Electric power false data attack detection method and system based on graph convolutional network

Abstract

The invention relates to the technical field of data processing, in particular to an electric power false data attack detection method and system based on a graph convolutional network. The method comprises the steps of performing power grid state estimation based on SCADA system data; false data injection attack detection is carried out based on power grid state estimation; based on false data injection attack detection, constructing a graph neural network and performing FDIA detection by using the graph neural network; and analyzing the detection result, and judging whether the FDIA attack exists or not according to the calculation result of the node degree and the tuning parameter. The method based on the graph theory is adopted for detection, and the problem that in a traditional method, the safety of protected measurement data cannot be ensured all the time is solved.

Description

Technical Field

[0001] The present invention relates to the field of data processing technology, and in particular to a method and system for detecting false power data attacks based on a graph convolutional network. Background Art

[0002] In order to achieve reliable and safe operation of the power system, different measurement data showing the state of the grid are usually collected from each substation and transmitted to the control center, where these data are processed by the so-called Energy Management System (EMS). EMS consists of different functional modules and is designed to provide support tools for grid operators to help them make appropriate corrective and preventive measures. State estimation (SE) is one of the most important functions in EMS, which provides situational awareness to operators and thus maintains the safety of the grid. The grid state data generated by the state estimator serves as the basic data for running other EMS functions such as Contingency Analysis (CA), Optimal Power Flow (OPF), etc. Therefore, the security of the state estimator is crucial to maintain the safe operation of the power grid.

[0003] So far, a lot of research has been conducted on the vulnerability of state estimators to cyber attacks. One of the most insidious and destructive types of cyber attacks is the so-called false data injection attack (FDIA). In this attack, the attacker injects false data into the grid measurement data to achieve his goal. This operation is done in such a way that the traditional bad data detection module located in the grid control center cannot detect the tampering of the measurement data. Recently proposed FDIA construction methods use different assumptions to construct the attack vector. These assumptions can be divided into two major categories, namely, whether the direct current (DC) or alternating current (AC) model of the state estimator is considered, and whether the attacker has complete information about the grid topology and measurement data.

[0004] Security vulnerability issue: Traditional approaches focus on protecting a set of existing measurements or adding some new secure measurements to the grid to defend against attacks. The main drawback of such approaches is that it is not always possible to ensure that the protected measurements remain secure. For example, synchronized phasor measurement unit (PMU) data were considered secure in the past, but recent studies have shown that they are also vulnerable to attacks. Therefore, it is always possible for an attacker to break through the security protection measures of these measurements and compromise the security of the state estimator.

[0005] Detection accuracy issues: Traditional methods focus on using mathematical tools (such as statistical methods or machine learning methods) to detect attacks or increase the difficulty for attackers. However, the detection methods previously proposed in this category also have some limitations. Most of these methods are formulated and tested based on the direct current (DC) model of the state estimator. However, the performance of these methods under the alternating current (AC) model cannot be guaranteed, which is commonly used in power grid control centers. This is because the nonlinearity in the AC model enables attackers to exploit the coexisting false solutions of the AC state estimation problem to construct sparse-based attacks. When using DC FDIA detection methods to detect AC FDIA, only general detection accuracy can be achieved. Summary of the invention

[0006] Cyber-attack: refers to an attack on computer systems, networks or data through the Internet with the purpose of destroying, disclosing, changing or gaining unauthorized access to these resources.

[0007] False Data Injection Attack: This is a specific type of cyber attack in which the attacker injects false or modified data into the system to mislead the normal operation or decision-making process of the system. In power systems, FDIAs may target the state estimator, causing the grid control center to receive incorrect grid state information.

[0008] Graph Neural Networks (GNNs): A type of neural network that specializes in processing graph data and can capture the complex relationships between nodes and the characteristics of the graph structure.

[0009] Outlier Detection: A data analysis technique used to identify anomalies or outliers in a data set. These outliers may represent measurement errors, data entry errors, or intentional fraud. In power system state estimation, outlier detection can help identify data anomalies that may be caused by FDIAs.

[0010] State Estimation: In power systems, state estimation is a computational process used to determine the operating state of the power grid at a specific point in time, usually including the magnitude and phase angle of the voltage. State estimation is critical to the stable operation and control of the power grid.

[0011] SCADA: Supervisory Control and Data Acquisition system.

[0012] In order to solve the above-mentioned problems, the present invention provides a method and system for detecting false power data attacks based on graph convolutional networks.

[0013] In the first aspect, the present invention provides a method for detecting false power data attacks based on a graph convolutional network, which adopts the following technical solutions: A method for detecting false power data attacks based on a graph convolutional network, comprising: Obtain SCADA system data; Grid status estimation based on SCADA system data; Detection of false data injection attacks based on power grid state estimation; Based on false data injection attack detection, a graph neural network is constructed and used for FDIA detection; Analyze the detection results and determine whether there is an FDIA attack based on the calculation results of the node degree and the tuning parameters.

[0014] Furthermore, the power grid state estimation based on the SCADA system data includes processing the SCADA system data through a state estimator, utilizing the redundancy in the measurement data, and finding an estimated value of the system state vector that best fits the measurement data, expressed as: Where z, x, and e represent the measurement vector, state vector, and measurement error vector, respectively; h represents the nonlinear relationship function; argmin represents the “parameter value that minimizes the objective function”; and W is a diagonal matrix, each element of which is equal to the inverse of the corresponding measurement accuracy.

[0015] Furthermore, the false data injection attack detection based on power grid state estimation includes calculating the difference between the state variables at the current moment and the previous moment after the state estimation is completed to form a variable change vector , using the three sigma rule to identify the variable change vector The outliers in in, Represents the estimated state vector at the current moment.

[0016] Furthermore, the construction of a graph neural network and the use of the graph neural network for FDIA detection include constructing an undirected weighted graph G. For each bus, if at least one of its corresponding variables is identified as an outlier, a node is added to the graph to represent the bus, and the node is connected with a self-loop, and the weight of the edge is half of the number of abnormal variables related to the bus.

[0017] Furthermore, the method of constructing a graph neural network and using the graph neural network to perform FDIA detection also includes, for each branch, if at least one of its corresponding variables is identified as an outlier, adding two nodes representing the two ends of the branch to the graph, and connecting the two nodes with an edge, where the weight of the edge is the number of abnormal variables related to the branch.

[0018] Furthermore, the construction of a graph neural network and the use of the graph neural network for FDIA detection also includes calculating the degree and weighted degree of each node in an undirected weighted graph, and comparing them with a predefined threshold. If the degree of at least one node in the graph exceeds the threshold, an FDIA attack is considered to be detected.

[0019] Furthermore, the method of determining whether there is an FDIA attack based on the calculation results of the node degree and the tuning parameters includes adjusting two key parameters in the detection algorithm: the number of adjustable points τ nodes and node strength threshold τ strength ,To optimize the accuracy of detection, it is determined whether there is a FDIA attack based on the calculation results of the node degree and the tuned parameters.

[0020] In the second aspect, a power false data attack detection system based on graph convolutional network includes: The data acquisition module is configured to acquire SCADA system data; An estimation module is configured to estimate a power grid state based on SCADA system data; An attack detection module is configured to perform false data injection attack detection based on power grid state estimation; The FDIA detection module is configured to, based on false data injection attack detection, construct a graph neural network and use the graph neural network to perform FDIA detection; The judgment module is configured to analyze the detection results and determine whether a FDIA attack exists based on the calculation results of the node degree and the tuning parameters.

[0021] In a third aspect, the present invention provides a computer-readable storage medium storing a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, for a method for detecting false power data attacks based on a graph convolutional network.

[0022] In a fourth aspect, the present invention provides a terminal device comprising a processor and a computer-readable storage medium, the processor being used to implement various instructions; the computer-readable storage medium being used to store a plurality of instructions, the instructions being suitable for being loaded and executed by the processor, a method for detecting false power data attacks based on a graph convolutional network.

[0023] In summary, the present invention has the following beneficial technical effects: 1. Enhanced security: By adopting a graph-based method for detection, the problem of not always ensuring the security of protected measurement data in traditional methods is solved. Unlike traditional methods that rely on the protection of specific measurement data, this method uses the outliers detected during the power grid state estimation process and uses graph theory analysis to determine whether these outliers are caused by false data injection attacks, thereby effectively improving the protection capabilities against various types of attacks, and maintaining a high level of security even when the attacker breaks through some security protection measures.

[0024] 2. Improved detection accuracy: The proposed method performs well in detecting false data injection attacks in AC state estimation. Compared with the traditional method based on DC model, this method takes into account the nonlinear characteristics in the AC model, calculates the probability distribution of the estimated variables through historical data, and detects attacks by identifying and analyzing outliers. This approach overcomes the problem of insufficient detection accuracy of traditional DC FDIA detection methods in AC environment, thereby significantly improving the detection accuracy of FDIA in AC environment.

[0025] 3. Adaptability and robustness: Since this method does not rely on a specific grid topology or the security of the measured data, its detection mechanism can still maintain a high detection effect in the face of grid topology changes or incomplete information from attackers. In addition, this method can adaptively adjust the detection threshold according to changes in grid operation conditions, further improving the robustness and adaptability of the system and reducing false positives and false negatives caused by changes in grid status. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] Figure 1 is a schematic diagram of a method for detecting false power data attacks based on a graph convolutional network according to Embodiment 1 of the present invention; Figure 2 It is a schematic diagram of the structure of the graph neural network of Example 1 of the present invention. DETAILED DESCRIPTION

[0027] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0028] Example 1 Reference Figure 1 , a method for detecting false power data attacks based on a graph convolutional network in this embodiment specifically includes the following steps: S1.SCADA system data collection: 1. The operation of the power system is usually carried out by monitoring the voltage amplitude, phase angle and injected power on the bus, as well as the power flow in the transmission line. The supervisory control system (SCADA) collects these measurements and transmits them to the control center.

[0029] 2. Collect real-time measurement data from the SCADA system in the power grid, including voltage amplitude, phase angle, active power and reactive power injection of the bus, and power flow in the transmission line.

[0030] S2. Grid state estimation: 1. The operation of the power grid is usually achieved by monitoring the voltage amplitude, phase angle and power injection value on the bus and the power flow in the transmission line. The Supervisory Control and Data Acquisition System (SCADA) collects these measurement data and transmits them to the control center. However, these measurement data may have errors. These errors are usually caused by inaccuracies in the measuring equipment, noise in the communication lines, etc. In order to deal with these errors, the raw measurement data first needs to be processed by a state estimator. The goal of this process is to exploit the redundancy in the measurement data and find an estimate of the system state vector (bus voltage amplitude and phase angle, the phase angle of the reference bus is considered to be zero) that best fits the measurement data. This is achieved by considering the nonlinear relationship between the measurement data and the state variables.

[0031] In the above equation, z, x and e represent the measurement vector, state vector and measurement error vector respectively, and h represents the nonlinear relationship function.

[0032] 2. To find an estimate of the system state vector The most widely used method is the weighted least squares method (WLS). According to this method, The value of can be obtained by solving the following equation: Where argmin represents the parameter value that minimizes the objective function and W is a diagonal matrix whose elements are equal to the inverse of the corresponding measurement accuracy.

[0033] 3. After the state estimation is completed, use the maximum standardized residual to detect and remove bad data in the measurement data. If the residual If the threshold r is exceeded, it is considered that bad data exists, and it is removed and the state estimation is performed again.

[0034] S3. Detection of false data injection attacks: 1. Calculate the variable change vector. After the state estimation is completed, calculate the difference between the state variables at the current moment and the previous moment to form the variable change vector : in, Represents the estimated state vector at the current moment.

[0035] 2. Outlier detection, using the “three sigma rule” to identify variable change vectors If the change of a variable exceeds the range of its mean μ and three times the standard deviation σ, the variable is considered an outlier. It is expressed as: .

[0036] S4. FDIA detection based on graph neural network: 1. Based on the identified outliers, construct an undirected weighted graph G: For each bus, if at least one of its corresponding variables (such as voltage amplitude, phase angle, etc.) is identified as an outlier, add a node to the graph to represent the bus, and connect the nodes with self-loops. The weight of the edge is half of the number of outlier variables related to the bus.

[0037] 2. For each branch, if at least one of its corresponding variables (such as power flow) is identified as an outlier, two nodes representing the two ends of the branch are added to the graph and connected by an edge, where the weight of the edge is the number of outlier variables associated with the branch.

[0038] It is expressed as: , where I is the indicator function, which takes the value of 1 when v is greater than the threshold, otherwise it is 0.

[0039] 3. Calculate the degree of each node in the graph, especially the weighted degree (node ​​strength s i ), and compare it with a predefined threshold τ strength If the degree of at least one node in the graph exceeds the threshold, it is considered that an FDIA attack is detected. It is expressed as: .

[0040] S5. Parameter tuning and result analysis: 1. Tune the detection parameters and adjust two key parameters in the detection algorithm: τ nodes (adjustable number of points) and τ strength (node ​​strength threshold) to optimize the accuracy of detection. Different attack scenarios are simulated by using historical data, and the performance of different parameter combinations is evaluated using "balanced accuracy (BA)", which is expressed as: TP is the true positive, which indicates the number of samples that actually have attacks and are detected. FN is the false negative, which indicates the number of samples that actually have attacks but are not detected. TN is the true negative, which indicates the number of samples that actually have no attacks and are not detected. FP is the false positive, which indicates the number of samples that actually have no attacks but are detected.

[0041] 2. Analyze the detection results and determine whether there is an FDIA attack based on the calculation results of the node degree and the tuned parameters. If an attack is detected, record the location and impact range of the attack; if no attack is detected, store the current data sample in the historical database for subsequent analysis.

[0042] Determine whether there is an FDIA attack and record the location and impact range of the attack: , E anomaly Is connected to V anomaly The set of edges in the node.

[0043] S6. Real-time application and monitoring: 1. Continue to collect measurement data from the SCADA system and repeat the above steps to detect FDIA attacks in real time.

[0044] 2. If an attack is detected, take appropriate response measures immediately, such as isolating the affected bus or adjusting the grid operation strategy to ensure the security and stability of the grid.

[0045] like Figure 2 The paper presents a false data injection attack detection method in power system based on graph convolutional neural network. The figure is divided into five main parts, and the following is the description and explanation of each part: State estimation: In this section, different state estimation results (labeled as G1, G2, G3, etc.) are graphically represented. Each state corresponds to a specific moment or condition in the power grid, such as different measured values ​​of voltage, power, etc.

[0046] Graph Data Conversion: This part converts the raw state estimation data into graph data. Different graphs (G1, G2, etc.) are shown in the figure, each representing a specific state of the power grid. Nodes may represent buses or power components in the power grid, while edges represent electrical connections or data flows between these components.

[0047] Graph feature extraction: In the graph feature extraction stage, key information and features are extracted from each graph, which may include graph features such as node degree, graph density, clustering coefficient, etc. These features are used for subsequent analysis and pattern recognition.

[0048] Abnormal pattern recognition: This part identifies potential abnormalities or attack patterns by analyzing the extracted features. The red highlights in the figure may indicate detected anomalies or changes that may be signs of FDIA.

[0049] Anomaly Analysis: Ultimately, the anomaly patterns are validated and analyzed in detail through a series of analytical tools to determine if they do represent a security threat. The figure may show a specific instance (G2) that was identified as an anomaly and analyzed in detail.

[0050] Example 2 This embodiment provides a power false data attack detection system based on a graph convolutional network, including: The data acquisition module is configured to acquire SCADA system data; An estimation module is configured to estimate a power grid state based on SCADA system data; An attack detection module is configured to perform false data injection attack detection based on power grid state estimation; The FDIA detection module is configured to, based on false data injection attack detection, construct a graph neural network and use the graph neural network to perform FDIA detection; The judgment module is configured to analyze the detection results and determine whether a FDIA attack exists based on the calculation results of the node degree and the tuning parameters.

[0051] A computer-readable storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded and executed by a processor of a terminal device, for a method for detecting false power data attacks based on a graph convolutional network.

[0052] A terminal device includes a processor and a computer-readable storage medium, wherein the processor is used to implement various instructions; the computer-readable storage medium is used to store multiple instructions, and the instructions are suitable for being loaded and executed by the processor to detect a method for false power data attacks based on a graph convolutional network.

[0053] The above are all preferred embodiments of the present invention, and are not intended to limit the protection scope of the present invention. Therefore, any equivalent changes made based on the structure, shape, and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for detecting false power data attacks based on graph convolutional networks, characterized in that: include: Obtain SCADA system data; Grid status estimation based on SCADA system data; Detection of false data injection attacks based on power grid state estimation; Based on false data injection attack detection, a graph neural network is constructed and used for FDIA detection; Analyze the detection results and determine whether there is an FDIA attack based on the calculation results of the node degree and the tuning parameters.

2. According to claim 1, a method for detecting false power data attacks based on graph convolutional networks is characterized in that: The power grid state estimation based on the SCADA system data includes processing the SCADA system data through a state estimator, and using the redundancy in the measurement data to find an estimated value of the system state vector that best suits the measurement data, expressed as: Where z, x, and e represent the measurement vector, state vector, and measurement error vector, respectively; h represents the nonlinear relationship function; argmin represents the parameter value that minimizes the objective function; and W is a diagonal matrix, each element of which is equal to the inverse of the corresponding measurement accuracy.

3. According to claim 2, a method for detecting false power data attacks based on graph convolutional networks is characterized in that: The false data injection attack detection based on power grid state estimation includes calculating the difference between the state variables at the current moment and the previous moment after the state estimation is completed to form a variable change vector , using the three sigma rule to identify the variable change vector The outliers in in, Represents the estimated state vector at the current moment.

4. According to claim 3, a method for detecting false power data attacks based on graph convolutional networks is characterized in that: The method of constructing a graph neural network and using the graph neural network to perform FDIA detection includes constructing an undirected weighted graph G. For each busbar, if at least one of its corresponding variables is identified as an outlier, a node is added to the graph to represent the busbar, and the node is connected with a self-loop, and the weight of the edge is half of the number of abnormal variables related to the busbar.

5. According to claim 4, a method for detecting false power data attacks based on graph convolutional networks is characterized in that: The method of constructing a graph neural network and using the graph neural network to perform FDIA detection also includes, for each branch, if at least one of its corresponding variables is identified as an outlier, adding two nodes representing both ends of the branch to the graph, and connecting the two nodes with an edge, where the weight of the edge is the number of abnormal variables related to the branch.

6. According to claim 5, a method for detecting false power data attacks based on graph convolutional networks is characterized in that: The method of constructing a graph neural network and using the graph neural network to perform FDIA detection also includes calculating the degree and weighted degree of each node in an undirected weighted graph and comparing them with a predefined threshold. If the degree of at least one node in the graph exceeds the threshold, it is considered that an FDIA attack is detected.

7. The method for detecting false power data attacks based on graph convolutional networks according to claim 6 is characterized in that: The method of judging whether there is an FDIA attack based on the calculation results of the node degree and the tuning parameters includes adjusting two key parameters in the detection algorithm: the number of adjustable points τ nodes and node strength threshold τ strength ,To optimize the accuracy of detection, it is determined whether there is a FDIA attack based on the calculation results of the node degree and the tuned parameters.

8. A power false data attack detection system based on graph convolutional network, characterized in that: include: The data acquisition module is configured to acquire SCADA system data; An estimation module is configured to estimate a power grid state based on SCADA system data; An attack detection module is configured to perform false data injection attack detection based on power grid state estimation; The FDIA detection module is configured to, based on false data injection attack detection, construct a graph neural network and use the graph neural network to perform FDIA detection; The judgment module is configured to analyze the detection results and determine whether a FDIA attack exists based on the calculation results of the node degree and the tuning parameters.

9. A computer-readable storage medium storing a plurality of instructions, characterized in that: The instructions are suitable for being loaded by a processor of a terminal device and executing a method for detecting false power data attacks based on a graph convolutional network as described in claim 1.

10. A terminal device, comprising a processor and a computer-readable storage medium, wherein the processor is used to implement each instruction; and the computer-readable storage medium is used to store multiple instructions, characterized in that: The instructions are suitable for being loaded by a processor and executing the method for detecting false power data attacks based on a graph convolutional network as described in claim 1.

Images