A load frequency control system network attack detection method and device and medium
By jointly modeling the load frequency control system and training it with a twin network, the problems of slow detection speed and time delay noise limitations were solved, enabling faster and more accurate network attack detection.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- GUANGDONG POWER GRID CO LTD
- Filing Date
- 2023-07-27
- Publication Date
- 2026-06-09
AI Technical Summary
Existing methods for detecting network attacks on load frequency control systems are slow and easily limited by communication delays and noise.
By jointly modeling exogenous attacks and scaling attacks on the load frequency control system, a dynamic model and observer are established. Combining measurement data and equipment information, a twin network is used for pre-training and retraining. A loss function is constructed to distinguish between positive and negative sample pairs. The gradient equation is used to guide the retraining direction, thereby improving the detection speed.
It achieves faster network attack detection speed, overcomes the limitations of communication latency and noise, and improves the accuracy and speed of detection.
Smart Images
Figure CN116708021B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of load frequency control technology, and in particular to a method, device and medium for detecting network attacks on load frequency control systems. Background Technology
[0002] Load frequency control is one of the most important aspects of power system operation and control, and it is also a typical application of cyber-physical power systems. In recent years, frequent cyberattacks have made the cyber-physical load frequency control system constantly vulnerable to potential cyberattacks. Furthermore, the intensity and severity of cyberattacks have been gradually increasing, resulting in poor system defense capabilities against cyberattacks.
[0003] In the area of network attack detection for load frequency control systems, existing research employs two main approaches: first, it uses statistical analysis of the inter-regional error signals of regional control errors to capture single excessively high inter-regional error signal values obtained from measurements under attack scenarios, thereby achieving attack detection. Second, it utilizes methods such as data watermarking or data clustering to analyze sampled data or control signals, thus achieving attack detection. The main problem with existing detection schemes is that most statistical analysis-based detection strategies are essentially static detection methods, resulting in slow detection speeds and susceptibility to communication latency and noise limitations. Summary of the Invention
[0004] This invention provides a method, apparatus, and medium for detecting network attacks on load frequency control systems, in order to solve the problems of slow detection speed and susceptibility to communication delays and noise in existing methods for detecting network attacks on load frequency control systems.
[0005] This invention provides a method for detecting network attacks on a load frequency control system, comprising:
[0006] A joint model is performed on exogenous attacks and scaling attacks on the load frequency control system to obtain the hazard data of the affected tie line power data. Based on the hazard data, a dynamic model and observer are established according to the measurement data and equipment information in the load frequency control system. The error formula is obtained by solving the dynamic model and observer.
[0007] The measurement data and observation data of the load frequency control system are transmitted to the twin network in the form of data pairs. The measurement data and observation data are pre-trained according to the error formula. A loss function is established by controlling the distance between the measurement data and observation data after pre-training.
[0008] The loss function is used to retrain the pre-trained data to obtain a first dataset; a first data pair that may be affected by load interference is extracted from the first dataset; if the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then the load frequency control system is determined to be under attack.
[0009] This invention, by constructing a dynamic model, fully considers the impact of communication latency and noise, overcoming the limitations imposed by these factors during subsequent network attack detection. Pre-training brings features closer together in positive sample pairs and further separates features in negative sample pairs, initially improving the ability to acquire high-dimensional features. Retraining amplifies the differences between positive and negative sample pairs, further enhancing the ability to acquire high-dimensional features and accelerating network attack detection. Compared to existing technologies, this invention offers faster detection of network attacks on load frequency control systems and is not limited by communication latency and noise.
[0010] As a preferred embodiment, a dynamic model and observer are established based on the aforementioned hazard data and measurement data and equipment information in the load frequency control system, specifically as follows:
[0011] Based on the measurement data in the load frequency control system, a regional command for the load frequency control system is generated by integration. Based on the regional command, a dynamic model of the load frequency control system is established according to the hazard data, the measurement data, and the characteristics of the control command transmission path.
[0012] An observer is established based on the tie-line power and frequency of the load frequency control system.
[0013] This preferred solution can reduce data errors in the load frequency control system through the constructed regional commands, making the dynamic model built on the basis of the regional commands more accurate. Furthermore, the dynamic model is built based on the characteristics of the transmission path of the hazard data, the measurement data in the load frequency control system, and the control command, which can fully consider the impact of communication delay and noise, and get rid of the limitations caused by communication delay and noise during subsequent network attack detection.
[0014] As a preferred embodiment, transmitting the measurement data and the observation data of the load frequency control system to the twin network in the form of data pairs further includes:
[0015] The measurement data and observation data are converted into two sets of feature vectors and then transmitted to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazardous data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is less than the distance between the feature vector of the observation data and the feature vector of the hazardous data.
[0016] This preferred solution makes the distance between the feature vector of the observed data and the feature vector of the preset normal data smaller than the distance between the feature vector of the observed data and the feature vector of the hazardous data. This allows the preset normal data and hazardous data to be well distinguished from the hazardous data through the observed data, so as to more accurately distinguish the distance between the positive and negative sample pairs in the loss function generated on the basis of the observed data.
[0017] As a preferred embodiment, the measurement data and observation data are pre-trained according to the error formula, specifically as follows:
[0018] Based on the error formula, the measurement data and observation data are analyzed according to the twin network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the twin network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. Data with high correlation are positive sample pairs, and data with low correlation are negative sample pairs.
[0019] The cluster centers of the twin network bring features closer together in the positive sample pairs and move features further apart in the negative sample pairs, wherein the features are the trend characteristics of the data in the positive and negative sample pairs as the load changes.
[0020] This preferred scheme uses pre-training to bring features closer together in positive sample pairs and move features further away from negative sample pairs, which helps to extract high-dimensional features from the data in the future, thereby improving the speed of detecting whether the load frequency control system is under network attack.
[0021] As a preferred approach, a loss function is established by controlling the distance between the measured data and the observed data after pre-training, specifically as follows:
[0022] The distance between the positive and negative sample pairs is increased by the minimum margin, and the distance between the data in the positive sample pairs is reduced by the maximum margin; based on the minimum and maximum margins, the loss function is established by combining the concentric circle model.
[0023] The loss function is:
[0024]
[0025]
[0026]
[0027] Where L is the loss function, L1 is the distance between the positive and negative sample pairs, and L2 is the distance between the positive sample pair and the cluster center. This represents the furthest normal distribution of tie-line power. The vector output from the fully FC layer of the Siamese network. C is the vector output from the fully FC layer of the Siamese network for damaged data. c Let ξ be the cluster center. min and ξ max These are the minimum and maximum margins, respectively.
[0028] As a preferred embodiment, retraining the pre-trained data using the loss function further includes:
[0029] During the retraining process, if it is determined that the distance between the positive sample pair and the negative sample pair is positive, or the distance between the positive sample pair and the cluster center is positive, the gradient equation is used to guide the direction of the retraining.
[0030] The gradient equation is:
[0031]
[0032]
[0033]
[0034] Among them, G n G c and G F The gradient equation is represented by L1, where L1 is the distance between the positive and negative sample pairs, and L2 is the distance between the positive sample pair and the cluster center. The vector output from the fully FC layer of the Siamese network. The vector output from the fully FC layer of the twin network represents the damaged data. For the furthest normal data of tie-line power, C c The cluster center is defined as [the cluster center].
[0035] This preferred scheme retrains the pre-trained data using a loss function, which amplifies the differences between positive and negative sample pairs. Furthermore, during retraining, a gradient equation is used to guide the direction of retraining, ensuring that the distance between negative and positive sample pairs is sufficiently large, even achieving effective separation of negative and positive sample pairs. The retraining and guidance of the retraining direction further enhance the ability to acquire high-dimensional features of the data based on pre-training and cluster centers, thereby accelerating the detection of network attacks.
[0036] This invention provides a network attack detection device for a load frequency control system, comprising:
[0037] The error module is used to jointly model external attacks and scaling attacks on the load frequency control system, and solve for the hazard data of the affected tie line power data; combined with the hazard data, a dynamic model and observer are established based on the measurement data and equipment information in the load frequency control system, and the error formula is obtained by solving the dynamic model and observer;
[0038] The training module is used to transmit the measurement data and observation data of the load frequency control system to the twin network in the form of data pairs, pre-train the measurement data and observation data according to the error formula, and establish a loss function by controlling the distance between the measurement data and observation data after pre-training.
[0039] The detection module is used to retrain the pre-trained data using the loss function to obtain a first dataset; extract the first data pair in the first dataset that may be affected by load interference; if it is determined that the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then it is determined that the load frequency control system is under attack.
[0040] As a preferred embodiment, the error module specifically comprises:
[0041] Based on the measurement data in the load frequency control system, a regional command for the load frequency control system is generated by integration. Based on the regional command, a dynamic model of the load frequency control system is established according to the hazard data, the measurement data, and the characteristics of the control command transmission path.
[0042] An observer is established based on the tie-line power and frequency of the load frequency control system.
[0043] As a preferred embodiment, the training module includes:
[0044] The constraint unit is used to convert the measurement data and observation data into two sets of feature vectors and then transmit them to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazardous data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is less than the distance between the feature vector of the observation data and the feature vector of the hazardous data.
[0045] The pre-training unit is used to combine the error formula and analyze the measurement data and observation data according to the twin network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the twin network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. The data with high correlation is the positive sample pair, and the data with low correlation is the negative sample pair.
[0046] The clustering centers of the Siamese network bring features closer together in the positive sample pairs and move features further apart in the negative sample pairs, wherein the features are the trend features of the data in the positive and negative sample pairs as the load changes.
[0047] The loss function construction unit is used to increase the distance between the positive and negative sample pairs by using the minimum margin and to reduce the distance between the data in the positive sample pairs by using the maximum margin; based on the minimum and maximum margins, the loss function is established by combining the concentric circle model.
[0048] The loss function is:
[0049]
[0050]
[0051]
[0052] Where L is the loss function, L1 is the distance between the positive and negative sample pairs, and L2 is the distance between the positive sample pair and the cluster center. This represents the furthest normal distribution of tie-line power. The vector output from the fully FC layer of the Siamese network. C is the vector output from the fully FC layer of the Siamese network for damaged data. c Let ξ be the cluster center. min and ξ max These are the minimum and maximum margins, respectively.
[0053] As a preferred embodiment, the detection module specifically comprises:
[0054] During the retraining process, if it is determined that the distance between the positive sample pair and the negative sample pair is positive, or the distance between the positive sample pair and the cluster center is positive, the gradient equation is used to guide the direction of the retraining.
[0055] The gradient equation is:
[0056]
[0057]
[0058]
[0059] Among them, G n G c and G F The gradient equation is represented by L1, where L1 is the distance between the positive and negative sample pairs, and L2 is the distance between the positive sample pair and the cluster center. The vector output from the fully FC layer of the Siamese network. The vector output from the fully FC layer of the twin network represents the damaged data. For the furthest normal data of tie-line power, C c The cluster center is defined as [the cluster center].
[0060] This invention provides a storage medium storing a computer program, which is invoked and executed by a computer to implement a network attack detection method for a load frequency control system as described above. Attached Figure Description
[0061] Figure 1 This is a flowchart illustrating a network attack detection method for a load frequency control system provided in an embodiment of the present invention.
[0062] Figure 2 This is a system block diagram of the twin network provided in the embodiments of the present invention;
[0063] Figure 3 This is a schematic diagram of the IEEE-39 node 10-unit power system provided in an embodiment of the present invention;
[0064] Figure 4 This is a schematic diagram of the simulation results provided in the embodiments of the present invention;
[0065] Figure 5 This is a schematic diagram of the structure of a network attack detection device for a load frequency control system provided in an embodiment of the present invention. Detailed Implementation
[0066] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0067] In the description of this application, it should be understood that the term "first" is used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Therefore, a feature defined as "first" may explicitly or implicitly include one or more of that feature.
[0068] The above are preferred embodiments of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.
[0069] Please see Figure 1 The embodiments of the present invention provide a method for detecting network attacks on a load frequency control system, including S1 to S3:
[0070] S1. Jointly model the external attacks and scaling attacks on the load frequency control system to obtain the hazard data of the affected tie line power data; combine the hazard data with the measurement data and equipment information in the load frequency control system to establish a dynamic model and observer, and solve the dynamic model and observer to obtain the error formula.
[0071] In this embodiment of the invention, S1 includes S1.1 to S1.4:
[0072] S1.1 Jointly model the external attacks and scaling attacks on the load frequency control system to obtain the hazard data of the affected tie line power data;
[0073] The hazard data is as follows:
[0074]
[0075] Among them, D p (t) represents the time-varying value of the data injected into the tie-line power measurement, K. p (t) represents the time-varying parameters of the scaling attack. This refers to the power deviation of the tie line.
[0076] S1.2 Based on the measurement data in the load frequency control system, generate the area command of the load frequency control system by integration. Based on the area command, establish a dynamic model of the load frequency control system according to the characteristics of the hazard data, measurement data and control command transmission path.
[0077] The region command is:
[0078]
[0079] Among them, K pi and K Ii These are the proportional gain and integral gain of the controller, respectively. The frequency f controlled by the load frequency control system i The data causing the equivalent active power deviation, This is harmful data.
[0080] The dynamic model is:
[0081]
[0082] y i (t)=C i x i (t)+G i ω i (t)
[0083] For the intermediate variable x i y i C i A i B i E ij and F i have:
[0084] C i =[0 0β] i 0];
[0085]
[0086]
[0087] in, and β represents the deviation of the regulating valve position and the generator output power, respectively. i Δf is the frequency deviation coefficient. i For frequency deviation, The data represents the equivalent active power deviation caused by frequency, u i (t) represents the control signal output by the control center. and D represents the deviations in tie line power and load fluctuation, respectively. i R i and M i These are the damping coefficient, speed reduction coefficient, and inertia of the synchronous motor, respectively. ij The synchronization coefficient between region i and region j of the load frequency control system. and These are the time constants of the turbine and the governor, respectively, G i For bounded measurement noise ω i The constant matrix of the distribution matrix of (t) is known, ΔA i (t) and ΔB i (t) represent intermediate variables A. i and B i The deviation.
[0088] It should be noted that x i =x i (t), using x i (t) indicates that x is to highlight i In a dynamic model system, it is a quantity that changes with time, while x is used as... i This is to simplify expression.
[0089] This embodiment can reduce the data error of the load frequency control system by constructing regional commands, making the accuracy of the dynamic model built on the basis of regional commands higher, and preventing attackers from misleading the controller by tampering with the input data of regional control deviations. Furthermore, the dynamic model is built based on the characteristics of the transmission path of the control command and the hazard data, the measurement data in the load frequency control system, and the control command transmission path. It can fully consider the impact of communication delay and noise, and get rid of the limitations caused by communication delay and noise during subsequent network attack detection.
[0090] S1.3 Establish an observer based on the tie-line power and frequency of the load frequency control system;
[0091] The observer is:
[0092]
[0093] in, This represents the state vector of the state-space model of the load frequency control system. For x i The observed value, W i T i Y i and N i This is the gain matrix that matches the dimension of the variables to be multiplied later.
[0094] S1.4. By combining the dynamic model and the observer, the error formula can be obtained by solving.
[0095] The error formula is:
[0096]
[0097] Among them, Y i =Y i1 +Y i2 Y i1 and Y i2 I is an intermediate variable in the expression. n It is an n-dimensional identity matrix, x i y i and E ij z is an intermediate variable i State vector representing the state space model of a load frequency control system Parameters before differentiation The bounded measurement noise ω represents i (t) The parameter after differentiation; u i For the control signals output by the control center, it should be noted that: u i =u i (t).
[0098] The condition for the error formula to hold true is:
[0099] Ξ i =(I n ―N i C i );
[0100] W i =(I n ―N i C i A i —Y i1 C i ;
[0101] (I n ―N i C i )F i =0;
[0102] (I n ―N i C i ) = T i ;
[0103] Y i2 =((I n ―N i C i A i —Y i1 C i )N i
[0104] Where e is the error, Ξ i For an appropriate dimension matrix (existing as an intermediate variable), (C) i A i ) is a detectable pair of matrices (this pair of matrices enables W) i The expression is satisfied), Y i and N i ΔA is the gain matrix that matches the dimension of the variables being multiplied. i (t) and ΔB i (t) represent intermediate variables A. i and B i The deviation.
[0105] S2. Transmit the measurement data and observation data of the load frequency control system to the twin network in the form of data pairs. Pre-train the measurement data and observation data according to the error formula. Establish the loss function by controlling the distance between the measurement data and observation data after pre-training.
[0106] In this embodiment of the invention, S2 includes S2.1 to S2.3:
[0107] S2.1 After converting the measurement data and observation data into two sets of feature vectors, they are transmitted to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazard data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is less than the distance between the feature vector of the observation data and the feature vector of the hazard data.
[0108] For an explanation of the embodiments of the present invention, please refer to [link / reference]. Figure 2 An embodiment of the present invention provides a system block diagram of a Siamese network, which consists of two symmetric branches with equal weights and a loss layer. Each branch consists of four fully connected (FC) layers and rectified linear units (RELU). The FC layers can map the original data to the feature space of the hidden layer. The number of elements in each FC layer is equal to the dimension of the sample data. In addition, the measured values and observed values (measured data and observed data) can be transmitted to the loss layer of the Siamese network for processing.
[0109] It should be noted that the preset normal data is obtained by loading historical power data of tie lines under different operating conditions as normal data. If the similarity between the subsequently obtained high-dimensional features and the hazardous data is greater than the preset threshold (the similarity between the high-dimensional features and the preset normal data), then it is determined that the load frequency control system has been attacked.
[0110] This embodiment uses the loss function of the loss layer to quantify the distance between data points. Since the weights of the symmetric branches of the Siamese network are equal, it can be regarded as a filter. During the training process of the Siamese network, the impact of communication latency and noise can be further reduced, resulting in more "accurate" data. By making the distance between the feature vector of the observed data and the feature vector of the preset normal data smaller than the distance between the feature vector of the observed data and the feature vector of the hazardous data, the preset normal data and hazardous data can be well distinguished from each other using the observed data. This allows for a more accurate differentiation of the distance between positive and negative sample pairs in the loss function subsequently generated based on the observed data.
[0111] S2.2. Combining the error formula, the measurement data and observation data are analyzed based on the twin network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the twin network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. Data with high correlation are positive sample pairs, and data with low correlation are negative sample pairs.
[0112] The cluster centers of the Siamese network bring features closer together in positive sample pairs and move features further apart in negative sample pairs, where the features are the trend characteristics of the data in the positive and negative sample pairs as the load changes.
[0113] The cluster centers are:
[0114]
[0115] Where M is the number of normal samples, This is the vector output from the fully FC layer of the Siamese network.
[0116] This embodiment uses pre-training to bring features closer together in positive sample pairs and move features further away from negative sample pairs, which helps to extract high-dimensional features from the data in the future, thereby improving the speed of detecting whether the load frequency control system is under network attack.
[0117] S2.3. Increase the distance between positive and negative sample pairs by using the minimum margin, and reduce the distance between data in positive sample pairs by using the maximum margin; based on the minimum and maximum margins, combine the concentric circle model to establish a loss function;
[0118] The loss function is:
[0119]
[0120]
[0121]
[0122] Where L is the loss function, L1 is the distance between positive and negative sample pairs, and L2 is the distance between positive sample pairs and cluster centers. This represents the furthest normal distribution of tie-line power. The vector output from the fully FC layer of the Siamese network. C is the vector output from the fully FC layer of the Siamese network for damaged data. c For cluster centers, ξ min and ξ max These are the minimum margin and the maximum margin, respectively.
[0123] In this embodiment, due to the flexibility of the injected data parameters, it is difficult for the input sample data to cover the features of all types of injected data. Therefore, combining the concentric circle model to construct the loss function can improve the detection capability of unknown types of injected data.
[0124] S3. Use the loss function to retrain the pre-trained data to obtain the first dataset; extract the first data pair that may be affected by load interference from the first dataset. If the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then the load frequency control system is determined to be under attack.
[0125] In this embodiment of the invention, when retraining, if it is determined that the distance between positive sample pairs and negative sample pairs is positive, or the distance between positive sample pairs and cluster centers is positive, i.e., L1>0 or L2>0, gradient equations are used to guide the direction of retraining.
[0126] The gradient equation is:
[0127]
[0128]
[0129]
[0130] Among them, G n G c and G F The gradient equation is represented by L1, where L1 is the distance between positive and negative sample pairs, and L2 is the distance between positive sample pairs and cluster centers. The vector output from the fully FC layer of the Siamese network. The vector output from the fully fully connected layer of the Siamese network for damaged data. For the furthest normal data of tie-line power, C c It serves as the cluster center.
[0131] Besides L1>0 or L2>0, the following situations may also occur:
[0132] If L1≤0, it means that the distance between negative sample pairs and positive sample pairs is far enough.
[0133] If L2≤0, it means that the distance between positive sample pairs is close enough to the cluster center;
[0134] If L1≤0 and L2≤0, it is possible to achieve effective separation of negative and positive sample pairs.
[0135] In these three cases, a gradient equation is not needed to guide the direction of retraining.
[0136] When comparing high-dimensional features, if the similarity between the high-dimensional features and the hazardous data is determined to be greater than a preset threshold, then the load frequency control system is determined to be under attack. The preset threshold is the similarity between the high-dimensional features and the preset normal data.
[0137] This embodiment uses a loss function to retrain the pre-trained data, which amplifies the difference between positive and negative sample pairs. Furthermore, a gradient equation is used to guide the retraining direction because when L1>0 or L2>0, the data in the loss function is not satisfied and a loss value is generated. Therefore, a gradient equation is needed to guide the training direction, ensuring a sufficiently large distance between negative and positive sample pairs, even achieving effective separation. The retraining and guidance method further enhances the ability to acquire high-dimensional features of the data based on pre-training and cluster centers, accelerating the detection of network attacks.
[0138] In summary, the dynamic model of this invention is established based on hazard data, measurement data in the load frequency control system, and the characteristics of the control command transmission path. It fully considers the impact of communication latency and noise. Training the data after transmitting it to a twin network further eliminates the effects of communication latency and noise, thus overcoming the limitations imposed by communication latency and noise during subsequent network attack detection. Through pre-training and re-training, the distance between negative and positive sample pairs is made sufficiently large, even achieving effective separation of negative and positive sample pairs. This facilitates the subsequent extraction of high-dimensional features from the data, thereby improving the speed of detecting whether the load frequency control system is under network attack. Compared to existing technologies, the detection speed for network attacks on load frequency control systems is faster and is not limited by communication latency and noise.
[0139] Please see Figure 3 The embodiments of the present invention provide a schematic diagram of the IEEE-39 node 10 unit power system. The attack module shown in the lower half of the dashed box represents the threatened area. This power system is used as a test scheme to verify the feasibility of the proposed detection scheme on the load frequency control system.
[0140] In this embodiment, based on the characteristics of the IEEE-39 Node 10-Unit Power System, some parameters of the dynamic model are as follows:
[0141]
[0142] ΔB i (t) = [―0.065 0 0 0] T sin(t)
[0143] Some parameters of the error formula are:
[0144]
[0145] Y i = [―6.6635―0.0003 9.053 0.1884] T
[0146] Using the above examples, the performance of the network attack detection method for a load frequency control system proposed in this invention is evaluated. The training samples include 900 historical normal sample data and 300 corrupted data, with the twin network layer number chosen as 20. For the leaked data, the value template for external attacks is set to 0.01 pu-5 p.u., and the value for scaling attacks is set to 0.01-5. Each sample contains 60 seconds of tie-line power data. Furthermore, 3000 observation sample data were generated, including 1500 samples from the three types of spoofed data injection attacks mentioned above, as test samples. Using the sample data under these conditions, the feasibility of the proposed detection scheme in a load frequency control system can be verified.
[0147] Please see Figure 4 The embodiments of the present invention provide a schematic diagram of simulation results, which uses the following five methods for simulation comparison:
[0148] (1) Proposed attack detection scheme using clustering-based loss function (Method A: A network attack detection method for a load frequency control system provided by the present invention);
[0149] (2) Proposed attack detection scheme using a triple loss function (Method B);
[0150] (3) Detection method using multilayer sensing (method C);
[0151] (4) Detection method using clustering particle swarm optimization (method D);
[0152] (5) Regional control error prediction method (method E).
[0153] Simulation results are as follows Figure 4As shown, compared with detection methods using multilayer sensing, clustering particle swarm optimization, and other schemes (Method BE), the proposed attack detection scheme achieves higher detection accuracy (Method A), especially when the system is subjected to flexible attacks. Because the proposed scheme is trained based on the relationship between observed data and real data, it has a more significant advantage over other methods.
[0154] Please see Figure 5 An embodiment of the present invention provides a network attack detection device for a load frequency control system, comprising:
[0155] Error module 10 is used to jointly model external attacks and scaling attacks on the load frequency control system, and solve for the hazard data of the damaged tie line power data; combined with the hazard data, a dynamic model and observer are established based on the measurement data and equipment information in the load frequency control system, and the error formula is obtained by solving the dynamic model and observer.
[0156] Training module 20 is used to transmit the measurement data and observation data of the load frequency control system to the twin network in the form of data pairs, pre-train the measurement data and observation data according to the error formula, and establish the loss function by controlling the distance between the measurement data and observation data after pre-training.
[0157] The detection module 30 is used to retrain the pre-trained data using a loss function to obtain a first dataset; extract the first data pair that may be affected by load interference from the first dataset; if the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then it is determined that the load frequency control system has been attacked.
[0158] In one embodiment, the error module 10 is further configured to:
[0159] Based on the measurement data in the load frequency control system, the regional command of the load frequency control system is generated by integration. Based on the regional command, a dynamic model of the load frequency control system is established according to the characteristics of the transmission path of the hazard data, measurement data and control command.
[0160] An observer is established based on the tie-line power and frequency of the load frequency control system.
[0161] In one embodiment, the training module 20 further includes:
[0162] The constraint unit is used to convert the measurement data and observation data into two sets of feature vectors and then transmit them to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazardous data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is smaller than the distance between the feature vector of the observation data and the feature vector of the hazardous data.
[0163] The pre-training unit is used to combine the error formula and analyze the measurement and observation data according to the Siamese network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the Siamese network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. Data with high correlation are positive sample pairs, and data with low correlation are negative sample pairs.
[0164] The cluster centers of the Siamese network bring features closer together in positive sample pairs and move features further apart in negative sample pairs, where the features are the trend characteristics of the data in the positive and negative sample pairs as the load changes.
[0165] The loss function building unit is used to increase the distance between positive and negative sample pairs by using the minimum margin and to reduce the distance between data in positive sample pairs by using the maximum margin. Based on the minimum and maximum margins, the loss function is established by combining the concentric circle model.
[0166] The loss function is:
[0167]
[0168]
[0169]
[0170] Where L is the loss function, L1 is the distance between positive and negative sample pairs, and L2 is the distance between positive sample pairs and cluster centers. This represents the furthest normal distribution of tie-line power. The vector output from the fully FC layer of the Siamese network. C is the vector output from the fully FC layer of the Siamese network for damaged data. c For cluster centers, ξ min and ξ max These are the minimum margin and the maximum margin, respectively.
[0171] In one embodiment, the detection module 30 is further configured to:
[0172] When retraining, if the distance between positive and negative sample pairs is determined to be positive, or the distance between a positive sample pair and the cluster center is positive, the gradient equation is used to guide the direction of retraining.
[0173] The gradient equation is:
[0174]
[0175]
[0176]
[0177] Among them, G n G c and G F The gradient equation is represented by L1, where L1 is the distance between positive and negative sample pairs, and L2 is the distance between positive sample pairs and cluster centers. The vector output from the fully FC layer of the Siamese network. The vector output from the fully fully connected layer of the Siamese network for damaged data. For the furthest normal data of tie-line power, C c It serves as the cluster center.
[0178] This device, by constructing a dynamic model, can fully consider the impact of communication latency and noise, thus overcoming the limitations imposed by these factors when detecting network attacks. Pre-training brings features closer together in positive sample pairs and further separates features in negative sample pairs, initially improving the ability to acquire high-dimensional features. Retraining amplifies the differences between positive and negative sample pairs, further enhancing the ability to acquire high-dimensional features and accelerating network attack detection. Compared to existing technologies, this device offers faster detection of network attacks targeting load frequency control systems and is not limited by communication latency and noise.
[0179] Accordingly, embodiments of the present invention also provide a computer-readable storage medium, which includes a stored computer program, wherein the computer program controls the device where the computer-readable storage medium is located to execute the load frequency control system network attack detection method when it is running.
[0180] If the network attack detection method for the load frequency control system is implemented as a software functional unit and used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the above embodiments of the present invention can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.
[0181] The above are preferred embodiments of the present invention. It should be noted that, for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications are also considered to be within the scope of protection of the present invention.
Claims
1. A method for detecting network attacks on a load frequency control system, characterized in that, include: A joint model of exogenous attacks and scaling attacks on the load frequency control system is used to solve for the hazard data of the affected tie line power data; Based on the hazard data, a dynamic model and observer are established according to the measurement data and equipment information in the load frequency control system. Specifically, based on the measurement data in the load frequency control system, a regional command for the load frequency control system is generated through integration. Based on the regional command, a dynamic model of the load frequency control system is established according to the hazard data, the measurement data, and the characteristics of the control command transmission path. An observer is established based on the tie-line power and frequency of the load frequency control system. The error formula is obtained by solving the dynamic model and the observer. The measurement data and observation data of the load frequency control system are transmitted to the twin network in the form of data pairs. The measurement data and observation data are pre-trained according to the error formula. A loss function is established by controlling the distance between the measurement data and observation data after pre-training. The loss function is used to retrain the pre-trained data to obtain a first dataset; a first data pair that may be affected by load interference is extracted from the first dataset; if the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then the load frequency control system is determined to be under attack.
2. The method for detecting network attacks on a load frequency control system as described in claim 1, characterized in that, The method of transmitting the measurement and observation data of the load frequency control system to the twin network in the form of data pairs also includes: The measurement data and observation data are converted into two sets of feature vectors and then transmitted to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazardous data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is less than the distance between the feature vector of the observation data and the feature vector of the hazardous data.
3. The method for detecting network attacks on a load frequency control system as described in claim 1, characterized in that, The measurement and observation data are pre-trained according to the error formula, specifically as follows: Based on the error formula, the measurement data and observation data are analyzed according to the twin network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the twin network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. Data with high correlation are positive sample pairs, and data with low correlation are negative sample pairs. The cluster centers of the twin network bring features closer together in the positive sample pairs and move features further apart in the negative sample pairs, wherein the features are the trend characteristics of the data in the positive and negative sample pairs as the load changes.
4. The method for detecting network attacks on a load frequency control system as described in claim 1, characterized in that, A loss function is established by controlling the distance between the measured data and the observed data after pre-training, specifically as follows: The distance between positive and negative sample pairs is increased by using the minimum margin, and the distance between data in the positive sample pair is reduced by using the maximum margin; based on the minimum and maximum margins, the loss function is established by combining the concentric circle model. The loss function is: ； ； Where M is the number of normal samples, and L is the loss function. The distance between the positive and negative sample pairs is... The distance between the positive sample pair and the cluster center. This represents the furthest normal distribution of tie-line power. This refers to the vector output from the fully FC layer of the Siamese network, representing normal data. C is the vector output from the fully FC layer of the Siamese network for damaged data. c Let ξ be the cluster center. min and ξ max These are the minimum and maximum margins, respectively.
5. The method for detecting network attacks on a load frequency control system as described in claim 1, characterized in that, Retraining the pre-trained data using the loss function further includes: During the retraining process, if the distance between positive and negative sample pairs is determined to be positive, or the distance between a positive sample pair and a cluster center is determined to be positive, a gradient equation is used to guide the direction of the retraining. The gradient equation is: ； ； Among them, G n G c and G F Together they represent the gradient equation, The distance between the positive and negative sample pairs is... The distance between the positive sample pair and the cluster center. The vector output from the fully FC layer of the Siamese network. The vector output from the fully FC layer of the twin network represents the damaged data. For the furthest normal data of tie-line power, C c The cluster center is defined as [the cluster center].
6. A network attack detection device for a load frequency control system, characterized in that, include: The error module is used to jointly model external attacks and scaling attacks on the load frequency control system, and solve for the hazard data of the affected tie-line power data. Based on the hazard data, a dynamic model and observer are established according to the measurement data and equipment information in the load frequency control system. Specifically, based on the measurement data in the load frequency control system, a regional command for the load frequency control system is generated through integration. Based on the regional command, a dynamic model of the load frequency control system is established according to the hazard data, the measurement data, and the characteristics of the control command transmission path. An observer is established based on the tie-line power and frequency of the load frequency control system. The error formula is obtained by solving the dynamic model and the observer. The training module is used to transmit the measurement data and observation data of the load frequency control system to the twin network in the form of data pairs, pre-train the measurement data and observation data according to the error formula, and establish a loss function by controlling the distance between the measurement data and observation data after pre-training. The detection module is used to retrain the pre-trained data using the loss function to obtain a first dataset; extract the first data pair in the first dataset that may be affected by load interference; if it is determined that the similarity between the high-dimensional features of the first data pair and the harmful data is greater than a preset threshold, then it is determined that the load frequency control system is under attack.
7. The network attack detection device for a load frequency control system according to claim 6, characterized in that, The training module includes: The constraint unit is used to convert the measurement data and observation data into two sets of feature vectors and then transmit them to the loss layer of the Siamese network. The loss function of the loss layer is used to calculate the distance between the feature vector of the observation data and the feature vector of the preset normal data and the feature vector of the hazardous data, respectively, so that the distance between the feature vector of the observation data and the feature vector of the preset normal data is less than the distance between the feature vector of the observation data and the feature vector of the hazardous data. The pre-training unit is used to combine the error formula and analyze the measurement data and observation data according to the twin network to obtain a combination of frequency deviation data and normal data that are affected by the communication simulated by the twin network. The data in the combination are sorted according to the correlation. According to the sorting order, the data in the combination are divided into positive sample pairs and negative sample pairs. The data with high correlation is the positive sample pair, and the data with low correlation is the negative sample pair. The clustering centers of the Siamese network bring features closer together in the positive sample pairs and move features further apart in the negative sample pairs, wherein the features are the trend features of the data in the positive and negative sample pairs as the load changes. The loss function construction unit is used to increase the distance between the positive and negative sample pairs by using the minimum margin and to reduce the distance between the data in the positive sample pairs by using the maximum margin; based on the minimum and maximum margins, the loss function is established by combining the concentric circle model. The loss function is: ； ； Where M is the number of normal samples, and L is the loss function. The distance between the positive and negative sample pairs is... The distance between the positive sample pair and the cluster center. This represents the furthest normal distribution of tie-line power. The vector output from the fully FC layer of the Siamese network. C is the vector output from the fully FC layer of the Siamese network for damaged data. c Let ξ be the cluster center. min and ξ max These are the minimum and maximum margins, respectively.
8. A network attack detection device for a load frequency control system according to claim 6, characterized in that, The detection module is specifically: During the retraining process, if the distance between positive and negative sample pairs is determined to be positive, or the distance between a positive sample pair and a cluster center is determined to be positive, a gradient equation is used to guide the direction of the retraining. The gradient equation is: ； ； Among them, G n G c and G F Together they represent the gradient equation, The distance between the positive and negative sample pairs is... The distance between the positive sample pair and the cluster center. The vector output from the fully FC layer of the Siamese network. The vector output from the fully FC layer of the twin network represents the damaged data. For the furthest normal data of tie-line power, C c The cluster center is defined as [the cluster center].
9. A storage medium, characterized in that, The storage medium stores a computer program, which is called and executed by a computer to implement any one of the network attack detection methods for a load frequency control system as described in claims 1 to 5.