Interval state estimation-based power distribution network topology attack detection method and electronic equipment

Abstract

The invention discloses a power distribution network topology attack detection method based on interval state estimation and electronic equipment. The method comprises the following steps: acquiring measurement coefficient information and measurement information of a power distribution network; performing attack detection on the power distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result; attack detection is carried out on the power distribution network based on an interval state estimation model, a second detection result is obtained, and an interval state estimation equation is solved based on a preset optimization algorithm in the interval state estimation model; and determining a target detection result based on the first detection result and the second detection result, the target detection result being used for representing the information of the line subjected to the attack operation in the power distribution network. According to the method, the technical problems of poor self-checking capability and low recognition accuracy of an attacked line of the power distribution network under the network topology hostile attack are solved.

Description

Technical Field

[0001] The present invention relates to the field of distribution network security analysis, and in particular to a distribution network topology attack detection method and electronic equipment based on interval state estimation. Background Art

[0002] In the context of the transformation of power systems to highly information-based and intelligent cyber-physical systems, the distribution network, as a key link between power sources and users, plays an irreplaceable role in ensuring the safety of the power grid and stable power supply through efficient monitoring and precise control of its operating status. However, this transformation has also significantly increased the network security risks faced by the distribution network, especially network topology attacks, which have become a threat that cannot be ignored. Network topology attacks directly affect the power system control center's accurate estimation of the distribution network status by tampering with or forging the topological structure information of the power grid, thereby misleading control decisions, causing a decrease in the operating efficiency of the power system and even large-scale power outages.

[0003] At present, the distribution network still has obvious deficiencies in dealing with malicious attacks on network topology. The existing distribution network self-checking mechanism focuses on the detection and isolation of physical faults, and lacks effective identification and response methods for network topology attacks that are highly concealed and far-reaching. Specifically, when the network topology of the distribution network is maliciously tampered with, the self-checking ability of the distribution network is often poor, and it is difficult to detect the attack behavior in time; at the same time, due to the lack of detection algorithms and technical means specifically for topology attacks, the accuracy of identifying attack lines is low, and it is impossible to provide the power system control center with timely and accurate attack line information, which in turn limits the power system's ability to ensure the safe and stable operation of the power grid.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a distribution network topology attack detection method and electronic device based on interval state estimation, so as to at least solve the technical problems that the distribution network has poor self-detection capability and low identification accuracy of attacked lines under malicious network topology attacks.

[0006] According to one embodiment of the present invention, a distribution network topology attack detection method based on interval state estimation is provided, which is applied to an attack detection end, including: obtaining measurement coefficient information and measurement information of the distribution network; performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result; performing attack detection on the distribution network based on an interval state estimation model to obtain a second detection result, wherein the interval state estimation equation is solved based on a preset optimization algorithm in the interval state estimation model; determining a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information in the distribution network that is subjected to an attack operation.

[0007] Optionally, attack detection is performed on the distribution network based on measurement information and measurement coefficient information to obtain a first detection result including: determining node residual information based on measurement vector information and measurement equation information in the measurement information; normalizing the measurement residual information based on vector information and a preset residual threshold in the measurement coefficient information to obtain normalized residual information; in response to a maximum value in the normalized residual information being greater than or equal to a preset residual threshold, determining a branch corresponding to the maximum value as an attacked branch.

[0008] Optionally, attack detection is performed on the distribution network based on the interval state estimation model to obtain a second detection result including: determining an interval state estimation equation of the state quantity based on interval information in the measurement information and interval information in the measurement coefficient information; solving the interval state estimation equation based on an interval Gaussian elimination algorithm and a preset optimization algorithm to obtain an interval of the state quantity; in response to the state quantity in the measurement information existing outside the interval of the state quantity, determining a node corresponding to the state quantity as a node under attack.

[0009] Optionally, determining the target detection result based on the first detection result and the second detection result includes: in response to the presence of an attacked node in the first detection result and / or the second detection result, triggering a topology structure identification mechanism of the distribution network to obtain a topology structure identification result; using the topology structure identification result to analyze the attacked node to determine the disguised attack line information and the target attack line information in the target detection result.

[0010] According to one embodiment of the present invention, there is also provided a distribution network topology attack detection method based on interval state estimation, which is applied to a simulated attack end, and includes: obtaining topology structure information and quantity measurement information of the distribution network, wherein the topology structure information is used to determine branch information and node information of the distribution network; determining attack line information based on the topology structure information and the quantity measurement information, wherein the attack line information includes target attack line information and target forged attack line information; and using the attack line information to launch an attack operation on the distribution network.

[0011] Optionally, determining the target attack line information based on the topological structure information and the measurement information includes: determining the line interruption distribution coefficient based on the branch admittance information in the measurement information, the node admittance information in the measurement information and the node association information in the topological structure information; determining the flow information of the alternative attack line using the line interruption distribution coefficient and the branch flow information in the measurement information; and determining the alternative attack line corresponding to the maximum value in the flow information as the target attack line.

[0012] Optionally, determining the target forged attack line information based on the topological structure information and the measurement information includes: obtaining path information of the alternative forged attack line based on the topological structure information; determining the first forged attack line information based on the path information and the branch flow information in the measurement information; and adjusting the first forged attack line information using a depth-first search method to obtain the target forged attack line information.

[0013] Optionally, the first forged attack line information is adjusted using a depth-first search method to obtain target forged attack line information: the endpoint information of the first forged attack line is obtained; and the target forged attack line information is determined between the starting endpoint and the ending endpoint in the endpoint information using a depth-first search method.

[0014] According to one embodiment of the present invention, there is also provided a distribution network topology attack detection device based on interval state estimation, which is applied to an attack detection end and includes: an acquisition module, used to acquire measurement coefficient information and measurement information of the distribution network; a first detection module, used to perform attack detection on the distribution network based on the measurement information and the measurement coefficient information, and obtain a first detection result; a second detection module, used to perform attack detection on the distribution network based on an interval state estimation model, and obtain a second detection result, wherein the interval state estimation equation is solved based on a preset optimization algorithm in the interval state estimation model; a determination module, used to determine a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information in the distribution network that has been subjected to an attack operation.

[0015] Optionally, the determination module is also used to determine the node residual information based on the measurement vector information and the measurement equation information in the measurement information; the first detection module is also used to normalize the measurement residual information based on the vector information in the measurement coefficient information and the preset residual threshold to obtain normalized residual information; the determination module is also used to determine the branch corresponding to the maximum value as the attacked branch in response to the maximum value in the normalized residual information being greater than or equal to the preset residual threshold.

[0016] Optionally, the determination module is also used to determine the interval state estimation equation of the state quantity based on the interval information in the measurement information and the interval information in the measurement coefficient information; the second detection module is also used to solve the interval state estimation equation based on the interval Gaussian elimination algorithm and the preset optimization algorithm to obtain the interval of the state quantity; the determination module is also used to determine the node corresponding to the state quantity as an attacked node in response to the state quantity in the measurement information existing outside the interval of the state quantity.

[0017] Optionally, the determination module is also used to: in response to the presence of an attacked node in the first detection result and / or the second detection result, trigger the topology structure identification mechanism of the distribution network to obtain a topology structure identification result; use the topology structure identification result to analyze the attacked node to determine the disguised attack line information and the target attack line information in the target detection result.

[0018] According to one embodiment of the present invention, there is also provided a distribution network topology attack detection device based on interval state estimation, which is applied to a simulated attack end and includes: an acquisition module, used to acquire topology structure information and quantity measurement information of the distribution network, wherein the topology structure information is used to determine branch information and node information of the distribution network; a determination module, used to determine attack line information based on the topology structure information and the quantity measurement information, wherein the attack line information includes target attack line information and target forged attack line information; a processing module, used to use the attack line information to initiate an attack operation on the distribution network.

[0019] Optionally, the determination module is also used to: determine the line interruption distribution coefficient based on the branch admittance information in the measurement information, the node admittance information in the measurement information and the node association information in the topology information; determine the flow information of the alternative attack line using the line interruption distribution coefficient and the branch flow information in the measurement information; and determine the alternative attack line corresponding to the maximum value in the flow information as the target attack line.

[0020] Optionally, the determination module is also used to: obtain path information of alternative forged attack lines based on topological structure information; determine first forged attack line information based on path information and branch flow information in measurement information; the processing module is also used to adjust the first forged attack line information using a depth-first search method to obtain target forged attack line information.

[0021] Optionally, the acquisition module is further used to acquire endpoint information of the first forged attack line; the determination module is further used to determine the target forged attack line information between the starting endpoint and the ending endpoint in the endpoint information by using a depth-first search method.

[0022] According to one embodiment of the present invention, there is also provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned distribution network topology attack detection method based on interval state estimation is executed when the program is running.

[0023] According to one embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute the above-mentioned distribution network topology attack detection method based on interval state estimation.

[0024] According to one embodiment of the present invention, a computer program product is further provided, including a computer program, which implements the above-mentioned distribution network topology attack detection method based on interval state estimation when executed by a processor.

[0025] In an embodiment of the present invention, a method of obtaining measurement coefficient information and measurement information of a distribution network is adopted, attack detection is performed on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result, and attack detection is performed on the distribution network based on an interval state estimation model to obtain a second detection result. Finally, a target detection result is determined based on the first detection result and the second detection result, thereby achieving the purpose of real-time detection of whether the distribution network is subjected to a topological attack and accurate identification of the attacked line when subjected to a topological network attack, thereby achieving the technical effect of improving the self-detection capability of the distribution network and the accuracy of identifying the attacked line, and further solving the technical problem of poor self-detection capability and low accuracy of identifying the attacked line of the distribution network under malicious attacks on the network topology. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0027] Figure 1 It is a hardware structure block diagram of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0028] Figure 2 is a flow chart of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0029] Figure 3 is a flow chart of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0030] Figure 4 is a flow chart of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0031] Figure 5 is a schematic diagram of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0032] Figure 6 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0033] Fig. 7Ais a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0034] Figure 7B is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0035] Fig. 8A is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0036] Figure 8B is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0037] Fig. 9 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention;

[0038] Fig.10 is a structural block diagram of a distribution network topology attack detection device based on interval state estimation according to one embodiment of the present invention;

[0039] Fig.11 It is a structural block diagram of another distribution network topology attack detection device based on interval state estimation according to one embodiment of the present invention. DETAILED DESCRIPTION

[0040] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0041] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0042] The distribution network topology attack detection method embodiment based on interval state estimation provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 is a hardware structure diagram of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Figure 1 As shown, the computer terminal 10 (or electronic device 10) may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions. In addition, it may also include: a display, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, a power supply and / or a camera. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0043] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10 (or electronic device). As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0044] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the distribution network topology attack detection method based on interval state estimation in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, the above-mentioned distribution network topology attack detection method based on interval state estimation is realized. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof.

[0045] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0046] The display may be, for example, a touch screen type liquid crystal display (LCD), which may enable a user to interact with a user interface of the computer terminal 10 (or electronic device).

[0047] It should be noted that, in some optional embodiments, the above Figure 1 The computer device (or electronic device) shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the above-described computer device (or electronic device).

[0048] According to an embodiment of the present invention, a method embodiment of a distribution network topology attack detection method based on interval state estimation is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in an order different from that shown here.

[0049] Figure 2 is a flow chart of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention, which is applied to the attack detection end, such as Figure 2 As shown, the method comprises the following steps:

[0050] Step S21, obtaining measurement coefficient information and measurement information of the distribution network;

[0051] In step S21, the measurement coefficient information of the distribution network is used to represent a measurement coefficient vector and a measurement coefficient matrix, wherein the measurement coefficient vector is denoted as H and the measurement coefficient matrix is ​​denoted as [H];

[0052] The quantity measurement information of the distribution network is used to characterize the quantity measurement vector and the interval estimation value of the quantity measurement, wherein the quantity measurement vector is denoted as z and the interval estimation value of the quantity measurement is denoted as [z]. For [z], in, z are the upper and lower bounds of the interval [z] respectively.

[0053] Step S22, performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result;

[0054] In step S22, the first detection result is used to characterize the node information with bad data in the distribution network and to determine the branch information that suffers from the topology attack.

[0055] Specifically, the residual information of the node in the distribution network is calculated according to the measurement information, and then the normalized residual information of the node is determined based on the measurement coefficient information and the residual information of the node; and the first detection result is obtained using the normalized residual information of the node.

[0056] Step S23, performing attack detection on the distribution network based on the interval state estimation model to obtain a second detection result, wherein the interval state estimation model solves the interval state estimation equation based on a preset optimization algorithm;

[0057] In step S23, the above interval state estimation equation is shown as expression (1).

[0058] [z]=[H][x] (1)

[0059] Where [z] represents the interval estimate of the quantity measurement; [H] represents the measurement coefficient matrix; and [x] represents the state quantity interval.

[0060] The above preset optimization algorithm is used to characterize the optimization algorithm Krawczyk algorithm.

[0061] Specifically, in the interval state estimation model, the Krawczyk algorithm is used to solve the interval state equation to determine the state quantity interval [x] of the distribution network. The second detection result is obtained by judging whether the state quantity in the distribution network is in the state quantity interval, wherein the second detection result is used to determine the node information that suffers from the topology attack.

[0062] Step S24, determining a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

[0063] Specifically, when the normalized residual value of a node in the first detection result exceeds the preset residual threshold, or the state estimation result exists outside the state quantity interval, the topology structure identification mechanism will be triggered to re-identify the topology structure of the distribution network. By comparing the new identified topology with the known topology, the line information that has been subjected to topology attack operations can be detected, which can not only monitor the topology attack on the distribution network, but also improve the accuracy of identifying the lines that have been subjected to topology attacks.

[0064] In the above steps S21 to S24, the measurement coefficient information and the measurement information of the distribution network are obtained, and attack detection is performed on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result, and attack detection is performed on the distribution network based on the interval state estimation model to obtain a second detection result. Finally, the target detection result is determined based on the first detection result and the second detection result, thereby achieving the purpose of real-time detection of whether the distribution network is subjected to a topological attack, and accurately identifying the attacked line when subjected to a topological network attack, thereby achieving the technical effect of improving the self-detection capability of the distribution network and the accuracy of identifying the attacked line, and further solving the technical problem that the distribution network has poor self-detection capability and low accuracy in identifying the attacked line under malicious attacks on the network topology.

[0065] Optionally, in step S22, attack detection is performed on the distribution network based on the quantity measurement information and the measurement coefficient information, and obtaining a first detection result includes:

[0066] Step S221, determining node residual information based on quantity measurement vector information and measurement equation information in the quantity measurement information;

[0067] In step S221, the measurement equation information is used to represent a mathematical expression of the relationship between the actual measurement value and the system state variable in the distribution network, which is denoted as h(x).

[0068] Specifically, the process of determining the node residual information is shown in expression (2).

[0069] r=zh(x) (2)

[0070] Among them, r represents the measurement residual vector of the node; z represents the quantity measurement vector; h(x) represents the measurement equation.

[0071] Step S222, normalizing the measurement residual information based on the vector information in the measurement coefficient information and a preset residual threshold to obtain normalized residual information;

[0072] Specifically, the process of determining the normalized residual information is shown in expression (3).

[0073]

[0074] Among them, r N represents the normalized residual information of the node; r represents the measurement residual vector of the node; S represents the measurement sensitivity vector, where S = IH (H T R -1 H)H T R -1 , I represents the measurement unit vector, H represents the measurement coefficient vector, and S represents the preset residual threshold.

[0075] Step S223: In response to the maximum value in the normalized residual information being greater than or equal to a preset residual threshold, a branch corresponding to the maximum value is determined as an attacked branch.

[0076] Specifically, the obtained normalized residual information is sorted from large to small, and the largest normalized residual information is selected for judgment. When the maximum normalized residual information is less than the preset residual threshold, there is no bad data in the distribution network; when the maximum value in the normalized residual information is greater than or equal to the preset residual threshold, the branch corresponding to the maximum value is considered to be under attack; the branch is eliminated, and the normalized residual information is re-detected until there is no bad data.

[0077] Based on the above steps S221 to S223, the node residual information is determined based on the measurement vector information and the measurement equation information in the measurement information; the measurement residual information is normalized based on the vector information in the measurement coefficient information and the preset residual threshold to obtain normalized residual information; in response to the maximum value in the normalized residual information being greater than or equal to the preset residual threshold, the branch corresponding to the maximum value is determined as the attacked branch, which can detect in real time whether the distribution network is subjected to a topological attack, and when the distribution network is subjected to a topological network attack, the attacked line can be accurately identified, which can not only improve the self-detection capability of the distribution network, but also improve the accuracy of identifying the attacked line.

[0078] Optionally, in step S23, attack detection is performed on the distribution network based on the interval state estimation model, and the second detection result obtained includes:

[0079] Step S231, determining an interval state estimation equation of a state quantity based on the interval information in the quantity measurement information and the interval information in the measurement coefficient information;

[0080] Specifically, the interval state estimation equation is shown in expression (1).

[0081] [z]=[H][x] (1)

[0082] Where [z] represents the interval estimate of the quantity measurement; [H] represents the measurement coefficient matrix; and [x] represents the state quantity interval.

[0083] Step S232, solving the interval state estimation equation based on the interval Gaussian elimination algorithm and the preset optimization algorithm to obtain the interval of the state quantity;

[0084] Specifically, firstly, the initial iteration value of [x] is obtained based on the Interval Gaussian Elimination (IGE) algorithm, and then it is iterated through the Krawczyk algorithm to obtain a more appropriate state quantity interval.

[0085] Furthermore, first, the initial value of the interval measurement is constructed. For example, it can be constructed based on the 3σ criterion, for errors that follow the Gaussian distribution N(0,σ 2 ) m , the interval estimate of the quantity measurement can be obtained as [z m -3σ, z m +3σ].

[0086] Then, the initial value of the iteration is obtained by the IGE method, and the Krawczyk algorithm is used to iterate according to expression (4) to update the state quantity. Expression (4) is as follows.

[0087] [x] k+1 =(C k [b] k +(IC k [A] k )[x] k )∩[x] k

[0088] C=(mid([A])) -1 (4)

[0089] Where [x] k+1 , [x] k represent the state intervals at the k+1th and kth iterations respectively; I represents the measurement unit vector; [b] k represents the construction vector at the kth iteration; [A] krepresents the construction matrix at the kth iteration, where [A] represents a non-singular interval matrix. C is a non-singular matrix; mid([A]) means taking the midpoint value of the upper and lower limits of the interval A.

[0090] Finally, when [x] k+1 When the number of convergence or iterations reaches a threshold, an interval estimate of the state quantity [x] is obtained.

[0091] Step S233: In response to the state quantity in the quantity measurement information being outside the interval of the state quantity, determining the node corresponding to the state quantity as a node under attack.

[0092] Specifically, when the state quantity in the quantity measurement information exists outside the interval estimated value of the state quantity, the node corresponding to the state quantity is determined as the attacked node.

[0093] Based on the above steps S231 to S233, the interval state estimation equation of the state quantity is determined based on the interval information in the measurement information and the interval information in the measurement coefficient information; the interval state estimation equation is solved based on the interval Gaussian elimination algorithm and the preset optimization algorithm to obtain the interval of the state quantity; in response to the state quantity in the measurement information existing outside the interval of the state quantity, the node corresponding to the state quantity is determined as the attacked node, and the interval state estimation model can more accurately reflect the uncertainty of the state of the distribution network system, thereby improving the accuracy of attack detection, and the interval Gaussian elimination algorithm and the Krawczyk algorithm can effectively solve the interval state estimation equation, compared with the traditional numerical method, it can provide a faster convergence speed, which is crucial for real-time attack detection, and after receiving new measurement information, the interval state estimation model is used to quickly update the state estimation, which can detect the attack in a timely and accurate manner, and help to quickly respond and take measures, thereby improving the security of the entire distribution network.

[0094] Optionally, in step S24, determining the target detection result based on the first detection result and the second detection result includes:

[0095] Step S241, in response to the presence of an attacked node in the first detection result and / or the second detection result, triggering a topology structure identification mechanism of the distribution network to obtain a topology structure identification result;

[0096] Specifically, when the node information in the distribution network satisfies expression (5), it means that a branch in the distribution network may have suffered a topological attack. At this time, the topological structure identification mechanism of the distribution network is triggered to obtain the topological structure identification result.

[0097]

[0098] The constraint condition of expression (5) is as shown in expression (6):

[0099]

[0100] Among them, l A Indicates the attack node to be found; represents the estimated result of the node state quantity; [x] represents the interval estimation result of the state quantity, where x They represent the upper and lower limits of [x] respectively; L represents the number of nodes in the distribution network; represents the maximum value in the normalized meal information; R represents the preset residual threshold of the normalized residual; z represents the quantity measurement vector; H represents the measurement coefficient vector; [z] represents the interval estimate of the quantity measurement; [H] represents the measurement coefficient matrix; [x] represents the state quantity interval.

[0101] Step S242: Analyze the attacked node using the topology node recognition result to determine the disguised attack line information and the target attack line information in the target detection result.

[0102] Specifically, when the maximum value in the normalized residual information exceeds the preset residual threshold and / or the state estimation result exceeds the interval range, the topology structure identification mechanism of the distribution network will be triggered to re-identify the distribution network topology. By comparing the new identified topology with the known topology, the potential attacked branches are detected, and the distribution network topology attack is monitored. When the distribution network is attacked by the disguised attack line and the target attack line at the same time, the disguised attack line information and the target attack line information can be identified by this method.

[0103] Based on the above steps S241 to S242, in response to the existence of attacked nodes in the first detection result and / or the second detection result, the topology structure identification mechanism of the distribution network is triggered to obtain a topology structure identification result; the attacked nodes are analyzed using the topology structure identification result to determine the disguised attack line information and the target attack line information in the target detection result; by real-time monitoring and analysis of the first detection result and the second detection result, once signs of attack are detected, the topology structure identification mechanism is automatically triggered, reducing manual intervention, improving response speed and processing efficiency, and being able to accurately identify the attacked nodes, including the disguised attack lines and the target attack lines, which helps to take targeted defense measures.

[0104] Figure 3 is a flowchart of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention, which is applied to simulate the attack end, such as Figure 3 As shown, the method comprises the following steps:

[0105] Step S31, obtaining topological structure information and quantity measurement information of the distribution network, wherein the topological structure information is used to determine branch information and node information of the distribution network;

[0106] In step S31, the above-mentioned quantity measurement information includes but is not limited to: branch admittance information, node admittance information, and branch power flow information in the distribution network.

[0107] Specifically, for a distribution network with N nodes and L branches, the distribution network can be represented by a graph model G(V, E), where V represents a node set and E represents a branch set. The attacker needs to have some knowledge of the topological structure information and quantity measurement information of the distribution network before implementing a topological attack. Therefore, the following assumptions are made: the attacker has the topological structure information and quantity measurement information of the distribution network; the attacker can perform power flow calculations on a local part of the distribution network to verify the effectiveness of the attack; the attacker can intercept and modify the quantity measurement information in the distribution network.

[0108] Furthermore, in order to ensure the rationality of the attack launched by the attacker and prevent the control center from discovering that the system topology has been tampered with, it is necessary to limit the attack line. The basic assumptions and tampering conditions are as follows:

[0109] 1) Lines connected to unloaded buses cannot be targeted because load changes on unloaded buses can be easily detected by the control center;

[0110] 2) When the attacker tampers with the measurement information, the extent of the tampering cannot be too large and needs to be limited to a certain range, and the generator output power cannot be tampered with;

[0111] 3) The attacking end cannot select the attack line that divides the power system into two independent systems;

[0112] 4) The nodes at both ends of the line attacked by the attacker cannot both be nodes connected to the generator;

[0113] 5) The target attack line and the target forged attack line cannot contain the same nodes, that is, the two cannot be adjacent, because after the control center detects the forged attack line, it is easy to detect the target attack line by checking the nearby lines.

[0114] Step S32, determining attack line information based on the topology information and the quantity measurement information, wherein the attack line information includes target attack line information and target forged attack line information;

[0115] Specifically, the attacker determines the target attack line and the target forged attack line based on the acquired topological information and measurement information. The attacker uses the target forged attack line to prevent the target attack line from being detected by the control center of the power system. When the control center performs bad data detection, the target forged attack line will produce more significant detection results, allowing the target attack line to avoid detection. This is because, in order to avoid allocating power flow to the target forged attack line, the power system will allocate higher power flow to other branches, which will cause other branches, including the target attack branch, to exceed the thermal transmission limit power, thereby causing power system failure and achieving the purpose of the attack.

[0116] Step S33: using the attack line information to initiate an attack operation on the distribution network.

[0117] Specifically, a topological attack operation is launched on the distribution network simultaneously using the target attack line and the target forged attack line to cause power system failure and achieve the purpose of the topological attack.

[0118] Furthermore, when using the attack line to launch an attack operation on the distribution network, it is necessary to tamper with the measurement data, and the modification of the measurement data needs to be in accordance with the minimum change in the line flow of the distribution network before and after the attack. Specifically, as shown in expression (7).

[0119]

[0120] Where, Δs A Indicates the target attack line l A The line flow of the corresponding attack area before and after the attack; s A Indicates the target attack line l A The line flow of the corresponding attack area when it is not attacked; Indicates the target attack line l A The line flow of the corresponding attack area after being attacked; Δs C Indicates the target forged attack line l C The line flow of the corresponding attack area before and after the attack; s C Indicates the target forged attack line l C The line flow of the corresponding attack area when it is not attacked; Indicates the target forged attack line l C The line flow of the corresponding attack area after being attacked.

[0121] Based on the above steps S31 to S33, the topological structure information and the quantity measurement information of the distribution network are obtained, the attack line information is determined based on the topological structure information and the quantity measurement information, and finally the attack line information is used to launch an attack operation on the distribution network. The simulated attack end uses a target fake attack line, so that the attacker can divert the attention of the control center, making the real target attack line difficult to be discovered, thereby increasing the concealment of the attack. In addition, the attack test on the distribution network using the target attack line and the target fake attack line can improve the self-inspection capability of the distribution network attack detection end.

[0122] Optionally, in step S32, determining target attack line information based on topology information and quantity measurement information includes:

[0123] Step S321, determining a line interruption distribution coefficient based on branch admittance information in the quantity measurement information, node admittance information in the quantity measurement information, and node association information in the topology structure information;

[0124] Specifically, the calculation process of the line interruption distribution coefficient matrix M is shown in expression (8).

[0125] M=B L AB -1 A T (8)

[0126] Among them, B L represents the diagonal matrix composed of branch admittances; B represents the imaginary part of the node admittance matrix; A represents the node association matrix.

[0127] Step S322, determining the power flow information of the candidate attack line by using the line interruption distribution coefficient and the branch power flow information in the measurement information;

[0128] Specifically, the impact factor f is defined to indicate the degree of change in the power flow in the distribution network after different branches are attacked. When the lth branch is used as an alternative attack line, assuming that the lth branch is attacked, the impact factor f l The calculation process of is shown in expression (9).

[0129] f l ={[M(:,l) T sign(Re[S])]}P l (9)

[0130] Where M represents an L-dimensional square matrix; M(:,l) represents the l-th column in the matrix M; sign(Re[S])) represents the sign of the active power; S = [S1,…,S L ] represents the line power of L branches; P l Represents the active power of the lth line.

[0131] Step S323: determine the candidate attack route corresponding to the maximum value in the power flow information as the target attack route.

[0132] Specifically, select f l The largest line is used as the target attack line l A , and branch l A The nodes at both ends are put into the attack node set N A . Target attack line l A The specific determination process of is shown in expression (10).

[0133]

[0134] Among them, l A Indicates the target attack line; impact factor f l It represents the influence factor of the lth branch when the lth branch is used as an alternative attack route.

[0135] Based on the above steps S321 to S323, the line interruption distribution coefficient is determined based on the branch admittance information in the measurement information, the node admittance information in the measurement information, and the node association information in the topology information; the flow information of the alternative attack line is determined using the line interruption distribution coefficient and the branch flow information in the measurement information; the alternative attack line corresponding to the maximum value in the flow information is determined as the target attack line, and a more concealed target attack line is determined by simulating the attack end, which can increase the difficulty of the attack detection end in identifying the target attack line, thereby helping to improve the self-detection capability of the attack detection end and the ability to correctly identify the attack line.

[0136] Optionally, in step S32, determining the target forged attack line information based on the topology information and the quantity measurement information includes:

[0137] Step S324, obtaining path information of the candidate forged attack route based on the topology information;

[0138] Specifically, since the target attack line and the target forged attack line cannot contain the same nodes, that is, the two cannot be adjacent, after the target attack line is determined, the path information of the candidate forged attack line is obtained according to the topological structure information.

[0139] Step S325, determining first forged attack line information based on the path information and branch flow information in the quantity measurement information;

[0140] Specifically, the specific process of determining the first forged attack line information based on the path information and the branch flow information in the quantity measurement information is as shown in Expression (11).

[0141]

[0142] Among them, l B represents the first forged attack route; E represents the set of alternative forged attack routes; It represents the total power flow of the distribution network when the forged l-th branch is interrupted; It represents the power flow limit power of the distribution network when the lth branch is interrupted.

[0143] in, It can be determined based on expression (12).

[0144]

[0145] in, It represents the total branch power of the distribution network when the forged l-th branch is interrupted; P l represents the power flow of the lth branch; W = [w1,...,w L ] T represents the line selection vector, where w l The value is 0 or 1, w l When the value is 0, it means the line is disconnected. l When the value is 1, it means the line is connected; M represents the line interruption distribution coefficient matrix

[0146] Step S326: adjusting the first forged attack line information by using a depth-first search method to obtain target forged attack line information.

[0147] Specifically, after determining the first forged attack line, a simple attack method is to inject a pair of power with equal amplitude and opposite sign into the nodes at both ends of the first forged attack line. However, this method is easy for the control center to detect the attack line, so the depth-first search (DFS) method is used to adjust the first forged attack line information to obtain the target forged attack line information l C .

[0148] Based on the above steps S324 to S326, path information of the alternative forged attack line is obtained based on the topological structure information; the first forged attack line information is determined based on the path information and the branch flow information in the measurement information; the first forged attack line information is adjusted using a depth-first search method to obtain the target forged attack line information; the simulated attack end uses the target forged attack line to allow the attacker to divert the attention of the control center, making the real target attack line less likely to be discovered, thereby increasing the concealment of the attack and increasing the difficulty of the attack detection end in identifying the target attack line, thereby helping to improve the self-detection capability of the attack detection end and the ability to correctly identify the attack line.

[0149] Optionally, in step S326, the first forged attack line information is adjusted using a depth-first search method to obtain target forged attack line information:

[0150] Step S3261, obtaining endpoint information of the first forged attack line;

[0151] Step S3262, using a depth-first search method, determine the target forged attack line information between the starting endpoint and the ending endpoint in the endpoint information.

[0152] Specifically, first, the endpoints of the first forged attack line are obtained, which are respectively recorded as endpoint i and endpoint k. Then, power is injected into endpoint i, and a line whose end point is endpoint k is found through DFS, and the line is determined as the target forged attack line. Alternatively, power is injected into endpoint k, and a line whose end point is endpoint i is found through DFS, and the line is determined as the target forged attack line.

[0153] Based on the above steps S3261 to S3262, the endpoint information of the first forged attack line is obtained; the target forged attack line information is determined between the starting endpoint and the ending endpoint in the endpoint information using a depth-first search method, thereby increasing the concealment of the target forged attack line and further increasing the difficulty for the attack detection end to identify the target attack line, thereby helping to improve the self-detection capability of the attack detection end and the ability to correctly identify the attack line.

[0154] Figure 4 is a flow chart of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention, which is applied to the attack detection end, such as Figure 4 As shown, the method comprises the following steps:

[0155] Step S401, obtaining measurement coefficient information and measurement information of the distribution network;

[0156] Step S402, determining node residual information based on quantity measurement vector information and measurement equation information in the quantity measurement information;

[0157] Step S403, normalizing the measurement residual information based on the vector information in the measurement coefficient information and a preset residual threshold to obtain normalized residual information;

[0158] Step S404, determining an interval state estimation equation of the state quantity based on the interval information in the quantity measurement information and the interval information in the measurement coefficient information;

[0159] Step S405, solving the interval state estimation equation based on the interval Gaussian elimination algorithm and the preset optimization algorithm to obtain the interval of the state quantity;

[0160] Step S406, determining whether the interval between the normalized residual information and the state quantity satisfies the condition in expression (5);

[0161] Step S407, when the condition in expression (5) is met, trigger the topology structure identification mechanism of the distribution network to obtain the topology structure identification result;

[0162] Step S408, analyzing the attacked node using the topology node recognition result to determine the camouflaged attack line information and the target attack line information in the target detection result;

[0163] Step S409: when the condition in expression (5) is not satisfied, it is determined that the distribution network is not subject to a topology attack.

[0164] Based on the above steps S401 to S409, the measurement coefficient information and the measurement information of the distribution network are obtained, and attack detection is performed on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result, and attack detection is performed on the distribution network based on the interval state estimation model to obtain a second detection result. Finally, the target detection result is determined based on the first detection result and the second detection result, thereby achieving the purpose of real-time detection of whether the distribution network is subjected to a topological attack and accurate identification of the attacked line when subjected to a topological network attack, thereby achieving the technical effect of improving the self-detection capability of the distribution network and the accuracy of identifying the attacked line, and further solving the technical problem of poor self-detection capability and low accuracy of identifying the attacked line of the distribution network under malicious attacks on the network topology.

[0165] Figure 5 is a schematic diagram of a distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention, which is applied to a simulated attack end, such as Figure 5 As shown, the method comprises the following steps:

[0166] The method comprises the following steps: obtaining topological structure information and measurement information of a distribution network; determining a line interruption distribution coefficient based on branch admittance information in the measurement information, node admittance information in the measurement information, and node association information in the topological structure information; determining the flow information of an alternative attack line using the line interruption distribution coefficient and branch flow information in the measurement information; determining the alternative attack line corresponding to the maximum value in the flow information as a target attack line; obtaining path information of an alternative forged attack line based on the topological structure information; determining first forged attack line information based on the path information and branch flow information in the measurement information; adjusting the first forged attack line information using a depth-first search method to obtain target forged attack line information; determining whether the target attack line and the target forged attack line meet basic assumptions and tampering conditions; when the target attack line and the target forged attack line meet basic assumptions and tampering conditions, tampering the measurement data in the attack area based on expression (7); and re-determining the attack line information based on the topological structure information and the measurement information.

[0167] Based on the above embodiment, the topological structure information and quantity measurement information of the distribution network are obtained, the attack line information is determined based on the topological structure information and the quantity measurement information, and finally the attack line information is used to launch an attack operation on the distribution network, and the attack end is simulated by using the target to forge the attack line. The attacker can divert the attention of the control center, so that Figure 1 The real target attack line is not easy to be discovered, which increases the concealment of the attack. In addition, using the target attack line and the target fake attack line to conduct attack tests on the distribution network can improve the self-checking capability of the distribution network attack detection end.

[0168] The following is an example to introduce the workflow of the distribution network topology attack detection method based on interval state estimation in detail:

[0169] Specifically, Figure 6 FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Figure 6 The topology structure of the improved IEEE33-node distribution network shown in the figure is used for topology attack detection test. Assume that the range of tampering measurement by the simulated attack end is 25%, the voltage amplitude range is between 0.95pu and 1.05pu, and the normalized residual threshold is set to 3. The measurement error obeys the Gaussian distribution of μ = 0, σ = 0.1% × the true value.

[0170] Simulate the attack end based on Figure 5 The method for selecting the attack line in the present invention is to determine the target attack line and the target forged attack line, wherein l 13-14 As a target forged attack line, l6-7 The target attack line is used to attack the distribution network topology using the target forged attack branch and the target attack branch.

[0171] After a topological attack occurs, the attack detection end uses the normalized residual method to detect it. The normalized residual information of different nodes is as follows: Fig. 7A As shown, Fig. 7A FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Fig. 7A The target forged attack branch l can be found in 13-14 The normalized residual is the largest, branch l 6-7 , l 12-13 Secondly, and all exceed the threshold value of the set normalized residual 3. 13-14 The corresponding measurements are eliminated, and then the bad data is detected again to obtain the normalized residual as Figure 7B As shown, Figure 7B FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Figure 7B It can be found that Fig. 7A In comparison, after the bad data detection is performed again, the maximum normalized residual is less than the set threshold 3, and the target attack line l 6-7 The attack was not detected, which proves the effectiveness and feasibility of topology attack. At the same time, the attack detection end uses the interval state estimation model to detect attacks on the distribution network. Under normal circumstances, the node voltage amplitude and its interval state estimation curve are as follows: Fig. 8A As shown, Fig. 8A FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Fig. 8A As shown in the figure, the real value of the node voltage amplitude is marked with a solid line, and the upper and lower limits of the node voltage amplitude are marked with a dotted line. Fig. 8A It can be found that the node voltage amplitude is within the estimated range at this time. After the topology attack occurs, the node voltage amplitude and its interval state estimation curve are as follows: Figure 8B As shown, Figure 8B FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Figure 8B As shown in the figure, the real value of the node voltage amplitude is marked with a solid line, where the real value of some node voltage amplitudes is 0, which coincides with the coordinate axis; the upper and lower limits of the interval of the node voltage amplitude are marked with a dotted line, where the upper and lower limits of the interval of the node voltage amplitude are 0, which coincides with the coordinate axis. Figure 8BIt can be found that the voltage amplitude from node 7 to node 18 is obviously beyond the interval range. According to the topology attack detection mechanism of the invention, the topology identification mechanism is triggered to identify the new network structure and obtain the new topology structure as follows: Fig. 9 shown. Fig. 9 FIG. 1 is a schematic diagram of another distribution network topology attack detection method based on interval state estimation according to one embodiment of the present invention. Fig. 9 It can be found that the topological structure of nodes 1 to 6, nodes 19 to 22, and nodes 23 to 25 is correct, which is consistent with the known Figure 6 The topology in the diagram is consistent, but the topology from node 7 to node 18 is wrong compared with the correct topology, and combined with Figure 8B In the node voltage amplitude information, the voltage amplitude from node 7 to node 18 is abnormal. Based on the topology recognition results, normalized residual information and state estimation results, it can be known that branch 6-7 has been maliciously attacked, so that nodes 7 to 18 are disconnected from the network, thereby realizing the detection of the attack branch.

[0172] Through the above embodiments, it can be found that the method proposed in the present invention can not only monitor the attacked branch by using the normalized residual information, but also detect potential attacks in combination with the interval state estimation results when the normalized residual cannot be detected, thereby achieving the purpose of real-time detection of whether the distribution network is subjected to a topological attack, and accurately identifying the attacked line when subjected to a topological network attack, thereby achieving the technical effect of improving the self-detection capability of the distribution network and the accuracy of identifying the attacked line, and further solving the technical problem that the distribution network has poor self-detection capability and low accuracy in identifying the attacked line under malicious attacks on the network topology.

[0173] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a magnetic disk, or an optical disk), and includes a number of instructions for enabling a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present invention.

[0174] In an embodiment of the present invention, a distribution network topology attack detection device based on interval state estimation is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0175] Fig.10 1 is a block diagram of a distribution network topology attack detection device based on interval state estimation according to one embodiment of the present invention, which is applied to an attack detection terminal. Fig.10 As shown, the device comprises:

[0176] An acquisition module 1001 is used to acquire measurement coefficient information and measurement information of a distribution network;

[0177] A first detection module 1002, configured to perform attack detection on the distribution network based on the measurement information and the measurement coefficient information, and obtain a first detection result;

[0178] The second detection module 1003 is used to perform attack detection on the distribution network based on the interval state estimation model to obtain a second detection result, wherein the interval state estimation equation is solved based on a preset optimization algorithm in the interval state estimation model;

[0179] The determination module 1004 is used to determine a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

[0180] Optionally, the determination module 1004 is also used to determine the node residual information based on the measurement vector information and the measurement equation information in the measurement information; the first detection module 1002 is also used to normalize the measurement residual information based on the vector information in the measurement coefficient information and the preset residual threshold to obtain normalized residual information; the determination module 1004 is also used to determine the branch corresponding to the maximum value as the attacked branch in response to the maximum value in the normalized residual information being greater than or equal to the preset residual threshold.

[0181] Optionally, the determination module 1004 is also used to determine the interval state estimation equation of the state quantity based on the interval information in the measurement information and the interval information in the measurement coefficient information; the second detection module 1003 is also used to solve the interval state estimation equation based on the interval Gaussian elimination algorithm and the preset optimization algorithm to obtain the interval of the state quantity; the determination module 1004 is also used to determine the node corresponding to the state quantity as an attacked node in response to the state quantity in the measurement information existing outside the interval of the state quantity.

[0182] Optionally, the determination module 1004 is also used to: in response to the presence of an attacked node in the first detection result and / or the second detection result, trigger the topology structure identification mechanism of the distribution network to obtain a topology structure identification result; use the topology structure identification result to analyze the attacked node to determine the disguised attack line information and the target attack line information in the target detection result.

[0183] Fig.11 1 is a structural block diagram of another distribution network topology attack detection device based on interval state estimation according to one embodiment of the present invention, which is applied to simulate the attack end. Fig.11 As shown, the device comprises:

[0184] An acquisition module 1101 is used to acquire topological structure information and quantity measurement information of a distribution network, wherein the topological structure information is used to determine branch information and node information of the distribution network;

[0185] A determination module 1102, configured to determine attack line information based on topology information and quantity measurement information, wherein the attack line information includes target attack line information and target forged attack line information;

[0186] The processing module 1103 is used to initiate an attack operation on the distribution network using the attack line information.

[0187] Optionally, the determination module 1102 is also used to: determine the line interruption distribution coefficient based on the branch admittance information in the measurement information, the node admittance information in the measurement information, and the node association information in the topology information; determine the flow information of the alternative attack line using the line interruption distribution coefficient and the branch flow information in the measurement information; and determine the alternative attack line corresponding to the maximum value in the flow information as the target attack line.

[0188] Optionally, the determination module 1102 is also used to: obtain path information of an alternative forged attack line based on topology information; determine the first forged attack line information based on the path information and branch flow information in the measurement information; the processing module 1103 is also used to adjust the first forged attack line information using a depth-first search method to obtain the target forged attack line information.

[0189] Optionally, the acquisition module 1101 is further used to acquire endpoint information of the first forged attack line; the determination module 1102 is further used to determine the target forged attack line information between the start endpoint and the end endpoint in the endpoint information by using a depth-first search method.

[0190] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0191] According to one embodiment of the present invention, there is also provided an electronic device, comprising: a memory storing an executable program; and a processor for running the program, wherein the above-mentioned distribution network topology attack detection method based on interval state estimation is executed when the program is running.

[0192] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0193] Step S1, obtaining measurement coefficient information and measurement information of the distribution network;

[0194] Step S2, performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result;

[0195] Step S3, performing attack detection on the distribution network based on the interval state estimation model to obtain a second detection result, wherein the interval state estimation model solves the interval state estimation equation based on a preset optimization algorithm;

[0196] Step S4, determining a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

[0197] According to one embodiment of the present invention, a computer-readable storage medium is also provided, which includes a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute the above-mentioned distribution network topology attack detection method based on interval state estimation.

[0198] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0199] Step S1, obtaining measurement coefficient information and measurement information of the distribution network;

[0200] Step S2, performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result;

[0201] Step S3, performing attack detection on the distribution network based on the interval state estimation model to obtain a second detection result, wherein the interval state estimation model solves the interval state estimation equation based on a preset optimization algorithm;

[0202] Step S4, determining a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

[0203] Optionally, in this embodiment, the above-mentioned storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0204] According to one embodiment of the present invention, a computer program product is further provided, including a computer program, which implements the above-mentioned distribution network topology attack detection method based on interval state estimation when executed by a processor.

[0205] Optionally, in this embodiment, the computer program product may be configured as a computer program for executing the following steps:

[0206] Step S1, obtaining measurement coefficient information and measurement information of the distribution network;

[0207] Step S2, performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result;

[0208] Step S3, performing attack detection on the distribution network based on the interval state estimation model to obtain a second detection result, wherein the interval state estimation model solves the interval state estimation equation based on a preset optimization algorithm;

[0209] Step S4, determining a target detection result based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

[0210] Optionally, the specific examples in this embodiment may refer to the examples described in the above embodiments and optional implementation modes, and this embodiment will not be described in detail here.

[0211] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0212] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0213] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0214] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0215] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0216] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0217] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A distribution network topology attack detection method based on interval state estimation, characterized in that: Applied to attack detection end, including: Obtaining measurement coefficient information and measurement information of the distribution network; Performing attack detection on the distribution network based on the quantity measurement information and the measurement coefficient information to obtain a first detection result; Performing attack detection on the distribution network based on an interval state estimation model to obtain a second detection result, wherein the interval state estimation model solves the interval state estimation equation based on a preset optimization algorithm; A target detection result is determined based on the first detection result and the second detection result, wherein the target detection result is used to represent line information that is subjected to an attack operation in the distribution network.

2. The distribution network topology attack detection method based on interval state estimation according to claim 1 is characterized in that: Performing attack detection on the distribution network based on the measurement information and the measurement coefficient information to obtain a first detection result includes: Determine node residual information based on the measurement vector information and the measurement equation information in the measurement information; Normalizing the measurement residual information based on the vector information in the measurement coefficient information and a preset residual threshold to obtain normalized residual information; In response to a maximum value in the normalized residual information being greater than or equal to the preset residual threshold, a branch corresponding to the maximum value is determined as an attacked branch.

3. The distribution network topology attack detection method based on interval state estimation according to claim 1 is characterized in that: Performing attack detection on the distribution network based on the interval state estimation model, obtaining a second detection result includes: Determine an interval state estimation equation of a state quantity based on the interval information in the quantity measurement information and the interval information in the measurement coefficient information; Solving the interval state estimation equation based on an interval Gaussian elimination algorithm and a preset optimization algorithm to obtain the interval of the state quantity; In response to the state quantity in the quantity measurement information being outside the interval of the state quantity, a node corresponding to the state quantity is determined as an attacked node.

4. The distribution network topology attack detection method based on interval state estimation according to claim 1 is characterized in that: Determining a target detection result based on the first detection result and the second detection result includes: In response to the presence of an attacked node in the first detection result and / or the second detection result, triggering a topology structure identification mechanism of the distribution network to obtain a topology structure identification result; The attacked node is analyzed using the topological node identification result to determine the disguised attack line information and the target attack line information in the target detection result.

5. A distribution network topology attack detection method based on interval state estimation, characterized in that: Applied to simulate the attack end, including: Acquire topological structure information and quantity measurement information of the distribution network, wherein the topological structure information is used to determine branch information and node information of the distribution network; Determine attack line information based on the topology information and the quantity measurement information, wherein the attack line information includes target attack line information and target forged attack line information; An attack operation is initiated on the distribution network using the attack line information.

6. The distribution network topology attack detection method based on interval state estimation according to claim 5 is characterized in that: Determining the target attack line information based on the topology information and the quantity measurement information includes: Determine a line interruption distribution coefficient based on branch admittance information in the quantity measurement information, node admittance information in the quantity measurement information, and node association information in the topology structure information; Determine the power flow information of the candidate attack line by using the line interruption distribution coefficient and the branch power flow information in the quantity measurement information; The candidate attack route corresponding to the maximum value in the power flow information is determined as the target attack route.

7. The distribution network topology attack detection method based on interval state estimation according to claim 5 is characterized in that: Determining the target forgery attack line information based on the topology information and the quantity measurement information includes: Obtaining path information of an alternative forged attack route based on the topology information; Determine first forged attack line information based on the path information and branch flow information in the quantity measurement information The first forged attack line information is adjusted by using a depth-first search method to obtain the target forged attack line information.

8. The distribution network topology attack detection method based on interval state estimation according to claim 7 is characterized in that: The first forged attack line information is adjusted by using a depth-first search method to obtain the target forged attack line information: Obtaining endpoint information of the first forged attack line; The target forgery attack line information is determined between the start endpoint and the end endpoint in the endpoint information by using the depth-first search method.

9. An electronic device, characterized in that: include: A memory storing an executable program; A processor is used to run the program, wherein the program, when running, executes the distribution network topology attack detection method based on interval state estimation as described in any one of claims 1 to 8.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored executable program, wherein when the executable program is running, the device where the storage medium is located is controlled to execute the distribution network topology attack detection method based on interval state estimation as described in any one of claims 1 to 8.

Images