False data injection attack detection method

Abstract

The invention discloses a false data injection attack detection method, and belongs to the technical field of network security, and the method comprises the following steps: converting to-be-identified data into image data through a plurality of different modes, respectively converting the image data into different single-channel feature maps, and fusing the different single-channel feature maps to generate a multi-channel feature map; constructing a multi-scale fusion and convolution long short-term memory network model, and capturing multi-scale spatial features and time sequence information in the multi-channel feature map; and classifying the to-be-identified data in combination with the spatial features and the time sequence information. According to the method, multi-scale spatial feature and time sequence information capture is realized by adopting multi-scale fusion and a convolutional long-short-term memory network model, and the accuracy and generalization ability of image classification can be improved due to the combination of the spatial information and the time sequence information.

Description

Technical Field

[0001] The invention belongs to the technical field of network security, and in particular relates to a false data injection attack detection method. Background Art

[0002] False Data Injection Attack (FDIA) is a common network attack method that injects erroneous and invalid data into valid data, causing the control center to make wrong decisions due to the influence of false data.

[0003] Since the structure of intelligent network control systems is very complex, the decisions of each control center are affected by various factors. When attacks occur on intelligent network control systems, huge losses will be caused to the network control systems. Energy infrastructure such as electricity has a digital dependence on network control systems. Invasion of critical infrastructure through the injection of false data may have a serious impact on energy production and supply chains.

[0004] FDIA is extremely hidden and difficult to detect. Traditional FDIA detection methods use two-dimensional image data converted from FDIA data for training, which easily loses the temporal characteristics of the data. Therefore, it is urgent to study a fast, efficient and accurate FDIA detection method. Summary of the invention

[0005] The technical problem to be solved by the present invention is to overcome the above difficulties by capturing the time correlation characteristic information of data and discovering the spatial correlation patterns between different variables, avoiding the loss of data timing characteristics, thereby improving the detection effect of false data injection attacks.

[0006] To achieve the above object, the present invention provides a false data injection attack detection method, the technical solution is as follows:

[0007] A false data injection attack detection method comprises the following steps:

[0008] Step S1: converting the data to be identified into image data in a variety of different ways, respectively converting them into different single-channel feature maps, fusing the different single-channel feature maps to generate a multi-channel feature map;

[0009] Step S2: construct a multi-scale fusion and convolutional long short-term memory network model to capture the multi-scale spatial features and temporal information in the multi-channel feature map;

[0010] Step S3: Classify the data to be identified by combining spatial features and temporal information.

[0011] Furthermore, the multi-scale fusion and convolutional long short-term memory network model includes: a FFSE module (FFSE is a compression excitation network model based on feature fusion), a Parallel ResNet module (ResNet is a residual network), a TBiGRU module (TBiGRU represents a dual bidirectional gated recurrent unit) and a Fully Connected Layers module (Fully Connected Layers represents a fully connected layer) connected in sequence, wherein:

[0012] The FFSE module includes a multi-scale image feature fusion module (FF) and a channel attention module (SE);

[0013] The Parallel ResNet module includes at least a first ResNet structure and a second ResNet structure, and the first ResNet structure and the second ResNet structure are parallel to each other;

[0014] The TBiGRU module includes at least a first BiGRU layer and a second BiGRU layer;

[0015] The Fully Connected Layers module includes at least a linear layer, a first fully connected layer, and a second fully connected layer.

[0016] Furthermore, the first ResNet structure and the second ResNet structure have convolution kernels of different sizes.

[0017] Furthermore, the first ResNet structure includes several first ConvLSTM residual blocks; the second ResNet structure includes several second ConvLSTM residual blocks (ConvLSTM is a convolutional LSTM network).

[0018] Furthermore, the first ConvLSTM residual block and the second ConvLSTM residual block both include a forget gate, an input gate, an output gate, and a candidate memory unit.

[0019] Furthermore, the first ConvLSTM residual block and the second ConvLSTM residual block use a multi-layer structure of convolution kernels of different sizes to extract spatiotemporal features of input data of different granularities.

[0020] Furthermore, the first BiGRU layer and the second BiGRU layer are arranged in parallel with each other, and a Flip module is provided in front of the second BiGRU layer to perform a flip operation on the multi-channel feature map.

[0021] Furthermore, in step S1, the method of converting the data to be identified into image data includes:

[0022] The GASF transformation (Gramian Angular Summation Field) is used to transform the data to be identified into a first single-pass feature map containing spatial variations;

[0023] RP transformation (Recurrence Plots) is used to convert the data to be identified into a second single-channel feature map containing repeated features;

[0024] The MTF transform (Markov Transition Field) is used to transform the data to be identified into a third single-channel feature map containing frequency changes.

[0025] Furthermore, in step S1, the process of fusing different single-channel feature maps to generate a multi-channel feature map is as follows:

[0026] The first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are standardized respectively, and the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are spliced ​​to obtain a three-channel feature map.

[0027] Furthermore, the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are all two-dimensional images of (128, 128).

[0028] Furthermore, the three-channel feature map includes spatial variation, repetitive features and frequency variation features.

[0029] Compared with the prior art, the present invention has the following beneficial effects:

[0030] 1. The present invention adopts a multi-scale fusion and convolutional long short-term memory network model (FPResCLBGNet) to realize multi-scale spatial features and temporal information capture. In the forward propagation process of the model, the input image first passes through the FFSE module for feature fusion and self-attention calculation. Then, the fused features are simultaneously extracted through two branches of parallel ResNet (for example, 5×5 and 3×3 respectively). The extracted features are connected, combining spatial and temporal information to improve the accuracy and generalization ability of image classification;

[0031] 2. By leveraging the advantages of parallel ResNet and BiGRU, the model can better capture the complex features and dynamic changes of images;

[0032] 3. Through the FFSE module, the model can effectively fuse feature information from different spatial positions and channels, and at the same time enhance the representation of important features through the SE module; the different convolution kernel sizes in the ParallelResNet structure allow the model to capture multi-scale image features, improving the adaptability and expressiveness of the model; the introduction of the BiGRU layer enables the model to process sequence data and make full use of the temporal information of the image, and has a better effect on image data with time correlation (such as video frames); the various components of the model can be flexibly adjusted and expanded according to specific tasks and data characteristics, such as increasing or decreasing the number of ResNet blocks, changing the number of BiGRU layers, etc.

[0033] 4. A pooling fusion mechanism is introduced to further capture the dependencies within the data. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 Schematic diagram of the overall structure of a multi-scale fusion and convolutional long short-term memory network model of an embodiment of the present invention, in which GRM-image represents a GRM fusion image, FFSE represents a compression excitation network model based on feature fusion, ResNet represents a residual network, ResConvLSTMBlock represents a convolutional long short-term memory residual network block, TBiGRU represents a dual bidirectional gated recurrent unit, Linear represents a linear layer, Flatten represents a flattening operation, and cat represents a connection; the two ResNet structures in the figure can have different convolution kernels respectively;

[0035] Figure 2 1 is a first single-channel feature graph of an embodiment of the present invention, wherein (a) is a normal event and (b) is an attack event;

[0036] Figure 3 1 is a second single-channel feature graph of an embodiment of the present invention, wherein (a) is a normal event and (b) is an attack event;

[0037] Figure 4 3 is a single-channel characteristic diagram of an embodiment of the present invention, wherein (a) is a normal event and (b) is an attack event;

[0038] Figure 5 : is a multi-channel feature graph of an embodiment of the present invention, wherein (a) is a normal event and (b) is an attack event;

[0039] Figure 6 A schematic diagram of a TBiGRU module according to an embodiment of the present invention;

[0040] Figure 7This is a schematic diagram of the internal structure of the first ConvLSTM residual block or the second ConvLSTM residual block according to an embodiment of the present invention. The meanings of the symbols in the figure are as follows:

[0041]

[0042] Figure 8 Schematic diagram of the internal structure of the FFSE module according to an embodiment of the present invention, wherein Feature Fusion is a multi-scale image feature fusion (FF) module, SE block is a channel attention (SE) module, MaxPool2d is a two-dimensional maximum pooling layer, and AvgPool2d is an average two-dimensional pooling layer;

[0043] Fig. 9 Schematic diagram of the internal structure of a multi-scale image feature fusion module (FF) according to an embodiment of the present invention, where Conv2d is a two-dimensional convolution;

[0044] Fig.10 This is a schematic diagram of the internal structure of a channel attention module (SE) according to an embodiment of the present invention, where AdaptiveAvgPool2d represents a two-dimensional adaptive pooling layer, and Linear represents a linear layer. DETAILED DESCRIPTION

[0045] In order to further explain the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, a false data injection attack detection method proposed by the present invention, its specific implementation method, structure, characteristics and effects are described in detail as follows in combination with the accompanying drawings and preferred embodiments.

[0046] Example 1

[0047] The determination of whether there is false data is achieved by analyzing the data features. The presence of false data injection attack is marked as 1, and the absence of false data injection attack is marked as 0. Therefore, the detection of false data injection attack (FDIA) can be regarded as a binary classification problem. The present invention adopts a deep learning method to train the FDIA detection task.

[0048] The focus of the FDIA detection method is how to extract features. The present invention converts the data to be identified into images, and then uses the multi-scale fusion and convolutional long short-term memory network model (FPResCLBGNet) to extract features, and classifies the data to be identified according to the features. The specific scheme is as follows:

[0049] A false data injection attack detection method comprises the following steps:

[0050] Step S1: converting the data to be identified into image data in a variety of different ways, respectively converting them into different single-channel feature maps, fusing the different single-channel feature maps to generate a multi-channel feature map;

[0051] Step S2: construct a multi-scale fusion and convolutional long short-term memory network model (FPResCLBGNet) to capture the multi-scale spatial features and temporal information in the multi-channel feature map;

[0052] Step S3: Classify the data to be identified by combining spatial features and temporal information.

[0053] Further, such as Figure 1 As shown, the multi-scale fusion and convolutional long short-term memory network model includes: a FFSE module, a Parallel ResNet module, a TBiGRU module and a Fully Connected Layers module connected in sequence, wherein the Parallel ResNet module has a parallel ResNet network, and the TBiGRU module has a bidirectional gated recurrent unit (BiGRU).

[0054] Furthermore, the FFSE module includes a multi-scale image feature fusion module (FF) and a channel attention module (SEBlock); the input image can be spatially and channel-wise feature fused, and the self-attention mechanism can be calculated through the channel attention module (SEBlock);

[0055] The Parallel ResNet module includes at least a first ResNet structure and a second ResNet structure, and the first ResNet structure and the second ResNet structure are parallel to each other;

[0056] The TBiGRU module includes at least the first BiGRU layer and the second BiGRU layer, which are used to perform temporal modeling on the fused features to capture the temporal information in the image (see Figure 6 );

[0057] The Fully Connected Layers module includes at least a linear layer, a first fully connected layer, and a second fully connected layer, which are used to convert time series features into final classification outputs.

[0058] Example 2

[0059] The difference from Example 1 is that Figure 1 As shown, the first ResNet structure includes several first ConvLSTM residual blocks; the second ResNet structure includes several second ConvLSTM residual blocks.

[0060] Furthermore, the first ResNet structure and the second ResNet structure have convolution kernels of different sizes. In the present embodiment, the sizes of the convolution kernels are 5×5 and 3×3, respectively, so as to capture image features of different scales.

[0061] Furthermore, in the first ConvLSTM residual block and the second ConvLSTM residual block, the convolutional long short-term memory (ConvLSTM) operation is used to replace the traditional convolution layer. ConvLSTM can extract spatiotemporal related features from multivariate time series and capture the long-term dependencies in the sequence, so it is more suitable for processing data with time series information;

[0062] The ConvLSTM layer consists of a series of cascaded units that replace the matrix multiplication operations in ordinary long short-term memory (LSTM) units with convolution operations. In this way, ConvLSTM can not only capture the temporal correlation feature information of the data, but also discover the spatial correlation patterns between different variables. By using a multi-layer structure with different convolution kernel sizes, the spatiotemporal features of the input data of different granularities can be extracted.

[0063] like Figure 7 As shown, the first ConvLSTM residual block and the second ConvLSTM residual block both include a forget gate, an input gate, an output gate, and candidate memory units.

[0064] Furthermore, the first ConvLSTM residual block and the second ConvLSTM residual block use a multi-layer structure of convolution kernels of different sizes to extract spatiotemporal features of input data of different granularities.

[0065] Example 3

[0066] The difference from Example 1 and Example 2 is that Figure 6 As shown, in the TBiGRU module, the first BiGRU layer and the second BiGRU layer are parallel to each other, and the second BiGRU layer is preceded by a Flip module to perform a flip operation on the multi-channel feature map.

[0067] Example 4

[0068] The difference from Example 1-3 is that Figure 8-10 As shown, in the FFSE module of this embodiment, multiple convolutional layers of different sizes are used to extract feature information of different levels in the image features, taking into account the global information and local information of the image, and enhancing the expressiveness and stability of the model through activation functions and batch normalization layers. Finally, the features are downsampled through the pooling layer to reduce the size and calculation amount of the features.

[0069] The multi-scale image feature fusion module (FF, Feature Fusion module) is used to fuse feature information of different scales. It consists of three convolutional layers and one pooling layer. The first convolutional layer is used to extract the features of the input image, the second and third convolutional layers are used to further process the features, and the pooling layer is used to reduce the size of the features. The channel attention module (SEBlock) is an attention mechanism module that highlights the role of important features by weighted summation of features. In SEBlock, adaptive average pooling and fully connected layers are used to calculate the importance scores of features, and the scores are converted into weights through the Sigmoid function.

[0070] Example 5

[0071] The difference from Embodiments 1-4 is that, in the step S1, the method of converting the data to be identified into image data includes: using GASF transformation (Gramian Angular Summation Field) to convert the data to be identified into a first single-pass feature map containing spatial variations;

[0072] The RP transformation (Recurrence Plot) is used to convert the data to be identified into a second single-channel feature map containing repeated features;

[0073] The MTF transform (Markov Transition Field) is used to transform the data to be identified into a third single-channel feature map containing frequency changes.

[0074] The specific process is as follows:

[0075] The basic idea of ​​GASF is to convert the time series into a graphical representation of angles and distances, thereby capturing the local and global patterns of the time series, focusing on extracting the correlation between sample features with certain spatial characteristics, which is used for tasks such as pattern recognition and sample classification. 1 , x 2 , …, x n}It is necessary to first normalize it to the interval [-1, 1] according to formula (1) and express it as X'={x 1 ', x 2 ', ...x n '}.

[0076]

[0077] The normalized time series data X' is converted into polar coordinates using formula (2).

[0078] θ i =arccos(x′ i ), x′ i∈X′ (2)

[0079] Using polar coordinates, calculate GASF:

[0080]

[0081] According to GASF, the time series sample features of normal events and attack events are converted into a two-dimensional first single channel feature map, such as Figure 2 shown.

[0082] RP is a time series transformation method used to capture periodic and repetitive patterns in time series. It can be used to detect phase change points and sudden events in time series. Its features can be used as important features for time series classification and identification. First, the time series data needs to be transformed into phase space. Each feature data x in the time domain i Converted into the corresponding characteristic point s in phase space i , calculate the distance S between every two feature points in the phase space ij =||s i -s j ||. Then perform threshold binarization to obtain the recursive matrix:

[0083] R ij =θ(ε i -S ij ) (4)

[0084] where ε i is the threshold, θ is the jump function, as shown in formula (5):

[0085]

[0086] The second two-dimensional single-channel feature map obtained by using RP to perform feature conversion on the time series sample data is as follows: Figure 3 shown.

[0087] MTF image is a time series image representation method based on Markov transition matrix. Its core idea is to show the data characteristics of samples by describing the transition probability field of samples in time series.

[0088] Specifically, first, the time series data is divided into several bins according to the value range, ensuring that the amount of data in each bin is the same. Then, a Markov transition matrix is ​​constructed, which represents the probability of transferring from one bin to another in the time series. This probability field reflects the transfer law of samples in the time series.

[0089] In the process of generating MTF images, each pixel represents a bin, and the intensity of the pixel is determined by the corresponding Markov transition probability. Each pixel in the image is assigned a certain grayscale value by considering the transition behavior of the sample in time series, thus reflecting the correlation and evolution law of time series data.

[0090] In general, the MTF image uses the Markov transfer matrix to abstract and express the characteristics of time series data in the form of an image. This graphical representation helps to intuitively understand the dynamic characteristics of time series data, and can then play a role in tasks such as image analysis and pattern recognition.

[0091] The third channel feature image is the MTF image data obtained by converting the one-dimensional time series data, such as Figure 4 shown.

[0092] Furthermore, in step S1, the process of fusing different single-channel feature maps to generate a multi-channel feature map is as follows: standardizing the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map respectively, and splicing the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map to obtain a three-channel feature map, such as Figure 5 shown.

[0093] Furthermore, the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are all two-dimensional images of (128, 128).

[0094] Furthermore, the three-channel feature map includes spatial variation, repetitive features, and frequency variation features, and has stronger discriminability in classification and recognition tasks.

[0095] Example 6

[0096] In order to verify the effect of a false data injection attack detection method, this embodiment designs an experiment for verification.

[0097] 1. Experimental environment

[0098] The experiments in this embodiment use a 64-bit Windows 10 operating system, an Inte(R) Core(TM) i7-12700 CPU, 12 GB of memory, an Nvidia GeForce GTX 3060 GPU, a Python 3.7 compilation environment, and a Pytorch 1.10.1+cu111 deep learning framework.

[0099] 2. Experimental Dataset

[0100] The dataset comes from the public Google power system network attack dataset, which is collected by Oak Ridge National Laboratory. The dataset contains binary and tri-classified datasets. The tri-classified dataset contains no events, natural events, and attack events. The binary dataset contains normal events and attack events. Since the goal of this section is to identify attack events, a binary dataset is selected in this section. There are 15 sample subsets in this binary dataset, each with 4,000 to 6,000 samples. Each sample includes data collected by 4 sensors and snort alarm system logs. The sample features in each subset are shown in Table 1.

[0101] Table 1. Description of sensor measurement data characteristics

[0102]

[0103] 3. Experimental Setup

[0104] The data set used in the experiment contains 15 sample sets, and the statistical distribution of the samples is shown in Table 2.

[0105] Table 2 Sample distribution, situation table

[0106]

[0107] According to statistics, the total number of attack events is about 2.5 times the total number of normal events. In order to ensure that the data distribution of the training set and the test set is consistent, the training set and the test set data are divided according to the ratio of 7:3 in this experiment, that is, 0.30 data are randomly selected from the attack events and normal events and put into the test set. Such division can ensure that the attack events in the training set and the test set are about 2.5 times the normal events. And the training method uses a 5-fold cross-validation method for training, so that the model can fully learn all the training set data to improve the model performance. In addition, due to the imbalanced sample distribution of attack events and normal events, the AdaGrad optimization strategy is adopted. In order to obtain better model effects during the training process, the present embodiment adopts a learning rate decay strategy, and the learning rate is adjusted to 0.85 times the original after every 4 Epochs, so that the learning rate can be adjusted during the training process to obtain better training effects.

[0108] IV. Evaluation Indicators

[0109] In this embodiment, accuracy, precision, recall, and F1-score are used to evaluate the model's ability to process image features. The calculation methods of these four indicators are as follows.

[0110]

[0111] Among them, TP (true positive) represents the positive samples predicted by the model as positive, FP (false positive) represents the negative samples predicted by the model as positive, FN (false negative) represents the positive samples predicted by the model as negative, and TN (true negative) represents the negative samples predicted by the model as negative.

[0112] V. Analysis of experimental results

[0113] Through hyperparameter comparison experiments, ablation experiments, and comparison experiments with traditional methods, the false data injection attack detection method provided by the present invention has improved accuracy, precision, recall, and F1-score, and can improve the detection effect of false data injection attacks, as follows:

[0114] (I) Hyperparameter comparison experiment

[0115] Six sets of hyperparameter comparison experiments were conducted to select the learning rate and batch size that can make the model perform better. In the first four sets of experiments, the learning rate was set to 1×10 -3 , 1×10 -4 , 1×10 -5 , 1×10 -6 From Table 3, we can see that when the learning rate is 1×10 -4 When the learning rate is 1×10 -3 When the learning rate is 1×10 -5 , 1×10 -6 When the learning rate is small, the training process progresses slowly and requires a lot of training to converge. Therefore, we choose 1×10 -4 Used as the learning rate for training in this experiment.

[0116] When the learning rate is 1×10-4, due to the limited video memory of the experimental machine, the batch size is only set to 4, 8, and 16. As can be seen from Table 3, when the batch size is 8, the model performs relatively well. When the batch size is 4, the batch size is small and has large noise, making the value unstable; when the batch size is 16, the batch size is large, the gradient update is not frequent enough, and the generalization ability is reduced. Therefore, 8 is selected as the learning rate for the hyperparameter comparison experiment for training.

[0117] Table 3 Hyperparameter comparison

[0118]

[0119] (II) Ablation experiment

[0120] In order to verify the effectiveness of each module of the FPResCLBGNet model, this embodiment selectively splits the model module. In order to verify the effectiveness of the ConvLSTM module, the FPResBGNet model is designed in the ablation experiment of this embodiment. As can be seen from Table 4, after splitting the ConvLSTM module, each indicator has a decrease of 0.1-0.2. It can be seen that the advantage of this module in capturing long-term dependencies in the sequence is very obvious, and at the same time, it reflects from the side that timing information is very important in this task.

[0121] To verify the effectiveness of the FFSE module, the model was modified in the ablation experiment of this embodiment to design the PResCLBGNet model. From the comparison in Table 4, it can be seen that retaining the FFSE module will make the model performance better, indicating that the module can relatively better take into account the local and global features of the image.

[0122] In order to verify the effectiveness of the GRU module, this experiment designed the FPResCLNet model. Compared with the original model, it can be seen that the performance index values ​​of this model have decreased significantly, indicating that the GRU module also contributes to the temporal relationship in the model learning data.

[0123] Table 4 Ablation experiment

[0124]

[0125] (III) Comparative experiment

[0126] The traditional machine learning method, GAF-DenseNet121, Conv2dLSTM deep learning method and ResNet101 pre-trained model are reproduced on the same dataset, and the four evaluation indicators are calculated as shown in Table 5.

[0127] Table 5 Performance comparison of GRM-PResMABGNet / FPResCLBGNet and different algorithms

[0128]

[0129] In the comparative experiment, the ConvLSTM network and the DenseNet121 network were reproduced to train and predict the data set in this section. Among them, the effect of DenseNet121 is slightly better than ConvLSTM, and the accuracy and precision are significantly improved. In addition, the comparative experiment also uses the Resnet101 pre-training model to extract and classify the GRM mixed feature map. Compared with the above three deep learning methods, the GRM mixed feature map proposed in the present invention as the input method of FPResCLBGNet has improved the accuracy by about 0.01, the precision by about 0.02, the recall by about 0.03, and the F1-score by about 0.02. It can be seen that the combination of FFSE with PResNet and BiGRU can also better capture the complex features and time series features of the image. Therefore, the analysis principle and the comparison of the implementation results show that the method proposed in this section is slightly better than ConvLSTM, GAF-DenseNet and traditional machine learning methods.

[0130] The above content describes the basic principles and advantages of the present invention. Practitioners in this industry should understand that the above description is only for the preferred embodiments of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of this application.

Claims

1. A false data injection attack detection method, characterized in that: The steps include: Step S1: converting the data to be identified into image data in a variety of different ways, respectively converting them into different single-channel feature maps, fusing the different single-channel feature maps to generate a multi-channel feature map; Step S2: construct a multi-scale fusion and convolutional long short-term memory network model to capture the multi-scale spatial features and temporal information in the multi-channel feature map; Step S3: Classify the data to be identified by combining spatial features and temporal information.

2. The false data injection attack detection method according to claim 1, characterized in that: The multi-scale fusion and convolutional long short-term memory network model includes: a FFSE module, a Parallel ResNet module, a TBiGRU module and a Fully Connected Layers module connected in sequence, wherein: The FFSE module includes a multi-scale image feature fusion module and a channel attention module; The Parallel ResNet module includes at least a first ResNet structure and a second ResNet structure, and the first ResNet structure and the second ResNet structure are parallel to each other; The TBiGRU module includes at least a first BiGRU layer and a second BiGRU layer; The Fully Connected Layers module includes at least a linear layer, a first fully connected layer, and a second fully connected layer.

3. The false data injection attack detection method according to claim 2, characterized in that: The first ResNet structure and the second ResNet structure have convolution kernels of different sizes.

4. The false data injection attack detection method according to claim 2, characterized in that: The first ResNet structure includes several first ConvLSTM residual blocks; the second ResNet structure includes several second ConvLSTM residual blocks.

5. The false data injection attack detection method according to claim 4, characterized in that: The first ConvLSTM residual block and the second ConvLSTM residual block both include a forget gate, an input gate, an output gate, and candidate memory cells.

6. The false data injection attack detection method according to claim 4, characterized in that: The first ConvLSTM residual block and the second ConvLSTM residual block use a multi-layer structure with convolution kernels of different sizes to extract the spatiotemporal features of input data of different granularities.

7. The false data injection attack detection method according to claim 2, characterized in that: The first BiGRU layer and the second BiGRU layer are arranged in parallel with each other, and a Flip module is arranged in front of the second BiGRU layer to perform a flip operation on the multi-channel feature map.

8. The false data injection attack detection method according to claim 1, characterized in that: In step S1, the method of converting the data to be identified into image data includes: The GASF transformation is used to transform the data to be identified into a first single-pass feature map containing spatial variations; The RP transformation is used to convert the data to be identified into a second single-channel feature map containing repeated features; The MTF transform is used to convert the data to be identified into a third single-channel feature map containing frequency changes.

9. The false data injection attack detection method according to claim 8, characterized in that: In step S1, the process of fusing different single-channel feature maps to generate a multi-channel feature map is as follows: The first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are standardized respectively, and the first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are spliced ​​to obtain a three-channel feature map, wherein the three-channel feature map includes spatial variation, repetitive features, and frequency variation features.

10. The false data injection attack detection method according to claim 8, characterized in that: The first single-pass feature map, the second single-pass feature map, and the third single-pass feature map are all two-dimensional images of (128, 128).

Images