A maximum FDIA method considering residual contamination under incomplete information

Abstract

The present application relates to the technical field of power system attack testing, and discloses a maximum FDIA method taking into account residual pollution under incomplete information, including the following steps: S1, obtaining system measurement vector, Jacobian matrix and error variance matrix; S2, selecting attack target measurement points; S3, using graph theory algorithm to find the minimum attack subgraph; S4, selecting non-attack points in the subgraph to inject maximum values, and injecting reasonable false data at the target point; S5, eliminating maximum value injection points, and calculating weighted residual sensitivity matrix; S6, judging whether the conditions are met; S7, if satisfied, record the combination; if not satisfied, reselect the maximum value injection combination and jump to S5; S8, output the minimum attack cost combination. The present invention expands the concealment paradigm of false data injection attack, and only needs to master the local topological structure and line parameters to construct the attack vector within tens of milliseconds, and mislead the DC / AC state estimation results at a low cost.

Description

Technical Field

[0001] The invention relates to the technical field of power system attack testing, in particular to a maximum FDIA method taking residual pollution into account under incomplete information. Background Art

[0002] Electricity is an important part of the lifeline of a city. With the rapid development of the Internet and the rapid advancement of the global digitalization process, the network security of the power system has become an important global issue. The power data acquisition and supervision and data acquisition (SCADA) system is an important technical means to support the safe and stable operation of the power grid. It conducts state estimation based on the real-time measurement data of the power grid, and detects, identifies, eliminates and corrects bad data to retain normal data for use by the dispatching center. Once the SCADA system is attacked by a network attack, it will cause the dispatching center to make wrong decisions, threaten the safety and stability of the power grid, cause economic losses, and even endanger the normal operation of social functions and the stability of people's lives.

[0003] False Data Injection Attack (FDIA) is a network attack technology for power SCADA systems. It injects false data into the uploaded measurement information to avoid the bad data detection link of state estimation, causing the dispatch center to misjudge the power grid state. It has the characteristics of good concealment, high flexibility, wide attack range, and strong destructive power. It is of great significance to study the attack mechanism and detection and prevention methods of FDIA.

[0004] Existing FDIA research is mainly divided into two directions: attack modeling and detection. Attack detection research focuses on how to quickly and accurately detect FDIA, while attack modeling stands from the attacker's perspective, explores system business-level vulnerabilities, and studies attack mechanisms, applicable conditions, and optimal strategies. Attack modeling is mainly divided into two directions: optimal attack strategy and collaborative attack strategy.

[0005] The optimal attack strategy refers to the most effective attack plan designed by the attacker to achieve a certain goal (such as maximizing the attack effect, minimizing the cost, etc.) under specific conditions. This strategy usually requires the attacker to master the complete network topology and line parameters, and to avoid bad data detection through precisely designed attack vectors, directly misleading the dispatcher. However, the attack means used by the optimal attack strategy are relatively simple, and the actual operation is difficult.

[0006] The coordinated attack strategy uses multiple means (physical / network) to coordinate with false data injection to achieve the purpose of disrupting system operation. The coordinated attack strategy enriches the attack style of FDIA and has a higher attack success rate and destructive power. However, whether it is the optimal attack strategy or the coordinated attack strategy, the above studies all assume that the attacker has the complete network topology and line parameters, and directly avoids bad data detection by injecting false data, retaining false data to mislead dispatchers.

[0007] However, these assumptions have the following problems: 1) Attacks in which false data directly evade bad data detection are difficult, costly, and unlikely to be implemented; 2) In practice, it is often difficult for attackers to accurately obtain all the information of the target and they can only obtain partial network information.

[0008] It should be pointed out that if false data fails to escape bad data detection, but can induce residual contamination (i.e. bad data points cause other normal measurement residuals to exceed the threshold value and are mistakenly eliminated), it is still possible to be retained, thereby causing the dispatcher to misoperate. At this time, since the false data does not need to satisfy Kirchhoff's law, the attack cost (i.e. the number of measurements read and tampered) is smaller. However, there are few FDIA studies that consider residual contamination, and the incomplete information dilemma faced by attackers further exacerbates the difficulty of formulating attack strategies.

[0009] Some studies have begun to explore FDIA under incomplete information. The FDIA model based on incomplete information reveals how to conduct effective attacks with a small amount of measurement data under incomplete information conditions. These studies show that blind FDIA can launch attacks with only measurement data from multiple sections through methods such as principal component analysis. In addition, the blind FDIA method based on matrix reconstruction and subspace estimation enhances robustness in measurement noise scenarios.

[0010] However, most of these studies focus on the attack mode of traditional FDIA and do not fully consider residual contamination. How to induce residual contamination under incomplete information and reduce the cost of false data attack is a key issue that needs to be solved urgently. Summary of the invention

[0011] In view of the shortcomings of the prior art, the present invention provides a maximum FDIA method taking into account residual contamination under incomplete information, and proposes a maximum FDIA (LargeNumerical false Data Injection Attack, LN-FDIA) model through a weighted residual search method for the bad data identification link. This model weakens the diagonal elements of the weighted residual sensitivity matrix by reducing measurement redundancy, and only requires a small number of maximum injection points and a single false data point to achieve the attack effect. In addition, the mechanism of the measurement points that induce residual contamination to gather in the minimum attack subgraph is explored, the judgment conditions for constructing LN-FDIA under local network information are given, and a minimum attack cost solution optimization algorithm based on mechanism-driven and graph theory search is designed.

[0012] To achieve the above objectives, the present invention is implemented by the following technical scheme: a maximum FDIA method taking into account residual contamination under incomplete information, comprising the following steps:

[0013] S1. Obtain system measurement vector , measure the Jacobian matrix And the measurement error variance matrix ;

[0014] S2. Select the attack target measurement point , inject false data within a reasonable upper limit into it;

[0015] S3, using a graph theory-based search algorithm to find the minimum attack subgraph;

[0016] S4. Select the attack subgraph that does not include the measurement point of Measurement points, injecting maximum false data;

[0017] S5. Eliminate the above maximum value injection points and calculate the weighted residual sensitivity matrix after dimensionality reduction ;

[0018] S6. Determine whether the following conditions are met:

[0019]

[0020] or

[0021]

[0022] in, represents the reduced-dimensional weighted residual sensitivity matrix after removing the maximum measurement points, represents the reduced-dimensional weighted residual sensitivity matrix under the local topology mastered by the attacker;

[0023] S7. If satisfied, record the combination and continue to traverse until the maximum value is If not satisfied, continue to traverse and inject the maximum value. and repeat steps S4 to S7.

[0024] S8, traverse all the injected maximum values After the combination of, if there is no combination that meets the conditions, increase The value of , and repeat steps S4 to S7 until a combination that meets the conditions is found; if a combination that meets the conditions is found, proceed to S9;

[0025] S9, Output Minimal attack combination.

[0026] Preferably, the weighted residual sensitivity matrix after dimensionality reduction is Calculated by the following formula:

[0027]

[0028] in, Select the matrix for the rows, keeping only Zhongyu The row corresponding to the measurement whose element is 1, Select the matrix for the columns, keeping only Zhongyu The columns corresponding to the measurements whose elements are 1, is the weighted residual sensitivity matrix.

[0029] Preferably, the graph theory search algorithm comprises the following steps:

[0030] Select the number of the FDIA injection bus ;

[0031] Execute the minimum attack cost heuristic algorithm based on graph theory to obtain the minimum attack subgraph;

[0032] Let the counting variable .

[0033] Preferably, the selection When measuring points and injecting maximum values, the following formula is followed:

[0034]

[0035] in, is the attack vector, is the Jacobian matrix, is any non-zero vector.

[0036] Preferably, the weighted residual sensitivity matrix after dimensionality reduction is When , consider the following residual equation:

[0037]

[0038] in, is the weighted residual, is the weighted measurement error, is the weighted residual sensitivity matrix.

[0039] Preferably, the selected The measurement points meet the following conditions:

[0040]

[0041] in, and Respectively Matrix The column vector and elements.

[0042] Preferably, the injection of the false data satisfies the following conditions:

[0043]

[0044] in, is the measurement vector after removing the maximum measurement point, This is the FDIA attack vector.

[0045] Preferably, the estimated value of the state variable is calculated by weighted least squares method using the following formula:

[0046]

[0047] in, is the estimated value of the system state variable, is the measurement Jacobian matrix, is the measurement error variance matrix, is the system measurement vector.

[0048] Preferably, the minimum attack subgraph search algorithm adopted comprises the following steps:

[0049] Count other measurement points other than the FDIA attack point as candidates for injecting extremely large measurement values;

[0050] Record successful attack combinations;

[0051] Update the count variable and determine whether all attack combinations have been traversed.

[0052] Preferably, the output attack combination meets the following optimization objectives:

[0053]

[0054] in, and Both dimensional 0-1 column vector, where All elements are , Only the element corresponding to the maximum value measurement is 1, Represents the row selection matrix, retaining only Zhongyu The row corresponding to the measurement whose element is 1, Represents a column selection matrix, retaining only Zhongyu Columns corresponding to measurements with elements equal to 1.

[0055] The present invention provides a maximum FDIA method taking into account residual contamination under incomplete information. It has the following beneficial effects:

[0056] The present invention proposes a new network attack mode that takes into account residual pollution under incomplete information, and proposes a large numerical false data injection attack (LN-FDIA) model for the weighted residual search method of the bad data identification link. The LN-FDIA model weakens the diagonal elements of the weighted residual sensitivity matrix by reducing the measurement redundancy, and only a small number of maximum injection points and a single false data point are needed to achieve the attack effect. In addition, the mechanism that the measurement points that induce residual pollution are concentrated in the minimum attack subgraph is also explored, the judgment conditions for constructing LN-FDIA under local network information are given, and the minimum attack cost solution optimization algorithm based on mechanism drive and graph theory search is designed. And it has a high success rate, good real-time performance and low attack cost, is particularly suitable for the security research of large power systems, and provides a novel and practical solution for the network security of power systems. The present invention expands the paradigm of the concealment of false data injection attacks. Only by mastering the local topological structure and line parameters, the attack vector can be constructed within tens of milliseconds, and the DC / AC state estimation results can be misled at a very low attack cost. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] Figure 1 It is a schematic diagram of the method flow of the present invention;

[0058] Figure 2 It is a schematic diagram of the FDIA attack path of the present invention;

[0059] Figure 3is the minimum attack subgraph of the bus k of the present invention;

[0060] Figure 4 is a bar graph of attack success rates for bus 97 under different noise levels and test threshold values ​​according to an embodiment of the present invention;

[0061] Figure 5 This is a comparison chart of attack success rates for each bus of IEEE 118 under the DC power flow model of an embodiment of the present invention;

[0062] Figure 6 This is a comparison chart of the attack success rate on some buses of IEEE 118 under the AC power flow model of an embodiment of the present invention;

[0063] Figure 7 This is a comparison chart of attack costs of the IEEE 118-node system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The following will be combined with the drawings in the specification of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0065] In modern power systems, it is crucial to ensure the data integrity of monitoring and control systems. Power systems rely on accurate real-time data to ensure the stability and safety of operation. However, with the evolution of cyber attack technology, data security in the system faces more and more threats. In particular, false data injection attacks (FDIA) have become a significant security risk, which can manipulate state estimation results, leading to erroneous system operations and possible large-scale power outages.

[0066] Please see attached Figure 1 -Attached Figure 3 The present invention proposes a new network attack model taking into account residual pollution under incomplete information, and proposes a large numerical false data injection attack (LN-FDIA) model based on the weighted residual search method for the bad data identification link.

[0067] The LN-FDIA model weakens the diagonal elements of the weighted residual sensitivity matrix by reducing measurement redundancy, and only a small number of maximum injection points and a single false data point are needed to achieve the attack effect. In addition, the mechanism of the measurement points that induce residual pollution to gather in the minimum attack subgraph is explored, the judgment conditions for constructing LN-FDIA under local network information are given, and an algorithm for optimizing the minimum attack cost solution based on mechanism-driven and graph theory search is designed. The following is a detailed description of the specific implementation method.

[0068] 1. State estimation and bad data detection and identification methods

[0069] In the high-voltage transmission network, the bus voltage is close to the rated voltage and the branch resistance is much smaller than the reactance. In order to simplify the calculation and ensure convergence, the system measurement equation usually adopts a linearized DC power flow model. The measurement equation is expressed as follows:

[0070] (1)

[0071] In the formula, represents the system measurement vector; is the measurement Jacobian matrix; Represents the system state variables; means that the mean is 0 and the variance is The measurement error vector.

[0072] The estimated values ​​of the state variables can be solved by weighted least squares (WLS):

[0073] (2)

[0074] In the formula, Represents the estimated value of the system state variable; represents the measurement error variance matrix, Traditional bad data detection is done by comparing the Euclidean norm of the measurement residual with the detection threshold. The size of the bad data is determined. Once it does not meet

[0075] (3)

[0076] This will trigger the bad data detector alarm.

[0077] Once bad data is detected, the system will start the bad data identification process to find the specific location of the bad data. The theoretical basis for identifying bad data is the residual equation, which is expressed as:

[0078] (4)

[0079] In the formula, is the residual vector, is the residual sensitivity matrix, is the identity matrix.

[0080] Commonly used bad data identification methods include weighted residual search method (i.e. method) and the standardized residual search method (i.e. There are two methods, the basic idea of ​​which is to remove the element with the largest absolute value of the residual vector. If formula (3) is not satisfied, then continue to calculate and remove the element with the largest absolute value of the residual vector until formula (3) is satisfied.

[0081] 2. FDIA attack modeling ideas considering residual contamination

[0082] Traditional FDIA exploits the loophole of residual test and constructs the attack vector under the DC power flow model as shown in formula (5):

[0083] (5)

[0084] in, is any non-zero vector.

[0085] At this time, residual detection cannot detect false data mixed in the measurement data, and attackers can tamper with the measurement values ​​and state variables to any value, threatening the safe and stable operation of the power system. Figure 2 Shown in blue dashed box.

[0086] Although traditional FDIA has the advantages of high concealment and strong attack orientation, the number of tampered measurement values ​​is large, and the requirements for avoiding bad data detection are too strict, which brings certain difficulties to actual implementation. In fact, triggering bad data detection does not mean that the network attack is discovered. The detected bad data will enter the identification stage. At this time, if residual contamination occurs, resulting in the false data not being eliminated in the end, the same effect of concealing the misleading state estimation results can be achieved.

[0087] Based on the above analysis, the present invention establishes a new FDIA model taking residual pollution into account. The basic idea is to calculate the current load section The measurement of the collection injects false data, triggering residual pollution removal Normal measurement of the collection, finally retained Subset of The measurement in , so as to achieve the attack effect, such as Figure 2 Shown as purple dashed box.

[0088] In actual scenarios, it is difficult for attackers to obtain complete network information. How to construct an effective attack vector to induce residual pollution under incomplete information is a difficult problem. To address this problem, the present invention constructs the LN-FDIA model and explores the corresponding incomplete information modeling mechanism, solving the problem of how to conceal a single false data with fewer measurement injection points.

[0089] 3. LN-FDIA mechanism analysis

[0090] The starting point and breakthrough of LN-FDIA mechanism analysis is the residual equation. According to the residual analysis, the weighted residual equation is:

[0091] (6)

[0092] In the formula, is the weighted residual, is the weighted measurement error, represents the weighted residual sensitivity matrix, which is symmetric and idempotent.

[0093] Considering normal weighted measurement error There is a single bad data In the case of large ring data amplitude, When can be ignored, there are:

[0094] (7)

[0095] In the formula, and express Matrix The column vector and elements. From formula (7), we can see that the residual and The absolute value of and However, once it appears:

[0096] (8)

[0097] It will trigger residual pollution, which may cause the state estimation result to deteriorate. Whether the diagonal elements of the matrix are dominant.

[0098] Whether the matrix diagonal elements are dominant is closely related to the measurement redundancy. The present invention uses block matrix and matrix inversion auxiliary theorem to derive formulas, and expresses the relationship between the two as the following mechanism.

[0099] Mechanism 1: Reducing the measurement redundancy will weaken , and the degree of attenuation is related to the measurement being removed Corresponding related, The larger the value, the greater the degree of weakening. The specific mechanism is:

[0100] 1. Attackers can eliminate some measurements through certain network attack methods, thereby weakening The diagonal elements of the matrix trigger residual pollution, so that false data points are not eliminated;

[0101] 2. The measurement points to be eliminated can be limited to Larger measurement point range.

[0102] Reducing measurement redundancy means that the measurement data loses availability. Common network attack methods include denial of service attacks, black hole attacks, etc. However, these attack methods require additional knowledge of the routing protocol of the scheduling network or continuous occupation of network bandwidth, which is difficult to implement and has poor concealment.

[0103] In actual power systems, for measurement data that exceeds the reasonable upper limit, the SCADA system will generally filter it out directly without going to the alarm window. Therefore, the present invention adopts the method of injecting a maximum value into the relevant measurement points in combination with a single false data point (i.e., LN-FDIA) to achieve the attack effect. Injecting a maximum value is essentially a kind of FDIA, and the maximum value is twice the annual load peak.

[0104] When the normal measurement error is negligible compared to the false data, as long as the maximum value measurement points are eliminated, the corresponding false data points The diagonal elements of the matrix do not dominate, and the mathematical expression is:

[0105] (9)

[0106] In the formula, and They are the measurement vector after removing the maximum measurement point and the FDIA attack vector, Only on target measurement There are non-zero elements at ; Represents the reduced-dimensional weighted residual sensitivity matrix after removing the maximum measurement points.

[0107] Generally speaking, as long as the false data points are not eliminated during the first bad data identification, as the measurement redundancy decreases, the situation where the diagonal elements are not dominant will become more serious, and the false data points are likely to be retained until the state estimation results converge.

[0108] Formula (9) is used as the decision principle for constructing LN-FDIA, and a complete network topology is required to calculate However, in actual scenarios, it is difficult for attackers to obtain complete network information, so it is urgent to explore the theoretical method of constructing LN-FDIA under incomplete information.

[0109] Node injection power It is a busbar and adjacent busbars If you want to accurately tamper with the state variables of , at least one of the state variables needs to be changed. The present invention assumes that The corresponding state variable , expand formula (5) to obtain:

[0110] (10)

[0111] In the formula, Only on busbar From formula (10), we can see that the amplitude and position of the tampered measurement are only related to Formation Column vector related to; and Only on busbar , adjacent busbar There are non-zero elements in the corresponding positions of the measurements of the connected lines. This shows that Strongly correlated measurements are concentrated around the busbar In the minimum attack subgraph centered on Figure 3 shown.

[0112] analyze It can be seen that The top measurements in descending order are located exactly on the busbar This property provides a basis for reducing the search space of the maximum measurement set.

[0113] Furthermore, the present invention explores mechanism 2 and successfully resolves the difficulty of constructing LN-FDIA under incomplete information conditions.

[0114] Mechanism 2: The measurement set eliminated in the minimum attack subgraph causes the target to tamper with the measurement Corresponding Not dominant, there is a high probability of causing measurement failure in the complete topology Corresponding Not dominant.

[0115] Mechanism 2 means that when the attacker obtains only part of the network information of the minimum attack subgraph covering the false data points, he can design an attack vector to satisfy:

[0116] (11)

[0117] To start LN-FDIA. In the formula, represents the reduced-dimensional weighted residual sensitivity matrix under the local topology mastered by the attacker, and The meaning of is similar to that of formula (9). represents the injection of the maximum value measurement set, Indicates busbar It is the set of measurements within the minimum attack subgraph searched from the starting point.

[0118] 4. LN-FDIA Optimization Scheme Based on Minimum Attack Cost

[0119] Formula (9) or (11) characterizes the construction principle of LN-FDIA. The present invention continues to search for the minimum cost LN-FDIA attack scheme that satisfies the above principle. The optimization problem can be described as

[0120] (12)

[0121] In the formula, and Both Victoria 0-1 Column vector, where All elements are 1, Only the element corresponding to the maximum value measurement is 1; Represents the row selection matrix, retaining only Zhongyu The row corresponding to the measurement whose element is 1, Represents a column selection matrix, retaining only Zhongyu The column corresponding to the measurement whose element is 1; measurement are false data points selected in advance.

[0122] Obviously, this is an NP-hard nonlinear integer programming problem. There are inequalities of absolute value and infinite norm in the constraints, which are difficult to solve directly using existing solvers. Therefore, the present invention designs a minimum cost LN-FDIA optimization algorithm based on mechanism drive and graph theory search, such as Figure 1 shown.

[0123] The core idea of ​​the algorithm of the present invention can be briefly described as follows:

[0124] 1. First select a target measurement point , inject false data within a reasonable upper limit, and use a graph theory search algorithm to search for the minimum attack subgraph.

[0125] 2. Then select from the measurement set corresponding to the subgraph Measurement points (excluding measurement points ), while injecting the maximum value, calculate Array and determine whether formula (9) or (11) satisfies:

[0126] If not satisfied, select Each measurement injects the maximum value and continues searching;

[0127] Once the conditions are met, the output Minimal attack combination.

[0128] Embodiment 1:

[0129] The embodiment of the present invention provides a maximum FDIA method taking into account residual contamination under incomplete information, and the steps are as follows:

[0130] S1. Obtain system measurement vector , measure the Jacobian matrix And the measurement error variance matrix ;

[0131] S2. Select the attack target measurement point , inject false data within a reasonable upper limit into it;

[0132] S3, using a graph theory-based search algorithm to find the minimum attack subgraph;

[0133] S4. Select the attack subgraph that does not include the measurement point of Measurement points, injecting maximum false data;

[0134] S5. Eliminate the above maximum value injection points and calculate the weighted residual sensitivity matrix after dimensionality reduction ;

[0135] S6. Determine whether the following conditions are met:

[0136]

[0137] or

[0138]

[0139] in, represents the reduced-dimensional weighted residual sensitivity matrix after removing the maximum measurement points, represents the reduced-dimensional weighted residual sensitivity matrix under the local topology mastered by the attacker;

[0140] S7. If satisfied, record the combination and continue to traverse until the maximum value is If not satisfied, continue to traverse and inject the maximum value. and repeat steps S4 to S7.

[0141] S8, traverse all the injected maximum values After the combination of, if there is no combination that meets the conditions, increase The value of , and repeat steps S4 to S7 until a combination that meets the conditions is found; if a combination that meets the conditions is found, proceed to S9;

[0142] S9, Output Minimal attack combination.

[0143] Finally, the output satisfies the condition and Minimum attack combination. This combination represents the minimum cost solution to achieve an effective attack under incomplete information. In this way, a covert and efficient attack on the power system can be achieved.

[0144] By gradually increasing the number of measurement points where false data is injected, and using the calculation of the minimum attack subgraph and weighted residual sensitivity matrix, an effective false data injection attack is ensured under incomplete information. False data injection attacks exploit vulnerabilities in power system state estimation, interfere with the accuracy of measurement data, and thus affect the state estimation results, leading to errors in power system control decisions.

[0145] Embodiment 2:

[0146] In order to achieve the minimum cost of LN-FDIA attack under incomplete information conditions, the present invention proposes a LN-FDIA attack cost optimization search algorithm based on mechanism drive and graph theory search. The algorithm includes the following steps:

[0147] Step 1: Determine whether you have complete network information

[0148] If you have the complete network information, you can construct the complete Jacobian matrix , if only partial network information is known, then a partial Jacobian matrix is ​​constructed .

[0149] Step 2: Select the number of the FDIA injection bus

[0150] Select the bus number that has a greater impact on the system status , and execute the FDIA minimum attack cost heuristic algorithm based on graph theory to obtain the minimum attack subgraph, and let the counting variable .

[0151] Step 3: Count other measurement points besides the FDIA attack point

[0152] Statistics attack points As the measurement point for injecting the maximum value, there are a total of indivual.

[0153] Step 4: Beyond the FDIA attack point The maximum value is injected into the measurement point

[0154] choose The maximum value is injected into the measurement points, combinations, let the counting variable , the number of attack combinations successfully implemented in each round .

[0155] Step 5: Calculate the reduced-dimensional residual sensitivity matrix

[0156] According to formula (4), the weighted residual sensitivity matrix after dimensionality reduction is calculated , and determine whether formula (9) or (11) is valid. If the formula is valid, go to step 6; otherwise, jump to step 7.

[0157] Step 6: Record the attack combination

[0158] Record successful attack combinations and the number of successfully implemented attack combinations .

[0159] Step 7: Update the count variable

[0160] Count variables .

[0161] Step 8: Determine whether Attack combination traversal

[0162] Determine whether the counting variable count is equal to , if they are equal, go to step 9; if they are not equal, jump to step 5.

[0163] Step 9: Determine the number of successful attack combinations Is it equal to zero?

[0164] like If it is equal to zero, execute step 10. Otherwise, set the number of attack points to be reduced. , and skip to step 4.

[0165] Step 10: Output Minimal attack combination.

[0166] Embodiment 3:

[0167] This embodiment provides an application of the LN-FDIA method based on incomplete information and taking residual contamination into account in the IEEE 118-node system, and verifies its effectiveness and superiority under different simulation parameter settings.

[0168] 1. Simulation parameter settings

[0169] 1) Example system and load data: This paper uses the improved IEEE 118-node system for simulation analysis. The simulation data selected the load data of the New York Independent System Operator (NYISO) on the 1st of each month in 2013, with a load section every 5 minutes, a total of 3456 load sections, from which 100 sections were randomly selected for simulation. The load data of each section was divided into 99 areas and connected to the IEEE 118-node system.

[0170] 2) Attack subgraph division: IEEE 118-node system buses 3-7, 11-13, buses 27, 28, 32, 114, 115, buses 83-90 and buses 76, 77, 80, 82, 94-97 constitute attack subgraphs 1-4 respectively. All simulation calculations are performed in these four subgraphs.

[0171] 3) Measurement system parameter configuration: Since the standard deviations of the various quantities measured in the measurement error simulation are not much different, the standard deviations of all measurement noises are equal (i.e. ), the value set is , the boundary of bad data is The bad data identification method of LN-FDIA adopts The default system measurement configuration is full measurement, and the reasonable upper limit of the measurement value is ±60% of the current load value of each load node. The calculated variables are all per-unit values.

[0172] 4) Attack parameter setting: In this embodiment, LN-FDIA with complete / incomplete network information (Complete / Incomplete information) is written as CLN-FDIA / ILN-FDIA. Assume that the attacker can only obtain the measurement information of one load section, and all attack vector amplitudes are ±50% of the target bus load value under the same load section. In addition, since the zero-injection power bus measurement is a virtual measurement with a zero error; and the active output measurement of the power plant is monitored in real time by the dispatching center, this embodiment assumes that the attacker cannot directly attack these buses.

[0173] 5) Simulation environment configuration: The relevant calculations are implemented in MATLAB software through the MATPOWER toolkit. The computer configuration is AMD Ryzen 7 4800H with Radeon Graphics CPU @ 2.90GHz and 16GB memory.

[0174] 2. Feasibility verification of attack model under DC power flow

[0175] The feasibility of the attack model is simulated and verified under the DC power flow model. Taking bus 97 as the attack target, the success rates of the two attack models under different noise levels and different test thresholds are calculated. Figure 4 As shown. The attack success rate is defined as the number of load sections where the target bus measurement estimation deviation exceeds 30% divided by the total number of load sections, the same below. Note that the definition of the attack success rate here is relatively strict. In actual simulations, almost all attack vectors trigger residual pollution. However, due to the interference of factors such as load fluctuations, measurement redundancy, inspection thresholds, and measurement noise, the estimation deviation fluctuates to a certain extent. If only the triggering of residual pollution is used as the criterion, the average attack success rate of all examples will be above 99%.

[0176] Depend on Figure 3 It can be seen that the success rate of the two attack models reaches 100% under most combinations of test threshold and noise level. When , the attack success rate is 0. This is because, under this combination of test threshold and noise level, even if no network attack is carried out, the state estimation program will detect and remove a large amount of bad data, and the injection of attack vectors will aggravate the residual pollution phenomenon, which will eventually make the system unobservable, so the attack fails.

[0177] Since current measuring instruments are very accurate and have relatively low noise levels, the limit of bad data is usually Therefore, in order to simulate a more realistic measurement system, in the subsequent simulation calculation, the test threshold value is selected , the measurement noise standard deviation is fixed at 0.01.

[0178] This embodiment also attacks other buses in the four attack subgraphs. The results are as follows: Figure 5 As shown in the figure, for buses 11, 84, 88 and 97, the success rates of the two attack models are as high as 100%; while for buses 3, 28, 95 and 114, the attack success rate of LN-FDIA is about 80%, and the success rate of CLN-FDIA is slightly higher than that of ILN-FDIA.

[0179] The reason for the above results is that the fully measured IEEE 118-node system has a high measurement redundancy and inspection threshold, while the loads of buses 3, 28, 95, and 114 are relatively light. LN-FDIA may have directly avoided the bad data detection or converged after only removing one normal measurement in the identification link, thus weakening the degree of tampering of the estimated value. The above results show that the attack success rate is closely related to the selection of the bus, and the heavily loaded bus should be selected for attack first.

[0180] 3. Feasibility verification of attack model under AC flow

[0181] In order to reflect the practical applicability of the model, this section uses the AC power flow state estimation program for simulation. The simulation results are shown in Figure 6 shown. Figure 6 The results show that the success rates of CLN-FDIA and ILN-FDIA have dropped significantly, with the success rates of more than half of the buses being less than 50%. The reason is that the success of LN-FDIA attacks is closely related to the Whether the diagonal elements of the array are dominant is closely related, but under the communication flow Whether the diagonal of the array is dominant is also related to reactive power measurement, so LN-FDIA does not perform well in AC systems.

[0182] 4. Computational efficiency comparison

[0183] In real-world scenarios, the frequency of data collection and uploading is very high. SCADA data is usually uploaded every 2 seconds or so, so the real-time nature of the attack is very important. Table 1 shows the average calculation time of the attack vectors of the two attack models for a single bus. Among them, the calculation time of ILN-FDIA is less than 0.05 seconds, which reflects the excellent real-time performance of the model and is suitable for large-scale example systems.

[0184] Table 1 Average computation time of attack vectors

[0185]

[0186] 5. Comparison of attack costs

[0187] Attack cost is also one of the important indicators to measure whether the attack model is feasible. Figure 7 As shown, the attack costs of the two attack models are almost the same, and on average only no more than 4 measurement values ​​need to be tampered with, which is significantly lower than the attack cost of the traditional DC / AC power flow model FDIA (the average attack costs are 14 and 32 respectively), reflecting the significant advantage of the model of this embodiment in saving attack resources.

[0188] Through the above simulation analysis, it can be seen that the LN-FDIA method of the present invention can achieve effective attacks on power systems under incomplete information conditions. It has a high success rate, good real-time performance and low attack cost, and is particularly suitable for security research on large power systems. The present invention provides a novel and practical solution for network security of power systems.

[0189] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A maximum FDIA method taking into account residual contamination under incomplete information, characterized in that: The following steps are involved: S1. Obtain system measurement vector , measure the Jacobian matrix And the measurement error variance matrix ; S2. Select the attack target measurement point , inject false data within a reasonable upper limit into it; S3, using a graph theory-based search algorithm to find the minimum attack subgraph; S4. Select the attack subgraph that does not include the measurement point of Measurement points, injecting maximum false data; S5. Eliminate the above maximum value injection points and calculate the weighted residual sensitivity matrix after dimensionality reduction ; S6. Determine whether the following conditions are met: or in, represents the reduced-dimensional weighted residual sensitivity matrix after removing the maximum measurement points, represents the reduced-dimensional weighted residual sensitivity matrix under the local topology mastered by the attacker; S7. If the condition is satisfied, record the maximum value measurement point injection combination that meets the condition, and continue to traverse the number of injection maximum values. If not satisfied, continue to traverse and inject the maximum value. and repeating steps S4 to S7; S8, traverse all the injected maximum values After the combination of, if there is no combination that meets the conditions, increase The value of , and repeat steps S4 to S7 until a combination that meets the conditions is found; if a combination that meets the conditions is found, proceed to S9; S9, Output Minimal attack combination.

2. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The weighted residual sensitivity matrix after dimensionality reduction is Calculated by the following formula: in, Select the matrix for the rows, keeping only Zhongyu The row corresponding to the measurement whose element is 1, Select the matrix for the columns, keeping only Zhongyu The columns corresponding to the measurements whose elements are 1, is the weighted residual sensitivity matrix.

3. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The graph theory search algorithm includes the following steps: Select the number of the FDIA injection bus ; The minimum attack cost heuristic algorithm based on graph theory is executed to obtain the minimum attack subgraph. The number of measurement points in the subgraph except the FDIA injection bus is obtained as follows: indivual; Let the counting variable .

4. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The step S4 includes: selecting from the minimum attack subgraph, except for the FDIA injection bus measurement points and inject the maximum value.

5. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The selected The measurement points meet the following conditions: in, and Respectively Matrix The column vector and elements.

6. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The injection of the false data meets the following conditions: in, is the measurement vector after removing the maximum measurement point, This is the FDIA attack vector.

7. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The system measurement vector Using the linearized DC power flow model, the measurement equation is expressed as follows: in, represents the system measurement vector; is the measurement Jacobian matrix; Represents the system state variables; means that the mean is 0 and the variance is The measurement error vector of The estimated values ​​of the state variables are calculated by weighted least squares method using the following formula: in, is the estimated value of the system state variable, is the measurement Jacobian matrix, is the measurement error variance matrix, is the system measurement vector.

8. The maximum FDIA method taking into account residual contamination under incomplete information according to claim 1 is characterized in that: The output attack combination meets the following optimization objectives: in, and Both dimensional 0-1 column vector, where All elements are , Only the element corresponding to the maximum value measurement is 1, Represents the row selection matrix, retaining only Zhongyu The row corresponding to the measurement whose element is 1, Represents a column selection matrix, retaining only Zhongyu The columns corresponding to the measurements whose elements are 1.

Images