Method and device for detecting false data injection attack

Abstract

The invention discloses a false data injection attack detection method and device. The method comprises the steps that power grid measurement data are acquired, and the power grid measurement data comprise multiple types of power data; power grid measurement data are analyzed through an ensemble classification detection model, an output vector value is obtained, and the ensemble classification detection model is obtained through machine learning training of multiple sets of data; each group of data in the multiple groups of data comprises historical power grid measurement data and a label for indicating whether the historical power grid measurement data is false data injection attack data; and determining whether the power grid measurement data is attacked or not according to the size of the output vector value, and processing the attacked data. The technical problems that in the prior art, a false data injection attack detection method for power system state estimation is insufficient in fitting capacity, and the polluted power grid state quantity cannot be accurately recognized are solved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, device, computer-readable storage medium and electronic device for detecting false data injection attacks. Background Art

[0002] With the rapid development of new power systems, the power system has shifted from being dominated by fossil energy to being dominated by clean energy. The access of large-scale new energy sources has reduced the regulation capacity of the power system and increased the difficulty of control. Virtual power plants optimize and regulate distributed flexible resources on the demand side through communication information technology, coordinate and integrate them into a flexible whole, and thus achieve goals such as automatic allocation, optimized power generation, demand response and centralized control. However, virtual power is highly interactive with the external network environment, and the potential risk of cyber attacks seriously threatens the safe and stable operation of the power system.

[0003] False data injection attack is a network attack method for power system state estimation. It tampers with the power grid measurement data collected by the Supervisory Control and Data Acquisition (SCADA) system and the Phasor Measurement Unit (PMU), thereby contaminating the power grid state quantity calculated by the state estimation program, making it impossible for the dispatch center to obtain reliable power grid state information, and ultimately interfering with the safe and stable operation of the power system, causing huge economic losses. Therefore, active detection of false data injection attacks is an important means to improve the network security and defense capabilities of power systems.

[0004] The classifier used in the traditional machine learning-based false data injection attack detection method has insufficient fitting ability for complex power measurement data. It can only identify whether a false data injection attack exists, but cannot accurately identify the power grid state quantity contaminated by false data.

[0005] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0006] The embodiments of the present invention provide a method, device, computer-readable storage medium and electronic device for detecting false data injection attacks, so as to at least solve the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the contaminated power grid state quantity.

[0007] According to one aspect of an embodiment of the present invention, a method for detecting a false data injection attack is provided, comprising: acquiring power grid measurement data, wherein the power grid measurement data includes multiple types of power data; analyzing the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; determining whether the power grid measurement data is attacked according to the size of the output vector value, and processing the attacked data.

[0008] Optionally, before analyzing the power grid measurement data by using the integrated classification detection model, the false data injection attack detection method further includes: establishing a data matrix of the power grid measurement data as Among them, Z represents the data matrix, d represents the number of the power grid measurement data, and m represents the dimension of the power grid measurement data; the data matrix is ​​divided into multiple sub-matrices by cross partitioning, and the multiple sub-matrices are divided into a training set and a test set; an initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and when the test passes, the integrated classification detection model is obtained.

[0009] Optionally, determining whether the power grid measurement data is attacked is performed according to the size of the output vector value, including: performing label conversion on the output vector value using a multi-label encoding method to obtain a binary code for each of the output vector values; when the binary code is 1, determining that the power grid measurement data is attacked; when the binary code is 0, determining that the power grid measurement data is not attacked.

[0010] Optionally, the output vector value is subjected to label conversion by adopting a multi-label encoding method, including: adopting a multi-label encoding method by formula Perform label conversion, where b i is the ith output vector,

[0011] is the binary code corresponding to the ith output vector after conversion using the multi-label encoding method.

[0012] Optionally, performing label conversion on the output vector value using a multi-label encoding method further includes: performing label conversion on the voltage amplitude and voltage phase of nodes other than the balancing node using the multi-label encoding method respectively.

[0013] Optionally, obtaining power grid measurement data includes: obtaining first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data includes at least node injected active power, node injected reactive power, branch active power flow data, and branch reactive power flow data; obtaining second power grid measurement data of a synchronous phasor measurement unit, wherein the second power grid measurement data includes at least node voltage phasor data and branch current phasor data.

[0014] Optionally, the integrated classification detection model includes multiple base classifiers.

[0015] According to another aspect of an embodiment of the present invention, a detection device for a false data injection attack is also provided, comprising: an acquisition unit, used to acquire power grid measurement data, wherein the power grid measurement data includes multiple types of power data; an analysis unit, used to analyze the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; a determination unit, used to determine whether the power grid measurement data is attacked according to the size of the output vector value, and to process the attacked data.

[0016] Optionally, the false data injection attack detection device further comprises: an establishment unit, which is used to establish a data matrix of the power grid measurement data before analyzing the power grid measurement data through the integrated classification detection model. Among them, Z represents the data matrix, d represents the number of the power grid measurement data, and m represents the dimension of the power grid measurement data; a partitioning unit is used to divide the data matrix into multiple sub-matrices by cross partitioning, and divide the multiple sub-matrices into a training set and a test set; a processing unit is used to obtain an initial integrated classification detection model, train the initial integrated classification detection model through the training set, and test the trained initial integrated classification detection model through the test set, and obtain the integrated classification detection model when the test passes.

[0017] Optionally, the determination unit includes: a first conversion subunit, used to perform label conversion on the output vector value using a multi-label encoding method to obtain a binary code for each of the output vector values; a first determination subunit, used to determine that the power grid measurement data has been attacked when the binary code is 1; and a second determination subunit, used to determine that the power grid measurement data has not been attacked when the binary code is 0.

[0018] Optionally, the first conversion subunit includes: a second conversion subunit, configured to use a multi-label encoding method through the formula Perform label conversion, where b i is the ith output vector, is the binary code corresponding to the ith output vector after conversion using the multi-label encoding method.

[0019] Optionally, the first conversion subunit further includes: a third conversion subunit, configured to perform label conversion on the voltage amplitude and voltage phase of nodes other than the balancing node respectively using the multi-label encoding method.

[0020] Optionally, the acquisition unit includes: a first acquisition subunit, used to acquire first power grid measurement data of the data acquisition and monitoring system, wherein the first power grid measurement data at least includes node injected active power, node injected reactive power, branch active power flow data and branch reactive power flow data; a second acquisition subunit, used to acquire second power grid measurement data of the synchronous phasor measurement unit, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0021] Optionally, the integrated classification detection model includes multiple base classifiers.

[0022] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is also provided, wherein the computer-readable storage medium includes a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting false data injection attacks.

[0023] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a detection method for executing any one of the false data injection attacks described above.

[0024] In an embodiment of the present invention, power grid measurement data is obtained, wherein the power grid measurement data includes multiple types of power data; the power grid measurement data is analyzed by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training of multiple groups of data, and each group of data in the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; whether the power grid measurement data is attacked is determined according to the size of the output vector value, and the attacked data is processed. Through the technical solution provided by the present invention, the purpose of using a cross-division method to process mixed power grid measurement data, constructing an integrated classification detection model, and converting its output vector through multi-label encoding is achieved, thereby achieving the technical effect of effectively identifying the state quantity of the power grid polluted by the false data injection attack, improving the fitting ability and accuracy of the model, and thus solving the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the polluted power grid state quantity. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0026] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for detecting a false data injection attack according to an embodiment of the present invention;

[0027] Figure 2 is a flow chart of a method for detecting a false data injection attack according to an embodiment of the present invention;

[0028] Figure 3 is a flow chart of an optional false data injection attack detection method according to an embodiment of the present invention;

[0029] Figure 4 is a flow chart of another optional false data injection attack detection method according to an embodiment of the present invention;

[0030] Figure 5 is a schematic diagram of a process for building an integrated classification detection model according to an embodiment of the present invention;

[0031] Figure 6 is a schematic diagram of a detection device for false data injection attack according to an embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] As introduced in the background technology, the existing false data injection attack detection method for power system state estimation has insufficient fitting ability and cannot accurately identify the polluted power grid state quantity. In view of the above defects, a false data injection attack detection method, device, computer-readable storage medium and electronic device are provided in the embodiments of the present invention.

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] The method embodiments provided in the embodiments of the present invention can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for detecting a false data injection attack according to an embodiment of the present invention. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0037] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the detection method of false data injection attack in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks and combinations thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] According to an embodiment of the present invention, a method embodiment of a method for detecting a false data injection attack is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 2 FIG. 1 is a flow chart of a method for detecting a false data injection attack according to an embodiment of the present invention. Figure 2 As shown, the method comprises the following steps:

[0040] Step S202: acquiring power grid measurement data, wherein the power grid measurement data includes multiple types of power data.

[0041] In this embodiment, power grid measurement data can be obtained. By collecting various types of power data of the power grid, the operation status of the power grid can be fully monitored and possible abnormalities in the power grid can be discovered in time.

[0042] Figure 3is a flow chart of an optional false data injection attack detection method according to an embodiment of the present invention, such as Figure 3 As shown, the power grid measurement data is obtained, which may include SCADA (Supervisory Control and Data Acquisition, SCADA) measurement data and PMU (Phasor Measurement Unit, PMU) measurement data.

[0043] Step S204, analyzing the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data.

[0044] In this embodiment, by analyzing the power grid measurement data and obtaining the output vector value, the integrated classification detection model can detect whether a false data injection attack occurs, and take corresponding measures in time to protect the security and stability of the power grid system.

[0045] Step S206, determining whether the power grid measurement data is attacked according to the magnitude of the output vector value, and processing the attacked data.

[0046] In this embodiment, determining whether the power grid measurement data is attacked based on the size of the output vector value can help the system to promptly detect possible attack behaviors. By analyzing and comparing the size of the output vector value, the attacked data can be effectively identified and corresponding countermeasures can be taken in a timely manner.

[0047] As can be seen from the above, in an embodiment of the present invention, power grid measurement data is obtained, wherein the power grid measurement data includes multiple types of power data; the power grid measurement data is analyzed by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; whether the power grid measurement data is attacked is determined according to the size of the output vector value, and the attacked data is processed, thereby achieving the purpose of using a cross-division method to process mixed power grid measurement data, constructing an integrated classification detection model, and converting its output vector through multi-label encoding, thereby achieving the technical effect of effectively identifying the state quantity of the power grid polluted by the false data injection attack, and improving the fitting ability and accuracy of the model.

[0048] The technical solution provided by the embodiment of the present invention solves the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the contaminated power grid state quantity.

[0049] According to the above embodiment of the present invention, before analyzing the power grid measurement data through the integrated classification detection model, the false data injection attack detection method further includes: establishing a data matrix of the power grid measurement data as Wherein, Z represents the data matrix, d represents the number of power grid measurement data, and m represents the dimension of the power grid measurement data; the data matrix is ​​divided into multiple sub-matrices by cross partitioning, and the multiple sub-matrices are divided into a training set and a test set; an initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and when the test passes, the integrated classification detection model is obtained.

[0050] In this embodiment, by constructing the power grid measurement data into a data matrix, a large amount of data can be processed more systematically. Through cross-division, the diversity and representativeness of the training set and test set data can be ensured, overfitting can be avoided, and the generalization ability of the model can be improved. By testing the trained model with the test set, the robustness of the model can be verified. The integrated classification detection model can be continuously trained and updated according to the new power grid data to adapt to the changes in the power grid status and new attack modes, so as to maintain the timeliness and effectiveness of the detection system.

[0051] Figure 4 is a flow chart of another optional false data injection attack detection method according to an embodiment of the present invention, such as Figure 4 As shown, according to the measurement matrix composed of SCADA and PMU original measurement data, the measurement matrix is ​​divided into 5 independent subsets by cross partitioning, one of which is a test set and the rest are training sets. An integrated classification detection model is constructed based on the training set and the test set.

[0052] Figure 5 is a schematic diagram of the integrated classification detection model construction process according to an embodiment of the present invention. Figure 5As shown in the figure, the measurement matrix composed of SCADA and PMU measurement data is divided into five training sets and test sets by the cross method. The first set of the first group is the test set, and the remaining four are training sets; the second set of the second group is the test set, and the remaining four are training sets; the third set of the third group is the test set, and the remaining four are training sets; the fourth set of the fourth group is the test set, and the remaining four are training sets; the fifth set of the fifth group is the test set, and the remaining four are training sets. The integrated detection classifier includes 9 heterogeneous base classifiers including RandomForest, ExtraTrees, XGBoost, SVM, GaussianNB, LogisticRegression, MLP, CNN and Kneighbors. The final integrated classification detection model is formed by aggregating the base classifiers, and finally the vector is output through the integrated detection model.

[0053] It should be noted that in order to improve the fitting ability of the detection model for complex power grid measurement data, the above-mentioned integrated classification detection model contains 9 heterogeneous base classifiers, among which the RandomForest base classifier can increase the differences between basic classifiers by random subset selection and division using the optimal attributes; the ExtraTrees base classifier uses random thresholds for attribute division and does not depend on the selection of the optimal subset attributes; each decision tree classifier in the XGBoost base classifier updates the residual information and has a higher detection effect after multiple iterations; the SVM base classifier uses the principle of structural risk minimization, has a certain robustness to noise and anomalies in the data, and reduces the detection error of the model; the GaussianNB base classifier classifies data by calculating conditional probability, and has a higher processing efficiency for large-scale data; the LogisticRegression The ion-based classifier is based on a probability model and learns parameters by minimizing the loss function. It is easy to calculate in parallel processing and has a fast fitting speed. The MLP-based classifier has a strong nonlinear fitting ability and can handle complex input-output relationships. The CNN-based classifier automatically learns local and global features in the data through multi-layer convolution operations, thereby capturing attack features hidden in the data and has a high attack feature extraction capability. The Kneighbors-based classifier compares the features in the data and finds the classification labels with the most similar features in the data, which has the advantage of high accuracy.

[0054] Specifically, the above RandomForest model is as follows: Among them, Y(x) is the output result of RandomForest, m i is the i-th decision tree, and n is the output variable of the i-th decision tree; the model of the above ExtraTrees is as follows: Among them, L is the output result of ExtraTrees, y m =j means the output of the mth decision tree is j, λ(·) means the number of satisfying conditions; the above XGBoost model is as follows: Among them, p is the output result of the model; Q is the number of decision trees, f q is the decision tree function, and F represents the decision space of all decision trees.

[0055] Optionally, the MLP may include at least 5 hidden layers, and the number of neurons in each hidden layer is at least 50; the CNN may include at least 2 convolutional layers, 2 pooling layers and 1 fully connected layer.

[0056] like Figure 3 As shown, the original measurement data is cross-partitioned to construct a training set and a test set, so as to construct an integrated classification detection model based on the training set and the test set.

[0057] According to the above embodiment of the present invention, whether the power grid measurement data is attacked is determined according to the size of the output vector value, including: converting the output vector value into a label using a multi-label encoding method to obtain a binary code for each output vector value; when the binary code is 1, it is determined that the power grid measurement data is attacked; when the binary code is 0, it is determined that the power grid measurement data is not attacked.

[0058] In this embodiment, the output vector value is labeled and converted by multi-label encoding, and multiple labels in the output vector value can be binary encoded to determine whether the power grid measurement data corresponding to each label is attacked. The binary encoding can accurately identify which specific power grid measurement data points are attacked, which simplifies the decision-making process of determining whether the power grid data is attacked, so that the detection process can be executed faster, which is helpful for post-analysis and improvement of security strategies.

[0059] like Figure 4 As shown, the real-time measurement data of the power grid to be detected is obtained, the real-time measurement data of the power grid is input into the integrated classification detection model, and the detection model output vector is obtained. After that, the output of the integrated classification detection model is converted using multi-label coding, wherein a binary code of 1 indicates that the power grid state quantity is attacked, and a binary code of 0 indicates that the power grid state quantity is not attacked.

[0060] like Figure 3 As shown, after the integrated classification detection model is constructed, the real-time measurement data of the power grid to be detected is obtained, the real-time measurement data of the power grid is input into the integrated classification detection model, and the output vector of the integrated classification detection model is converted through multi-label encoding to obtain the detection result of the power grid state quantity contaminated by false data in the real-time measurement data of the power grid.

[0061] In the above embodiment of the present invention, the output vector value is converted into a label by using a multi-label encoding method, including: using the multi-label encoding method through the formula Perform label conversion, where b i is the ith output vector, is the binary code corresponding to the i-th output vector after conversion using multi-label encoding.

[0062] In this embodiment, a multi-label encoding method is used to convert labels through a formula, which can help the model more accurately identify and distinguish which power grid measurement data are attacked and which are not attacked. By binary encoding the output vector, the data representation is more intuitive and easy to understand. Some specific labels can be inserted into the data to change the corresponding output vector, so that data that may be attacked by false data injection can be detected.

[0063] It should be noted that, since the elements in the output vector of the above integrated classification detection model are discrete values ​​between [0, 1], binary label conversion needs to be performed according to the formula.

[0064] In the above embodiment of the present invention, the output vector value is converted into a label by adopting a multi-label encoding method, and further includes: converting the voltage amplitude and the voltage phase of the nodes other than the balancing node into a label by adopting a multi-label encoding method.

[0065] In this embodiment, the voltage amplitude and voltage phase of nodes other than the balancing node can be converted into labels using a multi-label encoding method, which can improve the detection algorithm's ability to distinguish data. The multi-label encoding method can process the voltage amplitude and voltage phase data of different nodes in a unified format, which is convenient for comparison and analysis, and helps to improve the analysis and processing capabilities of power grid data.

[0066] Specifically, the above multi-label encoding method is as follows Figure 4 The last step is to map the voltage phase angles and voltage amplitudes of all nodes except the balancing node using a binary label, and then obtain the binary code that identifies the state quantity contaminated by the false data injection attack, so as to obtain the detection result of the power grid state quantity contaminated by the false data.

[0067] According to the above embodiment of the present invention, obtaining power grid measurement data includes: obtaining first power grid measurement data of a data acquisition and monitoring system, wherein the first power grid measurement data at least includes node injected active power, node injected reactive power, branch active power flow data, and branch reactive power flow data; obtaining second power grid measurement data of a synchronous phasor measurement unit, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0068] In this embodiment, the first power grid measurement data obtained from the data acquisition and monitoring system and the second power grid measurement data from the synchronous phasor measurement unit can be used as original data for comparison and analysis with actual data, thereby providing more comprehensive power grid status information.

[0069] like Figure 4 As shown, SCADA measurement data (ie, first power grid measurement data) and PMU measurement data (ie, second power grid measurement data) are acquired.

[0070] According to the above embodiment of the present invention, the integrated classification detection model includes multiple base classifiers.

[0071] In this embodiment, the overall classification accuracy can be improved by integrating multiple base classifiers. A single classifier may overfit the training data, and the integration method can reduce overfitting by averaging the prediction results of multiple models, improve the generalization ability of the model, and effectively identify important features.

[0072] Through the technical solution provided by the above-mentioned embodiment of the present invention, the fitting ability of the detection model for complex power measurement data is improved, and the output vector of the integrated classification detection model is converted by multi-label encoding to obtain a binary code for identifying the state quantity contaminated by false data injection attacks, thereby solving the technical problem that the traditional machine learning-based detection model has insufficient fitting ability for complex power measurement data and cannot accurately identify the power grid state quantity contaminated by false data. Taking into account the two types of power grid measurement data, SCADA and PMU, a virtual power plant false data injection attack detection method is proposed, which has strong fitting ability for complex power measurement data and can effectively identify the power grid state quantity contaminated by false data injection attacks. This is not common in the existing virtual power plant false data injection attack detection methods.

[0073] From the above, it can be seen that in an embodiment of the present invention, an attack detection method for identifying contaminated grid state quantities in false data injection attacks in virtual power plants is proposed, special attention is paid to the problem of complex power data fitting capability, and a detection model including SCADA and PMU hybrid grid measurement data is considered. Training sets and test sets are constructed by cross-division, and the final integrated classification detection model is constructed using multiple groups of training sets and test sets, thereby avoiding overfitting in the integrated classification detection model due to the joint learning of multiple base classifiers.

[0074] That is, the technical solution provided by the embodiment of the present invention comprehensively considers various factors, adopts a cross-partitioning method to process SCADA and PMU power grid measurement data, obtains a training set and a test set, and constructs an integrated classification detection model based on the training set and the test set. The integrated detection classifier includes 9 heterogeneous base classifiers, namely RandomForest, ExtraTrees, SVM, Kneighbors, GaussianNB, LogisticRegression, MLP, CNN and XGBoost, and the output vector of the integrated classification detection model is converted through multi-label encoding. Compared with the detection method that can only identify whether a false data injection attack of a virtual power plant exists, it can provide information on the state of the power grid contaminated by false data.

[0075] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0076] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, or network device, etc.) to execute the methods of each embodiment of the present application.

[0077] According to an embodiment of the present invention, a false data injection attack detection device for implementing the false data injection attack detection method is also provided. Figure 6 is a schematic diagram of a detection device for false data injection attack according to an embodiment of the present invention. Figure 6 As shown, the device includes: an acquisition unit 601, an analysis unit 603 and a determination unit 605. The detection device for the false data injection attack is described below.

[0078] The acquisition unit 601 is used to acquire power grid measurement data, wherein the power grid measurement data includes multiple types of power data.

[0079] The analysis unit 603 is used to analyze the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data.

[0080] The determination unit 605 is used to determine whether the power grid measurement data is attacked according to the size of the output vector value, and process the attacked data.

[0081] It should be noted here that the above-mentioned acquisition unit 601, analysis unit 603 and determination unit 605 correspond to steps S202 to S206 in the above-mentioned embodiment, and the three modules are the same as the instances and application scenarios implemented by the corresponding steps, but are not limited to the contents disclosed in the above-mentioned embodiment.

[0082] As can be seen from the above, in the scheme recorded in the above-mentioned embodiment of the present invention, first, the acquisition unit can be used to acquire power grid measurement data, wherein the power grid measurement data includes multiple types of power data; then the analysis unit can be used to analyze the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; finally, the determination unit can be used to determine whether the power grid measurement data is attacked according to the size of the output vector value, and process the attacked data, thereby achieving the purpose of using a cross-division method to process mixed power grid measurement data, constructing an integrated classification detection model, and converting its output vector through multi-label encoding, thereby achieving the technical effect of effectively identifying the state quantity of the power grid polluted by the false data injection attack, and improving the fitting ability and accuracy of the model.

[0083] The technical solution provided by the embodiment of the present invention solves the technical problem that the false data injection attack detection method for power system state estimation in the prior art has insufficient fitting ability and cannot accurately identify the contaminated power grid state quantity.

[0084] In an optional embodiment, the false data injection attack detection device further includes: an establishment unit for establishing a data matrix of the power grid measurement data before analyzing the power grid measurement data through the integrated classification detection model. Wherein, Z represents a data matrix, d represents the number of power grid measurement data, and m represents the dimension of the power grid measurement data; a partitioning unit is used to divide the data matrix into multiple sub-matrices by cross partitioning, and divide the multiple sub-matrices into a training set and a test set; a processing unit is used to obtain an initial integrated classification detection model, train the initial integrated classification detection model by the training set, and test the trained initial integrated classification detection model by the test set, and obtain the integrated classification detection model when the test passes.

[0085] In an optional embodiment, the determination unit includes: a first conversion subunit, used to perform label conversion on the output vector value using a multi-label encoding method to obtain a binary code for each output vector value; a first determination subunit, used to determine that the power grid measurement data is attacked when the binary code is 1; and a second determination subunit, used to determine that the power grid measurement data is not attacked when the binary code is 0.

[0086] In an optional embodiment, the first conversion subunit includes: a second conversion subunit, which is used to adopt a multi-label encoding method through the formula Perform label conversion, where b i is the ith output vector,

[0087] is the binary code corresponding to the i-th output vector after conversion using multi-label encoding.

[0088] In an optional embodiment, the first conversion subunit further includes: a third conversion subunit, configured to perform label conversion on the voltage amplitude and voltage phase of nodes other than the balancing node respectively using a multi-label encoding method.

[0089] In an optional embodiment, the acquisition unit includes: a first acquisition subunit, used to acquire first power grid measurement data of the data acquisition and monitoring system, wherein the first power grid measurement data at least includes node injected active power, node injected reactive power, branch active power flow data and branch reactive power flow data; a second acquisition subunit, used to acquire second power grid measurement data of the synchronous phasor measurement unit, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

[0090] In an optional embodiment, the integrated classification detection model includes multiple base classifiers.

[0091] According to another aspect of an embodiment of the present invention, there is also provided an electronic device, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for detecting a false data injection attack for executing any of the above items.

[0092] According to another aspect of an embodiment of the present invention, a processor is further provided, and the processor is used to run a program, wherein when the program is run, any one of the above-mentioned methods for detecting false data injection attacks is executed.

[0093] According to another aspect of an embodiment of the present invention, a computer program product is provided, including computer instructions, and when the computer instructions are executed by a processor, any one of the above-mentioned methods for detecting false data injection attacks is executed.

[0094] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium including a stored program, wherein when the program is running, the device where the computer-readable storage medium is located is controlled to execute any one of the above-mentioned methods for detecting false data injection attacks.

[0095] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the communication devices in a communication device group.

[0096] Optionally, in this embodiment, a computer-readable storage medium is configured to store program code for executing the following steps: obtaining power grid measurement data, wherein the power grid measurement data includes multiple types of power data; analyzing the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; determining whether the power grid measurement data is attacked based on the size of the output vector value, and processing the attacked data.

[0097] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: establishing a data matrix of power grid measurement data as Wherein, Z represents the data matrix, d represents the number of power grid measurement data, and m represents the dimension of the power grid measurement data; the data matrix is ​​divided into multiple sub-matrices by cross partitioning, and the multiple sub-matrices are divided into a training set and a test set; an initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and when the test passes, the integrated classification detection model is obtained.

[0098] Optionally, in this embodiment, the computer-readable storage medium is configured to store program code for executing the following steps: performing label conversion on the output vector value using a multi-label encoding method to obtain a binary code for each output vector value; when the binary code is 1, determining that the power grid measurement data is attacked; when the binary code is 0, determining that the power grid measurement data is not attacked.

[0099] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: using a multi-label encoding method through the formula Perform label conversion, where b i is the ith output vector, is the binary code corresponding to the i-th output vector after conversion using multi-label encoding.

[0100] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: performing label conversion on voltage amplitudes and voltage phases of nodes other than the balancing node using a multi-label encoding method.

[0101] Optionally, in this embodiment, the computer-readable storage medium is configured to store program codes for executing the following steps: obtaining first power grid measurement data of the data acquisition and monitoring system, wherein the first power grid measurement data includes at least node injected active power, node injected reactive power, branch active power flow data, and branch reactive power flow data; obtaining second power grid measurement data of the synchronous phasor measurement unit, wherein the second power grid measurement data includes at least node voltage phasor data and branch current phasor data.

[0102] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0103] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0104] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0105] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0106] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0107] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0108] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for detecting a false data injection attack, characterized in that: include: Acquiring power grid measurement data, wherein the power grid measurement data includes multiple types of power data; The power grid measurement data is analyzed by an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by machine learning training of multiple groups of data, and each group of the multiple groups of data includes historical power grid measurement data and a label of whether the historical power grid measurement data is false data injection attack data; Whether the power grid measurement data is attacked is determined according to the size of the output vector value, and the attacked data is processed.

2. The method for detecting false data injection attacks according to claim 1, characterized in that: Before analyzing the power grid measurement data by using the integrated classification detection model, the method further includes: The data matrix of the power grid measurement data is established as Wherein, Z represents the data matrix, d represents the number of the power grid measurement data, and m represents the dimension of the power grid measurement data; Dividing the data matrix into a plurality of sub-matrices by cross partitioning, and dividing the plurality of sub-matrices into a training set and a test set; An initial integrated classification detection model is obtained, the initial integrated classification detection model is trained by the training set, and the trained initial integrated classification detection model is tested by the test set, and when the test passes, the integrated classification detection model is obtained.

3. The method for detecting false data injection attacks according to claim 1, characterized in that: Determining whether the power grid measurement data is attacked according to the magnitude of the output vector value includes: Performing label conversion on the output vector value by adopting a multi-label encoding method to obtain a binary code of each output vector value; When the binary code is 1, it is determined that the power grid measurement data is attacked; When the binary code is 0, it is determined that the power grid measurement data has not been attacked.

4. The method for detecting false data injection attacks according to claim 3, characterized in that: The output vector value is subjected to label conversion using a multi-label encoding method, including: Using multi-label encoding method through the formula Perform label conversion, where b i is the ith output vector, is the binary code corresponding to the ith output vector after conversion using the multi-label encoding method.

5. The method for detecting false data injection attacks according to claim 3, characterized in that: The output vector value is subjected to label conversion using a multi-label encoding method, further comprising: The voltage amplitudes and voltage phases of nodes other than the balancing node are respectively converted into labels using the multi-label encoding method.

6. The method for detecting false data injection attacks according to claim 1, characterized in that: Obtain grid measurement data, including: Acquire first power grid measurement data of the data acquisition and monitoring system, wherein the first power grid measurement data at least includes node injected active power, node injected reactive power, branch active power flow data, and branch reactive power flow data; Second power grid measurement data of the synchronous phasor measurement unit is acquired, wherein the second power grid measurement data at least includes node voltage phasor data and branch current phasor data.

7. The method for detecting false data injection attacks according to claim 1, characterized in that: The integrated classification detection model includes multiple base classifiers.

8. A detection device for false data injection attack, characterized in that: include: An acquisition unit, configured to acquire power grid measurement data, wherein the power grid measurement data includes multiple types of power data; An analysis unit is used to analyze the power grid measurement data through an integrated classification detection model to obtain an output vector value, wherein the integrated classification detection model is obtained by training multiple groups of data through machine learning, and each group of the multiple groups of data includes historical power grid measurement data and a label indicating whether the historical power grid measurement data is false data injection attack data; A determination unit is used to determine whether the power grid measurement data is attacked according to the size of the output vector value, and process the attacked data.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the false data injection attack detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a detection method for executing the false data injection attack described in any one of claims 1 to 7.

Images