Methods, devices, and computer equipment for detecting power grid fraudulent data intrusion

Abstract

This application relates to a method, apparatus, computer equipment, storage medium, and computer program product for detecting power grid spoofing. The method includes: collecting power grid data from a new power system; preprocessing the power grid data to obtain preprocessed power grid data; inputting the preprocessed power grid data into a preset power grid spoofing detection model to obtain predicted operating status values; training a neural network model based on the power grid spoofing detection model and the predicted operating status values ​​to obtain a trained neural network model; inputting the data to be detected into the trained neural network model to obtain output data; acquiring measurement data from the new power system; and confirming that the data to be detected contains spoofing data if the difference between the output data and the measurement data exceeds a preset range. Using this method can improve the detection accuracy of power grid spoofing.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a method, apparatus, computer equipment, storage medium, and computer program product for detecting power grid fraudulent data intrusion. Background Technology

[0002] With the development of smart grid technology, its complexity has gradually increased, making it vulnerable to intrusion by false data. The methods of intrusion by false data can be arbitrarily changed according to the grid's own configuration, easily bypassing network protection and causing serious consequences.

[0003] However, existing methods are easily affected by noise from new power system operation data during the detection of fake data intrusions, and the types of attack data collected are relatively limited, resulting in low accuracy in detecting fake data intrusions into the power grid. Summary of the Invention

[0004] Therefore, it is necessary to provide a method, apparatus, computer equipment, computer-readable storage medium, and computer program product for detecting power grid fraudulent data intrusion, which can improve the detection accuracy of power grid fraudulent data intrusion, in response to the above-mentioned technical problems.

[0005] Firstly, this application provides a method for detecting intrusion of false data into the power grid. The method includes:

[0006] Collect grid data from a new power system, preprocess the grid data, and obtain preprocessed grid data;

[0007] The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0008] Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model.

[0009] The data to be detected is input into the trained neural network model to obtain the output data;

[0010] If the difference between the output data and the measured data exceeds a preset range, the measurement data of the novel power system is obtained, and if the difference exceeds a preset range, it is confirmed that the data to be detected contains false data.

[0011] In one embodiment, the preprocessing of the power grid data to obtain preprocessed power grid data includes:

[0012] The number of decomposition layers required for denoising the power grid data is determined based on the number of attributes of the power grid data.

[0013] Based on the number of decomposition layers, the different types of power grid data are filtered according to a preset threshold range to obtain the filtered dataset;

[0014] Deceptive data is removed from the filtered dataset to obtain preprocessed power grid data.

[0015] In one embodiment, before inputting the preprocessed power grid data into a preset power grid spoofing data intrusion detection model to obtain the predicted operating status value, the method further includes:

[0016] Based on the measurement data of the new power system, a state estimation model of the new power system is established.

[0017] The state estimation model is used to perform state estimation calculations on the novel power system to obtain state estimation calculation data.

[0018] Based on the measurement data and the state estimation calculation data, a power grid fake data intrusion detection model is established as the preset power grid fake data intrusion detection model.

[0019] In one embodiment, the trained neural network model is trained in the following manner, including:

[0020] Obtain data samples; the data samples include data samples containing fake data intrusions and data samples not containing fake data intrusions;

[0021] The data sample is input into the preset power grid false data intrusion detection model to obtain the predicted operating status value corresponding to the data sample;

[0022] The predicted running state value corresponding to the data sample is input into the neural network model to be trained to obtain the output data corresponding to the data sample.

[0023] Based on the output data corresponding to the data sample, the model parameters of the neural network model to be trained are adjusted to obtain the trained neural network model.

[0024] In one embodiment, the method further includes:

[0025] Obtain feedback data for the trained neural network model;

[0026] Based on the feedback data, the trained neural network model is updated to obtain the updated neural network model.

[0027] The step of inputting the data to be detected into the trained neural network model to obtain output data includes:

[0028] The data to be detected is input into the updated neural network model to obtain the corresponding output data.

[0029] In one embodiment, the method further includes:

[0030] If it is confirmed that the data to be detected contains the fake data, the data type of the fake data is identified;

[0031] Based on the data type, generate corresponding early warning information for power grid false data intrusion.

[0032] Secondly, this application also provides a detection device for power grid fraudulent data intrusion. The device includes:

[0033] The data processing module is used to collect grid data from the new power system, preprocess the grid data, and obtain preprocessed grid data.

[0034] The data detection module is used to input the preprocessed power grid data into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0035] The model training module is used to train the neural network model to be trained based on the power grid fake data intrusion detection model and the operation status prediction value, so as to obtain the trained neural network model.

[0036] The data output module is used to input the data to be detected into the trained neural network model to obtain output data;

[0037] The result confirmation module is used to acquire the measurement data of the new power system, and if the difference between the output data and the measurement data exceeds a preset range, it confirms that the data to be detected contains false data.

[0038] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0039] Collect grid data from a new power system, preprocess the grid data, and obtain preprocessed grid data;

[0040] The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0041] Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model.

[0042] The data to be detected is input into the trained neural network model to obtain the output data;

[0043] If the difference between the output data and the measured data exceeds a preset range, the measurement data of the novel power system is obtained, and if the difference exceeds a preset range, it is confirmed that the data to be detected contains false data.

[0044] Fourthly, this application also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program thereon, which, when executed by a processor, performs the following steps:

[0045] Collect grid data from a new power system, preprocess the grid data, and obtain preprocessed grid data;

[0046] The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0047] Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model.

[0048] The data to be detected is input into the trained neural network model to obtain the output data;

[0049] If the difference between the output data and the measured data exceeds a preset range, the measurement data of the novel power system is obtained, and if the difference exceeds a preset range, it is confirmed that the data to be detected contains false data.

[0050] Fifthly, this application also provides a computer program product. The computer program product includes a computer program that, when executed by a processor, performs the following steps:

[0051] Collect grid data from a new power system, preprocess the grid data, and obtain preprocessed grid data;

[0052] The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0053] Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model.

[0054] The data to be detected is input into the trained neural network model to obtain the output data;

[0055] If the difference between the output data and the measured data exceeds a preset range, the measurement data of the novel power system is obtained, and if the difference exceeds a preset range, it is confirmed that the data to be detected contains false data.

[0056] The aforementioned method, apparatus, computer equipment, storage medium, and computer program product for detecting power grid spoofing intrusion involves: collecting power grid data from a new power system; preprocessing the power grid data to obtain preprocessed power grid data; inputting the preprocessed power grid data into a preset power grid spoofing intrusion detection model to obtain predicted operating status values; training a neural network model based on the power grid spoofing intrusion detection model and the predicted operating status values ​​to obtain a trained neural network model; inputting the data to be detected into the trained neural network model to obtain output data; and finally acquiring measurement data from the new power system. If the difference between the output data and the measurement data exceeds a preset range, it is confirmed that the data to be detected contains spoofing data. Preprocessing power grid data in advance effectively reduces detection time and computational complexity, while minimizing detection bias caused by spoofed data injection. The preprocessed data is then input into a pre-defined power grid spoofing intrusion detection model to obtain predicted operating states. These predicted states can then be accurately calculated through state estimation. Based on the detection model and the predicted operating states, a neural network model is trained, resulting in a fully trained model. Repeated training of the neural network algorithm ensures a qualified model. Finally, the data to be detected is input into the trained model, generating output data. This output data is compared with measured data; if the difference exceeds a preset range, spoofed data is confirmed. This detection method effectively avoids interference from noise in the operating data of new power systems, comprehensively and accurately identifies the types of power grid attacks, and thus improves the detection accuracy of spoofed data intrusion. Attached Figure Description

[0057] Figure 1 This is a flowchart illustrating a method for detecting false data intrusion into the power grid in one embodiment;

[0058] Figure 2 This is a flowchart illustrating the steps of preprocessing power grid data in one embodiment;

[0059] Figure 3 This is a flowchart illustrating the steps of training a neural network model in one embodiment;

[0060] Figure 4 This is a schematic diagram of the neural network algorithm structure in one embodiment;

[0061] Figure 5 This is a flowchart illustrating a method for detecting false data intrusion into the power grid, as described in another embodiment.

[0062] Figure 6 This is a flowchart illustrating a method for detecting false data intrusion into the power grid in yet another embodiment;

[0063] Figure 7 This is a structural block diagram of a power grid false data intrusion detection device in one embodiment;

[0064] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] In one embodiment, such as Figure 1 As shown, a method for detecting false data intrusion into the power grid is provided. This embodiment illustrates the application of this method to a terminal as an example. It is understood that this method can also be applied to a server, and to a system including both a terminal and a server, and is implemented through interaction between the terminal and the server. The terminal can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices; IoT devices can be smart speakers, smart TVs, smart air conditioners, smart vehicle devices, etc.; portable wearable devices can be smartwatches, smart bracelets, head-mounted devices, etc. The server can be a standalone server or a server cluster composed of multiple servers. In this embodiment, the method includes the following steps:

[0067] Step 101: Collect grid data of the new power system, preprocess the grid data, and obtain preprocessed grid data.

[0068] Among them, the new power system refers to a power system with the basic characteristics of being clean and low-carbon, safe and controllable, flexible and efficient, intelligent and user-friendly, and open and interactive.

[0069] Among them, power grid data refers to the data generated by the new power system in the stages of power generation, transmission, and transformation.

[0070] Specifically, the terminal receives a detection request for intrusion of false power grid data into the new power system. Based on the detection request, it collects power grid data of the new power system and performs wavelet threshold denoising processing on the collected power grid data to obtain preprocessed power grid data.

[0071] For example, the terminal receives a detection request for false data intrusion into the power grid of a new type of power system. Based on the detection request, it collects power grid data of the new power system; determines the number of decomposition layers required for denoising the power grid data and selects a threshold; processes the decomposition coefficients of the original power data; sets a threshold for false data detection; and determines whether there is a relationship between the threshold function and its residual. If there is a relationship between the threshold function and its residual, it obtains the actual operating status of the new power system, completes the data preprocessing, and obtains the preprocessed power grid data.

[0072] Step S102: Input the preprocessed power grid data into the preset power grid fake data intrusion detection model to obtain the predicted value of the operating status.

[0073] Among them, the power grid fake data intrusion detection model is a detection model used to determine whether the power grid has been intruded by fake data.

[0074] Among them, the predicted value of the operating status refers to the predicted value obtained by the operating status prediction model through state estimation.

[0075] Specifically, the terminal acquires the preprocessed power grid data, sets the power grid fake data intrusion detection model as the target model, and then inputs the preprocessed power grid data into the target model to obtain the predicted value of the power grid data's operating status.

[0076] For example, the terminal obtains the power grid data after wavelet threshold denoising, sets the power grid fake data intrusion detection model as the target model, and then inputs the power grid data after wavelet threshold denoising into the target model to obtain the predicted value of the power grid data's operating status as 2.4.

[0077] Step S103: Based on the power grid false data intrusion detection model and the predicted operating status, train the neural network model to be trained to obtain the trained neural network model.

[0078] Among them, the neural network model is a simplified model that simulates how the human brain processes information. It works by simulating a large number of interconnected processing units in an abstract form similar to neurons, such as convolutional neural network models and deep neural network models.

[0079] Specifically, the terminal acquires the neural network model to be trained, trains the neural network model based on the power grid fake data intrusion detection model and the predicted operating status, and adjusts the model parameters of the neural network model to obtain the trained neural network model.

[0080] For example, the terminal obtains the neural network model to be trained, obtains multiple operational status prediction values ​​through the power grid fake data intrusion detection model, and repeatedly trains the neural network model to be trained using the obtained operational status prediction values, thereby adjusting the weights and biases of the neural network model to obtain a qualified neural network model.

[0081] Step S104: Input the data to be detected into the trained neural network model to obtain the output data.

[0082] The data to be tested refers to the power grid data to be tested, and it is unknown whether it contains false data.

[0083] Here, output data refers to the output value of the state obtained using the neural network model.

[0084] Specifically, the terminal receives a detection request for false data intrusion into the power grid, obtains the data to be detected based on the detection request, sets the trained neural network model as the target model, inputs the data to be detected into the target model, and obtains the output data through the calculation of the target model.

[0085] Step S105: Obtain measurement data of the new power system. If the difference between the output data and the measurement data exceeds the preset range, confirm that the data to be detected contains false data.

[0086] Among them, the measurement data of the new power system refers to the data collected by the power management unit, which represents real data without the addition of false values.

[0087] Specifically, the terminal acquires the output data and the measurement data of the new power system, calculates the difference between the output data and the measurement data of the new power system, and compares the calculated difference with a preset range. If the difference exceeds the preset range, it is confirmed that the data to be detected contains false data.

[0088] For example, the terminal acquires output data and measurement data of the new power system, calculates the difference between the output data and the measurement data of the new power system to be 1.2, while the preset range is 0-1; obviously, this difference exceeds the preset range, thus confirming that the data to be detected contains false data.

[0089] The aforementioned method for detecting power grid spoofing involves collecting power grid data from a new power system, preprocessing the data to obtain preprocessed power grid data, inputting the preprocessed data into a pre-defined power grid spoofing detection model to obtain predicted operating status values, training a neural network model based on the detection model and the predicted operating status values, and then inputting the data to be detected into the trained neural network model to obtain output data. Finally, measurement data from the new power system is acquired, and if the difference between the output data and the measurement data exceeds a preset range, it is confirmed that the data to be detected contains spoofing data. Preprocessing power grid data in advance effectively reduces detection time and computational complexity, while minimizing detection bias caused by spoofed data injection. The preprocessed data is then input into a pre-defined power grid spoofing intrusion detection model to obtain predicted operating states. These predicted states can then be accurately calculated through state estimation. Based on the detection model and the predicted operating states, a neural network model is trained, resulting in a fully trained model. Repeated training of the neural network algorithm ensures a qualified model. Finally, the data to be detected is input into the trained model, generating output data. This output data is compared with measured data; if the difference exceeds a preset range, spoofed data is confirmed. This detection method effectively avoids interference from noise in the operating data of new power systems, comprehensively and accurately identifies the types of power grid attacks, and thus improves the detection accuracy of spoofed data intrusion.

[0090] In one embodiment, before inputting the preprocessed power grid data into a preset power grid fake data intrusion detection model to obtain the predicted operating state value, step S102 further includes: establishing a state estimation model for the new power system based on the measurement data of the new power system; performing state estimation calculations on the new power system through the state estimation model to obtain state estimation calculation data; and establishing a power grid fake data intrusion detection model based on the measurement data and the state estimation calculation data, as a preset power grid fake data intrusion detection model.

[0091] The measurement data of the new power system refers to the data collected by the power management unit, and its vector representation is as follows: .

[0092] Among them, the state estimation model is a model used to perform state estimation calculations on new power systems. The state evaluation model expression is:

[0093]

[0094] In the formula, Y represents the energy data state vector of the new power system, R represents the measurement error vector, and G represents the Jacobian matrix of the new power system.

[0095] It should be noted that state estimation of the new power system requires calculating the minimum power system state vector. Based on the weighted least squares method, the formula for calculating the minimum state vector of the new power system is as follows:

[0096]

[0097] In the formula, W represents the weight value;

[0098] The data residual H, which is the difference between the existing and evaluated measurement vectors, is expressed as:

[0099]

[0100] The accuracy of the measurement vector can be obtained using the above formula with the help of an empirical threshold.

[0101] Given that the new type of spoofed power grid attack data already knows matrix G, and this matrix can control most of the vectors P, then the expression for the attack vector of the spoofed data is:

[0102]

[0103] Attackers continuously add erroneous measurement vectors P to the already compromised power management units, thus creating a false data injection attack. In this case, the operational state prediction model for the new power system is:

[0104]

[0105] In the formula, T represents the measurement period;

[0106] After predicting the operating state of the new power system, the error state vector can be generated, and its expression is:

[0107]

[0108] In the formula, V represents the node voltage of the new power system;

[0109] Therefore, the formula for calculating the real-time measurement error is as follows:

[0110]

[0111] If the attack vector D = G(V), then the deviation H is... D=H, and the operating status of the new power system has been attacked by false information. Based on the above prediction, and by detecting the new power system before the state occurs, the accuracy of false data intrusion detection can be enhanced.

[0112] Specifically, the terminal acquires measurement data of the new power system, analyzes and processes the measurement data, and establishes a state estimation model for the new power system. Then, it calculates the minimum power system state vector, performs state estimation calculations on the new power system using the state estimation model, and obtains state estimation calculation data. By analyzing and calculating the measurement data and state estimation calculation data, a power grid false data intrusion detection model is established.

[0113] In this embodiment, a state estimation model of a new power system is established and state estimation calculations are performed on the new power system to obtain state estimation calculation data. Then, based on the measurement data and the state estimation calculation data, a power grid false data intrusion detection model is established as the preset power grid false data intrusion detection model. Thus, relevant data is effectively utilized to accurately establish the power grid false data intrusion detection model, thereby enhancing the accuracy of false data intrusion detection.

[0114] In one embodiment, such as Figure 3 As shown, in step S103 above, the trained neural network model is obtained through the following training method, specifically including the following steps:

[0115] Step S301: Obtain data samples; the data samples include data samples containing fake data intrusions and data samples without fake data intrusions.

[0116] Step S302: Input the data sample into the preset power grid false data intrusion detection model to obtain the predicted operating status value corresponding to the data sample.

[0117] Step S303: Input the predicted running state value corresponding to the data sample into the neural network model to be trained to obtain the output data corresponding to the data sample.

[0118] Step S304: Adjust the model parameters of the neural network model to be trained based on the output data corresponding to the data samples to obtain the trained neural network model.

[0119] The data sample refers to a sample of power grid data, and it is known whether it contains false data.

[0120] The formula for calculating the result in the output layer of the neural network model is as follows:

[0121]

[0122] In the formula, Kj w represents the output value of the hidden layer in a neural network. jc b represents the weights between the output layer and the hidden layer. c This represents the bias between the output layer and the hidden layer.

[0123] Here, the model parameters of the neural network model refer to the weights and biases of the neural network model, and the formula for real-time update of the weights is:

[0124]

[0125] In the formula, w ij w represents the weights between input layer i and hidden layer j. jc x represents the weights between input layer j and hidden layer c. i The sample data is represented by M, the number of test samples is c, α represents the network parameters, and e represents the network parameters. c K represents the output value. j The output value of a hidden layer in a neural network is represented by the following formula:

[0126]

[0127] In the formula, w ij x represents the weights between input layer i and hidden layer j. i The data represents the sample data, f represents the activation function, and a represents the activation function. j Represents the bias between the input layer and the hidden layer;

[0128] The formula for calculating the real-time update of the bias is:

[0129]

[0130] In the formula, a j b represents the bias between the input layer and the hidden layer. c K represents the bias between the output layer and the hidden layer. j w represents the output value of the hidden layer in a neural network. jc The weights represent the input layer j and the hidden layer c, M is the number of detection samples, c represents the number of detection samples, and e c The output value is represented by α, and the network parameters are represented by x. i Representative sample data.

[0131] The neural network algorithm structure in the neural network model to be trained is as follows: Figure 4 As shown.

[0132] Specifically, the terminal acquires data samples of power grid data, sets the power grid fake data intrusion detection model as the target model, and then inputs the data samples into the target model for analysis and calculation to obtain multiple predicted operating status values ​​corresponding to the data samples. The obtained predicted operating status values ​​are then input into the neural network model to be trained to calculate the output data corresponding to the data samples. The output data is used to repeatedly train the neural network algorithm, and the weights and biases in the neural network model are adjusted to finally obtain a qualified neural network.

[0133] In this embodiment, by acquiring data samples, inputting the data samples into a preset power grid false data intrusion detection model, the predicted operating status value corresponding to the data sample is obtained; then, the predicted operating status value corresponding to the data sample is input into the neural network model to be trained, and the output data corresponding to the data sample is obtained; then, according to the output data corresponding to the data sample, the model parameters of the neural network model to be trained are adjusted to obtain the trained neural network model; thus, by repeatedly training the neural network algorithm and adjusting the weights and biases in the neural network model according to the actual training situation, a qualified trained neural network model is finally obtained accurately.

[0134] In one embodiment, in step S103 above, the trained neural network model is further trained in the following manner, specifically including: obtaining feedback data for the trained neural network model; updating the trained neural network model based on the feedback data to obtain an updated neural network model; wherein, inputting the data to be detected into the trained neural network model to obtain output data includes: inputting the data to be detected into the updated neural network model to obtain corresponding output data.

[0135] The feedback data of the neural network model refers to the historical output data obtained after processing by the neural network model.

[0136] Specifically, the terminal acquires and analyzes feedback data for the trained neural network model, and filters out the valid feedback data; based on the valid feedback data, it updates the model parameters of the trained neural network model to obtain the updated neural network model; and inputs the data to be detected into the updated neural network model to obtain more accurate output data.

[0137] In this embodiment, feedback data for the trained neural network model is obtained; the trained neural network model is updated based on the feedback data to obtain an updated neural network model; the data to be detected is input into the updated neural network model to obtain the corresponding output data; thus, the neural network model can be updated and corrected in real time using the latest feedback data, which is beneficial to obtaining a more accurate neural network model.

[0138] In one embodiment, such as Figure 2 As shown, in step S101 above, the power grid data is preprocessed to obtain preprocessed power grid data. Specifically, this includes the following: determining the number of decomposition layers required for power grid data denoising based on the number of attributes of the power grid data; filtering different types of power grid data based on the number of decomposition layers and a preset threshold range to obtain a filtered dataset; and deleting deceptive data from the filtered dataset to obtain preprocessed power grid data.

[0139] Among them, power grid data includes three major attributes: physical attributes, technical attributes, and value attributes; the number of decomposition layers refers to the stratification according to time scales such as milliseconds, minutes, 5 minutes, and 15 minutes; deceptive data refers to data with low reliability.

[0140] The formula for calculating the number of decomposition layers is as follows:

[0141]

[0142] In the formula, n is the number of decomposition layers required for wavelet threshold denoising, and m represents the number of new power grid data attributes.

[0143] It should be noted that during the testing process, the degree of restoration of useful information in the reconstructed power grid data after denoising is compared with that in the original data to determine the suitability of the number of decomposition layers. The main criteria for evaluating the quality of the number of decomposition layers are the signal-to-noise ratio and root mean square error of the power data. If the power data meets the two conditions of high signal-to-noise ratio and low root mean square error, the number of decomposition layers at this time can be determined to be optimal.

[0144] The formula for calculating the signal-to-noise ratio of power data is:

[0145]

[0146] The formula for calculating the root mean square error of power data is:

[0147]

[0148] In the formula, x(n) represents the original power data, x%(n) represents the power data after noise reduction, and N represents the original power dataset.

[0149] Specifically, the terminal acquires the grid data of the new power system, determines the number of decomposition layers required for grid data denoising based on the number of attributes in the grid data, sets a threshold range, processes the decomposition coefficients of the original power data, sets a false data detection threshold, and determines whether there is a relationship between the threshold function and its residual. If there is a relationship between the threshold function and its residual, the actual operating status of the new power system is obtained, and finally, data preprocessing is completed.

[0150] In this embodiment, by preprocessing the power grid data, the detection time can be effectively reduced, the computational difficulty of the detection process can be reduced, and the detection deviation caused by the injection of false data can be minimized.

[0151] In one embodiment, the method further includes the following: if it is confirmed that the data to be detected contains false data, identify the data type of the false data; and generate corresponding power grid false data intrusion warning information based on the data type.

[0152] Here, data type refers to the data types that the power grid may be vulnerable to attacks using false data.

[0153] Among them, intrusion warning information refers to warning information generated for data types that may be attacked by false data on the power grid.

[0154] Specifically, the terminal uses a trained neural network model to determine whether the data to be detected contains false data. If it is confirmed that the data to be detected contains false data, it analyzes and identifies the data type of the false data, and generates a corresponding power grid false data intrusion warning information based on the data type.

[0155] In this embodiment, when it is confirmed that there is false data in the data to be detected, the data type of the false data is identified; according to the data type, the corresponding power grid false data intrusion warning information is generated; thereby accurately obtaining power grid false data intrusion warning information for a certain data type and improving the detection efficiency of power grid false data intrusion.

[0156] In one embodiment, such as Figure 5 As shown, another method for detecting power grid spoofing intrusion is provided, which specifically includes the following steps:

[0157] Step S501: Collect grid data of the new power system; determine the number of decomposition layers required for grid data denoising based on the number of attributes of the grid data; filter different types of grid data based on the number of decomposition layers and a preset threshold range to obtain a filtered dataset; delete deceptive data from the filtered dataset to obtain preprocessed grid data.

[0158] Step S502: Based on the measurement data of the new power system, establish a state estimation model for the new power system; perform state estimation calculations on the new power system using the state estimation model to obtain state estimation calculation data; and establish a power grid false data intrusion detection model based on the measurement data and the state estimation calculation data, as a preset power grid false data intrusion detection model.

[0159] Step S503: Obtain data samples; the data samples include data samples containing false data intrusion and data samples without false data intrusion; input the data samples into the preset power grid false data intrusion detection model to obtain the predicted operating status value corresponding to the data samples.

[0160] Step S504: Input the predicted running state value corresponding to the data sample into the neural network model to be trained to obtain the output data corresponding to the data sample; adjust the model parameters of the neural network model to be trained according to the output data corresponding to the data sample to obtain the trained neural network model.

[0161] Step S505: Obtain feedback data for the trained neural network model; update the trained neural network model based on the feedback data to obtain the updated neural network model.

[0162] Step S506: Input the data to be detected into the updated neural network model to obtain the corresponding output data.

[0163] Step S507: Obtain measurement data of the new power system. If the difference between the output data and the measurement data exceeds the preset range, confirm that the data to be detected contains false data.

[0164] Step S508: If it is confirmed that the data to be detected contains the false data, identify the data type of the false data; and generate corresponding power grid false data intrusion warning information according to the data type.

[0165] The aforementioned method for detecting power grid spoofing intrusion effectively reduces detection time and computational complexity by collecting and preprocessing power grid data from the new power system, minimizing spoofing injection detection bias. A pre-defined power grid spoofing intrusion detection model is then established based on measurement and state estimation data, accurately building the model using relevant known data. The acquired data samples are input into the pre-defined model to obtain predicted operating states, allowing for accurate calculation of these predictions. These predicted operating states are then input into a neural network model to be trained, generating output data. The model parameters are adjusted based on this output data to obtain a trained neural network model, effectively training the algorithm and providing insights into the training process. In practice, the model parameters in the neural network model are adjusted to accurately obtain a qualified trained neural network model. Then, feedback data on the trained neural network model is obtained, and the model is updated based on this feedback data to obtain an updated neural network model. This update yields a more accurate neural network model. Finally, the data to be detected is input into the updated neural network model to obtain corresponding output data. Measurement data from the new power system is then acquired. If the difference between the output data and the measurement data exceeds a preset range, it is confirmed that the data to be detected contains false data. This detection method effectively avoids interference from noise in the operating data of the new power system, comprehensively and accurately grasps the data types of power grid attacks, and thus improves the detection accuracy of false data intrusion into the power grid. Furthermore, when the false data to be detected is confirmed, the data type of the false data is identified, and corresponding power grid false data intrusion warning information is generated based on the data type, which helps relevant personnel to respond to power grid false data intrusion situations efficiently and accurately.

[0166] To more clearly illustrate the method for detecting power grid spoofing intrusion provided in this application, a specific embodiment is used below to describe the method. In one embodiment, as follows... Figure 6 As shown, this application also provides another method for detecting power grid spoofing intrusion, specifically including the following steps:

[0167] Step S601: Power grid data preprocessing.

[0168] Step S602: Determine the number of decomposition layers required for denoising fake data.

[0169] Step S603: The decomposition coefficients of the original power data are processed at different scales by using a threshold selection method.

[0170] Step S604: Set the threshold for detecting false data. By comparing the relationship between the threshold function and the corresponding residual, the actual operating status of the new power system is obtained. The result is used as a diagnostic basis for detection, thus narrowing the detection range.

[0171] Step S605: Acquire and analyze the measurement data of the new power system, and establish a state estimation model for the new power system; perform state estimation calculations on the new power system through the state estimation model to obtain state estimation calculation data; and construct a power grid false data intrusion detection model based on the measurement data and the state estimation calculation data.

[0172] Step S606: Input the sample with false data intrusion and the sample without false data into the power grid false data intrusion detection model to obtain the predicted operating status values ​​of the sample with false data intrusion and the sample without false data intrusion.

[0173] Step S607: Input the predicted running state values ​​of the samples with and without false data intrusion into the neural network model to obtain the output results.

[0174] Step S608: Based on the difference between the output result and the actual value, continuously update the model parameters of the neural network model to obtain a qualified trained neural network model.

[0175] Step S609: Input the data to be detected into the trained neural network to obtain the output value.

[0176] Step S610: When the deviation between the output value and the actual threshold is large, it indicates that there is false data intrusion in the data to be detected.

[0177] The aforementioned method for detecting false data intrusion into the power grid effectively reduces detection time and computational complexity by preprocessing the collected power grid data, minimizing detection bias caused by false data injection. State estimation calculations are performed on the new power system using a state estimation model to obtain state estimation data. Based on the measurement data and state estimation data, a false data intrusion detection model is constructed, effectively utilizing relevant data to accurately establish the model and enhance the accuracy of false data intrusion detection. By inputting samples with and without false data into the model, predicted operating states for both samples are obtained, allowing for accurate calculation of the target sample's operating state through state estimation. Predicted values: The predicted operating states of samples with and without false data intrusion are input into a neural network model to obtain the output. Based on the difference between the output and the actual value, the model parameters of the neural network model are continuously updated to obtain a qualified neural network model. This allows for effective training of the neural network algorithm, and the model parameters are adjusted according to the actual training situation to accurately obtain a qualified neural network model. The data to be detected is input into the trained neural network to obtain the output value. When the deviation between the output value and the actual threshold is large, it indicates that there is false data intrusion in the data to be detected. This detection method effectively avoids the interference of noise in the operating data of new power systems, comprehensively and accurately grasps the data types of power grid attacks, and thus improves the detection accuracy of false data intrusion in the power grid.

[0178] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0179] Based on the same inventive concept, this application also provides a power grid fake data intrusion detection device for implementing the above-described power grid fake data intrusion detection method. The solution provided by this device is similar to the implementation described in the above-described method; therefore, the specific limitations in one or more power grid fake data intrusion detection device embodiments provided below can be found in the limitations of the power grid fake data intrusion detection method described above, and will not be repeated here.

[0180] In one embodiment, such as Figure 7 As shown, a detection device for power grid fraudulent data intrusion is provided, comprising: a data processing module 701, a data detection module 702, a model training module 703, a data output module 704, and a result determination module 705, wherein:

[0181] The data processing module 701 is used to collect grid data of the new power system, preprocess the grid data, and obtain preprocessed grid data.

[0182] The data detection module 702 is used to input the preprocessed power grid data into a preset power grid false data intrusion detection model to obtain the predicted value of the operating status.

[0183] The model training module 703 is used to train the neural network model to be trained based on the power grid fake data intrusion detection model and the predicted value of the operating status, so as to obtain the trained neural network model.

[0184] The data output module 704 is used to input the data to be detected into the trained neural network model to obtain the output data.

[0185] The result determination module 705 is used to acquire measurement data of the new power system and, if the difference between the output data and the measurement data exceeds a preset range, confirm that the data to be tested contains false data.

[0186] In one embodiment, the power grid fake data intrusion detection device further includes a model building module, which is used to establish a state estimation model of the new power system based on the measurement data of the new power system; perform state estimation calculation on the new power system through the state estimation model to obtain state estimation calculation data; and establish a power grid fake data intrusion detection model based on the measurement data and the state estimation calculation data, as a preset power grid fake data intrusion detection model.

[0187] In one embodiment, the model training module 703 is further configured to acquire data samples; the data samples include data samples containing false data intrusion and data samples without false data intrusion; input the data samples into a preset power grid false data intrusion detection model to obtain the predicted operating state value corresponding to the data sample; input the predicted operating state value corresponding to the data sample into the neural network model to be trained to obtain the output data corresponding to the data sample; and adjust the model parameters of the neural network model to be trained according to the output data corresponding to the data sample to obtain the trained neural network model.

[0188] In one embodiment, the model training module 703 is further configured to acquire feedback data for the trained neural network model; update the trained neural network model based on the feedback data to obtain an updated neural network model; and input the data to be detected into the updated neural network model to obtain the corresponding output data.

[0189] In one embodiment, the data processing module 701 is further configured to determine the number of decomposition layers required for denoising the power grid data based on the number of attributes of the power grid data; perform data filtering on different types of power grid data based on the number of decomposition layers and a preset threshold range to obtain a filtered dataset; and delete deceptive data from the filtered dataset to obtain preprocessed power grid data.

[0190] In one embodiment, the power grid false data intrusion detection device further includes an early warning information generation module, which is used to identify the data type of the false data when it is confirmed that the data to be detected contains false data; and generate corresponding power grid false data intrusion early warning information according to the data type.

[0191] The modules in the aforementioned power grid false data intrusion detection device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of the computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0192] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are also connected to the system bus via the input / output interfaces. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The input / output interfaces are used for exchanging information between the processor and external devices. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. When the computer program is executed by the processor, it implements a method for detecting false data intrusion into the power grid. The display unit is used to form a visually visible image and can be a display screen, a projection device, or a virtual reality imaging device. The display screen can be an LCD screen or an e-ink screen. The input device of the computer device can be a touch layer covering the display screen, or buttons, trackballs, or touchpads set on the casing of the computer device, or external keyboards, touchpads, or mice, etc.

[0193] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0194] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0195] Collect grid data from the new power system, preprocess the grid data, and obtain preprocessed grid data;

[0196] The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted value of the operating status;

[0197] Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model;

[0198] The data to be detected is input into the trained neural network model to obtain the output data;

[0199] The system acquires measurement data from a new type of power system. If the difference between the output data and the measurement data exceeds a preset range, it confirms that the data to be tested contains false data.

[0200] In one embodiment, when the processor executes the computer program, it further performs the following steps: establishing a state estimation model for the new power system based on the measurement data of the new power system; performing state estimation calculations on the new power system using the state estimation model to obtain state estimation calculation data; and establishing a power grid fake data intrusion detection model based on the measurement data and the state estimation calculation data, as a preset power grid fake data intrusion detection model.

[0201] In one embodiment, when the processor executes the computer program, it further performs the following steps: acquiring data samples; the data samples include data samples containing false data intrusion and data samples without false data intrusion; inputting the data samples into a preset power grid false data intrusion detection model to obtain the predicted operating state value corresponding to the data sample; inputting the predicted operating state value corresponding to the data sample into the neural network model to be trained to obtain the output data corresponding to the data sample; adjusting the model parameters of the neural network model to be trained according to the output data corresponding to the data sample to obtain the trained neural network model.

[0202] In one embodiment, when the processor executes the computer program, it further performs the following steps: obtaining feedback data for the trained neural network model; updating the trained neural network model based on the feedback data to obtain an updated neural network model; and inputting the data to be detected into the trained neural network model to obtain output data, including: inputting the data to be detected into the updated neural network model to obtain corresponding output data.

[0203] In one embodiment, when the processor executes the computer program, it further performs the following steps: determining the number of decomposition layers required for denoising the power grid data based on the number of attributes of the power grid data; filtering different types of power grid data based on the number of decomposition layers and a preset threshold range to obtain a filtered dataset; and deleting deceptive data from the filtered dataset to obtain preprocessed power grid data.

[0204] In one embodiment, when the processor executes the computer program, it further performs the following steps: if it is confirmed that the data to be detected contains false data, it identifies the data type of the false data; and generates corresponding power grid false data intrusion warning information based on the data type.

[0205] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0206] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0207] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0208] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0209] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0210] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for detecting false data intrusion into the power grid, characterized in that, The method includes: The process involves collecting grid data from a new type of power system, determining the number of decomposition layers required for denoising the grid data based on the number of attributes in the grid data, filtering different types of grid data based on the number of decomposition layers and a preset threshold range to obtain a filtered dataset, deleting deceptive data from the filtered dataset to obtain preprocessed grid data; the grid data includes physical attributes, technical attributes, and value attributes, with a total of three attributes. The preprocessed power grid data is input into a preset power grid fake data intrusion detection model to obtain the predicted operating status value; Based on the power grid fake data intrusion detection model and the predicted operating status, the neural network model to be trained is trained to obtain the trained neural network model. The data to be detected is input into the trained neural network model to obtain the output data; If the difference between the output data and the measured data exceeds a preset range, the measurement data of the novel power system is obtained, and if the difference exceeds a preset range, it is confirmed that the data to be detected contains false data.

2. The method according to claim 1, characterized in that, Before inputting the preprocessed power grid data into a preset power grid fake data intrusion detection model to obtain the predicted operating status value, the process also includes: Based on the measurement data of the new power system, a state estimation model of the new power system is established. The state estimation model is used to perform state estimation calculations on the novel power system to obtain state estimation calculation data. Based on the measurement data and the state estimation calculation data, a power grid fake data intrusion detection model is established as the preset power grid fake data intrusion detection model.

3. The method according to claim 1, characterized in that, The trained neural network model is obtained through training in the following ways: Obtain data samples; the data samples include data samples containing fake data intrusions and data samples not containing fake data intrusions; The data sample is input into the preset power grid false data intrusion detection model to obtain the predicted operating status value corresponding to the data sample; The predicted running state value corresponding to the data sample is input into the neural network model to be trained to obtain the output data corresponding to the data sample. Based on the output data corresponding to the data sample, the model parameters of the neural network model to be trained are adjusted to obtain the trained neural network model.

4. The method according to claim 3, characterized in that, The method further includes: Obtain feedback data for the trained neural network model; Based on the feedback data, the trained neural network model is updated to obtain the updated neural network model. The step of inputting the data to be detected into the trained neural network model to obtain output data includes: The data to be detected is input into the updated neural network model to obtain the corresponding output data.

5. The method according to any one of claims 1 to 4, characterized in that, The method further includes: If it is confirmed that the data to be detected contains the fake data, the data type of the fake data is identified; Based on the data type, generate corresponding early warning information for power grid false data intrusion.

6. A detection device for false data intrusion into the power grid, characterized in that, The device includes: The data processing module is used to collect power grid data from a new type of power system, determine the number of decomposition layers required for denoising the power grid data based on the number of attributes in the power grid data, perform data filtering on different types of power grid data based on the number of decomposition layers and a preset threshold range, obtain a filtered dataset, delete deceptive data from the filtered dataset, and obtain preprocessed power grid data; the power grid data includes physical attributes, technical attributes, and value attributes, with a total of three attributes; the data detection module is used to input the preprocessed power grid data into a preset power grid false data intrusion detection model to obtain predicted operating status values; The model training module is used to train the neural network model to be trained based on the power grid fake data intrusion detection model and the operation status prediction value, so as to obtain the trained neural network model. The data output module is used to input the data to be detected into the trained neural network model to obtain output data; The result confirmation module is used to acquire the measurement data of the new power system, and if the difference between the output data and the measurement data exceeds a preset range, it confirms that the data to be detected contains false data.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 5.

Images