Power system dynamic intrusion detection method and detection device

Abstract

The invention provides a power system dynamic intrusion detection method and device. The method comprises the steps that a plurality of PMU data points are obtained from a plurality of phasor measurement units, a data matrix is formed, and each PMU data point comprises a voltage amplitude, a voltage phase, a current amplitude and a current phase; performing window sliding operation based on the data matrix, and performing circle fitting analysis on data in a window to obtain circle center positions of a plurality of fitting circles; calculating the distance between the center position of each fitting circle and a preset center position to obtain a plurality of distances; and comparing the plurality of distances with a preset distance, if the distance is greater than the preset distance, determining that intrusion exists, and if the distance is less than or equal to the preset distance, determining that intrusion does not exist. The method solves the problem that the real-time performance and the accuracy of intrusion detection cannot be ensured at the same time in the prior art.

Description

Technical Field

[0001] The present application relates to power system monitoring and security, and in particular, to a power system dynamic intrusion detection method, detection device, computer-readable storage medium and electronic device. Background Art

[0002] In recent years, with the development of smart grids and the integration of information technology, power systems have become increasingly dependent on complex computing and communication technologies. In cyber-physical systems, data security and system stability face a variety of potential cyber attack risks, such as false data injection attacks, which may cause control system misjudgments and thus affect the reliability and security of the power grid.

[0003] Currently, existing power system monitoring technologies usually cannot guarantee the real-time and accuracy of intrusion detection at the same time.

[0004] Therefore, there is an urgent need for a power system intrusion detection method that can ensure both real-time performance and accuracy. Summary of the invention

[0005] The main purpose of the present application is to provide a power system dynamic intrusion detection method, detection device, computer-readable storage medium and electronic device, so as to at least solve the problem in the prior art that the real-time and accuracy of intrusion detection cannot be guaranteed at the same time.

[0006] In order to achieve the above-mentioned purpose, according to one aspect of the present application, a method for dynamic intrusion detection in a power system is provided, comprising: acquiring multiple PMU data points from multiple phasor measurement units to form a data matrix, each of the PMU data points comprising voltage amplitude, voltage phase, current amplitude, and current phase; performing a sliding window operation based on the data matrix, performing a circle fitting analysis on the data in the window, and obtaining the center positions of multiple fitting circles; calculating the distance between the center position of each fitting circle and a preset center position to obtain multiple distances; comparing the multiple distances with the preset distance, if the distance is greater than the preset distance, there is intrusion, and if the distance is less than or equal to the preset distance, there is no intrusion.

[0007] Optionally, the process of forming the data matrix includes: each of the phasor measurement units includes multiple channels, and the PMU data points in each of the channels are arranged in sequence according to the time order of acquisition to form multiple column vectors, and the number of rows of the column vectors is the number of the PMU data points; all the column vectors of all the phasor measurement units are spliced ​​to form the data matrix, the number of rows of the data matrix is ​​the number of the PMU data points, and the number of columns of the data matrix is ​​the total number of all the channels.

[0008] Optionally, a sliding window operation is performed based on the data matrix, and a circle fitting analysis is performed on the data in the window to obtain the center positions of multiple fitted circles, including: a determination step: determining the size of the window; a fitting step: performing algebraic fitting on the PMU data points in the window to generate a fitted circle; a sliding step: after each fitting circle is generated, sliding the window by a preset step size, and continuously performing algebraic fitting on the PMU data points in the window to obtain multiple fitted circles; a calculation step: calculating the center positions of multiple fitted circles; and repeating the determination step, the fitting step, the sliding step and the calculation step in sequence until the center position of each fitted circle is obtained.

[0009] Optionally, an empty queue F is initialized, and when the PMU data point or the distance reaches the queue F, the PMU data point or the distance is added to the tail of the queue F; if the length of the queue F exceeds a preset length, the PMU data point or the distance at the head of the queue is removed.

[0010] Optionally, after the intrusion is detected, a classification model is used to classify the detected intrusion.

[0011] Optionally, the detected intrusion is classified using a classification model, including: initializing an empty category set; storing all intrusion categories in the category set, and obtaining an intrusion category set C = {C1, C2, ..., C j ,...,C k}, wherein Cj represents the j-th type of intrusion and includes data corresponding to multiple subcategories, and k is the total number of the intrusion categories; the similarity between the detected intrusion and each of the intrusion categories in the intrusion category set C is calculated; if the similarity is greater than the preset sensitivity, a new category is created and placed in the intrusion category set C, and the detected intrusion is used as the first subcategory of the new category; if the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is less than the preset capacity, the detected intrusion is added to the intrusion category; if the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is greater than or equal to the preset capacity, the subcategory first added to the intrusion category is removed, and then the detected intrusion is added to the intrusion category.

[0012] Optionally, after using the classification model to classify the detected intrusion, the method also includes: calculating the ratio of the number of correctly classified samples to the total number of samples to obtain the accuracy rate; if the accuracy rate is lower than the preset accuracy rate, using the differential evolution algorithm to adjust the preset distance, the preset sensitivity and the preset capacity.

[0013] According to another aspect of the present application, there is provided a power system dynamic intrusion detection device, comprising:

[0014] An acquisition unit, used for acquiring a plurality of PMU data points from a plurality of phasor measurement units to form a data matrix, wherein each of the PMU data points includes a voltage amplitude, a voltage phase, a current amplitude, and a current phase;

[0015] An analysis unit, configured to perform a sliding window operation based on the data matrix, perform a circle fitting analysis on the data in the window, and obtain the center positions of multiple fitting circles;

[0016] A calculation unit, used for calculating the distance between the center position of each fitting circle and a preset center position to obtain a plurality of distances;

[0017] The comparison unit is used to compare the multiple distances with a preset distance. If the distance is greater than the preset distance, there is an intrusion; if the distance is less than or equal to the preset distance, there is no intrusion.

[0018] According to another aspect of the present application, a computer-readable storage medium is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the power system dynamic intrusion detection methods described.

[0019] According to another aspect of the present application, an electronic device is provided, comprising: one or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include means for executing any one of the methods for dynamic intrusion detection in a power system.

[0020] By applying the technical solution of the present application, multiple PMU data points are obtained from multiple phasor measurement units to form a data matrix, each of which includes voltage amplitude, voltage phase, current amplitude, and current phase; a sliding window operation is performed based on the data matrix, and a circle fitting analysis is performed on the data in the window to obtain the center positions of multiple fitting circles; the distance between the center position of each fitting circle and the preset center position is calculated to obtain multiple distances; the multiple distances are compared with the preset distances, and if the distance is greater than the preset distance, there is an intrusion, and if the distance is less than or equal to the preset distance, there is no intrusion. In this solution, by implementing a sliding window operation, real-time analysis of the acquired PMU data points can be achieved, and by comparing the distance between the center position of the fitting circle and the preset center position, it is accurately determined whether there is an intrusion, thereby solving the problem in the prior art that the real-time and accuracy of intrusion detection cannot be guaranteed at the same time. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] The drawings constituting part of the present application are used to provide a further understanding of the present application. The exemplary embodiments and descriptions of the present application are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0022] Figure 1 A hardware structure block diagram of a mobile terminal for executing a method for dynamic intrusion detection in a power system provided in an embodiment of the present application is shown;

[0023] Figure 2 A schematic diagram of a flow chart of a power system dynamic intrusion detection method provided according to an embodiment of the present application is shown;

[0024] Figure 3 An IEEE standard node system phasor measurement unit (PMU) configuration diagram of a power system dynamic intrusion detection method provided according to an embodiment of the present application is shown;

[0025] Figure 4 A flowchart of intrusion detection and classification of a power system dynamic intrusion detection method provided according to an embodiment of the present application is shown;

[0026] Figure 5 A comparison diagram of intrusion detection performance of a power system dynamic intrusion detection method provided according to an embodiment of the present application is shown;

[0027] Figure 6 A comparison diagram of intrusion category performance metrics of a power system dynamic intrusion detection method provided according to an embodiment of the present application is shown;

[0028] Figure 7 A schematic diagram of a power system dynamic intrusion detection device provided according to an embodiment of the present application is shown.

[0029] The above drawings include the following reference numerals:

[0030] 102, processor; 104, memory; 106, transmission device; 108, input and output devices. DETAILED DESCRIPTION

[0031] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0032] In order to enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of this application.

[0033] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequential order. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present application described here. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0034] As introduced in the background technology, the existing power system intrusion detection technology cannot guarantee both real-time and accurate detection. In order to solve the problem that the above-mentioned existing solutions cannot simultaneously guarantee the real-time and accuracy of intrusion detection, the embodiments of the present application provide a power system dynamic intrusion detection method, detection device, computer-readable storage medium and electronic device.

[0035] The technical solutions in the embodiments of the present invention will be described clearly and completely below in conjunction with the accompanying drawings in the embodiments of the present invention.

[0036] The method embodiments provided in the embodiments of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a power system dynamic intrusion detection method according to an embodiment of the present invention. Figure 1As shown, the mobile terminal may include one or more ( Figure 1 Only one is shown in the figure) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the mobile terminal may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is for illustration only and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0037] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the display method of device information in the embodiment of the present invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories can be connected to the mobile terminal via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and a combination thereof. The transmission device 106 is used to receive or send data via a network. The above-mentioned specific examples of the network may include a wireless network provided by a communication provider of the mobile terminal. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0038] In this embodiment, a method for dynamic intrusion detection in an electric power system running on a mobile terminal, a computer terminal or a similar computing device is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0039] Figure 2 FIG. 1 is a flow chart of a method for dynamic intrusion detection in a power system according to an embodiment of the present application. Figure 2 As shown, the method comprises the following steps:

[0040] Step S201, acquiring multiple PMU data points from multiple phasor measurement units to form a data matrix, each of the above PMU data points including voltage amplitude, voltage phase, current amplitude, and current phase;

[0041] Specifically, a phasor measurement unit is a device used to monitor the power system in real time. Figure 3 The configuration diagram of the IEEE standard node system phasor measurement unit (PMU) is as follows: Figure 3 As shown, the PMU installation and current measurement status of each node in a typical IEEE standard node system are shown. Nodes 1, 3, 4, 5, 6, 10, 11, and 12 represent nodes with PMU installed, and nodes 2, 7, 8, 9, and 13 represent nodes without PMU installed. The solid arrow indicates that the current on this connection line is being measured by the PMU device, and the dotted arrow indicates that the current on this connection line is not measured by the PMU. This layout scheme helps to show how to configure PMU in the power system to optimize the monitoring and control of power flow and ensure the stability and efficient operation of the system. In this embodiment, four phasor measurement units are configured, and each phasor measurement unit will obtain voltage amplitude, voltage phase, current amplitude, and current phase in real time. The data obtained by the four phasor measurement units form a data matrix.

[0042] Step S202, performing a sliding window operation based on the above data matrix, performing a circle fitting analysis on the data in the window, and obtaining the center positions of multiple fitting circles;

[0043] Specifically, the sliding window operation refers to sliding the data in the data matrix according to a certain window size and performing a circle fitting analysis in each window. Circle fitting analysis is a mathematical method used to determine the position and radius of the circle that best fits a given set of data points. In this case, by performing a circle fitting analysis on the data points in the window, the center positions of multiple fitted circles can be obtained.

[0044] Specifically, the algebraic form of the circle F(X+e)=a(X+e) T (X+e)+b T (X+e)+c=0 is converted into the formula according to the standardization of the circle equation Get As the center of the circle, is the initial circle with radius, where Represents the coordinate point, is the error vector, is a coefficient vector, a is a coefficient, a≠0, c is a constant term, x and y represent the coordinates of the PMU data point in the sliding window, e represents the error of the PMU data point in the sliding window, e1 represents the error of the PMU data point in the sliding window in the x direction, e2 represents the error of the PMU data point in the sliding window in the y direction, and the center position of the fitting circle is obtained by the formula of the fitting circle

[0045] More specifically, by expanding the matrix multiplication (X+e) T (X+e)=(x+e1) 2 +(y+e2) 2 =x 2 +2xe1+e1 2 +y 2 +2ye2+e2 2 , so the original equation becomes Simplifying the equation When a≠0, divide both sides by a and rearrange to get:

[0046] Formula F(X+e)=a(X+e) T (X+e)+b T The coefficient u in (X+e)+c=0 is (a, b1, b2, c) T It can be found by forming a system of linear equations Bu = 0, where B contains the coordinates of the data points obtained by considering the imaginary and real parts of the PMU data points in the sliding window as follows: However, for ω>3, this linear system is only solvable when all PMU data points in the sliding window are completely on a circle, so an optimization problem is used to find the best fit as follows: min||B t u||, with the constraint that ||u||=1, which is equivalent to finding the right singular vector associated with the minimum singular value of Bt.

[0047] In the sliding window process, the data in the sliding window usually contains an error e. The e1 and e2 in the formula reflect this error. The calculation result of the fitting center not only contains the information of the data itself, but also includes the offset caused by the error or intrusion. When the error e is large enough, the fitting center will deviate significantly from the preset center. Therefore, by comparing the deviation between the fitting center and the preset center, it is possible to effectively detect whether the system has been invaded.

[0048] Step S203, calculating the distance between the center position of each of the fitted circles and the preset center position to obtain a plurality of distances;

[0049] Specifically, through d t =||c0-c t||The distance between the center position of each fitted circle and the preset center position is calculated to evaluate the degree of deviation between the fitted circle and the preset circle. By calculating the distance, it is determined whether the system is intruded. Among them, c0 is the preset center position, c t is the center position of the fitted circle, d t It is the distance between the center of the fitted circle and the preset center.

[0050] More specifically, the algebraic form of the circle F(X * )=a*X* T X*+b* T X*+c*=0 is converted into the formula according to the standardization of the circle equation Get As the center of the circle, is the initial circle with radius, where Represents the coordinate point, is a coefficient vector, a* is a coefficient, a*≠0, c* is a constant term, x* and y* represent the coordinates of the uninvaded PMU data points in the initial window, and the center coordinates of the initial circle are Determine the preset center position.

[0051] The above preset circle center represents the center position of the circle formed by the data points when the system is stable under ideal conditions. In the training stage, it is assumed that there is no error, that is, e = 0, so the calculated circle center depends only on the data itself and does not contain any dynamic error. In the sliding window process, the data in the sliding window usually contains an error e. The e1 and e2 in the formula reflect this error. The fitting circle center c t The calculation result not only contains the information of the data itself, but also includes the deviation caused by errors or attacks.

[0052] Step S204, comparing the plurality of distances with a preset distance, if the distance is greater than the preset distance, there is an intrusion, if the distance is less than or equal to the preset distance, there is no intrusion.

[0053] Specifically, the preset distance θ is a preset standard used to determine whether the change in the system exceeds the normal range, that is, whether it may be caused by intrusion. By comparing the distance d between the center position of each fitting circle and the preset center position t The size of the preset distance θ determines whether to trigger the intrusion detection flag. If d t <θ, then it is considered that there is no invasion, if d t >θ, it is considered that an intrusion is detected and further analysis and processing are required.

[0054] More specifically, the intrusion detection result is a Boolean value indicating whether the system has detected an intrusion. The result is used to quickly indicate the security status of the system. If the intrusion detection result is True, it means that an intrusion has occurred. If the intrusion detection result is False, it means that no intrusion has been found. The intrusion detection flag is initially set to False, indicating that no intrusion has been detected. t >θ, the intrusion detection result is set to True, indicating that the system may be intruded.

[0055] In the above embodiment, multiple PMU data points are obtained from multiple phasor measurement units to form a data matrix, each of which includes voltage amplitude, voltage phase, current amplitude, and current phase; a sliding window operation is performed based on the data matrix, and a circle fitting analysis is performed on the data in the window to obtain the center positions of multiple fitting circles; the distance between the center position of each fitting circle and the preset center position is calculated to obtain multiple distances; the multiple distances are compared with the preset distance, and if the distance is greater than the preset distance, there is an intrusion, and if the distance is less than or equal to the preset distance, there is no intrusion. In this solution, by implementing a sliding window operation, real-time analysis of the acquired PMU data points can be achieved, and by comparing the distance between the center position of the fitting circle and the preset center position, it is accurately determined whether there is an intrusion, thereby solving the problem in the prior art that the real-time and accuracy of intrusion detection cannot be guaranteed at the same time.

[0056] In a specific embodiment of the present application, the process of forming the above-mentioned data matrix includes: each of the above-mentioned phasor measurement units includes multiple channels, and the above-mentioned PMU data points in each of the above-mentioned channels are arranged in sequence according to the time order of acquisition to form multiple column vectors, and the number of rows of the above-mentioned column vectors is the number of the above-mentioned PMU data points; all the above-mentioned column vectors of all the above-mentioned phasor measurement units are spliced ​​to form the above-mentioned data matrix, the number of rows of the above-mentioned data matrix is ​​the number of the above-mentioned PMU data points, and the number of columns of the above-mentioned data matrix is ​​the total number of all the above-mentioned channels.

[0057] In one embodiment of the present application, there can be 4 phasor measurement units, with a total of 24 channels, 9 of which are voltage channels and 15 are current channels. Each PMU data point is acquired in chronological order, and each row of the data matrix represents the data at a time point, including all channel data of all phasor measurement units. Each column of the data matrix represents the data of a channel, including all PMU data points of the channel. That is to say, each row of the data matrix represents the data of all channels at the same time point, and each column represents the data of the same channel at different time points.

[0058] In one embodiment of the present application, a sliding window operation is performed based on the above data matrix, and a circle fitting analysis is performed on the data in the window to obtain the center positions of multiple fitting circles, including:

[0059] Determining steps: determining the size of the above window;

[0060] Specifically, before the sliding window operation, the number of PMU data points contained in each window is determined. If the window is too small, the circular trajectory may not be effectively fitted. If the window is too large, it may lead to excessive calculation and inaccurate fitting results. Therefore, a suitable window size is usually determined through experiments or experience.

[0061] Fitting step: performing algebraic fitting on the above PMU data points in the above window to generate a fitting circle;

[0062] Specifically, during the fitting process, the least squares method or other fitting algorithms are used to find the parameters of the circle that best fits the data points in the window, such as the center coordinates and radius. The purpose of fitting is to help better understand the distribution characteristics of the data points in the window and whether there are abnormal points.

[0063] Sliding step: after each fitting circle is generated, the window is slid by a preset step length, and algebraic fitting is continuously performed on the PMU data points in the window to obtain a plurality of fitting circles;

[0064] Specifically, after each fitting circle is generated, the window slides forward from position α by β positions to position α+β. The window size is defined by β, that is, the number of data contained in the window is β. This ensures that the window size remains unchanged when processing data, and the latest data is always processed.

[0065] Calculation steps: calculating the center positions of multiple fitted circles;

[0066] The determining step, the fitting step, the sliding step and the calculating step are repeatedly performed in sequence until the center position of each of the fitting circles is obtained.

[0067] Specifically, these steps are repeated in order to perform a circle fitting analysis on all PMU data points in the entire data matrix. By this method, the data in the data matrix can be effectively analyzed to find the center positions of multiple fitting circles.

[0068] In another embodiment of the present application, the above method also includes: initializing an empty queue F, and when the above PMU data point or the above distance reaches the above queue F, adding the above PMU data point or the above distance to the tail of the above queue F; if the length of the above queue F exceeds the preset length, removing the above PMU data point or the above distance at the head of the above queue.

[0069] Specifically, queue F is a first-in-first-out queue used to store and analyze PMU data points and the distance between the center position of each fitted circle and the preset center position, including normal data points and previously detected intrusion data points. These data points are processed and analyzed in the order they arrive. When new data points enter the queue, the oldest data points will be removed to ensure that the queue always contains the latest and most relevant data, which is particularly important for maintaining dynamic window analysis and is an indispensable component in real-time detection systems.

[0070] In an embodiment of the present application, the method further includes: after detecting the intrusion, using a classification model to classify the detected intrusion.

[0071] Specifically, after detecting an intrusion, classifying the intrusion can more accurately identify abnormal behaviors and potential intrusions in the power system, effectively reduce false alarms and missed alarms, and improve detection accuracy and efficiency. Classifying dynamic intrusions can help the system distinguish different types of intrusions, so that corresponding defense measures can be taken later.

[0072] In a specific embodiment, a classification model is used to classify the detected intrusion, including:

[0073] Initialize an empty category collection;

[0074] Specifically, an empty collection is created to store intrusion categories. Usually, a data structure provided in a programming language can be used to initialize an empty category collection.

[0075] All intrusion categories are stored in the above category set, and the intrusion category set C = {C1, C2, ..., C j ,...,C k}, where C j represents the jth type of intrusion, and includes data corresponding to multiple subcategories, and k is the total number of the above intrusion categories;

[0076] Specifically, in this embodiment, there may be eight different intrusion categories, and each intrusion category includes a plurality of intrusion data of the same intrusion category.

[0077] More specifically, the error amplitudes injected into the intrusion 1 / 30 second are 0.1, 0.5, 1, and 5 (unit: 10 -3 ). All intrusions of intrusion categories 1 to 4 should inject additive errors, which means that in every 1 / 30 second, intrusion category 1 will inject 0.1*10 -3 The additive error of intrusion type 2 will inject 0.5*10 -3 The additive error of intrusion category 3 will inject 1*10-3 additive error, intrusion category 4 will inject 5*10 -3 All intrusions from category 5 to 8 should inject subtractive errors, which means that in every 1 / 30 second, intrusion category 5 will inject 0.1*10 -3 The subtractive error of intrusion type 6 will inject 0.5*10 -3 Subtractive error, intrusion category 7 will inject 1*10 -3 Subtractive errors, intrusion category 8 will inject 5*10 -3 This error injection configuration helps verify the robustness of the system to error injections of different types and magnitudes.

[0078] Calculate the similarity between the detected intrusion and each of the intrusion categories in the intrusion category set C;

[0079] Specifically, we first use the cross-correlation function Calculate the similarity between the detected intrusion and the intrusion category in the intrusion category set C. In the above formula, Pt(i+q) and are two time series, Pt(i+q) represents the value of the detected intrusion at time point i+q, It is C j The complex conjugate of (i), C j (i) indicates intrusion category C j The value at time point i, where q is the time delay parameter, indicating the relative displacement between the two sequences, and N is the total length of any one of the two sequences. The cross-correlation function calculates the detected intrusion sequence after delaying q time units with the sequence C j This indicates that when q ≥ 0, the invasion sequence is relatively j Moved to the right by q units, the correlation between the two sequences from time point q to time point Nq-1 is calculated. When q<0, the cross-correlation function H rj (q) is defined as That is, the invasion sequence is relative to C j Moved to the left by -q units, now use C j The complex conjugate of the cross correlation with the intrusion sequence All the cross-correlation function values ​​obtained are matrices are all contained in the sequence Q. Each element Q i is the cross-correlation function H rj The value when the time delay parameter is qN, that is, Q i =H rj (qN), and 1≤q≤2N-1,q∈N.

[0080] More specifically, according to the obtained sequence Q, through the formula Calculate the similarity between the detected intrusion and the intrusion category in the category set, It is calculated by comparing the absolute value of the difference between the first half and the second half of the sequence Q. reflects the asymmetry of the correlation between the first half (positive time delay) and the second half (negative time delay) of the sequence. If The value of is small, indicating that the two sequences have high similarity under all considered time delays. The larger the value of, the worse the match between the two is at certain specific delays, where, is the middle point, Card(Q) represents the total length of sequence Q, l divides sequence Q into two halves and is used to compare the sum of the first half and the second half. This division is based on half of the length of sequence Q, rounded up, which means that if the sequence length is odd, the middle element will be included in the first half, and 2N-1 is the maximum index of sequence Q, because the cross-correlation function generates at most 2N-1 correlation data points for two sequences of length N.

[0081] If the similarity is greater than the preset sensitivity, a new category is created and put into the intrusion category set C, and the detected intrusion is used as the first subcategory of the new category;

[0082] If the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is less than the preset capacity, then the detected intrusion is added to the intrusion category;

[0083] If the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is greater than or equal to the preset capacity, the subcategory first added to the intrusion category is removed, and the detected intrusion is added to the intrusion category.

[0084] Specifically, through the classification rules Determine the newly detected intrusion p t Which category in the existing category set C should it be classified into, or whether a new category needs to be created. This classification rule is based on two key parameters, namely similarity and preset sensitivity σ determines the degree of match between an intrusion sample and a known intrusion category, where ω represents the preset capacity, that is, the maximum limit on the amount of stored data for each intrusion category.

[0085] More specifically, first, if the newly detected intrusion P t Insufficient similarity to any existing categories, i.e. Then it means that this sample does not belong to any existing category. In this case, a new category C will be created. new , and P t as the first subcategory of this category; secondly, if the newly detected intrusion P t With an existing category C i The similarity is high enough, that is And the capacity of this category Card (C i ) does not reach the preset capacity ω, then P t Add to this category; Finally, if the newly detected intrusion P t With an existing category C i The similarity is high enough, that is However, if the capacity of the category has reached or exceeded the preset capacity ω, the first data point P that entered needs to be removed from the category. out , so that the data point P t Make room and add P t Add to this category.

[0086] In one embodiment of the present application, after using the classification model to classify the detected intrusion, the method further includes: calculating the ratio of the number of correctly classified samples to the total number of samples to obtain the accuracy rate; if the accuracy rate is lower than the preset accuracy rate, adjusting the preset distance, the preset sensitivity and the preset capacity using a differential evolution algorithm.

[0087] Specifically, the differential evolution algorithm is an optimization algorithm that finds the optimal solution by continuously iteratively adjusting parameters. In this embodiment, the differential evolution algorithm is used to adjust the preset distance, preset sensitivity, and preset capacity to obtain new preset distance, preset sensitivity, and preset capacity, and intrusion detection and classification are performed again until the accuracy of the classification model reaches the preset accuracy. This enhances the system's adaptive adjustment capability, ensures long-term effective and stable operation, simplifies the system's configuration process, and improves the speed of detection and response.

[0088] In order to enable those skilled in the art to more clearly understand the technical solution of the present application, the implementation process of the power system dynamic intrusion detection method of the present application will be described in detail below in combination with specific embodiments.

[0089] This embodiment relates to a specific power system dynamic intrusion detection method, such as Figure 4 As shown, the intrusion detection and classification process includes the following steps:

[0090] Step S1: Initialize an empty queue F, an empty category set C, the intrusion detection flag is False, the counter α=1, and initialize the preset sensitivity σ, the preset distance θ, and the preset capacity ω.

[0091] Step S2: Calculate the preset center of the circle using the historical data that has not been invaded.

[0092] Step S3: Acquire PMU data points to form a data matrix.

[0093] Step S4: Update the window according to the current counter value α, and calculate the center position of the fitting circle in the current window.

[0094] Step S5: Increase the counter α=α+1.

[0095] Step S6: Calculate the distance between the center position of the fitted circle and the preset center position, and store the distance in the queue F.

[0096] Step S7: Determine whether the distance is greater than a preset distance.

[0097] Step S8: If the distance is less than or equal to the preset distance, determine whether queue F is full.

[0098] Step S9: If queue F is not full, jump back to step S4.

[0099] Step S10: If the queue F is full, the intrusion detection flag is set to False.

[0100] Step S11: Determine whether all data have been processed.

[0101] Step S12: If the distance is greater than the preset distance, the intrusion detection flag is set to True.

[0102] Step S13: Create intrusion sample P from queue F t .

[0103] Step S14: Call the intrusion classifier and input P t , get the intrusion classification result C t .

[0104] Step S15: Calculate the intrusion sample P t Similarity to known intrusion categories

[0105] Step S16: Determine similarity Is it greater than the preset sensitivity?

[0106] Step S17: If the similarity Greater than the preset sensitivity Then a new category is created and the process jumps to step S11.

[0107] Step S18: If the similarity Less than or equal to the preset sensitivity It is then determined whether the capacity of the category is less than the preset capacity.

[0108] Step S19: If the capacity of the category is less than the preset capacity, the intrusion data point P t Add to the category and jump to step S11.

[0109] Step S20: If the capacity of the category exceeds the preset capacity, the first data point P out Replaced by the intrusion data point P t , and jump to step S11.

[0110] Step S21: If all data have not been processed, jump to step S3.

[0111] Step S22: If all data processing is completed, the accuracy is calculated.

[0112] Step S23: Determine whether the accuracy rate is higher than a preset accuracy rate.

[0113] Step S24: If the accuracy is higher than or equal to the preset accuracy, the entire process ends.

[0114] Step S25: If the accuracy is lower than the preset accuracy, the preset distance, preset sensitivity and preset capacity are adjusted using the differential evolution algorithm to obtain new preset distance, preset sensitivity and preset capacity.

[0115] Step S26: Initialize an empty queue F, an empty category set C, the intrusion detection flag is False, the counter α=1, and jump to step S3.

[0116] Specifically, after an intrusion is detected, an intrusion sample P is created from the queue F. t , and input it into the existing intrusion classifier for classification, that is, the newly detected intrusion sample P t Pass it to an existing algorithm or model for detecting and classifying various attacks. This classifier is usually trained so that it can accurately classify different types of intrusion samples into corresponding attack categories. The classifier usually uses various machine learning algorithms such as support vector machines, decision trees, neural networks, etc. to classify the intrusion samples P t Perform feature extraction and analysis, and finally output the classification result C t , classification result C t is a specific identifier of the detected intrusion category, C t =f(S), where f is a mapping function. The category of intrusion is determined based on the detected signal S. S is the specific signal or data detected, and its content directly affects the accuracy and efficiency of intrusion classification. The classification result C is obtained. tFinally, it can help determine the similarity between the newly detected intrusion category and the existing intrusion category, so as to decide whether it is necessary to create a new category or classify it into the existing intrusion category.

[0117] More specifically, the preset distance is a preset standard used to determine whether the changes in the power system exceed the normal range, that is, whether it may be caused by intrusion. Sensitivity is used to adjust the sensitivity in the intrusion classification process, that is, to determine the degree of match between an intrusion sample and a known intrusion category. The preset capacity is the maximum limit on the number of samples in each intrusion category, which determines the maximum number of intrusion samples that each intrusion category can contain. When the number of samples in an intrusion category reaches the preset capacity, the old samples need to be replaced to ensure the update and manageability of the intrusion category.

[0118] In the above-mentioned embodiment, by calculating the distance between the preset center position and the center position of the fitted circle in real time, it is determined whether there is an intrusion, and after the intrusion is detected, it is accurately classified according to the similarity between the detected intrusion and the existing intrusion category. This scheme can effectively detect intrusions in real time and accurately, thereby solving the problem in the prior art that it is impossible to simultaneously guarantee the real-time and accuracy of intrusion detection.

[0119] In this embodiment, the intrusion detection performance of this method is also compared with that of the "detection module". The intrusion detection performance comparison diagram is shown in FIG. Figure 5 As shown in the figure, a comparison is made in terms of intrusion detection accuracy, security event precision, security event recall rate, intrusion event precision, and intrusion event recall rate. Figure 5 The performance of the two methods in various performance indicators is shown in the paper. The performance of this method is better than the "detection module" in all indicators, which reflects its efficiency and accuracy in power system security testing. Among them, the "detection module" refers to the module or component used to detect intrusion in the power system, which usually includes a series of algorithms, rules and techniques for monitoring the security status of the power system and detecting abnormal behavior.

[0120] In this embodiment, under different intrusion categories (category 1 to category 8), the performance of four different methods, including this method, class-based ensemble, streaming classifier and new and old category detector, and fast synthesis classifier, in terms of accuracy, precision, and recall are compared. The intrusion category performance metric comparison is shown in the figure below: Figure 6 As shown, different methods have different accuracy in classifying intrusion types. Considering the distribution of accuracy obtained by each algorithm, it can be inferred that the present method is the most stable one.

[0121] The embodiment of the present application also provides a power system dynamic intrusion detection device. It should be noted that the power system dynamic intrusion detection device of the embodiment of the present application can be used to execute the power system dynamic intrusion detection method provided by the embodiment of the present application. The device is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware for a predetermined function. Although the device described in the following embodiments is preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceived.

[0122] The following is an introduction to the power system dynamic intrusion detection device provided in an embodiment of the present application.

[0123] Figure 7 Schematic diagram of a power system dynamic intrusion detection device according to an embodiment of the present application. Figure 7 As shown, the device comprises:

[0124] An acquisition unit 10 is used to acquire multiple PMU data points from multiple phasor measurement units to form a data matrix, each of the above PMU data points includes voltage amplitude, voltage phase, current amplitude, and current phase;

[0125] An analysis unit 20 is used to perform a sliding window operation based on the data matrix, perform a circle fitting analysis on the data in the window, and obtain the center positions of multiple fitting circles;

[0126] A calculation unit 30 is used to calculate the distance between the center position of each of the above-mentioned fitting circles and the preset center position to obtain multiple distances;

[0127] The comparison unit 40 is used to compare the multiple distances with a preset distance. If the distance is greater than the preset distance, there is an intrusion; if the distance is less than or equal to the preset distance, there is no intrusion.

[0128] An embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the power system dynamic intrusion detection method.

[0129] An embodiment of the present invention provides a device, which includes a processor, a memory, and a program stored in the memory and executable on the processor. When the processor executes the program, the steps of the above-mentioned power system dynamic intrusion detection method are implemented.

[0130] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0131] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0132] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0133] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0134] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0135] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0136] The memory may include non-permanent memory in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0137] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0138] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0139] The above description is only the preferred embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for dynamic intrusion detection in a power system, characterized in that: include: Acquire multiple PMU data points from multiple phasor measurement units to form a data matrix, each of the PMU data points including voltage amplitude, voltage phase, current amplitude, and current phase; Perform a sliding window operation based on the data matrix, perform a circle fitting analysis on the data in the window, and obtain the center positions of multiple fitting circles; Calculating the distance between the center position of each fitting circle and a preset center position to obtain multiple distances; The multiple distances are compared with a preset distance. If the distance is greater than the preset distance, there is an intrusion; if the distance is less than or equal to the preset distance, there is no intrusion.

2. The detection method according to claim 1, characterized in that: The process of forming the data matrix includes: Each of the phasor measurement units includes a plurality of channels, and the PMU data points in each of the channels are arranged in sequence according to the time sequence of acquisition to form a plurality of column vectors, wherein the number of rows of the column vectors is the number of the PMU data points; All the column vectors of all the phasor measurement units are concatenated to form the data matrix, the number of rows of the data matrix is ​​the number of the PMU data points, and the number of columns of the data matrix is ​​the total number of all the channels.

3. The detection method according to claim 1, characterized in that: A sliding window operation is performed based on the data matrix, and a circle fitting analysis is performed on the data in the window to obtain the center positions of multiple fitting circles, including: Determining step: determining the size of the window; Fitting step: performing algebraic fitting on the PMU data points in the window to generate a fitting circle; Sliding step: after each fitting circle is generated, the window is slid by a preset step length, and algebraic fitting is continuously performed on the PMU data points in the window to obtain a plurality of fitting circles; Calculation step: calculating the center positions of a plurality of the fitting circles; The determining step, the fitting step, the sliding step and the calculating step are repeatedly performed in sequence until the center position of each fitting circle is obtained.

4. The detection method according to claim 1, characterized in that: The method further comprises: Initialize an empty queue F, and when the PMU data point or the distance reaches the queue F, add the PMU data point or the distance to the end of the queue F; If the length of the queue F exceeds a preset length, the PMU data point or the distance at the head of the queue is removed.

5. The detection method according to claim 1, characterized in that: The method further comprises: After the intrusion is detected, the classification model is used to classify the detected intrusion.

6. The detection method according to claim 5, characterized in that: Use classification models to categorize detected intrusions, including: Initialize an empty category collection; All intrusion categories are stored in the category set, and the intrusion category set C = {C1, C2, ..., C j ,...,C k }, where C j represents the jth type of intrusion, and includes data corresponding to multiple subcategories, and k is the total number of intrusion categories; Calculating the similarity between the detected intrusion and each of the intrusion categories in the intrusion category set C; If the similarity is greater than a preset sensitivity, a new category is created and put into the intrusion category set C, and the detected intrusion is used as the first subcategory of the new category; If the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is less than the preset capacity, adding the detected intrusion to the intrusion category; If the similarity is less than or equal to the preset sensitivity, and the capacity of the intrusion category is greater than or equal to the preset capacity, the subcategory first added to the intrusion category is removed, and then the detected intrusion is added to the intrusion category.

7. The detection method according to claim 6, characterized in that: After classifying the detected intrusion using the classification model, the method further includes: Calculate the ratio of the number of correctly classified samples to the total number of samples to get the accuracy rate; If the accuracy is lower than the preset accuracy, the preset distance, the preset sensitivity and the preset capacity are adjusted using a differential evolution algorithm.

8. A power system dynamic intrusion detection device, characterized in that: include: An acquisition unit, used for acquiring a plurality of PMU data points from a plurality of phasor measurement units to form a data matrix, wherein each of the PMU data points includes a voltage amplitude, a voltage phase, a current amplitude, and a current phase; An analysis unit, configured to perform a sliding window operation based on the data matrix, perform a circle fitting analysis on the data in the window, and obtain the center positions of multiple fitting circles; A calculation unit, used for calculating the distance between the center position of each fitting circle and a preset center position to obtain a plurality of distances; The comparison unit is used to compare the multiple distances with a preset distance. If the distance is greater than the preset distance, there is an intrusion; if the distance is less than or equal to the preset distance, there is no intrusion.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the power system dynamic intrusion detection method according to any one of claims 1 to 7.

10. An electronic device, characterized in that: include: One or more processors, a memory, and one or more programs, wherein the one or more programs are stored in the memory and are configured to be executed by the one or more processors, and the one or more programs include a method for executing the power system dynamic intrusion detection method described in any one of claims 1 to 7.

Images