Relay protection network attack positioning method and system based on digital twinning

Abstract

The invention provides a relay protection network attack positioning method and system based on digital twinning, relates to the technical field of relay protection network security, introduces a digital twinning model, simulates the dynamic behavior of an actual power system in real time, facilitates the analysis and understanding of the actual power system when the actual power system suffers from a network attack, and improves the security of the relay protection network. A new thought is provided for network attack detection; under the application of a digital twin model, whether the power system is subjected to the network attack or not is quickly determined based on residual calculation of a measured value of protection equipment and a measured value of twin protection equipment and first non-parameter accumulation calculation on the basis of the residual, and residual measurement is introduced to quickly distinguish network attack objects; and finally, second nonparametric accumulation calculation is carried out based on residual measurement, and specific attacked equipment subjected to network attacks is positioned, so that the effectiveness of network attack detection is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of relay protection network security, and more specifically, to a relay protection network attack locating method and system based on digital twins. Background Art

[0002] At present, the power system is developing towards intelligence. The smart grid architecture integrates new energy, new materials, new equipment, and advanced sensing technology, information technology, control technology, energy storage technology and other new technologies to improve the efficiency and reliability of power generation, transmission, and power systems. However, while advanced technologies provide huge operational advantages for the power system, they also increase the vulnerability of the power grid to cyber attacks, disrupting the normal operation of the power system, causing power restrictions, power outages, and even personal safety issues.

[0003] Power system relay protection refers to the use of some electrical automatic devices to quickly cut off the faulty part from the system or send out signals in time when an abnormality occurs in the power system, so as to reduce the scope of the fault and ensure the stable operation of the power system.

[0004] The operation of power systems, such as energy management, load and generation forecasting, network reconfiguration, remote tripping, accident and reliability analysis, etc., is highly dependent on the integrity and reliability of relay protection and measurement equipment such as relays, reclosers, smart meters, and vector measurement units (PMUs), which are extremely attractive targets for hostile forces. For example, the communication protocols used in the relay protection device network may have security vulnerabilities, such as lack of encryption and lax authentication, which allow attackers to tamper with communication data, conduct man-in-the-middle attacks, or perform denial of service attacks. In addition, when parsing the communication protocol, the relay protection device may have vulnerabilities such as buffer overflow, denial of service, and command injection, which attackers can exploit to perform malicious operations or tamper with control commands.

[0005] Although current information and communication technology-based security tools (advanced network switches, firewalls, signature-based intrusion detection, two-factor authentication, etc.) can provide basic security protection for power systems from cyber threats, smart and experienced attackers may bypass available network security devices to carry out cyber attacks, such as false data injection. False data injection (FDI) is a new method of cyber attack on power systems, which mainly interferes with the operating state of the power system by tampering with the measurement data of sensors, thereby avoiding the detection of bad data by the power grid and threatening the safety of the power system. FDI that forges control commands sent to protection relays to cause circuit breakers to trip remotely can be easily detected by existing detection strategies, but in reality, FDI that forges monitoring and control information in a way that does not trigger relay protection devices is difficult to detect or locate because attackers may inject any type of signal, even mimicking the normal operation of the system (e.g., ramp, sinusoidal, random, replay). These attacks can force operators or automation controllers to make inaccurate decisions, which can seriously affect the safe operation of the power system.

[0006] In addition, the operation of relay protection in power systems depends on protection equipment and measurement and control equipment. When the power system is injected with false information, distinguishing whether the target of the network attack is the protection equipment or the measurement and control equipment, and locating the equipment attacked by the network, facilitates the relay protection system to take necessary control actions and improves the reliability of power system operation. Therefore, how to distinguish whether the target of the network attack is the protection equipment or the measurement and control equipment, and locate the equipment attacked by the network, is a technical problem that needs to be solved urgently. Summary of the invention

[0007] In order to solve the problem that the current network attack detection method has poor detection effectiveness and cannot distinguish and locate the objects attacked by the network, the present invention proposes a relay protection network attack positioning method and system based on digital twins, which can quickly distinguish the type of attacked objects, and then accurately find the specific attacked devices, thereby improving the effectiveness of false information injection network attack detection.

[0008] In order to achieve the above technical effects, the technical solution of the present invention is as follows:

[0009] In the first aspect, the present application proposes a method for locating a relay protection network attack based on digital twins, comprising:

[0010] S1: Obtain the basic components of the actual power system, which include basic operating equipment, measurement and control equipment, and protection equipment;

[0011] S2: Based on the basic components of the actual power system, a digital twin model is constructed to simulate the dynamic behavior of the actual power system in real time. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment.

[0012] S3: Obtain the measured values ​​of the protection device in the actual power system and the measured values ​​of the twin protection device in the digital twin model, and calculate the residual between the measured values ​​of the protection device and the measured values ​​of the twin protection device;

[0013] S4: performing a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determining whether the actual power system is subject to a cyber attack according to the first non-parametric cumulative calculation value;

[0014] S5: Calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, use the difference as a residual metric, and distinguish the network attack targets according to the residual metric;

[0015] S6: Perform a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locate a specific attacked device that has been attacked by the network attack according to the second non-parametric cumulative calculation value.

[0016] Preferably, the actual power system is composed of N nodes and L lines, and the basic operation equipment includes: N E energy storage devices, converters and controllers, the system status of the actual power system is used Indicates that the system status includes: the voltage, current, active power and reactive power of each node; the active power, reactive power and charging and discharging status of each energy storage device;

[0017] The measurement and control equipment is represented by z, Protecting equipment The measured value of the protection device is represented by y. Protect your device Line relay protection equipment and energy storage relay protection equipment The measurement and control equipment and protection equipment collect the relay protection information of the actual power system and take relay protection control actions u.

[0018] Preferably, in the digital twin model, the twin basic operating equipment includes E The digital twin model includes a twin energy storage device corresponding to each energy storage device, a twin converter corresponding to the converter, and a twin controller corresponding to the controller. The digital twin model is updated only by using the measurement and control equipment information z from the actual power system, and simulates the relay protection control action of the actual power system according to the relay protection control action u taken by the actual power system.

[0019] Based on the above technical means, the digital twin model is used to reproduce the dynamic behavior of the actual power system, including running in a DRTS that can simulate the electromagnetic transient behavior of the actual power system and the detailed operation of its equipment in real time, facilitating the analysis and understanding of the actual power system when it is attacked by a cyber attack.

[0020] Preferably, in S3, the measured value of the jth protection device in the actual power system is assumed to be It consists of p features, t k represents the measurement time, and the measurement value of the j-th twin protection device in the digital twin model is The same p features can also be generated in the digital twin model. The residual between each feature of the j-th twin protection device measurement value and each feature of the j-th protection device measurement value is calculated. The calculation expression is:

[0021]

[0022] Among them, r j,l (t k ) represents the residual.

[0023] Preferably, the expression for performing the first non-parametric cumulative calculation based on the residual is:

[0024]

[0025] in, and Σ j,l They represent the nominal mean and variance of the lth feature of the jth protection device in normal operation; S j,l (t k+1 ) represents the first nonparametric cumulative value, S j,l (t0) = 0; (x) + represents max(0,x), which keeps the first non-parametric cumulative value positive, δ d,j,l Indicates adjustment parameters to avoid S j,l (t k ) Unbounded growth;

[0026] According to the value of the first non-parametric cumulative calculation, the process of determining whether the power system is attacked by a network is as follows:

[0027] Collect the normal operation data of the actual power system and select the trigger parameter α based on the normal operation data j,l ;

[0028] Compare the first nonparametric cumulative value S j,l (t k+1 ) and trigger parameter α j,l If Sj,l (t k )>α j,l , then the actual power system is attacked by the network. If S j,l (t k )≤α j,l , the actual power system has been subjected to unimportant cyber attacks or has not been subjected to cyber attacks.

[0029] According to the above technical means, the measurement value data y and y are collected from the protection devices in the actual power system and the twin protection devices in the digital twin model respectively. Then, the non-parametric cumulative sum method is used to preliminarily determine whether the actual power system is under cyber attack, and the trigger parameter α is selected. j,l Avoid false alarms.

[0030] Preferably, the expression for calculating the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value is:

[0031]

[0032] in,

[0033] φ j,l (t k ) is the residual metric RRC; c j,l (t k ) represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the actual power system protection device; It represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the twin protection device of the digital twin model; Indicates protection equipment a subset of downstream energy storage devices;

[0034] If c j,l (t k ) is greater than Then φ j,l (t k ) is positive, a network attack targeting the measured value of the protection device occurs; if The rate of change is greater than c j,l (t k ), then φ j,l (t k ) is a negative value, a network attack targeting the measurement values ​​of the measurement and control equipment occurs.

[0035] According to the above technical means, two consecutive measurement values ​​are used for calculation, which ensures that any injection of false information will affect the difference. Moreover, based on the principle that the digital twin model only uses the information z from the measurement and control equipment of the actual power system for updating, malicious attacks on the measurement and control equipment in the actual power system will affect the operation dynamics of the digital twin model, and malicious attacks on the protection equipment of the actual power system will not affect the operation dynamics of the digital twin model, thereby realizing the rapid differentiation of network attack targets.

[0036] Preferably, the process of performing the second non-parametric cumulative calculation based on the residual metric to obtain the second non-parametric cumulative calculation value satisfies:

[0037]

[0038] Among them, δ φ,j,l and are bias parameters set to avoid false alarms, and

[0039]

[0040] Collect the operating data of the actual power system under several normal transient conditions, and select the threshold parameter β according to the operating data j,l ;

[0041] Collect the operating data of the digital twin model under several normal transient conditions, and select the twin threshold parameters based on the operating data

[0042] If W j,l (t)>β j,l , then the network attack target is the protection device j; if The network attack target is the measurement and control equipment downstream of the protection device j; if W j,l (t)≤β j,l or The actual power system has been subjected to insignificant cyber attacks or has not been subjected to any cyber attacks.

[0043] According to the above technical means, since the measured values ​​of the protection devices in the actual power system are not used to update the digital twin model, the network attack that affects the measured values ​​of the protection devices has no direct impact on the dynamics of the digital twin model. If the protection device is injected with false information, the impact will be visible on the attacked protection device. j,l (t)>β j,l Based on the judgment, the protection device j that has been attacked by the network can be directly located.

[0044] Preferably, represents a binary variable, It means that when the actual power system is attacked by a network, there is at least one feature l, and the measured value Sj,l (t k )>α j,l and At this point, the set of affected protection devices is:

[0045]

[0046] like If the number of elements of is greater than 1, there are multiple measurement and control devices that have been attacked by the network.

[0047] Preferably, if there are multiple measurement and control devices that are attacked by the network, first locate the branch where the measurement and control devices that are attacked by the network are located in the actual power system. The process is: construct a directed graph Among them, line relay protection equipment is a vertex and ε is an edge, which indicates the electrical interconnection between two protection devices, that is, there is current between the two lines containing protection devices;

[0048] Then locate the specific measurement and control equipment that has been attacked by the network. The process is as follows:

[0049] Find the vertex set Subgraph of The subgraph Indicates the path of the protection device where the cyber attack was observed; It includes a single aggregation node, which corresponds to the protection device located upstream of the affected measurement and control equipment. The aggregation node checks each measurement and control device in this path to locate the measurement and control device that has been attacked by the network.

[0050] In the second aspect, the present application proposes a relay protection network attack positioning system based on digital twins, and the system is implemented based on the relay protection network attack positioning method based on digital twins, including:

[0051] A data acquisition unit, used to acquire the basic components of the actual power system, the basic components including basic operating equipment, measurement and control equipment and protection equipment;

[0052] A digital twin model construction unit is used to construct a digital twin model that simulates the dynamic behavior of the actual power system in real time according to the basic composition of the actual power system. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment.

[0053] A residual calculation unit is used to obtain the measurement value of the protection device in the actual power system and the measurement value of the twin protection device in the digital twin model, and calculate the residual between the measurement value of the protection device and the measurement value of the twin protection device;

[0054] A network attack judgment unit performs a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determines whether the actual power system is subjected to a network attack according to the first non-parametric cumulative calculation value;

[0055] A residual metric calculation unit, used to calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, and use the difference as the residual metric;

[0056] The network attack positioning unit performs a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locates a specific attacked device that is attacked by the network attack according to the second non-parametric cumulative calculation value.

[0057] Compared with the prior art, the technical solution of the present invention has the following beneficial effects:

[0058] The present invention proposes a relay protection network attack positioning method and system based on digital twins, introduces a digital twin model, simulates the dynamic behavior of the actual power system in real time, facilitates the analysis and understanding of the actual power system when it is attacked by a network, and provides a new idea for network attack detection; and under the application of the digital twin model, based on the residual calculation of the measurement value of the protection device and the measurement value of the twin protection device and the first non-parametric cumulative calculation based on the residual, it is quickly determined whether the power system is attacked by a network, and the residual measurement is introduced to quickly distinguish the network attack objects. Finally, the second non-parametric cumulative calculation is performed based on the residual measurement to locate the specific attacked device that is attacked by the network, thereby improving the effectiveness of network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 A schematic diagram showing a flow chart of a relay protection network attack location method based on digital twins proposed in an embodiment of the present invention;

[0060] Figure 2 A framework diagram of a relay protection network attack positioning architecture system based on digital twins proposed in an embodiment of the present invention is shown;

[0061] Figure 3 A residual metric RRC curve diagram is shown when a protection device is subjected to a network attack according to an embodiment of the present invention;

[0062] Figure 4 A residual metric RRC curve diagram is shown when a measurement and control device is attacked by a network according to an embodiment of the present invention;

[0063] Figure 5 It shows a structural diagram of a relay protection network attack positioning system based on digital twin proposed in an embodiment of the present invention. DETAILED DESCRIPTION

[0064] The drawings are for illustrative purposes only and should not be construed as limiting the present patent;

[0065] In order to better illustrate the present embodiment, some parts of the drawings may be omitted, enlarged or reduced, and do not represent the actual size;

[0066] It is understandable to those skilled in the art that descriptions of certain well-known contents in the drawings may be omitted.

[0067] The technical solution of the present invention is further described below in conjunction with the accompanying drawings and embodiments.

[0068] The positional relationships described in the drawings are only for illustrative purposes and should not be construed as limiting the present patent;

[0069] Example 1

[0070] This embodiment proposes a relay protection network attack location method based on digital twins. The flowchart of this method is shown in Figure 1 ,like Figure 1 As shown, the following steps are included:

[0071] S1: Obtain the basic components of the actual power system, which include basic operating equipment, measurement and control equipment, and protection equipment;

[0072] S2: Based on the basic components of the actual power system, a digital twin model is constructed to simulate the dynamic behavior of the actual power system in real time. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment.

[0073] S3: Obtain the measured values ​​of the protection device in the actual power system and the measured values ​​of the twin protection device in the digital twin model, and calculate the residual between the measured values ​​of the protection device and the measured values ​​of the twin protection device;

[0074] S4: performing a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determining whether the actual power system is subject to a cyber attack according to the first non-parametric cumulative calculation value;

[0075] S5: Calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, use the difference as a residual metric, and distinguish the network attack targets according to the residual metric;

[0076] S6: Perform a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locate a specific attacked device that has been attacked by the network attack according to the second non-parametric cumulative calculation value.

[0077] This embodiment introduces a digital twin model to simulate the dynamic behavior of the actual power system in real time, which facilitates the analysis and understanding of the actual power system when it is attacked by a network, and provides a new idea for network attack detection. Moreover, under the application of the digital twin model, it is based on the residual calculation of the measured value of the protection device and the measured value of the twin protection device and the first non-parametric cumulative calculation based on the residual to quickly determine whether the power system is attacked by a network. The residual metric is introduced to quickly distinguish the target of the network attack, and finally the second non-parametric cumulative calculation is performed based on the residual metric to locate the specific attacked device that is attacked by the network, thereby improving the effectiveness of network attack detection.

[0078] Example 2

[0079] This embodiment is described by taking an actual power system consisting of N nodes and L lines as an example, wherein the basic operation equipment includes: E Energy storage devices, converters and controllers, intelligent switches and other intelligent electronic equipment IEDs, the system status of the actual power system is used Indicates that the system status includes: the voltage, current, active power and reactive power of each node; the active power, reactive power and charging and discharging status of each energy storage device;

[0080] The measurement and control equipment is represented by z, Such as electronic transformers, protection equipment The measured value of the protection device is represented by y. Protect your device Line relay protection equipment and energy storage relay protection equipment The measurement and control equipment and protection equipment collect the relay protection information of the actual power system and take relay protection control actions u.

[0081] See also Figure 2 From the perspective of the actual power system, taking the architecture as an example, the process layer includes measurement and control equipment such as electronic transformers and operating equipment such as intelligent switches. The interval layer includes measurement and control equipment such as PCS measurement and control, protection equipment PCS protection and operating equipment such as other intelligent electronic devices IED. The station control layer includes GPS, several workstations and telecontrol stations.

[0082] The FDI considered in this embodiment include relay protection setting attack, device action instruction sending and receiving attack and measurement attack of measurement and control equipment, which are different from FDI that can be easily detected by existing detection strategies, such as forging control commands sent to protection relays to cause remote tripping of circuit breakers. This embodiment forges monitoring and control information in a way that does not trigger protection devices. These types of attacks are difficult to detect or locate because attackers may inject any type of signal and even imitate the normal operation of the system (e.g., ramp, sine, random, replay). These attacks can seriously affect the power grid by forcing operators or automation controllers to make inaccurate decisions. For example, attackers can manipulate the measurement data of protection devices to cause the automation controller to take unnecessary load reduction, use emergency backup power, or cause the energy storage system to overcharge and over-discharge. Assuming that the attacker has sufficient knowledge of the system architecture, it can bypass network security measures and access the communication traffic between SCADA and the central controller (such as DNP3, Modbus). The attacker can destroy the measurement subset and control commands of the protection device or measurement and control device and perform FDI attacks.

[0083] In this embodiment, the digital twin model is used to reproduce the dynamic behavior of the actual power system, including running in a DRTS that can simulate the electromagnetic transient behavior of the actual power system and the detailed operation of its equipment in real time, so as to facilitate the analysis and understanding of the actual power system when it is attacked by a network. Specifically, in the digital twin model, the twin basic operating equipment in the digital twin model includes E The energy storage device corresponds to a twin energy storage device, the converter corresponds to a twin converter, and the controller corresponds to a twin controller, such as Figure 2 As shown in FIG. 1 , the digital twin model is updated only by using the measurement and control equipment information z from the actual power system, and the relay protection control action u taken by the actual power system is used to simulate the relay protection control action of the actual power system. Overall, the network attack location strategy proposed in this embodiment collects measurement values ​​y and To determine if an attacker has manipulated measurement and control equipment or protection equipment, and then indicate the location of the affected equipment or area.

[0084] This embodiment obtains the measured value of the protection device in the actual power system and the measured value of the twin protection device in the digital twin model, and calculates the residual between the measured value of the protection device and the measured value of the twin protection device:

[0085] Assume that the measured value of the jth protection device in the actual power system is It consists of p features (i.e. active power and reactive power), t k represents the measurement time, and the measurement value of the j-th twin protection device in the digital twin model is The same p features can also be generated in the digital twin model. The residual between each feature of the j-th twin protection device measurement value and each feature of the j-th protection device measurement value is calculated. The calculation expression is:

[0086]

[0087] Among them, r j,l (t k ) represents the residual.

[0088] The expression for the first nonparametric cumulative calculation based on the residual is:

[0089]

[0090] in, and Σ j,l They represent the nominal mean and variance of the lth feature of the jth protection device in normal operation; S j,l (t k+1 ) represents the first nonparametric cumulative value, S j,l (t0) = 0; (x) + represents max(0,x), which keeps the first non-parametric cumulative value positive, δ d,j,l Indicates adjustment parameters to avoid S j,l (t k ) Unbounded growth;

[0091] According to the value of the first non-parametric cumulative calculation, the process of determining whether the power system is attacked by a network is as follows:

[0092] Collect the normal operation data of the actual power system and select the trigger parameter α based on the normal operation data j,l ;

[0093] Compare the first nonparametric cumulative value S j,l (t k+1 ) and trigger parameter α j,l If S j,l (t k )>α j,l , then the actual power system is attacked by the network. If S j,l (t k )≤α j,l , the actual power system has been subjected to unimportant cyber attacks or has not been subjected to cyber attacks.

[0094] In this embodiment, the normal operation data of the actual power system collected is the system status data of the actual power system under normal operation, such as the charging and discharging status of the energy storage device and the load distribution of the actual power system. Based on these data and combined with the actual operation conditions, the trigger parameter α is comprehensively determined. j,l, trigger parameter α j,l To avoid false alarms, a non-parametric cumulative sum method is used to preliminarily determine whether the actual power system is under cyber attack. That is, when the power system is under cyber attack, data is collected and S is calculated. j,l (t k ) and α j,l If S j,l (t k )>α j,l , then the protection device j and feature l trigger an alarm; otherwise it is considered as an unimportant attack or no attack.

[0095] In this embodiment, the introduced residual metric RRC is calculated using two consecutive measurement values ​​to ensure that any false information injection will affect the difference, thereby achieving rapid differentiation of network attack targets. Specifically, the expression for calculating the difference between the rate of change of the actual power system protection device measurement value and the rate of change of its corresponding twin protection device measurement value is:

[0096]

[0097] in,

[0098] φ j,l (t k ) is the residual metric RRC; c j,l (t k ) represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the actual power system protection device; It represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the twin protection device of the digital twin model; Indicates protection equipment a subset of downstream energy storage devices;

[0099] If c j,l (t k ) is greater than Then φ j,l (t k ) is positive, a network attack targeting the measured value of the protection device occurs; if The rate of change is greater than c j,l (t k ), then φ j,l (t k ) is a negative value, a network attack targeting the measurement values ​​of the measurement and control equipment occurs.

[0100] Specifically, Figure 3 As shown, an attack targeting the measured value of the protection device will result in c j,l (t k) changes faster than So that φ j,l (t k ) is positive. On the other hand, attacks targeting the measurement values ​​of measurement and control equipment will affect the operation dynamics of the digital twin model, making The change rate is faster than c j,l (t k ), so that φ j,l (t k ) is negative, if attached Figure 4 shown.

[0101] This embodiment is based on the principle that the digital twin model is updated only using the measurement and control equipment information z from the actual power system. Malicious attacks on the measurement and control equipment in the actual power system will affect the operating dynamics of the digital twin model, while malicious attacks on the protection equipment of the actual power system will not affect the operating dynamics of the digital twin model, thereby achieving rapid differentiation of network attack targets.

[0102] In this embodiment, the second non-parametric cumulative calculation is performed based on the residual metric, and the process of obtaining the second non-parametric cumulative calculation value satisfies:

[0103]

[0104] Among them, δ φ,j,l and are bias parameters set to avoid false alarms, and

[0105]

[0106] Collect the operating data of the actual power system under several normal transient conditions, and select the threshold parameter β according to the operating data j,l The normal transient conditions of the actual power system collected are the system status data of the actual power system under normal transient conditions, such as the charging and discharging status of the energy storage equipment and the dynamic changes of the load of the actual power system. Based on these data and combined with the actual operation conditions, the threshold parameter β is selected. j,l .

[0107] Collect the operating data of the digital twin model under several normal transient conditions, and select the twin threshold parameters based on the operating data In this embodiment,

[0108] If W j,l (t)>β j,l , then the network attack target is the protection device j; if The network attack target is the measurement and control equipment downstream of the protection device j; if W j,l (t)≤β j,l or The actual power system has been subjected to insignificant cyber attacks or has not been subjected to any cyber attacks.

[0109] Since the measured values ​​of the protection devices in the actual power system are not used to update the digital twin model, the cyber attack that affects the measured values ​​of the protection devices has no direct impact on the dynamics of the digital twin model. If the protection device is injected with false information, the impact will be visible on the attacked protection device. j,l (t)>β j,l Based on the judgment, the protection device j that has been attacked by the network can be directly located.

[0110] As for the measurement and control equipment, the measurement values ​​of the measurement and control equipment are used as the input of the digital twin model. Therefore, the attack on the measurement values ​​of the measurement and control equipment will change the operation of the digital twin model, resulting in the detection index S measured by multiple protection devices at the same time. j,l (t k )and Increase, increasing the difficulty of locating the attacked device.

[0111] In order to locate the attacked measurement and control device, this embodiment proposes the following method:

[0112] set up represents a binary variable, It means that when the actual power system is attacked by a network, there is at least one feature l, and the measured value S j,l (t k )>α j,l and At this point, the set of affected protection devices is:

[0113]

[0114] like If the number of elements of is greater than 1, there are multiple measurement and control devices that have been attacked by the network.

[0115] If there are multiple measurement and control devices that are attacked by the network, first locate the branch where the measurement and control devices that are attacked by the network are located in the actual power system. The process is: construct a directed graph Among them, line relay protection equipment is a vertex and ε is an edge, which indicates the electrical interconnection between two protection devices, that is, there is current between the two lines containing protection devices;

[0116] Then locate the specific measurement and control equipment that has been attacked by the network. The process is as follows:

[0117] Find the vertex set Subgraph of The subgraph Indicates the path of the protection device where the cyber attack was observed; It includes a single aggregation node, which corresponds to the protection device located upstream of the affected measurement and control equipment. The aggregation node checks each measurement and control device in this path to locate the measurement and control device that has been attacked by the network.

[0118] Example 3

[0119] like Figure 5 As shown, this embodiment proposes a relay protection network attack positioning system based on digital twins, and the system is implemented based on the relay protection network attack positioning method based on digital twins proposed in Embodiments 1 and 2, including:

[0120] A data acquisition unit, used to acquire the basic components of the actual power system, the basic components including basic operating equipment, measurement and control equipment and protection equipment;

[0121] A digital twin model construction unit is used to construct a digital twin model that simulates the dynamic behavior of the actual power system in real time according to the basic composition of the actual power system. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment.

[0122] A residual calculation unit is used to obtain the measurement value of the protection device in the actual power system and the measurement value of the twin protection device in the digital twin model, and calculate the residual between the measurement value of the protection device and the measurement value of the twin protection device;

[0123] A network attack judgment unit performs a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determines whether the actual power system is subjected to a network attack according to the first non-parametric cumulative calculation value;

[0124] A residual metric calculation unit, used to calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, and use the difference as the residual metric;

[0125] The network attack positioning unit performs a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locates a specific attacked device that is attacked by the network attack according to the second non-parametric cumulative calculation value.

[0126] Obviously, the above embodiments of the present invention are only examples for clearly illustrating the present invention, and are not intended to limit the embodiments of the present invention. For those skilled in the art, other different forms of changes or modifications can be made based on the above description. It is not necessary and impossible to list all the embodiments here. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the claims of the present invention.

Claims

1. A relay protection network attack location method based on digital twin, characterized in that: include: S1: Obtain the basic components of the actual power system, which include basic operating equipment, measurement and control equipment, and protection equipment; S2: Based on the basic components of the actual power system, a digital twin model is constructed to simulate the dynamic behavior of the actual power system in real time. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment. S3: Obtain the measured values ​​of the protection device in the actual power system and the measured values ​​of the twin protection device in the digital twin model, and calculate the residual between the measured values ​​of the protection device and the measured values ​​of the twin protection device; S4: performing a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determining whether the actual power system is subject to a cyber attack according to the first non-parametric cumulative calculation value; S5: Calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, use the difference as a residual metric, and distinguish the network attack targets according to the residual metric; S6: Perform a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locate a specific attacked device that has been attacked by the network attack according to the second non-parametric cumulative calculation value.

2. The method for locating relay protection network attacks based on digital twins according to claim 1 is characterized in that: The actual power system is composed of N nodes and L lines. The basic operating equipment includes: E energy storage devices, converters and controllers, the system status of the actual power system is used Indicates that the system status includes: the voltage, current, active power and reactive power of each node; the active power, reactive power and charging and discharging status of each energy storage device; The measurement and control equipment is represented by z, Protecting equipment The measured value of the protection device is represented by y. Protect your device Line relay protection equipment and energy storage relay protection equipment The measurement and control equipment and protection equipment collect the relay protection information of the actual power system and take relay protection control actions u.

3. The method for locating relay protection network attacks based on digital twins according to claim 2 is characterized in that: In the digital twin model, the twin basic operating equipment includes E The digital twin model includes a twin energy storage device corresponding to each energy storage device, a twin converter corresponding to the converter, and a twin controller corresponding to the controller. The digital twin model is updated only by using the measurement and control equipment information z from the actual power system, and simulates the relay protection control action of the actual power system according to the relay protection control action u taken by the actual power system.

4. The method for locating relay protection network attacks based on digital twins according to claim 3 is characterized in that: In S3, let the measured value of the jth protection device in the actual power system be It consists of p features, t k represents the measurement time, and the measurement value of the j-th twin protection device in the digital twin model is The same p features can also be generated in the digital twin model. The residual between each feature of the j-th twin protection device measurement value and each feature of the j-th protection device measurement value is calculated. The calculation expression is: Among them, r j,l (t k ) represents the residual.

5. The method for locating relay protection network attacks based on digital twins according to claim 4 is characterized in that: The expression for the first nonparametric cumulative calculation based on the residual is: in, and Σ j,l They represent the nominal mean and variance of the lth feature of the jth protection device in normal operation; S j,l (t k+1 ) represents the first nonparametric cumulative value, S j,l (t0) = 0; (x) + represents max(0,x), which keeps the first non-parametric cumulative value positive, δ d,j,l Indicates adjustment parameters to avoid S j,l (t k ) Unbounded growth; According to the value of the first non-parametric cumulative calculation, the process of determining whether the power system is attacked by a network is as follows: Collect the normal operation data of the actual power system and select the trigger parameter α based on the normal operation data j,l ; Compare the first nonparametric cumulative value S j,l (t k+1 ) and trigger parameter α j,l If S j,l (t k )>α j,l , then the actual power system is attacked by the network. If S j,l (t k )≤α j,l , the actual power system has been subjected to unimportant cyber attacks or has not been subjected to cyber attacks.

6. The method for locating relay protection network attacks based on digital twins according to claim 5 is characterized in that: The expression for calculating the difference between the rate of change of the actual power system protection device measurement value and the rate of change of its corresponding twin protection device measurement value is: in, φ j,l (t k ) is the residual metric RRC; c j,l (t k ) represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the actual power system protection device; It represents the measured value after removing the influence of the change of the energy storage device downstream of the j-th protection device on the measured value of the twin protection device of the digital twin model; Indicates protection equipment a subset of downstream energy storage devices; If c j,l (t k ) is greater than Then φ j,l (t k ) is positive, a network attack targeting the measured value of the protection device occurs; if The rate of change is greater than c j,l (t k ), then φ j,l (t k ) is a negative value, a network attack targeting the measurement values ​​of the measurement and control equipment occurs.

7. The method for locating relay protection network attacks based on digital twins according to claim 6 is characterized in that: The process of performing the second nonparametric cumulative calculation based on the residual metric to obtain the second nonparametric cumulative calculation value satisfies: Among them, δ φ,j,l and are bias parameters set to avoid false alarms, and W j,l (t0)=0, Collect the operating data of the actual power system under several normal transient conditions, and select the threshold parameter β according to the operating data j,l ; Collect the operating data of the digital twin model under several normal transient conditions, and select the twin threshold parameters based on the operating data If W j,l (t)>β j,l , then the network attack target is the protection device j; if The network attack target is the measurement and control equipment downstream of the protection device j; if W j,l (t)≤β j,l or The actual power system has been subjected to unimportant cyber attacks or has not been subjected to cyber attacks.

8. The method for locating relay protection network attacks based on digital twins according to claim 7 is characterized in that: set up represents a binary variable, It means that when the actual power system is attacked by a network, there is at least one feature l, and the measured value S j,l (t k )>α j,l and At this point, the set of affected protection devices is: like If the number of elements of is greater than 1, there are multiple measurement and control devices that have been attacked by the network.

9. The method for locating relay protection network attacks based on digital twins according to claim 8 is characterized in that: If there are multiple measurement and control devices that are attacked by the network, first locate the branch where the measurement and control devices that are attacked by the network are located in the actual power system. The process is: construct a directed graph Among them, line relay protection equipment is a vertex and ε is an edge, which indicates the electrical interconnection between two protection devices, that is, there is current between the two lines containing protection devices; Then locate the specific measurement and control equipment that has been attacked by the network. The process is as follows: Find the vertex set Subgraph of The subgraph Indicates the path of the protection device where the cyber attack was observed; It includes a single aggregation node, which corresponds to the protection device located upstream of the affected measurement and control equipment. The aggregation node checks each measurement and control device in this path to locate the measurement and control device that has been attacked by the network.

10. A relay protection network attack positioning system based on digital twins, characterized in that: The system is implemented based on the digital twin-based relay protection network attack positioning method according to claim 1, and includes: A data acquisition unit, used to acquire the basic components of the actual power system, the basic components including basic operating equipment, measurement and control equipment and protection equipment; A digital twin model construction unit is used to construct a digital twin model that simulates the dynamic behavior of the actual power system in real time according to the basic composition of the actual power system. The digital twin model includes twin basic operating equipment, twin measurement and control equipment, and twin protection equipment. A residual calculation unit is used to obtain the measurement value of the protection device in the actual power system and the measurement value of the twin protection device in the digital twin model, and calculate the residual between the measurement value of the protection device and the measurement value of the twin protection device; A network attack judgment unit performs a first non-parametric cumulative calculation based on the residual to obtain a first non-parametric cumulative calculation value, and determines whether the actual power system is subjected to a network attack according to the first non-parametric cumulative calculation value; A residual metric calculation unit, used to calculate the difference between the rate of change of the actual power system protection device measurement value and the rate of change of the corresponding twin protection device measurement value, and use the difference as the residual metric; The network attack positioning unit performs a second non-parametric cumulative calculation based on the residual metric to obtain a second non-parametric cumulative calculation value, and locates a specific attacked device that is attacked by the network attack according to the second non-parametric cumulative calculation value.

Images