An unsupervised intelligent power grid anomaly detection method

Abstract

The present invention proposes an unsupervised intelligent grid anomaly detection method, which is based on the statistical correlation of measurement values and is used to detect abnormal power consumption behaviors, abnormal power consumption patterns or cyberattacks in the power grid. The framework of its intelligent grid attack detector includes DBN modeling, mutual information for feature extraction, and RBM for data training; the DBN and mutual information are applied to an intelligent grid test system composed of multiple measurement values, and the RBM is used to capture the full-system patterns extracted by the DBN model in an unsupervised manner; the intelligent grid attack detector extracts knowledge from the SCADA system; starting from actual applications, the present invention focuses on the selection of feature quantities of massive online data for power equipment and power networks, sample preprocessing, and introduces two different data mining methods to handle the anomaly problems of intelligent grids.

Description

Technical Field

[0001] The present invention relates to the technical field of power grid operation and maintenance, and in particular to an unsupervised intelligent power grid anomaly detection method. Background Art

[0002] With the rapid development of computer network applications, it has become increasingly important to detect abnormal behaviors and patterns in the field of network security. These anomalies can lead to serious consequences, so it is necessary to detect these power consumption anomalies in a timely manner and take appropriate measures.

[0003] With the continuous expansion of the scale and increasing complexity of the power information network, various application services based on the intelligent power grid are becoming more and more extensive, and the amount of generated data is also becoming more and more huge. Therefore, the possibility of network anomalies has increased significantly. Summary of the Invention

[0004] The present invention proposes an unsupervised intelligent power grid anomaly detection method. Starting from actual applications, the focus is on the selection of feature quantities of massive online data of power equipment and power networks, sample preprocessing, and the introduction of two different data mining methods to handle the anomaly problems of the intelligent power grid.

[0005] The present invention adopts the following technical solutions.

[0006] An unsupervised intelligent power grid anomaly detection method, based on the statistical correlation of measurement values, for detecting abnormal power consumption behaviors, abnormal power consumption patterns or network attacks in the power grid. The method includes a SCADA simulator module, a state estimator module, a rough set rule extractor, an anomaly detector module, and an intelligent power grid attack detector;

[0007] The SCADA simulator module calculates all voltages, power flows and injections of the power system network, and then associates the calculated quantities with the rules extracted by the rough set rule extractor at the measurement points of the power system;

[0008] The state estimator module includes a program for the state estimation process;

[0009] The rough set rule extractor uses the rough set classification algorithm to extract rules from the knowledge database of the SCADA system;

[0010] The anomaly detector module uses the rules defined by the rough set rule extractor to determine the state of the SCADA output data;

[0011] The framework of the intelligent power grid attack detector includes DBN modeling, mutual information for feature extraction, and RBM for data training; the DBN and mutual information are applied to the intelligent power grid test system composed of multiple measurement values, and the RBM is used to capture the full-system patterns extracted by the DBN model in an unsupervised manner;

[0012] The intelligent power grid attack detector extracts knowledge from the SCADA system. First, in the offline mode, a knowledge extractor generates rules for determining the normal or abnormal behavior of the system. Second, in the online mode, the data of the RTU breaker is detected according to the above rules to determine the normality of the measurement.

[0013] The intelligent power grid attack detector extracts knowledge from the SCADA system. The method includes the selection of characteristic quantities of power equipment and online data of the power grid, sample preprocessing, and introducing a data mining method based on unsupervised learning to deal with the abnormal problems of the intelligent power grid: the data mining method includes the density-based local outlier factor learning method and the distance-based support vector domain data description learning method.

[0014] The local outlier factor is the local outlier factor LOF; the support vector domain data description is the support vector domain description SVDD.

[0015] The SVDD verifies the integrity of the state vector by calculating the L-norm of the measurement residual, that is, BDD. The formula for determining the existence of bad data is

[0016]

[0017] where z ∈ R N is the measurement vector, is the estimated state vector, Z ∈ R N×D is the measurement Jacobian matrix. The threshold P r is predefined to control the tolerance of the residual according to the accuracy of the state estimation.

[0018] When the mode of the intelligent power grid attack is the FDI attack that intends to control a subset of sensor readings and arbitrarily manipulate state variables, the change of the measurement point data caused by the attack is expressed by the formula

[0019] where ε is the measurement noise, is the operator's attempted estimated value of the state vector who does not know that the attack has occurred, not the actual state vector x;

[0020] The abnormal detection method decomposes the injected false data (H a ) into a = Zc a and q a two parts, where c a ∈ R D is the injected data vector, located in the column space of Z, used to ensure the undetectability of the BDD test, while q a is located in Z(Z T Z)- 1 Z T q a The only detectable part in the complementary space where q = 0, i.e., if the attacker can partially access the network topology and line parameters to construct a secret attack that is completely located in (H), i.e., q a = 0, then the coordinated attack vector h a always exists.

[0021] The rough set classification algorithm provides a more compact rule set for the anomaly detector module by performing data reduction when establishing the knowledge database.

[0022] The DBN is modeled as a probabilistic graphical model, i.e., by representing the state of the system as a set of variables and modeling the probabilistic dependencies of the variables within and between time steps in a time series. When modeling, different time points t = 1,..., T are considered; each x i,t represents the expression of state i at time t; the symbol sequence is extracted from the variables set by the SDF; to find the probability of the occurrence of a new symbol s n assuming that the DBN satisfies the L-order Markov property and learning the state transition matrix Π that describes the L-order Markov chain from the training data; assuming that the state at time k is represented as q k ; the ij-th element of the state transition matrix Π is q k+1 is the probability of s j assuming q k is s j , i.e.,

[0023] Π ij = P(q k+1 = s i |q k = s j ) Equation Seven;

[0024] When processing several time series simultaneously, the probability of the occurrence of a new symbol in a symbol sequence A is predicted using an xL-order Markov chain, given the last L symbols of another symbol sequence B, and regular state transition matrices Π A and Π B are defined for the L-order Markov of subsystems A and B respectively, i.e., the causal dependencies of A on B and B on A can be represented by the cross state transition matrices Π AB and Π BA respectively, and given a multivariate time series, a high-order DBN is defined to describe the subsequent states and transition probabilities between vertices by splitting to generate a symbol sequence S;

[0025] When the DBN model is ready, the system-wide patterns of the SCADA system are learned by the RBM, and then the likelihood of the learned features is calculated from the test data.

[0026] The RBM for data training is a restricted Boltzmann machine, which belongs to the stochastic energy-based model EM. In EM, energy is associated with each state of the system being analyzed; the system being analyzed is represented by a network of stochastic binary neurons, and the stochastic binary neurons are expressed as a set of visible variables v = {v1,..., v N}, and these neurons are connected to stochastic unobservable units, that is, a set of hidden variables h = {h1,..., h K}; given the binary variables v and the hidden variables h, the joint probability Pr(v, h) of the state depends only on the energy En(v, h) of that state, and has a Boltzmann distribution function, which is expressed by the formula:

[0027]

[0028] where, where a, b, and w are model parameters obtained by maximizing the likelihood of the training data with low-energy states; the data density is rewritten as:

[0029] Pr(v) ∝ ∑ h exp(-En(v,h)) = exp(-F(v)) Formula XVII;

[0030] where F(v) is the known free energy, rewritten as:

[0031] F(v) = -log(Pr(v)) + constant Formula XVIII;

[0032] The free energy is used as an anomaly exponent to sort data instances in linear time.

[0033] When the trained RBM is used to detect network attacks based on the probability and energy level of events, low-probability events with high energy are considered anomalies, assuming that network attacks change the interactions between power grid subsystems and trigger different patterns in the DBN, that is

[0034] P(s n |s n-1 ...s n-L ...s0) = P(s n |s n-1 ...s n-L ) Formula X;

[0035] To quantify the difference between the energy distributions in the training and test data, the relative entropy RE metric is used; the relative entropy between two probability distributions on random variables is a measure of the distance between them; considering two probability distributions P and Q on a finite set X, RE is defined as,

[0036]

[0037] where P and Q represent the free energy distributions in normal and abnormal situations respectively; the symmetric ring distance under normal operating conditions is defined as

[0038] RE d (P||Q) = RE(P||Q) + RE(Q||P), Equation 20;

[0039] This formula is used as a metric for smart grid attack / anomaly detection, and by comparing it with a predefined detection threshold DT, grid attacks can be detected.

[0040] The establishment of the smart grid attack detector includes the following steps;

[0041] Step A1: Use intelligent technology to extract knowledge from the SCADA system;

[0042] Step A2: In the offline mode, the knowledge extractor generates a set of rules for determining the normal or abnormal behavior of the system;

[0043] Step A3: In the online mode, the data from the RTU interrupter will be checked according to the rules in Step A2 to determine the normality of the measurement;

[0044] Step A4: Use a rough classification algorithm to achieve data reduction and provide a more compact rule set for the anomaly detector module.

[0045] The implementation of the anomaly detection method includes the following steps;

[0046] Step B1: In the power grid environment, perform DBN modeling, feature extraction through mutual information, and RBM for data training;

[0047] Step B2: Establish an RBM for capturing the full-system patterns extracted by the DBN model in an unsupervised manner;

[0048] Step B3: Establish a simulation-based training mode, and use a feature extraction scheme, SDF, and time series data partitioning to develop a computationally efficient tool for discovering causal interactions between subsystems;

[0049] Step 4: Establish an anomaly detection model in the online and unsupervised modes in the power network environment.

[0050] The abnormal detection method uses historical measurement data to identify the behavior patterns of FDI attacks, that is, by associating scalar energy with each variable to capture the dependencies between variables and using it as a measure of compatibility to improve the detection accuracy and reduce the false alarm rate of detection.

[0051] Using the results of the abnormal detection technology of the statistical correlation of measurement values, the present invention proposes an intelligent power grid attack detection framework, summarizes an intelligent abnormal detection method suitable for large-scale intelligent power grids, and is applicable to a scalable abnormal detection engine for large-scale intelligent power grids and early detection and warning of abnormalities; using the abnormal detection technology proposed by the present invention, the unsupervised abnormal detection function of the intelligent power grid can be easily realized.

[0052] The present invention is applicable to a scalable abnormal detection engine for large-scale intelligent power grids and early detection and warning of abnormalities; it can distinguish the actual faults, interferences and intelligent network attacks of power equipment in the intelligent power grid, and can maintain its effectiveness and accuracy under different operating conditions of IEEE 39, 118 and 2848 node systems, and is a method suitable for unsupervised abnormal detection. Brief Description of the Drawings

[0053] The following further details the present invention in conjunction with the drawings and specific embodiments:

[0054] Att Figure 1 is a schematic structural diagram of the abnormal detection method of the present invention;

[0055] Att Figure 2 is a schematic principle diagram of the implementation environment of the present invention;

[0056] Att Figure 3 is a schematic diagram of the attack in the embodiment. Detailed Description of the Invention

[0057] ]>As shown in the figure, an unsupervised intelligent power grid abnormal detection method, based on the statistical correlation of measurement values, is used to detect abnormal power consumption behaviors, abnormal power consumption patterns or network attacks in the power grid. The method includes a SCADA simulator module, a state estimator module, a rough set rule extractor, an abnormal detector module, and an intelligent power grid attack detector;

[0058] The SCADA simulator module calculates all voltages, power flows and injections of the power system network, and then associates the calculated quantities with the rules extracted by the rough set rule extractor at the measurement points of the power system;

[0059] The state estimator module includes a program for the state estimation process;

[0060] The rough set rule extractor uses the rough set classification algorithm to extract rules from the knowledge database of the SCADA system;

[0061] The abnormal detector module uses the rules defined by the rough set rule extractor to determine the status of the SCADA output data;

[0062] The framework of the smart grid attack detector includes DBN modeling, mutual information for feature extraction, and RBM for data training; the DBN and mutual information are applied to the smart grid test system composed of multiple measurement values, and the RBM is used to capture the full-system patterns extracted by the DBN model in an unsupervised manner;

[0063] The smart grid attack detector extracts knowledge from the SCADA system. First, in the offline mode, a knowledge extractor generates rules for determining the normal or abnormal behavior of the system. Second, in the online mode, the above rules are used to detect the data of the RTU breaker to determine the normality of the measurement.

[0064] The smart grid attack detector extracts knowledge from the SCADA system. The method includes the selection of characteristic quantities of on-line data of power equipment and power network, sample preprocessing, and the introduction of data mining methods based on unsupervised learning methods to handle the abnormal problems of the smart grid: the data mining methods include the density-based local outlier factor learning method and the distance-based support vector domain data description learning method;

[0065] The local outlier factor is the local outlier factor LOF; the support vector domain data description is the support vector domain description SVDD;

[0066] The SVDD verifies the integrity of the state vector by calculating the L-norm of the measurement residual, that is, BDD. The formula for determining the existence of bad data is

[0067]

[0068] where z ∈ R N is the measurement vector, is the estimated state vector, Z ∈ R N×D is the measurement Jacobian matrix. The threshold P r is predefined to control the tolerance of the residual according to the accuracy of the state estimation.

[0069] When the pattern of the smart grid attack is an FDI attack that intends to control a subset of sensor readings and arbitrarily manipulate state variables, the change in the measurement point data caused by the attack is expressed by the formula

[0070]

[0071] where ε is the measurement noise, is the operator's attempted estimated value of the state vector who does not know that the attack has occurred, not the actual state vector x;

[0072] The anomaly detection method decomposes the injected false data (H a ) into a = Zc a and q a in two parts, where c a ∈R D is the injected data vector, which lies in the column space of Z and is used to ensure the undetectability of the BDD test, while q a lies in the complementary space of Z(Z T Z) - 1 Z T q a = 0 and is the only detectable part. That is, if the attacker can partially access the network topology and line parameters to construct a secret attack completely located in (H), i.e., q a = 0, then the coordinated attack vector h a always exists.

[0073] The rough set classification algorithm provides a more compact rule set for the anomaly detector module by performing data reduction when establishing the knowledge database.

[0074] The DBN is modeled as a probabilistic graphical model, that is, by representing the state of the system as a set of variables and modeling the probabilistic dependencies of the variables within and between time steps in a time series. When modeling, different time points t = 1,..., T are considered; each x i,t represents the expression of state i at time t; the symbol sequence is extracted from the variables set by the SDF; to find the probability of the occurrence of a new symbol s n , assume that the DBN satisfies the L-order Markov property and learn the state transition matrix Π describing the L-order Markov chain from the training data; assume that the state at time k is represented as q k ; the ij-th element of the state transition matrix Π is q k+1 is the probability of s j , assume that q k is s j , that is

[0075] Π ij = P(q k+1 = s i |q k = s j ) Equation Seven;

[0076] When processing several time series simultaneously, predict the probability of the occurrence of a new symbol in a symbol sequence A using an xL-order Markov chain, given the last L symbols of another symbol sequence B, and define regular state transition matrices Π for the L-order Markovs representing subsystems A and B respectivelyA and Π B That is, the causal dependencies of A on B and B on A can be represented by the cross-state transition matrices Π AB and Π BA respectively. Given a multivariate time series, a symbol sequence S is generated by segmentation, and a high-order DBN is defined to describe the subsequent states and transition probabilities between vertices;

[0077] When the DBN model is ready, the system-wide patterns of the SCADA system are learned by the RBM, and then the likelihood of the learned features is calculated from the test data.

[0078] The RBM for data training is a restricted Boltzmann machine, which belongs to the stochastic energy-based model EM. In EM, energy is associated with each state of the system being analyzed; the system being analyzed is represented by a network of stochastic binary neurons, and the stochastic binary neurons are expressed as a set of visible variables v = {v1,..., v N}, and these neurons are connected to stochastic unobservable units, that is, a set of hidden variables h = {h1,..., h K}; given the binary variables v and the hidden variables h, the joint probability Pr(v, h) of the state depends only on the energy En(v, h) of the state and has a Boltzmann distribution function, which is expressed by the formula:

[0079]

[0080] where

[0081] where a, b, and w are model parameters obtained by maximizing the likelihood of the training data with low-energy states; the data density is rewritten as:

[0082] Pr(v) ∝ ∑ h exp(-En(v,h)) = exp(-F(v)) Formula XVII;

[0083] where F(v) is the known free energy, which is rewritten as:

[0084] F(v) = -log(Pr(v)) + constant Formula XVIII;

[0085] The free energy is used as an anomaly exponent to sort the data instances in linear time.

[0086] When the trained RBM is used to detect network attacks based on the probability and energy level of events, a low-probability event with high energy is considered an anomaly, assuming that the network attack changes the interaction between the power grid subsystems and triggers different patterns in the DBN, that is

[0087] P(sn |s n-1 ...s n-L ...s0)=P(s n |s n-1 ...s n-L ) Formula 10;

[0088] To quantify the difference between the energy distributions in the training and test data, the relative entropy RE metric is used; the relative entropy between two probability distributions on a random variable is a measure of the distance between them; considering two probability distributions P and Q on a finite set X, RE is defined as,

[0089]

[0090] where P and Q represent the free energy distribution under normal and anomalous conditions, respectively; the symmetric ring distance under normal operating conditions is defined as

[0091] RE d (P||Q)=RE(P||Q)+RE(Q||P) Formula 20;

[0092] This formula is used as a metric for smart grid attack / anomaly detection, and is used to detect grid attacks by comparing it with a predefined detection threshold DT.

[0093] The establishment of the smart grid attack detector includes the following steps:

[0094] Step A1: Extract knowledge from the SCADA system using intelligent technology;

[0095] Step A2: In offline mode, the knowledge extractor generates a set of rules to determine the normal or abnormal behavior of the system;

[0096] Step A3: In online mode, the data from the RTU interrupter will be checked according to the rules of step A2 to determine the normality of the measurement;

[0097] Step A4: A rough classification algorithm is used to achieve data reduction and provide a more compact rule set for the anomaly detector module.

[0098] The implementation of the anomaly detection method includes the following steps:

[0099] Step B1: DBN modeling, feature extraction through mutual information, and RBM for data training in a power grid environment;

[0100] Step B2: Establish an RBM to capture the system-wide patterns extracted by the DBN model in an unsupervised manner;

[0101] Step B3: Establish a simulation-based training mode and develop a computationally efficient tool for discovering causal interactions between subsystems using a feature extraction scheme, SDF, and time series data partitioning.

[0102] Step 4: Establish an anomaly detection model in an online and unsupervised mode in a power grid environment.

[0103] The anomaly detection method uses historical measurement data to identify the behavioral patterns of FDI attacks, that is, by associating scalar energy with each variable to capture the dependencies between variables and using it as a measure of compatibility to improve the detection accuracy and reduce the false alarm rate of detection.

[0104] Example:

[0105] As Figure 3 shown, a smart grid physical system based on the IEEE-39 bus model, where each agent includes a generator, a measurement device, a distributed control agent, and an energy storage system, as Figure 3 shown. The energy storage system can draw energy from the feeder system through different microgrids or renewable energy sources.

[0106] In this example, the attack strategy aims to overload lines 6-31 and 11-12, and the attack area is as Figure 3 shown.

[0107] (1) Accuracy, false positives, and true positives analysis. In a smart grid, the main concern is not only detecting network attacks but also the ability to avoid false alarms.

[0108] (2) Technical performance analysis.

[0109] To evaluate the performance of the proposed method, four different scenarios were considered:

[0110] 1) Normal scenario without attacks, 2) Random attacks, 3) Single FDI attack on 6-31, 4) Multiple simultaneous FDI attacks on lines 6-31 and 11-12.

[0111] The performance of the proposed method was compared with two of the most popular BDD methods; the LNR test and the chi-square test. The same criteria were considered when setting the threshold in the LNR test.

[0112] Under normal operating conditions, the outputs of all detectors are below the threshold, which specifies that there are no traces of bad data or network attacks in the system.

[0113] In the random attack state, the outputs of all detectors will be higher than the threshold at a certain moment. It can be seen from this that all methods can detect random attacks. Since the attack is non-intelligent, it will leave traces in the dataset, and the operator will be informed of the existence of the attack.

[0114] In the optimal state estimation, in this example, the cost function is evaluated based on the measurement residuals. Under normal operating conditions, in the absence of bad data in the system, the cost function follows a normal distribution with a mean of zero. Under a random attack, the cost function will exceed the threshold of the optimal state estimation. Therefore, both the LNR and the chi-square test will successfully trigger an alarm.

[0115] Similar results were observed in all case studies.

Claims

1. An unsupervised intelligent grid anomaly detection method, based on the statistical correlation of measurement values, for detecting abnormal power consumption behaviors, abnormal power consumption patterns or network attacks in the power grid, characterized in that: The method includes a SCADA simulator module, a state estimator module, a rough set rule extractor, an anomaly detector module, and a smart grid attack detector; The SCADA simulator module calculates all voltages, power flows, and injections of the power system network, and then associates the calculated quantities with the rules extracted by the rough set rule extractor at the measurement points of the power system; The state estimator module includes a program for the state estimation process; The rough set rule extractor uses a rough set classification algorithm to extract rules from the knowledge database of the SCADA system; The anomaly detector module uses the rules defined by the rough set rule extractor to determine the status of the SCADA output data; The framework of the smart grid attack detector includes DBN modeling, mutual information for feature extraction, and RBM for data training; the DBN and mutual information are applied to the smart grid test system composed of multiple measurement values, and the RBM is used to capture the full-system patterns extracted by the DBN model in an unsupervised manner; The smart grid attack detector extracts knowledge from the SCADA system. First, in the offline mode, a knowledge extractor generates rules for determining the normal or abnormal behavior of the system. Second, in the online mode, the above rules are used to detect the data of the RTU breaker to determine the normality of the measurement; The smart grid attack detector extracts knowledge from the SCADA system. The method includes feature quantity selection and sample preprocessing of the online data of power equipment and power networks, and introduces data mining methods based on unsupervised learning methods to handle the abnormal problems of the smart grid: the data mining methods include the density-based local outlier factor learning method and the distance-based support vector data description learning method; The local outlier factor is the local outlier factor LOF; the support vector data description is the support vector data description SVDD; The SVDD verifies the integrity of the state vector by calculating the L-norm of the measurement residuals, that is, BDD. The formula for determining the existence of bad data is where \(z\in\mathbb{R}\) N is the measurement vector, is the estimated state vector, \(Z\in\mathbb{R}\) N×D is the measurement Jacobian matrix; the threshold \(P\) r is predefined to control the tolerance of the residual according to the accuracy of the state estimate; When the mode of the smart grid attack is an FDI attack that intends to control a subset of sensor readings and arbitrarily manipulate state variables, the change in the measurement point data caused by the attack is expressed by the formula where ε is the measurement noise, is the operator's attempt to estimate the state vector without knowing that an attack has occurred, and is not the actual state vector x; The abnormal detection method decomposes the injected false data H a into a = Zc a and q a in two parts, where c a ∈R D is the injected data vector, which lies in the column space of Z and is used to ensure the undetectability of the BDD test, while q a is the only detectable part in the complementary space of Z(Z T Z) -1 Z T q a = 0, that is, if the attacker can partially access the network topology and line parameters to construct a secret attack completely located in H, that is, q a = 0, then the coordinated attack vector h a always exists.

2. The unsupervised intelligent grid anomaly detection method according to claim 1, characterized in that: The rough set classification algorithm provides a more compact rule set for the anomaly detector module by performing data reduction when establishing the knowledge database.

3. The unsupervised intelligent grid anomaly detection method according to claim 1, characterized in that: The DBN modeling is the modeling of a probabilistic graphical model, that is, by representing the state of the system as a set of variables and modeling the probabilistic dependencies of the variables within and between time steps in the time series. When modeling, different time points t = 1,..., T are considered; each x i,t represents the expression of state i at time t; the symbol sequence is extracted from the variables set by the SDF; in order to find the probability of the occurrence of the new symbol s n assuming that the DBN satisfies the L-order Markov property and learning the state transition matrix ∏ describing the L-order Markov chain from the training data; assuming that the state at time k is represented as q k ; the ij-th element of the state transition matrix Π is q k+1 is the probability of s j assuming that q k is s j , that is Π ij = P(q k+1 = s i |q k = s j ) Formula VII; When dealing with several time series simultaneously, the probability of a new symbol occurring in a symbol sequence A is predicted by an xL-order Markov chain, given the last L symbols of another symbol sequence B, and regular state transition matrices Π are defined for the L-order Markovs representing subsystems A and B respectively. A and ∏ B , that is, the causal dependencies of A on B and B on A are represented by the cross state transition matrices ∏ AB and ∏ BA respectively, and given a multivariate time series, by splitting to generate a symbol sequence S, a high-order DBN is defined to describe the subsequent states and transition probabilities between vertices; When the DBN model is ready, the system-wide patterns of the SCADA system are learned by the RBM, and then the likelihood of the learned features is calculated from the test data.

4. An unsupervised intelligent grid anomaly detection method according to claim 3, characterized in that: The RBM for data training is a restricted Boltzmann machine, which belongs to the stochastic energy-based model EM. In EM, energy is associated with each state of the system being analyzed; the system being analyzed is represented by a network of stochastic binary neurons, and the stochastic binary neurons are expressed as a set of visible variables v = {v1,..., v N}, and these neurons are connected to stochastic unobservable units, that is, a set of hidden variables h = {h1,..., h K}; given the binary variables v and the hidden variables h, the joint probability Pr(v, h) of the state depends only on the energy En(v, h) of that state and has a Boltzmann distribution function, which is expressed by the formula: Among them, Where a, b, and w are model parameters obtained by maximizing the likelihood of the training data with low energy states; the data density is rewritten as: Pr(v)∝∑ h exp(-En(v,h)) = exp(-F(v)), Equation 17; Where F(v) is the known free energy, rewritten as: F(v) = -log(Pr(v)) + constant Formula XVIII; The free energy is used as an anomaly index to sort the data instances in linear time.

5. The method for unsupervised intelligent grid anomaly detection according to claim 4, wherein: When a trained RBM is used to detect network attacks based on the probability and energy level of events, low-probability events with high energy are considered anomalies, assuming that network attacks change the interactions between power grid subsystems and trigger different patterns in the DBN, namely P(s n |s n-1 ...s n-L ...s0) = P(s n |s n-1 ...s n-L ) Formula Ten; To quantify the difference between the energy distributions in the training and test data, the relative entropy RE metric is used; the relative entropy between two probability distributions on a random variable is a measure of the distance between them; considering two probability distributions P and Q on a finite set X, RE is defined as where P and Q represent the free energy distributions in normal and abnormal situations respectively; the symmetric ring distance under normal operating conditions is defined as RE d (P||Q) = RE(P||Q) + RE(Q||P) Formula 20; This formula is used as a metric for smart grid attack / anomaly detection, and by comparing it with a predefined detection threshold DT, power grid attacks can be detected.

6. The unsupervised intelligent grid anomaly detection method according to claim 1, characterized in that: The establishment of the smart grid attack detector includes the following steps; Step A1: Use intelligent technology to extract knowledge from the SCADA system; Step A2: In the offline mode, the knowledge extractor generates a set of rules for determining the normal or abnormal behavior of the system; Step A3: In the online mode, the data from the RTU interrupter will be checked according to the rules in Step A2 to determine the normality of the measurement; Step A4: Use a rough classification algorithm to implement data reduction and provide a more compact rule set for the anomaly detector module.

7. An unsupervised intelligent grid anomaly detection method according to claim 1, characterized in that: The implementation of the anomaly detection method includes the following steps; Step B1: In the power grid environment, perform DBN modeling, feature extraction through mutual information, and RBM for data training; Step B2: Establish an RBM for capturing the full-system patterns extracted by the DBN model in an unsupervised manner; Step B3: Establish a simulation-based training mode, and use the feature extraction scheme, SDF, and time series data partitioning to develop a computationally efficient tool for discovering causal interactions between subsystems; Step 4: Establish an anomaly detection model in the online and unsupervised modes in the power network environment.

8. A method for unsupervised anomaly detection in smart grid according to claim 1, characterized in that: The anomaly detection method uses historical measurement data to identify the behavior patterns of FDI attacks, that is, by associating a scalar energy with each variable to capture the dependencies between variables and using it as a measure of compatibility to improve the detection accuracy and reduce the false alarm rate of detection.

Images