A data- and model-driven FDIA detection method for integrated energy systems

Abstract

The present invention provides a FDIA detection method for an integrated energy system based on data and model driving, and belongs to the field of integrated energy systems. The method is to realize false data intrusion detection of the integrated energy system. Under the premise of considering the decision tree algorithm and model driving in machine learning, the false data intrusion detection process based on data and model driving is established in combination with the cold and hot network of the integrated energy system, so that the integrated energy system can achieve the purpose of low missed detection rate and low false detection rate in false data intrusion detection; when performing intrusion detection based on the establishment of a decision tree machine learning algorithm, in order to solve the problem of decision tree branch reduction, an intrusion detection method for the integrated energy system based on model driving is introduced; finally, the false intrusion detection of the integrated energy system is more diverse, and the detection rate during operation is significantly improved.

Description

Technical Field

[0001] The present invention belongs to the field of integrated energy systems, and in particular relates to a FDIA detection method for integrated energy systems based on data and model driving. Background Art

[0002] An integrated energy system (IES) is a new type of energy system that integrates multiple energy sources such as coal, oil, thermal energy, electricity, biomass energy, etc. in a specific area, and uses advanced information-physical technologies and innovative thinking patterns to achieve coordinated planning, optimized scheduling, complementary advantages, and mutual response among various energy subsystems.

[0003] As more large-scale intelligent and networked devices are connected to the integrated energy grid, the ability to monitor and manage the energy grid is enhanced. However, the large-scale connection of devices to the Internet of Things increases the security risks of the energy grid: the increase in the number of intelligent devices will cause more network security vulnerabilities and increase the scope of hackers' attacks on the energy system.

[0004] Since the 21st century, many countries have experienced energy supply interruptions, trading suspensions, power outages and other incidents caused by cyber attacks. With the harm to energy systems caused by cyber attacks, how to enhance awareness, detect attacks, and resist various malicious cyber attacks has become a hot area of ​​network security for integrated energy systems in recent years. For the purpose of destruction and extortion, attackers can use security vulnerabilities to launch false data injection attacks (FDIA) and denial of service (DoS) and other network attacks, which may cause problems such as the closure of energy service companies' online services, and may even cause serious consequences such as energy supply interruptions. Therefore, network security and network attack detection are powerful means to ensure the safe and stable operation of integrated energy systems.

[0005] The most important protection technology in network security is intrusion detection. The intrusion detection system plays a vital role in the field of network security. How to detect various network attacks in a complex Internet environment is the key to intrusion detection. At present, virus attacks, vulnerability attacks, false data injection, eavesdropping attacks, denial of service attacks, etc. are the main intrusion attack methods known to target power grids and power information systems, and they are developing towards a trend of team-based combined attacks.

[0006] Compared with other network attack methods, false data attack is a serious threat to wireless sensor networks and will damage the stability of integrated energy systems. Common false data injection attack models include: scaling attack, ramp attack, pulse attack and random attack. Scaling attack is to modify the measurement value to a fixed multiple. Ramp attack is to modify the measurement value to a multiple that changes over time. Pulse attack is based on scaling attack, adding time interval pulses, that is, intermittently modifying the measurement data.

[0007] Intrusion detection methods include model-driven ones, such as state estimation techniques and variants of models based on statistical techniques, and the use of Kalman filters for measurement estimation to detect network attacks against smart grids. In addition, there are also data-driven methods for attack detection of power grids. The detection method compares the observed system events and behaviors with normal system behaviors, and identifies obvious deviations to discover network attacks. First, by collecting system data to form a data set, relevant machine learning algorithms are used to learn relevant behavior patterns. At the same time, samples are collected and compared with the obtained system behavior patterns to determine whether the sample has a huge deviation, and finally data-driven intrusion detection is achieved.

[0008] The criticism of data-driven detection methods is that they will generate more false alarms. However, as long as the intrusion detection method is reasonably configured and the detection model is updated in time according to the changes in the system dynamics behavior, the false alarm rate of anomaly detection will be greatly reduced. The detection method based on feature matching and statistical analysis of traditional false data attacks has defects such as difficulty in feature selection and poor adaptability, resulting in low accuracy of system intrusion detection and identification, and high false alarm and missed alarm rates. Therefore, based on the above problems, a false data intrusion detection mechanism for dual integrated energy systems based on data and models is proposed to overcome many shortcomings of traditional methods. Summary of the invention

[0009] In order to solve the above problems of the prior art, the present invention proposes a FDIA detection method for an integrated energy system based on data and model driving;

[0010] In the integrated energy system, various measuring devices provide a large amount of data to the control end, which also brings security issues to the energy network. Among them, false data injection attacks may have a more severe impact on the system. This method first conducts intrusion detection based on machine learning for the attack model of false data injection, and uses the decision tree algorithm in the machine learning algorithm to learn normal behavior patterns and detect network attacks. In addition, in order to solve the problem of high missed detection rate in the machine learning algorithm, a data- and model-driven integrated energy system FDIA detection method is proposed.

[0011] To this end, the present invention provides a data- and model-driven integrated energy system FDIA detection method, the method steps are as follows:

[0012] S1 Establish a machine learning classification model based on decision tree

[0013] S1.1 Establish a false data injection attack model;

[0014] S1.2 Collect multi-energy measurement data of the integrated energy system, normalize the data, and divide the data into training set and test set;

[0015] S1.3 Establish a machine learning classification model based on decision tree;

[0016] S1.4 If the judgment result is no, perform model-based intrusion detection, and if the judgment result is yes, the detection process is completed.

[0017] S2 Establish model-based intrusion detection model

[0018] S2.1 Establishing cold and hot network simulation modeling intrusion detection model

[0019] S2.2 Establishing an intrusion detection model for power grid model state estimation

[0020] Furthermore, the false data injection attack model includes: a scaling attack model, a ramp attack model, a pulse attack model and a random attack model;

[0021] The scaling attack model modifies the measured value to a multiple of the actual measured value according to the scaling attack parameter.

[0022]

[0023] In the formula, y * (τ) is the quantity measurement received by the control center after the attack, and y(τ) is the actual quantity measurement;

[0024] The ramp attack model gradually modifies the true measurement value by adding a ramp function that gradually increases or decreases over time.

[0025]

[0026] In the formula, α r is the slope attack parameter;

[0027] The pulse attack model is similar to the scaling attack model, except that the scaling attack continuously modifies the measured value, that is, it is modified during the attack time, while the pulse attack changes the measured value through time interval pulses, as shown in the following formula.

[0028]

[0029] In the formula, α p is the pulse attack parameter, n is the number of pulses, σ att is the pulse attack cycle;

[0030] The random attack model is to take a random number randomly distributed within a certain range and add it to the measurement value to achieve data tampering.

[0031]

[0032] In the formula, random(a,b) is a uniformly distributed random number with a lower bound and b upper bound.

[0033] Furthermore, the multi-energy measurement data of the integrated energy system includes a large amount of normal measurement data that has not been attacked, as well as problematic data that has been tampered with by the attack. All tampered false data are generated by one of the models in formulas (1)-(4), where X is the measurement data set of the integrated energy system, x1, x2..x n Represents different sample data:

[0034] X = [x1, x2..x n ] (9)

[0035] y i is any output of the system, where i = 1, 2, ... n, when y i 1 means no attack, y i When it is 0, it means the data has been tampered with and attacked.

[0036] Y=[y1,y2,..y n ],y∈{0,1} (10)

[0037] After the model is trained, the dataset X to be tested can be tested, and the classification result of X is Y. The dataset to be tested and its classification result satisfy the following relationship.

[0038] Y=f(X) (11)

[0039] Where f is the trained prediction function.

[0040] Furthermore, the machine learning classification model of the decision tree is based on the ID3 algorithm of machine learning to classify and discriminate the test set;

[0041] Assume that the information entropy of training set D is E(D), P represents the sample category, and k represents the number of categories. The probability of a sample appearing is |P K | / |D|, then the information entropy is as follows.

[0042]

[0043] Assume that feature C has n different values, and divide D into n subsets D1, D2, ..., D n The conditional entropy E(D|C) of feature C on training set D is as follows.

[0044]

[0045] D ik Indicates the number of samples in category P whose feature C value is i; D i Indicates the number of samples with the value i of feature C. E(D i ) is expressed as follows.

[0046]

[0047] Finally, the information gain Gain (D|C) is calculated as follows

[0048] Gain(D|C)=E(D)-E(D|C) (8)

[0049] Furthermore, the steps of the ID3 algorithm are:

[0050] Step 1. Input: data set D, feature set A, threshold V, output: decision tree T.

[0051] Step 2. If all instances in D are of the same class C k , then T is a single-node tree, and class C k as the class label for this node and return T.

[0052] Step 3. If A is an empty set, then T is a single-node tree, and the class C with the largest instance in D is k as the class label for this node and return T.

[0053] Step 4. Calculate the information gain of each feature in A for D, and select A with the largest information gain i .

[0054] Step 5. If A i The information gain is less than the threshold V, then T is a single-node tree and the class C with the largest instance in D is k as the class label for this node and return T.

[0055] Step 6. Otherwise, i For each possible value of , D is divided into several non-empty subsets D i , D i The class with the largest number of instances in is used as the class label of the node, constructs the child nodes, and returns T.

[0056] Step 7. For the i-th child node, use D i For the training set, recursively call steps 1-5 to get the subtree T i , return T i .

[0057] Furthermore, the model-based intrusion detection model includes: a FDIA detection model based on a cold and hot network model and a FDIA detection model based on power grid model state estimation.

[0058] Furthermore, the FDIA detection model based on the cold and hot network model includes: a quantity-regulated heating network node and pipeline model, a dependency model between nodes in the heating network, a water supply side parameter model, and a cooling network model; the quantity-regulated heating network node and pipeline model represents the nodes and pipelines with two matrices respectively, as shown in the following formula.

[0059] V=[v1,...,v i , ..., v I ] (12)

[0060] Where V is the node matrix, v i represents the i-th node, and I is the number of nodes.

[0061] E=[e1,...,e j , ..., e J ] (13)

[0062] Where E is the pipeline matrix, e j represents the jth pipeline, and J is the number of pipelines.

[0063] The connection relationship between nodes and pipelines is described by a node-pipeline association matrix A, as shown in formula (14).

[0064]

[0065] In the formula, a ij Represents node v i and pipe e j The corresponding relationship, when a ij When v is -1, i Yes j The starting node of ij When v is 1, i Yes j The end node of .

[0066] Dependency model between nodes in the heating network:

[0067] Construct an I*I matrix B TSTo represent the dependency relationship between nodes in the heat network, each column represents the in-degree of the current numbered node, and each row represents the out-degree of the current numbered node, as shown in formula (15).

[0068]

[0069] B TS Any point b in the matrix pq , where if b pq If b is 0, it means that node p and node q have no connection relationship or node p is the predecessor node of node q but the temperature of node p is known. pq is 1, then node p is the predecessor node of node q and the temperature of node p is unknown.

[0070] The node temperature is determined by the end temperature of the pipe flowing into it. Node c has n predecessor nodes, so the temperature of node c is.

[0071]

[0072] Where, T c is the temperature of node c, in °C, Q i is the flow rate of pipeline i, in kg / s, t oi is the end temperature of pipe i, in °C.

[0073] The pipe end temperature can be calculated based on the pipe parameters and the medium temperature at the pipe inlet, as shown in formula (17).

[0074]

[0075] Where, T e is the ambient temperature in °C, T i is the temperature of node i in °C, λ i is the thermal conductivity of pipe i, in W / (m·k), l i is the equivalent length of pipeline i, in m, C H2O is the specific heat capacity of water, which is 4.2×10 3 J / (kg·℃).

[0076] The model of the water supply side parameters

[0077] According to the above model and the calculation order obtained by topological sorting, all node temperatures can be solved, and the model for solving other water supply side parameters is as follows.

[0078] The node water supply power can be solved by formula (18).

[0079]

[0080] Where P Sis the node water supply power, in kW, and q is the node flow rate, in kg / s.

[0081] The pipe temperature drop can be solved by equation (19).

[0082] Δt=t i -t0 (19)

[0083] Where Δt is the pipe temperature drop in °C, t i is the pipe inlet temperature, t0 is the pipe end temperature, in °C. The pipe heat loss can be solved by equation (20).

[0084]

[0085] Where P L is the pipeline heat loss, in kW.

[0086] The return network structure of the heating network is exactly the same as that of the water supply network. The difference is that the heat source node in the water supply network is the heat load node of the return network, and the heat load node is the heat source node. The flow direction of all pipeline media is opposite. The return power of the load node can be calculated by formula (21), which can also be used to calculate the power consumption of the heat source node.

[0087] P B =P S -P C (twenty one)

[0088] Where P B is the node return water power, in kW, P C The power consumed by the node, in kW.

[0089] Therefore, all the parameters of the return water network can be solved according to the calculation method of the water supply network, and the steady-state simulation of the heating network is completed. For the cooling network, its model is almost the same as the heating network. Since the pipe network in the cooling network absorbs heat from the environment and the load also increases the temperature of the medium, the cooling network model has several differences from the heating network. The formula can be changed to the following formula.

[0090]

[0091] Δt=t0-t i (twenty three)

[0092] P B =P S +P C (twenty four)

[0093] Where Δt is the pipeline temperature rise parameter.

[0094] The cooling network model divides the medium in the heating network pipeline into several segments with the same medium passing time. These segments represent the amount of medium flowing into the pipeline within the same time t, and these segments are called sequences s.

[0095] Because the flow rate in the pipeline is different in the same time, the flow rate is different. A method based on the flow weight β is designed to rewrite the temperature of node i, that is, by changing T i The weight is updated to become T q .

[0096]

[0097] In the formula, v s is the instantaneous flow velocity in the pipeline s sequence period, C is any value greater than v s is a constant, and β is a weight value.

[0098] T q =βT i (26)

[0099] Therefore, the water supply temperature at the current time section can be rewritten as:

[0100]

[0101] Furthermore, the judgment criteria of the FDIA detection model based on the cold and hot network model is: by comparing the simulation results based on the measurement data with the measurement data of the medium flowing back to the energy station, when the difference between the simulation results and the measurement values ​​at the energy station is greater than a certain threshold, the system is attacked by false data injection.

[0102]

[0103] Where Y a is the simulation result of the return water temperature at the energy station, Y is the measured value of the return water temperature at the energy station, and Λ is the threshold value.

[0104] Furthermore, the steps of establishing the FDIA detection model based on the power grid model state estimation are:

[0105] S301: Let X be the state vector, which is composed of node voltage phasors. Y is the output vector, which is the measurable physical quantity, including line power, node injection power, node voltage amplitude, etc.

[0106] S302 According to the power system flow equation, Y can be expressed as a function of X:

[0107] Y=H(X) (29)

[0108] S03 Order is the measured value of Y, ε is the error, the measured value is equal to the true value plus the error, and the measurement equation is as follows:

[0109]

[0110] The significance of S304 state estimation is to determine the estimated value X' of X to achieve a certain optimality; linear least squares estimation is adopted, and the goal is to make the obtained state vector estimated value X' minimize the Euclid norm of the error vector estimated value ε';

[0111] The Euclid norm expression is as follows:

[0112]

[0113] Make the Euclid norm of ε' as small as possible, that is, find:

[0114]

[0115] Solve X' to make the above equation true, let:

[0116]

[0117] Then find the minimum value of f(X'):

[0118]

[0119] Then we get the state estimate X':

[0120]

[0121] Furthermore, the criterion of the FDIA detection model based on the power grid model state estimation is: judging by the similarity between the state estimation value X' and X, using the cosine similarity method, as shown in the following formula:

[0122]

[0123] The closer Sim(X, X') is to 1, the more similar the two values ​​are, that is, there is no attack; if the value of Sim(X, X') is not close to 1, it proves that the power grid system is under attack.

[0124] Beneficial effects of the present invention:

[0125] In order to realize false data intrusion detection in integrated energy system, this method takes into account the decision tree algorithm and model-driven in machine learning, and combines the integrated energy system to establish a false data intrusion detection process based on data and model-driven, so that the integrated energy system can achieve low missed detection rate and low false detection rate in false data intrusion detection.

[0126] In order to ensure the effective operation of false data intrusion detection in the integrated energy system and to minimize the harmful effects of network attacks on the integrated energy system, a model-driven integrated energy system intrusion detection method was introduced to solve the problem of decision tree pruning when performing intrusion detection based on the establishment of a decision tree machine learning algorithm; thus solving the problem of intrusion detection in the integrated energy system in two aspects, and ultimately making the false intrusion detection of the integrated energy system more diverse, and the detection rate during operation is significantly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0127] Figure 1 The present invention is based on the data of the integrated energy system false data intrusion detection process

[0128] Figure 2 The present invention's integrated energy system FDIA detection process based on data and model drive DETAILED DESCRIPTION

[0129] The following is a clear and complete description of the technical solutions in the embodiments of the present invention in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0130] Embodiments of the present invention:

[0131] like Figure 1-2 As shown,

[0132] S1 Establish a machine learning classification model based on decision tree

[0133] S1.1 Establishing a false data injection attack model

[0134] Common models of false data injection attacks include: scaling attack, ramp attack, pulse attack and random attack.

[0135] The scaling attack modifies the measurement value to a multiple of the actual measurement value according to the scaling attack parameters.

[0136]

[0137] In the formula, y * (τ) is the quantity measurement received by the control center after the attack, and y(τ) is the actual quantity measurement.

[0138] Ramp attack gradually modifies the true measurement value by adding a ramp function that gradually increases or decreases over time.

[0139]

[0140] In the formula, α r is the slope attack parameter.

[0141] The pulse attack model is similar to the scaling attack model, but the difference is that the scaling attack continuously modifies the measured value, that is, it will be modified during the attack time, while the pulse attack changes the measured value through time interval pulses, as shown in the following formula.

[0142]

[0143] In the formula, α p is the pulse attack parameter, n is the number of pulses, σ att is the pulse attack period.

[0144] A random attack is to take a random number that is randomly distributed within a certain range and add it to the measured value to achieve data tampering.

[0145]

[0146] Where random(a, b) is a uniformly distributed random number with a lower bound and b upper bound.

[0147] S1.2 Collect multi-energy measurement data of the integrated energy system, normalize the data, and divide the data into training set and test set;

[0148] Formula (9) is the multi-energy measurement data of the integrated energy system, including a large amount of normal measurement data that has not been attacked, and problematic data that has been tampered with by the attack. All tampered false data are generated by one of the models in formulas (1)-(4), where X is the measurement data set of the integrated energy system, x1, x2..x n Represents different sample data:

[0149] X = [x1, x2..x n ] (9)

[0150] y i is any output of the system, where i = 1, 2, ... n, when y i 1 means no attack, y i When it is 0, it means the data has been tampered with and attacked.

[0151] Y=[y1,y2,..y n ],y∈{0,1} (10)

[0152] After the model is trained, the dataset X to be tested can be tested, and the classification result of X is Y. The dataset to be tested and its classification result satisfy the following relationship.

[0153] Y=f(X) (11)

[0154] Where f is the trained prediction function.

[0155] S1.3 Establish a machine learning classification model based on decision tree;

[0156] The ID3 algorithm is an improved algorithm for decision trees. It uses information entropy and information gain as the measurement indicators for node splitting. When doing classification tasks, first calculate the information entropy of the entire training set, then calculate the empirical conditional entropy of a feature in the training set one by one, and obtain the final information gain by subtracting them. Finally, select the feature for node splitting based on the maximum information gain.

[0157] Assume that the information entropy of training set D is E(D), P represents the sample category, and k represents the number of categories. The probability of a sample appearing is |P K | / |D|, then the information entropy is as follows.

[0158]

[0159] Assume that feature C has n different values, and divide D into n subsets D1, D2, ..., D n The conditional entropy E(D|C) of feature C on training set D is as follows.

[0160]

[0161] D ik Indicates the number of samples in category P whose feature C value is i; D i Indicates the number of samples with the value i of feature C. E(D i ) is expressed as follows.

[0162]

[0163] Finally, the information gain Gain (D|C) is calculated as follows

[0164] Gain(D|C)=E(D)-E(D|C) (8)

[0165] ID3 algorithm steps:

[0166] Step 1. Input: data set D, feature set A, threshold V, output: decision tree T.

[0167] Step 2. If all instances in D are of the same class C k , then T is a single-node tree, and class C k as the class label for this node and return T.

[0168] Step 3. If A is an empty set, then T is a single-node tree, and the class C with the largest instance in D is kas the class label for this node and return T.

[0169] Step 4. Otherwise, calculate the information gain of each feature in A for D, and select A with the largest information gain i .

[0170] Step 5. If A i The information gain is less than the threshold V, then T is a single-node tree and the class C with the largest instance in D is k as the class label for this node and return T.

[0171] Step 6. Otherwise, i For each possible value of , D is divided into several non-empty subsets D i , D i The class with the largest number of instances in is used as the class label of the node, constructs the child nodes, and returns T.

[0172] Step 7. For the i-th child node, use D i For the training set, recursively call steps 1-5 to get the subtree T i , return T i .

[0173] S1.4 If the judgment result is no, perform model-based intrusion detection, and if the judgment result is yes, the detection process is completed.

[0174] Due to the diversity of attack behaviors, when the ID3 algorithm performs intrusion detection judgment on input data, false detection or even missed detection results may occur. In the face of this problem, after performing intrusion detection based on the machine learning-ID3 algorithm, a model-based intrusion detection method is adopted, including the cold and hot network simulation modeling intrusion detection method considering flow weights and the FDIA intrusion detection considering the state estimation of the power grid model, which is more accurate and more complete in judging the false data intrusion detection of the integrated energy system.

[0175] S2 Establish model-based intrusion detection model

[0176] A model-based intrusion detection model is constructed based on the machine learning classification model of the decision tree. The model includes: a FDIA detection model based on the cold and hot network model and a FDIA detection model based on the state estimation of the power grid model.

[0177] S2.1 Establishing FDIA detection model for hot and cold network model

[0178] The simulation modeling of the cold and hot network considering the flow weight is an intrusion detection model. The heating pipe network in the heat network is used as an example to illustrate the modeling process of steady-state simulation. The heating pipe network is generally divided into two heating modes: quality regulation and quantity regulation. Quality regulation refers to a regulation method in which only the water supply temperature of the network is changed at the heat source as the outdoor temperature changes, while the circulation flow of the network tends to remain unchanged. Quantity regulation is the opposite. During quantity regulation, the water supply temperature of the energy network always maintains the design temperature unchanged, and only the water supply flow is adjusted. For the quantity regulation heating network. When modeling the heat network, the devices in the network are described as nodes, and the lines are described as pipelines. The nodes and pipelines and their connection relationships constitute the topology of the heating network. The nodes and pipelines are represented by two matrices respectively, as shown in the following formula.

[0179] V=[v1,...,v i , ..., v I ] (12)

[0180] Where V is the node matrix, v i represents the i-th node, and I is the number of nodes.

[0181] E=[e1,...,e j , ..., e J ] (13)

[0182] Where E is the pipeline matrix, e j represents the jth pipeline, and J is the number of pipelines.

[0183] The connection relationship between nodes and pipelines is described by a node-pipeline association matrix A, as shown in formula (14).

[0184]

[0185] In the formula, a ij Represents node v i and pipe e j The corresponding relationship, when a ij When v is -1, i Yes j The starting node of ij When v is 1, i Yes j The end node of .

[0186] The flow direction of the medium in the heating network is from the heat source to the load, and the flow rate at the corresponding pipeline and node is a fixed value. Therefore, under the premise of determining the node calculation order through topological sorting, the variable values ​​of each node and line in the heating network can be determined through certain calculations by the heat source. The topological graph of the heating network is a directed graph, and the calculation order of the nodes is determined by topological sorting. In the heating network topology, the temperature of each node is determined by the temperature of the starting node in the pipeline. When calculating the temperature of the current node, the temperature of the starting node needs to be known to derive the calculation. These nodes are also called the predecessor nodes of the current node. The in-degree is the number of predecessor nodes with unknown temperatures, that is, if the temperatures of all predecessor nodes of the current node are known, the temperature of the current node can be calculated. The out-degree is the number of all nodes directly connected to the current node. First, construct an I*I matrix B TS To represent the dependency relationship between nodes in the heat network, each column represents the in-degree of the current numbered node, and each row represents the out-degree of the current numbered node, as shown in formula (15).

[0187]

[0188] B TS Any point b in the matrix pq , where if b pq If b is 0, it means that node p and node q have no connection relationship or node p is the predecessor node of node q but the temperature of node p is known. pq is 1, then node p is the predecessor node of node q and the temperature of node p is unknown.

[0189] When topologically sorting the heat network, since heat source nodes have no predecessor nodes, the in-degree of all heat source nodes is 0. In-degree 0 means that the current node can be calculated, and the nodes it flows to do not depend on it. Therefore, when it is determined that the in-degree of a node is 0, all elements of the row representing this node in the BTS can be set to 0, and then the next node with in-degree 0 can be found. In this way, the calculation order of all nodes in the heat network can be arranged.

[0190] The node temperature is determined by the end temperature of the pipe flowing into it. Node c has n predecessor nodes, so the temperature of node c is.

[0191]

[0192] Where, T c is the temperature of node c, in °C, Q i is the flow rate of pipeline i, in kg / s, t oi is the end temperature of pipe i, in °C.

[0193] The pipe end temperature can be calculated based on the pipe parameters and the medium temperature at the pipe inlet, as shown in formula (17).

[0194]

[0195] Where, T e is the ambient temperature in °C, T i is the temperature of node i in °C, λ i is the thermal conductivity of pipe i, in W / (m·k), l i is the equivalent length of pipeline i, in m, C H2O is the specific heat capacity of water, which is 4.2×10 3 J / (kg·℃).

[0196] According to the above model and the calculation order obtained by topological sorting, all node temperatures can be solved, and the model for solving other water supply side parameters is as follows.

[0197] The node water supply power can be solved by formula (18).

[0198]

[0199] Where P S is the node water supply power, in kW, and q is the node flow rate, in kg / s.

[0200] The pipe temperature drop can be solved by equation (19).

[0201] Δt=t i -t0 (19)

[0202] Where Δt is the pipe temperature drop in °C, t i is the pipe inlet temperature, t0 is the pipe end temperature, in °C. The pipe heat loss can be solved by equation (20).

[0203]

[0204] Where P L is the pipeline heat loss, in kW.

[0205] The return network structure of the heating network is exactly the same as that of the water supply network. The difference is that the heat source node in the water supply network is the heat load node of the return network, and the heat load node is the heat source node. The flow direction of all pipeline media is opposite. The return power of the load node can be calculated by formula (21), which can also be used to calculate the power consumption of the heat source node.

[0206] P B =P S -P C (twenty one)

[0207] Where P Bis the node return water power, in kW, P C The power consumed by the node, in kW.

[0208] Therefore, all the parameters of the return water network can be solved according to the calculation method of the water supply network, and the steady-state simulation of the heating network is completed. For the cooling network, its model is almost the same as the heating network. Since the pipe network in the cooling network absorbs heat from the environment and the load also increases the temperature of the medium, the cooling network model has several differences from the heating network. The formula can be changed to the following formula.

[0209]

[0210] Δt=t0-t i (twenty three)

[0211] P B =P S +P C (twenty four)

[0212] Where Δt is the pipeline temperature rise parameter.

[0213] In actual production, the network status changes in real time as the load energy consumption changes over time. In addition, the flow rate of the medium in the heating pipeline is slow. When the network status changes, the steady-state simulation of a single section cannot accurately describe the network information. Compared with the steady-state simulation, the steady-state simulation of the cold and hot network considering the pipeline flow weight can provide information on the changes in the pipelines and equipment in the heating network, which is used to fully reflect the operation status of the network.

[0214] With the help of the infinite segmentation idea, the medium in the heat network pipeline can be divided into several segments with the same medium passing time. These segments represent the amount of medium flowing into the pipeline within the same time t, and these segments are called sequences s.

[0215] Because the flow rate in the pipeline is different in the same time, the flow rate is different. A method based on the flow weight β is designed to rewrite the temperature of node i, that is, by changing T i The weight is updated to become T q .

[0216]

[0217] In the formula, v s is the instantaneous flow velocity in the pipeline s sequence period, C is any value greater than v s is a constant, and β is a weight value.

[0218] T q =βT i (26)

[0219] Therefore, the water supply temperature at the current time section can be rewritten as:

[0220]

[0221] The cold network can be calculated by replacing the corresponding formula as above. The criterion of the FDIA detection model of the cold and hot network model considering the flow weight is as follows:

[0222] Based on the parameters of the medium flowing back to the energy station, it can be determined whether the data on the user side has been tampered with. By comparing the simulation results based on the measured data with the measured data of the medium flowing back to the energy station, the false data injection attack can be detected more accurately. When the difference between the simulation result and the measured value at the energy station is greater than a certain threshold, the system has been attacked by false data injection.

[0223]

[0224] Where Y a is the simulation result of the return water temperature at the energy station, Y is the measured value of the return water temperature at the energy station, and Λ is the threshold value.

[0225] S2.2 Establishing FDIA detection model based on power grid model state estimation

[0226] State Estimation (SE) is a method to estimate the internal state of a system through available measurement data. Grid state estimation takes the grid model, equipment operation status and real-time data collected by the grid as input, and takes the estimated values ​​of physical quantities such as bus voltage (amplitude and phase angle), active and reactive power values ​​of lines or transformers as output to estimate the real-time operating state of the power system. Linear least squares (LS) is used for state estimation, and finally the cosine similarity method is used to identify FDIA.

[0227] The steps to establish the FDIA detection model based on power grid model state estimation are as follows:

[0228] S301: Let X be the state vector, which is composed of node voltage phasors. Y is the output vector, which is the measurable physical quantity, including line power, node injection power, node voltage amplitude, etc.

[0229] S302 According to the power system flow equation, Y can be expressed as a function of X:

[0230] Y=H(X) (29)

[0231] S03 Order is the measured value of Y, ε is the error, the measured value is equal to the true value plus the error, and the measurement equation is as follows:

[0232]

[0233] The significance of S304 state estimation is to determine the estimated value X' of X to achieve a certain optimality; linear least squares estimation is adopted, and the goal is to make the obtained state vector estimated value X' minimize the Euclid norm of the error vector estimated value ε';

[0234] The Euclid norm expression is as follows:

[0235]

[0236] Make the Euclid norm of ε' as small as possible, that is, find:

[0237]

[0238] Solve X' to make the above equation true, let:

[0239]

[0240] Then find the minimum value of f(X'):

[0241]

[0242] Then we get the state estimate X':

[0243]

[0244] The criteria for the FDIA detection model based on the power grid model state estimation are as follows:

[0245] In the detection, the similarity between the state estimation value X' and X is used to judge, and the cosine similarity method is adopted, as follows:

[0246]

[0247] The closer Sim(X,X') is to 1, the more similar the two values ​​are, that is, there is no attack; if the value of Sim(X,X') is not close to 1, it proves that the power grid system is under attack.

[0248] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A data and model driven integrated energy system FDIA detection method, characterized by: S1 establishes a machine learning classification model based on decision trees; S1.1 Establish a false data injection attack model to generate problematic data that has been tampered with by the attack, and form a data set for training the machine learning classification model; S1.2 Collect multi-energy measurement data of the integrated energy system, normalize the data, and divide the data into training set and test set; S1.3 Establish a machine learning classification model based on decision tree; S1.4 If the judgment result is no, perform model-based intrusion detection. If the judgment result is yes, the detection process is completed; S2 builds a model-based intrusion detection model; S2.1 Establish a FDIA detection model based on the hot and cold network model; S2.2 Establish the FDIA detection model for power grid model state estimation; When modeling the heating network, the devices in the network are described as nodes, the lines are described as pipelines, and the nodes and pipelines and their connection relationships constitute the topology of the heating network; Construct an I*I matrix To represent the dependency relationship between nodes in the heat network, each column represents the in-degree of the current numbered node, and each row represents the out-degree of the current numbered node: , Any point in the matrix , where if If it is 0, it means that node p and node q have no connection relationship or node p is the predecessor node of node q but the temperature of node p is known. is 1, then node p is the predecessor node of node q and the temperature of node p is unknown; The node temperature is determined by the end temperature of the pipe flowing into it. Node c has n predecessor nodes, so the temperature of node c is: , In the formula, is the temperature of node c, is the flow rate of pipe i, is the end temperature of pipe i; The heating network model is: ， ， ， Where toi is the pipe end temperature, is the ambient temperature, is the temperature of node i, is the thermal conductivity of pipe i, is the equivalent length of pipeline i, is the specific heat capacity of water; For the pipe temperature drop, is the pipe inlet temperature, is the pipe end temperature; is the node return water power, Ps is the node supply water power, is the node power consumption, q is the node traffic; The node water supply power can be solved by the following formula: In the formula, is the node water supply power, in kW, q is the node flow, in kg / s; The cooling network model is: ， ， ， In the formula, is the pipeline heating parameter; Because the flow rate in the pipeline is different in the same time, the flow rate is different. Design a method based on flow weight Rewrite node i temperature; , where is the instantaneous flow velocity in the pipeline s sequence period, C is any value greater than The constant of The water supply temperature at the current time section is: The criterion of the FDIA detection model of the cold and hot network model is: by comparing the return water temperature simulation result based on the measured data with the measured data of the medium flowing back to the energy station, when the difference between the simulation result and the measured value at the energy station is greater than a certain threshold, the system is attacked by false data injection: The measured data of the integrated energy system passes through a machine learning classification model based on decision-making power. If the intrusion is judged to be yes, the process ends. If the intrusion is judged to be no, it is necessary to pass the FDIA detection of the backbone cooling and heating network model and the FDIA detection based on the power grid model state estimation respectively.

2. The FDIA detection method for an integrated energy system based on data and model drive according to claim 1, characterized in that: The false data injection attack model includes: a scaling attack model, a ramp attack model, a pulse attack model and a random attack model; The scaling attack model modifies the measured value to a multiple of the actual measured value according to the scaling attack parameter; （1） In the formula, is the amount of data received by the control center after the attack, is the actual quantity measurement, αs is the scaling attack parameter, δ represents the time range for launching the attack, and τ is an arbitrary time node; The ramp attack model gradually modifies the true measurement value by adding a ramp function, which gradually increases or decreases over time; （2） In the formula, is the slope attack parameter; The pulse attack model is similar to the scaling attack model, except that the scaling attack modifies the measured value continuously, i.e., it is modified during the attack time, while the pulse attack modifies the measured value through time interval pulses, as shown in the following formula: （3） In the formula, is the pulse attack parameter, n is the number of pulses, is the pulse attack cycle; The random attack model is to take a random number randomly distributed within a certain range and add it to the measured value to achieve data tampering; （4） Where random(a,b) is a uniformly distributed random number with a lower bound and b upper bound.

3. The FDIA detection method for an integrated energy system based on data and model drive according to claim 1 is characterized in that: The multi-energy measurement data of the integrated energy system includes a large amount of normal measurement data that has not been attacked, and problematic data that has been tampered with by the attack; all the tampered false data are generated by one of the models in formulas (1)-(4), where X is the measurement data set of the integrated energy system, Represents different sample data: (9) Y is the system output, where For any of its outputs, when 1 means no attack. When it is 0, it means the data has been tampered with and attacked; (10) After the model is trained, the dataset X to be tested can be tested, and the classification result of X is Y. The dataset to be tested and its classification result satisfy the following relationship; （11） Where f is the trained prediction function.

4. The FDIA detection method for an integrated energy system based on data and model drive according to claim 1 is characterized in that: The machine learning classification model of the decision tree is based on the ID3 algorithm of machine learning, which classifies and distinguishes the test set; Assume that the information entropy of the training set D is E(D), P represents the sample category; k represents the number of categories; the probability of the sample appearing is | | / |D|, then the information entropy is as follows; （5） Assume that feature C has n different values, divide D into n subsets , , …, ; The conditional entropy E(D|C) of feature C on training set D is as follows; （6） Indicates the number of samples in category P whose value of feature C is i; Indicates the number of samples whose value of feature C is i; It is expressed as follows: （7） Finally, calculate the information gain as follows: （8）。 5. The FDIA detection method for an integrated energy system based on data and model drive according to claim 4 is characterized in that: The steps of the ID3 algorithm are: Step 1. Input: data set D, feature set A, threshold V, output: decision tree T; Step 2. If all instances in D are of the same class , then T is a single-node tree, and the class As the class label of the node, and return T; Step 3. If A is an empty set, then T is a single-node tree, and the class with the largest instance in D is As the class label of the node, and return T; Step 4. Calculate the information gain of each feature in A to D, and select the one with the largest information gain ; Step 5. If The information gain is less than the threshold V, then T is a single-node tree and the class with the largest instance in D is As the class label of the node, and return T; Step 6. Otherwise, For each possible value of , D is divided into several non-empty subsets ,Will The class with the largest number of instances in is used as the class label of the node, constructs the child node, and returns T; Step 7. For the i-th child node, For the training set, recursively call Step 1-5 to get the subtree ,return .

6. The FDIA detection method for an integrated energy system based on data and model drive according to claim 1 is characterized in that: The model-based intrusion detection model includes: a FDIA detection model based on a cold and hot network model and a FDIA detection model based on power grid model state estimation.

7. The FDIA detection method for an integrated energy system based on data and model drive according to claim 1 is characterized in that: The steps of establishing the FDIA detection model based on the power grid model state estimation are: S301: Let X be the state vector, which is composed of node voltage phasors; Y be the output vector, which is the measurable physical quantity, including line power, node injection power, and node voltage amplitude; S302 According to the power system flow equation, Y can be expressed as a function of X: （29） S03 Order is the measured value of Y, is the error, the measured value is equal to the true value plus the error, and the measurement equation is as follows: （30） The significance of S304 state estimation is to determine the estimated value X ’ , to achieve the best in a certain sense; using linear least squares estimation, the goal is to make the estimated value of the state vector X ’ Let the error vector estimate ’ The Euclid norm of is the smallest; The Euclid norm expression is as follows: （31） Make ’ The Euclid norm of is the smallest, that is, find: （32） Solution To make the above equation valid, let: （33） Then seek The minimum value of : （34） Then we get the state estimate of X : （35）。 8. The FDIA detection method for an integrated energy system based on data and model drive according to claim 7 is characterized in that: The criterion of the FDIA detection model based on the power grid model state estimation is: The similarity between and X is judged by the cosine similarity method, as follows: （36） The closer it is to 1, the more similar the two values ​​are, which means there is no attack. The closer the value is to 1, the more it proves that the power grid system is under attack.

Images