Optimal defense against cyberattacks on energy metering systems

Abstract

This invention discloses an optimal defense method for cyberattacks on energy metering systems. The method includes establishing a dynamic AMI node conversion model with dynamic control coefficients; establishing a loss objective function to find the optimal defense strategy; solving the optimal defense problem to obtain an optimal defense strategy model; solving the optimal defense strategy based on the forward and backward Euler method, and using Python to build a model to obtain a numerical solution to the optimal defense problem, thereby obtaining the optimal defense method. Finding the optimal defense strategy can suppress the spread of cyberattack malware and minimize defense costs while maximizing defense effectiveness.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security protection, and in particular relates to an optimal defense method for network attacks on energy metering systems. Background Art

[0002] Advanced Metering Infrastructure (AMI) is a key component of the smart grid. With the widespread adoption of IoT and advanced communication and sensing technologies within AMI, the scale of intelligent end-point devices (smart meters and concentrators) has grown exponentially. However, security issues with these devices are also becoming increasingly apparent. On the one hand, because these devices are close to users, manufacturers prioritize low cost and ease of deployment over security. On the other hand, their open network environments and lack of regular security maintenance increase the risk of infection and control by network attacks (such as malware, worms, and DDoS attacks). Therefore, AMIs with a large number of end-point devices are highly susceptible to infection and virus spread within the system due to attacks on and infection of intelligent end-point devices with weak security protection capabilities. Once a virus spreads within the AMI system, it can take over critical nodes, paralyzing the entire system and causing security incidents such as network congestion, data unavailability, privacy breaches, and even power outages.

[0003] In recent years, the security of AMI networks has attracted widespread attention from both academia and industry, particularly the large-scale spread of network attacks (malware, worms, etc.) against AMI systems. However, most current approaches focus on physical protection, intrusion detection, and the establishment of static attack-defense game models. There is a lack of research on the propagation patterns of network attack malware and viruses, as well as on dynamic optimal strategies.

[0004] Existing AMI system network defenses rely on firewalls, intrusion detection systems, honeypots, and other methods. This approach is overly rigid and lacks optimal cost control. Although some researchers have proposed building game models for attackers and defenders to identify the optimal attack and defense strategies for both parties, this approach is limited in that, on the one hand, it only considers a finite number of games between attackers and defenders at discrete time points, ignoring the impact of time-varying and network structure-changing factors. On the other hand, it only generates static and fixed equilibrium strategies for attackers and defenders. However, in real-world scenarios, the defense strategies deployed in AMI systems require continuous adjustment to minimize costs and maximize defense effectiveness. Summary of the Invention

[0005] The purpose of the embodiments of the present invention is to provide an optimal defense method for network attacks on energy metering systems, find the optimal defense strategy to suppress the spread of network attack malware and ensure the lowest defense cost while maximizing the defense benefit.

[0006] To solve the above technical problems, the technical solution adopted by the present invention is an optimal defense method for network attacks on energy metering systems, comprising the following steps:

[0007] S1, establish an AMI node dynamic conversion model with dynamic control coefficients;

[0008] S2, establish the loss objective function and seek the optimal defense strategy;

[0009] S3, solve the optimal defense problem and obtain the optimal defense strategy model;

[0010] S4, based on the forward and backward Euler method to solve the optimal defense strategy, uses Python to build a model to obtain the numerical solution of the optimal defense problem, thereby obtaining the optimal defense method.

[0011] Furthermore, the S1 includes:

[0012] The AMI network topology is modeled as a graph consisting of N nodes and edges connecting the nodes. Each node represents a device in the AMI network, and an edge represents a communication channel connecting two nodes.

[0013] Establish a SEIR dynamic model to describe the dynamic transformation state of AMI system nodes due to network attacks;

[0014] The SEIR dynamic model conforms to the following assumptions:

[0015] (1) Every node in the AMI is vulnerable to network attacks;

[0016] (2) The total number of nodes in the AMI network is constant;

[0017] Under network attack, a dynamic conversion model of AMI nodes with dynamic control coefficients is established. The model is:

[0018]

[0019] In formula (1), β is the infection rate, ε is the probability of an infected node attacking, and μ k (t) is the dynamic infection recovery rate that changes with time, γ k (t) is the dynamic attack recovery rate that changes with time; S k (t), E k (t), I k (t) and R k (t) represents the node S with degree k k 、E k , I k and R kAt time t, the ratio of the number of people in the system, μ(t)=(μ1(t),μ2(t),...,μ n (t)) is the set of infected node recovery rates, γ(t)=(γ1(t),γ2(t),...,γ n (t)) is the set of attack node recovery rates, represents the probability of any node connecting to an infected node, where <k>=∑ k kP k is the average degree of the node, k = 1, 2, ..., n is the degree distribution of the node;

[0020] S k Represents normal but vulnerable nodes that are easily infected by network attack viruses;

[0021] E k Represents a proxy node that is infected by a virus and controlled by an attacker;

[0022] I k Represents the target node that was successfully attacked;

[0023] R k Represents the recovered node;

[0024] Define auxiliary variable vector y(t)=(S1(t),E1(t),I1(t),R1(t)...,S n (t),E n (t),I n (t),R n (t)) T , where T is the transpose;

[0025] Formula (1) is expressed in the following matrix form:

[0026]

[0027] Furthermore, the initial condition of formula (1) is:

[0028]

[0029] Define U={u(t),u min ≤μ k (t)≤u max ,γ min ≤γ k (t)≤γ max ,t∈[0,T]}, where T>0 is the termination time, U is the control / defense factor variable set of formula (1), u(t)=(μ(t),γ(t)) is the vector set composed of the infection recovery rate and attack recovery rate of each node in the system network, u min is the minimum infection recovery rate, u max is the maximum infection recovery rate, γ min is the minimum value of the attack recovery rate, γ max The maximum attack recovery rate.

[0030] Furthermore, the S2 includes: establishing a loss objective function

[0031]

[0032] Among them, defense losses The defense loss is related to the nodes in the infected and successfully attacked AMIs. The defense cost Among them A k and B k Represents the cost-effectiveness of deploying defense resources on a smart meter node and a concentrator target node;

[0033] The optimal defense problem is established as follows:

[0034]

[0035] J(u * ) is the objective function of defense cost;

[0036] The constraints of this problem are:

[0037] Furthermore, the S3 includes: first establishing a Hamiltonian function model

[0038]

[0039] Among them, λ(t) is the set vector of covariate variable combinations

[0040] λ(t)=(λ 11 (t),λ 21 (t),λ 31 (t),λ 41 (t),...λ 1k (t),λ 2k (t),λ 3k (t),λ 4k (t),....,λ 1n (t),λ 2n (t),λ 3n (t),λ 4n (t)), λ 1k (t), λ 2k (t), λ 3k (t), λ 4k (t) is the covariate variable, t = 0: T and k = 1: n; They are is the ratio of normal, infected, attacked and recovered nodes in the network that changes over time;

[0041] Based on the Pontryagin minimum principle, the Hamiltonian function model for solving the optimal defense problem (6) is:

[0042] According to the Pontryagin minimum principle, the covariate variables can be calculated by the following differential equation:

[0043]

[0044]

[0045] It meets the following two conditions:

[0046] λ 1k (T) = λ 2k (T) = λ 3k (T) = λ 4k (T)=0,k=1,2,...,n (8)

[0047]

[0048] is the covariate variable; H is the Hamiltonian function H(y(t),u(t),λ(t));

[0049] For formula (1) in the optimal defense and The solution below;

[0050] Without loss of generality, the covariate equations and optimal defenses can be calculated and The covariates satisfy the following equations:

[0051]

[0052] θ E* (t) is the probability that any node connects to an infected node, P k is the node degree distribution of the network, are the optimal defenses for infected node recovery and attack node recovery, respectively. Formula (1) in the optimal defense The solution is the density of normal nodes,

[0053] The optimal defense solution is:

[0054]

[0055] Formula (1) in the optimal defense The solution is the density of infected nodes and attack nodes;

[0056] The optimal defense strategy model of the system for the optimal defense problem is as follows:

[0057]

[0058]

[0059] Furthermore, S4 includes:

[0060] Solve the optimal defense problem by applying the forward-backward Euler algorithm to find the best defense strategy, and establish Model (12) using Python to obtain the numerical solution. The algorithm process is as follows:

[0061] First, the vector variables X and λ are respectively: X = (S1, S2, …, S n , E1, E2, …, E n , I1, I2, …, I n , R1, R2, …, R n ), λ = (λ 1k , λ 2k , λ 3k , λ 4k ). Then apply the forward-backward Euler method to the solution stage of the optimal strategy. The solution process is as follows:

[0062] 1) Input: model parameters (β, ε, μ min , μ max , γ min , γ max , A k , B k , n);

[0063] 2) Enter the forward Euler loop stage: outer loop: if 0 <= t <= T, then enter the inner loop. If 1 <= k <= n, end the inner loop. Under the condition of the outer loop 0 <= t <= T, if t < T - 1, then X k (t + 1) = X k+1 (t);

[0064] 3) Enter the backward Euler method loop stage: outer loop. If 0 <= t <= T, then enter the inner loop. If 1 <= k <= n, then use Equation (11) to solve μ​​​​​​​​​​​​​​​​​​​​​ k (t));

[0066] 5) Output (S1(t),…,S n (t),E1(t),…,E n (t),I1(t),…,I n (t),R1(t),…,R n (t)),J(u k (t)) and (μ1(t),…μ n (t),γ1(t),…γ n (t)).

[0067] The beneficial effects of the present invention are: a network attack (malware, worm virus, etc.) propagation defense strategy for the AMI system, including the establishment of a system optimal defense model and the selection of defense methods, establishing a reasonable network attack optimal defense problem model according to actual scenarios, and using optimal control theory to find the optimal defense strategy to suppress the spread of network attack malware and ensure the lowest defense cost while maximizing the defense benefit. BRIEF DESCRIPTION OF THE DRAWINGS

[0068] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0069] Figure 1 Schematic diagrams of two AMI network structures; (a) is a scale-free network and (b) is a small-world network.

[0070] Figure 2 It is a diagram of the infected node E(t) and the attacked node I(t) under different defense strategies in a scale-free network system.

[0071] Figure 3 This is the situation of infected node E(t) and attacked node I(t) under different defense strategies in a small-world network system.

[0072] Figure 4 This is a comparison diagram of the optimal defense strategy and the random defense strategy. Among them, (a) is a scale-free network and (b) is a small-world network.

[0073] Figure 5 Comparison of the optimal defense strategy and several fixed defense strategies under two network architectures. (a) is a scale-free network, and (b) is a small-world network. DETAILED DESCRIPTION

[0074] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0075] AMI complex systems can be viewed as complex networks. This paper describes and analyzes AMI systems using graph theory. Furthermore, the AMI system network can be compared to the internet. Based on the infection and propagation mechanisms of malware and viruses among intelligent terminal nodes in the system, epidemiological models are applied to study the spread of cyberattack viruses within AMI. Therefore, combining complex network theory with dynamic epidemic models, an optimal defense strategy against cyberattack malware and viruses in the heterogeneous intelligent device scenario of AMI systems is designed. This strategy not only reduces the impact of cyberattack propagation but also reduces defense costs while maximizing defense effectiveness.

[0076] The optimal defense against cyberattacks on energy metering systems involves the following steps:

[0077] The AMI network topology is modeled as a graph G consisting of N nodes and edges connecting the nodes. Each node represents a device in the AMI network, and an edge represents a communication channel connecting two nodes.

[0078] Establish a SEIR dynamic model to describe the dynamic transformation state of AMI system nodes due to network attacks;

[0079] First, combining complex network theory and infectious disease SEIR model, we assume that at any time, each node of AMI has four possible states. k 、E k , I k and R k To represent the state of a node with degree k.

[0080] S k Represents normal but vulnerable nodes that are easily infected by network attack viruses.

[0081] E k Represents a proxy node (such as a smart meter) that is infected by a virus and controlled by an attacker.

[0082] I k The target node (such as a data concentrator) that has been successfully attacked is unable to provide services and accurately send normal data to the system center.

[0083] R k Recovered nodes can recover infected and attacked nodes by updating software, upgrading firewalls or systems, and installing intrusion prevention mechanisms.

[0084] The SEIR dynamic model conforms to the following assumptions:

[0085] (1) Every node in AMI is vulnerable to network attacks.

[0086] (2) The total number of nodes in the AMI network remains unchanged.

[0087] Under network attack, a dynamic conversion model of AMI nodes with dynamic control coefficients is established. The model is:

[0088]

[0089] In formula (1), β is the infection rate (the node state is represented by S k Convert to E k ), ε is the probability of infection node attack (the node state is represented by E k Convert to I k ), μ k (t) is the dynamic infection recovery rate that changes with time (the node state is represented by E k Transform to recovery state R k ), γ k (t) is the dynamic attack recovery rate that changes with time (the node state is represented by I k Transform to recovery state R k );S k (t), E k (t), I k (t) and R k (t) represents the node S with degree k k 、E k , I k and R k At time t, the ratio of the number of people in the system, μ(t)=(μ1(t),μ2(t),...,μ n (t)) is the set of infected node recovery rates, γ(t)=(γ1(t),γ2(t),...,γ n (t)) is the set of attack node recovery rates, represents the probability of any node connecting to an infected node, where <k>=∑ k kP k is the average degree of the node, k=1,2,…,n is the degree distribution of the node.

[0090] The initial conditions of formula (1) are:

[0091]

[0092] Define U={u(t),u min ≤μ k (t)≤u max ,γ min ≤γ k (t)≤γ max ,t∈[0,T]}, where T>0 is the termination time. U is the set of defense factor variables in model (1) (i.e., formula (1)), u(t)=(μ(t),γ(t)) is the vector set composed of the infection recovery rate and attack recovery rate of each node in the system network, u min is the minimum infection recovery rate, u max is the maximum infection recovery rate, γ min is the minimum value of the attack recovery rate, γ max The maximum attack recovery rate.

[0093] Define an auxiliary variable vector y(t)=(S1(t),E1(t),I1(t),R1(t)...,S n (t),E n (t),I n (t),R n (t)) T , where T is the transpose;

[0094] Formula (1) can be expressed in the following matrix form:

[0095]

[0096] In order to find the optimal defense strategy, it is necessary to establish a loss objective function

[0097]

[0098] Among them, defense losses The defense loss is related to the nodes in the infected and successfully attacked AMIs. The defense cost Among them A k and B k Represents the cost-effectiveness of deploying defense resources on a smart meter node and a concentrator target node.

[0099] The optimal defense strategy aims to minimize defense losses and defense costs. That is, the optimal defense problem is as follows:

[0100]

[0101] J(u * ) is the objective function of defense cost;

[0102] The constraints of this problem are:

[0103] Theoretically solve the optimal defense problem, that is, formula (5), and find the optimal defense strategy model:

[0104] (1) First establish the Hamiltonian function model

[0105]

[0106] Among them, λ(t) is the set vector of covariate combinations λ(t)=(λ 11 (t),λ 21 (t),λ 31 (t),λ 41 (t),...λ 1k (t),λ 2k (t),λ 3k (t),λ 4k (t),....,λ 1n (t),λ 2n (t),λ 3n (t),λ 4n (t))λ 1k (t), λ 2k (t), λ 3k (t), λ 4k (t) is the covariate variable, t = 0: T and k = 1: N; They are is the ratio of normal, infected, attacked and recovered nodes in the network that changes over time;

[0107] Based on the Pontryagin minimum principle, the Hamiltonian function model for solving the optimal defense problem (6) is:

[0108] According to the Pontryagin minimum principle, the covariate variables can be calculated by the following differential equation:

[0109]

[0110]

[0111] It meets the following two conditions:

[0112] λ 1k (T) = λ 2k (T) = λ 3k (T) = λ 4k (T)=0,k=1,2,...,n (8)

[0113]

[0114] is the covariate variable; H is the Hamiltonian function H(y(t),u(t),λ(t));

[0115] For formula (1) in the optimal defense and The solution below;

[0116] Without loss of generality, the covariate equations and optimal defenses can be calculated and The covariates satisfy the following equations:

[0117]

[0118] θ E* (t) is the probability that any node connects to an infected node, P k is the node degree distribution of the network, are the optimal defenses for infected node recovery and attack node recovery, respectively. Formula (1) in the optimal defense The solution is the density of normal nodes,

[0119] The optimal defense solution is:

[0120]

[0121] Formula (1) in the optimal defense The solution is the density of infected nodes and attack nodes;

[0122] Combining the above discussion, we can get the optimal defense problem, i.e. the optimal defense strategy model of the system in Equation (5), as follows:

[0123]

[0124] The forward-backward Euler algorithm is applied to solve the optimal defense problem, i.e., Equation (5), to find the best defense strategy. The Python model (12) is used to obtain the numerical solution. The algorithm process is as follows:

[0125] First, define the vector variables X and λ, respectively: X=(S1,S2,…,S n ,E1,E2,…,E n ,I1,I2,…,I n , R1, R2, …, R n ), λ = (λ 1k , λ 2k , λ 3k , λ 4k ). Then, the forward and backward Euler methods are applied to the solution phase of the optimal strategy, and the solution process is as follows:

[0126] 1) Input: model parameters (β, ε, μ min , μ max , γ min , γ max , A k , B k , n);

[0127] 2) Enter the forward Euler loop phase: Outer loop: If 0 <= t <= T, enter the inner loop. If 1 <= k <= n, End the inner loop. Under the condition of the outer loop 0 <= t <= T, if t < T - 1, then X k (t + 1) = X k+1 (t);

[0128] 3) Enter the backward Euler method loop phase: Outer loop. If 0 <= t <= T, enter the inner loop. If 1 <= k <= n, Then, use equation (11) to solve for μ k-1 (t) and γ k-1 (t), and end the inner loop; Under the condition of the outer loop 0 <= t <= T, if t > 0, then λ k ]>(t - 1) = λ k-1 (t), μ k (t - 1) = μ k-1 (t), γ k (t - 1) = γ k-1 (t);

[0129] 4) Use to calculate the objective function defense cost J(u k (t));

[0130] 5) Output (S1(t), …, S n (t), E1(t), …, E n (t), I1(t), …, I n (t), R1(t), …, R n (t)), J(u k (t)) and (μ1(t), … μ n (t), γ1(t), … γ n (t)).

[0131] Numerical simulation verifies the effectiveness of the optimal defense strategy

[0132] Numerical simulation is used to verify the effectiveness of the optimal defense strategy proposed in this paper on AMI network nodes and to conduct comparative analysis. This paper defines the following four indicators: (the average density of optimal defense resources deployed by infected nodes and attack nodes) and the average value of the defense objective cost function of all N nodes (14) as well as the infected node and attack node densities E(t) and I(t) are numerically analyzed.

[0133]

[0134]

[0135] The present invention establishes two AMI network systems with different structures (such as Figure 1 The scale-free and small-world networks are good representations of the AMI network architecture. In scale-free networks, different nodes have different degrees, that is, the degree of the concentrator node is set to be greater than the degree of the smart meter node. In the small-world network, since the network can represent the smart meter network system of the P2P network and has the same degree, these two network structures can well represent the AMI network system. The schematic diagram is as follows: Figure 1 shown.

[0136] Set the initial conditions, S k (0) = 0.9, E k (0) = 0.1, I k (0) = 0, R k (0)=0;

[0137] (1) Compared with fixed defense strategy

[0138] from Figure 2 and Figure 3 As can be seen, regardless of the network structure, the proportional value of E(t) decreases over time, indicating that appropriately deploying defense resources in smart meters can protect against cyberattacks. However, for the attacked node I(t), since cyberattacks on the AMI network can infect smart meters and then spread throughout the neighborhood network, attacking the concentrator, the number of attacked nodes (data concentrators) increases as the cyberattack spreads. We can see that I(t) begins to rise sharply within 22 seconds, then gradually decreases with the implementation of the data concentrator defense strategy, becoming increasingly smaller over time, indicating that deploying appropriate defense resources can protect against cyberattacks. The trend of I(t) mirrors the defense strength of the data concentrator: both gradually increase and strengthen over time, reach a maximum, and then gradually decrease and weaken. Furthermore, in each time slot, the E(t) and I(t) values ​​under the optimal defense strategy are consistently lower than those under the fixed defense strategy, demonstrating the effectiveness of the proposed optimal defense strategy in promoting AMI defense measures against cyberattacks.

[0139] (2) Optimal defense strategy performance evaluation

[0140] In real-world situations, it is necessary to compare the performance of the actual dynamic defense strategy with the proposed optimal dynamic defense strategy. The average defense loss and cost of the invented optimal defense strategy and the actual dynamic defense strategy in 100 time periods, namely ACP(100), are compared. In the actual dynamic defense strategy, μ k (t) and γ k The values ​​of (t) are randomly assigned.

[0141] The random defense strategy was repeated 30 times to achieve a fair comparison. For the scale-free network, under the optimal defense strategy, the minimum, maximum, and average values ​​of the defense cost and loss ACP(100) were 24.77, 28.64, and 25.85, respectively, which were smaller than the values ​​under the random defense strategy (26.85, 30.52, and 27.95). For the small-world network model, under the optimal defense strategy, the minimum, maximum, and average values ​​of the defense cost and loss ACP(100) were 18.54, 19.54, and 18.90, respectively, which were significantly smaller than the values ​​under the random defense strategy (22.14, 25.44, and 22.14).

[0142] Figure 4 (a) and (b) show the comparison results of two baseline networks, where the green and red bars represent the ACP(100) values ​​of the random defense strategy and the optimal defense strategy 30 times, respectively. Figure 5 Figures (a) and (b) show that regardless of the minimum, maximum, average optimal, or random fixed (u = 0.35, r = 0.3) defense strategy, the value of ACP (100) is greater than the optimal defense strategy. Both figures prove the effectiveness of the optimal defense strategy.

[0143] Each embodiment in this specification is described in a related manner. Similar parts between the various embodiments can be referred to in conjunction with each other. Each embodiment focuses on the differences between the other embodiments. In particular, the system embodiment is generally similar to the method embodiment, so the description is relatively simple. For related parts, refer to the description of the method embodiment.

[0144] The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention are included in the scope of protection of the present invention.< / k> < / k>

Claims

1. The optimal defense method for energy metering system cyber attacks is characterized by: The following steps are involved: S1, establish an AMI node dynamic conversion model with dynamic control coefficients; S2, establish the loss objective function and seek the optimal defense strategy; S3, solve the optimal defense problem and obtain the optimal defense strategy model; S4, based on the forward and backward Euler method to solve the optimal defense strategy, using Python to build a model to obtain the numerical solution of the optimal defense problem, thereby obtaining the optimal defense method; Said S1 comprises: The AMI network topology is modeled as a graph consisting of N nodes and edges connecting the nodes. Each node represents a device in the AMI network, and an edge represents a communication channel connecting two nodes. Establish a SEIR dynamic model to describe the dynamic transformation state of AMI system nodes due to network attacks; The SEIR dynamic model conforms to the following assumptions: (1) Every node in AMI is vulnerable to network attacks; (2) The total number of nodes in the AMI network remains unchanged; Under network attack, a dynamic conversion model of AMI nodes with dynamic control coefficients is established. The model is: （1） In formula (1), is the infection rate, is the probability of an infected node attack, is the dynamic infection recovery rate that changes over time, is the dynamic attack recovery rate that changes with time; 、 、 and Respectively expressed as Node 、 、 and exist t time, the proportion of quantity in the system, is the set of infected node recovery rates, is the set of attack node recovery rates, represents the probability of any node connecting to an infected node, where is the average degree of the nodes, k = 1, 2, · · · , n, is the node degree distribution of the network; Represents normal but vulnerable nodes that are easily infected by network attack viruses; Represents a proxy node that is infected by a virus and controlled by an attacker; Represents the target node that was successfully attacked; Represents the recovered node; Define auxiliary variable vector , here T is transposed; Formula (1) is expressed in the following matrix form: （3） in, It is a vector set composed of the infection recovery rate and attack recovery rate of each node in the system network; T is the termination time.

2. The optimal defense method for network attacks on energy metering systems according to claim 1, characterized in that: The initial conditions of formula (1) are: （2） definition , where T>0 is the termination time, U is the set of defense factor variables in formula (1), is a vector set composed of the infection recovery rate and attack recovery rate of each node in the system network. is the minimum infection recovery rate, is the maximum infection recovery rate, is the minimum value of the attack recovery rate, The maximum attack recovery rate.

3. The optimal defense method for network attacks on energy metering systems according to claim 2, characterized in that: The S2 includes: establishing a loss objective function: （4） Among them, defense loss ,Defense loss is the defense cost associated with nodes in infected and successfully attacked AMIs. ,in and Represents the cost-effectiveness of deploying defense resources on a smart meter node and a concentrator target node; The optimal defense problem is established as follows: (5) is the objective function of defense cost; The constraints of this problem are: .

4. The optimal defense method for network attacks on energy metering systems according to claim 3, characterized in that: The S3 includes: first establishing a Hamiltonian function model: （6） in, is a set vector of combinations of comorphic variables: , , , , are co-state variables, t = 0: T and k = 1: n; 、 、 、 They are , , , , is the proportion of normal, infected, attacked and recovered nodes in the network that changes over time; Based on the Pontryagin minimum principle, the Hamiltonian function model for solving the optimal defense problem (6) is: According to the Pontryagin minimum principle, the covariate variables can be calculated by the following differential equation: （7） It meets the following two conditions: （8） （9） 、 、 、 is a co-variable; H is Hamiltonian function; For formula (1) in the optimal defense and The solution below; Without loss of generality, the covariate equations and optimal defenses can be calculated and ; The covariates satisfy the following equations: （10） The probability of any node connecting to an infected node, is the node degree distribution of the network, 、 are the optimal defenses for infected node recovery and attack node recovery, respectively. Formula (1) in the optimal defense 、 The solution is the density of normal nodes; The solution of optimal defense is: （11） 、 Formula (1) in the optimal defense 、 The solution is the density of infected nodes and attack nodes; The optimal defense strategy model of the system for the optimal defense problem is as follows: （12）。 5. The optimal defense method for network attacks on energy metering systems according to claim 4, characterized in that: The S4 includes: The forward-backward Euler algorithm is applied to solve the optimal defense problem to find the best defense strategy. The model (12) is established using Python to obtain the numerical solution. The algorithm process is as follows: First, define the vector variable and , respectively: , ; Then apply the forward and backward Euler method to solve the optimal strategy. The solution process is as follows: 1) Input: Model parameters ; 2) Enter the forward Euler cycle stage: outer loop: if 0 <= t <= T, then enter the inner loop. If 1 <= k <= n, , end the inner loop. Under the condition of the outer loop 0 <= t <= T, if t < T - 1, then ; 3) Enter the backward Euler loop stage: outer loop, if 0<=t<=T, then enter the inner loop, if 1<=k<=n, , and then use formula (11) to solve and , end the inner loop; in the outer loop 0<=t<=T condition, if t>0, then ; 4) Utilize Calculate the objective function defense costs; 5) Output , and .

Images