A false data injection attack detection method based on modal decomposition and extreme gradient boosting

Abstract

The present application relates to a kind of false data injection attack detection method based on modal decomposition and extreme gradient boosting, belong to intelligent power grid attack detection technical field.The present application uses variational modal decomposition to extract the significant features of FDIA signal under different frequencies;In addition, the present application uses the result obtained from particle swarm optimization to replace the predetermined threshold of extreme gradient boosting on individual bus, so as to improve the detection accuracy and interpretability of the present application.The simulation results of IEEE-14 bus system show that the present application can effectively detect attacks on individual bus, finally, the influence of attack strength on the performance of the present application under certain noise interference is evaluated, thereby confirming the effectiveness and robustness of the present application.

Description

Technical Field

[0001] This invention relates to a method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting, belonging to the field of smart grid attack detection technology. Background Technology

[0002] With the explosive growth of information transmission and communication interconnection technologies, current smart grids have achieved improved power supply efficiency and reduced transmission costs, making significant contributions to reducing industrial electricity costs and promoting rational power distribution. However, the introduction of control equipment into information systems inevitably introduces numerous information layer vulnerabilities. For example, spoofed data injection attacks, with their unique stealth, pose significant threats to system and network security. Therefore, network security is one of the most severe challenges facing smart grids today. On the one hand, existing attack detection technologies rarely consider extracting long-term electricity consumption trends from historical data. This is because time-domain characteristics are difficult to observe intuitively, and researchers often overlook these subtle changes, leading to an inability to fully determine the authenticity of detected attack signals and potential misjudgments. On the other hand, due to the complexity of grid equipment, the Gibbs effect is highly likely to occur during an attack. The drastic fluctuations in system state and the presence of non-Gaussian noise in the short term will bring more uncertainties and difficulties to attack detection. Therefore, this invention proposes a spoofed data injection attack detection method to address the problems of existing technologies.

[0003] The technology of this invention is derived from the Yunnan Provincial Major Science and Technology Project (202302AD080002); the Yunnan Provincial Key Laboratory of Computer Technology Application Open Fund (CB22144S073A); and the Industrial Innovation Talent Project of the "Xingdian Elite Talent Support Program" (Yunnan Development and Reform Commission Personnel

[2019] No. 1096). Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting, so as to solve the problem of efficient detection of fake data injection attacks in complex power grid equipment.

[0005] The technical solution of this invention is as follows: This invention analyzes the real-time load of the power grid, extracts important features affecting changes in the power grid state from the time and frequency domains, then identifies attack signals and noise interference based on the proposed model, and finally ensures the reliability and accuracy of the detection technology through several verifications. On the one hand, based on the results of modal decomposition, it promptly extracts relatively obvious abnormal signals in the non-Gaussian system state, preventing power grid equipment from being subjected to noise interference again during communication transmission, thereby increasing the difficulty of attack detection. On the other hand, the use of the extreme gradient boosting model can solve the problem of slow and error-prone large-scale data processing, eliminating the need to use methods such as online data updates to verify complex power grid load data, significantly reducing the workload and processing time of the detection framework, and improving the efficiency of real-time load data detection.

[0006] The technical solution adopted in this invention is: a method for detecting fake data injection attacks, which is essentially an extreme gradient boosting model based on variational mode decomposition and particle swarm optimization. The steps are as follows:

[0007] Step 1: Collect cyber-physical system data and organize and summarize it to obtain the power grid load dataset;

[0008] Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the power grid load dataset, and extract the initial voltage phase angle and initial current amplitude of any node as long-term power consumption characteristics;

[0009] Step 3: Construct an attack signal that conforms to the characteristics of FDIA using voltage / current phase angle and amplitude, perform bad data detection, and obtain initial FDIA data;

[0010] Step 4: Merge the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, then shuffle the obtained data and reassemble them to obtain complete, unmissing, and balanced reassembled FDIA data.

[0011] Step 5: Use the VMD method to decompose the recombined FDIA data, extract multi-layer IMFs and perform sub-column fusion, and then determine the modality number by extracting correlations and frequency changes to obtain decomposed FDIA data containing FDIA information with the corresponding modality number;

[0012] Step 6: Use the decomposed FDIA data as input to the feature extraction module to guide the extraction of target key features of time series data at different scales, and arrange and combine the target key features;

[0013] Step 7: Extract a portion of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the data of the first mode as daily electricity consumption characteristics, and judge the search rationality of particle swarm optimization based on daily electricity consumption characteristics and long-term electricity consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model.

[0014] Step 8: Extract a portion of the reconstructed FDIA data and directly use the VMD method to decompose and extract the data of the first mode as short-term electricity consumption features. Combining the short-term and long-term electricity consumption features, use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model. After the update is completed, use the XGBoost model to classify the target key features. Once the FDIA features are identified, they are labeled to obtain several multi-label binary classification results.

[0015] Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency distribution map. Trigger an attack alert for results that meet the FDIA characteristics after the secondary check; otherwise, classify them as non-attackable. The secondary check confirms that the classification results are correct (no missing labels). Attack signals and normal signals have completely different distributions on the state frequency distribution map, which can be used as a basis for judging an attack. The secondary check of the frequency distribution map further confirms whether there are any misjudgments.

[0016] Step 3 specifically refers to:

[0017] FDIA has the characteristic of arbitrarily tampering with values, and can adjust the attack size to be equal to the measurement error in value, thereby using the measurement error to achieve the purpose of hiding the attack signal;

[0018] Z = h(x) + e

[0019] Z represents the measured value (including attacks), h(x) represents the state value (excluding attacks), and e represents the measurement error;

[0020] An attack is added to the initial voltage / current phase angle and amplitude, and the attack is made less than or equal to the measurement error to complete the attack signal construction. The maximum normalized residual of the initial voltage / current phase angle and amplitude is calculated as the judgment criterion. If the difference between the measured value and the state value is greater than the maximum normalized residual, unusable bad data is detected; otherwise, the initial FDIA data is obtained.

[0021] Step 5 specifically includes:

[0022] Step 5.1: Gradually break down the reconstructed FDIA data into sub-signals at different frequencies, and simultaneously extract the center frequency W of each sub-signal. NThe process continues until the center frequency error between the N-1 decomposition layers and the Nth layer is less than a threshold. The signal is then decomposed until the center frequency error equals the threshold. The current center frequency is then considered the dominant center frequency. As the decomposition progresses, if the number of dominant center frequencies, n, remains constant (n = N), then N sets of intrinsic mode functions (IMFs) processed by the VMD method are obtained. i ;

[0023] Step 5.2: Remove the weighted portion of the intrinsic mode function (IMF) of the first mode, and progressively reduce the weighted portion of the IMF layer by layer. i Stack and add them together to form the eigenfunction feature set IMF = (IMF2, IMF3, IMF4) 2+3 IMF 2+3+4 ..., IMF 2+3+4+……+N );

[0024] Step 5.3: By solving the correlation between each element in the IMF and the IMF set and the frequency change, that is, by using the unweighted modal correlation coefficient ratio-instantaneous frequency mean method to judge and calculate the optimal number of modes required to decompose the FDIA signal across modes;

[0025] Step 5.4: Decompose each value in the reconstructed FDIA data into the corresponding optimal modal number IMF according to Step 5.1. i This can yield N sets of decomposed FDIA data containing FDIA information.

[0026] Step 5.3 specifically refers to:

[0027] Step 5.3.1: Calculate the Pearson correlation coefficient between each element in the IMF and the IMF set, and arrange them in ascending order of modality number:

[0028]

[0029] Where C(n) represents the correlation coefficient ratio, M represents the number of modes, x represents the initial state value, and the value k ranges from 2 to n;

[0030] Step 5.3.2: Use the recombined FDIA data to solve for the frequency values ​​at the corresponding time nodes under mode i, and sum the frequency values ​​to calculate the average value, so as to obtain N sets of instantaneous frequency average values;

[0031]

[0032] Where K represents the total numerical value under the same mode, f ij Let j represent the instantaneous frequency of the j-th sample value in the i-th mode, where j = 1, 2, 3, ..., K. This represents the derivative with respect to the instantaneous phase angle;

[0033] Step 5.3.3: Find the number of modes whose instantaneous frequency mean changes from an increasing to a decreasing trend. Use the Pearson correlation coefficient to determine whether the mode is related to the original FDIA data. The number of modes with the highest correlation and whose instantaneous frequency mean changes from a decreasing trend is the optimal number of modes.

[0034] Find the minimum value of the mean instantaneous frequency of each of the N groups, and record the mode set X = (a1, a2, ..., an) corresponding to the minimum value. Record the mode set Y = (b1, b2, ..., bn) where the Pearson correlation coefficient is close to 1. The correlation is greatest when ai = bi.

[0035] Step 6 specifically refers to:

[0036] Step 6.1: Divide the time series features into N subsets according to modality, and use the K values ​​contained in each subset as input values ​​for the feature extraction module;

[0037] Step 6.2: The feature extraction module S consists of five different scales: envelope entropy S1, modal energy deviation S2, Mahalanobis distance S3, standard deviation S4, and mean S5. The N subsets are imported into the feature extraction module to extract the target key features F of the same modality at different scales. i , i = 1, 2, 3, 4, 5;

[0038] Step 6.3: Arrange the extracted envelope entropy F1 and standard deviation F4 in ascending order of magnitude, and arrange the modal energy deviation F2, Mahalanobis distance F3, and mean F5 in descending order of magnitude.

[0039] Among them, rearranging reduces the difficulty of classifying key target features in Step 8. Smaller envelope entropy and standard deviation reflect less noise in the signal and less change in the signal in the time domain, which can reduce interference factors. Larger modal energy deviation, Mahalanobis distance and mean reflect the greater likelihood of attack, stronger independence of each node and greater attack intensity, respectively. This indicates that the extracted attack is very pure, the features are very clear and do not contain other signals. After rearranging, it can save time for model classification in Step 8 and improve classification efficiency.

[0040] Step 6.2 specifically refers to:

[0041] Step 6.2.1: Calculate the envelope entropy for each subset in the decomposed FDIA data under the same modality, and obtain the sequence of each subset as the envelope entropy S1;

[0042]

[0043] Where E represents the entropy value, p ijLet N denote the probability density function, N denote the discretization of the envelope function into N points, and a(ij) denote the envelope function of the j-th component that makes up the i-th mode;

[0044] Step 6.2.2: Calculate the energy value of each subset of the decomposed FDIA data and the initial voltage / current phase angle and amplitude data under the same mode in mode i, and take the difference between the two as the mode energy deviation S2;

[0045]

[0046] Among them, |y ij | represents the absolute value of the amplitude of the j-th component of the i-th mode, A and B represent the state of the system with attack and the original system state, respectively, and n represents the total number of signal components;

[0047] Step 6.2.3: Transform each subset of the FDIA data decomposed under the same modality into a 1*k matrix, and then use the mean and variance to calculate the value of the matrix as the Mahalanobis distance S3;

[0048]

[0049] Where d(X) i ) represents the Mahalanobis distance, X i Let S represent the value of the i-th mode, T represent the matrix transpose, and S represent the value of the i-th mode. -1 The matrix represents the inverse of the standard deviation matrix, and μ represents the mean.

[0050] Step 6.2.4: Directly calculate the standard deviation S4 and mean S5 of each subset of the FDIA data decomposed under the same modality;

[0051] Step 6.2.5: Take the absolute value of the envelope entropy S1 as the target key feature F1, take the absolute value of the modal energy deviation S2 as the target key feature F2, take the absolute value of the Mahalanobis distance S3 as the target key feature F3, and take the absolute values ​​of the standard deviation S4 and the mean S5 as the target key features F4 and F5.

[0052] Step 7 specifically refers to:

[0053] Step 7.1: Sample the initial voltage / current phase angle and amplitude at intervals T, and recombine the sampled data into a new sample set. Decompose the sample set using Step 5, and take the first mode IMF1 time series feature set as the daily electricity consumption feature F. D ;

[0054] Step 7.2: Record daily electricity usage characteristics F D and long-term electricity consumption characteristics F LAs input to the XGBoost model, F is calculated using a linearly decreasing weight strategy. D and F L inertia factor ω1 (t) and ω2 (t) :

[0055] ωj (t) =(ω ini -ω end (G) k -g) / G k +ω end

[0056] Where, ω (t) It is the inertia factor, G k It is the maximum number of iterations, ω ini It is the initial inertia weight, ω end It is the inertia weight when iterating to the maximum number of generations, g is the number of iterations, and j = 1, 2, representing different inertia factors;

[0057] The inertia factor reflects the global and local search capabilities of particle swarm optimization and is key to balancing global and local search. When the inertia factor ω1 (t) and ω2 (t) When maintaining consistency at the error level τ, the inertia factor ω1 is at this point. (t) and ω2 (t) The mean value is used as the optimal inertia factor ω. (t) =(ω1) (t) +ω2 (t) ) / 2, and then update the optimal position of the particle through the optimal inertia factor. The optimal position is the initial value of the optimal parameters of the XGBoost model.

[0058] The beneficial effects of this invention are as follows: First, it extracts the long-term trend of smart grid load changes and performs collaborative analysis with daily electricity consumption characteristics, ultimately constructing an initialization model that conforms to the actual situation by combining historical data. Second, it extracts many subtle system state changes that researchers often overlook from the frequency domain perspective, making the attack detection results more consistent with reality and greatly enhancing credibility. Finally, this invention does not need to consider the influence of complex grid structure nodes and buses; the characteristics of each node calculated are relatively independent, resulting in a significant improvement in the detection accuracy of the model. Attached Figure Description

[0059] Figure 1 This is a flowchart illustrating the implementation of the present invention;

[0060] Figure 2 This is a Hilbert transformation diagram before and after the FDIA of this invention;

[0061] Figure 3This is a diagram showing the VMD mode selection results of the present invention;

[0062] Figure 4 This is a diagram of the particle swarm optimization extreme gradient boosting model of the present invention;

[0063] Figure 5 This is a diagram showing the changes in each IMF sub-column before and after the FDIA occurs according to the present invention;

[0064] Figure 6 These are the frequency division diagrams of each feature before and after the occurrence of FDIA in this invention;

[0065] Figure 7 This is a graph showing the relationship between the model detection performance and attack strength of this invention;

[0066] Figure 8 This is a mode decomposition diagram of the signal under different attack intensities according to the present invention. Detailed Implementation

[0067] The present invention will be further described below with reference to the accompanying drawings and specific embodiments.

[0068] Example 1: As Figure 1 As shown, a method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting is described, with the following specific steps:

[0069] Step 1: Collect cyber-physical system data and organize and summarize it to obtain the power grid load dataset;

[0070] Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the power grid load dataset, and extract the initial voltage phase angle and initial current amplitude of any node as long-term power consumption characteristics;

[0071] Step 3: Construct an attack signal that conforms to the characteristics of FDIA using voltage / current phase angle and amplitude, perform bad data detection, and obtain initial FDIA data;

[0072] Step 4: Merge the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, then shuffle the obtained data and reassemble them to obtain complete, unmissing, and balanced reassembled FDIA data.

[0073] Step 5: Use the VMD method to decompose the recombined FDIA data, extract multi-layer IMFs and perform sub-column fusion, and then determine the modality number by extracting correlations and frequency changes to obtain decomposed FDIA data containing FDIA information with the corresponding modality number;

[0074] Step 6: Use the decomposed FDIA data as input to the feature extraction module to guide the extraction of target key features of time series data at different scales, and arrange and combine the target key features;

[0075] Step 7: Extract a portion of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the data of the first mode as daily electricity consumption characteristics, and judge the search rationality of particle swarm optimization based on daily electricity consumption characteristics and long-term electricity consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model.

[0076] Step 8: Extract a portion of the reconstructed FDIA data and directly use the VMD method to decompose and extract the data of the first mode as short-term electricity consumption features. Combining the short-term and long-term electricity consumption features, use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model. After the update is completed, use the XGBoost model to classify the target key features. Once the FDIA features are identified, they are labeled to obtain several multi-label binary classification results.

[0077] Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency map. Trigger an attack alert for results that meet the FDIA characteristics after the secondary check; otherwise, classify them as non-attackable.

[0078] The invention will now be described in detail through specific examples.

[0079] Step 1: Setting up the simulation environment and experimental data;

[0080] This invention utilizes the Anaconda platform and the Matpower toolkit within the Matlab platform for experiments, employing a New York City electricity consumption dataset (recording real-time information every 5 minutes) provided by the New York Independent System Operator (NYISO). To ensure the experimental results are more realistic, this invention extracts complete grid load changes for one quarter in New York City (11 boroughs) and organizes this data to obtain the electricity consumption dataset used in the experiment.

[0081] Step 2: Overall Implementation Process;

[0082] like Figure 1 As shown, the specific implementation process of the present invention is as follows:

[0083] First, state estimation is performed on the collected time series dataset, and the voltage and current phase angles and amplitudes at different periods are calculated. Then, a fake data injection attack is constructed on it to ensure that the FDIA data can pass the bad data detection, thereby obtaining a power grid load dataset containing the attack.

[0084] Secondly, the required IMF is solved using the VMD algorithm. iIn order to avoid mode aliasing, it is necessary to determine an appropriate number of modes for decomposition. Therefore, this invention constructs an unweighted mode correlation coefficient ratio-instantaneous frequency mean method (UMOCCR-IFM) to determine the number of modes.

[0085] pass Figure 2 This shows the specific methods and values ​​for calculating instantaneous frequencies using the Hilbert transform before and after a fake data injection attack. The final modality selection effect is as follows: Figure 3 As shown, this provides the most suitable VMD modal values ​​for the New York electricity consumption dataset. Therefore, by decomposing the signals before and after the attack, we can... Figure 6 The data shows that at sample number 1500, the IMF... i The obvious anomalies shown in the data, also known as "suspicion signals," can be more clearly demonstrated by the residuals.

[0086] Furthermore, regarding the different IMFs obtained above... i Feature extraction is performed because the original IMF i The features are not obvious, their magnitude is small, and their variations are subtle. Therefore, this invention uses five features to describe the IMF. i Its characteristics change before and after the attack, such as Figure 7 As shown.

[0087] Finally, the performance of the extreme gradient boosting model is optimized using the particle swarm optimization algorithm. First, a collaborative analysis of the long-term trends in smart grid load changes and daily electricity consumption characteristics is performed to construct an initialization model that conforms to real-world conditions, such as... Figure 4 As shown. The particle swarm optimization algorithm is then used to continuously update the state values ​​and learning rate to reflect the current changes in the power grid load, thereby ensuring that the model's output is more accurate and the detection effect is more reliable. Therefore, this invention re-integrates the model's classification results and obtains the final classification result after several cross-validations.

[0088] Step 3: Optimize algorithm parameter settings. The parameter settings for the particle swarm optimization algorithm are shown in Table 1:

[0089] Table 1 Parameter Settings

[0090]

[0091] Step 4: Based on the parameter settings in Step 3, this invention underwent a simulation experiment on the IEEE-14 bus. Specific detection nodes are as follows: Figure 5 As shown;

[0092] Step 5: After completing the above experimental steps, the present invention selected the following parameters as evaluation parameters, and the results are shown in Tables 2 and 3:

[0093]

[0094] Table 2 Comparison with traditional machine learning models

[0095]

[0096] Table 3 Comparison with complex fusion models

[0097]

[0098]

[0099] Step 6: Based on the evaluation metrics in Step 5, observe the classification calculation results of the examples of this invention and compare them with algorithms such as Random Forest (RF), Convolutional Neural Network (CNN), Radial Basis Function Network (RBF), Convolutional Neural Network-Long Short-Term Memory Network-Attention Mechanism Network (CNN-LSTM-SAM-Attention), Lightweight Gradient Boosting Machine (LightGBM), Monte Carlo-based classification model, KPCA-EBWO-SVM optimized support vector machine based on kernel principal component analysis and improved White Whale Optimization algorithm, Particle Swarm Optimization Feedforward Neural Network (PSO-BP), and Naive Bayes-based classification model. It can be seen that, in terms of the evaluation metrics Accuracy, Precision, False Negative, and False Positive, this invention demonstrates significantly better results on real-time datasets and in attack detection over longer time spans. Furthermore, it exhibits superior model applicability compared to complex fusion models and traditional machine learning models. This reduces model complexity while avoiding the significant impact of time complexity on the model.

[0100] Step 7: Building upon the exploration of the same attack strength pair model in Step 6, the detection performance of this invention is still tested based on the attack strength pair. The results are as follows: Figure 8 As shown, the detection performance of this invention increases with the attack intensity, until it reaches its maximum. At this point, the changes in the IMF sub-signals of the system state are compared under attack intensities of +5% and +15%. It can be clearly seen that when the attack intensity is low, the change in the attack signal is not significant, but when the attack intensity reaches +15%, the attack signal becomes extremely obvious. This also indicates that the performance of the example model of this invention is more outstanding.

[0101] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting, characterized in that, The method includes: Step 1: Collect cyber-physical system data and organize and summarize it to obtain the power grid load dataset; Step 2: Calculate the initial voltage / current phase angle and amplitude on each bus and node based on the power grid load dataset, and extract the initial voltage phase angle and initial current amplitude of any node as long-term power consumption characteristics; Step 3: Construct an attack signal that conforms to the characteristics of FDIA using voltage / current phase angle and amplitude, perform bad data detection, and obtain initial FDIA data; Step 4: Merge the initial FDIA data with the initial voltage / current phase angle and amplitude data, remove missing values ​​and abnormal extreme values, then shuffle the obtained data and reassemble them to obtain complete, unmissing, and balanced reassembled FDIA data. Step 5: Use the VMD method to decompose the recombined FDIA data, extract multi-layer IMFs and perform sub-column fusion, and then determine the modality number by extracting correlations and frequency changes to obtain decomposed FDIA data containing FDIA information with the corresponding modality number; Step 6: Use the decomposed FDIA data as input to the feature extraction module to guide the extraction of target key features of time series data at different scales, and arrange and combine the target key features; Step 7: Extract a portion of the initial voltage / current phase angle and amplitude, directly use the VMD method to decompose and extract the data of the first mode as daily electricity consumption characteristics, and judge the search rationality of particle swarm optimization based on daily electricity consumption characteristics and long-term electricity consumption characteristics, and determine the optimal initial parameter values ​​of the XGBoost model. Step 8: Extract a portion of the reconstructed FDIA data and directly use the VMD method to decompose and extract the data of the first mode as short-term electricity consumption features; combine the short-term and long-term electricity consumption features, use the particle swarm optimization algorithm to update the optimal parameters of the XGBoost model, and after the update is completed, use the XGBoost model to classify the target key features. If FDIA features are identified, they are labeled to obtain several multi-label binary classification results. Step 9: Perform a secondary check on the multi-label binary classification results and compare them using the state frequency map. Trigger an attack alert for results that meet the FDIA characteristics after the secondary check; otherwise, classify them as non-attackable.

2. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 1, characterized in that, Step 3 specifically involves: adding an attack to the initial voltage / current phase angle and amplitude, ensuring the attack is less than or equal to the measurement error, thus completing the attack signal construction, and calculating the maximum normalized residual of the initial voltage / current phase angle and amplitude as a judgment criterion. If the difference between the measured value and the state value is greater than the maximum normalized residual, unusable bad data is detected; otherwise, the initial FDIA data is obtained.

3. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 1, characterized in that, Step 5 specifically includes: Step 5.1: Gradually break down the reconstructed FDIA data into sub-signals at different frequencies, and simultaneously extract the center frequency W of each sub-signal. N The process continues until the center frequency error between the N-1 decomposition layers and the Nth layer is less than a threshold. The signal is then decomposed until the center frequency error equals the threshold. The current center frequency is then considered the dominant center frequency. As the decomposition progresses, if the number of dominant center frequencies, n, remains constant (n = N), then N sets of intrinsic mode functions (IMFs) processed by the VMD method are obtained. i ; Step 5.2: Remove the weighted portion of the intrinsic mode function (IMF) of the first mode, and progressively reduce the weighted portion of the IMF layer by layer. i Stack and add them together to form the eigenfunction feature set IMF = (IMF2, IMF3, IMF4) 2+3 IMF 2+3+4 ..., IMF 2+3+4+……+N ); Step 5.3: By solving the correlation between each element in the IMF and the IMF set and the frequency change, that is, by using the unweighted modal correlation coefficient ratio-instantaneous frequency mean method to judge and calculate the optimal number of modes required to decompose the FDIA signal across modes; Step 5.4: Decompose each value in the reconstructed FDIA data into the corresponding optimal modal number IMF according to Step 5.

1. i This can yield N sets of decomposed FDIA data containing FDIA information.

4. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 3, characterized in that, Step 5.3 specifically refers to: Step 5.3.1: Calculate the Pearson correlation coefficient between each element in the IMF and the IMF set, and arrange them in ascending order of modality number: Where C(n) represents the correlation coefficient ratio, M represents the number of modes, x represents the initial state value, and the value k ranges from 2 to n; Step 5.3.2: Use the recombined FDIA data to solve for the frequency values ​​at the corresponding time nodes under mode i, and sum the frequency values ​​to calculate the average value, so as to obtain N sets of instantaneous frequency average values; Where K represents the total numerical value under the same mode, f ij Let j represent the instantaneous frequency of the j-th sample value in the i-th mode, where j = 1, 2, 3, ..., K. This represents the derivative with respect to the instantaneous phase angle; Step 5.3.3: Find the number of modes whose instantaneous frequency mean changes from an increasing to a decreasing trend. Use the Pearson correlation coefficient to determine whether the mode is related to the original FDIA data. The mode with the highest correlation and whose instantaneous frequency mean changes from a decreasing trend is the optimal number of modes.

5. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 4, characterized in that, The determination of the maximum correlation is specifically as follows: find the minimum value of the mean of the N instantaneous frequencies, record the mode set X = (a1, a2, ..., an) corresponding to the minimum value, and record the mode set Y = (b1, b2, ..., bn) where the Pearson correlation coefficient is close to 1. When ai = bi, the correlation is the maximum.

6. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 1, characterized in that, Step 6 specifically refers to: Step 6.1: Divide the time series features into N subsets according to modality, and use the K values ​​contained in each subset as input values ​​for the feature extraction module; Step 6.2: The feature extraction module S consists of five different scales: envelope entropy S1, modal energy deviation S2, Mahalanobis distance S3, standard deviation S4, and mean S5. The N subsets are imported into the feature extraction module to extract the target key features F of the same modality at different scales. i , i = 1, 2, 3, 4, 5; Step 6.3: Arrange the extracted envelope entropy F1 and standard deviation F4 in ascending order of magnitude, and arrange the modal energy deviation F2, Mahalanobis distance F3, and mean F5 in descending order of magnitude.

7. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 6, characterized in that, Step 6.2 specifically refers to: Step 6.2.1: Calculate the envelope entropy for each subset in the decomposed FDIA data under the same modality, and obtain the sequence of each subset as the envelope entropy S1; Where E represents the entropy value, p ij Let N denote the probability density function, N denote the discretization of the envelope function into N points, and a(ij) denote the envelope function of the j-th component that makes up the i-th mode; Step 6.2.2: Calculate the energy value of each subset of the decomposed FDIA data and the initial voltage / current phase angle and amplitude data under the same mode in mode i, and take the difference between the two as the mode energy deviation S2; Among them, |y ij | represents the absolute value of the amplitude of the j-th component of the i-th mode, A and B represent the attack system state and the original system state, respectively, and n represents the total number of signal components; Step 6.2.3: Transform each subset of the FDIA data decomposed under the same modality into a 1*k matrix, and then use the mean and variance to calculate the value of the matrix as the Mahalanobis distance S3; Where d(X) i ) represents the Mahalanobis distance, X i Let S represent the value of the i-th mode, T represent the matrix transpose, and S represent the value of the i-th mode. -1 The matrix represents the inverse of the standard deviation matrix, and μ represents the mean. Step 6.2.4: Directly calculate the standard deviation S4 and mean S5 of each subset of the FDIA data decomposed under the same modality; Step 6.2.5: Take the absolute value of the envelope entropy S1 as the target key feature F1, take the absolute value of the modal energy deviation S2 as the target key feature F2, take the absolute value of the Mahalanobis distance S3 as the target key feature F3, and take the absolute values ​​of the standard deviation S4 and the mean S5 as the target key features F4 and F5.

8. The method for detecting fake data injection attacks based on mode decomposition and extreme gradient boosting according to claim 1, characterized in that, Step 7 specifically refers to: Step 7.1: Sample the initial voltage / current phase angle and amplitude at intervals T, and recombine the sampled data into a new sample set. Decompose the sample set using Step 5, and take the first mode IMF1 time series feature set as the daily electricity consumption feature F. D ; Step 7.2: Record daily electricity usage characteristics F D and long-term electricity consumption characteristics F L As input to the XGBoost model, F is calculated using a linearly decreasing weight strategy. D and F L inertia factor ω1 (t) and ω2 (t) : ωj (t) =(ω ini -ω end )(G k -g) / G k +ω end Where, ω (t) It is the inertia factor, G k It is the maximum number of iterations, ω ini It is the initial inertia weight, ω end It is the inertia weight when iterating to the maximum number of generations, g is the number of iterations, and j = 1, 2, representing different inertia factors; When the inertia factor ω1 (t) and ω2 (t) When maintaining consistency at the error level τ, the inertia factor ω1 is at this point. (t) and ω2 (t) The mean value is used as the optimal inertia factor ω. (t) =(ω1) (t) +ω2 (t) ) / 2, and then update the optimal position of the particle through the optimal inertia factor. The optimal position is the initial value of the optimal parameters of the XGBoost model.

Images