A multi-stage cyber-physical coordinated attack method for vulnerable power system lines

Abstract

The present invention relates to the technical field of power systems, and in particular to a multi-stage information-physical coordinated attack method for vulnerable lines of power systems, comprising the following steps: S1: establishing a power information-physical structure coupling network model based on complex network theory; S2: evaluating the importance of nodes and associations in the power information-physical structure coupling network model; S3: obtaining the importance of nodes or lines of the power information-physical structure in combination with historical attack and defense data, and identifying vulnerable lines; S4: executing attack operations after obtaining an attack plan, and launching attacks on the information layer and the physical layer; S5: completing the physical damage and aftermath of the attack target, terminating the injection of false data at the network layer, and adopting the means of a springboard and a bastion host to prevent the attacker himself from being traced. The present invention implements a multi-stage hierarchical information-physical coordinated attack to cause continuous and in-depth serious damage to the power system at a relatively low attack cost.

Description

Technical Field

[0001] The present invention relates to the technical field of power systems, and in particular to a multi-stage cyber-physical coordinated attack method for vulnerable lines in power systems. Background Art

[0002] The power system is one of the important infrastructures, which is related to people's livelihood, economic development and social stability. Therefore, the power system has always been an important target of attack by hostile forces, and power warfare has become a new model of modern warfare. The attacks on the power system are mainly aimed at destroying the stable operation of the power system or reducing the economic efficiency of the power system operation. The power system is attacked through physical damage or network intrusion. With the expansion of the scale of the power system and the complexity of the network structure, the ability to perceive the status of power resources has been significantly improved, but many vulnerabilities in the network system may be invaded by malicious entities, bringing potential network security threats. Studying the attack methods against the power system from the perspective of attackers is of great significance to improving the offensive and defensive technical capabilities in the power field.

[0003] Information-physical coordinated attack methods often use information attacks to cover up the fault state caused by physical attacks, in order to achieve the purpose of destroying the safe and stable operation of the system. Since most of the existing power grid station nodes have perfect defense measures and are difficult to attack effectively, today's power information-physical coordinated attacks mainly choose transmission lines with a large geographical span as targets, and use information intrusion, physical destruction and other means to cause line failures, thereby causing major power outages. Before making an attack decision, it is necessary to understand the resource allocation of both the attacker and the defender, analyze the structural characteristics and operating characteristics of the target power information-physical system, study the difficulty of damaging power grid lines and nodes and the degree of their impact on the power system, identify weak points with poor security defense in the power grid and attack them, and achieve low-cost and high-return attack effects. Summary of the invention

[0004] Based on the above objectives, the present invention provides a multi-stage cyber-physical coordinated attack method for vulnerable lines in power systems.

[0005] The multi-stage cyber-physical coordinated attack method for vulnerable power system lines includes the following steps:

[0006] S1: Establish a power information-physical structure coupling network model based on complex network theory;

[0007] S2: Evaluate the importance of nodes and associations in the power information-physical structure coupled network model;

[0008] S3: Combine historical attack and defense data to obtain the importance of nodes or lines in the physical structure of power information and identify vulnerable lines;

[0009] S4: After obtaining the attack plan, execute the attack operation and launch attacks on both the information layer and the physical layer;

[0010] S5: Complete the physical destruction and post-attack work of the attack target, terminate the injection of false data at the network layer, and use springboards and bastion hosts to prevent the attackers themselves from being traced.

[0011] Furthermore, the establishment of the power information physical structure coupling network model based on complex network theory in S1 includes:

[0012] S11: Abstract the specific stations and lines of the power information physical structure into a coupled network consisting of nodes and associations, including the physical layer, information layer and logical layer;

[0013] S12: The power hub in the physical layer is regarded as a power node. The power hub includes a substation and a power plant, and the transmission line is regarded as the power-related reaction structure energy supply relationship of the node;

[0014] S13: The communication hub in the information layer is used as an information node. The communication hub includes a dispatching master station and a communication center. The communication channel is used as the information association of the node to reflect the monitoring and control relationship of the physical structure.

[0015] S14: The logic layer reflects the interaction between the information layer and the physical layer, couples the energy flow of the physical layer with the information flow of the information layer, and analyzes the importance of nodes and lines.

[0016] Furthermore, the evaluation of the importance of nodes and associations in the power information physical structure coupling network model in S2 includes:

[0017] S21: By analyzing the historical attack records of nodes and lines, and setting the importance evaluation cycle V according to the frequency of attacks on the selected power information physical structure, the strategic importance probability M of the target line or node i being attacked is calculated. i 'Make predictions;

[0018] S22: Divide the degree of damage X suffered by the target line or node each time into three attack risk level coefficients: A, B, and C. Estimate the average loss D suffered by the node each time based on historical data. i .

[0019] Furthermore, the M in S21 i The calculation formula of ′ is:

[0020]

[0021] Among them, M i M is the cumulative number of attacks suffered by the same type of line or node in the previous evaluation cycle before the current evaluation cycle.i,max and M i,min are the maximum and minimum number of times the same type of line or node has been attacked in the historical evaluation cycle, respectively; q is the number of equivalent lines or nodes of the same type as node i;

[0022] The average loss amount D in S22 i The calculation formula is:

[0023]

[0024] Among them, X l is the attack risk level coefficient of the same type of node or line when it is attacked for the lth time, and e is the cumulative number of attacks of the same type.

[0025] Furthermore, the importance of nodes or lines in the physical structure of power information is obtained by combining historical attack and defense data in S3, and the identification of vulnerable lines includes:

[0026] S31: Define the attack cost of the line based on the attack cost of the line, combined with the degree and betweenness index of the node and the defense capabilities of the nodes at both ends of the line;

[0027] S32: Comprehensively consider the strategic importance, structural importance and scheduling resource importance of the structural line, integrate subjective and objective indicators to calculate the attack cost H of line l l ,identify the vulnerable lines with low attack cost as the target lines for the coordinated power cyber-physical attack;

[0028] S33: Calculate the load loss ratio η of the associated nodes after the target line l is attacked, reflecting the threat level of the attack to the overall power information physical structure;

[0029] S34: After executing the attack on the target line, the attack cost and load loss ratio are recalculated, and a new optimal vulnerable line is selected as the next attack target. During the attack, false data injection is used to make the information layer unable to perceive the power grid line interruption. After repeated iterations, a multi-stage vulnerable line attack plan is obtained.

[0030] Furthermore, the structural importance U l The calculation formula is:

[0031] U l =μN(k i k j )+(1-μ)B ij ;

[0032] Among them, k i With k j Respectively represent the degree of the nodes at both ends of line l, B ijis the degree of line l, N(·) is the normalization function, and μ is the self-defined weight coefficient between betweenness and degree;

[0033] The scheduling resource importance V l The calculation formula is:

[0034] P i =P Gi,max +P F,i ;

[0035]

[0036] Among them, P Gi,max With P F,i are the upper limit of active output and load of the generator set at node i, P i With P j are the scheduling resource amounts of nodes i and j respectively;

[0037] The attack cost H l The calculation formula is:

[0038] H l =N(U l V l M l ′);

[0039] The calculation formula of the load loss ratio η is:

[0040]

[0041] Where L is the initial total load of the power system, L i is the load of node i, and E is the set of load nodes in the power system.

[0042] Further, after obtaining the attack plan in S4, executing the attack operation to attack the information layer and the physical layer simultaneously includes:

[0043] S41: Complete the attack plan and prepare the information layer and physical layer of the power information physical structure;

[0044] S42: The attacker invades the physical structure of power information and takes over some of the permissions of the dispatch center, injecting false data by tampering with the real-time telemetry information uploaded by the measurement and control device;

[0045] S43: Use false data to cover up the interruption status of the target transmission line, and use physical layer to damage the target line, including inducing line overload or cutting off the line, causing the target line to lose power;

[0046] S44: After confirming that a single attack is successful, the process of injecting false data and physically damaging the next target line is repeated, and the total attack duration and the single-step attack duration are preset;

[0047] S45: If the single-step attack times out, the current target line is abandoned and the attack is switched to the next target line. When the total attack duration reaches the time limit, the physical layer attack is terminated to ensure concealment and attack quality.

[0048] Furthermore, the false data injection specifically includes:

[0049] The false data injection attack is used to invade the dispatch center of the power information physical structure and inject false node load measurement data to simulate the normal operation status of the power system;

[0050] According to the historical data of active power of the transmission line and power of the associated nodes, the injected power of the nodes at both ends of the line and the status of the circuit breaker are simulated, injected into the measurement device as false data, and then uploaded to the dispatch center, so that the operation personnel cannot find the power system fault. If it is impossible to invade the power system information network, the attack plan will be terminated and the relevant reasons will be found;

[0051] Based on the established power information physical structure coupling network model, the range of power injection into the nodes at both ends of the line is calculated, so that the power flow changes caused by the attack are within the range that cannot be detected by the monitoring equipment, and a constraint model is established;

[0052] The node injection power and circuit breaker status of the target line are obtained through simulation, and the generated false data set is injected into the dispatching center in the format of power information physical structure measurement data upload to confuse the operation personnel.

[0053] Furthermore, the constraint model is expressed as:

[0054]

[0055]

[0056] Among them, α and β are the safety boundaries of injected data. is the load measurement of node i, is the change in power injected at node i after the line is disconnected, E is the set of load nodes in the power system, is the initial active power of the line that causes power flow changes due to physical attacks, is the line active power change caused by the physical attack, L M A collection of lines that cause a change in the flow of electricity due to an attack.

[0057] Beneficial effects of the present invention:

[0058] The present invention analyzes the vulnerability of transmission lines by establishing a power information-physical structure coupling network model, formulates a global attack plan for the target power system, takes into account both the characteristics of each line and node and the weaknesses of the global power network, and implements a multi-stage and hierarchical information-physical coordinated attack, causing continuous and in-depth serious damage to the power system at a relatively low attack cost.

[0059] The present invention uses false data injection in combination with physical attacks to destroy the power system when the power system control end cannot make effective scheduling, causing the interaction between the power information and physical structures to fail, resulting in more serious damage. Strictly following the attack method of the present invention can effectively reduce the attack cost and the possibility of exposure, which is helpful to occupy a more active position in future information-based power operations, and also provides new ideas for improving the defense capabilities of new power systems. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only for the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0061] Figure 1 A schematic diagram of a power information-physical structure coupling network model according to an embodiment of the present invention;

[0062] Figure 2 A schematic diagram of a vulnerable line screening process according to an embodiment of the present invention;

[0063] Figure 3 Schematic diagram of a flow chart of a multi-stage cyber-physical collaborative attack method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with specific embodiments.

[0065] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the present invention should be understood by people with ordinary skills in the field to which the present invention belongs. The "first", "second" and similar words used in the present invention do not indicate any order, quantity or importance, but are only used to distinguish different components. "Include" or "comprise" and similar words mean that the elements or objects appearing before the word include the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but may include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0066] like Figure 1-3 As shown, the multi-stage cyber-physical coordinated attack method for vulnerable lines in the power system includes the following steps:

[0067] Step 1: Establish a power information-physical structure coupling network model based on complex network theory. Figure 1 As shown in the figure, the specific stations and lines are abstracted into a coupled network composed of nodes and associations, covering the physical layer, information layer and logical layer. In combination with the structure and functional characteristics of the power system, the power hubs such as substations and power plants in the physical layer are regarded as power nodes, and the transmission lines are regarded as the power association of the nodes to reflect the energy supply relationship of the system; the communication hubs such as the dispatching master station and communication center in the information layer are regarded as information nodes, and the communication channels are regarded as the information association of the nodes to reflect the monitoring and control relationship of the physical system; the logical layer reflects the interactive relationship between the information layer and the physical layer, and couples the energy flow of the physical layer with the information flow of the information layer, so as to further analyze the importance of nodes and lines.

[0068] Step 2: After establishing the power information physical structure model, evaluate the importance of the model nodes and associations. The importance can reflect the attack value of the selected target in the power system. When both the attacker and the defender have the same attack information, the importance also reflects the amount of defense resources deployed by the power system at the selected target. By analyzing the historical attack records of nodes and lines, and setting the importance evaluation cycle V according to the frequency of attacks on the selected power information physical structure, the strategic importance of the target line or node i that may be attacked, that is, the probability M i ' Make predictions:

[0069]

[0070] Among them, M iM is the cumulative number of attacks suffered by the same type of line or node in the previous evaluation cycle before the current evaluation cycle. i,max and M i,min are the maximum and minimum times that the same type of lines or nodes have been attacked in the historical evaluation period, respectively. q is the number of equivalent lines or nodes of the same type as node i. Due to the complexity of the physical structure of the power information network, there may be multiple lines or nodes of the same type with the same functions, and their probability of being attacked and the impact of losses are also the same. Therefore, the probability that each network node may be attacked can be obtained by averaging the attack probability of nodes of the same type.

[0071] The degree of damage X suffered by a node or line each time under a network attack is divided into three attack risk level coefficients: A, B, and C. The average loss D suffered by the same type of node each time under attack is estimated based on historical data. i :

[0072]

[0073] Among them, X l is the attack risk level coefficient of the same type of node or line when it is attacked for the lth time, and e is the cumulative number of attacks of the same type.

[0074] Step 3: After combining historical attack and defense data to obtain the importance of power system nodes or lines, identify vulnerable lines. Since power nodes are highly independent and have perfect defenses, the cost of causing substantial failures to them is high, while the spatial span of transmission lines is large, making information-physical coordinated attacks on them less difficult and more concealed. Therefore, the present invention selects vulnerable lines in the power information-physical structure as attack targets, cuts off vulnerable lines at a low attack cost, and uses false data injection to prevent the dispatch center from detecting line interruptions, causing protection equipment to refuse to operate and cause over-tripping, attacking the power network in stages, and continuously expanding the scope of accidental power outages. The principles of the attack plan for vulnerable lines in the power information-physical structure are as follows:

[0075] 1. Find vulnerable lines based on the attack cost of the line. Under the condition that the attack damage effect is fixed, the line with a higher attack cost-effectiveness is suitable as the target. The present invention defines the attack cost of the line based on the defense capability of the nodes at both ends of the line. The physical properties such as line length and average altitude have little impact on the attack cost and are not considered.

[0076] In complex network theory, the node degree is the number of edges connected to the node, and the betweenness is the ratio of the number of shortest paths passing through the element in the network to the total number of all shortest paths. The degree and betweenness indicators reflect the distribution characteristics of the edge in the network. Lines with low degree and low betweenness are distributed at the edge of the power grid where the lines are sparse, and the security protection level of the nodes at both ends is low. It is believed that such lines are easily ignored in the power grid, and the difficulty of attack is relatively small, and the corresponding attack cost is also low. Therefore, the structural importance U of line l in the power information physical structure is l for:

[0077] U l =μN(k i k j )+(1-μ)B ij (3)

[0078] Among them, k i With k j Respectively represent the degree of the nodes at both ends of line l; B ij is the degree of line l; N(·) is the normalization function; μ is the self-defined weight coefficient between betweenness and degree.

[0079] Since the load and active output of the generators at different nodes can reflect the resource configuration of the nodes and are positively correlated with the attack cost, considering the impact of the dispatching resources of the nodes at both ends on the attack cost, the dispatching resource importance of the line is defined as l for:

[0080] P i =P Gi,max +P F,i (4)

[0081]

[0082] Among them, P Gi,max With P F,i are the upper limit of active output and load of the generating set at node i respectively; P i With P j are the scheduling resource amounts of nodes i and j respectively.

[0083] 2. Comprehensively consider the strategic importance, structural importance and dispatch resource importance of the system line, and integrate subjective and objective indicators to obtain the attack cost H of line l l for:

[0084] H l =N(U l V l M l ′) (6)

[0085] The relative value of the line attack cost reflects the level of its defense capability in the system, that is, the vulnerability of the line. The vulnerable line with low attack cost is selected as the target line of the power information-physical coordinated attack, and then a multi-stage attack is carried out to screen the vulnerable line. Figure 2 shown.

[0086] 3. Since the power grid usually meets the N-1 security check during operation, attacking only one target line is unlikely to affect the overall operation of the power system. When the target line is attacked, the power system will implement a load shedding strategy, and the power grid flow will undergo large-scale changes. The load loss caused by a single attack cannot be repaired in a short time. Calculating the load loss ratio η of the associated nodes after the target line l is attacked can reflect the threat level of the attack to the overall power information-physical structure.

[0087]

[0088] Where L is the initial total load of the system; L i is the load of node i; E is the set of system load nodes.

[0089] 4. After executing an attack on a target line, the attack cost and load loss ratio are recalculated, and a new optimal vulnerable line is selected as the next attack target. During the attack, false data injection is used to make the information layer unable to perceive the interruption of the power grid line. It is difficult for the dispatching center to effectively adjust the output and load of the generator set, and it is impossible to suppress the spread of chain failures. Therefore, in a multi-stage attack within a short period of time, it can be considered that the power system status of each attack is only affected by the previous attack. After repeated iterations, a multi-stage vulnerable line attack plan under certain attack resource conditions is obtained.

[0090] Step 4: After obtaining the attack plan, execute the attack operation and launch attacks on the information layer and the physical layer at the same time. After the preparation work, the attacker invades the physical structure of power information, takes over part of the authority of the dispatching center, tampers with the real-time telemetry information uploaded by the measurement and control device, and injects false data to cover the interruption status of all target transmission lines. After the false data injection is successful, the physical layer immediately implements physical damage to the target line, induces line overload or cuts off the line, and causes the target line to be out of power. After confirming that a single attack is successful, continue to inject false data into the next target line, and then implement physical damage, repeating the above operations until the entire attack plan is completed. The total attack duration and single-step attack duration are set in advance by the attacker according to the actual situation. If the single-step attack times out, the target line is abandoned and the attack is transformed into the next target line. When the total attack duration reaches the limit time, regardless of whether the attack plan is completed, the physical layer attack is terminated immediately to ensure concealment and attack quality. False data injection is a difficulty in the coordinated attack of power information and physics. It is a prerequisite for the implementation of the attack plan to effectively cover up the interruption of the transmission line. The specific false data injection method is as follows:

[0091] 1. Traditional false data injection attacks inject false data into the smart metering devices in the power grid or intercept and tamper with the data packets of the SCADA system, causing the dispatching decision of the power system dispatching center to deviate from the normal state and cause unreasonable dispatching plans. The false injection attack method adopted by the present invention is intended to cover up the physical layer attack and ensure that the power system cannot respond effectively during the attack, thereby ensuring the effectiveness of the multi-stage attack and continuously amplifying the attack effect. Therefore, the false data injection attack adopted in this article invades the power information physical structure dispatching center and injects false node load measurement data to simulate the normal operation state of the system.

[0092] 2. Based on the historical data of the active power of the transmission line and the power of the associated nodes, simulate the injected power of the nodes at both ends of the line and the status of the circuit breaker within a certain period of time, inject it into the measuring device as false data, and then upload it to the dispatching center, so that the operating personnel cannot find the system fault. If it is impossible to invade the power system information network, terminate the attack plan and find the relevant reasons.

[0093] 3. In order to cover up the sudden change of power flow caused by physical damage to the target line, the power information physical structure coupling network model established in Step 1 is used to calculate the range of power injection at the nodes at both ends of the line, so that the power flow change caused by the attack is within the range that the monitoring equipment cannot detect. The constraint model is established as follows:

[0094]

[0095]

[0096] Among them, α and β are the safety boundaries of injected data; is the load measurement of node i; is the change in the power injected at node i after the line is disconnected; E is the set of system load nodes; It is the initial active power of the line that causes power flow change due to physical attack; L is the change in line active power caused by the power flow change caused by the physical attack; M A collection of lines that may cause a change in the power flow to be attacked.

[0097] 4. The node injection power and circuit breaker status of the target line within a certain period of time are obtained through simulation, and the generated false data set is injected into the dispatching center in the format of power information physical structure measurement data upload to confuse the operation personnel.

[0098] Step 5: Complete the physical damage and follow-up work of the attack target, terminate the injection of false data at the network layer, and use means such as springboards and bastion hosts to prevent the attackers from being traced. Collect the damage status of the target power information physical structure after the attack and monitor the power grid function recovery time, analyze the accuracy of the vulnerable line selection and the staged damage impact of the staged attack, and continuously optimize the attack method described in the present invention. The complete multi-stage information physical coordinated attack method flow chart is as follows: Figure 3 shown.

[0099] Those skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present invention is limited to these examples. Under the concept of the present invention, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the present invention as described above, which are not provided in detail for the sake of simplicity.

[0100] The present invention is intended to cover all such substitutions, modifications and variations that fall within the broad scope of the claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. The multi-stage cyber-physical coordinated attack method for vulnerable lines in power systems can be used in information-based power operations and provide ideas for improving the defense capabilities of power systems. It is characterized in that The following steps are involved: S1: Establish a power information-physical structure coupling network model based on complex network theory; S2: Evaluate the importance of nodes and associations in the power information-physical structure coupled network model; S3: Combine historical attack and defense data to obtain the importance of nodes or lines in the physical structure of power information and identify vulnerable lines; S4: After obtaining the attack plan, execute the attack operation and launch attacks on both the information layer and the physical layer; S5: Complete the physical damage and follow-up work of the attack target, terminate the injection of false data at the network layer, and use the means of springboard and bastion host to prevent the attacker from being traced; The power information physical structure coupling network model established based on complex network theory in S1 includes: S11: Abstract the specific stations and lines of the power information physical structure into a coupled network consisting of nodes and associations, including the physical layer, information layer and logical layer; S12: The power hub in the physical layer is regarded as a power node. The power hub includes a substation and a power plant, and the transmission line is regarded as the power-related reaction structure energy supply relationship of the node; S13: The communication hub in the information layer is used as an information node. The communication hub includes a dispatching master station and a communication center. The communication channel is used as the information association of the node to reflect the monitoring and control relationship of the physical structure. S14: The logic layer reflects the interaction between the information layer and the physical layer, couples the energy flow of the physical layer with the information flow of the information layer, and analyzes the importance of nodes and lines; The evaluation of the importance of nodes and associations in the power information physical structure coupling network model in S2 includes: S21: By analyzing the historical attack records of nodes and lines, and setting the importance assessment cycle according to the frequency of attacks on the selected power information physical structure V , for the target line or node i Strategic importance probability of being attacked Make predictions; S22: The degree of damage and loss suffered by the target line or node each time the network attack X Divided into three attack risk level coefficients: A, B, and C, the average loss of each node damaged is estimated based on historical data D i ; The S21 The calculation formula is: ； in, The cumulative number of attacks on the same type of lines or nodes in the previous evaluation cycle before this evaluation cycle. and are the maximum and minimum number of attacks on the same type of lines or nodes in the historical evaluation period, q For Node i The number of equivalent lines or nodes of the same type; The average loss amount in S22 D i The calculation formula is: ； in, For the same type of node or line l The attack risk level coefficient of the attack suffered, e The cumulative number of attacks of the same type; The S3 combines historical attack and defense data to obtain the importance of power information physical structure nodes or lines, and identifies vulnerable lines, including: S31: Define the attack cost of the line based on the attack cost of the line, combined with the degree and betweenness index of the node and the defense capabilities of the nodes at both ends of the line; S32: Comprehensively analyze the strategic importance, structural importance and scheduling resource importance of the structured route, and integrate subjective and objective indicators to obtain the route l The attack cost ,identify the vulnerable lines with low attack cost as the target lines for the coordinated power cyber-physical attack; S33: Calculate target route l The load loss ratio of the associated nodes after the attack , reflects the threat level of the attack to the overall power information physical structure; S34: After executing the attack on the target line, the attack cost and load loss ratio are recalculated, and a new optimal vulnerable line is selected as the next attack target. During the attack, false data injection is used to make the information layer unable to perceive the interruption of the power grid line. After repeated iterations, a multi-stage vulnerable line attack plan is obtained; The structural importance The calculation formula is: ； in, and Respectively indicate lines l The degree of the two end nodes, For line l The degree of is the normalization function, is the weight coefficient between betweenness and degree defined by oneself; The scheduling resource importance The calculation formula is: ； ； in, and Node i The upper limit of active output and load of the generator set, and Node i and j The amount of scheduling resources; The attack cost The calculation formula is: ； The load loss ratio The calculation formula is: ； in, is the initial total load of the power system, For Node i The load capacity, is a set of load nodes in the power system; After the attack plan is obtained in S4, the attack operation is executed, and the attack on the information layer and the physical layer at the same time includes: S41: Complete the attack plan and prepare the information layer and physical layer of the power information physical structure; S42: The attacker invades the physical structure of power information and takes over some of the permissions of the dispatch center, injecting false data by tampering with the real-time telemetry information uploaded by the measurement and control device; S43: Use false data to cover up the interruption status of the target transmission line, and use physical layer to damage the target line, including inducing line overload or cutting off the line, causing the target line to lose power; S44: After confirming that a single attack is successful, the process of injecting false data and physically damaging the next target line is repeated, and the total attack duration and the single-step attack duration are preset; S45: If the single-step attack times out, the current target line is abandoned and the attack is switched to the next target line. When the total attack duration reaches the time limit, the physical layer attack is terminated to ensure concealment and attack quality.

2. The multi-stage cyber-physical coordinated attack method for vulnerable lines in the power system according to claim 1, It is characterized in that The false data injection specifically includes: The false data injection attack is used to invade the dispatch center of the power information physical structure and inject false node load measurement data to simulate the normal operation status of the power system; According to the historical data of active power of the transmission line and power of the associated nodes, the injected power of the nodes at both ends of the line and the status of the circuit breaker are simulated, injected into the measurement device as false data, and then uploaded to the dispatch center, so that the operation personnel cannot find the power system fault. If it is impossible to invade the power system information network, the attack plan will be terminated and the relevant reasons will be found; Based on the established power information physical structure coupling network model, the range of power injection into the nodes at both ends of the line is calculated, so that the power flow changes caused by the attack are within the range that cannot be detected by the monitoring equipment, and a constraint model is established; The node injection power and circuit breaker status of the target line are obtained through simulation, and the generated false data set is injected into the dispatching center in the format of power information physical structure measurement data upload to confuse the operation personnel.

3. The multi-stage cyber-physical coordinated attack method for vulnerable lines in the power system according to claim 2, It is characterized in that The constraint model is expressed as: ； ； in, and To inject data into the security boundary, For Node i Load measurement, Node after line disconnection i The change in injected power at is the set of load nodes in the power system, is the initial active power of the line that causes power flow changes due to physical attacks, The change in line active power caused by the power flow change caused by the physical attack, A collection of lines that cause a change in the flow of electricity due to an attack.

Images