False data injection attack detection method based on measurement physical recovery

Abstract

The invention discloses a false data injection attack detection method based on measurement physical recovery, and relates to the technical field of network security, and the method comprises the steps: obtaining a current abnormal data set, different from a normal data set, of a detection object; obtaining a historical abnormal data set of the detection object, and determining a threshold range used for detecting the current abnormal data set through a difference value between the historical abnormal data set and the normal data set; and executing a first repair action on the current abnormal data set according to the threshold range, so that the current abnormal data set falls into the threshold range. The method has the advantages that physical constraint is introduced, physical restoration action is executed on the current abnormal data set, enough accuracy and reliability of current abnormal data set restoration are improved, the current abnormal data set and hidden problems brought by the current abnormal data set to a power system are solved, and the power system reliability is improved. And the accurate capture and timely repair of later abnormal data by the power system can be improved.

Description

Technical Field

[0001] The invention relates to the technical field of network security, and in particular to a false data injection attack detection method based on measuring physical recovery. Background Art

[0002] With the deep integration of information technology and power engineering, the power grid has evolved into a complex cyber-physical smart grid (CPSG). The stable operation of the power system depends on the accurate state estimation process (SE), which requires measurement data provided by devices such as remote terminal units (RTU), supervisory control and data acquisition systems (SCADA) and phasor measurement units (PMU). However, the high interconnectivity of CPSG also introduces new security challenges, such as denial of service attacks, load redistribution attacks and false data injection attacks (FDIA). Among them, FDIA tampered with the measurement data points, destroyed the integrity of the measurement data, thereby affecting the results of SE, seriously threatening the safe operation of the power grid.

[0003] Existing technologies have some limitations when dealing with FDIA. First, in a complex AC power grid noise environment, it is difficult for existing technologies to accurately distinguish attack signals from normal data, resulting in reduced detection accuracy and increased false alarm rates. Second, current detection strategies rely on historical data and empirical models, which may not be flexible or accurate enough when facing dynamically changing networks or unknown attack patterns. Finally, although the FDIA detection model based on deep learning has certain innovations, its "black box" characteristics make the internal principle process of the model invisible and its reliance on high-quality data limits its physical interpretability and adaptability to diverse data environments. Summary of the invention

[0004] In order to overcome the problems existing in the related art, the embodiment of the present disclosure provides a false data injection attack detection method based on measuring physical recovery. The technical solution is as follows:

[0005] According to a first aspect of an embodiment of the present disclosure, a false data injection attack detection method based on measuring physical recovery is provided, comprising:

[0006] Obtain a current abnormal data set that is different from a normal data set;

[0007] Acquire a historical abnormal data set of the detection object, and determine a threshold range for detecting the current abnormal data set by a difference between the historical abnormal data set and the normal data set;

[0008] A first repairing action is performed on the current abnormal data set according to the threshold range, so that the current abnormal data set falls within the threshold range.

[0009] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: the present invention actively acquires the measurement data of the power system including the RTU to ensure the authenticity, accuracy and reliability of the measurement data, and quickly identifies all data that are different and / or different from the normal data through a preliminary data detection mechanism, thereby ensuring the comprehensive coverage of the current abnormal data set when it is initially collected, and avoiding any abnormal data from being missed; combining the historical abnormal data set to obtain a collection of differences between it and the normal data set, it is possible to ensure the accuracy and reliability of the threshold range determination standard established based on the difference collection, thereby ensuring the accuracy of the threshold range, which can not only more accurately verify the authenticity of the current abnormal data set, but also more accurately repair the current abnormal data set; based on the threshold The first repair action can be performed at least once on the current abnormal data set until the initially determined abnormal data value is restored to the range of the normal data set. This not only solves the current abnormal data set and its potential problems for the power system (such as misleading the system to make wrong decisions, causing unstable power supply, ineffective allocation of power resources, and increasing the damage to the system caused by real faults for a long time), but also helps the system update the abnormal data detection model to make it more in line with the actual operating state of the power system that may be subject to abnormal data, improve the robustness and generalization of the model and system, and the system can tolerate a certain degree of abnormal data while distinguishing and responding to new abnormal data, reducing false positives and negative positives of abnormal data, thereby helping to improve the power system's accurate capture and timely repair of subsequent abnormal data.

[0010] Although the present invention utilizes historical data, it does not need to rely on historical data to accurately capture abnormal data, nor does it need to replace or make up for the abnormal data. At the same time, the above-mentioned operation processes of the present invention are closely linked, aiming to solve low-quality and / or abnormal data, without relying on high-quality data, ensuring data diversity and improving the environmental adaptability of data.

[0011] According to a second aspect of an embodiment of the present disclosure, a false data injection attack detection method based on measuring physical recovery is provided, comprising:

[0012] Obtain a current abnormal data set that is different from a normal data set;

[0013] performing a second repairing action on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set;

[0014] Acquire a historical abnormal data set of the detection object, and determine a threshold range for detecting the current abnormal data set by a difference between the historical abnormal data set and the normal data set;

[0015] A first repairing action is performed on the current abnormal data set according to the threshold range, so that the current abnormal data set falls within the threshold range.

[0016] The technical solution provided by the embodiments of the present disclosure may include the following beneficial effects: the present invention quickly identifies all data that are different and / or discrepant from normal data through a preliminary data detection mechanism, divides the measurement data into a normal data set and an abnormal data set, performs a second repair action on the current abnormal data set, and narrows the gap between the current abnormal data set and the normal data set; combines the historical abnormal data set to obtain a collection of differences between it and the normal data set, establishes a threshold range determination standard based on the collection of differences, and performs at least one first repair action on the current abnormal data set after the second repair action based on the threshold range, until the abnormal data value is restored to the range of the normal data set; the present invention performs two repair actions on the current abnormal data set, not only ensuring that the current abnormal data set falls within the threshold range, but also ensuring that the current abnormal data set falls within the threshold range. It not only improves the accuracy and reliability of the recovery of the current abnormal data set, but also ensures that the corresponding models can be updated respectively based on the abnormal data detection and verification after the two repair actions. Among them, the model feedback result based on the first repair action can also supervise and promote the model update of the second repair action, which greatly improves the robustness and generalization of the two groups of repair models and the system detection model, so that the system can tolerate a greater degree of abnormal data while distinguishing and responding to new abnormal data. It not only helps to improve the power system's accurate capture and timely repair of subsequent abnormal data, but also ensures that the current abnormal data set and its hidden problems to the power system (such as misleading the system to make wrong decisions, causing unstable power supply, ineffective allocation of power resources, and increasing the damage to the system caused by real faults for a long time) are solved.

[0017] Although the present invention utilizes historical data, it does not need to rely on historical data to accurately capture abnormal data, nor does it need to replace or make up for the abnormal data. At the same time, the above-mentioned two repair operations of the current abnormal data set of the present invention are closely linked, aiming to solve low-quality and / or abnormal data, without relying on high-quality data, ensuring data diversity and improving the environmental adaptability of data.

[0018] In one embodiment, determining a threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set comprises the following steps:

[0019] Acquire difference data between each abnormal data in the historical abnormal data set and corresponding normal data in the normal data set as a difference set, and establish a standard object corresponding to each group of difference data in the difference set;

[0020] Calculating the distance between each set of difference data in the difference set and the corresponding standard object to obtain a distance value collection corresponding to the difference set;

[0021] A first sorting action is performed on the distance value collection corresponding to the difference value set, and a specific range of the distance value collection after sorting is determined as a preset threshold.

[0022] In one embodiment, the standard object represents a set of Gaussian distribution models with the smallest distance value corresponding to each set of difference data in a mixture model of the Gaussian distribution set established based on the difference set;

[0023] The first sorting action means to arrange the distance values ​​in the distance value collection corresponding to the difference value set in a normal order according to their sizes;

[0024] The specific range of the preset threshold is the 95% quantile of the distance value set corresponding to the difference set;

[0025] If the distance value of any set of measurement data is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the distance value of the set of measurement data falls outside the threshold range, and the set of measurement data is determined to be in an abnormal state.

[0026] In one embodiment, determining a threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set further includes the following steps:

[0027] Measure the detection object at least once and obtain the current measurement data set;

[0028] Preliminarily determining at least one group of current abnormal data values ​​according to at least one abnormal display of each measurement data in the current measurement data set;

[0029] A candidate set of the current abnormal data value and / or the current abnormal data value after the second repairing action is determined according to the threshold range.

[0030] In one embodiment, the mixed model p(d|Θ) of the Gaussian distribution set established based on the difference set is expressed as:

[0031]

[0032] in, represents the i-th group of Gaussian distribution;

[0033] represents the normal data set; d represents the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set; μ i represents the mean vector, which is the center of the Gaussian distribution of the i-th group; Σ i represents the covariance matrix, which is the shape and direction of the i-th group of Gaussian distribution; φ i Represents the mixing coefficient, which is the weight of the i-th group of Gaussian distribution in the model.

[0034] In one embodiment, the candidate set C of the current abnormal data value is determined i , expressed as:

[0035]

[0036] Among them, c i represents the candidate current abnormal data value; Indicates the currently determined abnormal data value and / or normal data value; Represents the candidate current abnormal data value c i Compared with the current abnormal data value and / or normal data value determined initially The Euclidean distance between loss Represents the current abnormal data value c of the detection candidate i Compared with the current abnormal data value and / or normal data value determined initially The preset threshold for the Euclidean distance difference between them.

[0037] In one embodiment, performing a first repair action on the current abnormal data set according to the threshold range so that the current abnormal data set falls within the threshold range includes the following steps:

[0038] Acquire a first difference collection and / or a second difference collection, and respectively perform a first physical constraint on each first difference data and / or second difference data in the first difference collection and / or the second difference collection;

[0039] Detecting the first difference data and / or the second difference data after passing the first physical constraint by using the threshold range;

[0040] If the first difference data and / or the second difference data after the first physical constraint is greater than and / or equal to the 95% quantile of the distance value collection corresponding to the difference set, it is determined that the abnormal data value corresponding to the first difference data and / or the second difference data after the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the first difference data and / or the second difference data after the first physical constraint;

[0041] If the first difference data and / or the second difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value collection corresponding to the difference set, it is determined that the first difference data and / or the second difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

[0042] In one embodiment, the first difference value represents the difference between each abnormal data value in the current abnormal data set and each abnormal data value in the candidate set after the second repair action;

[0043] The second difference value represents the difference between each abnormal data value in the candidate set and each normal data value in the normal data set;

[0044] The first physical constraint represents a calculation process for reducing the value of the first difference and / or the second difference;

[0045] The first repairing action means assisting each abnormal data value in the current abnormal data set and / or each abnormal data value after the second repairing action to be restored to the range of the normal data set;

[0046] The second repairing action represents assisting each abnormal data value in the current abnormal data set to be restored to the range of the normal data set.

[0047] In one embodiment, obtaining the first difference collection and / or the second difference collection, and performing first physical constraints on each first difference data and / or second difference data in the first difference collection and / or the second difference collection, respectively, comprises the following steps:

[0048] The numerical values ​​of each abnormal data value in the current abnormal data set, each current abnormal data value in the candidate set, each abnormal data value in the candidate set after the second repair action, and each normal data value in the normal data set are respectively set to facilitate satisfying the first physical constraint process of the first difference and / or the second difference;

[0049] The first physical constraint is applied to the first difference and / or the second difference, and the expression is:

[0050]

[0051] Where ε(m,n) represents the overall loss function, which is the sum of the first difference and / or the second difference; L(Z i ) represents the basic loss function, which is used to measure the basic first difference and / or second difference; the regularization term Used to measure the Euclidean distance between the real voltages m1 and m2 to prevent overfitting; Used to measure the Euclidean distance between the imaginary voltages n1 and n2 to prevent overfitting; β m ||m1-m2||2 is used to measure the Manhattan distance between the real voltages m1 and m2, encouraging sparse solutions; β n ||n1-n2||1 is used to measure the Manhattan distance between the imaginary voltages n1 and n2, encouraging sparse solutions.

[0052] In one embodiment, performing a second repair action on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set includes the following steps:

[0053] Building a second repair model of the current abnormal data set based on the explicit and implicit features of the normal data set;

[0054] adding a second physical constraint process in the second repair model;

[0055] A second physical constraint is performed on the second difference to reduce a value of the second difference.

[0056] In one embodiment, the second physical constraint represents a calculation process for reducing the second difference value, and the expression is:

[0057]

[0058] Among them, the loss function L(Z i ) represents training of the second repair model; T represents the length of the time series; P represents the number of measurement values ​​in the current measurement data set; f e represents the mapping function of the second repair model, which is used to extract the features of the input value of the normal data set; d A mapping function representing the second repair model, used to restore the input value of the current abnormal data set; represents the normal data set input value at the jth time step; ·2 represents the L2 norm, which represents the Euclidean distance of the measured values.

[0059] The beneficial effects of the present invention are as follows: by introducing physical constraints, physical repair actions are performed on the current abnormal data set, thereby improving the sufficient accuracy and reliability of the recovery of the current abnormal data set, ensuring that the current abnormal data set and its potential problems to the power system (such as misleading the system to make wrong decisions leading to unstable power supply, ineffective allocation of power resources, and increasing the damage to the system caused by real faults for a long time) are solved, and also helping the system to update the abnormal data detection model to make it more in line with the actual operating state of the power system that may be subject to abnormal data, improving the robustness and generalization of the model and the system, the system can tolerate a certain degree of abnormal data while also distinguishing and responding to new abnormal data, reducing false positives and omissions of abnormal data, thereby helping to improve the power system's accurate capture and timely repair of subsequent abnormal data.

[0060] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. DETAILED DESCRIPTION

[0061] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present disclosure. Instead, they are merely examples of devices and methods consistent with some aspects of the present disclosure as detailed in the appended claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0063] Figure 1 The present invention is a flowchart of an implementation method of a false data injection attack detection method based on measuring physical recovery.

[0064] Figure 2 The present invention is a flowchart of another implementation method of a false data injection attack detection method based on measuring physical recovery.

[0065] Example 1

[0066] This embodiment is the first embodiment of a security detection method, which is a detection method for false data injection attacks based on measuring physical recovery. The security detection method includes the following steps S101-S103:

[0067] In S101, a current abnormal data set of a detection object that is different from a normal data set is obtained.

[0068] In S102, a historical abnormal data set of the detection object is obtained, and a threshold range for detecting the current abnormal data set is determined by the difference between the historical abnormal data set and the normal data set.

[0069] In S103, a first repairing action is performed on the current abnormal data set according to the threshold range, so that the current abnormal data set falls within the threshold range.

[0070] The detection object in the present invention may include a power system including a remote terminal unit (RTU);

[0071] Among them, the power system also includes a supervisory control and data acquisition system (SCADA) and a synchronized phasor measurement unit (PMU). However, the RTU in the power system is not only responsible for remote monitoring and control, but also can operate independently. Its performance directly affects the reliability and efficiency of the power system. That is, the RTU determines the authenticity, accuracy and reliability of the measurement data of the power system. The measurement data obtained based on the RTU contributes to the accuracy of the detection of abnormal data sets in the present invention; therefore, the detection object of the present invention gives priority to the power system including the RTU.

[0072] The normal data set, current abnormal data set and historical abnormal data set in the present invention are all obtained by directly measuring the power system through the measuring equipment. The measured data are preliminarily detected to distinguish the measured data into a normal data set and a current abnormal data set that is different from the normal data set. The historical abnormal data set is once preliminarily detected and confirmed as an abnormal data set, and then thoroughly confirmed as a real abnormal data set after multiple verifications.

[0073] Among them, normal data sets may include voltage (phase voltage, line voltage), current (phase current, line current), active power, reactive power, apparent power, power factor, grid frequency and grid phase angle;

[0074] Among them, the manifestations of the current abnormal data set being different from the normal data set include data range abnormality (measurement data exceeds and / or is lower than the normal and / or expected working threshold, such as the voltage or current value is too high or too low), data trend abnormality (measurement data suddenly changes drastically in a short period of time, such as the current suddenly increases or decreases; the change trend of the measurement data does not match the expected normal pattern, such as the data that should rise steadily under normal circumstances suddenly decreases), data pattern abnormality (new change patterns appear in the measurement data; the patterns that should normally exist in the measurement data disappear), data correlation abnormality (inconsistency between data reported by different measurement devices, such as the phasor data reported by the RTU and PMU do not match; the correlation between data points that are normally related to each other is destroyed), data quality abnormality (no data points are received within a predetermined time interval; the data contains erroneous values ​​or invalid values, such as NaN (Not a Number)), and statistical characteristic abnormality (the standard deviation of the data set increases significantly, indicating that the dispersion of the data increases; the average value of the data is significantly different from the average value under normal circumstances);

[0075] In addition, abnormal data also includes a false data injection attack (such as load redistribution attack, economic dispatch attack and load forecast attack), which deceives the monitoring and control system by injecting forged data into the system, thereby causing the system to make wrong decisions. This type of attack will change the operating state of the system without arousing suspicion, and is therefore more difficult to detect than conventional abnormal data. Therefore, in a security detection method based on abnormal data proposed in the present invention, a false data injection attack is preferred to further study and expand the specific security detection implementation method of the present invention. In this preferred implementation method, abnormal data specifically includes a false data injection attack and a false data injection attack based on measured physical recovery.

[0076] The measuring equipment includes a remote terminal unit (RTU), a supervisory control and data acquisition system (SCADA) and a phasor measurement unit (PMU).

[0077] The threshold range in the present invention may include a value and / or a value interval for detecting and verifying whether the current abnormal data set is a real abnormal data set. The value and / or the value interval may represent the scope of the normal data set or the scope of the abnormal data set. The former adopts the exclusion method and the latter adopts the induction method. Since the threshold range of the normal data set is usually relatively stable, while the patterns of abnormal data are diverse and updated from time to time, it is difficult to cover them comprehensively. The exclusion method only focuses on data points that exceed the error range and obviously deviate from normal operation, which can reduce false positives of abnormal data sets, improve the accuracy of capturing abnormal data sets, and ensure that the verification effect is accurate and reliable. Therefore, the present invention gives priority to determining the threshold range as a value and / or a value interval that can represent the normal data set.

[0078] Among them, the numerical value and / or numerical range that can represent the normal data set may include the mean value, standard deviation, and difference; since the difference between the normal data set and the abnormal data set can not only intuitively reflect the abnormal data set, but also can further narrow the detection range and improve the detection accuracy, a reliable difference between the known abnormal data set and the normal data set can be obtained based on a sufficiently accurate and reliable historical abnormal data set, that is, it can lay a foundation for the accuracy of identifying the re-appearance of the known abnormal data set and the new appearance of the unknown abnormal data set; it should be noted that the present invention does not directly define the threshold range in the present invention with the specific numerical value and / or numerical range of the difference, but uses multiple numerical values ​​of the standard of the difference between the historical data set and the normal data set as the basis for establishing a standard that truly limits the threshold range.

[0079] The first repair action in the present invention means to assist in restoring each abnormal data value in the current abnormal data set preliminarily determined in the current measurement data set to the range of the normal data set, by infinitely reducing the difference between each abnormal data value and each corresponding normal data value, so that each abnormal data value is infinitely close to each corresponding normal data value, that is, each abnormal data value after the first repair action will fall into the threshold range representing the normal data set, wherein the number of times of the first repair action is at least once, and the superposition of the number of times shows the data detection result after the first repair action as abnormal based on the threshold range.

[0080] In the present invention, the specific operation process of the safety detection method includes the following:

[0081] First, the power system including the RTU is monitored in real time to collect a large amount of measurement data;

[0082] Further scanning all the collected measurement data, quickly identifying all data that are different and / or discrepant from normal data, and distinguishing the acquired measurement data into a normal data set and a current abnormal data set that is different from the normal data set;

[0083] Further import the historical abnormal data set to obtain the difference collection between it and the normal data set;

[0084] Further, a standard for limiting a threshold range is established based on the difference value collection, and a threshold range that can be used to detect and verify the current abnormal data set is determined;

[0085] Based on the previously determined threshold range, the first repair action is performed on the current abnormal data set and then tested again. If each abnormal data value in the current abnormal data set after the first repair action falls within the threshold range, there is no need to perform the first repair action on the current abnormal data set.

[0086] If each abnormal data value in the current abnormal data set does not fall within the threshold range, the first repair action is continued to be performed at least once for each abnormal data value that does not fall within the threshold range until each abnormal data value is restored to the range of the normal data set.

[0087] In one implementable method of the present invention, the power system is monitored in real time through the remote monitoring function of the RTU, combined with SCADA and PMU equipment. The RTU can automatically collect various measurement data in the power system, such as voltage, current and power, and transmit them to the data center through the communication network; the statistical characteristics of the data (such as mean, standard deviation and quartile) can be calculated through statistical methods (such as box plots and Z-Score methods) to preliminarily determine whether the data is abnormal; and through simulation experiments or actual data tests, it is verified whether the set threshold range can effectively distinguish normal data from abnormal data.

[0088] The disclosed embodiment actively acquires the measured data of the power system including the RTU to ensure the authenticity, accuracy and reliability of the measured data, and quickly identifies all data that are different and / or different from the normal data through a preliminary data detection mechanism to ensure the comprehensive coverage of the current abnormal data set when it is initially collected, and avoid any abnormal data being missed; in combination with the historical abnormal data set, a collection of differences between it and the normal data set is obtained, which can ensure the accuracy and reliability of the threshold range determination standard established based on the collection of differences, thereby ensuring the accuracy of the threshold range, which can not only more accurately verify the authenticity of the current abnormal data set, but also more accurately repair the current abnormal data set; based on the threshold range, the current abnormal data set is The first repair action can be performed at least once until the initially determined abnormal data value is restored to the range of the normal data set. This not only solves the current abnormal data set and its potential problems for the power system (such as misleading the system to make wrong decisions, causing unstable power supply, ineffective allocation of power resources, and increasing the damage to the system caused by real faults for a longer time), but also helps the system update the abnormal data detection model to make it more in line with the actual operating state of the power system that may be subject to abnormal data, improve the robustness and generalization of the model and system, and the system can tolerate a certain degree of abnormal data while distinguishing and responding to new abnormal data, reducing false positives and negative positives of abnormal data, thereby helping to improve the power system's accurate capture and timely repair of subsequent abnormal data.

[0089] Although the present invention utilizes historical data, it does not need to rely on historical data to accurately capture abnormal data, nor does it need to replace or make up for the abnormal data. At the same time, the above-mentioned operation processes of the present invention are closely linked, aiming to solve low-quality and / or abnormal data, without relying on high-quality data, ensuring data diversity and improving the environmental adaptability of data.

[0090] Example 2

[0091] This embodiment is the second embodiment, which is different from the first embodiment in that the method is a detection method for false data injection attacks based on measuring physical recovery. The security detection method also includes the following steps S201-S203:

[0092] In S201, a current abnormal data set of a detection object that is different from a normal data set is obtained;

[0093] In S202, a second repairing action is performed on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set;

[0094] In S203, a historical abnormal data set of the detection object is obtained, and a threshold range for detecting the current abnormal data set is determined by the difference between the historical abnormal data set and the normal data set;

[0095] In S204, a first repairing action is performed on the current abnormal data set according to the threshold range, so that the current abnormal data set falls within the threshold range.

[0096] The explanations of the detection object, normal data set, current abnormal data set, historical abnormal data set, and the general explanation of the threshold range in the present invention are detailed in Example 1.

[0097] The second repair action in the present invention means assisting each abnormal data value in the current abnormal data set preliminarily determined in the current measurement data set to be restored to the range of the normal data set, by reducing the difference between each abnormal data value and the corresponding normal data value to a certain extent, so that each abnormal data value is close to the corresponding normal data value to a certain extent, that is, each abnormal data value after the second repair action may and / or may not fall into the threshold range representing the normal data set.

[0098] The first repair action in the present invention means assisting the restoration of each abnormal data value that is still detected and verified as abnormal data after the second repair action to the range of the normal data set, by infinitely reducing the difference between each abnormal data value at this time and each corresponding normal data value, so that each abnormal data value at this time is infinitely close to each corresponding normal data value, that is, each abnormal data value after the first repair action will fall into the threshold range representing the normal data set, wherein the number of times of the first repair action is at least once, and the superposition of the number of times is based on the threshold range to display the data detection result after the first repair action as abnormal.

[0099] The threshold range in the present invention can infinitely detect and verify the current abnormal data set after the second and / or first repair action.

[0100] In the present invention, the specific operation process of the safety detection method includes the following:

[0101] First, the power system including the RTU is monitored in real time to collect a large amount of measurement data;

[0102] Further scanning all the collected measurement data, quickly identifying all data that are different and / or discrepant from normal data, and distinguishing the acquired measurement data into a normal data set and a current abnormal data set that is different from the normal data set;

[0103] Further performing a second repair action on the initially determined current abnormal data set;

[0104] Further import the historical abnormal data set to obtain the difference collection between it and the normal data set;

[0105] Further, a standard for limiting a threshold range is established based on the difference value collection, and a threshold range that can be used to detect and verify the current abnormal data set is determined;

[0106] Based on the previously determined threshold range, further testing is performed on the current abnormal data set after the second repairing action. If each abnormal data value in the current abnormal data set falls within the threshold range, there is no need to perform the first repairing action on the current abnormal data set.

[0107] If each abnormal data value in the current abnormal data set does not fall within the threshold range, then at least one first repair action is performed on each abnormal data value that does not fall within the threshold range until each abnormal data value is restored to the range of the normal data set.

[0108] In one possible implementation of the present invention, it is the same as Example 1.

[0109] The disclosed embodiment actively acquires the measurement data of the power system including the RTU, and quickly identifies all data that are different and / or different from the normal data through a preliminary data detection mechanism, divides the measurement data into a normal data set and an abnormal data set, and performs a second repair action on the current abnormal data set to narrow the gap between the current abnormal data set and the normal data set; in combination with the historical abnormal data set, a difference set between the abnormal data set and the normal data set is obtained, and a threshold range determination standard is established based on the difference set; based on the threshold range, at least one first repair action is performed on the current abnormal data set after the second repair action, until the abnormal data value is restored to the range of the normal data set; by performing two repair actions on the current abnormal data set, the present invention not only ensures that the current abnormal data set falls within the threshold range, but also ensures that the current abnormal data set falls within the threshold range. It not only improves the accuracy and reliability of the recovery of the current abnormal data set, but also ensures that the corresponding models can be updated respectively based on the abnormal data detection and verification after the two repair actions. Among them, the model feedback result based on the first repair action can also supervise and promote the model update of the second repair action, which greatly improves the robustness and generalization of the two groups of repair models and the system detection model, so that the system can tolerate a greater degree of abnormal data while distinguishing and responding to new abnormal data. It not only helps to improve the power system's accurate capture and timely repair of subsequent abnormal data, but also ensures that the current abnormal data set and its hidden problems to the power system (such as misleading the system to make wrong decisions, causing unstable power supply, ineffective allocation of power resources, and increasing the damage to the system caused by real faults for a long time) are solved.

[0110] Although the present invention utilizes historical data, it does not need to rely on historical data to accurately capture abnormal data, nor does it need to replace or make up for the abnormal data. At the same time, the above-mentioned two repair operations of the current abnormal data set of the present invention are closely linked, aiming to solve low-quality and / or abnormal data, without relying on high-quality data, ensuring data diversity and improving the environmental adaptability of data.

[0111] Example 3

[0112] This embodiment is the third embodiment, which is different from the embodiment 1 and / or the embodiment 2 in that: step S101 in the embodiment 1 and / or step S201 in the embodiment 2 obtains the current abnormal data set of the detection object that is different from the normal data set, and may include the following sub-steps A1-A2:

[0113] In A1, the actual data value, the estimated data value, and the residual value between the actual data value and the estimated data value of the normal data set are obtained, and a first detection model of the current abnormal data set is constructed;

[0114] In A2, the residual value is used as a criterion for detecting the current abnormal data set, and a specific threshold is preset for the residual value.

[0115] The actual data values ​​in the present invention represent data directly measured from the power system, such as the active power and reactive power of the bus and branches. These specific parameters constitute a data set under normal operating conditions, and these data values ​​reflect the real state of the system.

[0116] The estimated data value in the present invention represents the data value predicted based on the system model and the measured data. The estimated data value closest to the actual state is obtained through the state estimation process. The measurement noise error is taken into account. The estimated data value is an approximation of the actual data value.

[0117] The residual value in the present invention represents the difference between the actual data value and the estimated data value, and is used to evaluate the accuracy of the model for predicting the estimated data value, and serves as a key indicator in the preliminary anomaly detection of the measured data; when the residual value exceeds a certain threshold, the data set may contain anomalies. By setting a specific threshold, it can be judged based on the tolerable false positive rate whether the residual value is large enough to consider the data set to be abnormal.

[0118] The first detection model in the present invention is a model constructed based on a normal data set and is used to detect abnormal data. The model usually uses residual values ​​to determine whether the data deviates from a normal range.

[0119] In one possible implementation of the present invention, the data value z containing actual noise in the normal data set is obtained. no i se , the expression is:

[0120]

[0121] Wherein, z represents a set of multiple single data values ​​including measurement noise errors; represents the multivariate Gaussian distribution; R represents the covariance matrix of zero-mean Gaussian measurement noise, that is, R makes the data value z containing actual noise in the normal data set noise The generation follows a multivariate Gaussian distribution

[0122] The data value z containing actual noise in the normal data set noise After complex power injection, the actual data value of the normal data set is obtained, which is expressed as:

[0123]

[0124] Among them, P bus Indicates the active power of the bus; P f and P t Respectively represent the active power on the “input” and “output” sides; Q bus Indicates the reactive power of the bus; Q f and Q t Represents the reactive power on the “input” and “output” sides respectively; The active power and reactive power of all buses and branches are fully combined to form the actual data value z of the normal data set;

[0125] The data value z containing actual noise in the normal data set noise In the form of complex power injection, it is expressed as:

[0126] S bus =[v]Y bus v *

[0127] in, represents the complex bus voltage vector; the complex bus voltage vector v contains the voltage of each bus, and the complex bus voltage vector v is expressed as v n =|v n |∠θ n ,|v n | represents the voltage amplitude, θ n Indicates the voltage phase angle; represents the bus admittance matrix; the bus admittance matrix Y bus represents the electrical connection relationship and admittance value between the buses in the system; [v] represents the conversion of the complex bus voltage vector v into a diagonal matrix; v * is the conjugate transpose of the complex bus voltage vector;

[0128] Get the estimated data value of the normal data set, the expression is:

[0129] z=h(x)+e

[0130] Where z represents a set of multiple single data values ​​containing measurement noise errors; x represents the state value of the power system; h(*) represents the state estimation process, in which z represents the best estimate obtained by averaging multiple single data values ​​with measurement noise errors, and the measurement noise error e represents a diagonal covariance matrix Zero-mean Gaussian measurement noise; z = h(x) + e means that by solving the weighted least squares problem, based on the actual data value z of the normal data set and the state estimation model h(x), the state value x of the power system is optimally estimated to obtain the estimated data value of the normal data set that is closest to the actual state v

[0131] The expression for solving the minimum weighted least squares problem is:

[0132]

[0133] Among them, v represents the actual state of the normal data set; represents the estimated state of the normal data set; R represents the covariance matrix of the zero-mean Gaussian measurement noise; (zh(v)) represents the residual value between the actual data value z of the normal data set and the theoretical data value calculated by the state estimation model h(x); (zh(v)) T Represents the transposition of the residual value between the actual data value z of the normal data set and the theoretical data value calculated by the state estimation model h(x); (zh(v)) T R -1 (zh(v)) means (zh(v)) T and R -1 product of (zh(v)); argmin v J(v) represents obtaining the estimated data value that minimizes J(v)

[0134] Assume that the residual value is expressed as r = zh(ν), which represents the difference between the actual data value z and the estimated data value Reflection of differences between

[0135] Suppose the expression of known abnormal data value is

[0136] Where y = R -1 / 2 r, R -1 / 2 Represents the square root matrix of the inverse residual value, after R -1 / 2 After processing, y approximately follows the standard normal distribution; due to R -1 / 2r approximately follows the standard normal distribution, and at least 2N normal data values ​​are required to solve the state estimation problem, so γ(z) approximately obeys the χ distribution with degrees of freedom κ = P-2N. 2 distributed.

[0137] Determine the detection threshold τ based on the tolerated false positive rate α χ (α), the expression is:

[0138]

[0139] If the residual value γ between the actual data value and the estimated data value of the current detection data set exceeds a preset specific threshold, the power system determines that the current detection data set is the current abnormal data set and issues an alarm in real time.

[0140] In the present invention, the specific operation process of the safety detection method includes the following:

[0141] Firstly, the data under normal operating conditions are measured and collected from the power system to obtain the actual data value z;

[0142] Further use the state estimation model h(x) to predict the estimated data value

[0143] Further calculate the residual value r = zh(ν);

[0144] The residual value r is further used as a criterion for detecting anomalies, and a first detection model is constructed based on the residual value;

[0145] Further preset a threshold τ χ (α), the threshold is determined based on the tolerated false positive rate α;

[0146] When the residual value γ(z) exceeds the threshold τ χ (α), the current data set is judged to be abnormal and an alarm is issued.

[0147] The technical solution provided by the embodiments of the present invention may include the following beneficial effects: by combining the distribution characteristics of the residual values ​​and determining a preset threshold representing normal data, most of the abnormal alarms caused by random fluctuations or slight deviations can be filtered out, and only those abnormal data that do deviate from the normal range are retained. Moreover, the preset threshold is not fixed, and can be dynamically adjusted based on real-time data to adapt to changes in data distribution. It can also be tested repeatedly on a regular basis to ensure the rationality of the preset threshold and achieve intuitive and accurate detection of abnormal data.

[0148] Example 4

[0149] This embodiment is the fourth embodiment, which is different from the embodiment 1 and / or the embodiment 2 in that: step S102 in the embodiment 1 and / or step S203 in the embodiment 2 obtains the historical abnormal data set of the detection object, and determines the threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set, which may include the following sub-steps B1-B3:

[0150] In B1, the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set is obtained as a difference set, and a standard object corresponding to each group of difference data in the difference set is established;

[0151] In B2, the distance between each group of difference data in the difference set and the corresponding standard object is calculated to obtain a distance value collection corresponding to the difference set;

[0152] In B3, a first sorting action is performed on the distance value set corresponding to the difference value set, and a specific range of the distance value set after sorting is determined as a preset threshold.

[0153] The standard object of the present invention represents a group of Gaussian distribution models with the smallest distance value corresponding to each group of difference data, wherein each difference data in the difference set is used for threshold prediction based on GMM, and the GMM model will establish a mixed model of Gaussian distribution composed of each Gaussian distribution model corresponding to each difference data.

[0154] The distance value collection in the present invention represents the degree of proximity between each set of difference data and the standard object.

[0155] The first sorting action of the present invention means that each distance value in the distance value collection corresponding to the difference set is normally arranged according to size.

[0156] The specific range of the preset threshold of the present invention is the 95% quantile of the distance value set corresponding to the difference set, a spherical area is defined, and the 95% quantile of these distances is selected as the empirical upper limit τ loss , the points in this area are considered to be within an acceptable range of deviation from the cluster center. For a normally distributed data set, 95% of the data points will fall within about 1.96 standard deviations on both sides of the mean. Therefore, choosing 95% as the quantile can cover most of the normal data points and reduce the probability of false positives;

[0157] If the distance value of any set of measurement data is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the distance value of the set of measurement data falls outside the threshold range, and the set of measurement data is determined to be in an abnormal state.

[0158] In one possible implementation of the present invention, the mixed model p(d|Θ) of the Gaussian distribution set established based on the difference set is expressed as:

[0159]

[0160] in, represents the i-th group of Gaussian distribution; represents the normal data set; d represents the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set; μ i represents the mean vector, which is the center of the Gaussian distribution of the i-th group; Σ i represents the covariance matrix, which is the shape and direction of the i-th group of Gaussian distribution; φ i Represents the mixing coefficient, which is the weight of the i-th group of Gaussian distribution in the model.

[0161] In the present invention, the specific operation process of the safety detection method includes the following:

[0162] First, the difference between each abnormal data point and the corresponding normal data point in the normal data set is extracted from the historical abnormal data set;

[0163] Further, a Gaussian distribution model is established for each set of difference data in the difference set, namely, a standard object, which represents the statistical characteristics of the difference data;

[0164] Further calculating the distance between each set of difference data in the difference set and the corresponding standard object;

[0165] Further collect all calculated distance values ​​and form a distance value collection;

[0166] Further sort the distance values ​​in the distance value collection according to their size;

[0167] Further, according to the sorted distance value collection, the 95% quantile is determined as the preset threshold;

[0168] If the distance value of any set of measurement data is less than the preset threshold, the set of data is considered abnormal and an alarm is triggered.

[0169] The technical solution provided by the embodiments of the present invention may include the following beneficial effects: by comparing the differences between new data points and known normal and abnormal data points in historical data, the normality of new data points can be quickly determined; since a statistical method based on historical data is used, a more conservative threshold can be set, and only those data points that are extremely different from historical data are determined to be abnormal, which can reduce false alarms caused by accidental noise or short-term fluctuations; as the data set is updated and changed, the standard object will be adjusted accordingly to adapt to the new normal mode. At the same time, the parameters of the standard object, such as the mean and variance of the Gaussian distribution, can be adjusted according to different application scenarios to better adapt to specific anomaly detection needs. Using the Gaussian distribution model as the standard object makes the anomaly detection model have a certain degree of interpretability, which is easy to understand and analyze.

[0170] Example 5

[0171] This embodiment is the fifth embodiment, which is different from the embodiment 4 in that: step S203 in the embodiment 1 and / or the embodiment 2 obtains the historical abnormal data set of the detection object, and determines the threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set, which may include the following sub-steps C1-C3:

[0172] In C1, the detection object is measured at least once and the current measurement data set is obtained;

[0173] In C2, based on at least one abnormal display of each measurement data in the current measurement data set, preliminarily determining at least one group of current abnormal data values;

[0174] In C3, a candidate set of the current abnormal data value and / or the current abnormal data value after the second repairing action is determined according to the threshold range.

[0175] The candidate set in the present invention indicates that after detection and verification within a threshold range, the current abnormal data value and / or the current abnormal data value after the second repair action is confirmed to be a real abnormal data set.

[0176] In one possible implementation of the present invention, a candidate set C of the current abnormal data value is determined. i , expressed as:

[0177]

[0178] Among them, c i represents the candidate current abnormal data value; Indicates the currently determined abnormal data value and / or normal data value; Represents the candidate current abnormal data value c iCompared with the current abnormal data value and / or normal data value determined initially The Euclidean distance between loss Represents the current abnormal data value c of the detection candidate i Compared with the current abnormal data value and / or normal data value determined initially The preset threshold for the Euclidean distance difference between them.

[0179] In the present invention, the specific operation process of the safety detection method includes the following:

[0180] First, through the implementation method in Example 3, the detection object is measured at least once to obtain a current measurement data set, which includes the measurement results of the detection object at the current moment;

[0181] Further, through the implementation in Example 3, it is checked at least once whether the current measurement data set shows abnormality;

[0182] If a data point shows anomaly, it is preliminarily identified as a group of current abnormal data values, which are data points that are suspected to contain anomalies;

[0183] Further testing and verifying each group of abnormal data values ​​preliminarily determined according to the threshold range preset in Example 4;

[0184] The groups of abnormal data values ​​that do not fall within the threshold range are summarized and determined as the candidate collection of the current abnormal data values.

[0185] The technical solution provided by the embodiment of the present invention may include the following beneficial effects: by further testing and verifying the threshold range of each group of abnormal data values ​​initially determined, it can be ensured that the abnormal data set finally obtained is sufficiently reliable and the false alarm rate can be reduced, because only data points that are very close to the actual abnormal data values ​​will be selected as the candidate collection of abnormal data, and the Euclidean distance and the preset threshold are used as standards, so that the anomaly detection model has a certain degree of interpretability, which is easy to understand and analyze.

[0186] Example 6

[0187] This embodiment is the sixth embodiment, which is different from the embodiment 1 in that: step S103 in the embodiment 1 performs a first repair action on the current abnormal data set according to the threshold range so that the current abnormal data set falls within the threshold range, and may include the following sub-steps D1-D4:

[0188] In D1, a second difference collection is obtained, and a first physical constraint is respectively performed on each second difference data in the second difference collection;

[0189] In D2, the second difference data after the first physical constraint is detected by a threshold range;

[0190] In D3, if the second difference data after passing the first physical constraint is greater than and / or equal to the 95% quantile of the distance value set corresponding to the difference set, it is determined that the abnormal data value corresponding to the second difference data after passing the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the second difference data after passing the first physical constraint;

[0191] In D4, if the second difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the second difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

[0192] The second difference value in the present invention represents the difference between each current abnormal data value in the candidate set and each normal data value in the normal data set;

[0193] The first physical constraint in the present invention represents a calculation process of reducing the second difference value through regularization terms and iterative adjustment, wherein the regularization term includes two parts, L1 regularization (by β R and β I Weight control) tends to produce sparse solutions, which helps to identify and ignore unimportant differences in the recovery process of each current abnormal data value in the candidate set; L2 regularization (controlled by α R and α I Weight control) helps to produce a smooth solution and prevent overfitting in the process of recovering the current abnormal data values ​​in the candidate set.

[0194] The first repair action in the present invention means that each current abnormal data value in the auxiliary candidate set is restored to the range of the normal data set.

[0195] In one possible implementation of the present invention, let each current abnormal data value in the candidate set be z a , expressed as:

[0196] z a =h(v R,a ,v I,a )

[0197] Suppose the normal data value of the normal data set is z x , expressed as:

[0198] z x =h(v R,x ,v I,x )

[0199] Among them, v R,a Represents the real part of the current abnormal data value; vI,a Represents the imaginary part of the current abnormal data value; v R,x represents the real part of the normal data value; v I,x represents the imaginary part of the normal data value;

[0200] The difference between the current abnormal data value and the normal data value satisfies the first physical constraint, and the expression is:

[0201]

[0202] Among them, ε(v R,a ,v I,a ) represents the overall loss function, which represents the current abnormal data value z a With normal data value z x The total difference between i ) represents the basic loss function, which is used to measure the current abnormal data value z a With normal data value z x The basic difference between Used to measure the current abnormal data value z a The real voltage v R,a With normal data value z x The real voltage v R,x The Euclidean distance between them prevents overfitting; Used to measure the current abnormal data value z a The imaginary voltage v I,a With normal data value z x The imaginary voltage v I,x The Euclidean distance between them prevents overfitting; R ||v R,a -v R,x ||1 is used to measure the current abnormal data value z a The real voltage v R,a With normal data value z x The real voltage v R,x The Manhattan distance between them encourages sparse solutions; β I ||v I,a -v I,x ||1 is used to measure the current abnormal data value z a The imaginary voltage v I,a With normal data value z x The imaginary voltage v I,x The Manhattan distance between , encourages sparse solutions.

[0203] Minimize the weighted loss ε by backpropagating through the RMSprop optimizer k , where k represents the number of optimizations;

[0204] The second difference between the current abnormal data value and the normal data value after the first physical constraint is compared with the preset threshold τ loss Compare,

[0205] If the second difference after the first physical constraint is less than the preset threshold τ loss , then stop the iterative first repair action and determine the current abnormal data value z a Belongs to the normal data set;

[0206] If the difference after the first physical constraint is greater than and / or equal to the preset threshold τ loss , then the iterative first repair action is performed multiple times until the maximum number of iterative first repair actions i max When , the iterative first repair action is stopped, and then the second difference after the first physical constraint is compared with the preset threshold τ loss Comparison, if the second difference after the first physical constraint is less than the preset threshold τ loss , then the current abnormal data value z is determined a Belongs to the normal data set.

[0207] In the present invention, the specific operation process of the safety detection method includes the following:

[0208] First, the difference between each abnormal data value in the candidate set and the corresponding normal data value in the normal data set is calculated to form a second difference set;

[0209] Further performing a first physical constraint on each second difference value in the second difference value collection to reduce the second difference value;

[0210] Further comparing the second difference after the first physical constraint with a preset threshold to determine whether an abnormality is still displayed;

[0211] If the second difference after the first physical constraint is less than the preset threshold, the iterative first repair action is stopped, and the current abnormal data value is determined to belong to the normal data set;

[0212] If the difference after passing the first physical constraint is greater than and / or equal to the preset threshold, the iterative first repair action is performed multiple times until the maximum number of iterative first repair actions is reached, and then the second difference after passing the first physical constraint is compared with the preset threshold. If the second difference after passing the first physical constraint is less than the preset threshold, it is determined that the current abnormal data value belongs to the normal data set.

[0213] The technical solution provided by the embodiment of the present invention may include the following beneficial effects: through the first physical constraint and iterative adjustment of the regularization term in steps D1, D2, D3 and D4, the model can be helped to remember the details of the data to a certain extent and learn the laws behind the data when training data, thereby improving the prediction performance of the model on unknown data, thereby more accurately identifying and verifying abnormal data; since the preset threshold and the first physical constraint are used to adjust the data, it can be ensured that the prediction results of the model are physically feasible, thereby reducing false alarms caused by model predictions exceeding physical boundaries, which helps to reduce the false alarm rate; using the first physical constraint and iterative adjustment as the standard, the training process of the model also appears to be more purposeful and directional, so that the anomaly detection model has a certain degree of interpretability, which is easy to understand and analyze.

[0214] Example 7

[0215] This embodiment is the seventh embodiment, which is different from the second embodiment and the sixth embodiment in that: step S204 in the second embodiment performs a first repairing action on the current abnormal data set according to the threshold range so that the current abnormal data set falls within the threshold range, and may include the following sub-steps E1-E4:

[0216] In E1, a first difference collection is obtained, and first physical constraints are respectively performed on each first difference data in the first difference collection;

[0217] In E2, the first difference data after the first physical constraint is detected by a threshold range;

[0218] In E3, if the first difference data after passing the first physical constraint is greater than and / or equal to the 95% quantile of the distance value set corresponding to the difference set, it is determined that the abnormal data value corresponding to the first difference data after passing the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the first difference data after passing the first physical constraint;

[0219] In E4, if the first difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the first difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

[0220] The first difference value in the present invention represents the difference between each abnormal data value in the current abnormal data set and each abnormal data value in the candidate set after the second repair action.

[0221] The first physical constraint in the present invention represents a calculation process of reducing the first difference through regularization terms and iterative adjustment, wherein the regularization term includes two parts, L1 regularization (by β Rand β I Weight control) tends to produce sparse solutions, which helps to identify and ignore unimportant differences in the recovery process of each abnormal data value after the second repair action; L2 regularization (controlled by α R and α I Weight control) helps to produce a smooth solution and prevent overfitting in the process of recovering the abnormal data values ​​after the second repair action.

[0222] The first repairing action in the present invention means that each abnormal data value in the auxiliary candidate set is restored to the range of the normal data set after the second repairing action.

[0223] The second repairing action in the present invention means assisting in restoring each abnormal data value in the currently abnormal data set that is initially determined to be restored to the range of the normal data set.

[0224] In one possible implementation of the present invention, assume that each abnormal data value in the current abnormal data set is z a , expressed as:

[0225] z a =h(v R,a ,v I,a )

[0226] Suppose the values ​​of each abnormal data in the candidate set after the second repair action are Expressed as:

[0227]

[0228] Among them, v R,a Represents the real part of the current abnormal data value; v I,a Represents the imaginary part of the current abnormal data value; Represents the real part of each abnormal data value in the candidate set after the second repair action; Represents the imaginary part of each abnormal data value in the candidate set after the second repair action;

[0229] The difference between each current abnormal data value and each abnormal data value in the candidate set after the second repair action satisfies the first physical constraint, and the expression is:

[0230]

[0231] in, Represents the overall loss function, representing each current abnormal data value z a Each abnormal data value in the candidate set after the second repair action The total difference between Represents the basic loss function, which is used to measure the current abnormal data value z aEach abnormal data value in the candidate set after the second repair action The basic difference between ; L1 regularization term Used to measure each current abnormal data value z a The real voltage v R,a Each abnormal data value in the candidate set after the second repair action The real voltage The Euclidean distance between them prevents overfitting; L1 regularization term Used to measure each current abnormal data value z a The imaginary voltage v I,a Each abnormal data value in the candidate set after the second repair action The imaginary voltage The Euclidean distance between them prevents overfitting; L2 regularization term Used to measure each current abnormal data value z a The real voltage v R,a Each abnormal data value in the candidate set after the second repair action The real voltage v R,x The Manhattan distance between encourages sparse solutions; the L2 regularization term Used to measure each current abnormal data value z a The imaginary voltage Each abnormal data value in the candidate set after the second repair action The imaginary voltage The Manhattan distance between , encourages sparse solutions.

[0232] Minimize the weighted loss ε by backpropagating through the RMSprop optimizer k , where k represents the number of optimizations;

[0233] The first difference after the first physical constraint is compared with the preset threshold τ l oss Compare,

[0234] If the first difference after the first physical constraint is less than the preset threshold τ l oss , then the iterative first repair action is stopped, and the abnormal data value after the second repair action is determined to belong to the normal data set;

[0235] If the first value after the first physical constraint is greater than and / or equal to the preset threshold value τ l oss , then the iterative first repair action is performed multiple times until the maximum number of iterative first repair actions i max, the iterative first repair action is stopped, and then the first difference after the first physical constraint is compared with the preset threshold τ loss Comparison, if the first after the first physical constraint is less than the preset threshold τ loss , it is determined that the abnormal data value after the second repair action belongs to the normal data set.

[0236] In the present invention, the specific operation process of the safety detection method includes the following:

[0237] First, the difference between each abnormal data value in the current abnormal data set and each abnormal data value in the candidate set after the second repair action is calculated to form a first difference set;

[0238] Further performing a first physical constraint on each first difference value in the first difference value collection to reduce the first difference value;

[0239] Further back-propagation through the RMSprop optimizer is performed to minimize the weighted loss;

[0240] Further comparing the first difference after the first physical constraint with a preset threshold to determine whether each abnormal data value in the candidate set after the second repair action still shows abnormality;

[0241] If the first difference after the first physical constraint is less than the preset threshold, the iterative first repair action is stopped, and the abnormal data value after the second repair action is determined to belong to the normal data set;

[0242] If the first value after the first physical constraint is greater than and / or equal to the preset threshold, the iterative first repair action is performed multiple times until the maximum number of iterative first repair actions is reached and the iterative first repair action is stopped, and then the first difference after the first physical constraint is compared with the preset threshold. If the first value after the first physical constraint is less than the preset threshold, it is determined that the abnormal data value after the second repair action belongs to the normal data set.

[0243] The technical solution provided by the embodiment of the present invention may include the following beneficial effects: through the first physical constraint and iterative adjustment of the regularization term in steps E1, E2, E3 and E4, the model can be helped to remember the details of the data to a certain extent and learn the laws behind the data when training data, thereby improving the prediction performance of the model on unknown data, thereby more accurately identifying and verifying abnormal data; since the preset threshold and the first physical constraint are used to adjust the data, it can be ensured that the prediction results of the model are physically feasible, thereby reducing false alarms caused by model predictions exceeding physical boundaries, which helps to reduce the false alarm rate; using the first physical constraint and iterative adjustment as standards, the training process of the model also appears to be more purposeful and directional, so that the anomaly detection model has a certain degree of interpretability, which is easy to understand and analyze.

[0244] Example 8

[0245] This embodiment is the eighth embodiment, which is different from the embodiment 2 in that: step S202 in the embodiment 2 performs a second repairing action on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set, and may include the following sub-steps F1-F3:

[0246] In F1, a second repair model of the current abnormal data set is constructed based on the explicit and implicit features of the normal data set;

[0247] In F2, a second physical constraint process is added to the second repair model;

[0248] In F3, a second physical constraint is performed on the second difference to reduce the value of the second difference.

[0249] The second difference in the present invention is explained in detail in Example 6.

[0250] The second repair model in the present invention aims to repair and optimize the abnormal data set by learning the characteristics of the normal data set. When training the second repair model, some constraints (such as conservation of energy and momentum) are added and / or optimization algorithms (such as gradient descent, stochastic gradient descent and momentum gradient descent) are used to adjust the model parameters to prevent the model from overfitting or learning features that do not conform to physical laws, thereby ensuring that the detection degree of the second repair model is accurate enough and improving the refinement of its repair degree for abnormal data.

[0251] The second physical constraint in the present invention means that when the second repair model is used to detect the measurement data, some constraints (such as conservation of energy and conservation of momentum) are added to further improve the refinement of the degree of repair of abnormal data.

[0252] In one possible implementation of the present invention,

[0253] Get the normal data value z of the normal data set at different time points within the length T t Collection;

[0254] Let the normal data value z t The set corresponds to the input variable x t After the collection is input one by one into at least one layer of the recurrent neural network structure GRU layer of the encoder, the process of extracting the features of the normal data set in the encoder is completed, and the process of extracting the features of the normal data set in the encoder is defined as the mapping function f e ;

[0255] Taking the normal data value z t and the hidden state h at the previous moment t-1 As input, the expression is:

[0256] Update Gate:

[0257]

[0258] Reset the gate:

[0259]

[0260] Candidate hidden states:

[0261]

[0262] The resulting encoder hidden state is:

[0263]

[0264] Among them, l represents the GRU layer, ψ represents the Sigmoid activation function, ⊙ represents the Hadamard product, W and U represent the weight matrices respectively, and b represents the bias vector; represents a collection of feature results extracted from the normal data set in the encoder;

[0265] Using a reparameterization step of a deep learning model VAE to learn the spatiotemporal correlation and other potential data patterns of the normal data set according to the feature result collection extracted from the normal data set in the encoder;

[0266] The expression of the reparameterization step of the deep learning model VAE is:

[0267]

[0268] Where g represents the latent variable; μ g represents the mean of the latent variable g, and represents one of the parameters of the distribution of the latent variable g; represents the logarithmic variance, which is one of the parameters of the distribution of the latent variable g; ∈ represents the random noise drawn from the standard normal distribution; It means that the mean μ of the latent variable g is g Plus random noise ∈ multiplied by the exponential part of the variance to generate the latent variable g; the mean μ of the latent variable g g and log variance The deep learning model VAE accepts the time series hidden state H = {h1,h2,...,h T}After the estimation is obtained;

[0269] Input the current abnormal data value collection corresponding to different time points of the current abnormal data set into at least one recurrent neural network structure GRU layer of the encoder, so that the encoder hidden state result quantity of the current abnormal data set and the potential variable g are input into at least one recurrent neural network structure GRU layer of the decoder, and obtain the hidden state result quantity of the last recurrent neural network structure GRU layer of the decoder The decoder process is defined as a mapping function f d ;

[0270] The data value of the current abnormal data set after the second repair action Expressed as:

[0271]

[0272] Among them, W h and b x They are respectively represented as the weights and bias items mapped from the deep learning model VAE training to the measurement space, ensuring the continuity and consistency of the time series data;

[0273] The data value of the current abnormal data set after the second repair action The candidate set C of the current abnormal data value is passed in i In the determination calculation process, the data value of the current abnormal data set after the second repair action is The actual abnormal data value The Euclidean distance difference between them is compared with the preset threshold τ loss ;

[0274] The second physical constraint represents a calculation process for reducing the second difference value, and the expression is:

[0275]

[0276] Among them, the loss function L(Z i) represents training of the second repair model; T represents the length of the time series; P represents the number of measurement values ​​in the current measurement data set; f e represents the mapping function of the second repair model, which is used to extract the features of the input value of the normal data set; d A mapping function representing the second repair model, used to restore the input value of the current abnormal data set; represents the normal data set input value at the jth time step; ·2 represents the L2 norm, which represents the Euclidean distance of the measured values.

[0277] In the present invention, the specific operation process of the safety detection method includes the following:

[0278] First, a recurrent neural network (GRU) layer is used to extract features of normal data values ​​at different time points in the normal data set to form a collection of feature results;

[0279] The encoding function and decoding function are further defined as GRU layers to extract and restore the input values ​​of the normal data set;

[0280] The second restoration model is further trained using the loss function, and the model parameters are adjusted through the optimization algorithm to reduce the second difference, thereby preventing the model from overfitting or learning features that do not conform to physical laws;

[0281] During the training process of the second repair model, a second physical constraint is applied to the second difference to further reduce the second difference;

[0282] The model parameters are adjusted through the second physical constraint combined with the optimization algorithm to minimize the second difference, thereby repairing the current abnormal data set to make it close to the normal data set to a certain extent.

[0283] The technical solution provided by the embodiments of the present invention may include the following beneficial effects: by constructing a second repair model and adding a second physical constraint, the current abnormal data set can be repaired and optimized more accurately; by learning the characteristics of the normal data set, the second repair model can better identify and repair deviations in the abnormal data; using the deep learning model and physical constraints as standards, the second repair model has a certain degree of interpretability, which is easy to understand and analyze.

[0284] Example 9

[0285] refer to Figure 1 This embodiment is the ninth embodiment, which is different from embodiments 1 to 8 in that: a false data injection attack detection method based on measuring physical recovery is provided, and the method includes the following steps S301-S312:

[0286] In 301, actual data values, estimated data values, and residual values ​​between the actual data values ​​and the estimated data values ​​of a normal data set are obtained, and a first detection model of the current abnormal data set is constructed;

[0287] In 302, the residual value is used as a criterion for detecting the current abnormal data set, and a specific threshold is preset for the residual value;

[0288] In 303, the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set is obtained as a difference set, and a standard object corresponding to each group of difference data in the difference set is established;

[0289] In 304, the distance between each set of difference data in the difference set and the corresponding standard object is calculated to obtain a distance value collection corresponding to the difference set;

[0290] In 305, a first sorting action is performed on the distance value collection corresponding to the difference value set, and a specific range of the distance value collection after sorting is determined as a preset threshold;

[0291] In 306, the detection object is measured at least once, and a current measurement data set is obtained;

[0292] In 307, a preliminary detection is performed on the current measurement data set based on the residual value in the first detection model, and at least one set of current abnormal data values ​​is preliminarily determined according to at least one abnormal display of each measurement data in the current measurement data set;

[0293] In 308, a candidate set of the current abnormal data value is determined according to a threshold range;

[0294] In 309, a second difference collection of the candidate collection is obtained, and a first physical constraint is respectively performed on each second difference data in the second difference collection;

[0295] In 310, the second difference data after the first physical constraint is detected by a threshold range;

[0296] In 311, if the second difference data after passing the first physical constraint is greater than and / or equal to the 95% quantile of the distance value set corresponding to the difference set, it is determined that the abnormal data value corresponding to the second difference data after passing the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the second difference data after passing the first physical constraint;

[0297] In 312, if the second difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the second difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

[0298] The present invention can perform at least one first repair action on the current abnormal data set based on the threshold range until the initially determined abnormal data value is restored to the range of the normal data set. This not only solves the above-mentioned hidden dangers of the current abnormal data set and the problems it brings to the power system, but also helps to improve the power system's accurate capture and timely repair of subsequent abnormal data.

[0299] Example 10

[0300] refer to Figure 2 This embodiment is the tenth embodiment, which is different from embodiments 1 to 8 and 9 in that: a false data injection attack detection method based on measuring physical recovery is provided, and the method includes the following steps S401-S415:

[0301] In 401, actual data values, estimated data values, and residual values ​​between the actual data values ​​and the estimated data values ​​of a normal data set are obtained, and a first detection model of the current abnormal data set is constructed;

[0302] In 402, the residual value is used as a criterion for detecting the current abnormal data set, and a specific threshold is preset for the residual value;

[0303] In 403, the detection object is measured at least once, and a current measurement data set is obtained;

[0304] In 404, a preliminary detection is performed on the current measurement data set based on the residual value in the first detection model, and at least one set of current abnormal data values ​​is preliminarily determined according to at least one abnormal display of each measurement data in the current measurement data set;

[0305] In 405, a second repair model of the current abnormal data set is constructed based on the explicit and implicit features of the normal data set;

[0306] In 406, a second physical constraint process is added to the second repair model;

[0307] In 407, a second physical constraint is applied to the second difference to reduce a value of the second difference;

[0308] In 408, the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set is obtained as a difference set, and a standard object corresponding to each group of difference data in the difference set is established;

[0309] In 409, the distance between each set of difference data in the difference set and the corresponding standard object is calculated to obtain a distance value collection corresponding to the difference set;

[0310] In 410, a first sorting action is performed on the distance value collection corresponding to the difference value set, and a specific range of the distance value collection after sorting is determined as a preset threshold;

[0311] In 411, a candidate set of current abnormal data values ​​after the second repair action is determined according to the threshold range;

[0312] In 412, a first difference collection of the candidate collection is obtained, and a first physical constraint is respectively performed on each first difference data in the first difference collection;

[0313] In 413, the first difference data after the first physical constraint is detected by a threshold range;

[0314] In 414, if the first difference data after passing the first physical constraint is greater than and / or equal to the 95% quantile of the distance value set corresponding to the difference set, it is determined that the abnormal data value corresponding to the first difference data after passing the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the first difference data after passing the first physical constraint;

[0315] In 415, if the first difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the first difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

[0316] The disclosed embodiment actively acquires measurement data of the power system including the RTU. The present invention performs two repair actions on the current abnormal data set, thereby not only ensuring that the current abnormal data set falls within the threshold range, but also improving the sufficient accuracy and reliability of the recovery of the current abnormal data set, ensuring that the current abnormal data set and the above-mentioned hidden dangers of the problems brought by the current abnormal data set to the power system are solved, and also helping to improve the power system's accurate capture and timely repair of subsequent abnormal data.

[0317] In combination with Example 9, although the present invention uses historical data, it does not need to rely on historical data to accurately capture abnormal data, nor does it need to replace and make up for the abnormal data. At the same time, the above-mentioned two repair operations of the current abnormal data set of the present invention are closely linked, aiming to solve low-quality and / or abnormal data, without relying on high-quality data, ensuring data diversity and improving the environmental adaptability of data.

[0318] It is important to note that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A safety detection method, characterized in that: include, Obtain a current abnormal data set that is different from a normal data set; Acquire a historical abnormal data set of the detection object, and determine a threshold range for detecting the current abnormal data set by a difference between the historical abnormal data set and the normal data set; A first repairing action is performed on the current abnormal data set according to the threshold range, so that the current abnormal data set falls within the threshold range.

2. The safety detection method according to claim 1, characterized in that: After obtaining the current abnormal data set of the detected object which is different from the normal data set, the method further includes: A second repairing action is performed on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set.

3. The safety detection method according to claim 1 or 2, characterized in that: Determining a threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set comprises the following steps: Acquire difference data between each abnormal data in the historical abnormal data set and corresponding normal data in the normal data set as a difference set, and establish a standard object corresponding to each group of difference data in the difference set; Calculating the distance between each set of difference data in the difference set and the corresponding standard object to obtain a distance value collection corresponding to the difference set; A first sorting action is performed on the distance value collection corresponding to the difference value set, and a specific range of the distance value collection after sorting is determined as a preset threshold.

4. The safety detection method according to claim 3, characterized in that: The standard object represents a set of Gaussian distribution models with the smallest distance value corresponding to each set of difference data in the mixed model of the Gaussian distribution set established based on the difference set; The first sorting action means to arrange the distance values ​​in the distance value collection corresponding to the difference value set in a normal order according to their sizes; The specific range of the preset threshold is the 95% quantile of the distance value set corresponding to the difference set; If the distance value of any set of measurement data is less than the 95% quantile of the distance value set corresponding to the difference set, it is determined that the distance value of the set of measurement data falls outside the threshold range, and the set of measurement data is determined to be in an abnormal state.

5. The safety detection method according to any one of claims 1, 2 and 4, characterized in that: Determining a threshold range for detecting the current abnormal data set by the difference between the historical abnormal data set and the normal data set also includes the following steps: Measure the detection object at least once and obtain the current measurement data set; Preliminarily determining at least one set of current abnormal data values ​​according to at least one abnormal display of each measurement data in the current measurement data set; A candidate set of the current abnormal data value and / or the current abnormal data value after the second repairing action is determined according to the threshold range.

6. The safety detection method according to claim 4, characterized in that: The mixed model p(d|Θ) of the Gaussian distribution set established based on the difference set is expressed as: in, represents the i-th group of Gaussian distribution; represents the normal data set; d represents the difference data between each abnormal data in the historical abnormal data set and the corresponding normal data in the normal data set; μ i represents the mean vector, which is the center of the i-th group of Gaussian distribution; Σ i represents the covariance matrix, which is the shape and direction of the i-th group of Gaussian distribution; φ i Represents the mixing coefficient, which is the weight of the i-th group of Gaussian distribution in the model.

7. The safety detection method according to claim 5, characterized in that: Determine the candidate set C of the current abnormal data value i , expressed as: Among them, c i represents the candidate current abnormal data value; Indicates the currently determined abnormal data value and / or normal data value; Represents the candidate current abnormal data value c i Compared with the current abnormal data value and / or normal data value determined initially The Euclidean distance between loss Represents the current abnormal data value c of the detection candidate i Compared with the current abnormal data value and / or normal data value determined initially The preset threshold for the Euclidean distance difference between them.

8. The safety detection method according to any one of claims 4, 6 and 7, characterized in that: Performing a first repair action on the current abnormal data set according to the threshold range so that the current abnormal data set falls within the threshold range includes the following steps: Acquire a first difference collection and / or a second difference collection, and respectively perform a first physical constraint on each first difference data and / or second difference data in the first difference collection and / or the second difference collection; Detecting the first difference data and / or the second difference data after passing the first physical constraint by using the threshold range; If the first difference data and / or the second difference data after the first physical constraint is greater than and / or equal to the 95% quantile of the distance value collection corresponding to the difference set, it is determined that the abnormal data value corresponding to the first difference data and / or the second difference data after the first physical constraint is in an abnormal state, and the first physical constraint is repeated at least once for the first difference data and / or the second difference data after the first physical constraint; If the first difference data and / or the second difference data after repeating the first physical constraint at least once is less than the 95% quantile of the distance value collection corresponding to the difference set, it is determined that the first difference data and / or the second difference data after repeating the first physical constraint at least once falls within the threshold range, and it is determined that the abnormal data value after passing the first physical constraint belongs to the normal data set.

9. The safety detection method according to claim 8, characterized in that: The first difference value represents the difference between each abnormal data value in the current abnormal data set and each abnormal data value in the candidate set after the second repair action; The second difference value represents the difference between each abnormal data value in the candidate set and each normal data value in the normal data set; The first physical constraint represents a calculation process for reducing the value of the first difference and / or the second difference; The first repairing action means assisting each abnormal data value in the current abnormal data set and / or each abnormal data value after the second repairing action to be restored to the range of the normal data set; The second repairing action represents assisting each abnormal data value in the current abnormal data set to be restored to the range of the normal data set.

10. The safety detection method according to claim 9, characterized in that: Obtaining a first difference collection and / or a second difference collection, and performing first physical constraints on each first difference data and / or second difference data in the first difference collection and / or the second difference collection, respectively, comprises the following steps: The numerical values ​​of each abnormal data value in the current abnormal data set, each current abnormal data value in the candidate set, each abnormal data value in the candidate set after the second repair action, and each normal data value in the normal data set are respectively set to facilitate satisfying the first physical constraint process of the first difference and / or the second difference; The first physical constraint is applied to the first difference and / or the second difference, and the expression is: Where ε(m,n) represents the overall loss function, which is the sum of the first difference and / or the second difference; L(Z i ) represents the basic loss function, which is used to measure the basic first difference and / or second difference; the regularization term Used to measure the Euclidean distance between the real voltages m1 and m2 to prevent overfitting; Used to measure the Euclidean distance between the imaginary voltages n1 and n2 to prevent overfitting; β m ||m1-m2||1 is used to measure the Manhattan distance between the real voltages m1 and m2, encouraging sparse solutions; β n ||n1-n2||1 is used to measure the Manhattan distance between the imaginary voltages n1 and n2, encouraging sparse solutions.

11. The safety detection method according to claim 2, characterized in that: Performing a second repairing action on the current abnormal data set based on the normal data set to reduce the difference between the current abnormal data set and the normal data set includes the following steps: Building a second repair model of the current abnormal data set based on the explicit and implicit features of the normal data set; adding a second physical constraint process in the second repair model; A second physical constraint is performed on the second difference to reduce a value of the second difference.

12. The safety detection method according to claim 11, characterized in that: The second physical constraint represents a calculation process for reducing the second difference value, and the expression is: Among them, the loss function L(Z i ) represents training of the second repair model; T represents the length of the time series; P represents the number of measurement values ​​in the current measurement data set; f e represents the mapping function of the second repair model, which is used to extract the features of the input value of the normal data set; d A mapping function representing the second repair model, used to restore the input value of the current abnormal data set; represents the normal data set input value at the jth time step; ·2 represents the L2 norm, which represents the Euclidean distance of the measured values.

Images