ of GMM, we can solve the following equation:

[0117]

[0118]

[0119]

[0120] Where λ is the Lagrange multiplier. The solutions of the equation are all closed forms. The (η+1)th iteration result of estimating the parameter θ is:

[0121]

[0122]

[0123]

[0124] Represents the error sample data e at the nth iteration m,l The probability of belonging to the kth class, represents the expected deviation of the error data sample within the kth cluster at the η+1th iteration, e m,l Represents the error sample of the lth sampling data of the mth measurement unit.

[0125] Repeat the above calculation until the convergence condition for iteration termination is met:

[0126]

[0127] By using hidden variables The final data is rounded, and then the complete data set {E, γ} and the estimated parameter θ of GMM are obtained. The FDIA detection method based on k-means++ and EM algorithm is shown in the table below;

[0128] Table 1 FDIA detection based on k-means++ and EM algorithms

[0129]

[0130] S5. Determine the measurement data attacked by false number injection in the measurement unit based on the optimal error parameter.

[0131] The expected μ in the optimal error parameter kThe smallest cluster is the cluster that has not been attacked by false data injection. The error sample data in this cluster is the data that has not been attacked by false data injection. The error sample data in other clusters are the data after being attacked by false data injection. The larger the deviation, the more serious the false data injection attack.

[0132] The present invention aims at the FDIA problem in smart grid and proposes a strategy to detect it using statistical learning methods. The attack detection problem is converted into a data classification problem, the classification number is confirmed by the CH index, and the k-means++ algorithm and the EM algorithm are combined for data classification, which can correctly detect and locate which measurement units have false measurement data.

[0133] In order to verify the feasibility of the algorithm proposed in this paper, this paper adopts Figure 2 The local sub-ring network near node 2 in the IEEE-14 node system shown in the figure is simulated and analyzed. The simulation is performed using MATLAB R2018b software, and conventional power flow calculations are performed based on the relevant data in the MATPOWER power simulation package. The system operation data obtained is used as the measurement data of the power system. The attack vector is injected into the system to attack it, and the k-means++ algorithm and the EM algorithm are combined for simulation calculation to verify whether the detection method is feasible and effective.

[0134] The experimental data related to the FDIA simulation modification of the IEEE-14 node system are shown in Table 2, which can make the voltage amplitude of node 2 reach its calibrated upper limit of 1.1pu. In Table 3, this paper summarizes the simulation parameters to be used in the simulation. Based on these parameters, this paper generates a simulation data set according to the Monte Carlo method to verify the algorithm of this paper.

[0135] Table 2 Simulation data

[0136]

[0137] Table 3 Simulation parameters

[0138]

[0139] The distribution of the measurement error data set injected with false data generated by the Monte Carlo method is shown in the figure below: Figure 3 It can be clearly seen from the figure that among the 100 measurement errors of the 7 measurement units contained in the data set, the measured values ​​of the current amplitude and phase angle of multiple measurement units have obvious deviations.

[0140] The k-means++ algorithm is used to analyze the clustering results of the measurement error after injecting false data. It is iterated with different numbers of clusters. The CH index of different iteration results of the algorithm is as follows: Figure 4As shown in the figure, the number of clusters with the maximum value of CH index is 5, which means that at least 4 measurement units in the sample data are attacked.

[0141] The data preprocessed by k-means++ is further iterated by the EM algorithm to obtain the following Figure 6 The measurement error probability density function (PDF) image is shown in Figure 1. The result of classifying the measurement error data set according to the fitted GMM is shown in Figure 2. Figure 7 As shown in the figure, it can be seen that the measurement units with errors distributed around 0 include I 1-5 ,I 3-4 and I 4-5 , there is no deviation, so it is normal data; and the measurement unit I 1-2 ,I 2-3 ,I 2-4 and I 2-5 The amplitude and phase angle of the measurement data have large deviations, which shows that these measurement units are all measurement data tampered by FDIA.

[0142] According to the algorithm in this paper, the measurement deviation of the false data contained in the measurement data is obtained as follows: Figure 7 As shown in the figure, the first 7 measurement units represent the current amplitude measurement deviation, and the last 7 measurement units represent the current phase angle measurement deviation. It can be seen from the figure that the obtained data deviation completely coincides with the deviation caused by the actual FDIA.

[0143] When FDIA is used to attack node 2 with different tampering extents, the false data detection in its measurement data is as follows: Figure 8 As shown in the figure. According to the experiment, when the voltage amplitude state change of node 2 does not exceed 0.003pu, the algorithm in this paper completely fails to detect FDIA. As the tampering amplitude of the voltage amplitude increases, the detection probability also increases. When the amplitude change exceeds 0.008pu, the detection probability of false data in the measured data reaches 100%. And the experiment shows that the detection probability of FDIA with a tampering amplitude of more than 0.008pu for the state estimation result is close to 100%.

[0144] The present invention has been described exemplarily. Obviously, the specific implementation of the present invention is not limited to the above-mentioned method. As long as various non-substantial improvements are made using the method concept and technical solution of the present invention, or the concept and technical solution of the present invention are directly applied to other occasions without improvement, they are all within the protection scope of the present invention.

Claims

1. A method for detecting false data injection attacks in smart grids, characterized in that: The method specifically comprises the following steps: S1. Obtain the measurement data collected by the measurement unit at each node of the power grid within a set time and the true value of the measurement data; S2, based on the k-means++ algorithm to obtain clusters with different number of classes K; S3, calculate the CH index under each K value, output the clustering result corresponding to the maximum CH index, and calculate the error parameter θ=[α1,...,α k ,μ1,...,μ k ,∑1,...,∑ k ] T , where α k represents the weight of the measurement error of the sample data in the kth cluster, μ k represents the expected deviation of the data sample in the kth cluster, ∑ k represents the covariance of the data samples in the kth cluster; S4, using the error parameter θ as the initial value of the EM algorithm, and finding the optimal error parameter based on the EM algorithm; S5. Determine the measurement data attacked by the false number injection in the measurement unit based on the optimal error parameter; The CH index is the separation degree SS between the centers of each category and the center of the error data set. B The closeness SS between each point in the cluster and the cluster center W The calculation formula is as follows: Among them, M represents the total number of measurement units, L represents the number of sample data collected within the set time of each measurement unit, and K represents the number of classes in the clustering process; Separation SS B It represents the sum of squares of the distances between various centers and the center of the error data set. The calculation formula is as follows: Among them, c0 represents the center of the error data set, c k represents the center of the kth class, γ m,l,k represents the probability that the Lth measurement value of the Mth measurement unit belongs to the kth class; Tightness SS W It represents the sum of the squares of the distances between each point in the class and the class center. The calculation formula is as follows: Among them, e m,l Represents the error sample of the lth sampling data of the mth measurement unit; The calculation formula for the center c0 of the error data set is as follows:

2. The method for detecting false data injection attacks in smart grid according to claim 1, characterized in that: The measurement data is a current phasor or a voltage phasor.

3. The method for detecting false data injection attacks in smart grid according to claim 1, characterized in that: The step S2 specifically includes the following steps: S21, define the number of classes K in the current clustering process; S22, randomly selecting an error sample from the error sample E as the initial cluster center; S23, calculating the probability of the remaining error sample being selected as the cluster center based on the distance between the remaining error sample and the previous cluster center; S24, select the next cluster center based on the roulette method, and execute step S23 repeatedly until K cluster centers are selected S25, assigning each error sample to the corresponding cluster center according to the minimum Euclidean distance principle, updating the latent variables and cluster centers, and taking the centroid of all samples belonging to the same cluster as the cluster center of the current cluster; S26. Repeat step S25 until the clustering result converges, and output the clustering result.

4. The method for detecting false data injection attacks in smart grid according to claim 1, characterized in that: The method for determining the measurement unit of the false number injection attack is as follows: The expected μ in the optimal error parameter k The smallest cluster is the cluster that has not been attacked by false data injection. The error sample data in this cluster is the data that has not been attacked by false data injection. The error sample data in other clusters are the data after being attacked by false data injection.

5. A smart grid false data injection attack detection system, characterized in that: The system comprises: A measuring unit is arranged at each node of the power grid, and the measuring unit is communicatively connected with a supervisory control and data acquisition system SCADA. The measuring unit collects the measurement data of the current node and sends it to the supervisory control and data acquisition system SCADA. The supervisory control and data acquisition system SCADA determines the measurement data attacked by false data injection in each measuring unit based on the method for detecting false data injection attacks on smart grids as described in any one of claims 1 to 4.

Images