A power grid false data injection identification method based on improved CNN-LSTM

Abstract

The application is a power grid false data injection identification method based on improved CNN-LSTM. It includes the power FDIA feature extraction method based on the stacked autoencoder to solve the problem of large model calculation caused by the feature redundancy of power system operation data. In order to further improve the performance of feature extraction, the attention mechanism module is introduced to improve the model, and the attention mechanism layer is introduced at the input layer of each sub-autoencoder, so as to provide greater weight to the highly relevant features of the attack. The false data injection attack identification model based on CNN-LSTM is constructed, and the sparrow search algorithm is used to optimize the parameters of the CNN-LSTM model to solve the problem that the parameter selection has a great influence on the identification accuracy. The method is scientific and reasonable, has high accuracy, can be applied to the identification of false data injection attacks in power grids, and has certain practical significance for maintaining the safety of power grids.

Description

Technical Field

[0001] This invention relates to the field of power grid security and is a method for identifying spoofed data injection into power grids based on an improved CNN-LSTM. Background Technology

[0002] With the rapid development of information and communication technologies, traditional power systems are transforming into Cyber-Physical Systems (CPS). Through tight coupling between the physical and network layers, CPS significantly improves reliability and operational efficiency compared to traditional power systems. However, in CPS, various measuring instruments and control devices constantly generate massive amounts of data, and the interaction of this large volume of data between the physical and network layers, while making the system more efficient, also increases the risk of cyberattacks. False data injection (FDIA) attacks exploit vulnerabilities in state estimation, allowing attackers to construct fake data sets, tamper with normal system data, alter state variables, manipulate system operation, and gain economic benefits. Compared to general cyberattacks, FDIA is a meticulously designed data integrity attack based on grid-related information, aiming to compromise the grid for economic gain. FDIA poses a significant threat to the power grid.

[0003] Traditional smart grids typically use mechanism-based modeling and other methods to detect spoofed data injection (FDIA) attacks. However, these methods are insufficient for the rapid detection needs of high-dimensional, heterogeneous power systems. Therefore, data-driven approaches such as machine learning and deep learning are commonly employed to identify FDIA attacks. In the current context of power cyber-physical systems, the large-scale deployment of wide-area measurement systems provides a big data analytics foundation for these methods. Neural network models, as a crucial branch of deep learning algorithms, offer advantages in both detection efficiency and accuracy. They do not require complex time-frequency domain modeling calculations, have a relatively simple design environment, and are more versatile across power systems with different structures. The large-scale deployment of wide-area measurement systems provides big data support for machine learning-based FDIA attack identification methods, enabling machine learning-based FDIA identification schemes to mature.

[0004] When faced with high-dimensional data, typical deep learning attack identification models suffer from slow training speeds and low accuracy, resulting in high false positive rates, poor real-time detection, and unstable performance. However, large-scale power systems are often affected by spatial and temporal complexity, and their data features are more prone to high-dimensionality and nonlinearity. Therefore, feature extraction and selection become crucial steps in FDIA detection. Regardless of the identification model used, extracting and filtering features of the power system under both normal operating conditions and under attack conditions is essential. Summary of the Invention

[0005] The purpose of this invention is to address the problems of slow training and low accuracy in the process of training deep learning models with high-dimensional, low-value-density data during the identification of power grid fake data injection attacks, as well as the problems of model overfitting, false alarm rate, and unstable performance caused by improper matching of model parameters and data scale. From the perspective of power data mining, this invention proposes a scientific, efficient, and universally applicable method for identifying power grid fake data injection based on an improved CNN-LSTM.

[0006] The technical solution of this invention is: a method for identifying spurious power grid data injection based on an improved CNN-LSTM, characterized in that: preprocessed power operation data samples to be identified are input into a trained improved stacked autoencoder feature extraction model, and the reconstruction error is calculated, the loss between the reconstructed data and the original data is calculated, and the model parameters are updated using the backpropagation algorithm. The number of features to be extracted is selected based on the reconstruction error.

[0007] The dataset for identifying attacks with extracted features is divided into training, validation, and test sets. A CNN-LSTM-based fake data injection attack identification model is constructed. The model is trained using the training set. The parameters of the CNN-LSTM model are optimized using a sparrow search algorithm with the validation set. Finally, the identification results are validated using the test set.

[0008] The above plan also includes:

[0009] In constructing the spoofing attack identification model based on CNN-LSTM, the steps of the spoofing attack feature extraction method based on the improved stacked autoencoder are as follows:

[0010] The improved stacked autoencoder structure involves adding an attention mechanism layer before the hidden layers. The raw power operation data is compressed by the encoder to obtain a latent space feature representation. An attention weight vector is calculated for each simplified feature. The attention weights determine the importance of different parts of the input data in feature extraction. If the attention vector finds that a particular feature does not contribute to attack identification, it sets the corresponding value in the vector to zero, causing the network to forget that feature. The attention weight vector is multiplied by the feature representation and used as input to the hidden layer. Finally, the decoder reconstructs the data, calculates the loss between the reconstructed data and the original data, and updates the model parameters using backpropagation.

[0011] The specific steps are as follows:

[0012] Step 1: The pre-processed power system operation data to be identified is input into the first autoencoder. The encoder of the first autoencoder compresses the input data to obtain a latent space feature representation. This step maps the input data to a lower-dimensional representation, captures the key features of the input data, and generates compressed and simplified power data features.

[0013] Step 2: Calculate the attention weight for each simplified power data feature, and calculate the attention weight for each feature against spoofing attacks. The attention weight vector for each feature reflects its importance in feature extraction. If a particular feature does not contribute to attack identification, the corresponding value of the attention vector is set to zero to cause the network to ignore that feature.

[0014] Step 3: Multiply the attention weight vector of the first autoencoder with the feature representation to obtain a weighted feature representation. Pass the weighted feature representation as input to the hidden layer of the first autoencoder.

[0015] Step 4: Reconstruct the attack features using the decoder of the first autoencoder, and use the reconstructed attack feature results as the input of the second autoencoder.

[0016] Step 5: Compress the output of the first autoencoder decoder using the encoder of the second autoencoder to obtain the feature representation of the second latent space.

[0017] Step 6: Calculate the second attention weight, and calculate the contribution of each reconstructed feature to the fake data injection attack.

[0018] Step 7: Multiply the attention weight vector of the second autoencoder with the feature representation to obtain the weighted feature representation.

[0019] Step 8: Decode the feature representation of the hidden layer of the second autoencoder using the decoder of the second autoencoder to reconstruct the attack features of the second autoencoder.

[0020] Step 9: Calculate the reconstruction error between the reconstructed data and the original data sample, update the model parameters using the backpropagation algorithm, and determine the final number of extracted features based on the magnitude of the reconstruction error under different data dimensions.

[0021] The specific steps of optimizing the attack detection method of CNN-LSTM using the sparrow search algorithm are as follows:

[0022] Step 1: Construct a CNN-LSTM attack detection model, including the following sub-steps:

[0023] Step 1: Constructing the CNN: Design the structure of the Convolutional Neural Network (CNN) to extract spatial features from the attack data. Select appropriate convolutional layers, pooling layers, and activation functions, and determine the size of the convolutional kernels.

[0024] Step 2: Construct the LSTM part: Design the structure of the Long Short-Term Memory (LSTM) network, and define the number of LSTM layers, the number of hidden units, and other hyperparameters.

[0025] Step 3: Merge CNN and LSTM: Connect the CNN and LSTM to form a unified CNN-LSTM model. This typically involves feeding the output sequence of the CNN into the LSTM for temporal modeling.

[0026] Step 2: Optimize the model parameters of the sparrow search algorithm, including the following sub-steps:

[0027] Step 1: Initialize the parameter range.

[0028] Based on the characteristics of the attack identification task and the scale and complexity of the dataset, the search range of parameters to be optimized is determined, including the number of neurons in the convolutional layer, the size of the convolutional kernel, the size of the pooling kernel, the number of nodes in the LSTM layer, and the number of nodes in the fully connected hidden layer.

[0029] Step 2: Generate the initial population.

[0030] A set of initial network structures is generated randomly, including the number of neurons in the convolutional layers, the kernel size of the convolutional layers, the kernel size of the pooling layers, and the number of nodes in the LSTM layers and fully connected hidden layers.

[0031] Step 3: Assess fitness.

[0032] For each generated network architecture, the model is trained using the training set, and the performance of the FDIA attack identification model is evaluated using the validation set. Based on the evaluation results, the fitness value of each individual is calculated, serving as its discoverer in the population.

[0033] Step 4: Run the sparrow search algorithm.

[0034] In each iteration, based on the basic principles of the sparrow search algorithm, some individuals are selected according to their fitness values ​​for crossover and mutation operations to generate new parameters.

[0035] Step 5: Update the population.

[0036] The population is updated based on the new parameters obtained from the crossover and mutation operations, and the fitness of each individual is recalculated.

[0037] Step 6: Termination conditions.

[0038] The algorithm terminates the search when the minimum error and maximum number of iterations are reached.

[0039] Step 7: Select the optimal solution.

[0040] After the termination condition is met, the individual with the highest fitness is selected from the final population as the optimal solution, which is the parameter of the required CNN-LSTM fake data injection attack identification model.

[0041] Step 3: Output the identification results.

[0042] Evaluate the model's performance using a test set, including metrics such as accuracy, precision, and recall. Ensure the model can effectively distinguish between attacks and legitimate behavior.

[0043] A method for identifying spoofed data injection in power grids based on an improved CNN-LSTM is characterized by including the following:

[0044] (1) A method for extracting features of fake data injection attacks based on an improved stacked autoencoder

[0045] A stacked autoencoder-based algorithm is employed to generate a new feature set based on features highly relevant to the attack from the original dataset. This reduces redundant features, improves training accuracy, and lowers model complexity. This enhances the efficiency and accuracy of identifying fake data injection attacks.

[0046] The autoencoder has a symmetrical structure, consisting of an input layer, a hidden layer, and an output layer. Power operation data undergoes linear combination and activation function operations during the encoding stage, followed by input processing in the hidden layer. The decoding stage reconstructs the original input samples through linear combination and nonlinear activation operations. The specific flow of each stage is as follows:

[0047] Encoding process: The encoding process from the input layer to the hidden layer is shown in formula (1):

[0048]

[0049] After being processed by the encoder, the input vector Generate hidden layer vectors of dimension d. θ represents the encoder weight parameter W a , which is the weight matrix from the input layer to the hidden layer, b is the bias value of the encoder, and s is the activation function used by the encoder.

[0050] Decoding process: The process from the hidden layer to the output layer is shown in formula (2):

[0051]

[0052] θ′ represents the decoded data vector, and θ′ represents the decoder's weight parameters W′. a , W′ a is the weight matrix from the hidden layer to the output layer, b′ is the bias value of the decoder, and s′ represents the activation function used by the decoder. When autoencoders are applied to feature extraction, the gradient is typically backpropagated by minimizing the reconstruction error, and the parameters W of the autoencoder are adjusted. a 、W′ a b and b′ enable more accurate reconstruction of the input data. The formula for calculating the reconstruction error is (3):

[0053]

[0054] The focus of the above description is on a single sample. Perform with a single input The reconstruction error is measured, and in the training set covering m samples, the reconstruction error function of the autoencoder (AE) is explicitly defined as (4).

[0055]

[0056] For large-scale power operation data, using only autoencoders is insufficient. To obtain better data representation, a layer-by-layer stacking method can be used to train autoencoders, known as stacked autoencoders (SAEs).

[0057] This invention improves the model by using an attention mechanism on the basis of stacked autoencoders. An attention mechanism is added after the input layer of the autoencoder, and the model is guided to give greater weight to features that are highly related to fake data injection attacks by taking advantage of the attention mechanism's ability to capture key information.

[0058] The attention mechanism layer uses a value vector, where each value represents the importance of the corresponding feature. A small subset of key features is selected from the rich feature information through weighted summation. Specific calculation formulas are shown in (5)-(7):

[0059] M = tanh(W) a x′+b a (5)

[0060] α i =softmax(M i (6)

[0061]

[0062] Where x′ refers to the output of the encoder in AE, W a It is the encoder weight, b aIt is the offset value, and a i M is normalized by softmax i The probability distribution is then calculated. Finally, the probability distribution is used as weights and summed with x′ to obtain a more representative feature vector v, focusing on important features. The attention mechanism layer eliminates unnecessary functions and gradually improves the network's performance.

[0063] The improved stacked autoencoders (ISAE) architecture adds an attention mechanism layer before the hidden layers of the autoencoder. The original input data is compressed by the encoder to obtain a feature representation in the latent space. An attention weight vector is calculated for each simplified feature. The attention weights determine the importance of different parts of the input data in feature extraction. If the attention vector finds that a particular feature does not contribute to attack detection, it sets the corresponding value in the vector to zero, causing the network to forget that feature. The attention weight vector is multiplied by the feature representation and used as input to the hidden layer. Finally, the decoder reconstructs the data, calculates the loss between the reconstructed data and the original data, and uses backpropagation to update the model parameters.

[0064] (2) Sparrow Search Algorithm Optimizes CNN-LSTM Attack Identification Method

[0065] Convolutional Neural Networks (CNNs) mainly consist of convolutional layers (Convolutional Cayner, Conv), pooling layers, and fully connected layers (Dense). CNNs possess representation learning capabilities. The convolutional layer is the core component of a CNN, consisting of a set of parallel feature maps. Through convolutional kernels of different sizes, the input data is learned layer by layer according to the network structure to obtain the output feature map. All elements in this feature map are calculated using the same weights and biases. The mathematical model of the convolution operation is shown in Equation 8.

[0066]

[0067] The operation is a non-linear activation function, where FE q This represents a set of features input to the convolutional layer. This represents the input features of the p-th convolutional kernel in the (l-1)-th layer of the network. The label represents the q-th weight of the p-th convolutional kernel in the l-th layer. This represents the q-th bias value of the l-th layer, and the final output is... Let q be the feature map of the l-th layer.

[0068] Pooling layers employ the principle of local correlation to reduce model size, improve computational speed, and enhance the robustness of extracted features. This is achieved by reducing redundant features, thus preserving key features relevant to FDIA attacks. This prevents overfitting and improves model generalization ability. The mathematical model of pooling layers is as follows:

[0069]

[0070] In the formula, h(u,v) is the value at position (u,v) in the pooling input matrix, G(r,s) is the value at position (r,s) in the pooling output, and y is the edge value of the set region.

[0071] Convolutional neural networks (CNNs) can analyze features within individual data points in power operation data due to their structural characteristics, but they are relatively weak in extracting correlations between sequences. Unlike CNNs, which focus on good local feature extraction capabilities, Long Short-Term Memory (LSTM) networks emphasize learning the correlations between sequences. LSTM is a variant of RNN, and it solves the gradient vanishing or exploding problems that may occur in parameter passing of traditional recurrent neural networks through a special internal "gate" mechanism. Therefore, it is considered the best choice when using RNNs and related neural networks. LSTM has several key components: Indicates the state of the memory unit; i t This represents the input gate, which controls the updating of memory unit information, i.e., how much information needs to be saved from the current network state to the internal state; f t This refers to the forgetting gate, which controls whether information from a previous memory location should be retained in the current memory location; t Indicates the output gate, and the control information C. t Output to the next hidden state.

[0072] These parts together form the streaming computation, as shown in the following formulas (10)-(15):

[0073] f t =σ(W f [h t-1 ,x t ]+b f (10)

[0074] i t =σ(W t [h t-1 ,x t ]+b i (11)

[0075]

[0076]

[0077] o t =σ(W o [h t-1 ,x t ]+b o (14)

[0078] h t =o t ⊙tanh(C t (15)

[0079] In the above formula, σ represents the Sigmoid function; w is the weight term for x, v is the weight term for h, b is the bias term; and ⊙ represents the dot product operator. The LSTM's memory cells receive input and, under the action of the σ activation function, generate signals to control the input gate (i), forget gate (f), and output gate (o). Since the Sigmoid function's range is between (0, 1), the values ​​of i, f, and o are also within the range of (0, 1). The LSTM updates its memory cells and generates the current state output based on the signals of each gate at the current time step, using it as additional input for subsequent time steps s; this process is repeated continuously.

[0080] The advantages of this invention are as follows: Addressing the problem of high computational load in power system operation data due to feature redundancy, a power FDIA feature extraction method based on an improved stacked autoencoder is adopted. By introducing an attention mechanism, the model can adaptively focus on features relevant to the power system attack identification task. This enables the model to more accurately capture changes and anomalies caused by attacks, improving the accuracy of attack identification. A CNN-LSTM-based spoofing attack identification model is constructed, horizontally concatenating the feature vectors extracted by the CNN and LSTM networks to obtain a new fusion vector. This extracts local feature information from the power operation data while considering the relationships between features. Finally, a softmax activation function is used to obtain the probability outputs of FDIA and normal samples, achieving better classification results for FDIA identification. Simultaneously, SSA, as a global optimization algorithm, helps optimize the parameters of the CNN-LSTM model, making it better suited to the power system attack identification task and improving overall performance. Its adaptive characteristics help adapt to changes in power system data and the diversity of attacks, improving the model's adaptability to new attacks and enhancing its robustness. This method is scientifically sound, highly accurate, and applicable to the identification of spoofed data injection attacks in power grids, thus possessing practical significance for maintaining power grid security.

[0081] The present invention will be further described below with reference to the accompanying drawings and specific embodiments. Attached Figure Description

[0082] Figure 1This is the overall flowchart of the present invention.

[0083] Figure 2 This is a diagram of the feature extraction model of SAE based on the attention mechanism of this invention.

[0084] Figure 3 This is a comparison chart of the dimensionality reduction effect of the feature extraction model of SAE based on the attention mechanism improved by this invention.

[0085] Figure 4 This is a diagram of the CNN-LSTM fake data injection attack identification model of the present invention.

[0086] Figure 5 This is a flowchart of the parameters of the SSA-optimized CNN-LSTM fake data injection attack identification model of the present invention.

[0087] Figure 6 This is a comparison chart of the accuracy of the SSA-CNN-LSTM fake data injection attack identification model of this invention.

[0088] Figure 7 This is a comparison chart of the accuracy of the SSA-CNN-LSTM fake data injection attack identification model of this invention.

[0089] Figure 8 This is a comparison chart of the recall rates of the SSA-CNN-LSTM fake data injection attack identification model of this invention.

[0090] Figure 9 This is a comparison chart of the F1-Score of the SSA-CNN-LSTM fake data injection attack identification model of this invention.

[0091] Figure 10 This is a performance comparison chart of the SSA-CNN-LSTM fake data injection attack identification model of this invention with different identification algorithms. Detailed Implementation

[0092] Reference Figure 1-10 A method for identifying spoofed data injection into power grids based on an improved CNN-LSTM, including the following:

[0093] 1. An attention mechanism improves the FDIA feature extraction method of stacked autoencoders.

[0094] Improved Stacked Autoencoders (ISAEs) are a type of deep learning model with the following structure: Figure 1As shown, this algorithm aims to improve the performance of autoencoders by introducing an attention mechanism. The algorithm introduces an attention mechanism layer between the encoder and decoder, enabling the network to learn the features of the input data more flexibly and focus more on information that contributes to spoofing attacks during the reconstruction phase. The specific steps of the algorithm are as follows:

[0095] The specific steps are as follows:

[0096] Step 1: The pre-processed power system operation data to be identified is input into the first autoencoder. The encoder of the first autoencoder compresses the input data to obtain a latent space feature representation. This step maps the input data to a lower-dimensional representation, captures the key features of the input data, and generates compressed and simplified power data features.

[0097] Step 2: Calculate the attention weight for each simplified power data feature, and calculate the attention weight for each feature against spoofing attacks. The attention weight vector for each feature reflects its importance in feature extraction. If a particular feature does not contribute to attack identification, the corresponding value of the attention vector is set to zero to cause the network to ignore that feature.

[0098] Step 3: Multiply the attention weight vector of the first autoencoder with the feature representation to obtain a weighted feature representation. Pass the weighted feature representation as input to the hidden layer of the first autoencoder.

[0099] Step 4: Reconstruct the attack features using the decoder of the first autoencoder, and use the reconstructed attack feature results as the input of the second autoencoder.

[0100] Step 5: Compress the output of the first autoencoder decoder using the encoder of the second autoencoder to obtain the feature representation of the second latent space.

[0101] Step Six: Calculate the second attention weight, and calculate the contribution of each reconstructed feature to the spoofing attack:

[0102] Step 7: Multiply the attention weight vector of the second autoencoder with the feature representation to obtain the weighted feature representation.

[0103] Step 8: Decode the feature representation of the hidden layer of the second autoencoder using the decoder of the second autoencoder to reconstruct the attack features of the second autoencoder:

[0104] Step 9: Calculate the reconstruction error between the reconstructed data and the original data sample, update the model parameters using the backpropagation algorithm, and determine the final number of extracted features based on the magnitude of the reconstruction error under different data dimensions.

[0105] To verify the impact of feature extraction on the recognition results, the results of three common classification models—Naive Bayes, SVM, and KNN—were analyzed and compared. The accuracy and recall before and after feature extraction are shown below. Figure 2 As shown, after feature extraction, the average precision improved by 15.33% and the average recall improved by 13% compared to the data without feature extraction; compared to the traditional stacked autoencoder model, the average precision improved by 2.6% and the average recall improved by 4.6%.

[0106] 2. A method for identifying fake data injection attacks based on SSA-CNN-LSTM

[0107] To accurately identify electricity data injection attacks, this invention proposes a model that integrates CNN and LSTM (CNN-LSTM), the structure of which is as follows: Figure 3 As shown, this method combines the advantages of CNN and LSTM, and concatenates the feature vectors extracted by the two networks horizontally to obtain a new fusion vector. This not only extracts local feature information of power operation data, but also takes into account the relationship between the features. Finally, the softmax activation function is used to obtain the probability output of FDIA and normal samples, so that the identification effect of fake data injection attacks can be better achieved.

[0108] Given the significant impact of CNN-LSTM model network architecture on performance, swarm intelligence optimization algorithms can simulate the movement and behavior patterns of things or organisms in nature to search for optimal solutions within a specific range of solution space. The sparrow search algorithm is a bio-inspired algorithm based on a series of behaviors of a sparrow population during foraging. Considering a population of n sparrows, by simulating the sparrow foraging process, this algorithm seeks optimal solutions for some parameters within a certain range. In a d-dimensional search space, assuming there are several sparrows, the position X of the i-th sparrow in the D-dimensional search space is... id =[x i1 ,...,x id ,...,x iD It can be represented as follows, and its mathematical model is shown in formula (16):

[0109]

[0110] In the formula, t represents the current iteration number; T is the maximum iteration number; α is a uniformly distributed random number between (0,1]; Q is a random number conforming to a standard normal distribution; L is a 1×d matrix with all elements being 1; R2∈[0,2] and ST∈[0.5,1] represent the warning value and the safety value, respectively. When R2<ST, the warning threshold has not been reached, the environment is considered safe, and the discoverer will search a wide area; when R2≥ST, the warning threshold has been reached, the environment is considered dangerous, and the discoverer will immediately leave the current location and move towards a safe area.

[0111] Apart from the discoverer, the remaining sparrows all become participants and their positions are updated according to formula (17):

[0112]

[0113] In the formula: This represents the worst position of the sparrow in the d-th dimension at the t-th iteration of the population. This represents the optimal position of the sparrow in the d-th dimension at the (t+1)-th iteration of the population; when When, it indicates that the i-th participant has low fitness and is in a poor position, requiring a large-scale transfer; when When the i-th joiner has relatively high fitness, it will follow the trail of the best sparrow and find a new position nearby. The position update operation is as shown in formula (18):

[0114]

[0115] In the formula: β is a random number generated according to a normal distribution with a mean of 0 and a variance of 1; K is a random number between [-1, 1], where a positive value is far from the worst sparrow and a negative value is close to the worst sparrow; e is a very small number to avoid the inability to update the position when the denominator is 0; f i f represents the fitness of the i-th sparrow. g and f w These are the best and worst fitness values ​​for the current sparrow population, respectively. In f i ≠f w When f is in a certain position, it indicates that the sparrow is not in an optimal position and is in a relatively dangerous situation, requiring it to move towards the direction of the optimal sparrow; while f i =f w When the time is right, it means that the sparrow is currently in the best position, but due to the appearance of predators, it needs to move closer to other sparrows to avoid potential threats.

[0116] The Sparrow Search Algorithm (SSA) boasts fast convergence, robustness, and stability, making it a more powerful global search algorithm compared to other algorithms. Therefore, this invention utilizes the Sparrow Search Algorithm to optimize the parameters of a CNN-LSTM model, thereby improving the accuracy and efficiency of FDIA (Fault-Total Inspection) identification of secondary devices. The Sparrow Search Algorithm is used to optimize the CNN-LSTM model, such as... Figure 4 As shown.

[0117] The specific steps for optimizing the CNN-LSTM attack detection model using the sparrow search algorithm are as follows:

[0118] Step 1: Construct a CNN-LSTM attack detection model, including the following sub-steps:

[0119] Step 1: Constructing the CNN: Design the structure of the Convolutional Neural Network (CNN) to extract spatial features from the attack data. Select appropriate convolutional layers, pooling layers, and activation functions, and determine the size of the convolutional kernels.

[0120] Step 2: Construct the LSTM part: Design the structure of the Long Short-Term Memory (LSTM) network, and define the number of LSTM layers, the number of hidden units, and other hyperparameters.

[0121] Step 3: Merge CNN and LSTM: Connect the CNN and LSTM to form a unified CNN-LSTM model. This typically involves feeding the output sequence of the CNN into the LSTM for temporal modeling.

[0122] Step 2: Optimize the model parameters of the sparrow search algorithm, including the following sub-steps:

[0123] Step 1: Initialize the parameter range.

[0124] Based on the characteristics of the attack identification task and the scale and complexity of the dataset, the search range of parameters to be optimized is determined, including the number of neurons in the convolutional layer, the size of the convolutional kernel, the size of the pooling kernel, the number of nodes in the LSTM layer, and the number of nodes in the fully connected hidden layer.

[0125] Step 2: Generate the initial population.

[0126] A set of initial network structures is generated randomly, including the number of neurons in the convolutional layers, the kernel size of the convolutional layers, the kernel size of the pooling layers, and the number of nodes in the LSTM layers and fully connected hidden layers.

[0127] Step 3: Assess fitness.

[0128] For each generated network architecture, the model is trained using the training set, and the performance of the FDIA attack identification model is evaluated using the validation set. Based on the evaluation results, the fitness value of each individual is calculated, serving as its discoverer in the population.

[0129] Step 4: Run the sparrow search algorithm.

[0130] In each iteration, based on the basic principles of the sparrow search algorithm, some individuals are selected according to their fitness values ​​for crossover and mutation operations to generate new parameters.

[0131] Step 5: Update the population.

[0132] The population is updated based on the new parameters obtained from the crossover and mutation operations, and the fitness of each individual is recalculated.

[0133] Step 6: Termination conditions.

[0134] The algorithm terminates the search when the minimum error and maximum number of iterations are reached.

[0135] Step 7: Select the optimal solution.

[0136] After the termination condition is met, the individual with the highest fitness is selected from the final population as the optimal solution, which is the parameter of the required CNN-LSTM fake data injection attack identification model.

[0137] Step 3: Output the identification results.

[0138] Evaluate the model's performance using a test set, including metrics such as accuracy, precision, and recall. Ensure the model can effectively distinguish between attacks and legitimate behavior.

[0139] The performance of the power grid spoofing data injection identification model based on the improved CNN-LSTM provided in this invention was comprehensively verified on two different test sets. The model performance was reflected in a bar chart composed of metrics such as confusion matrix, accuracy, precision, recall, and F1-Scor. The identification results are as follows: Figure 5 As shown, the overall accuracy on dataset 1 is 97.43%, and the overall accuracy on dataset 2 is 95.8%. Comparing the proposed method with CNN models, LSTM models, CNN-LSTM models, and other parameter-optimized models, the SSA-CNN-LSTM model performs excellently, accurately identifying each class of samples and outperforming other models overall. Figure 6 , Figure 7 , Figure 8As can be seen, the SSA-CNN-LSTM power grid spoofing attack identification method proposed in this invention improves the accuracy, precision, recall, and F1 score by an average of 10.23%, 7.45%, 11.88%, and 13.85%, respectively, in Dataset 1. In Dataset 2, the four evaluation methods described in this invention improve by an average of 8.16%, 9.46%, 7.68%, and 12.05%, respectively. This fully demonstrates its stability and reliability in implementing FDIA detection and identification under power grid topology. The false alarm rate among various types of FDIA samples is low, which proves the high accuracy and high stability of the proposed model. To verify the recognition performance of the SSA-CNN-LSTM method of this invention, the model of this invention is compared with currently popular classification algorithms. The comparison results are as follows. Figure 9 As shown, the model proposed in this invention has a higher overall performance in FDIA recognition than other classifiers, with an average improvement of 38.23%, 24.17%, 22.58%, and 39.16% in accuracy, precision, recall, and F1 index, respectively.

[0140] In summary, the power CPS generalized spurious data injection attack identification method based on deep forest of the present invention can achieve high-precision identification of FDIA under the conditions of imbalanced dataset and high data dimensionality. Moreover, the model has a low false alarm rate and is not prone to overfitting. The FDIA identification model provided by the present invention effectively improves the identification accuracy and stability of FDIA.

[0141] The SSA-CNN-LSTM-based method proposed in this invention demonstrates significant advantages in terms of comprehensiveness and stability of detection and recognition capabilities. It can also maintain high recognition accuracy by adapting to different power topologies. The method proposed in this invention effectively identifies false data injection attacks in the power grid, which is beneficial to the safe and stable operation of the power system.

[0142] The software program of this invention is developed based on automation and computer processing technology, which is familiar to those skilled in the art.

[0143] The above description is merely a specific embodiment of the present invention, and the various examples do not constitute a limitation on the substantive content of the present invention.

Claims

1. A power grid false data injection identification method based on an improved CNN-LSTM, characterized in that: The preprocessed power operation data samples to be identified are input into the trained improved stacked autoencoder feature extraction model, and the reconstruction error is calculated. The loss between the reconstructed data and the original data is calculated, and the model parameters are updated using the backpropagation algorithm. The number of features to be extracted is selected based on the reconstruction error. The dataset for attack identification with extracted features is divided into training set, validation set and test set. A fake data injection attack identification model based on CNN-LSTM is constructed. The model is trained using the training set. The parameters of the CNN-LSTM model are optimized by inputting the sparrow search algorithm into the validation set. Finally, the identification results are verified using the test set. In constructing the spoofing attack identification model based on CNN-LSTM, the steps of the spoofing attack feature extraction method based on the improved stacked autoencoder are as follows: The improved stacked autoencoder structure adds an attention mechanism layer before the hidden layer of the autoencoder. The original power operation data is compressed by the encoder to obtain a feature representation in the latent space. The attention weight vector of each simplified feature is calculated. The attention weight determines the importance of different parts of the input data in feature extraction. If the attention vector finds that a certain feature does not contribute to attack identification, it will set the corresponding specific value in the vector to zero, causing the network to forget this feature. The attention weight vector is multiplied with the feature and used as the feature representation input to the hidden layer. Finally, the decoder performs decoding and reconstruction, calculates the loss between the reconstructed data and the original data, and uses the backpropagation algorithm to update the model parameters. The specific steps are as follows: Step 1: Input the power system operation data to be identified after simple preprocessing into the first autoencoder. The encoder of the first autoencoder compresses the input data to obtain a feature representation in the latent space. This step maps the input data to a lower-dimensional representation, captures the key features of the input data, and generates compressed and simplified power data features; Step 2: Calculate the attention weight of each simplified power data feature, calculate the attention weight of each feature against spoofing attacks, and the attention weight vector of each feature reflects its importance in feature extraction; If a particular feature does not contribute to attack identification, the attention vector sets the corresponding value to zero to cause the network to ignore the feature. Step 3: Multiply the attention weight vector and feature representation of the first autoencoder to obtain a weighted feature representation; pass the weighted feature representation as input to the hidden layer of the first autoencoder. Step 4: Reconstruct the attack features using the decoder of the first autoencoder, and use the reconstructed attack feature results as the input of the second autoencoder; Step 5: Compress the output of the first autoencoder decoder using the encoder of the second autoencoder to obtain the feature representation of the second latent space; Step 6: Calculate the second attention weight, and calculate the contribution of each reconstructed feature to the fake data injection attack; Step 7: Multiply the attention weight vector of the second autoencoder with the feature representation to obtain the weighted feature representation; Step 8: Decode the feature representation of the hidden layer of the second autoencoder using the decoder of the second autoencoder to reconstruct the attack features of the second autoencoder; Step 9: Calculate the reconstruction error between the reconstructed data and the original data sample, update the model parameters using the backpropagation algorithm, and determine the final number of extracted features based on the magnitude of the reconstruction error under different data dimensions.

2. The power grid false data injection identification method based on the improved CNN-LSTM according to claim 1, characterized in that, The specific steps of optimizing the attack detection method of CNN-LSTM using the sparrow search algorithm are as follows: Step 1: Construct a CNN-LSTM attack detection model, including the following sub-steps: Step 1: Constructing the CNN: Design the structure of the Convolutional Neural Network (CNN) to extract spatial features from the attack data; Choose appropriate convolutional layers, pooling layers, and activation functions, and determine the size of the convolutional kernels; Step 2: Construct the LSTM part: Design the structure of the Long Short-Term Memory (LSTM) network, and define the number of LSTM layers, the number of hidden units, and other hyperparameters; Step 3: Merge CNN and LSTM: Connect the CNN and LSTM to form a CNN-LSTM model; this usually involves inputting the output sequence of the CNN into the LSTM for temporal modeling. Step 2: Optimize the model parameters of the sparrow search algorithm, including the following sub-steps: Step 1: Initialize the parameter range; Based on the characteristics of the attack identification task and the scale and complexity of the dataset, the search range of parameters to be optimized is determined, including the number of neurons in the convolutional layer, the size of the convolutional kernel, the size of the pooling kernel, the number of nodes in the LSTM layer, and the number of nodes in the fully connected hidden layer. Step 2: Generate the initial population; A set of initial network structures is generated randomly, including the number of neurons in the convolutional layers, the kernel size of the convolutional layers, the kernel size of the pooling layers, and the number of nodes in the LSTM layers and fully connected hidden layers. Step 3: Assess fitness; For each generated network structure, the model is trained using the training set and the performance of the FDIA attack identification model is evaluated using the validation set; the fitness value of each individual is calculated based on the evaluation results, serving as its discoverer in the population; Step 4: Run the sparrow search algorithm; In each iteration, based on the basic principles of the sparrow search algorithm, some individuals are selected according to their fitness values ​​for crossover and mutation operations to generate new parameters. Step 5: Update the population; The population is updated based on the new parameters obtained from the crossover and mutation operations, and the fitness of each individual is recalculated. Step 6: Termination Condition; The algorithm terminates the search when the minimum error and the maximum number of iterations are reached. Step 7: Select the optimal solution; After the termination condition is met, the individual with the highest fitness is selected from the final population as the optimal solution, which is the parameter of the required CNN-LSTM fake data injection attack identification model. Step 3: Output the identification results; Use a test set to evaluate the model's performance, including accuracy, precision, and recall metrics; ensure the model can effectively identify attacks and normal behavior.

Images