Method for detecting false data injection attack of power monitoring system and related device

Abstract

The application belongs to the technical field of power monitoring system attack detection, and discloses a power monitoring system false data injection attack detection method and related device, which comprises inputting the measured data of the power monitoring system to be detected into a pre-trained power monitoring system false data injection attack detection model to obtain the detection category of the measured data to be detected; the pre-trained power monitoring system false data injection attack detection model is obtained by iteratively training an initial classification model; the labeled measured data sample is input into the initial classification model, the supervision loss is obtained through the main classification head, the unlabeled measured data sample is input into the initial classification model, the unsupervised loss is obtained through the main classification head and the pseudo classification head, the overall loss is obtained by combining the supervision loss and the unsupervised loss, and the model parameters of the initial classification model are updated. The detection performance decline problem in the case of a small amount of labeled measured data and unbalanced measured data categories is solved, and the attack detection accuracy is improved.

Description

Technical Field

[0001] This invention belongs to the field of attack detection technology for power monitoring systems, and relates to a method and related apparatus for detecting fake data injection attacks in power monitoring systems. Background Technology

[0002] With the rapid development of power communication and digital technologies, traditional power systems are gradually transforming into new information-based and intelligent power systems. The shift from a closed to an open power system has led to a high dependence of power monitoring systems on advanced technologies such as sensing, control, and communication, making them highly vulnerable to cyberattacks. False data injection (FDI) attacks are considered one of the most threatening malicious cyberattacks due to their stealth and destructive power. Undetected FDI attacks can mislead the system's estimation of its current operating status, causing the control center to make incorrect decisions and triggering serious physical power monitoring system failures. Therefore, how to detect whether a system is under FDI attack is of great significance for building a secure and stable power monitoring system.

[0003] In recent years, researchers have proposed data-driven methods based on machine learning to quickly and accurately detect FDI attacks. Supervised learning, as a paradigm of machine learning, has been widely applied to FDI attack detection. However, manually labeling the massive amounts of measurement data obtained from power monitoring systems is time-consuming and labor-intensive, failing to meet the training requirements of supervised learning methods, which require a large amount of labeled data. Therefore, some researchers have begun to explore the application of semi-supervised learning in scenarios with massive amounts of unlabeled measurement data and limited amounts of labeled measurement data. However, previous methods have ignored the fact that the attacked state of the system is far less than the normal operating state. This class imbalance brings additional challenges to accurate FDI detection, leading to a significant decrease in detection performance. Specifically, under these non-ideal training conditions, the neural networks trained by existing machine learning-based data-driven methods tend to over-focus on a large amount of normal measurement data and overfit to a small amount of labeled measurement data, ultimately resulting in lower precision on normal measurement data and lower recall on attacked measurement data. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a method and related apparatus for detecting false data injection attacks in power monitoring systems.

[0005] To achieve the above objectives, the present invention employs the following technical solution:

[0006] In a first aspect, the present invention provides a method for detecting spoofed data injection attacks in a power monitoring system, comprising:

[0007] Acquire the measurement data to be detected in the power monitoring system;

[0008] The measurement data to be detected is input into a pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected.

[0009] The detection categories include normal measurement data and attack measurement data;

[0010] The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss.

[0011] Optionally, the feature extractor structure is a two-layer multilayer perceptron connected to each other. Each multilayer perceptron consists of a single fully connected layer and a connected Dropout layer for reducing model overfitting.

[0012] Both the main classification header and the pseudo-classification header are single-layer fully connected layers;

[0013] When iteratively training the initial classification model, the main classifier and pseudo-classifier use independently learned weights and biases.

[0014] Optionally, the step of inputting labeled measurement data samples into the initial classification model and obtaining the supervised loss through the main classification head includes: obtaining the supervised loss using the following formula.

[0015]

[0016] in, A collection of labeled measurement data samples. D represents L The i-th measurement data sample in the middle, N represents the label of the i-th measurement data sample. l This indicates the number of labeled measurement data samples. Output of the main classification header h The model predicts the distribution, l ce This is the cross-entropy function.

[0017] Optionally, the step of inputting unlabeled measurement data samples into the initial classification model and obtaining the unsupervised loss through the main classification head and pseudo-classification head includes: obtaining the unsupervised loss using the following formula.

[0018]

[0019] in, A collection of unlabeled measurement data samples. D represents U The i-th measurement data sample is given, and N represents the number of unlabeled measurement data samples. for pseudo-tags according to Calculations show that For pseudo-master classification head h pseudo Output The model predicts the distribution, q i for The sample is assigned weights.

[0020] Optionally, the The sample weights are assigned by adjusting the output of the main classification head h. Model predicts distribution for Assign weights q to the samples i The process is defined as a linear programming problem, and the linear programming problem is transformed into an optimal transport problem and solved quickly using the Sinkhorn-Knopp algorithm;

[0021] The optimization objective of the linear programming problem is:

[0022]

[0023] Where K is the number of detection categories, q ij p represents the j-th element of the weight distribution assigned to the i-th sample. ij Let represent the j-th element of the probability distribution predicted by the model for i samples, and Δ represent the feasible solution space that satisfies the constraints of the linear programming problem.

[0024] The constraints of the linear programming problem are: a) weights are evenly distributed among the detection categories; b) in each iteration, the measurement data samples to which weights are assigned are the measurement data samples with higher confidence in the current model, and the proportion of measurement data samples to which weights are assigned gradually increases as the model training progresses.

[0025] Optionally, the The sample allocation weights are obtained in the following way:

[0026] T1: Define the prediction matrix Where, p ij Let ∑ represent the j-th element of the model prediction probability distribution of i measurement data samples. ij pij =N; K is the number of detection categories;

[0027] Define the weight matrix Where; q ij This represents the j-th element of the sample assignment weights for the i-th measurement data sample.

[0028] T2: Construct the following optimal transmission problem:

[0029]

[0030]

[0031]

[0032]

[0033]

[0034] Where <·> denotes the matrix inner product, and Let represent the variable to be optimized, the prediction matrix, and the cost matrix in the optimal transport problem, respectively, and let U(r,c) represent the space of all feasible solutions that satisfy the constraints. and They represent Row and column projections, and These are slack variables, each of which is non-negative. It is a non-negative slack variable, ω≥0,1 K This represents a vector of dimension K consisting entirely of 1s. This represents the upper bound of the weights assigned to each detection category, where ρ∈[0,1] represents the proportion of the measurement data samples assigned weights to all measurement data samples.

[0035] T3: Solve the optimal transmission problem in T2 to obtain the optimal weight allocation matrix. Based on the optimal weight allocation matrix Obtain the weight assignment matrix Q; use the value of the i-th row of the weight assignment matrix Q as... The sample is assigned weights.

[0036] Optionally, the combination of supervised loss and unsupervised loss to obtain the overall loss includes:

[0037] The overall loss L is obtained from the following formula. e :

[0038]

[0039] in, To monitor losses, Let ξ be the unsupervised loss, and let ξ be a hyperparameter used to balance the contributions of supervised and unsupervised losses.

[0040] When updating the model parameters of the initial classification model based on the overall loss, the model parameters of the initial classification model are updated using the Adam algorithm based on the overall loss.

[0041] In a second aspect, the present invention provides a system for detecting spoofed data injection attacks in a power monitoring system, comprising:

[0042] The data acquisition module is used to acquire the measurement data to be detected in the power monitoring system;

[0043] The attack detection module is used to input the measurement data to be detected into the pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected.

[0044] The detection categories include normal measurement data and attack measurement data;

[0045] The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss.

[0046] In a third aspect, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described method for detecting false data injection attacks in a power monitoring system.

[0047] In a fourth aspect, the present invention provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the above-described method for detecting false data injection attacks in a power monitoring system.

[0048] Compared with the prior art, the present invention has the following beneficial effects:

[0049] This invention discloses a method for detecting fake data injection attacks in power monitoring systems. The method is based on a pre-defined model for detecting fake data injection attacks in power monitoring systems. This model is obtained through iterative training of an initial classification model, which includes a feature extractor and a main classification head and a pseudo-classification head connected to the feature extractor. This model structure, containing a main classification head and a pseudo-classification head, allows for independent generation and utilization of pseudo-labels during self-training. This effectively reduces training errors accumulated in the main classification head due to class imbalance during self-training, helping the model learn feature representations of normal and attack measurement data with higher discriminative power in the feature space. It also reduces error accumulation during training and improves the utilization rate of attack measurement data through reweighting. This solves the problem of decreased detection performance of data-driven machine learning methods when dealing with limited labeled measurement data and class imbalance, ultimately improving the accuracy of detecting fake data injection attacks in power monitoring systems.

[0050] Furthermore, the sample allocation weights are defined as a linear programming problem by assigning sample weights based on the model prediction distribution output by the main classification head. The linear programming problem is then transformed into an optimal transfer problem and solved quickly using the Sinkhorn-Knopp algorithm. The weighting algorithm based on optimal transfer is used to reweight the unlabeled measurement samples participating in self-training, effectively improving the utilization rate of a small amount of attack measurement data and the reliability of the training process. Attached Figure Description

[0051] Figure 1 This is a flowchart of a method for detecting fake data injection attacks in a power monitoring system according to an embodiment of the present invention.

[0052] Figure 2 This is a topology diagram of the IEEE 14-node standard test system according to an embodiment of the present invention.

[0053] Figure 3 The graph shows the detection accuracy of the false data injection attack detection method for the power monitoring system according to an embodiment of the present invention under different measurement noise and label ratios.

[0054] Figure 4 This is a graph showing the change in detection accuracy during the training process of the false data injection attack detection method for the power monitoring system according to an embodiment of the present invention. Detailed Implementation

[0055] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0056] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0057] The present invention will now be described in further detail with reference to the accompanying drawings:

[0058] See Figure 1 In one embodiment of the present invention, a method for detecting false data injection attacks in a power monitoring system is provided to solve the problem of decreased detection performance of data-driven methods based on machine learning when there is a small amount of labeled measurement data and the measurement data categories are imbalanced.

[0059] Specifically, the method for detecting fake data injection attacks in this power monitoring system includes the following steps:

[0060] S1: Acquire the measurement data to be detected in the power monitoring system.

[0061] S2: Input the measurement data to be detected into the pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected.

[0062] The detection categories include normal measurement data and attack measurement data;

[0063] The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss.

[0064] This invention discloses a method for detecting fake data injection attacks in power monitoring systems. The method is based on a pre-defined model for detecting fake data injection attacks in power monitoring systems. This model is obtained through iterative training of an initial classification model, which includes a feature extractor and a main classification head and a pseudo-classification head connected to the feature extractor. This model structure, containing a main classification head and a pseudo-classification head, allows for independent generation and utilization of pseudo-labels during self-training. This effectively reduces training errors accumulated in the main classification head due to class imbalance during self-training, helping the model learn feature representations of normal and attack measurement data with higher discriminative power in the feature space. It also reduces error accumulation during training and improves the utilization rate of attack measurement data through reweighting. This solves the problem of decreased detection performance of data-driven machine learning methods when dealing with limited labeled measurement data and class imbalance, ultimately improving the accuracy of detecting fake data injection attacks in power monitoring systems.

[0065] In one possible implementation, the feature extractor structure is a two-layer multilayer perceptron connected to each other. Each multilayer perceptron consists of a single fully connected layer and a Dropout layer connected to each other to reduce model overfitting. Both the main classifier head and the pseudo-classifier head are single fully connected layers. When iteratively training the initial classification model, the main classifier head and the pseudo-classifier head use independently learned weights and biases.

[0066] In one possible implementation, inputting labeled measurement data samples into the initial classification model and obtaining the supervised loss through the main classification head includes: obtaining the supervised loss using the following formula.

[0067]

[0068] in, A collection of labeled measurement data samples. D represents L The i-th measurement data sample in the middle, N represents the label of the i-th measurement data sample. lThis indicates the number of labeled measurement data samples. Output of the main classification header h The model predicts the distribution, l ce This is the cross-entropy function.

[0069] Optionally, the step of inputting unlabeled measurement data samples into the initial classification model and obtaining the unsupervised loss through the main classification head and pseudo-classification head includes: obtaining the unsupervised loss using the following formula.

[0070]

[0071] in, A collection of unlabeled measurement data samples. D represents U The i-th measurement data sample is given, and N represents the number of unlabeled measurement data samples. for pseudo-tags according to Calculations show that For pseudo-master classification head h pseudo Output The model predicts the distribution, q i for The sample is assigned weights.

[0072] Optionally, the The sample weights are assigned by adjusting the output of the main classification head h. Model predicts distribution for Assign weights q to the samples i The process is defined as a linear programming problem, and the linear programming problem is transformed into an optimal transport problem and solved quickly using the Sinkhorn-Knopp algorithm.

[0073] The optimization objective of the linear programming problem is:

[0074]

[0075] Where K is the number of detection categories, q ij p represents the j-th element of the weight distribution assigned to the i-th sample. ij Let represent the j-th element of the probability distribution predicted by the model for i samples, and let Δ represent the feasible solution space that satisfies the constraints of the linear programming problem.

[0076] The constraints of the linear programming problem are: a) weights are evenly distributed among the detection categories; b) in each iteration, the measurement data samples to which weights are assigned are the measurement data samples with higher confidence in the current model, and the proportion of measurement data samples to which weights are assigned gradually increases as the model training progresses.

[0077] Optionally, the The sample allocation weights are obtained in the following way:

[0078] T1: Define the prediction matrix Where, ∑ ij p ij =N; K is the number of detection categories. Define the weight matrix. in,

[0079] T2: Construct the following optimal transmission problem:

[0080]

[0081]

[0082]

[0083]

[0084]

[0085] Where 〈·〉 denotes the matrix inner product, and Let represent the variable to be optimized, the prediction matrix, and the cost matrix in the optimal transport problem, respectively, and let U(r,c) represent the space of all feasible solutions that satisfy the constraints. and They represent Row and column projections, and These are slack variables, each of which is non-negative. It is a non-negative slack variable, ω≥0,1 K This represents a vector of dimension K consisting entirely of 1s. This represents the upper bound of the weights assigned to each detection category, where ρ∈[0,1] represents the proportion of the measurement data samples assigned weights to all measurement data samples.

[0086] T3: Solve the optimal transmission problem in T2 to obtain the optimal weight allocation matrix. Based on the optimal weight allocation matrix Obtain the weight assignment matrix Q; use the value of the i-th row of the weight assignment matrix Q as... The sample is assigned weights.

[0087] In one possible implementation, obtaining the overall loss by combining supervised loss and unsupervised loss includes: obtaining the overall loss L using the following formula. e :

[0088]

[0089] in, To monitor losses, Let ξ be the unsupervised loss, and ξ be a hyperparameter used to balance the contributions of supervised and unsupervised losses.

[0090] Optionally, when updating the model parameters of the initial classification model based on the overall loss, the model parameters of the initial classification model are updated using the Adam algorithm based on the overall loss.

[0091] In one possible implementation, the pre-trained power monitoring system fake data injection attack detection model is obtained through the following specific steps:

[0092] S11: Obtain the measurement dataset from the actual power monitoring system, including a massive amount of unlabeled measurement data and a small amount of labeled measurement data, of which the total amount of attacked measurement data is far less than the total amount of normal measurement data.

[0093] Specifically, the dataset obtained is a measurement dataset from an actual power monitoring system. This dataset includes a massive amount of unlabeled measurement data and a small amount of labeled measurement data, with the total amount of attacked measurement data being far less than the total amount of normal measurement data. All measurement data is per-unit quantized, a numerical processing method commonly used in power system analysis and engineering calculations. By converting various physical quantities (such as voltage, current, and power) into relative values, the calculation and analysis process is simplified. The unit is pu (unit of measurement unit).

[0094] S12: Define the initial classification model to learn to distinguish between normal and attack measurement data in the feature space.

[0095] Specifically, a classification model φ is defined, including a feature extractor ψ, a main classifier h, and a classification head h. pseudo This model is used to learn to distinguish between normal and aggressive measurement data in the feature space. Specifically, ψ has a two-layer multilayer perceptron (MLP) structure, each layer consisting of a single fully connected layer and a Dropout layer to reduce model overfitting; h and h pseudo Both are single-layer fully connected layers; ψ connects h and h' respectively. pseudo .

[0096] S13: Input the labeled measurement data into the initial classification model and calculate the supervised loss for the e-th iteration.

[0097] Specifically, a dataset is defined as a collection of a small amount of labeled measurement data. in, D represents L The i-th measurement sample, N represents the one-hot label of the i-th measurement sample. l This represents the number of samples. Secondly, [the following will be done / will ... Input model φ, calculate the supervised loss in the e-th iteration. That is, the model prediction distribution output by the main classifier head h. With sample Cross-entropy between them.

[0098] S14: Input the unlabeled measurement data into the initial classification model and calculate the unsupervised loss for the e-th iteration.

[0099] Specifically, the collection of unlabeled measurement data is defined as a dataset. in, D represents U The i-th measurement sample is given, and N represents the number of samples. Next, the... Input model φ, and the predicted distribution output by the main classifier h. for Assign sample weights q that satisfy specific constraints i Specifically, it includes the following steps:

[0100] 1) Formulaic weight allocation process. Define a prediction matrix. Where p ij Let ∑ represent the j-th element of the probability distribution predicted by the model for i samples, i.e., ∑ ij p ij =N; Define a weight matrix Where q ij This represents the j-th element of the weight distribution assigned to the i-th sample, i.e. The optimization objective of the weight allocation process is as follows:

[0101]

[0102] Where KL(·) represents the Kullback–Leibler divergence, i.e. Represents entropy, that is Let <·> denote the matrix inner product, then the final form of the objective function to be optimized is:

[0103]

[0104] 2) Define the constraints that the weighting process must satisfy. To prevent the model from over-focusing on a large amount of normal measurement data and overfitting to a small amount of labeled measurement data, two specific constraints are set: a. The weights should be evenly distributed among the K classes; b. In each iteration, the samples to which weights are assigned should be a subset of samples with high confidence in the current model, and the proportion of these samples should gradually increase as the model training progresses. The above-mentioned constrained weighting process can be viewed as a linear programming problem, i.e.:

[0105]

[0106]

[0107] Q1 K +u=1 N ,

[0108]

[0109]

[0110] in, and It is a slack variable in which each term is non-negative. It is a non-negative slack variable (ω≥0), 1 K This represents a vector of dimension K consisting entirely of 1s. This represents the upper bound of the weights assigned to each class, where ρ∈[0,1] represents the proportion of the samples assigned weights to all samples.

[0111] 3) Transform the linear programming problem into the basic form of the optimal transport problem. The transformed optimal transport problem is as follows:

[0112]

[0113]

[0114]

[0115] in, and Let represent the variable to be optimized, the prediction matrix, and the cost matrix in the optimal transmission, respectively, and U(r,c) represent the feasible solution space that satisfies the constraints. and They represent The row and column projections, i.e.:

[0116]

[0117]

[0118] The optimal solution to this optimal transmission problem satisfies the following form:

[0119]

[0120] in, and Let α and β represent two non-negative scaling variables, and ε be the regularization parameter. α and β can be solved using a fixed-point iterative algorithm, i.e.:

[0121]

[0122] 4) Obtain the sample The assigned weight q i According to the solution The weight distribution matrix Q is known, therefore q i This represents the value corresponding to the i-th row of the weight matrix Q.

[0123] Finally, Input model φ, calculate the unsupervised loss in the e-th iteration. Among them, the model prediction distribution is determined by the pseudo-classification head h. pseudo Output, i.e. pseudo-tags according to Calculated. That is, the model predicts the distribution. With pseudo-tags The weighted cross-entropy between them.

[0124] S15: Calculate the overall loss in the e-th iteration of the initial classification model. Where ξ is a hyperparameter used to balance the contributions of supervised loss and unsupervised loss, and the model parameters of the initial classification model are updated using the Adam algorithm. When the initial classification model is updated to convergence, proceed to S16; otherwise, return to S13.

[0125] S16: Obtain a pre-trained power monitoring system fake data injection attack detection model for detecting detection categories of unknown measurement data.

[0126] In one possible implementation, see Figure 2 The IEEE 14-node standard test system provided by MATPOWER was used to simulate the operation of a real power grid. Real load data from the ElectricityLoadDiagrams2011-2014 dataset was used to simulate natural load patterns, and the load data was scaled to match the power demand scale in the test system.

[0127] The test system generates different measurement datasets based on different experimental parameter settings. The experimental parameters include the class imbalance ratio σ, the labeled ratio λ, the number of attacking nodes k, and the attack intensity s. Among them, σ = number of normal measurement samples / number of attack measurement samples, and λ = number of labeled samples / total number of samples.

[0128] Each dataset in each setting includes 12,000 data points, divided into training, testing, and validation sets in a 4:1:1 ratio.

[0129] First, all measurement data were preprocessed using min-max standardization.

[0130] Secondly, an initial classification model φ is constructed, including a feature extractor ψ consisting of two fully connected layers and a Dropout layer, and a main classification head h and a pseudo classification head h consisting of a single fully connected layer. pseudo Among them, h and h pseudo The weights and biases are learned independently. Φ is trained for 100 epochs using the standard Adam optimizer with an initial learning rate of 0.002, and the learning rate is adjusted according to the cosine period.

[0131] Finally, the relevant parameters of the method proposed in this invention are set. The proportion ρ of the weighted measurement data samples to all measurement data samples increases linearly from 0 to 1 in each training round, the regularization parameter ε is set to 100, and the hyperparameter ξ that balances the contributions of supervised loss and unsupervised loss is set to 1.

[0132] Accuracy is chosen as the metric to intuitively measure overall detection performance. Precision and Recall are chosen to measure detection performance for each category separately. The formulas for calculating these metrics are as follows:

[0133]

[0134]

[0135]

[0136] Wherein, TP, TN, FP, and FN represent correctly classified attacked samples, correctly classified normal samples, incorrectly classified normal samples, and incorrectly classified attacked samples, respectively.

[0137] Table 1

[0138]

[0139] Table 1 shows the experimental results of the detection accuracy of the proposed method and the baseline method. The parameter settings are as follows: when λ = 0.05, σ ∈ {1, 10, 20, 30}; when σ = 40, λ ∈ {0.05, 0.1, 0.15, 0.2}; s ∈ {0.2, 0.3}; k ∈ {2, 3}. The baseline methods are: SL: using the same model structure as the proposed method, but training only on labeled data, learning the mapping relationship between input features and labels by minimizing cross-entropy loss.

[0140] AAE stands for Adversarial AutoEncoders, a neural network model consisting of an autoencoder and a generative adversarial network. It can learn effective data representations and make predictions by using a large amount of unlabeled data and a small amount of labeled data, by incorporating label information into hidden representations and using generative adversarial networks to force these representations to match a predefined distribution.

[0141] Referring to Table 1, it can be observed that the comparative method exhibits a significant performance decline as the class imbalance ratio σ increases when the labeled proportion λ is fixed; conversely, it exhibits a significant performance decline as the labeled proportion λ decreases when the class imbalance ratio σ is fixed. In contrast, the method proposed in this invention maintains a high detection accuracy, at least 97.25%.

[0142] Table 2

[0143]

[0144] Table 2 shows the experimental results of the detection precision and recall of the proposed method and the baseline method for normal and attack categories. Overall, the baseline method exhibits low precision for the normal category and low recall for the attack category under conditions of class imbalance and limited labeled measurement data. In contrast, the proposed method maintains high detection performance across various scenarios.

[0145] See Figure 3 The graph shows the change in detection accuracy of the proposed method as the measurement noise level increases, with an imbalance ratio of σ = 40, s = 0.2, and k = 3. It can be seen that the method also has a certain robustness to measurement noise; the detection accuracy decreases by no more than 4% as the measurement noise increases from 2% to 10%.

[0146] See Figure 4 The graph shows the change in detection accuracy during the training process of the method proposed in this invention (λ = 0.05, s = 0.2, k = 3). It can be seen that the accuracy increases rapidly in the early stage and then remains stable at a high level, reflecting the stability of the training process of this method.

[0147] The following are embodiments of the apparatus of the present invention, which can be used to execute embodiments of the method of the present invention. For details not disclosed in the apparatus embodiments, please refer to the embodiments of the method of the present invention.

[0148] In another embodiment of the present invention, a false data injection attack detection system for a power monitoring system is provided, which can be used to implement the above-mentioned false data injection attack detection method for a power monitoring system. Specifically, the false data injection attack detection system for a power monitoring system includes a data acquisition module and an attack detection module.

[0149] The data acquisition module is used to acquire the measurement data of the power monitoring system to be detected; the attack detection module is used to input the measurement data to be detected into the pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected.

[0150] The detection categories include normal measurement data and attack measurement data.

[0151] The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss.

[0152] All relevant content of each step involved in the aforementioned embodiments of the power monitoring system fake data injection attack detection method can be referenced to the functional description of the corresponding functional module of the power monitoring system fake data injection attack detection system in the embodiments of the present invention, and will not be repeated here.

[0153] The module division in this embodiment of the invention is illustrative and represents only one logical functional division. In actual implementation, other division methods may be used. Furthermore, the functional modules in the various embodiments of the invention can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0154] In another embodiment of the present invention, a computer device is provided, comprising a processor and a memory. The memory stores a computer program, which includes program instructions. The processor executes the program instructions stored in the computer storage medium. The processor may be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. It is the computing and control core of the terminal, suitable for implementing one or more instructions, specifically suitable for loading and executing one or more instructions from the computer storage medium to achieve a corresponding method flow or corresponding function. The processor described in this embodiment of the present invention can be used in the operation of a method for detecting false data injection attacks in a power monitoring system.

[0155] In another embodiment of the present invention, a storage medium is provided, specifically a computer-readable storage medium (Memory), which is a memory device in a computer device used to store programs and data. It is understood that the computer-readable storage medium here can include both the built-in storage medium in the computer device and extended storage media supported by the computer device. The computer-readable storage medium provides storage space that stores the terminal's operating system. Furthermore, the storage space also stores one or more instructions suitable for loading and execution by a processor. These instructions can be one or more computer programs (including program code). It should be noted that the computer-readable storage medium here can be high-speed RAM or non-volatile memory, such as at least one disk storage device. The processor can load and execute one or more instructions stored in the computer-readable storage medium to implement the corresponding steps of the method for detecting false data injection attacks in a power monitoring system in the above embodiments.

[0156] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0157] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0158] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0159] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0160] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for detecting spoofed data injection attacks in a power monitoring system, characterized in that, include: Acquire the measurement data to be detected in the power monitoring system; The measurement data to be detected is input into a pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected. The detection categories include normal measurement data and attack measurement data; The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss. The process of inputting labeled measurement data samples into the initial classification model and obtaining the supervised loss through the main classification head includes: obtaining the supervised loss using the following formula. : in, A collection of labeled measurement data samples. express The Middle A sample of measurement data. Indicates the first Labels for each measurement data sample This indicates the number of labeled measurement data samples. Main category head Output The model predicts the distribution. It is the cross-entropy function; The process of inputting unlabeled measurement data samples into the initial classification model and obtaining the unsupervised loss through the main classification head and pseudo-classification head includes: obtaining the unsupervised loss using the following formula. : in, A collection of unlabeled measurement data samples. express The Middle A sample of measurement data. This represents the sample size of the unlabeled measurement data. for pseudo-tags according to Calculations show that Classifying pseudo-masters Output The model predicts the distribution. for The sample is assigned weights; The The sample weights are assigned by adjusting the main classification head. Output Model predicts distribution for Assign weights to samples The process is defined as a linear programming problem, and the linear programming problem is transformed into an optimal transport problem and solved quickly using the Sinkhorn-Knopp algorithm; The optimization objective of the linear programming problem is: in, To detect the number of categories, Indicates the first The nth sample is assigned a weight distribution. One element, express The probability distribution predicted by the model for the nth sample is... One element, This represents the feasible solution space that satisfies the constraints of the linear programming problem. The constraints of the linear programming problem are: a) the weights are evenly distributed among the detection categories; b) in each iteration, the measurement data samples to which weights are assigned are the measurement data samples with higher confidence of the model at present, and the proportion of measurement data samples to which weights are assigned gradually increases as the model training progresses. The The sample allocation weights are obtained in the following way: T1: Define the prediction matrix ;in, express The model predicts the probability distribution of the nth measurement data sample. One element, ; Number of categories detected; Define the weight matrix ;in; Indicates the first The sample allocation weight of the measurement data sample. One element, ; T2: Construct the following optimal transmission problem: in, Represents the inner product of matrices. , and Let these represent the variable to be optimized, the prediction matrix, and the cost matrix in the optimal transport problem, respectively. Let represent the space of all feasible solutions that satisfy the constraints. and They represent Row and column projections, and These are slack variables, each of which is non-negative. , It is a non-negative slack variable. , The dimension is A vector of all 1s This represents the upper bound for assigning weights to each detection category. This represents the proportion of the measurement data samples to which weights have been assigned to them out of all measurement data samples. T3: Solve the optimal transmission problem in T2 to obtain the optimal weight allocation matrix. ,according to Obtain the weight allocation matrix ; Assign weight matrix The The value of the row as The sample is assigned weights.

2. The method for detecting fake data injection attacks in a power monitoring system according to claim 1, characterized in that, The feature extractor structure is a two-layer multilayer perceptron connected to each other. Each multilayer perceptron consists of a single fully connected layer and a connected Dropout layer to reduce model overfitting. Both the main classification header and the pseudo-classification header are single-layer fully connected layers; When iteratively training the initial classification model, the main classifier and pseudo-classifier use independently learned weights and biases.

3. The method for detecting fake data injection attacks in a power monitoring system according to claim 1, characterized in that, The overall loss obtained by combining supervised loss and unsupervised loss includes: The overall loss is obtained using the following formula. : in, To monitor losses, Loss due to lack of supervision Hyperparameters used to balance the contributions of supervised and unsupervised losses; When updating the model parameters of the initial classification model based on the overall loss, the model parameters of the initial classification model are updated using the Adam algorithm based on the overall loss.

4. A power monitoring system for detecting fake data injection attacks based on the method for detecting fake data injection attacks in a power monitoring system according to claim 1, characterized in that, include: The data acquisition module is used to acquire the measurement data to be detected in the power monitoring system; The attack detection module is used to input the measurement data to be detected into the pre-trained power monitoring system fake data injection attack detection model to obtain the detection category of the measurement data to be detected. The detection categories include normal measurement data and attack measurement data; The pre-trained power monitoring system fake data injection attack detection model is obtained by iteratively training an initial classification model. The initial classification model includes a feature extractor and a main classification head and a pseudo classification head connected to the feature extractor. Iterative training of the initial classification model includes: inputting labeled measurement data samples into the initial classification model and obtaining supervised loss through the main classification head; inputting unlabeled measurement data samples into the initial classification model and obtaining unsupervised loss through the main classification head and the pseudo classification head; combining the supervised loss and the unsupervised loss to obtain the overall loss; and updating the model parameters of the initial classification model based on the overall loss.

5. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the power monitoring system false data injection attack detection method as described in any one of claims 1 to 3.

6. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the steps of the false data injection attack detection method for power monitoring systems as described in any one of claims 1 to 3.

Images