A power grid error data injection attack path prediction method, system and device

Abstract

The application provides a power grid error data injection attack path prediction method, system and device, which comprises the following steps: step 1, obtaining the operation data of a to-be-tested power system, and obtaining an abnormal node of the to-be-tested power system according to the obtained operation data; step 2, calculating the correlation degree between each line of the to-be-tested power system and each abnormal node; step 3, obtaining a high-risk line set of the to-be-tested power system according to the obtained abnormal node and correlation degree; and step 4, analyzing the obtained high-risk line set to obtain a power grid error data injection attack prediction path of the to-be-tested power system. The application solves the problem of attack path prediction when the system is under suspicious attack.

Description

Technical Field

[0001] This invention belongs to the field of power grid attack detection technology, and in particular relates to a method, system and device for predicting power grid erroneous data injection attack paths. Background Technology

[0002] As a typical cyber-physical system (CPS), the power system is built on an integrated high-speed two-way communication network, deeply integrating physical and information systems. Through the application of advanced sensing and measurement technologies, advanced control methods, and decision support system technologies, it achieves the goals of a safe, economical, efficient, and environmentally friendly power grid.

[0003] Studies have shown that the emergence of new components, equipment, and structures has introduced more uncertainties and risks into power systems. On the one hand, power system attacks exhibit cyber-physical coupling characteristics. Although cyberattacks cannot directly damage the physical equipment of the power system, they can achieve effects similar to physical attacks by weakening or even completely disrupting the normal functions of the information system. During normal operation of the power system, information system failures can cause measurement loss or errors, affecting dispatchers' accurate perception of the power grid's physical system. When physical system failures occur, if the communication networks of information systems such as relay protection devices, Supervisory Control and Data Acquisition (SCADA), Energy Management Systems (EMS), and Wide Area Measurement Systems (WAMS) malfunction or are maliciously attacked, resulting in information interruptions, delays, or tampering, it is highly likely that the control center will issue incorrect instructions, decision-making units will malfunction, or the system will shut down, leading to physical system failures such as oscillations and large-scale power outages. The Ukrainian blackout is a typical example of a physical system failure caused by a cyberattack on the information system. On the other hand, the diverse and open network environment of the power system makes the flow of state information more vulnerable to threats from the cyber world compared to traditional power grids, and these threats are more dangerous.

[0004] Since the introduction of False Data Injection Attack (FDIK) against power systems, scholars have conducted extensive research in this field. In recent years, information attacks against industrial control systems, such as power grids, have occurred frequently. How to meet the requirements of the system to cope with information attacks while ensuring the normal operation of the industrial control system is one of the hot issues in the current research field of industrial control systems.

[0005] Existing research mainly focuses on the detection of FDI attacks, but cannot predict the attack paths of power grid erroneous data injection, resulting in a passive defense strategy for the power system and thus affecting the operating efficiency of the power system. Summary of the Invention

[0006] The purpose of this invention is to provide a method, system, and device for predicting power grid error data injection attack paths, thereby solving the aforementioned technical problems.

[0007] To achieve the above objectives, the technical solution adopted by the present invention is as follows:

[0008] This invention provides a method for predicting power grid error data injection attack paths, comprising the following steps:

[0009] Step 1: Obtain the operating data of the power system under test, and identify the abnormal nodes in the operation of the power system under test based on the obtained operating data;

[0010] Step 2: Calculate the correlation between each line and each abnormal node in the power system under test;

[0011] Step 3: Based on the obtained abnormal nodes and correlation, obtain the set of high-risk lines of the power system under test;

[0012] Step 4: Analyze the obtained set of high-risk lines to obtain the predicted path of power grid error data injection attack for the power system under test.

[0013] Preferably, in step 1, the abnormal nodes of the power system under test are obtained based on the obtained operating data. The specific method is as follows:

[0014] Based on the obtained operational data, obtain the estimated node state value for each node in the power system under test;

[0015] Determine whether the corresponding node is an abnormal node based on the obtained node state estimate.

[0016] Preferably, the estimated node state value for each node in the power system under test is obtained according to the following formula:

[0017]

[0018] in, Let be the node state estimate; H be the measurement matrix; z be the system measurement value.

[0019] Preferably, the method for determining whether a node is an abnormal node based on the obtained node state estimate is as follows:

[0020] Calculate the residual between the estimated node state and the measured value of that node;

[0021] The obtained residual is compared with a preset threshold, and the node is determined as an abnormal node based on the comparison result.

[0022] Preferably, in step 2, the correlation between each line and each abnormal node in the power system under test is calculated. The specific method is as follows:

[0023] The correlation between each line and each abnormal node is calculated using the power flow distribution factor.

[0024] Preferably, in step 3, the set of high-risk lines in the power system under test is obtained based on the obtained abnormal nodes and correlation degrees. The specific method is as follows:

[0025] The column space of the measurement matrix of the power system under test is defined as the cut set space;

[0026] The lines with a high correlation to each abnormal node are selected as high-risk lines;

[0027] A set of high-risk routes is formed by selecting cut sets containing high-risk routes from the defined cut set space.

[0028] Preferably, in step 4, the obtained set of high-risk lines is analyzed to obtain the predicted path for power grid error data injection attacks on the power system under test. The specific method is as follows:

[0029] Determine whether there is only one set of attack lines in the high-risk line set. If so, make the final prediction result for that set of attack lines; otherwise, calculate the attack cost and benefit corresponding to each set of attack lines to obtain the benefit function, and take the attack line corresponding to the maximum benefit function as the final prediction result.

[0030] A power grid error data injection attack path prediction system includes:

[0031] The abnormal node acquisition unit is used to acquire the operating data of the power system under test and to acquire the abnormal nodes of the power system under test based on the acquired operating data.

[0032] The correlation calculation unit is used to calculate the correlation between each line and each abnormal node in the power system under test.

[0033] The high-risk line set acquisition unit is used to obtain the high-risk line set of the power system under test based on the obtained abnormal nodes and correlation.

[0034] The attack path prediction unit is used to analyze the obtained set of high-risk lines to obtain the power grid error data injection attack prediction path of the power system under test.

[0035] A power grid error data injection attack path prediction device includes a processor and a computer program capable of running on the processor, wherein the processor executes the computer program to implement the steps of the method.

[0036] Compared with the prior art, the beneficial effects of the present invention are:

[0037] This invention provides a method for predicting power grid error data injection attack paths. It identifies anomalous nodes using event-related and spatial-related methods, and combines this with the correlation between line nodes to find the line combinations most relevant to the anomalous nodes. Based on the attacker's covert behavior requirements, and with attack cost and benefit as objectives, it solves the problem of attack path prediction when the system is under suspicious attack. Specifically, it analyzes lines potentially vulnerable to attack based on node-line correlation, and determines high-risk line sets using cut sets in the system as search routes based on the characteristics of FDI attacks. The cost of each scheme is specifically reflected in the number of measurement devices the attacker needs to attack, and the benefit is the potential load loss after the attack. Subsequently, it weighs and constructs an attacker attack model to find the scheme that maximizes the attacker's overall benefit. Attached Figure Description

[0038] Figure 1 This is a patent flowchart;

[0039] Figure 2 Diagram of the IEEE-14BUS system;

[0040] Figure 3 This is a graph showing the prediction results. Detailed Implementation

[0041] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0042] Example 1

[0043] This implementation case provides a method for predicting power grid error data injection attack paths, such as... Figure 1 As shown, it includes:

[0044] S01: Data Acquisition

[0045] The system collects topology and power flow data generated during operation, including system measurements, node parameters, and line parameters.

[0046] The system measurements include node injected power and line power flow.

[0047] Line power flow includes the direction and value of active power, as well as the direction and magnitude of reactive power.

[0048] The node parameters include voltage and phase angle.

[0049] The line parameters include the node admittance matrix.

[0050] S02: Data Processing

[0051] The system measurements, node parameters, and line parameters are all converted into per-unit values ​​for easier calculation.

[0052] Construct the system topology based on node parameters and line parameters.

[0053] S03: Node State Estimation:

[0054] Node state estimation refers to the process by which a system estimates state values ​​(node ​​voltage phase angles) that cannot be directly measured, using measurable data (such as active power, reactive power, and node voltage amplitude).

[0055] For a typical power system, the system measurement values ​​and system state are related by z = Hx + w, where z is the system measurement value, H is the system measurement matrix, x is the phase angle of the system node voltage, and w is the measurement noise. The state estimation device in the system will generate an estimate of the current state of the system based on the measurement values. This is the estimated value of the node state of the current system.

[0056] S04: Abnormal Node Detection

[0057] Specifically, when the system is running normally, the measured data and the estimated values ​​satisfy the error data check: u is the residual and ω is the preset threshold. If there is a node that satisfies u > ω, then there is reason to believe that the node is currently in an abnormal state, and the abnormal node data is transferred to S05 for aggregation; if there is no abnormal node data in the system, it is transferred to S01 to continuously collect data.

[0058] S05: Input of abnormal node data:

[0059] When there are abnormal data nodes in the system, the abnormal node data is statistically analyzed, and the node number and abnormal data content are recorded. The abnormal node data includes the number of each abnormal node, the abnormal data of the abnormal node, and the corresponding correct estimated data. Furthermore, when statistically analyzing the abnormal node data, the abnormal nodes need to be sorted according to the deviation between the abnormal value and the normal value, and the priority for processing is determined according to the degree of abnormality.

[0060] S06, Line Node Correlation Analysis:

[0061] Based on the network topology obtained in S02, the impact of power flow changes on each line and node is considered. The correlation between nodes and lines refers to the impact of node power flow changes on the power flow of each line. Specifically, this can be expressed using the power flow transfer distribution factor, which is a parameter used to describe the power flow transmission relationship between different nodes in the system.

[0062] The specific calculation method is as follows:

[0063] Consider a power system with n nodes, where node i and node j are connected by a line. Therefore, the power flow distribution factor can be defined as the ratio of the power flow at node i to the total power flow at node j, i.e.:

[0064] DF(i,j) = P(i,j) / P(j)

[0065] Where P(i,j) represents the power flow from node i to node j, and P(j) represents the total power flow at node j.

[0066] The power flow distribution factor (DF) can be used to calculate the influence of power flow changes at any node on the power flow of any line. For a system with n nodes and m lines, its power flow distribution factor is an m×n matrix, where the element in the m-th row and n-th element is the power flow transfer distribution factor of line m to node n.

[0067] Therefore, a line that is sensitive to power flow changes at a certain abnormal node can be obtained.

[0068] S07, High-risk route set generation:

[0069] The set of high-risk lines is obtained by combining abnormal node data and line node correlation analysis results.

[0070] The existing error data verification mechanism in power systems can be described as follows: first, an estimate of the current state of the system is generated based on the measured values. Then, based on the estimated value of the current system state Calculate the estimated value of the measurement. When the system is running normally, the measured data and the estimated values ​​satisfy the error data check: r is the residual, and η is the preset threshold. After a typical information attack injection, this residual will be greater than the threshold. However, when an attacker injects an attack of the form a = Hc, the system residual remains unchanged before and after the attack, and this detection mechanism cannot detect it.

[0071] This section analyzes the attack mechanism of the form a = Hc. By breaking the system along any cut set, the system can be divided into two subsystems S1 and S2, when the following conditions are met... Attackers can always construct feasible covert attacks. First, when the attacker only has partial system knowledge, assuming the attacker's understanding of the system matrix has a bias δ, then... Given H = DXA, where D is a unit diagonal matrix and X is a diagonal reactance matrix, for a system's incidence matrix A, the sum of each row of A is 0, i.e. Given δ = εA, for an attack to be undetectable, δ = εA = 0 must be guaranteed. That is, the attack vector constructed by the attacker must have a corresponding system state variable that satisfies the current measurement matrix; in other words, the attack vector must be in the column space of the measurement matrix. At this point, the attack vector injected by the attacker will cause the control center to make an incorrect estimate of the current system state, resulting in a new measurement value z. m =z+a=H(x+c) will be considered a correct measurement by the system, and the system's error data verification device will be successfully bypassed.

[0072] Specifically, the attack vector needs to be in the column space of the system's measurement matrix. The column space of the system's measurement matrix is ​​equivalent to the system's cut set space. Therefore, the path attacked by the attacker must be the union of the system's cut sets. Based on the impact of modifying the flow of power on the target node's measurements and the system's cut set space, the space of all feasible solutions can be derived.

[0073] Identify the lines that are highly correlated with the abnormal nodes, and then find all the cut sets that contain these lines; this is the set of high-risk lines.

[0074] S08, Solution space evaluation:

[0075] Determine the dimension of the solution space of the high-risk route set obtained in S07. If there is only one solution, proceed to S11; otherwise, proceed to S09.

[0076] S09, Calculate the cost and benefit of each option:

[0077] When the system has multiple possible attack route combinations, calculate the attacker's attack cost and benefit for each scheme. Specifically, assume that the final set of attack routes is Sa, and Sa = Sa1∪Sa2∪…∪Sa n For a specific set of minimal attack paths Sa i Let Ba be the attacker's gain under this attack scheme. i Specifically, this can be understood as the load loss caused by the attack; the attacker's attack cost is denoted as Ca. i Specifically, the attacker in Sa i This refers to the cost incurred by an attacker in obtaining parameter information and carrying out the attack. To simplify the analysis, we assume that the attack cost is the same for any single node; therefore, the attacker's attack cost can be characterized by the number of measurement values ​​that need to be compromised. The calculation results are then processed in S10.

[0078] S10: Attack Plan Prediction:

[0079] Based on the costs and benefits of each scheme obtained in S09, and analyzing the attacker's model, we can derive the attacker's benefit per unit cost as f(Ba). i Ca i By analyzing the attacker's target, we can obtain...

[0080]

[0081] Sa i Denotes a set of fundamental cut sets, i.e., the optimization objective is to find a set such that f(Ba) i Ca i The most maximal attack strategy, after obtaining the profit function f, can perform threat rating on all lines in the system, implement additional protective measures for high-threat lines, and ultimately find a set of f(Ba) i Ca i The largest possible circuit combination is the final prediction result, which is then output to S11.

[0082] S11: Output prediction scheme:

[0083] When there is only one solution in the solution space of S08, that solution is the final prediction result. If there are multiple solutions in the solution space, the solution with the greatest overall benefit to the attacker is taken as the final prediction result.

[0084] Example 2

[0085] Figure 2 This is a system architecture diagram for a test case of an IEEE-14 node standard power system. The system contains 14 nodes, of which nodes 1, 2, 3, 6, and 8 are generating nodes, and the other nodes are load nodes. There are 20 branches between the nodes.

[0086] The control center can control the on / off state of each branch in the system and the working status of each generator. Under normal operation, all generators in the system are in the on state. When an attacker intrudes into the control center, he can issue false control commands to the generators. For example, the attacker can send a control command to shut down the generator on node 2. When the generator receives the command, it will respond to it, which may cause damage to the system's operating status.

[0087] In the MATPOWER environment, a physical response model of the power system is constructed based on the power system's connection structure, electrical parameters, and the switching states of each generator. This model allows for power flow analysis of the power system. Figure 2 Specifically, it includes the following steps:

[0088] Step S01: Set the baseMVA value of the entire system to 100MVA, and initially generate the following bus matrix based on the node power and voltage parameters:

[0089]

[0090] In the Bus matrix, the first column is the No parameter, the second column is the Type parameter, the third column is the Pd parameter, the fourth column is the Od parameter, the fifth column is the Gs parameter, the sixth column is the Bs parameter, the seventh column is the area parameter, the eighth column is the Vm parameter, the ninth column is the Va parameter, the tenth column is the baseKV parameter, the eleventh column is the zone parameter, the twelfth column is the Vmax parameter, and the thirteenth column is the Vmin parameter.

[0091] In the Bus matrix, Type indicates the node type, where 1 is a PQ node, 2 is a PV node, and 3 is a slack node; Pd and Qd represent the active and reactive power injected by the node into the load; Gs and Bs represent the conductance and susceptance values ​​of the node in parallel, which are all set to 0 in this system; Vm, Va, Vmax, and Vmin represent the initial amplitude, initial phase, maximum amplitude, and minimum amplitude of the node voltage, respectively, where the voltage amplitudes are per-unit values ​​under the base capacity. For the simplification of the system model, the initial phase value of each node is uniformly set to 0, and the maximum and minimum amplitudes are uniformly set to 1.1 and 0.9, respectively; baseKV represents the node base voltage, which is consistent with the system base capacity; area and zone are used to set the grid section number and zone number, which are generally set to 1;

[0092] Step S02: Based on the line connection relationships between nodes and the impedance and admittance parameters of each branch, determine the following branch matrix:

[0093]

[0094] In the branch matrix, the first column is the fb parameter, the second column is the tb parameter, the third column is the R parameter, the fourth column is the X parameter, the fifth column is the B parameter, the sixth column is the rA parameter, the seventh column is the rB parameter, the eighth column is the rC parameter, the ninth column is the ratio parameter, the tenth column is the ang parameter, the eleventh column is the S parameter, the twelfth column is the angmin parameter, and the thirteenth column is the angmax parameter.

[0095] In the branch matrix, fb and tb represent the node numbers connected to the branch; columns R, X, and B represent the resistance, reactance, and susceptance of the branch, respectively; rA, rB, and rC represent the allowable power of the branch in the long term, short term, and emergency, respectively. To simplify the system model, the values ​​of these three columns are uniformly set to 250; ratio represents the branch voltage ratio. If the branch is a conductor, its value is 0. If the branch has a transformer, its value is the ratio of the reference voltages on both sides of the transformer; S represents the closed state of the branch, where 1 indicates the branch is closed and 0 indicates the branch is open; ang, angmin, and angmax represent the branch phase angle and the maximum and minimum angle differences, respectively.

[0096] Step S103: Based on the generator's power parameters and electrical parameters, determine the following generator matrix (gen matrix):

[0097]

[0098] In the gen matrix, the first column is the bus parameter, the second column is the Pg parameter, the third column is the Qg parameter, the fourth column is the Qmax parameter, the fifth column is the Qmin parameter, the sixth column is the Vg parameter, the seventh column is the mBase parameter, the eighth column is the S parameter, the ninth column is the Pmax parameter, and the tenth column is the Pmin parameter.

[0099] In the gen matrix, Pg, Pmax, and Pmin represent the generator's active power and maximum and minimum allowable values, respectively; Qg, Qmax, and Qmin represent the generator's reactive power and maximum and minimum allowable values, respectively; Vg represents the generator's operating voltage, which is a per-unit value under the base capacity; mBase represents the generator's power base, which is consistent with the base capacity; S represents the generator's operating state, where 1 indicates the generator is running and 0 indicates the generator is off.

[0100] Step S02: Calculate the system power flow to determine the system state matrix s and the line power flow matrix l.

[0101]

[0102] The first column of the s matrix is ​​the node number data, the second column is the voltage amplitude, the third column is the voltage phase angle, the fourth column is the active power injected by the node, the fifth column is the reactive power injected by the node, and the node without these two values ​​is the load node. The sixth column is the active power absorbed by the node, and the seventh column is the reactive power absorbed by the node, and the node without these two values ​​is the generator node.

[0103]

[0104] The first column of the l matrix contains the line number data, the second column contains the starting node of the line power, the third column contains the ending node of the line power, the fourth column contains the active power injected by the starting node, the fifth column contains the reactive power injected by the starting node, the sixth column contains the active power injected by the ending node (negative values ​​indicate that the node absorbs active power from the line), the seventh column contains the reactive power injected by the ending node (negative values ​​indicate that the node absorbs reactive power from the line), and the eighth and ninth columns contain the active and reactive power losses of the line, respectively.

[0105] Step S03: Node state estimation. Estimate the state variables of each node and the power flow value of the line, and compare them with the calculation results. The comparison results are shown in Table 1 below.

[0106] Table 1

[0107]

[0108]

[0109] like Figure 3 As shown, after comparative calculation, the estimated state values ​​of nodes 3, 4, 5, and 6 deviate significantly from the calculated values, suggesting the presence of abnormal data in these nodes. Based on the correlation between nodes and lines, we obtained the following set of high-order lines. The overall revenue was normalized based on the maximum revenue, as shown in Table 2.

[0110]

[0111] The final prediction results are route combinations 3, 4, 7, and 10, as detailed below. Figure 3 As shown.

[0112] Example 3

[0113] This embodiment provides a power grid error data injection attack path prediction system, comprising:

[0114] The abnormal node acquisition unit is used to acquire the operating data of the power system under test and to acquire the abnormal nodes of the power system under test based on the acquired operating data.

[0115] The correlation calculation unit is used to calculate the correlation between each line and each abnormal node in the power system under test.

[0116] The high-risk line set acquisition unit is used to obtain the high-risk line set of the power system under test based on the obtained abnormal nodes and correlation.

[0117] The attack path prediction unit is used to analyze the obtained set of high-risk lines to obtain the power grid error data injection attack prediction path of the power system under test.

[0118] Example 4

[0119] The aforementioned power grid error data injection attack path prediction device can be a computing device such as a desktop computer, laptop, handheld computer, or cloud server. This device may include, but is not limited to, a processor and memory. ...

[0120] The processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. …

[0121] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A method for predicting power grid error data injection attack paths, characterized in that, Includes the following steps: Step 1: Obtain the operating data of the power system under test, and identify the abnormal nodes in the operation of the power system under test based on the obtained operating data; Step 2: Calculate the correlation between each line and each abnormal node in the power system under test; Step 3: Based on the obtained abnormal nodes and correlation, obtain the set of high-risk lines of the power system under test; Step 4: Analyze the obtained set of high-risk lines to obtain the predicted path of power grid error data injection attack for the power system under test.

2. The method for predicting power grid error data injection attack paths according to claim 1, characterized in that, In step 1, the abnormal nodes of the power system under test are obtained based on the obtained operational data. The specific method is as follows: Based on the obtained operational data, obtain the estimated node state value for each node in the power system under test; Determine whether the corresponding node is an abnormal node based on the obtained node state estimate.

3. The method for predicting power grid error data injection attack paths according to claim 2, characterized in that, The estimated node state value for each node in the power system under test is obtained using the following formula: in, Let be the node state estimate; H be the measurement matrix; z be the system measurement value.

4. The method for predicting power grid error data injection attack paths according to claim 2, characterized in that, The method for determining whether a node is an anomalous node based on the obtained node state estimate is as follows: Calculate the residual between the estimated node state and the measured value of that node; The obtained residual is compared with a preset threshold, and the node is determined as an abnormal node based on the comparison result.

5. The method for predicting power grid error data injection attack paths according to claim 1, characterized in that, In step 2, the correlation between each line and each anomalous node in the power system under test is calculated. The specific method is as follows: The correlation between each line and each abnormal node is calculated using the power flow distribution factor.

6. The method for predicting power grid error data injection attack paths according to claim 1, characterized in that, In step 3, the set of high-risk lines in the power system under test is obtained based on the obtained abnormal nodes and correlations. The specific method is as follows: The column space of the measurement matrix of the power system under test is defined as the cut set space; The lines with a high correlation to each abnormal node are selected as high-risk lines; A set of high-risk routes is formed by selecting cut sets containing high-risk routes from the defined cut set space.

7. The method for predicting power grid error data injection attack paths according to claim 1, characterized in that, In step 4, the obtained set of high-risk lines is analyzed to obtain the predicted path for power grid error data injection attacks on the power system under test. The specific method is as follows: Determine whether there is only one set of attack lines in the high-risk line set. If so, make the final prediction result for that set of attack lines; otherwise, calculate the attack cost and benefit corresponding to each set of attack lines to obtain the benefit function, and take the attack line corresponding to the maximum benefit function as the final prediction result.

8. A power grid error data injection attack path prediction system, characterized in that, include: The abnormal node acquisition unit is used to acquire the operating data of the power system under test and to acquire the abnormal nodes of the power system under test based on the acquired operating data. The correlation calculation unit is used to calculate the correlation between each line and each abnormal node in the power system under test. The high-risk line set acquisition unit is used to obtain the high-risk line set of the power system under test based on the obtained abnormal nodes and correlation. The attack path prediction unit is used to analyze the obtained set of high-risk lines to obtain the power grid error data injection attack prediction path of the power system under test.

9. A power grid error data injection attack path prediction device, comprising a processor and a computer program capable of running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the method as described in any one of claims 1-7.

Images