Cyber-attack-oriented active power distribution network cyber-physical system operation situation prediction method and system

Abstract

The application discloses an active distribution network cyber physical system (ADNCPS) operation situation prediction method and system against network attacks, constructs an ADNCPS situation prediction index system, sets alarm threshold values for various indexes in the index system, stores real-time acquired ADNCPS operation data into a historical data storage module, completes the screening and calculation of initial ADNCPS operation data by using the constructed ADNCPS situation prediction index system, compares the calculation results with the alarm threshold values of various prediction indexes, stores the index data exceeding the alarm threshold values according to time sequences, completes the prediction of various indexes by using a model parallel situation prediction model based on CNN-LSTM, and finally completes the operation situation prediction of the ADNCPS by using a fuzzy analytic hierarchy process method. The application improves the prediction accuracy and provides protection for the safe and stable operation of the ADNCPS.

Description

Technical Field

[0001] This invention relates to the field of secure and stable operation technology of active distribution network cyber-physical systems, and in particular to a method and system for predicting the operational status of active distribution network cyber-physical systems in response to network attacks. Background Technology

[0002] With the rapid development of the economy and the increasingly prominent contradictions between energy shortages and environmental pollution, green and renewable energy technologies have flourished. In particular, distributed generation (DGs), characterized by small capacity, decentralized distribution, and primarily local consumption, has become an indispensable component of the power system. Against this backdrop, Active Distribution Network Cyber ​​Physical System (ADNCPS) has emerged and attracted widespread attention.

[0003] As a crucial component of ADNCPS (Active Distribution Network System), the large-scale integration of distributed generation (DG), controllable loads, and distributed energy storage poses significant challenges to the safe and stable operation of the distribution network. Firstly, because DGs from different manufacturers employ different communication protocols, attackers who obtain critical information such as the ADNCPS topology and exploit communication protocol vulnerabilities to launch cyberattacks can severely threaten the safe and stable operation of ADNCPS. Secondly, household terminal loads are converted into controllable loads via the Internet of Things (IoT). However, some household devices have weak network security protection measures. When attackers exploit network security vulnerabilities to launch cyberattacks against large-scale controllable loads, it can cause voltage exceedances and frequency oscillations in ADNCPS. Thirdly, the relevant protocol standards for integrating distributed energy storage into ADNCPS are still incomplete. Attackers can exploit protocol standard vulnerabilities to implant malicious code and send malicious control commands, leading to power quality problems and even disrupting the power supply and demand balance of ADNCPS. Therefore, the adverse effects on ADNCPS caused by attackers exploiting security vulnerabilities to launch cyberattacks should not be underestimated.

[0004] Currently, there are no existing methods or systems for predicting the operational status of ADNCPS in response to network attacks, thus making it impossible to effectively predict the operational status of ADNCPS. Summary of the Invention

[0005] This invention provides a method and system for predicting the operational status of an active distribution network cyber-physical system (ADNCPS) in response to network attacks, thereby solving or at least partially solving the technical problem in the prior art that it is impossible to effectively predict the operational status of ADNCPS.

[0006] To address the aforementioned technical problems, the first aspect of this invention provides a method for predicting the operational status of an active power distribution network cyber-physical system in response to network attacks, comprising:

[0007] S1: Construct an ADNCPS operation state transition model, where ADNCPS is an active distribution network cyber-physical system. The ADNCPS operation state transition model includes operation state and key state nodes of ADNCPS. The operation state includes ADNCPS operation state under network attack and ADNCPS operation state without network attack.

[0008] S2: Establish an ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods for each indicator;

[0009] S3: The historical operational data collected is calculated using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, resulting in historical operational situation prediction data.

[0010] S4: Set alarm thresholds for the information-side and physical-side indicators included in the ADNCPS situation prediction indicator system;

[0011] S5: Based on the set alarm threshold, judge the historical operation status prediction data, and construct the historical status prediction indicators that exceed the alarm threshold as training data.

[0012] S6: Real-time acquisition of ADNCPS operation data, and calculation of the real-time acquired ADNCPS operation data according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted.

[0013] S7: Construct a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model;

[0014] S8: Use the trained CNN-LSTM model to predict the data of the indicators to be predicted, and obtain the ADNCPS situation prediction index results;

[0015] S9: Use fuzzy hierarchical analysis to predict the operational status of ADNCPS based on the results of various ADNCPS situation prediction indicators.

[0016] The method for predicting the operational status of an active distribution network cyber-physical system in response to network attacks includes an ADNCPS operational status transition model constructed in step S1, which contains 5 operational statuses and 4 key ADNCPS status nodes. The 6 operational statuses are: (1) S1: ADNCPS normal operation status; (2) S2: ADNCPS vulnerable operation status; (3) S3: ADNCPS operation status under network attack; (4) S4: ADNCPS recovery operation status; (5) S5: ADNCPS disconnection and shutdown status. The 4 key ADNCPS status nodes are: (1) S3-1: ADNCPS alarm status under network attack; (2) S3-2: Status of extracting information side and physical side index values ​​of ADNCPS status prediction index system; (3) S3-3: ADNCPS general risk status; (4) S3-4: ADNCPS alarm operation status.

[0017] In one implementation, the ADNCPS situation prediction index system established in step S2 includes one information-side index and eight physical-side indexes. The information-side index C includes the flow anomaly index C1, and the physical-side index P includes the power supply reliability index P1, the ADNCPS security index P2, the ADNCPS economic index P3, and the DG output index P4.

[0018] In one implementation, among the information-side indicators C, the traffic anomaly indicator C1 includes traffic size C11. This indicator represents the number of data packets transmitted by the information system within a certain period of time after ADNCPS suffers a network attack, and the formula is:

[0019] (1)

[0020] In equation (1), Indicates in ( Q data packets are transmitted within a time period, where i represents the i-th time.

[0021] In one implementation, the physical side index P,

[0022] 1) Power supply reliability index P1 includes power supply margin insecurity P11, main transformer load rate imbalance severity P12, and power supply capacity sudden change severity P13.

[0023] The formula for the power supply margin unsafety level P11 is as follows:

[0024] (2)

[0025] In equation (2), Indicates ADNCPS at time The sudden increase in load value; S represents the maximum power supply of ADNCPS;

[0026] The formula for the severity P12 of the main transformer load imbalance is:

[0027] (3)

[0028] In equation (3), This indicates the degree of imbalance in the main transformer load rate after ADNCPS suffers a cyberattack; Indicates the main transformer p Load rate; Average load value of the main transformer; N This represents the total number of main transformers in ADNCPS.

[0029] The formula for the severity of the power supply capacity mutation, P13, is:

[0030] (4)

[0031] In equation (4), It is expressed as the percentage of the maximum power supply capacity of the main transformer reduced at time (t+1) due to the ADNCPS cyber attack, relative to the total power supply value at the previous time t. This indicates the probability of a failure in the main transformer P. This represents the power reduction of the system when the main transformer p exits ADNCPS at time (t+1); M represents the number of main transformers that will not exit operation due to fault after a network attack on ADNCPS. This represents the total power of ADNCPS at time (t+1);

[0032] ADNCPS safety index P2 includes voltage over-limit severity P21 and load loss severity P22.

[0033] The voltage over-limit severity P21 is expressed as follows:

[0034] (5)

[0035] In equation (5), LV represents the voltage offset value of ADNCPS at time t. This represents the minimum value of the ADNCPS voltage at time t;

[0036] The severity of load loss P22 in ADNCPS at time t is expressed as:

[0037] (6)

[0038] In equation (6), LD represents the load loss of ADNCPS at time t; This represents the load value of load node j on the faulty bus a after ADNCPS suffers a network attack. This indicates the number of load nodes on bus a that experienced the fault. The load value transferred from faulty bus a to node c on normal bus b; The number of load nodes transferred to normal bus b;

[0039] ADNCPS economic index P3 includes line loss severity P31, expressed as:

[0040] (7)

[0041] In equation (7), This represents the amount of active power transmitted in the f-th bus. This represents the power loss of the f-th line;

[0042] DG output index P4 includes DG penetration rate (P41) and the severity of DG output fluctuation (P42).

[0043] Wherein, the DG penetration rate P41 is expressed as:

[0044] (8)

[0045] In equation (8), This represents the total output power of the DG at time t; This represents the total output power of the ADNCPS at time t.

[0046] The severity of DG output fluctuation P42 is expressed as:

[0047] (9)

[0048] In equation (9), This represents the total output power of DG at time (t+1); This indicates that DG is in t Total output power at any given time.

[0049] In one implementation, when S7 trains the CNN-LSTM model using the constructed training data, it employs a multi-feature data reconstruction method based on a time-sliding window algorithm to process the training data, specifically including:

[0050] Based on the time sliding window algorithm, historical operational status prediction data is extracted every 5 minutes and mapped to a 1D time series status prediction index data group with a time step of 12; meteorological data at the same time point as the historical operational status prediction data is extracted every 30 minutes and mapped to a 1D time series meteorological data group with a time step of 12.

[0051] Set time as the horizontal axis and historical operational trend forecast data and meteorological data as the vertical axis to construct... × A two-dimensional data matrix, wherein: This indicates the number of time interval steps for predicting historical operational trends. This indicates the quantity of ADNCPS forecast indicators and meteorological data at the corresponding time point.

[0052] In one implementation, S8 uses a trained CNN-LSTM model to predict the data of the indicator to be predicted, specifically including: using the trained CNN-LSTM model based on... Historical moments The correlation coefficient between the data of each feature to be extracted is used to calculate the next... The situation value of the ADNCPS situation prediction index at each time point is calculated using the following formula:

[0053] (10)

[0054] In equation (10), Indicates the first The future trend values ​​of the indicators to be predicted, among which: , Indicates the first The next indicator to be predicted ADNCPS operational status values ​​for a given time period Representing history The first moment Each characteristic quantity and The correlation coefficient of ADNCPS's operational status at any given time. Indicates the error value. Indicates the first The predicted value of the situation of the indicator to be predicted at time t. Indicates the first One indicator to be predicted The predicted situation at any given time. This represents the extracted feature values. Indicates the number of eigenvectors. Indicates the first One indicator to be predicted The predicted situation at any given time.

[0055] Based on the same inventive concept, a second aspect of the present invention provides an active power distribution network cyber-physical system operation status prediction system for network attacks, comprising:

[0056] The operational state transition model construction module is used to construct the ADNCPS operational state transition model. ADNCPS is an active distribution network cyber-physical system. The ADNCPS operational state transition model includes operational states and key ADNCPS state nodes. The operational states include ADNCPS operational states under network attacks and ADNCPS operational states without network attacks.

[0057] The situation prediction indicator system establishment module is used to establish the ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods of each indicator.

[0058] The first calculation module is used to calculate the collected historical operational data using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, and the historical operational situation prediction data.

[0059] The alarm threshold setting module is used to set alarm thresholds for the information-side indicators and physical-side indicators included in the ADNCPS situation prediction indicator system.

[0060] The training data construction module is used to judge the historical operation status prediction data according to the set alarm threshold, and construct the historical status prediction indicators that exceed the alarm threshold as training data.

[0061] The second calculation module is used to collect ADNCPS operation data in real time, and calculate the real-time collected ADNCPS operation data according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted.

[0062] The model building and training module is used to build a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model.

[0063] The prediction index calculation module is used to predict the data of the index to be predicted using a trained CNN-LSTM model, and obtain the ADNCPS situation prediction index results.

[0064] The operational status prediction module is used to predict the operational status of ADNCPS based on the results of various ADNCPS status prediction indicators using fuzzy hierarchical analysis.

[0065] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0066] This invention provides a method for predicting the operational status of an active power distribution network (ADP) cyber-physical system (CPS) against network attacks. It constructs an ADNCPS status prediction index system and sets alarm thresholds for each index. The method calculates historical operational data using the methods for each index within the ADNCPS status prediction index system. The calculated historical index values ​​are compared with the alarm thresholds for each predicted index. Historical index data exceeding the alarm thresholds are stored and used as training data. A CNN-LSTM model is constructed and trained using the training data. The trained CNN-LSTM model is then used to predict the data for the predicted indexes, yielding the ADNCPS status prediction index results and completing the prediction of each index. Finally, fuzzy hierarchical analysis is used to predict the operational status of the ADNCPS based on the results of each ADNCPS status prediction index. This CNN-LSTM-based prediction method combines information-side and physical-side data to better predict the future operational status trend of the ADNCPS, improving prediction accuracy. Attached Figure Description

[0067] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0068] Figure 1 This is a coupling diagram of the information side and physical side of the active power distribution network cyber-physical system against network attacks in an embodiment of the present invention;

[0069] Figure 2 This is a diagram showing the operational state transition of the cyber-physical system in an active power distribution network.

[0070] Figure 3 A schematic diagram of the situation prediction index system for active power distribution network cyber-physical systems;

[0071] Figure 4 A simplified flowchart of the situation prediction process for an active power distribution network cyber-physical system in response to cyberattacks. Detailed Implementation

[0072] This invention proposes a method and system for predicting the operational status of an active distribution network (ADNCPS) cyber-physical system. It constructs an ADNCPS status prediction index system and sets alarm thresholds for each index. The ADNCPS operational data acquired in real-time by the DPMU is stored in the historical data storage module of the ADNCPS operational status prediction system. The constructed ADNCPS status prediction index system is used to filter and calculate the initial ADNCPS operational data. The calculation results are compared with the alarm thresholds of each prediction index. Data exceeding the alarm thresholds are used as training data and stored in the data preprocessing module in chronological order. A parallel status prediction model based on CNN-LSTM is established to predict each index. Fuzzy hierarchical analysis is used to predict the operational status of ADNCPS based on the results of each ADNCPS status prediction index. This invention helps maintenance personnel to formulate and adjust ADNCPS operational strategies in a timely manner based on the prediction results, ensuring the safe and stable operation of ADNCPS.

[0073] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0074] Example 1

[0075] This invention provides a method for predicting the operational status of an active power distribution network cyber-physical system in response to network attacks, including:

[0076] S1: Construct an ADNCPS operation state transition model, where ADNCPS is an active distribution network cyber-physical system. The ADNCPS operation state transition model includes operation state and key state nodes of ADNCPS. The operation state includes ADNCPS operation state under network attack and ADNCPS operation state without network attack.

[0077] S2: Establish an ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods for each indicator;

[0078] S3: The historical operational data collected is calculated using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, resulting in historical operational situation prediction data.

[0079] S4: Set alarm thresholds for the information-side and physical-side indicators included in the ADNCPS situation prediction indicator system;

[0080] S5: Based on the set alarm threshold, judge the historical operation status prediction data, and construct the historical status prediction indicators that exceed the alarm threshold as training data.

[0081] S6: Real-time acquisition of ADNCPS operation data, and calculation of the real-time acquired ADNCPS operation data according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted.

[0082] S7: Construct a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model;

[0083] S8: Use the trained CNN-LSTM model to predict the data of the indicators to be predicted, and obtain the ADNCPS situation prediction index results;

[0084] S9: Use fuzzy hierarchical analysis to predict the operational status of ADNCPS based on the results of various ADNCPS situation prediction indicators.

[0085] Please see Figure 1 This is a coupling diagram of the information side and physical side of the active power distribution network cyber-physical system in response to network attacks in an embodiment of the present invention.

[0086] Specifically, historical operational status prediction data refers to the values ​​of various indicators calculated according to the calculation method in the indicator system, i.e., historical operational status values. These historical operational status values ​​serve as the input training set for the CNN-LSTM model, thereby enabling ADNCPS operational status prediction.

[0087] Step S3 processes the collected raw operational data based on the calculation method of the ADNCPS situation prediction index system. Specifically, during the real-time operation of ADNCPS, a large amount of operational status data can be captured by the Supervisory Control ADN Data Acquisition (SCADA) system and the Advanced Metering Infrastructure (AMI). The captured data is stored in the historical data storage unit of ADNCPS. The collected raw ADNCPS operational data is then calculated based on the ADNCPS situation prediction index system established in Step S2. The calculated results are used as training data for the ADNCPS prediction model.

[0088] Step S4 sets alarm thresholds for ADNCPS situation prediction indicators. To accurately predict the operational status of ADNCPS, the ADNCPS situation prediction system needs to acquire a large amount of ADNCPS operational data after network attacks. This embodiment of the invention does not consider ADNCPS situation prediction indicator alarms caused by ADNCPS itself failing; it only considers alarms caused by network attacks. Therefore, this embodiment sets alarm thresholds for each ADNCPS situation prediction indicator in the indicator system of step S2. At this time, ADNCPS is in S1: normal ADNCPS operation state.

[0089] Step S5 performs ADNCPS situation prediction indicator limit exceeding alarm judgment. Based on the ADNCPS alarm threshold set in step S4, the values ​​of each ADNCPS situation prediction indicator are judged. When an ADNCPS situation prediction indicator triggers an alarm, the current time is defined as... t 0. That is, the moment when an attacker launches a network attack on ADNCPS and causes damage to ADNCPS. At this time, ADNCPS is in S3-1: ADNCPS under network attack issues an alarm; otherwise, proceed to step 3 to continue collecting raw operational data. At this time, ADNCPS is in S2: ADNCPS vulnerable operational state.

[0090] After defining the recording time t0, record the various situation prediction index values ​​of ADNCPS, time-stamp the various index values ​​collected in real time by the distribution network SCADA system and AMI, and store the data in the historical database of the active distribution network cyber-physical system operation situation prediction system to provide analytical data for subsequent situation assessment; at this time, ADNCPS is in S3-2: extracting ADNCPS information side and physical side index values ​​under network attack.

[0091] In one implementation, the ADNCPS operation state transition model constructed in step S1 includes 5 operation states and 4 ADNCPS key state nodes. The 6 operation states are as follows: (1) S1: ADNCPS normal operation state; (2) S2: ADNCPS vulnerable operation state; (3) S3: ADNCPS operation state under network attack; (4) S4: ADNCPS recovery operation state; (5) S5: ADNCPS disconnection and shutdown state; The 4 ADNCPS key state nodes are as follows: (1) S3-1: ADNCPS alarm state under network attack; (2) S3-2: state of extracting ADNCPS situation prediction index system information side and physical side index values; (3) S3-3: ADNCPS general risk state; (4) S3-4: ADNCPS alarm operation state.

[0092] Construct an ADNCPS state transition model against network attacks, such as... Figure 2 As shown, it includes 5 running states and 4 ADNCPS critical state nodes.

[0093] In one implementation, the ADNCPS situation prediction index system established in step S2 includes one information-side index and eight physical-side indexes. The information-side index C includes the flow anomaly index C1, and the physical-side index P includes the power supply reliability index P1, the ADNCPS security index P2, the ADNCPS economic index P3, and the DG output index P4.

[0094] Specifically, the ADNCPS situation prediction index system includes one information-side index and eight physical-side indexes. The information-side index C includes the flow anomaly index C1, and the physical-side index P consists of the power supply reliability index P1, the ADNCPS safety index P2, the ADNCPS economic index P3, and the DGs output index P4. Specifically: the power supply reliability index P1 includes the power supply margin insecurity level P11, the severity of main transformer load imbalance P12, and the severity of power supply capacity mutation P13. The ADNCPS safety index P2 includes the voltage limit exceedance severity P21 and the load loss severity P22. The ADNCPS economic index P3 includes the line loss severity P31. The DGs output index P4 includes the DGs penetration rate P41 and the DGs output fluctuation severity P42.

[0095] In one implementation, among the information-side indicators C, the traffic anomaly indicator C1 includes traffic size C11. This indicator represents the number of data packets transmitted by the information system within a certain period of time after ADNCPS suffers a network attack, and the formula is:

[0096] (1)

[0097] In equation (1), Indicates in ( Q data packets are transmitted within a time period, where i represents the i-th time.

[0098] Specifically, the traffic size C11 represents the number of data packets transmitted by the information system within a certain period of time after ADNCPS suffers a network attack.

[0099] In one implementation, the physical side index P,

[0100] 1) Power supply reliability index P1 includes power supply margin insecurity P11, main transformer load rate imbalance severity P12, and power supply capacity sudden change severity P13.

[0101] The formula for the power supply margin unsafety level P11 is as follows:

[0102] (2)

[0103] In equation (2), Indicates ADNCPS at time The sudden increase in load value; S represents the maximum power supply of ADNCPS;

[0104] The formula for the severity P12 of the main transformer load imbalance is:

[0105] (3)

[0106] In equation (3), This indicates the degree of imbalance in the main transformer load rate after ADNCPS suffers a cyberattack; Indicates the main transformer p Load rate; Average load value of the main transformer; N This represents the total number of main transformers in ADNCPS.

[0107] The formula for the severity of the power supply capacity mutation, P13, is:

[0108] (4)

[0109] In equation (4), It is expressed as the percentage of the maximum power supply capacity of the main transformer reduced at time (t+1) due to the ADNCPS cyber attack, relative to the total power supply value at the previous time t. This indicates the probability of a failure in the main transformer P. This represents the power reduction of the system when the main transformer p exits ADNCPS at time (t+1); M represents the number of main transformers that will not exit operation due to fault after a network attack on ADNCPS. This represents the total power of ADNCPS at time (t+1);

[0110] ADNCPS safety index P2 includes voltage over-limit severity P21 and load loss severity P22.

[0111] The voltage over-limit severity P21 is expressed as follows:

[0112] (5)

[0113] In equation (5), LV represents the voltage offset value of ADNCPS at time t. This represents the minimum value of the ADNCPS voltage at time t;

[0114] The severity of load loss P22 in ADNCPS at time t is expressed as:

[0115] (6)

[0116] In equation (6), LD represents the load loss of ADNCPS at time t; This represents the load value of load node j on the faulty bus a after ADNCPS suffers a network attack. This indicates the number of load nodes on bus a that experienced the fault. The load value transferred from faulty bus a to node c on normal bus b; The number of load nodes transferred to normal bus b;

[0117] ADNCPS economic index P3 includes line loss severity P31, expressed as:

[0118] (7)

[0119] In equation (7), This represents the amount of active power transmitted in the f-th bus. This represents the power loss of the f-th line;

[0120] DG output indicators P4 include DG penetration rate (P41) and the severity of DG output fluctuations (P42).

[0121] Wherein, the DG penetration rate P41 is expressed as:

[0122] (8)

[0123] In equation (8), This represents the total output power of the DG at time t; This represents the total output power of the ADNCPS at time t.

[0124] The severity of DG output fluctuation P42 is expressed as:

[0125] (9)

[0126] In equation (9), This represents the total output power of DG at time (t+1); This indicates that DG is in t Total output power at any given time.

[0127] Please see Figure 3 This is a schematic diagram of the situation prediction index system for the cyber-physical system of active power distribution networks.

[0128] Specifically, the power supply margin insecurity P11 reflects the safety margin of the ADNCPS power supply capacity and its safe and stable operation. Therefore, this embodiment defines the power supply margin insecurity P11 as a value at a certain moment.t The ratio of sudden load increase to the maximum power supply capacity of ADNCPS.

[0129] The severity of the main transformer load imbalance (P12) reflects the impact of a network attack on ADNCPS, which causes a main transformer failure. This failure results in a load shift of the main transformer, causing some main transformers to experience an excessively high load. Main transformers operating under uneven load conditions for extended periods exacerbate the adverse effects of network attacks on ADNCPS.

[0130] The power supply capacity sudden change severity P13 indicates that when ADNCPS suffers a network attack, one or more main transformers in the system fail and go out of operation. If the power supply capacity is reduced suddenly, it will seriously threaten the safe and stable operation of ADNCPS.

[0131] In ADNCPS security index P2, voltage over-limit severity P21 indicates that when ADNCPS suffers a network attack and malfunctions, a voltage over-limit situation occurs. When power equipment operates in an over-limit environment for an extended period, the insulation of the equipment will be significantly reduced, thereby affecting the safe and stable operation of ADNCPS.

[0132] Load loss severity P22. This indicator represents the extent to which a network attack on ADNCPS causes a fault, resulting in the outage of one or more main transformers or busbars. The load borne by these out-of-service transformers or busbars will be transferred to other main transformers or busbars. However, when the transferred load exceeds the capacity of the main transformers or busbars, the system will be in a "saturated" state, and the loads that cannot be transferred must be taken out of service. If the faulty busbar contains DGs (Distributed Gauges), the power supply to part of the load can be restored by adjusting the output of the DGs.

[0133] In ADNCPS economic indicators P3, line loss severity P31 represents the ratio of power loss to power output of a line after an ADNCPS network attack.

[0134] In the DGs output index P4, the DGs penetration rate P41 represents the ADNCPS in... t The proportion of output of DGs in ADNCPS to the total output of ADNCPS at any given time. The severity of output fluctuation of DGs (P42) indicates the degree of output fluctuation after DGs are connected to ADNCPS.

[0135] In one implementation, when S7 trains the CNN-LSTM model using the constructed training data, it employs a multi-feature data reconstruction method based on a time-sliding window algorithm to process the training data, specifically including:

[0136] Based on the time sliding window algorithm, historical operational status prediction data is extracted every 5 minutes and mapped to a 1D time series status prediction index data group with a time step of 12; meteorological data at the same time point as the historical operational status prediction data is extracted every 30 minutes and mapped to a 1D time series meteorological data group with a time step of 12.

[0137] Set time as the horizontal axis and historical operational trend forecast data and meteorological data as the vertical axis to construct... × A two-dimensional data matrix, wherein: This indicates the number of time interval steps for predicting historical operational trends. This indicates the quantity of ADNCPS forecast indicators and meteorological data at the corresponding time point.

[0138] Specifically, during the real-time operation of ADNCPS, maintenance personnel assess the operational status of ADNCPS based on factors such as flow rate (C11), power supply margin insecurity (P11), main transformer load imbalance severity (P12), power supply capacity abrupt change severity (P13), voltage limit exceedance severity (P21), load loss severity (P22), line loss severity (P31), DGs penetration rate (P41), and DGs output fluctuation severity (P42), and formulate relevant strategies to ensure the dynamic balance of ADNCPS operation. When one or more of the above indicators change, the remaining indicator values ​​will also be directly or indirectly affected. Since the proposed CNN-LSTM-based ultra-short-term ADNCPS situation prediction method requires a two-dimensional matrix format for the input data, this implementation proposes a multi-feature data reconstruction method based on a time sliding window algorithm.

[0139] The total duration is 6 hours, and the meteorological data includes temperature and wind speed. This represents the number of time interval steps for historical data, where the interval is 5 minutes and the period is 60 minutes.

[0140] A two-dimensional reconstruction can be completed using the multi-feature data reconstruction method. × The matrix input dataset is constructed to provide a training dataset for CNN-LSTM.

[0141] In one implementation, S8 uses a trained CNN-LSTM model to predict the data of the indicator to be predicted, specifically including: using the trained CNN-LSTM model based on... Historical moments The correlation coefficient between the data of each feature to be extracted is used to calculate the next... The situation value of the ADNCPS situation prediction index at each time point is calculated using the following formula:

[0142] (10)

[0143] In equation (10), Indicates the first The future trend values ​​of the indicators to be predicted, among which: , Indicates the first The next indicator to be predicted ADNCPS operational status values ​​for a given time period Representing history The first moment Each characteristic quantity and The correlation coefficient of ADNCPS's operational status at any given time. Indicates the error value. Indicates the first The predicted value of the situation of the indicator to be predicted at time t. Indicates the first One indicator to be predicted The predicted situation at any given time. This represents the extracted feature values. Indicates the number of eigenvectors. Indicates the first One indicator to be predicted The predicted situation at any given time.

[0144] Specifically, during the real-time operation of ADNCPS, in order to ensure the dynamic balance of "source-grid-load" in ADNCPS, maintenance personnel assess the operational status of ADNCPS based on the following indicators: flow rate (C11), power supply margin insecurity (P11), main transformer load rate imbalance severity (P12), power supply capacity sudden change severity (P13), voltage limit violation severity (P21), load loss severity (P22), line loss severity (P31), DGs penetration rate (P41), and DGs output fluctuation severity (P42), and formulate corresponding countermeasures for adjustment. Considering that when one or more of the above indicators change, the remaining indicator values ​​will also be directly or indirectly affected, this embodiment has a total of (…). -2) The CNN-LSTMs share the same dataset, and each CNN-LSTM is trained independently for one situation prediction metric, without interfering with each other. After convolution by multiple two-dimensional convolutional kernels, the CNN can extract the data along the vertical axis. Spatial correlation of the features to be extracted, extracted on the horizontal axis. The ultra-short-term temporal correlation of secondary features was analyzed. The correlation vectors of each input matrix extracted by the CNN were pooled to construct a long-term time series, which was then used as input data for the LSTM. Long-term historical temporal relationships were extracted for ADNCPS operational prediction. By combining time windows and long-term historical data, situational predictions for various operational indicators in ADNCPS were achieved.

[0145] By training a CNN-LSTM model, the predicted value of each ADNCPS situation prediction index can be obtained.

[0146] After obtaining the ADNCPS situation prediction index results (the predicted value of each ADNCPS situation prediction index), this invention implements the ADNCPS situation prediction results based on the fuzzy hierarchical analysis method.

[0147] To present the ADNCPS operational status prediction results in a quantitative manner, this embodiment calculates the weights of the ADNCPS status prediction indicators based on the fuzzy hierarchical analysis method. A pre-warning level classification method is established to quantitatively evaluate the ADNCPS status pre-warning level in scenarios with and without network attacks. Similarly, to assess the accuracy of the prediction model, a prediction error evaluation index is established for accuracy assessment. At this point, the ADNCPS will be in either S3-3: ADNCPS general risk state or S3-4: ADNCPS alarm-level operational state.

[0148] Step 1: Classification of Warning Levels

[0149] This embodiment, based on the new version of the meteorological disaster warning signal, divides the ADNCPS safety situation warning into four levels: blue represents safe, yellow represents moderate, orange represents relatively severe, and red represents serious. Let... As the situation warning value, each warning level is divided into intervals, as shown in Table 1.

[0150] Table 1. Situational Warning Level Classification

[0151]

[0152] Situation warning value The calculation formula is:

[0153] (11)

[0154] (12)

[0155] In equations (11)-(12), This represents the ADNCPS situational awareness indicator vector. This represents the weight vector of the ADNCPS situation prediction index. Based on the division of warning level intervals, the index's scale is defined as follows: Therefore, we can conclude that... Among them, the severity vector of the ADNCPS situation prediction index .

[0156] Step 2: ADNCPS Prediction Results

[0157] The steps for assessing the operational status of ADNCPS are as follows: 1) Extract the predicted value of each ADNCPS situation prediction indicator; 2) Calculate the weight of the ADNCPS situation prediction indicator using the fuzzy hierarchical analysis method; 3) Obtain the warning value at each time point using equations (11)-(12), and obtain the warning level of ADNCPS according to the warning level classification method. When the operation and maintenance personnel adjust the relevant parameters of ADNCPS according to the predicted value, its status can be changed from the S3 ADNCPS operational status with network attack to the S4 ADNCPS recovery operational status. When the prediction result is severe, ADNCPS will be decoupled and shut down until the operation and maintenance personnel formulate corresponding repair strategies to restore ADNCPS to normal operation.

[0158] Please see Figure 4 This is a simplified flowchart of the situation prediction process for the active power distribution network cyber-physical system in response to network attacks during the specific implementation process.

[0159] Step 1: Construct the ADNCPS runtime state transition model;

[0160] Step 2: Establish an ADNCPS situation prediction index system;

[0161] Step 3: Process the collected raw operational data using the calculation method based on the ADNCPS situation prediction index system;

[0162] Step 4: Setting the alarm threshold for ADNCPS situation prediction indicators; at this time, ADNCPS is in S1: ADNCPS normal operation state.

[0163] Step 5: ADNCPS Situation Prediction Indicator Limit Exceedance Alarm Judgment (Based on the ADNCPS alarm threshold set in Step 4, the values ​​of each ADNCPS situation prediction indicator are judged. When an ADNCPS situation prediction indicator alarm occurs, proceed to Step 6; otherwise, proceed to Step 3. At this time, ADNCPS is in S2: ADNCPS Vulnerable Operating State)

[0164] Step 6: Define the network attack start time t0; at this time, ADNCPS is in S3-1: ADNCPS issues alarm under network attack.

[0165] Step 7: Record the various situation prediction index values ​​of ADNCPS after time t0; at this time, ADNCPS is in S3-2: extracting ADNCPS information side and physical side index values ​​under network attack.

[0166] Step 8: Construct a two-dimensional matrix data model;

[0167] Step 9: Obtain the predicted values ​​of each ADNCPS situation prediction index based on the multi-step CNN-LSTM model;

[0168] Step 10: Obtain ADNCPS situation prediction results based on fuzzy hierarchical analysis.

[0169] Example 2

[0170] Based on the same inventive concept, this embodiment provides an active power distribution network cyber-physical system operation status prediction system against network attacks, including:

[0171] The operational state transition model construction module is used to construct the ADNCPS operational state transition model. ADNCPS is an active distribution network cyber-physical system. The ADNCPS operational state transition model includes operational states and key ADNCPS state nodes. The operational states include ADNCPS operational states under network attacks and ADNCPS operational states without network attacks.

[0172] The situation prediction indicator system establishment module is used to establish the ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods of each indicator.

[0173] The first calculation module is used to calculate the collected historical operational data using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, and the historical operational situation prediction data.

[0174] The alarm threshold setting module is used to set alarm thresholds for the information-side indicators and physical-side indicators included in the ADNCPS situation prediction indicator system.

[0175] The training data construction module is used to judge the historical operation status prediction data according to the set alarm threshold, and construct the historical status prediction indicators that exceed the alarm threshold as training data.

[0176] The second calculation module is used to collect ADNCPS operation data in real time, and calculate the real-time collected ADNCPS operation data according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted.

[0177] The model building and training module is used to build a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model.

[0178] The prediction index calculation module is used to predict the data of the index to be predicted using a trained CNN-LSTM model, and obtain the ADNCPS situation prediction index results.

[0179] The operational status prediction module is used to predict the operational status of ADNCPS based on the results of various ADNCPS status prediction indicators using fuzzy hierarchical analysis.

[0180] Since the system described in Embodiment 2 of this invention is the same system used to implement the method for predicting the operational status of an active distribution network cyber-physical system against network attacks in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this system based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All systems used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0181] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0182] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0183] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments as well as all changes and modifications falling within the scope of the invention.

[0184] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations to the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention also intends to include these modifications and variations.

Claims

1. A method for predicting the operational status of an active power distribution network cyber-physical system in response to network attacks, characterized in that, include: S1: Construct an ADNCPS operation state transition model, where ADNCPS is an active distribution network cyber-physical system. The ADNCPS operation state transition model includes operation state and key state nodes of ADNCPS. The operation state includes ADNCPS operation state under network attack and ADNCPS operation state without network attack. S2: Establish an ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods for each indicator; S3: The historical operational data collected is calculated using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, resulting in historical operational situation prediction data. S4: Set alarm thresholds for the information-side and physical-side indicators included in the ADNCPS situation prediction indicator system; S5: Based on the set alarm threshold, judge the historical operation status prediction data, and construct the historical status prediction indicators that exceed the alarm threshold as training data. S6: Collect ADNCPS operation data in real time, and calculate the ADNCPS operation data in real time according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted. S7: Construct a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model; S8: Use the trained CNN-LSTM model to predict the data of the indicators to be predicted, and obtain the ADNCPS situation prediction index results; S9: Use fuzzy hierarchical analysis to predict the operational status of ADNCPS based on the results of various ADNCPS situation prediction indicators. The ADNCPS situation prediction index system established in step S2 includes one information-side index and eight physical-side indexes. Among them, the information-side index C includes the flow anomaly index C1, and the physical-side index P includes the power supply reliability index P1, the ADNCPS security index P2, the ADNCPS economic index P3, and the DG output index P4. In the information-side indicator C, the traffic anomaly indicator C1 includes traffic size C11. This indicator represents the number of data packets transmitted by the information system within a certain period after ADNCPS suffers a network attack. The formula is: （1） In equation (1), Indicates in ( Transmit Q data packets within a time period, where i represents the i-th time. In the physical side index P, 1) Power supply reliability index P1 includes power supply margin insecurity P11, main transformer load rate imbalance severity P12, and power supply capacity sudden change severity P13. The formula for the power supply margin unsafety level P11 is as follows: （2） In equation (2), Indicates ADNCPS at time The sudden increase in load value; S represents the maximum power supply of ADNCPS; The formula for the severity P12 of the main transformer load imbalance is: （3） In equation (3), This indicates the degree of imbalance in the main transformer load rate after ADNCPS suffers a cyberattack; Indicates the main transformer p Load rate; Average load value of the main transformer; N This represents the total number of main transformers in ADNCPS. The formula for the severity of the power supply capacity mutation, P13, is: （4） In equation (4), It is expressed as the percentage of the maximum power supply capacity of the main transformer reduced at time (t+1) due to the ADNCPS cyber attack, relative to the total power supply value at the previous time t. This indicates the probability of a failure in the main transformer P. This represents the power reduction of the system when the main transformer p exits ADNCPS at time (t+1); M represents the number of main transformers that will not exit operation due to fault after a network attack on ADNCPS. This represents the total power of ADNCPS at time (t+1); ADNCPS safety index P2 includes voltage over-limit severity P21 and load loss severity P22. The voltage over-limit severity P21 is expressed as follows: （5） In equation (5), LV represents the voltage offset value of ADNCPS at time t. This represents the minimum value of the ADNCPS voltage at time t; The severity of load loss P22 in ADNCPS at time t is expressed as: （6） In equation (6), LD represents the load loss of ADNCPS at time t; This represents the load value of load node j on the faulty bus a after ADNCPS suffers a network attack. This indicates the number of load nodes on bus a that experienced the fault. The load value transferred from faulty bus a to node c on normal bus b; The number of load nodes transferred to normal bus b; ADNCPS economic index P3 includes line loss severity P31, expressed as: （7） In equation (7), This represents the amount of active power transmitted in the f-th bus. This represents the power loss of the f-th line; DG output indicators P4 include DG penetration rate (P41) and the severity of DG output fluctuations (P42). Wherein, the DG penetration rate P41 is expressed as: （8） In equation (8), This represents the total output power of the DG at time t; This represents the total output power of the ADNCPS at time t. The severity of DG output fluctuation P42 is expressed as: （9） In equation (9), This represents the total output power of DG at time (t+1); This indicates that DG is in t Total output power at any given time.

2. The method for predicting the operational status of an active power distribution network cyber-physical system against network attacks as described in claim 1, characterized in that, The ADNCPS operation status migration model constructed in step S1 includes 5 operation statuses and 4 ADNCPS key status nodes. The 6 operation statuses are as follows: (1) S1: ADNCPS normal operation status; (2) S2: ADNCPS vulnerable operation status; (3) S3: ADNCPS operation status under network attack; (4) S4: ADNCPS recovery operation status; (5) S5: ADNCPS disconnection and shutdown status. The 4 ADNCPS key status nodes are as follows: (1) S3-1: ADNCPS alarm status under network attack; (2) S3-2: Status of extracting ADNCPS situation prediction index system information side and physical side index values; (3) S3-3: ADNCPS general risk status; (4) S3-4: ADNCPS alarm operation status.

3. The method for predicting the operational status of an active power distribution network cyber-physical system against network attacks as described in claim 1, characterized in that, When S7 trains the CNN-LSTM model using the constructed training data, it employs a multi-feature data reconstruction method based on the time sliding window algorithm to process the training data, specifically including: Based on the time sliding window algorithm, historical operational status prediction data is extracted every 5 minutes and mapped to a 1D time series status prediction index data group with a time step of 12; meteorological data at the same time point as the historical operational status prediction data is extracted every 30 minutes and mapped to a 1D time series meteorological data group with a time step of 12. Set time as the horizontal axis and historical operational trend forecast data and meteorological data as the vertical axis to construct... × A two-dimensional data matrix, wherein: This indicates the number of time interval steps for predicting historical operational trends. This indicates the quantity of ADNCPS forecast indicators and meteorological data at the corresponding time point.

4. The method for predicting the operational status of an active power distribution network cyber-physical system against network attacks as described in claim 3, characterized in that, S8 uses a trained CNN-LSTM model to predict the data of the indicator to be predicted, specifically including: using the trained CNN-LSTM model based on... Historical moments The correlation coefficient between the data of each feature to be extracted is used to calculate the next... The situation value of the ADNCPS situation prediction index at each time point is calculated using the following formula: (10) In equation (10), Indicates the first The future trend values ​​of the indicators to be predicted, among which: , Indicates the first The next indicator to be predicted ADNCPS operational status values ​​for a given time period Representing history The first moment Each characteristic quantity and The correlation coefficient of ADNCPS's operational status at any given time. Indicates the error value. Indicates the first The predicted value of the situation of the indicator to be predicted at time t. Indicates the first One indicator to be predicted The predicted situation at any given time. This represents the extracted feature values. Indicates the number of eigenvectors. Indicates the first One indicator to be predicted The predicted situation at any given time.

5. A system for predicting the operational status of an active power distribution network cyber-physical system in response to network attacks, characterized in that: Based on the method described in claim 1, the prediction system includes: The operational state transition model construction module is used to construct the ADNCPS operational state transition model. ADNCPS is an active distribution network cyber-physical system. The ADNCPS operational state transition model includes operational states and key ADNCPS state nodes. The operational states include ADNCPS operational states under network attacks and ADNCPS operational states without network attacks. The situation prediction indicator system establishment module is used to establish the ADNCPS situation prediction indicator system, which includes information-side indicators, physical-side indicators, and the calculation methods of each indicator. The first calculation module is used to calculate the collected historical operational data using the calculation methods of each indicator in the ADNCPS situation prediction indicator system, and the historical operational situation prediction data. The alarm threshold setting module is used to set alarm thresholds for information-side and physical-side indicators included in the ADNCPS situation prediction indicator system. The training data construction module is used to judge the historical operation status prediction data according to the set alarm threshold, and construct the historical status prediction indicators that exceed the alarm threshold as training data. The second calculation module is used to collect ADNCPS operation data in real time, and calculate the real-time collected ADNCPS operation data according to the calculation method of each indicator in the ADNCPS situation prediction indicator system to obtain the indicator data to be predicted. The model building and training module is used to build a CNN-LSTM model, train the CNN-LSTM model using the constructed training data, and obtain a trained CNN-LSTM model. The prediction index calculation module is used to predict the data of the index to be predicted using a trained CNN-LSTM model, and obtain the ADNCPS situation prediction index results. The operational status prediction module is used to predict the operational status of ADNCPS based on the results of various ADNCPS status prediction indicators using fuzzy hierarchical analysis.

Images