A Replay Attack Detection Method for Thermal Power Plants Based on System Identification and Noise Coding

Abstract

This invention discloses a replay attack detection method for thermal power plants based on system identification and noise coding. By applying the system identification principle, it utilizes the residual chi-square test based on Kalman filtering and a noise coding method to detect network attacks in the coordinated control system of a unit. By setting appropriate alarm thresholds and Gaussian noise variance, the method can meet the actual false alarm and detection rates of network attacks, achieving replay attack detection while ensuring the stable operation of the control system. It provides a means of detecting network attacks on the coordinated control system, offering a basis for identifying replay attacks targeting sensors. This invention can detect changes in residual distribution when sensors in the coordinated control system of a unit are subjected to replay attacks, determining whether a replay attack has occurred. It achieves network attack detection without affecting the normal operation of the coordinated control system and without relying on network traffic analysis methods.

Description

Technical Field

[0001] This invention belongs to the field of coordinated control technology for thermal power plant units, and in particular, it is a method for detecting replay attacks in thermal power plants based on system identification and noise coding. Background Technology

[0002] With the development of information and communication technology, industrial control systems widely use computer and network communication technologies to improve control levels, enabling power plants to develop into cyber-physical systems that can achieve real-time perception, dynamic control and information services integration. At the same time, this has also brought many network security issues to power plants.

[0003] To achieve steam pressure and load control, the unit coordinated control system collects actual steam pressure and load data through sensors, compares it with target steam pressure and load, and uses a classic PI control algorithm to coordinate the control of the boiler and turbine, rapidly adjusting the load while maintaining minimal steam pressure fluctuations. Cyberattacks can disrupt the system's closed-loop control, reducing system stability or even causing collapse. Existing network security monitoring algorithms are typically based on network traffic analysis, which suffers from high false positive and false negative rates. Furthermore, since malicious replay attacks targeting sensors use real historical data, which cannot be analyzed through network traffic, a new detection algorithm is needed to identify malicious replay attacks on sensors. Summary of the Invention

[0004] The purpose of this invention is to provide a replay attack detection algorithm for thermal power plants based on system identification and noise coding. This algorithm can detect changes in residual distribution when sensors in the unit's coordinated control system are subjected to a replay attack, thus determining whether a replay attack has occurred. It achieves network attack detection without affecting the normal operation of the coordinated control system and without relying on network traffic analysis methods.

[0005] The technical solution to achieve the purpose of this invention is: a method for detecting replay attacks in thermal power plants based on system identification and noise coding, the method comprising the following steps:

[0006] Step 1: For a certain operating condition of a thermal power unit, the particle swarm optimization algorithm is used to identify the multi-input multi-output (MIMO) model of the coordinated control system and a Kalman filter model is established.

[0007] Step 2: Determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements;

[0008] Step 3: Offline sharing of Gaussian noise signals between the controller side and the sensor side;

[0009] Step 4: Add Gaussian noise to the sensor feedback signal for encoding, and subtract the Gaussian noise from the controller received signal for decoding.

[0010] Step 5: The residual signal is formed by combining the Kalman filter prior estimation result with the decoding result in step 4;

[0011] Step 6: Construct a detection signal based on the residual signal and compare it with the alarm threshold in Step 2. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

[0012] Furthermore, in step 1, the multi-input multi-output (MIMO) model of the coordinated control system is a transfer function with unknown parameters defined according to the thermal process, with boiler fuel quantity command and turbine valve opening command as inputs, and boiler main steam pressure and unit output power as outputs.

[0013] Furthermore, step 1 employs the particle swarm optimization algorithm to identify the multi-input multi-output (MIMO) model of the coordinated control system, specifically including:

[0014] The following two fitness functions are used to identify the multi-input multi-output (MIMO) model of the coordinated control system:

[0015]

[0016]

[0017] In the formula, The fitness function represents the main steam pressure identification process; The fitness function represents the output power identification process; , , , For the system transfer function of the MIMO model, specifically: This represents the system transfer function from the valve opening command to the main steam pressure. This represents the system transfer function from the valve opening command to the unit's output power. The system transfer function representing the fuel quantity command to the main steam pressure; The system transfer function represents the process from fuel quantity command to unit output power; This represents the turbine control valve opening command at time i; This indicates the boiler fuel quantity command at time i; The system transfer function G represents the input signal. The response value; This represents the sensor measurement of the main steam pressure at time i; The summation from k1 to k2 represents the sensor measurement of the output power at time i; the summation represents the cumulative error between the predicted output of the identification model and the actual measurement during this time period.

[0018] Furthermore, the establishment of the Kalman filter model in step 1 specifically includes:

[0019] Step 1-1: Based on the identified parameters of the MIMO model, establish the system state equations:

[0020]

[0021] In the formula, Let be the m-dimensional system state vector at time k. Let be the m-dimensional system state vector at time k+1; This is the n-dimensional output vector at time k, which is the actual measurement value of the sensor; Let be the system input vector at time k, which is the system control signal at time k; A, B, and C represent the system matrix, control matrix, and observation matrix, respectively. and These represent the system noise and sensor noise at time k, respectively;

[0022] Step 1-2: Based on the system state equation, establish the Kalman filter model:

[0023]

[0024]

[0025]

[0026]

[0027]

[0028] In the formula, and Let represent the prior estimates of the system state at times k+1 and k, respectively; Let k be the posterior estimate of the system state at time k; This represents the Kalman filter gain at time k; and Let represent the prior covariance estimates at times k and k+1, respectively; Represents the posterior covariance estimate at time k; Q represents the system noise variance, i.e. R represents the observer noise variance, i.e. The superscript T indicates the transpose procedure.

[0029] Furthermore, the alarm threshold and Gaussian noise variance for each sensor determined in step 2 based on the false alarm rate and detection rate requirements are respectively... , :

[0030]

[0031]

[0032] In the formula, Obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail representing the false alarm rate. ; Also obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail end representing the detection rate. ; This represents the observer residual covariance under normal conditions; It represents the variance of the minimum Gaussian noise signal.

[0033] Furthermore, the detection signal constructed from the residual signal in step 6 is as follows:

[0034]

[0035] In the formula, t represents the size of the detection window; The signal represents the observer residual signal at time i; T represents the transpose process; for an n-dimensional measurement signal, the detection signal... It follows a chi-square distribution with nt degrees of freedom.

[0036] Compared with the prior art, the significant advantages of this invention are:

[0037] 1) Based on the system identification principle, the residual chi-square test method and noise coding method based on Kalman filtering are applied to the network attack detection of unit coordinated control system. By setting appropriate alarm thresholds and Gaussian noise variance, the actual false alarm rate and detection rate of network attacks can be met, realizing the detection of replay attacks, while ensuring the stable operation of the control system. This provides a means of detecting network attacks on coordinated control system and provides a certain basis for identifying replay attacks targeting sensors.

[0038] 2) The abnormal monitoring signals obtained by this algorithm can be used for on-site alarms when the sensors of thermal power units are subjected to replay network attacks, which can ensure the stability and safety of unit operation and has certain theoretical and engineering value.

[0039] The present invention will now be described in further detail with reference to the accompanying drawings. Attached Figure Description

[0040] Figure 1 This is a schematic diagram of the MIMO model to be identified in the thermal process of the coordinated control system according to an embodiment of the present invention.

[0041] Figure 2 The flowchart illustrates a replay attack detection method for thermal power plants based on system identification and noise coding according to an embodiment of the present invention.

[0042] Figure 3 This is a schematic diagram of a Matlab / Simulink model of a coordinated control system used for testing embodiments of the present invention.

[0043] Figure 4 The diagram shows the main steam pressure measurement signal received by the boiler controller in a scenario simulation of the replay attack detection method illustrated in the embodiment of the present invention.

[0044] Figure 5 The diagram shows the turbine controller receiving the unit output power signal in a simulation scenario of the replay attack detection method illustrated in the embodiment of the present invention.

[0045] Figure 6 The diagram shows the changes in the detection signal of the boiler sub-control system before and after being subjected to a replay attack in a scenario simulation of the replay attack detection method illustrated in the embodiment of the present invention.

[0046] Figure 7 This is a diagram showing the changes in the detection signal of the turbine sub-control system before and after a replay attack in a scenario simulation of the replay attack detection method illustrated in the embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0048] It should be noted that if the embodiments of the present invention involve descriptions such as "first" and "second," these descriptions are for descriptive purposes only and should not be construed as indicating or implying their relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined with "first" and "second" may explicitly or implicitly include at least one of those features. Furthermore, the technical solutions of the various embodiments can be combined with each other, but this must be based on the ability of those skilled in the art to implement them. When the combination of technical solutions is contradictory or impossible to implement, it should be considered that such a combination of technical solutions does not exist and is not within the scope of protection claimed by the present invention.

[0049] like Figure 1 As shown, the boiler and turbine can be simplified into a coupled, two-input, two-output model. The system input is the turbine high-pressure control valve opening. Boiler fuel quantity The system output is the emitted power. and main steam pressure . This represents the system transfer function from the valve opening command to the main steam pressure. This represents the system transfer function from the valve opening command to the unit's output power. The system transfer function representing the fuel quantity command to the main steam pressure; This represents the system transfer function from fuel quantity command to unit output power.

[0050] Increasing the valve opening releases the boiler's stored energy, resulting in a short-term increase in output power, which then gradually returns to its original level—a reverse response process. Conversely, increasing the valve opening releases the pipeline's stored energy, causing a rapid drop in main steam pressure—a self-balancing process.

[0051] Boiler combustion heat absorption is characterized by high inertia and high delay, positively impacting both power output and main steam pressure, and is a self-balancing process. Therefore, let:

[0052]

[0053]

[0054]

[0055]

[0056] In the formula, This represents the system transfer function from the valve opening command to the main steam pressure. This represents the system transfer function from the valve opening command to the unit's output power. The system transfer function representing the fuel quantity command to the main steam pressure; This represents the system transfer function from fuel quantity command to unit output power. Represents the numerator coefficients; Indicates the time coefficients; Indicates a delay phase. Indicates the delay time.

[0057] In one embodiment, combined Figure 2 This paper provides a method for detecting replay attacks in thermal power plants based on system identification and noise coding. The method includes the following steps:

[0058] Step 1: For a certain operating condition of a thermal power unit, the particle swarm optimization algorithm is used to identify the multi-input multi-output (MIMO) model of the coordinated control system and a Kalman filter model is established.

[0059] Here, the MIMO model refers to a transfer function with unknown parameters defined according to the thermal process, with boiler fuel quantity command and turbine valve opening command as inputs, and boiler main steam pressure and unit output power as outputs. The unknown parameters in the MIMO model constitute the solution position for each particle in the particle swarm optimization algorithm.

[0060] Step 2: Determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements;

[0061] Here, the false alarm rate refers to the probability that the detected signal exceeds the threshold when no attack occurs; the detection rate refers to the probability that the detected signal exceeds the threshold when a replay attack occurs. The alarm threshold is determined by the false alarm rate using a chi-square distribution table; the Gaussian noise variance is determined by the detection rate using a chi-square distribution table.

[0062] Step 3: Offline sharing of Gaussian noise signals between the controller side and the sensor side;

[0063] Step 4: Add Gaussian noise to the sensor feedback signal for encoding, and subtract the Gaussian noise from the controller received signal for decoding.

[0064] Here, encoding and decoding serve two purposes: first, to keep the noise distribution of the feedback signal unchanged during normal operation; and second, to change the noise distribution of the feedback signal when a replay attack occurs.

[0065] Step 5: The residual signal is formed by combining the Kalman filter prior estimation result with the decoding result in step 4;

[0066] Step 6: Construct a detection signal based on the residual signal and compare it with the alarm threshold in Step 2. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

[0067] Furthermore, in one embodiment, step 1 employs a particle swarm optimization (PSO) algorithm to identify the multi-input multi-output (MIMO) model of the coordinated control system. Here, the convergence objective of the PSO algorithm should be to minimize the deviation between the identified model response and the actual system response. The identification process of the PSO algorithm needs to be performed twice: the first time using the controller command and the boiler main steam pressure as the input and output, respectively; the second time using the controller command and the unit output power as the input and output, respectively. Specifically, it includes:

[0068] The following two fitness functions are used to identify the multi-input multi-output (MIMO) model of the coordinated control system:

[0069]

[0070]

[0071] In the formula, The fitness function represents the main steam pressure identification process; The fitness function represents the output power identification process; , , , For the system transfer function of the MIMO model, specifically: This represents the system transfer function from the valve opening command to the main steam pressure. This represents the system transfer function from the valve opening command to the unit's output power. The system transfer function representing the fuel quantity command to the main steam pressure; The system transfer function represents the process from fuel quantity command to unit output power; This represents the turbine control valve opening command at time i; This indicates the boiler fuel quantity command at time i; The system transfer function G represents the input signal. The response value; This represents the sensor measurement of the main steam pressure at time i; The summation from k1 to k2 represents the sensor measurement of the output power at time i; the summation represents the cumulative error between the predicted output of the identification model and the actual measurement during this time period.

[0072] Furthermore, in one embodiment, the establishment of the Kalman filter model in step 1 specifically includes:

[0073] Step 1-1: Based on the identified parameters of the MIMO model, establish the system state equations:

[0074]

[0075] In the formula, Let be the m-dimensional system state vector at time k. Let be the m-dimensional system state vector at time k+1. It is an m-dimensional real vector; Let n be the n-dimensional output vector at time k, which represents the actual measurement value of the sensor. It is an n-dimensional real vector; Let be the system input vector at time k, which is the system control signal at time k; A, B, and C represent the system matrix, control matrix, and observation matrix, respectively. and These represent the system noise and sensor noise at time k, respectively;

[0076] Step 1-2: Based on the system state equation, establish the Kalman filter model:

[0077]

[0078]

[0079]

[0080]

[0081]

[0082] In the formula, and Let represent the prior estimates of the system state at times k+1 and k, respectively; Let k be the posterior estimate of the system state at time k; This represents the Kalman filter gain at time k; and Let represent the prior covariance estimates at times k and k+1, respectively; Represents the posterior covariance estimate at time k; Q represents the system noise variance, i.e. R represents the observer noise variance, i.e. The superscript T indicates the transpose procedure.

[0083] Furthermore, in one embodiment, the Kalman filter gain and prior covariance estimation It will gradually converge to stable values ​​K and P, let:

[0084]

[0085] Define the observer residual at time k. for:

[0086]

[0087] In the formula: Let C be the sensor measurement signal at time k; C is the system observation matrix. Let be the prior estimate at time k.

[0088] Its variance satisfy:

[0089]

[0090] In the formula, C is the system observation matrix; P is the convergent value of the prior covariance estimate; and R is the sensor measurement noise.

[0091] When the system is subjected to a replay attack, the attacker replays data containing outdated Gaussian noise signals, and the controller's decoding is out of sync, which will cause changes in the residual covariance.

[0092]

[0093] In the formula, This represents the observer residual covariance after a replay attack. This represents the observer residual covariance under normal conditions; This represents the change in residual covariance directly caused by the asynchrony between encoding and decoding; This represents the change in residual covariance caused by the error feedback signal passing through the closed-loop control process.

[0094] The system suffers from multiple impacts when subjected to a replay attack. First, the asynchronous encoding and decoding of sensor measurements directly increases the sensor residual covariance, which is equivalent to increased sensor measurement noise, as expressed in the above formula. Partially; secondly, the increased noise error feedback signal is received by the controller, causing changes in the control signal, which in turn increases the prior estimate covariance of the system state, ultimately leading to changes in the residual covariance, expressed as in the above formula. Partially. Considering that the unit coordinated control system uses a PI controller and the controlled object has a large inertia, its response to high-frequency input signals with a Gaussian distribution and a mean of 0 is not significant. Therefore, the change in residual covariance caused by the erroneous feedback signal can be ignored, i.e., the above formula can be ignored. Therefore, we have:

[0095]

[0096] The false alarm rate decreases as the alarm threshold increases, but the corresponding attack detection rate decreases.

[0097] Gaussian coding schemes increase the detection rate under replay attacks, and the larger the variance of the coding noise, the higher the attack detection rate. For each sensor in a MIMO (Multiple-Input Multiple-Output) system, the corresponding alarm threshold that meets the conditions can be calculated. and minimum Gaussian noise signal variance :

[0098]

[0099]

[0100] In the formula, Obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail representing the false alarm rate. ; Also obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail end representing the detection rate. ; This represents the observer residual covariance under normal conditions; It represents the variance of the minimum Gaussian noise signal.

[0101] Furthermore, in one embodiment, the detection signal constructed from the residual signal in step 6 is:

[0102]

[0103] In the formula, t represents the detection window size; The signal represents the observer residual signal at time i; T represents the transpose process; for an n-dimensional measurement signal, the detection signal... It follows a chi-square distribution with n degrees of freedom; in the example, n=1.

[0104] In one embodiment, a replay attack detection system for thermal power plants based on system identification and noise coding is provided, the system comprising:

[0105] The first module is used to identify the multi-input multi-output (MIMO) model of the coordinated control system for a certain operating condition of a thermal power unit using the particle swarm optimization algorithm, and to establish a Kalman filter model.

[0106] The second module is used to determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements.

[0107] The third module is used for offline sharing of Gaussian noise signals between the controller side and the sensor side;

[0108] The fourth module is used to add Gaussian noise to the sensor feedback signal for encoding and subtract Gaussian noise from the controller received signal for decoding.

[0109] The fifth module is used to form the residual signal from the Kalman filter prior estimation results and the decoding results;

[0110] The sixth module is used to construct a detection signal based on the residual signal and compare it with the alarm threshold. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

[0111] Specific limitations regarding the system for detecting replay attacks on thermal power plants based on system identification and noise coding can be found in the limitations of the method for detecting replay attacks on thermal power plants based on system identification and noise coding mentioned above, and will not be repeated here. Each module in the aforementioned system for detecting replay attacks on thermal power plants based on system identification and noise coding can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0112] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to perform the following steps:

[0113] Step 1: For a certain operating condition of a thermal power unit, the particle swarm optimization algorithm is used to identify the multi-input multi-output (MIMO) model of the coordinated control system and a Kalman filter model is established.

[0114] Step 2: Determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements;

[0115] Step 3: Offline sharing of Gaussian noise signals between the controller side and the sensor side;

[0116] Step 4: Add Gaussian noise to the sensor feedback signal for encoding, and subtract the Gaussian noise from the controller received signal for decoding.

[0117] Step 5: The residual signal is formed by combining the Kalman filter prior estimation result with the decoding result in step 4;

[0118] Step 6: Construct a detection signal based on the residual signal and compare it with the alarm threshold in Step 2. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

[0119] For specific limitations on each step, please refer to the limitations on replay attack detection in thermal power plants based on system identification and noise coding mentioned above, which will not be repeated here.

[0120] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0121] Step 1: For a certain operating condition of a thermal power unit, the particle swarm optimization algorithm is used to identify the multi-input multi-output (MIMO) model of the coordinated control system and a Kalman filter model is established.

[0122] Step 2: Determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements;

[0123] Step 3: Offline sharing of Gaussian noise signals between the controller side and the sensor side;

[0124] Step 4: Add Gaussian noise to the sensor feedback signal for encoding, and subtract the Gaussian noise from the controller received signal for decoding.

[0125] Step 5: The residual signal is formed by combining the Kalman filter prior estimation result with the decoding result in step 4;

[0126] Step 6: Construct a detection signal based on the residual signal and compare it with the alarm threshold in Step 2. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

[0127] For specific limitations on each step, please refer to the limitations on replay attack detection in thermal power plants based on system identification and noise coding mentioned above, which will not be repeated here.

[0128] As a specific example, the invention will be further described in detail in one embodiment.

[0129] like Figure 3 As shown, the Simulink simulation model of the unit coordination control system consists of three parts:

[0130] (1) Boiler section: including controller, coal mill, water-cooled wall, delay circuit, steam drum and main steam pipeline, reflecting the energy balance inside the boiler. The controller adopts PI control, and adjusts the fuel quantity to maintain the main steam pressure when the load fluctuates.

[0131] (2) Steam turbine section: includes controller, electro-hydraulic converter, regulating valve and cylinder, which is coupled with the boiler section to output unit power. The controller adopts PI control and can realize primary and secondary frequency regulation functions.

[0132] (3) Generator and load model: The first-order inertial element is simplified to reflect the impact of changes in unit output power on grid frequency.

[0133] The variable load condition of the coordinated control system was selected, with the unit load fluctuating around 0.85, and the simulation step size was 0.1s. Next, according to... Figure 1 The model structure was used to identify the main steam pressure and power regulation process model. The sampled data was obtained from... Figure 3 Simulation results were obtained, with the noise variance of the main steam pressure sensor set to 0.1 and the noise variance of the power sensor set to... The model expression obtained from the identification is:

[0134]

[0135]

[0136]

[0137]

[0138] Scenario 1: Noise level during main steam pressure regulation is as follows: The sensor noise variance is 0.1. The system was subjected to a replay attack starting at 1500s, during which the attacker replayed the main steam pressure measurement data from 1000s to 1500s.

[0139] Assuming the system requires a false alarm rate of no more than 5% and a detection rate of no less than 90%, the alarm threshold is set to 11.07, the Gaussian noise variance is 0.297, and the detection signal window size is 5. Figure 4 This is a schematic diagram showing the changes in the measurement signal of the main steam pressure sensor before and after it was subjected to a replay attack. Figure 6The graph shows the trend of the detection signal before and after the system was attacked. As can be seen from the graph, the detection function value changed significantly before and after the attack, and clearly exceeded the threshold. When the system was running normally from 0 to 1500 seconds, the actual false alarm rate was 5.33%. When the attack occurred from 1500 to 2000 seconds, the actual detection rate was 89.18%.

[0140] Scenario 2: Noise level during unit load regulation is The sensor noise variance is The system was subjected to a replay attack starting at 1500s, during which the attacker replayed the output power measurement data from 1000s to 1500s.

[0141] Assuming the system requires a false alarm rate of no more than 5% and a detection rate of no less than 90%, the alarm threshold is set to 11.07, and the Gaussian noise variance is... The detection signal window size is 5. Figure 5 This is a schematic diagram illustrating the changes in the measurement signal of the output power sensor before and after it is subjected to a replay attack. Figure 7 The graph shows the trend of the detection signal before and after the system was attacked. As can be seen from the graph, the detection function value changed significantly before and after the attack, and clearly exceeded the threshold. When the system was running normally from 0 to 1500 seconds, the actual false alarm rate was 5.13%. When the attack occurred from 1500 to 2000 seconds, the actual detection rate was 89.02%.

[0142] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention without departing from its spirit and scope should be included within the protection scope of the present invention.

Claims

1. A method for detecting replay attacks in thermal power plants based on system identification and noise coding, characterized in that, The method includes the following steps: Step 1: For a certain operating condition of a thermal power unit, the particle swarm optimization algorithm is used to identify the multi-input multi-output (MIMO) model of the coordinated control system and a Kalman filter model is established. Step 2: Determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements; Step 3: Offline sharing of Gaussian noise signals between the controller side and the sensor side; Step 4: Add Gaussian noise to the sensor feedback signal for encoding, and subtract the Gaussian noise from the controller received signal for decoding. Step 5: The residual signal is formed by combining the Kalman filter prior estimation result with the decoding result in step 4; Step 6: Construct a detection signal based on the residual signal and compare it with the alarm threshold in Step 2. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists. In step 2, the alarm threshold and Gaussian noise variance for each sensor are determined based on the false alarm rate and detection rate requirements, respectively. , : In the formula, Obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail representing the false alarm rate. ; Also obtained from the chi-square distribution table, with degrees of freedom t, and the area at the right tail end representing the detection rate. ; This represents the observer residual covariance under normal conditions; It represents the variance of the minimum Gaussian noise signal.

2. The method for detecting replay attacks in thermal power plants based on system identification and noise coding according to claim 1, characterized in that, In step 1, the multi-input multi-output (MIMO) model of the coordinated control system is a transfer function with unknown parameters defined according to the thermal process. The boiler fuel quantity command and the turbine valve opening command are used as inputs, and the boiler main steam pressure and the unit output power are used as outputs.

3. The method for detecting replay attacks in thermal power plants based on system identification and noise coding according to claim 2, characterized in that, Step 1 uses the particle swarm optimization algorithm to identify the multi-input multi-output (MIMO) model of the coordinated control system, specifically including: The following two fitness functions are used to identify the multi-input multi-output (MIMO) model of the coordinated control system: In the formula, The fitness function represents the main steam pressure identification process; The fitness function represents the output power identification process; , , , For the system transfer function of the MIMO model, specifically: This represents the system transfer function from the valve opening command to the main steam pressure. This represents the system transfer function from the valve opening command to the unit's output power. The system transfer function representing the fuel quantity command to the main steam pressure; The system transfer function represents the process from fuel quantity command to unit output power; This represents the turbine control valve opening command at time i; This indicates the boiler fuel quantity command at time i; The system transfer function G represents the input signal. The response value; This represents the sensor measurement of the main steam pressure at time i; The summation from k1 to k2 represents the sensor measurement of the output power at time i; the summation represents the cumulative error between the predicted output of the identification model and the actual measurement during this time period.

4. The method for detecting replay attacks in thermal power plants based on system identification and noise coding according to claim 3, characterized in that, The establishment of the Kalman filter model in step 1 specifically includes: Step 1-1: Based on the identified parameters of the MIMO model, establish the system state equations: In the formula, Let be the m-dimensional system state vector at time k. Let be the m-dimensional system state vector at time k+1. It is an m-dimensional real vector; Let n be the n-dimensional output vector at time k, which represents the actual measurement value of the sensor. It is an n-dimensional real vector; Let be the system input vector at time k, which is the system control signal at time k; A, B, and C represent the system matrix, control matrix, and observation matrix, respectively. and These represent the system noise and sensor noise at time k, respectively; Step 1-2: Based on the system state equation, establish the Kalman filter model: In the formula, and Let represent the prior estimates of the system state at times k+1 and k, respectively; Let k be the posterior estimate of the system state at time k; This represents the Kalman filter gain at time k; and Let represent the prior covariance estimates at times k and k+1, respectively; Represents the posterior covariance estimate at time k; Q represents the system noise variance, i.e. R represents the observer noise variance, i.e. The superscript T indicates the transpose procedure.

5. The method for detecting replay attacks in thermal power plants based on system identification and noise coding according to claim 4, characterized in that, The detection signal constructed from the residual signal in step 6 is as follows: In the formula, t represents the size of the detection window; The signal represents the observer residual signal at time i; T represents the transpose process; for an n-dimensional measurement signal, the detection signal... It follows a chi-square distribution with nt degrees of freedom.

6. A power plant replay attack detection system based on system identification and noise coding, using the method described in any one of claims 1 to 5, characterized in that, The system includes: The first module is used to identify the multi-input multi-output (MIMO) model of the coordinated control system for a certain operating condition of a thermal power unit using the particle swarm optimization algorithm, and to establish a Kalman filter model. The second module is used to determine the alarm threshold and Gaussian noise variance based on the false alarm rate and detection rate requirements. The third module is used for offline sharing of Gaussian noise signals between the controller side and the sensor side; The fourth module is used to add Gaussian noise to the sensor feedback signal for encoding and subtract Gaussian noise from the controller received signal for decoding. The fifth module is used to form the residual signal from the Kalman filter prior estimation results and the decoding results; The sixth module is used to construct a detection signal based on the residual signal and compare it with the alarm threshold. If the detection signal is greater than the alarm threshold, it indicates that a replay attack exists; otherwise, no replay attack exists.

7. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images