A method and device for detecting false data injection attacks against PMU measurements

Abstract

The present invention relates to a method for detecting false data injection attacks against PMU measurements. The method comprises the following steps: Step 1: using a robust random forest algorithm to determine the degree of anomaly and establish a forest model; Step 2: selecting a sample dimension for cutting until the sample is split into corresponding leaf nodes; Step 3: calculating the depth of the sample; Step 4: obtaining the anomaly score of the sample; Step 5: using a sliding window to save a given number of anomaly score sets, determining whether the anomaly score of the sample is the maximum anomaly score in the top 10% of the anomaly score set; if so, determining that the sample is an anomaly sample; if not, determining that the sample is a normal sample. Compared with the prior art, the present invention has the advantages of being able to solve the concept drift problem caused by topology changes and maintaining good detection performance when the attack amplitude changes.

Description

Technical Field

[0001] The present invention relates to the field of electric power information security, and in particular to a method and device for detecting false data injection attacks on PMU measurements. Background Art

[0002] The large-scale integration of renewable energy sources, the random charging of large numbers of electric vehicles, and the increase in reactive loads are destabilizing power systems. Phasor measurement units (PMUs) provide high-precision phase angle measurement with a latency of less than 10ms and a sampling rate of more than 30 times per second, enabling more advanced power system operation and control.

[0003] Smart grids incorporate modern communication technologies, which improve the automation and efficiency of power grids. However, these technologies also introduce new security risks. Cyberattacks that disrupt information systems can also threaten the safe operation of physical systems. False data injection attacks (FDIA) have been shown to cause incorrect solutions to multiple power system control algorithms, leading to increased operating costs, generation scheduling errors, and unplanned power outages. Therefore, FDIA detection is an active research area. With the widespread application of power measurement units (PMUs), FDIA detection of PMU measurements is gaining increasing attention.

[0004] However, existing detection methods employ a static learning model, using stored historical data for training and then using the trained model to achieve prediction, regression, or classification goals. Obviously, static learning methods struggle to adapt to concept drift caused by topology changes, and topology reconfiguration events such as line outages and generator outages are very common in power grids. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a method and device for detecting false data injection attacks on PMU measurements.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A method for detecting false data injection attacks on PMU measurements, the method comprising the following steps:

[0008] Step 1: Use the robust random forest algorithm to judge the degree of abnormality and establish a forest model;

[0009] Step 2: Select the dimension of the sample to cut until the sample is split into the corresponding leaf node;

[0010] Step 3: Calculate the depth of the sample;

[0011] Step 4: Get the anomaly score of the sample;

[0012] Step 5: Use a sliding window to save a given number of anomaly score sets, and determine whether the anomaly score of the sample is the maximum anomaly score of the top 10% in the anomaly score set. If so, the sample is determined to be an anomaly sample; otherwise, the sample is determined to be a normal sample.

[0013] The forest model is composed of a group of independent trees, each leaf node of the tree corresponds to a sample, and the number of trees in the forest model and the maximum number of leaf nodes n of each tree are selected.

[0014] In step 2, the process of selecting the sample dimensions for cutting is specifically as follows:

[0015] When the maximum number of leaf nodes in the tree is less than n, a forest model is constructed based on the PMU measurement data stream X = {x(1), x(2), …, x(t), …}, and the range of any dimension in the data is i∈Z and i≤N, select one The uniformly distributed random number r is cut, and the cutting dimension j satisfies The cutting point is Repeated cutting, where x(i) j is the j-th dimension data of x(i), until all samples are split into their corresponding leaf nodes;

[0016] When the maximum number of leaf nodes in the tree is equal to n, the tree is dynamically maintained by inserting the latest sample x(t) and deleting randomly selected samples x(r). A random number r is selected for cutting. If the cut separates the tree T(X) and the latest sample x(t), it is used as the first cut of the new tree. Otherwise, the cut is deleted and the same cut as in T(X) is selected to divide the subset. The cutting is repeated until all samples are split into their corresponding leaf nodes.

[0017] In step 3, the complexity C(T(X), x(t)) of the sample x(t) in the tree T(X) is a set of binary codes representing the path from the root node to x(t). Assuming that the sample is in the left subtree of the root node, the first bit of the code is 0 and the other bit is 1. The depth of the sample corresponds to the number of bits of the complexity:

[0018] d(T,x)=len(C(T(X),x(t)))

[0019] Where d(T,x) is the depth of sample x in the tree T(X), len(·) is the function for finding the number of bits, and C(T(X),x(t)) is the complexity of sample x(t) in the tree T(X).

[0020] In step 4, the anomaly score of the sample is specifically the displacement caused by the sample. If sample x is an anomaly sample, and there is more than one anomaly sample, and the positions of the anomaly samples on the tree are close, the process of calculating the anomaly score of the sample is specifically as follows:

[0021] Step 401: Select an abnormal set C by adopting a step-by-step expansion method;

[0022] Step 402: Remove the outlier set C consisting of sample x and points close to sample x;

[0023] Step 403: Take the maximum value of the average displacement change as the abnormality score s(x(t)).

[0024] In step 402, the calculation formula for the displacement change caused by removing the set C is:

[0025]

[0026] Where T(XC) is the tree after removing the outlier set C, X is the total set of trees T(X), DISP(C, T) is the displacement change caused by removing the outlier set C, and d(T(XC), x(i)) is the depth of sample x(i) in the tree T(XC).

[0027] In step 403, the calculation formula of the abnormality score s(x(t)) is:

[0028]

[0029] A device for implementing the false data injection attack detection method includes a memory and a processor.

[0030] The memory is used to store computer programs.

[0031] The processor is configured to implement the following method when executing the computer program:

[0032] Step 1: Use the robust random forest algorithm to judge the degree of abnormality;

[0033] Step 2: Select the dimension of the sample to cut until the sample is split into the corresponding leaf node;

[0034] Step 3: Calculate the depth of the sample;

[0035] Step 4: Get the anomaly score of the sample;

[0036] Step 5: Use a sliding window to save a given number of anomaly score sets, and determine whether the anomaly score of the sample is the maximum anomaly score of the top 10% in the anomaly score set. If so, the sample is determined to be an anomaly sample; otherwise, the sample is determined to be a normal sample.

[0037] Compared with the prior art, the present invention has the following beneficial effects:

[0038] 1. The present invention adopts an online learning mode, which can quickly adapt to the measurement data after the topology changes, and does not require any information about data labels and network topology;

[0039] 2. The present invention can solve the concept drift problem caused by topology changes, while maintaining good detection performance when the attack amplitude changes. BRIEF DESCRIPTION OF THE DRAWINGS

[0040] Figure 1 Flow chart of the method of the present invention.

[0041] Figure 2 IEEE-14 node power system structure diagram in an embodiment of the present invention.

[0042] Figure 3 A diagram showing the complexity of the tree T(X).

[0043] Figure 4 Schematic diagram for selecting the anomaly set C representing the tree T(X). DETAILED DESCRIPTION

[0044] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0045] The present invention provides a method for detecting false data injection attacks on PMU measurements, the method comprising the following steps:

[0046] Step 1: Use the robust random forest algorithm to judge the degree of anomaly and build a forest model. The forest model consists of a set of independent trees. Each leaf node of the tree corresponds to a sample. Select the number of trees in the robust random forest model and the maximum number of leaf nodes n for each tree.

[0047] Step 2: Select the dimension of the sample to cut until the sample is split into the corresponding leaf node:

[0048] When the maximum number of leaf nodes in the tree is less than n, a forest model is constructed based on the PMU measurement data stream X = {x(1), x(2), …, x(t), …}, and the range of any dimension in the data is i∈Z and i≤N, select one The uniformly distributed random number r is cut, and the cutting dimension j satisfies The cutting point is Cut repeatedly until all samples are split into their corresponding leaf nodes;

[0049] When the maximum number of leaf nodes in the tree is equal to n, the tree is dynamically maintained by inserting the latest sample x(t) and deleting randomly selected samples x(r). A random number r is selected for cutting. If the cut separates the tree T(X) and the latest sample x(t), it is used as the first cut of the new tree. Otherwise, the cut is deleted and the same cut as in T(X) is selected to divide the subset. The cut is repeated until all samples are split into their corresponding leaf nodes.

[0050] Step 3: Calculate the depth of sample x(t). The complexity C(T(X), x(t)) of sample x(t) in the tree T(X) is a set of binary codes representing the path from the root node to x(t). Assuming that the sample is in the left subtree of the root node, the first bit of the code is 0, and vice versa. The depth of the sample corresponds to the number of bits of complexity, which is recorded as d(T,x) = len(C(T(X), x(t))).

[0051] Step 4: Define the anomaly score of a sample as the displacement caused by the sample. Since there is more than one anomaly sample and the positions of the anomaly samples on the tree are close, the displacement caused by x(t) is small. Remove the anomaly set C consisting of x and points close to x. The calculation formula for the displacement change caused by removing set C is:

[0052]

[0053] Where T(XC) is the tree after removing the outlier set C, X is the total set of trees T(X), DISP(C, T) is the displacement change caused by removing the outlier set C, and d(T(XC), x(i)) is the depth of sample x(i) in the tree T(XC);

[0054] The maximum average displacement of samples in the removed anomaly set C is used as the anomaly score:

[0055]

[0056] Step 5: Use a sliding window to save a given number of anomaly score sets, and determine whether the anomaly score of sample x(t) is the maximum anomaly score in the top 10% of the anomaly score set. If so, the sample is determined to be an anomaly sample; otherwise, the sample is determined to be a normal sample.

[0057] like Figure 1 As shown, taking the IEEE-14 node power system as an example, the testing and implementation process of the present invention includes the following steps:

[0058] (1) Use the MATPOWER 6.0 toolbox to calculate the power flow and use it as the accurate measurement value of the PMU:

[0059] Use the loadcase function to load the case information and retrieve the load data to create a 1-hour load profile. The load is randomly sampled once per second from 95% to 105% of the original benchmark.

[0060] Use the runopf function to calculate the optimal power flow under different load conditions every second as the accurate measurement value of the PMU. The measured values ​​are all per-unit values.

[0061] (2) Adding additive white Gaussian noise with a signal-to-noise ratio of 45 dB to the precise measurement value, ultimately obtaining 432,000 (120 samples per second × 60 seconds × 60 minutes) measurement samples;

[0062] (3) Randomly select 10% of the measurement samples as the damaged sample set X(a). The state vector contains the voltage amplitude and phase angle of each node, so there are 28 state variables. For each potentially damaged sample, a random integer between 1 and 28 is generated. Each integer corresponds to a state variable and serves as the target that the attacker attempts to influence. Further calculate the false data injection attack (FDIA) with an attack amplitude of 20%. The attack amplitude is defined as the percentage change in the value of the state variable before and after the attack.

[0063] (4) Calculate the false data injection attacks with attack amplitudes of 5% and 10% respectively;

[0064] (5) After half an hour, simulate the interruption of line 4-5 and the outage of the generator at bus 8, and calculate the optimal power flow at this time and the false data injection attack with an attack amplitude of 20%;

[0065] (6) The robust random forest algorithm is used to judge the degree of abnormality. The robust random forest model consists of a set of independent trees. Each leaf node of the tree corresponds to a sample. The number of trees in the robust random forest model and the maximum number of leaf nodes n of each tree are selected;

[0066] (7) When the maximum number of leaf nodes in the tree is less than n, a forest model is constructed based on the PMU measurement data stream X = {x(1), x(2), …, x(t), …}, and the range of any dimension in the data is l i , i∈Z and i≤N, select one in The uniformly distributed random number r is cut, and the cutting dimension j satisfies The cutting point is Cut repeatedly until all samples are split into their corresponding leaf nodes;

[0067] (8) When the maximum number of leaf nodes in the tree is equal to n, the tree is dynamically maintained by inserting the latest sample x(t) and deleting the randomly selected sample x(r). A random number r is selected for cutting. If the cut separates the tree T(X) and the latest sample x(t), it is used as the first cut of the new tree. Otherwise, the cut is deleted and the same cut as in T(X) is selected to divide the subset. The cut is repeated until all samples are split into their corresponding leaf nodes.

[0068] (9) Calculate the depth of sample x(t). The complexity C(T(X), x(t)) of sample x(t) in tree T(X) is a set of binary codes representing the path from the root node to x(t). Assuming that the sample is located in the left subtree of the root node, the first bit of the code is 0, and the other bit is 1, such as Figure 2 As shown, the complexity C(T(X),x(t)) of sample x(t) is c1,c2,...,c r ,0,1;

[0069] (10) The depth of the sample corresponds to the number of bits of complexity, denoted as d(T,x) = len(C(T,x));

[0070] (11) The abnormal score of a sample is defined as the displacement caused by the sample. Since there is more than one abnormal sample and the positions of the abnormal samples on the tree are close, the displacement caused by the sample x(t) is very small. The abnormal set C consisting of the sample x(t) and the points close to the sample x(t) is removed, and the abnormal set C is selected by a step-by-step expansion method, as shown in the following example: Figure 3 As shown, for the parent node of sample x(t), that is, node 1, {x(t)} is the anomaly set C. For node 2, the leaf node of node 1 is the anomaly set. For node 3, the leaf node of node 2 is the anomaly set.

[0071] (12) Remove the maximum sample average displacement of C in the abnormal set as the abnormal score:

[0072]

[0073] (13) A sliding window is used to save a given number of anomaly score sets, and the anomaly score of the sample x(t) is judged to be the maximum anomaly score in the top 10% of the anomaly score set. If so, the sample is judged to be an anomaly sample; if not, the sample is judged to be a normal sample.

[0074] Simulation experiments were conducted. In the simulation experiments, the detection accuracy remained unchanged when two topology change events, line interruption and generator outage, occurred. When the attack amplitude varied between 5% and 20%, the accuracy was higher than 0.95. The experimental results show that the proposed method can solve the concept drift problem caused by topology changes, while maintaining good detection performance when the attack amplitude varies.

[0075] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A method for detecting false data injection attacks on PMU measurements, characterized in that: The method comprises the following steps: Step 1: Use the robust random forest algorithm to judge the degree of abnormality and establish a forest model; Step 2: Select the dimension of the sample to cut until the sample is split into the corresponding leaf node; Step 3: Calculate the depth of the sample; Step 4: Get the anomaly score of the sample; Step 5: Use a sliding window to save a given number of anomaly score sets, and determine whether the anomaly score of the sample is the maximum anomaly score of the top 10% in the anomaly score set. If so, the sample is determined to be an anomaly sample; if not, the sample is determined to be a normal sample. In step 4, the abnormal score of the sample is specifically the displacement caused by the sample. If the sample For an abnormal sample, and there is more than one abnormal sample, and the abnormal samples are close in position on the tree, the process of calculating the abnormal score of the sample is as follows: Step 401: Select an exception set using a step-by-step expansion method ; Step 402: Remove the sample and close to the sample An abnormal set of points ; Step 403: Take the maximum value of the average displacement change as the anomaly score ; In step 402, remove the collection The calculation formula for the resulting displacement change is: in, To remove the exception collection The tree behind For the tree The total collection of To remove the exception collection The displacement change caused by For the tree Samples in Depth; In step 403, the abnormal score The calculation formula is: 。 2. A method for detecting false data injection attacks on PMU measurements according to claim 1, characterized in that: The forest model consists of a set of independent trees, each leaf node of the tree corresponds to a sample, and the number of trees in the forest model and the maximum number of leaf nodes of each tree are selected. .

3. The method for detecting false data injection attacks on PMU measurements according to claim 1, wherein: In step 2, the process of selecting the sample dimensions for cutting is specifically as follows: When the maximum number of leaf nodes in the tree is less than When the PMU measures the data flow Construct a forest model and assume that the range of any dimension in the data is , select one in A random number uniformly distributed on Cutting, cutting dimensions satisfy , the cutting point is , repeatedly cut, where for No. Dimensional data until all samples are split into their corresponding leaf nodes; When the maximum number of leaf nodes in the tree is equal to By inserting the latest sample , and delete randomly selected samples To dynamically maintain the tree, select random numbers Make a cut, if the cut will and the latest samples Separate, it is used as the first cut of the new tree, otherwise delete the cut and select The same cut is used to divide the subsets, and the cuts are repeated until all samples are split into their corresponding leaf nodes.

4. The method for detecting false data injection attacks on PMU measurements according to claim 1, wherein: In step 3, the sample In the tree The complexity in is a set representing the distance from the root node to Binary encoding of the path. Assuming that the sample is in the left subtree of the root node, the first bit of the encoding is 0, and the second bit is 1. The depth of the sample corresponds to the number of bits of complexity: in, For the tree Samples in The depth, To find the function of the number of digits, For samples In the tree The complexity in .

5. A device for implementing the false data injection attack detection method according to any one of claims 1 to 4, characterized in that: The device includes a memory and a processor.

6. The false data injection attack detection device according to claim 5, characterized in that: The memory is used to store computer programs.

7. The false data injection attack detection device according to claim 5, characterized in that: The processor is configured to implement the following method when executing the computer program: Step 1: Use the robust random forest algorithm to judge the degree of abnormality; Step 2: Select the dimension of the sample to cut until the sample is split into the corresponding leaf node; Step 3: Calculate the depth of the sample; Step 4: Get the anomaly score of the sample; Step 5: Use a sliding window to save a given number of anomaly score sets, and determine whether the anomaly score of the sample is the maximum anomaly score of the top 10% in the anomaly score set. If so, the sample is determined to be an anomaly sample; otherwise, the sample is determined to be a normal sample.

Images