False data injection attack detection method based on modal decomposition and extreme gradient lifting

Abstract

The invention relates to a false data injection attack detection method based on modal decomposition and extreme gradient lifting, and belongs to the technical field of smart power grid attack detection. According to the method, variation mode decomposition is adopted to extract significant features of FDIA signals under different frequencies; in addition, a result obtained from particle swarm optimization is used for replacing a preset threshold value of extreme gradient improvement on a single bus, and therefore the detection precision and interpretability of the method are improved. A simulation result of an IEEE-14 bus system shows that the attack on a single bus can be effectively detected, and finally, the influence of attack intensity on the performance of the method under specific noise interference is evaluated, so that the effectiveness and robustness of the method are proved.

Description

Technical Field

[0001] The invention relates to a false data injection attack detection method based on modal decomposition and extreme gradient boosting, and belongs to the technical field of smart grid attack detection. Background Art

[0002] With the large-scale blowout development of information transmission and communication interconnection technology, the current smart grid has achieved the improvement of power supply efficiency and the reduction of transmission cost, and has made outstanding contributions to reducing industrial electricity costs and reasonable power distribution. However, the introduction of control equipment into the information system will inevitably bring a large number of information layer vulnerabilities. For example, false data injection attacks can bring huge hidden dangers to the system and network security through their unique attack concealment. Therefore, network security issues are one of the most severe challenges facing the current smart grid. On the one hand, the existing attack detection technology rarely considers the extraction of residents' long-term electricity consumption trend characteristics from past historical data. This is because the time domain characteristics are difficult to see intuitively, and researchers often ignore these minor changes, which leads to the inability to fully determine the true or false of the detected attack signal, which may cause misjudgment. On the other hand, due to the complexity of power grid equipment, the Gibbs effect is very likely to occur when an attack occurs. The violent fluctuations of the system state in a short period of time and the appearance of non-Gaussian noise will bring more uncertainties and difficulties to attack detection. Therefore, the present invention proposes a false data injection attack detection method to solve the problems of the prior art.

[0003] The technology of this invention is funded by the Yunnan Provincial Major Science and Technology Special Project (202302AD080002); the Yunnan Provincial Key Laboratory of Computer Technology Application Open Fund (CB22144S073A); and the "Xingdian Talent Support Plan" Industrial Innovation Talent Project (Yunnan Development and Reform Personnel

[2019] No. 1096). Summary of the invention

[0004] The technical problem to be solved by the present invention is to provide a false data injection attack detection method based on modal decomposition and extreme gradient boosting, so as to solve the problem of efficient detection of false data injection attacks in complex power grid equipment.

[0005] The technical solution of the present invention is: the present invention analyzes the real-time load of the power grid, extracts the important features that affect the change of the power grid state from the perspective of time domain and frequency domain, and then distinguishes the attack signal and noise interference according to the proposed model, and finally ensures the reliability and accuracy of the detection technology after several verifications. On the one hand, according to the results of modal decomposition, the more obvious abnormal signals in the non-Gaussian system state are extracted in time, which prevents the power grid equipment from being interfered by noise again during the communication transmission process, thereby increasing the difficulty of attack detection. On the other hand, the use of the extreme gradient boosting model can solve the problem of slow and error-prone large-scale data processing. There is no need to use methods such as online data update to verify complex power grid load data, which greatly reduces the workload and processing time of the detection framework and improves the efficiency of real-time load data detection.

[0006] The technical solution adopted by the present invention is: a false data injection attack detection method, which is essentially an extreme gradient boosting model based on variational mode decomposition and particle swarm optimization, and the steps are as follows:

[0007] Step 1: Collect cyber-physical system data and organize and summarize them to obtain a grid load data set;

[0008] Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the grid load data set, and extract the initial voltage phase angle and initial current amplitude of any node as the long-term power consumption characteristics;

[0009] Step 3: Use the voltage / current phase angle and amplitude to construct an attack signal that meets the FDIA characteristics, perform bad data detection, and obtain initial FDIA data;

[0010] Step 4: Combine the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, and then shuffle the order of the obtained data and reorganize them to obtain complete, non-missing, and balanced reorganized FDIA data;

[0011] Step 5: Use the VMD method to decompose the reorganized FDIA data, extract multi-layer IMF and perform sub-column fusion, and then determine the modal number by extracting the correlation and frequency change to obtain the decomposed FDIA data containing FDIA information corresponding to the modal number;

[0012] Step 6: Use the decomposed FDIA data as the input value of the feature extraction module to guide the extraction of target key features of the time series data at different scales, and arrange and combine the target key features;

[0013] Step 7: intercept part of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the first mode data as the daily power consumption characteristics, and judge the search rationality of the particle swarm optimization based on the daily power consumption characteristics and long-term power consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model;

[0014] Step 8: intercept part of the reorganized FDIA data, and directly use the VMD method to decompose and extract the first mode data as the short-term power consumption features. Combine the short-term power consumption features with the long-term power consumption features, and use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model. After the update is completed, use the XGBoost model to classify the target key features, and mark the FDIA features to obtain several multi-label binary classification results;

[0015] Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency map. After the secondary check, the results that meet the FDIA characteristics trigger an attack alarm, otherwise they are classified as no attack. Among them, the secondary check is to confirm that there is no error in the classification result (label missing). The distribution of attack signals and normal signals on the state frequency map is completely different, which can be used as a basis for judging the attack. The secondary check of the frequency map is to reconfirm whether there is any misjudgment.

[0016] The Step 3 is specifically as follows:

[0017] FDIA has the characteristic of arbitrarily tampering with values, and can adjust the attack size to be equal to the measurement error in value, thereby using the measurement error to achieve the purpose of hiding the attack signal;

[0018] Z=h(x)+e

[0019] Z is the measured value (including attack), h(x) is the state value (excluding attack), and e is the measurement error;

[0020] Add an attack to the initial voltage / current phase angle and amplitude, and make the attack less than or equal to the measurement error to complete the attack signal construction, and calculate the maximum normalized residual of the initial voltage / current phase angle and amplitude as the judgment criterion. If the difference between the measured value and the state value is greater than the maximum normalized residual, unusable bad data is detected, otherwise the initial FDIA data is obtained.

[0021] The Step 5 is specifically as follows:

[0022] Step 5.1: Gradually split the reorganized FDIA data into sub-signals at different frequencies, and extract the center frequency W of each sub-signal N, so that the center frequency error between the decomposition layers N-1 and N is less than the threshold, and the signal is decomposed until the center frequency error is equal to the threshold. Then the current center frequency is the dominant center frequency. With the decomposition, when the number of dominant center frequencies n does not change, at this time n = N, that is, N groups of intrinsic mode functions IMF processed by the VMD method are obtained. i ;

[0023] Step 5.2: Remove the weight part of the first mode intrinsic mode function, and transform the intrinsic mode function IMF layer by layer. i Stack and add to form the intrinsic mode function feature set IMF = (IMF2, IMF 2+3 ,IMF 2+3+4 , ..., IMF 2+3+4+……+N );

[0024] Step 5.3: By solving the correlation between each element in the IMF and the IMF set and the frequency change, the non-weighted modal correlation coefficient ratio-instantaneous frequency mean method is used to cross-modal judge and calculate the optimal number of modes required for decomposing the FDIA signal;

[0025] Step 5.4: Decompose each value in the reorganized FDIA data into the IMF corresponding to the optimal modal number according to step 5.1 i , N groups of decomposed FDIA data containing FDIA information can be obtained.

[0026] The Step 5.3 is specifically as follows:

[0027] Step 5.3.1: Calculate the Pearson correlation coefficient between each element in the IMF and the IMF set, and arrange them in ascending order of the modal number:

[0028]

[0029] Where C(n) represents the correlation coefficient ratio, M represents the mode number, x represents the initial state value, and the value k ranges from 2 to n;

[0030] Step 5.3.2: Use the reorganized FDIA data to solve the frequency values ​​of the corresponding time nodes under mode i, and add and average the frequency values ​​to obtain N groups of instantaneous frequency means;

[0031]

[0032] Among them, K represents the total value under the same mode, f ij represents the instantaneous frequency of the jth sample value of the i-th mode, j = 1, 2, 3, ..., K, represents the derivative of the instantaneous phase angle;

[0033] Step 5.3.3: Find the modal number with the increasing and decreasing trend of the instantaneous frequency mean value, and use the Pearson correlation coefficient to determine whether the mode is related to the original FDIA data. The modal number with the largest correlation and the change in the instantaneous frequency mean trend is the optimal modal number;

[0034] Find the minimum values ​​of the N groups of instantaneous frequency means respectively, record the mode set X=(a1, a2, ..., an) corresponding to the minimum value, and record the mode set Y=(b1, b2, ..., bn) whose Pearson correlation coefficient is close to 1. When ai=bi, the correlation is the highest.

[0035] The Step 6 is specifically as follows:

[0036] Step 6.1: Divide the time series features into N subsets according to the mode, and the K values ​​contained in each subset are used as input values ​​of the feature extraction module;

[0037] Step 6.2: The feature extraction module S is composed of five different scales: envelope entropy S1, modal energy deviation S2, Mahalanobis distance S3, standard deviation S4, and mean S5. The N subsets divided are respectively imported into the feature extraction module to extract the target key features F between the same modalities at different scales. i , i=1,2,3,4,5;

[0038] Step 6.3: Arrange and combine the extracted envelope entropy F1 and standard deviation F4 from low to high, and arrange and combine the modal energy deviation F2, Mahalanobis distance F3, and mean F5 from high to low.

[0039] Among them, rearrangement reduces the difficulty of classifying the key features of the target in Step 8. The smaller the envelope entropy and standard deviation, respectively, reflect that the signal contains less noise and the signal changes less in the time domain, which can reduce interference factors; while the larger the modal energy deviation, Mahalanobis distance and mean, respectively, reflect that the attack is more likely to occur, the independence of each node is stronger, and the attack intensity is greater. This means that the extracted attack is very pure, the features are very clear, and does not contain other signals. After arrangement, it can save time for the model classification in Step 8 and improve classification efficiency.

[0040] The Step 6.2 is specifically as follows:

[0041] Step 6.2.1: Calculate the envelope entropy of each subset in the decomposed FDIA data under the same mode, and obtain the sequence of each subset as the envelope entropy S1;

[0042]

[0043] Among them, E represents the entropy value, p ijrepresents the probability density function, N represents discretizing the envelope function into N points, and a(ij) represents the envelope function of the jth component constituting the i-th mode;

[0044] Step 6.2.2: Calculate the energy value of each subset of the decomposed FDIA data and the initial voltage / current phase angle and amplitude data under the same mode in mode i, and calculate the difference between the two as the modal energy deviation S2;

[0045]

[0046] Among them, |y ij | represents the absolute value of the amplitude of the jth component of the i-th mode, A and B represent the attack system state and the original system state respectively, and n represents the total number of signal components;

[0047] Step 6.2.3: transform each subset of the decomposed FDIA data under the same mode into a 1*k matrix, and then use the mean and variance to calculate the matrix value as the Mahalanobis distance S3;

[0048]

[0049] Among them, d(X i ) represents the Mahalanobis distance, X i represents the value of the i-th mode, T represents the matrix transpose, S -1 represents the inverse matrix of the standard deviation matrix, μ represents the mean;

[0050] Step 6.2.4: Directly calculate the standard deviation S4 and mean S5 of each subset of decomposed FDIA data under the same mode;

[0051] Step 6.2.5: Calculate the absolute value of envelope entropy S1 as the target key feature F1, calculate the absolute value of modal energy deviation S2 as the target key feature F2, calculate the absolute value of Mahalanobis distance S3 as the target key feature F3, calculate the absolute values ​​of standard deviation S4 and mean S5 as the target key features F4 and F5.

[0052] The Step 7 is specifically as follows:

[0053] Step 7.1: Sample the initial voltage / current phase angle and amplitude at intervals T, and reassemble the sampled data into a new sample set. Decompose the sample set by using step 5, and take the first modal IMF1 time series feature set as the daily electricity consumption feature F D ;

[0054] Step 7.2: Daily electricity consumption characteristics F D and long-term power consumption characteristics F LAs the input of the XGBoost model, F and D and F L The inertia factor ω1 (t) and ω2 (t) :

[0055] ωj (t) =(ω ini -ω end )(G k -g) / G k +ω end

[0056] Among them, ω (t) is the inertia factor, G k is the maximum number of iterations, ω ini is the initial inertia weight, ω end is the inertia weight when iterating to the maximum evolutionary generation, g is the number of iterations, j = 1, 2, representing different inertia factors;

[0057] The inertia factor reflects the global and local search capability of particle swarm optimization and is the key to balancing global and local search. (t) and ω2 (t) When the error level τ is maintained, the inertia factor ω1 (t) and ω2 (t) The mean of the optimal inertia factor ω (t) =(ω1 (t) +ω2 (t) ) / 2, and then update the optimal position of the particle through the optimal inertia factor. The optimal position is the initial value of the optimal parameter of the XGBoost model.

[0058] The beneficial effects of the present invention are as follows: the invention extracts the trend of long-term smart grid load changes, and conducts collaborative analysis with daily electricity consumption characteristics, and finally combines historical data to build an initialization model that conforms to the actual situation. Secondly, from the frequency domain perspective, it extracts many subtle system state changes that are easily overlooked by researchers, and the attack detection results will be more in line with the actual situation, greatly enhancing credibility. Finally, the invention does not need to consider the influence of complex grid structure nodes and buses. The calculated characteristics of each node are relatively independent, and the detection accuracy of the model can be greatly improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is an implementation flow chart of the present invention;

[0060] Figure 2 is the Hilbert transform diagram before and after the FDIA of the present invention occurs;

[0061] Figure 3It is a VMD mode selection result diagram of the present invention;

[0062] Figure 4 It is the extreme gradient boosting model diagram after particle swarm optimization of the present invention;

[0063] Figure 5 It is a change diagram of each IMF sub-column decomposed before and after the occurrence of FDIA of the present invention;

[0064] Figure 6 It is the characteristic frequency division diagram before and after the occurrence of FDIA of the present invention;

[0065] Figure 7 is a graph showing the relationship between the detection performance and attack strength of the model of the present invention;

[0066] Figure 8 It is a modal decomposition diagram of the signal under different attack intensities of the present invention. DETAILED DESCRIPTION

[0067] The present invention will be further described below in conjunction with the accompanying drawings and specific implementation methods.

[0068] Example 1: Figure 1 As shown in the figure, a false data injection attack detection method based on modal decomposition and extreme gradient boosting is presented. The specific steps are as follows:

[0069] Step 1: Collect cyber-physical system data and organize and summarize them to obtain a grid load data set;

[0070] Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the grid load data set, and extract the initial voltage phase angle and initial current amplitude of any node as the long-term power consumption characteristics;

[0071] Step 3: Use the voltage / current phase angle and amplitude to construct an attack signal that meets the FDIA characteristics, perform bad data detection, and obtain initial FDIA data;

[0072] Step 4: Combine the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, and then shuffle the order of the obtained data and reorganize them to obtain complete, non-missing, and balanced reorganized FDIA data;

[0073] Step 5: Use the VMD method to decompose the reorganized FDIA data, extract multi-layer IMF and perform sub-column fusion, and then determine the modal number by extracting the correlation and frequency change to obtain the decomposed FDIA data containing FDIA information corresponding to the modal number;

[0074] Step 6: Use the decomposed FDIA data as the input value of the feature extraction module to guide the extraction of target key features of the time series data at different scales, and arrange and combine the target key features;

[0075] Step 7: intercept part of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the first mode data as the daily power consumption characteristics, and judge the search rationality of the particle swarm optimization based on the daily power consumption characteristics and long-term power consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model;

[0076] Step 8: intercept part of the reorganized FDIA data, and directly use the VMD method to decompose and extract the first mode data as the short-term power consumption features. Combine the short-term power consumption features with the long-term power consumption features, and use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model. After the update is completed, use the XGBoost model to classify the target key features, and mark the FDIA features to obtain several multi-label binary classification results;

[0077] Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency diagram. The attack alarm is triggered for the results that meet the FDIA characteristics after the secondary check, otherwise they are classified as no attack.

[0078] The present invention is described in detail below through specific examples.

[0079] Step 1: Simulation environment and experimental data setting;

[0080] The present invention uses the Matpower toolkit in the Anaconda platform and the Matlab platform to conduct experiments, and uses the New York power consumption data set (recording real-time information every 5 minutes) provided by the New York Independent System Operator (NYISO). In order to ensure that the experimental results are more realistic, the present invention extracts the complete power grid load changes in New York City (11 districts) for one quarter, and organizes them to obtain the power consumption data set used in the experiment.

[0081] Step 2: Overall implementation process;

[0082] like Figure 1 As shown, the specific implementation process of the present invention is:

[0083] Firstly, the state estimation is performed on the collected time series data set, and the voltage and current phase angles and amplitudes in different periods are calculated respectively. Then, a false data injection attack is constructed to ensure that the FDIA data can pass the bad data detection, thereby obtaining the grid load data set containing the attack.

[0084] Secondly, the required IMF is solved by the VMD algorithm iWhen determining the modal number, it is necessary to determine the appropriate decomposed modal number to avoid modal aliasing. Therefore, the present invention constructs an unweighted modal correlation coefficient ratio-instantaneous frequency mean method (UMOCCR-IFM) to determine the modal number.

[0085] pass Figure 2 , we can see the specific method and value of using Hilbert transform to solve the instantaneous frequency before and after the false data injection attack. The final mode selection effect is as follows Figure 3 As shown in Figure 2, the most appropriate VMD modal value can be provided for the New York electricity consumption dataset. Figure 6 It can be seen that at sample 1500, the IMF i The data shows obvious anomalies, which are "suspicious signals", and its residuals can also show this anomaly more clearly.

[0086] Furthermore, for the different IMF i For feature extraction, this is because the original IMF i The characteristics are not obvious, their magnitude is small, and the changes are subtle. Therefore, this paper uses 5 characteristics to describe IMF i , the characteristics before and after the attack change as follows Figure 7 shown.

[0087] Finally, the particle swarm optimization algorithm is used to optimize the performance of the extreme gradient boosting model. First, the trend of long-term smart grid load changes and daily electricity consumption characteristics are analyzed collaboratively to construct an initialization model that conforms to the actual situation, such as Figure 4 As shown. The particle swarm optimization algorithm is then used to continuously update the state value and learning rate that are consistent with the current grid load changes, thereby ensuring that the output of the model is more accurate and the detection effect is more reliable. Therefore, the present invention reintegrates the classification results of the model and obtains the final classification results after several cross-validations.

[0088] Step 3: Optimization algorithm parameter settings. The parameter settings of the particle swarm optimization algorithm are shown in Table 1:

[0089] Table 1 Parameter settings

[0090]

[0091] Step 4: According to the parameter setting of Step 3, the present invention conducts a simulation experiment on the IEEE-14bus. The specific detection nodes are as follows: Figure 5 As shown;

[0092] Step 5: After completing the above experimental steps, the present invention selected the following parameter indicators as evaluation parameters, and the results are shown in Table 2 and Table 3:

[0093]

[0094] Table 2 Comparison with traditional machine learning models

[0095]

[0096] Table 3 Comparison with complex fusion models

[0097]

[0098]

[0099] Step 6: According to the evaluation index in Step 5, observe the evaluation index of the classification calculation result of the example of the present invention, and compare the algorithms Random Forest RF, Convolutional Neural Network CNN, Radial Basis Function Network RBF, Convolutional Neural Network-Long Short Time Memory Network-Attention Mechanism Network CNN-LSTM-SAM-Attention, Lightweight Gradient Boosting Machine Model LightGBM, Monte Carlo-based Classification Model Monte Carlo, KPCA-EBWO-SVM based on Kernel Principal Component Analysis and Improved White Whale Optimization Algorithm Optimization, Particle Swarm Optimization Feedforward Neural Network PSO-BP, Naive Bayes-based Classification Model Naive Bayes, it can be seen that in the results of the evaluation indexes Accuracy, precision, False Negative, and False Positive, the present invention can show relatively obvious good results in real-time data sets and attack detection with a longer time span, and at the same time has better model applicability than complex fusion models and traditional machine learning models. It not only reduces the complexity of the model, but also relatively avoids the greater impact of time complexity on the model.

[0100] Step 7: Based on the exploration of the same attack intensity pair model in Step 6, the detection performance of the present invention is still tested on the attack intensity pair. The results are as follows: Figure 8 As shown. It can be seen that as the attack intensity increases, the detection performance of the present invention also increases until it reaches the maximum. At this time, the changes in the IMF sub-signals of the system state under +5% and +15% attack intensities are compared respectively. It can be seen intuitively that when the attack intensity is low, the change in the attack signal is not obvious. When the attack intensity reaches +15%, the attack signal is already extremely obvious. This also shows that the performance of the example model of the present invention is more outstanding.

[0101] The specific implementation modes of the present invention are described in detail above in conjunction with the accompanying drawings, but the present invention is not limited to the above implementation modes, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

Claims

1. A false data injection attack detection method based on modal decomposition and extreme gradient boosting, characterized in that: The method comprises: Step 1: Collect cyber-physical system data and organize and summarize them to obtain a grid load data set; Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the grid load data set, and extract the initial voltage phase angle and initial current amplitude of any node as the long-term power consumption characteristics; Step 3: Use the voltage / current phase angle and amplitude to construct an attack signal that meets the FDIA characteristics, perform bad data detection, and obtain initial FDIA data; Step 4: Combine the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, and then shuffle the order of the obtained data and reorganize them to obtain complete, non-missing, and balanced reorganized FDIA data; Step 5: Use the VMD method to decompose the reorganized FDIA data, extract multi-layer IMF and perform sub-column fusion, and then determine the modal number by extracting the correlation and frequency change to obtain the decomposed FDIA data containing FDIA information corresponding to the modal number; Step 6: Use the decomposed FDIA data as the input value of the feature extraction module to guide the extraction of target key features of the time series data at different scales, and arrange and combine the target key features; Step 7: intercept part of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the first mode data as the daily power consumption characteristics, and judge the search rationality of the particle swarm optimization based on the daily power consumption characteristics and long-term power consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model; Step 8: intercept part of the reorganized FDIA data, and directly use the VMD method to decompose and extract the first mode data as the short-term power consumption features. Combine the short-term power consumption features with the long-term power consumption features, and use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model. After the update is completed, use the XGBoost model to classify the target key features, and mark the FDIA features to obtain several multi-label binary classification results; Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency diagram. The attack alarm is triggered for the results that meet the FDIA characteristics after the secondary check, otherwise they are classified as no attack.

2. According to claim 1, the false data injection attack detection method based on modal decomposition and extreme gradient boosting is characterized in that: The Step 3 is specifically as follows: adding an attack to the initial voltage / current phase angle and amplitude, and making the attack less than or equal to the measurement error, completing the attack signal construction, and calculating the maximum normalized residual of the initial voltage / current phase angle and amplitude as a judgment criterion. If the difference between the measured value and the state value is greater than the maximum normalized residual, unusable bad data is detected, otherwise the initial FDIA data is obtained.

3. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 1 is characterized in that: The Step 5 is specifically as follows: Step 5.1: Gradually split the reorganized FDIA data into sub-signals at different frequencies, and extract the center frequency W of each sub-signal N , so that the center frequency error between the decomposition layers N-1 and N is less than the threshold, and the signal is decomposed until the center frequency error is equal to the threshold. Then the current center frequency is the dominant center frequency. With the decomposition, when the number of dominant center frequencies n does not change, at this time n = N, that is, N groups of intrinsic mode functions IMF processed by the VMD method are obtained. i ; Step 5.2: Remove the weight part of the first mode intrinsic mode function, and transform the intrinsic mode function IMF layer by layer. i Stack and add to form the intrinsic mode function feature set IMF = (IMF2, IMF 2+3, , IMF 2+3+4 , ..., IMF 2+3+4+……+N ); Step 5.3: By solving the correlation between each element in the IMF and the IMF set and the frequency change, the non-weighted modal correlation coefficient ratio-instantaneous frequency mean method is used to cross-modal judge and calculate the optimal number of modes required for decomposing the FDIA signal; Step 5.4: Decompose each value in the reorganized FDIA data into the IMF corresponding to the optimal modal number according to step 5.1 i , N groups of decomposed FDIA data containing FDIA information can be obtained.

4. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 3 is characterized in that: The Step 5.3 is specifically as follows: Step 5.3.1: Calculate the Pearson correlation coefficient between each element in the IMF and the IMF set, and arrange them in ascending order of the modal number: Where C(n) represents the correlation coefficient ratio, M represents the mode number, x represents the initial state value, and the value k ranges from 2 to n; Step 5.3.2: Use the reorganized FDIA data to solve the frequency values ​​of the corresponding time nodes under mode i, and add and average the frequency values ​​to obtain N groups of instantaneous frequency means; Among them, K represents the total value under the same mode, f ij represents the instantaneous frequency of the jth sample value of the i-th mode, j = 1, 2, 3, ..., K, represents the derivative of the instantaneous phase angle; Step 5.3.3: Find the mode number whose instantaneous frequency mean value has a trend of increasing or decreasing, and use the Pearson correlation coefficient to determine whether the mode is related to the original FDIA data. The mode number with the highest correlation and a change in the instantaneous frequency mean value trend is the optimal mode number.

5. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 4 is characterized in that: The determination of the maximum correlation degree is specifically as follows: respectively find the minimum values ​​of the N groups of instantaneous frequency means, record the mode set X=(a1, a2,..., an) corresponding to the minimum values, record the mode set Y=(b1, b2,..., bn) whose Pearson correlation coefficient is close to 1, and when ai=bi, the correlation degree is the maximum.

6. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 1 is characterized in that: The Step 6 is specifically as follows: Step 6.1: Divide the time series features into N subsets according to the mode, and the K values ​​contained in each subset are used as input values ​​of the feature extraction module; Step 6.2: The feature extraction module S is composed of five different scales: envelope entropy S1, modal energy deviation S2, Mahalanobis distance S3, standard deviation S4, and mean S5. The N subsets divided are respectively imported into the feature extraction module to extract the target key features F between the same modality at different scales. i , i=1,2,3,4,5; Step 6.3: Arrange and combine the extracted envelope entropy F1 and standard deviation F4 from low to high, and arrange and combine the modal energy deviation F2, Mahalanobis distance F3, and mean F5 from high to low.

7. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 6 is characterized in that: The Step 6.2 is specifically as follows: Step 6.2.1: Calculate the envelope entropy of each subset in the decomposed FDIA data under the same mode, and obtain the sequence of each subset as the envelope entropy S1; Among them, E represents the entropy value, p ij represents the probability density function, N represents discretizing the envelope function into N points, and a(ij) represents the envelope function of the jth component constituting the i-th mode; Step 6.2.2: Calculate the energy value of each subset of the decomposed FDIA data and the initial voltage / current phase angle and amplitude data under the same mode in mode i, and calculate the difference between the two as the modal energy deviation S2; Among them, |y ij | represents the absolute value of the amplitude of the jth component of the i-th mode, A and B represent the attack system state and the original system state respectively, and n represents the total number of signal components; Step 6.2.3: transform each subset of the decomposed FDIA data under the same mode into a 1*k matrix, and then use the mean and variance to calculate the matrix value as the Mahalanobis distance S3; Among them, d(X i ) represents the Mahalanobis distance, X i represents the value of the i-th mode, T represents the matrix transpose, S -1 represents the inverse matrix of the standard deviation matrix, μ represents the mean; Step 6.2.4: Directly calculate the standard deviation S4 and mean S5 of each subset of decomposed FDIA data under the same mode; Step 6.2.5: Calculate the absolute value of envelope entropy S1 as the target key feature F1, calculate the absolute value of modal energy deviation S2 as the target key feature F2, calculate the absolute value of Mahalanobis distance S3 as the target key feature F3, calculate the absolute values ​​of standard deviation S4 and mean S5 as the target key features F4 and F5.

8. The false data injection attack detection method based on modal decomposition and extreme gradient boosting according to claim 1 is characterized in that: The Step 7 is specifically as follows: Step 7.1: Sample the initial voltage / current phase angle and amplitude at intervals T, and reassemble the sampled data into a new sample set. Decompose the sample set by using step 5, and take the first modal IMF1 time series feature set as the daily electricity consumption feature F D ; Step 7.2: Daily electricity consumption characteristics F D and long-term power consumption characteristics F L As the input of the XGBoost model, F and D and F L The inertia factor ω1 (t) and ω2 (t) : ωj (t) =(ω ini -ω end )(G k -g) / G k +ω end Among them, ω (t) is the inertia factor, G k is the maximum number of iterations, ω ini is the initial inertia weight, ω end is the inertia weight when iterating to the maximum evolutionary generation, g is the number of iterations, j = 1, 2, representing different inertia factors; When the inertia factor ω1 (t) and ω2 (t) When the error level τ is maintained, the inertia factor ω1 (t) and ω2 (t) The mean of the optimal inertia factor ω (t) =(ω1 (t) +ω2 (t) ) / 2, and then update the optimal position of the particle through the optimal inertia factor. The optimal position is the initial value of the optimal parameter of the XGBoost model.

Images