Power market network attack identification method, system and device based on gating circulation unit, and storage medium

Abstract

The invention discloses an electric power market network attack identification method, system and device based on a gating circulation unit and a storage medium, and relates to the field of electric power systems and market operation thereof, and the method comprises the steps: obtaining data from an electric power spot market, and carrying out the preprocessing; important characteristic variables are screened out; dividing the data into a training set, a verification set and a test set according to a time sequence; constructing a plurality of GRU models based on different time periods, and fusing prediction results of the models; evaluating the precision and stability of the model through a test set, and deploying the fusion model to an actual system for real-time attack recognition; according to the invention, the complex rule of power market data can be captured more comprehensively, and the accuracy of network attack identification and the system stability are improved; the deviation of a single model is avoided, the risks of over-fitting and under-fitting are reduced, and the reliability of the model under different market conditions is ensured; the data quality is improved, and the adaptability and flexibility of the prediction system are enhanced.

Description

Technical Field

[0001] The present invention relates to the field of power systems and market operations thereof, and in particular to a method, system, device and storage medium for identifying network attacks in a power market based on a gated cycle unit. Background Art

[0002] With the gradual opening of the national electricity spot market and the continuous improvement of the electricity trading mechanism, the electricity spot market, as an important part of electricity trading, has a significant impact on the decision-making of market participants due to its price volatility and uncertainty. With the diversification of modern communication methods and data collection, a large amount of electricity market data requires a large number of network devices to collect and transmit, which leaves more opportunities for cyber attacks. Cyber ​​attacks can cause abnormal power market data and affect market transactions and scheduling. However, power spot market data is affected by many factors, including supply and demand, fuel prices, weather conditions, policies and regulations, etc. These factors make the identification of power market cyber attacks extremely complex and challenging.

[0003] Traditional methods for identifying cyber attacks on electricity prices in the power spot market are mainly based on time series analysis and statistical methods, such as the autoregressive integrated moving average model (ARIMA) and the generalized autoregressive conditional heteroskedasticity model (GARCH). Although these methods have achieved certain results in capturing the changing trends of power market data, their recognition accuracy and stability are still insufficient when facing complex and changing market environments and large-scale data. In recent years, artificial intelligence technology, especially deep learning technology, has shown significant advantages in processing complex data and nonlinear problems. As an improved recurrent neural network (RNN) model, the gated recurrent unit (GRU) has attracted widespread attention for its superior performance in processing long-term series data. By introducing a gating mechanism, GRU effectively alleviates the gradient vanishing and gradient exploding problems that occur in traditional RNNs when processing long-term dependencies, making its application in time series prediction more extensive. However, a single GRU model still has some shortcomings in dealing with cyber attacks in the power spot market, such as limited processing capabilities for multi-period and multi-scale price data. Traditional statistical methods are not accurate enough for identifying cyber attacks, and a single GRU model has limited capabilities for processing multi-period and multi-scale data. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problem solved by the present invention is: how to improve the accuracy and stability of identifying network attacks in the power market by using a multi-model fusion method based on a gated recurrent unit.

[0006] In order to solve the above technical problems, the present invention provides the following technical solutions: In a first aspect, an embodiment of the present invention provides a method for identifying network attacks in a power market based on a gated cyclic unit, comprising: Acquire historical data and relevant influencing factor data from the electricity spot market, and preprocess the acquired data, wherein the preprocessing includes cleaning and normalization processing; Use correlation analysis and feature importance assessment methods to select and extract features from preprocessed data, and screen out feature variables that have a significant impact on changes in power market data; Divide the preprocessed data into training set, validation set and test set in chronological order; Based on the preprocessed data, multiple GRU models are constructed respectively; Use the training set data to train each GRU model, adjust the model parameters through the optimization algorithm to minimize the recognition error; use the validation set to evaluate the performance of each model; The prediction results of the GRU models in different time periods are integrated to obtain a fusion model, and a comprehensive electricity price prediction result is obtained based on the fusion model; Use the test set to test the fusion model and evaluate the accuracy and stability of the model; The fusion model is deployed in the power spot market cyber attack identification system to obtain market data in real time for cyber attack identification.

[0007] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The method of using correlation analysis and feature importance evaluation to select and extract features from the preprocessed data includes: Set the correlation coefficient threshold, use the correlation analysis method to calculate the correlation coefficient of each feature variable, and select the feature variables with correlation coefficients higher than the correlation coefficient threshold; use the feature importance evaluation method to perform feature selection and select the 10 most important feature variables.

[0008] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The dividing of the preprocessed data into a training set, a validation set, and a test set in chronological order comprises: The preprocessed data are divided into training set, validation set and test set in chronological order; the specific proportions are: the training set accounts for 70% of the total data, the validation set accounts for 15%, and the test set accounts for 15%. Each data set contains complete fluctuation information.

[0009] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The method of constructing multiple GRU models based on the preprocessed data includes: Based on the electricity market data of different time periods, multiple GRU models are constructed respectively; the models judge short-term fluctuations, medium-term trends and long-term changes respectively; Specifically, it is divided into short-cycle GRU model: the input is the data of the previous 24 hours and the selected feature variables, and the output is the data prediction range of the next hour; The medium-term GRU model takes the data of the previous four weeks and the selected feature variables as input, and outputs the predicted range of the data for the next week; Long-period GRU model: The input is the electricity price of the previous 6 months and the selected feature variables, and the output is the data prediction range for the next month.

[0010] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The GRU model prediction results of different time periods are fused to obtain a fusion model, and a comprehensive electricity price prediction result is obtained based on the fusion model, including: The weight of each model is determined based on its performance on the validation set. The weights of the short-term, medium-term, and long-term models are set to 0.5, 0.3, and 0.2, respectively. The prediction results of each model are fused by weighted averaging. The fused prediction results are compared with the actual data to obtain the prediction error, and whether a cyber attack has occurred is determined based on the prediction error. The error correction model is constructed using historical error data to adjust the weight coefficients of different models.

[0011] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The use of the test set to test the fusion model and evaluate the accuracy and stability of the model includes: Calculate the mean square error (MSE) and mean absolute error (MAE) between the actual data and the predicted data, and evaluate the prediction accuracy and stability of the model based on the MAE and MSE values ​​and the training curve; adjust different parameters of the model: the number of GRU layers, activation function, and learning rate parameters, compare the MSE and MAE under different schemes, select the scheme with the smallest value, and verify the practicality and reliability of the model.

[0012] As a preferred solution of the power market network attack identification method based on gated cyclic units, the following is proposed: The deployment of the fusion model into the power spot market network attack identification system and the acquisition of market data in real time for network attack identification include: Whether a cyber attack has occurred is determined based on actual data combined with model prediction data. If the deviation exceeds a preset threshold and the fusion model gives a reference sign of a cyber attack, it is considered that a cyber attack has occurred.

[0013] In a second aspect, an embodiment of the present invention provides a power market network attack identification system based on a gated cyclic unit, comprising: A data collection and preprocessing module, used to obtain historical data and relevant influencing factor data from the power spot market, and preprocess the obtained data, wherein the preprocessing includes cleaning and normalization processing; The feature selection and extraction module is used to select and extract features from the preprocessed data using correlation analysis and feature importance assessment methods, and to screen out feature variables that have a significant impact on changes in power market data; A data partitioning module is used to partition the preprocessed data into a training set, a validation set, and a test set in chronological order; Multi-cycle GRU model building module, used to build multiple GRU models based on preprocessed data; The model training and verification module is used to train each GRU model using the training set data, adjust the model parameters through the optimization algorithm, and minimize the recognition error; the verification set is used to evaluate the performance of each model; The multi-model fusion module is used to fuse the prediction results of the GRU models of different time periods to obtain a fusion model, and obtain a comprehensive electricity price prediction result based on the fusion model; Model testing and evaluation module, used to test the fusion model using the test set and evaluate the accuracy and stability of the model; The model deployment and application module is used to deploy the fusion model to the power spot market network attack identification system and obtain market data in real time for network attack identification.

[0014] In a third aspect, an embodiment of the present invention provides a computing device, including: Memory and processor; The memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions. When the one or more programs are executed by the one or more processors, the one or more processors implement the power market network attack identification method based on the gated cycle unit as described in any embodiment of the present invention.

[0015] In a fourth aspect, an embodiment of the present invention provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the method for identifying network attacks in a power market based on a gated cycle unit.

[0016] Beneficial effects of the present invention: The present invention adopts a multi-model variable-cycle method based on GRU, and identifies and judges electricity spot market data of different time scales by constructing short-cycle, medium-cycle and long-cycle GRU models. The multi-model system can more comprehensively capture the complex laws of changes in electricity market data and better reflect the real fluctuations of the market than a single model. Through multi-model fusion technology, the judgment results of models with different time periods are weighted and averaged and error correction is performed, which further improves the accuracy of network attack judgments, reduces errors, and enhances the sensitivity and responsiveness to changes in electricity market data; in the process of multi-model fusion, the present invention combines the advantages of each model through reasonable weight allocation and error correction mechanism, and reduces the recognition bias that may be caused by a single model. In particular, in the process of cross-validation of multiple randomly split data sets, the stability of model training and evaluation is ensured. Through this method, the present invention effectively avoids the problems of overfitting and underfitting, improves the adaptability and stability of the model under different market conditions, and ensures the reliability of the results in practical applications; in the data collection and preprocessing stage, the present invention combines the comprehensive consideration of time characteristics and external variables (such as weather data), especially when processing missing data, it adopts a more intelligent and meticulous method, so that the reconstructed data is closer to the actual situation, thereby improving the accuracy and integrity of data processing. This data processing method not only improves the quality of the model's input data, but also enhances the flexibility and adaptability of the entire forecasting system. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0018] Figure 1 It is an overall flow chart of the method for identifying network attacks in the power market based on gated cyclic units according to the present invention; Figure 2 It is an overall structural diagram of the power market network attack identification system based on gated cyclic units described in the present invention. DETAILED DESCRIPTION

[0019] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0020] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0021] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0022] Example 1

[0023] Reference Figure 1-Figure 2 , which is the first embodiment of the present invention, and provides a method for identifying network attacks in a power market based on a gated cyclic unit, comprising: S1: Obtain historical data and relevant influencing factor data from the power spot market, and preprocess the acquired data, wherein the preprocessing includes cleaning and normalization processing; Specifically, historical electricity price data and related influencing factors from 2019 to 2024 are obtained from the electricity spot market database, including electricity supply and demand data, fuel price data, weather data (temperature, humidity, rainfall, etc.), policy and regulatory information, etc. The data is cleaned to remove data with many outliers and missing values. The processed data is normalized to convert all data to the range of 0 to 1 to eliminate the impact of different data dimensions.

[0024] S2: Use correlation analysis and feature importance evaluation methods to select and extract features from the preprocessed data, and screen out feature variables that have a significant impact on changes in power market data; In the embodiment of the present application, a correlation coefficient threshold is set, and the correlation coefficient of each feature variable is calculated using a correlation analysis method, and feature variables with correlation coefficients higher than the correlation coefficient threshold are selected; a feature importance evaluation method is used for feature selection, and the 10 most important feature variables are selected.

[0025] Specifically, the correlation analysis method is used to calculate the correlation coefficient of each feature variable. Feature variables with higher correlation coefficients, such as electricity demand, fuel price, temperature, etc., are selected as input features of the model. In order to further reduce the complexity of the model, feature importance evaluation methods (such as random forest algorithm) are used for feature selection, and finally the 10 most important feature variables are selected.

[0026] S3: Divide the preprocessed data into training set, validation set and test set in chronological order; In an embodiment of the present application, the preprocessed data is divided into a training set, a validation set, and a test set in chronological order; the specific proportions are: the training set accounts for 70% of the total data, the validation set accounts for 15%, and the test set accounts for 15%, and each data set contains complete fluctuation information.

[0027] S4: Based on the preprocessed data, multiple GRU models are constructed respectively; In the embodiment of the present application, multiple GRU models are constructed based on the power market data of different time periods; the models judge short-term fluctuations, medium-term trends and long-term changes respectively; Specifically, it is divided into short-cycle GRU model: the input is the data of the previous 24 hours and the selected feature variables, and the output is the data prediction range of the next hour; The medium-term GRU model takes the data of the previous four weeks and the selected feature variables as input, and outputs the predicted range of the data for the next week; Long-period GRU model: The input is the electricity price of the previous 6 months and the selected feature variables, and the output is the data prediction range for the next month.

[0028] S5: Use the training set data to train each GRU model, adjust the model parameters through the optimization algorithm to minimize the recognition error; use the validation set to evaluate the performance of each model; Specifically, the training set data is used to train each GRU model, and the Adam optimization algorithm is used to adjust the model parameters to minimize the prediction error. The performance of each model is evaluated through the validation set data to avoid overfitting and underfitting. During the training process, the early stopping method is used to monitor the error changes of the validation set to prevent overtraining.

[0029] S6: Fusing the prediction results of the GRU models of different time periods to obtain a fusion model, and obtaining a comprehensive electricity price prediction result based on the fusion model; In the embodiment of the present application, the weight of each model is determined according to the performance of each model on the validation set; the weights of the short-term, medium-term and long-term models are set to 0.5, 0.3 and 0.2 respectively, and the prediction results of each model are fused by the weighted average method; the fused prediction results are compared with the actual data to obtain the prediction error, and whether a network attack has occurred is determined based on the prediction error; the error correction model is constructed using historical error data, and the weight coefficients of different models are adjusted.

[0030] S7: Use the test set to test the fusion model and evaluate the accuracy and stability of the model; In the embodiment of the present application, the mean square error MSE and mean absolute error MAE of the actual data and the predicted data are calculated, and the prediction accuracy and stability of the model are evaluated according to the values ​​of MAE and MSE and the training curve; different parameters of the model are adjusted: the number of GRU layers, activation function, and learning rate parameters, and the MSE and MAE under different schemes are compared, and the scheme with the smallest value is selected to verify the practicality and reliability of the model; S8: Deploy the fusion model to the power spot market cyber attack identification system to obtain market data in real time for cyber attack identification.

[0031] In an embodiment of the present application, whether a network attack has occurred is determined based on actual data combined with model prediction data. If the deviation exceeds a preset threshold and the fusion model gives a reference sign that a network attack has occurred, it is considered that a network attack has occurred.

[0032] The above is a schematic scheme of the method for identifying network attacks on the power market based on the gated cycle unit of this embodiment. It should be noted that the technical scheme of the power market network attack identification system based on the gated cycle unit and the technical scheme of the method for identifying network attacks on the power market based on the gated cycle unit belong to the same concept. For the details not described in detail in the technical scheme of the power market network attack identification system based on the gated cycle unit in this embodiment, please refer to the description of the technical scheme of the method for identifying network attacks on the power market based on the gated cycle unit.

[0033] like Figure 2 As shown, the power market network attack identification system based on the gated cyclic unit in this embodiment includes: The data collection and preprocessing module 100 is used to obtain historical data and related influencing factor data from the power spot market, and preprocess the obtained data, wherein the preprocessing includes cleaning and normalization processing; The feature selection and extraction module 200 is used to select and extract features from the preprocessed data using correlation analysis and feature importance evaluation methods, and screen out feature variables that have a significant impact on changes in power market data; A data partitioning module 300 is used to partition the preprocessed data into a training set, a validation set and a test set in chronological order; A multi-cycle GRU model construction module 400 is used to construct multiple GRU models based on the preprocessed data; The model training and verification module 500 is used to train each GRU model using the training set data, adjust the model parameters through the optimization algorithm, and minimize the recognition error; and use the verification set to evaluate the performance of each model; The multi-model fusion module 600 is used to fuse the prediction results of the GRU models of different time periods to obtain a fusion model, and obtain a comprehensive electricity price prediction result based on the fusion model; The model testing and evaluation module 700 is used to test the fusion model using the test set and evaluate the accuracy and stability of the model; The model deployment and application module 800 is used to deploy the fusion model to the power spot market network attack identification system and obtain market data in real time for network attack identification.

[0034] This embodiment further provides a computing device, which is applicable to the case of the power market network attack identification method based on the gated cyclic unit, including: A memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the power market network attack identification method based on the gated cycle unit as proposed in the above embodiment.

[0035] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the method for identifying network attacks in a power market based on a gated cycle unit as proposed in the above embodiment is implemented.

[0036] The storage medium proposed in this embodiment and the power market network attack identification method based on gated cycle unit proposed in the above embodiment belong to the same inventive concept. The technical details not described in detail in this embodiment can be referred to the above embodiment, and this embodiment has the same beneficial effects as the above embodiment.

[0037] Example 2

[0038] Referring to Table 1-Table 2, an embodiment of the present invention provides a method for identifying network attacks in a power market based on a gated cyclic unit. In order to verify the beneficial effects of the present invention, a scientific demonstration is carried out through simulation experiments.

[0039] The simulation study uses the power market data of a province from 2019 to 2023, including power load data, electricity price data, fuel price data, weather data, and policy and regulatory information. Some data are modified to simulate cyber attacks.

[0040] Step 1: Normalize the data using Minmax to convert all data to the range of 0 to 1.

[0041] Step 2: Use the Pearson correlation analysis method to calculate the correlation coefficient of each feature variable. Use the random forest algorithm for feature selection, and finally select the 10 most important feature variables: power load, electricity price, fuel price, coal freight, holiday information, temperature, renewable energy power generation, unified load, precipitation and maintenance information. The above variables are used as the input features of the model.

[0042] Step 3: Divide the processed data into training set, validation set and test set in chronological order. The specific proportion is: the training set accounts for 70% of the total data, the validation set accounts for 15%, and the test set accounts for 15%.

[0043] Step 4: Based on the electricity market data of different time periods (hours, days, weeks, and months), multiple GRU models are constructed. These models judge short-term fluctuations (hours, days), medium-term trends (weeks), and long-term changes (months). Specific: Step 4.1: Short-term GRU model, input is the data of the previous 24 hours and the selected feature variables, and output is the predicted range of data for the next hour. The number of layers of the GRU model is 1, the number of hidden layers is 24, and the output dimension is 24. The output of the GRU model is used as the input of the fully connected layer, the input dimension of the fully connected layer is 24, the output dimension is 1, and the activation function is ReLU.

[0044] Step 4.2: The medium-term GRU model takes the data of the previous 4 weeks and the selected feature variables as input, and outputs the predicted range of the data for the next week. The GRU model has 1 layer, 48 hidden layers, and an output dimension of 24. The output of the GRU model is used as the input of the fully connected layer, with an input dimension of 24 and an output dimension of 1. The activation function is tanh.

[0045] Step 4.3: Long-period GRU model: The input is the electricity price of the previous 6 months and the selected feature variables, and the output is the data forecast range for the next month. The GRU model has 3 layers, 48 ​​hidden layers, and an output dimension of 36. The output of the GRU model is used as the input of the fully connected layer, the input dimension of the fully connected layer is 36, the output dimension is 1, and the activation function is Leaky ReLU.

[0046] Step 5: Use the training set data to train each GRU model, and use the Adam optimization algorithm to adjust the model parameters to minimize the prediction error. The learning rate is 0.001, the beta1 parameter is 0.9, the beta2 parameter is 0.999, and the epsilon parameter is 10. -8 The trained model is verified in the validation set. When the loss no longer decreases, the training is stopped and the model is considered to be the optimal model.

[0047] Step 6: Fusion the prediction results of the GRU model in different time periods to obtain a comprehensive electrical judgment prediction result.

[0048] Specifically: Determine the weight of each model based on its performance on the validation set. Preliminarily assume that the weights of the short-term, medium-term, and long-term models are 0.5, 0.3, and 0.2, respectively, and fuse the prediction results of each model by weighted average. Compare the fused prediction results with the actual data to obtain the prediction error, and determine whether a cyber attack has occurred based on the prediction error. Use historical error data to build an error correction model, that is, adjust the weight coefficients of different models. Repeat the prediction steps to further improve the accuracy of cyber attack identification. Based on repeated training, the optimal weights are finally set to 0.469, 0.321, and 0.21. Step 7: Use the test set data to test the fusion model, calculate the mean square error (MSE) and mean absolute error (MAE) between the actual data and the predicted data, and evaluate the prediction accuracy and stability of the model based on the MAE and MSE values ​​and the training curve. Adjust different parameters of the model: GRU layers, activation function, learning rate and other parameters. Compare the MSE and MAE under different schemes, select the scheme with the smallest value, and verify the practicality and reliability of the model. The specific optimal parameters are shown in Table 1.

[0049] Table 1 Optimal parameters of each model , Step 8: Deploy the trained and verified fusion model to the power spot market cyber attack identification system, and obtain market data in real time for prediction. Determine whether a cyber attack has occurred based on the actual data combined with the model prediction data. If the deviation exceeds the threshold, the threshold is set to 32.86%. If the model neural network gives a reference sign of a cyber attack, it is considered that a cyber attack has occurred.

[0050] The accuracy of this method in distinguishing network attacks from the traditional ARIMA model and the single-layer GRU model is shown in Table 2.

[0051] Table 2 Comparison of the accuracy of network attack identification by various methods , It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should be included in the scope of the claims of the present invention.

Claims

1. A method for identifying network attacks in a power market based on gated cyclic units, characterized in that: include, Acquire historical data and relevant influencing factor data from the electricity spot market, and preprocess the acquired data, wherein the preprocessing includes cleaning and normalization processing; Use correlation analysis and feature importance assessment methods to select and extract features from preprocessed data, and screen out feature variables that have a significant impact on changes in power market data; Divide the preprocessed data into training set, validation set and test set in chronological order; Based on the preprocessed data, multiple GRU models are constructed respectively; Use the training set data to train each GRU model, adjust the model parameters through the optimization algorithm to minimize the recognition error; use the validation set to evaluate the performance of each model; The prediction results of the GRU models in different time periods are integrated to obtain a fusion model, and a comprehensive electricity price prediction result is obtained based on the fusion model; Use the test set to test the fusion model and evaluate the accuracy and stability of the model; The fusion model is deployed in the power spot market cyber attack identification system to obtain market data in real time for cyber attack identification.

2. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 1, characterized in that: The method of using correlation analysis and feature importance evaluation to select and extract features from the preprocessed data includes: Set a correlation coefficient threshold, use the correlation analysis method to calculate the correlation coefficient of each feature variable, and select feature variables with correlation coefficients higher than the correlation coefficient threshold; The feature importance evaluation method was used for feature selection, and the 10 most important feature variables were selected.

3. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 1 or 2, characterized in that: The preprocessed data is divided into a training set, a validation set and a test set in chronological order, including: The preprocessed data are divided into training set, validation set and test set in chronological order; the specific proportions are: the training set accounts for 70% of the total data, the validation set accounts for 15%, and the test set accounts for 15%. Each data set contains complete fluctuation information.

4. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 1 or 2, characterized in that: Based on the preprocessed data, multiple GRU models are constructed respectively, including: Based on the electricity market data of different time periods, multiple GRU models are constructed respectively; the models judge short-term fluctuations, medium-term trends and long-term changes respectively; Specifically, it is divided into short-cycle GRU model: the input is the data of the previous 24 hours and the selected feature variables, and the output is the data prediction range of the next hour; The medium-term GRU model takes the data of the previous four weeks and the selected feature variables as input, and outputs the predicted range of the data for the next week; Long-period GRU model: The input is the electricity price of the previous 6 months and the selected feature variables, and the output is the data prediction range for the next month.

5. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 4, characterized in that: The prediction results of the GRU models of different time periods are fused to obtain a fusion model, and a comprehensive electricity price prediction result is obtained based on the fusion model, including: Determine the weight of each model based on its performance on the validation set; set the weights of the short-term, medium-term, and long-term models to 0.5, 0.3, and 0.2, respectively, and fuse the prediction results of each model by weighted average; compare the fused prediction results with the actual data to obtain the prediction error, and determine whether a network attack has occurred based on the prediction error; The error correction model is constructed using historical error data, and the weight coefficients of different models are adjusted.

6. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 5, characterized in that: The test set is used to test the fusion model and evaluate the accuracy and stability of the model. include, Calculate the mean square error (MSE) and mean absolute error (MAE) between the actual data and the predicted data, and evaluate the prediction accuracy and stability of the model based on the MAE and MSE values ​​and the training curve; adjust different parameters of the model: the number of GRU layers, activation function, and learning rate parameters, compare the MSE and MAE under different schemes, select the scheme with the smallest value, and verify the practicality and reliability of the model.

7. The method for identifying network attacks in a power market based on a gated cyclic unit according to claim 6, characterized in that: The fusion model is deployed into the network attack identification system of the power spot market to obtain market data in real time for network attack identification, including: Whether a cyber attack has occurred is determined based on actual data combined with model prediction data. If the deviation exceeds a preset threshold and the fusion model gives a reference sign of a cyber attack, it is considered that a cyber attack has occurred.

8. A system for identifying a power market network attack based on a gated cyclic unit, characterized in that: include, A data collection and preprocessing module (100), used to obtain historical data and relevant influencing factor data from the power spot market, and preprocess the obtained data, wherein the preprocessing includes cleaning and normalization processing; A feature selection and extraction module (200) is used to select and extract features from the preprocessed data using a correlation analysis and feature importance evaluation method, and to screen out feature variables that have a significant impact on changes in power market data; A data partitioning module (300), used to partition the preprocessed data into a training set, a validation set and a test set in chronological order; A multi-cycle GRU model building module (400) is used to build multiple GRU models based on the preprocessed data; The model training and verification module (500) is used to train each GRU model using the training set data, adjust the model parameters through the optimization algorithm, and minimize the recognition error; and use the verification set to evaluate the performance of each model; A multi-model fusion module (600) is used to fuse the prediction results of the GRU models of different time periods to obtain a fusion model, and obtain a comprehensive electricity price prediction result based on the fusion model; A model testing and evaluation module (700) is used to test the fusion model using a test set and evaluate the accuracy and stability of the model; The model deployment and application module (800) is used to deploy the fusion model to the power spot market network attack identification system, and obtain market data in real time to identify network attacks.

9. A computing device comprising: A memory and a processor, wherein the memory is used to store computer-executable instructions, and wherein the processor is used to execute the computer-executable instructions, and when the computer-executable instructions are executed by the processor, the steps of the method for identifying network attacks in a power market based on a gated cycle unit are implemented.

10. A computer-readable storage medium storing computer-executable instructions, characterized in that: The computer executable instructions, when executed by a processor, implement the steps of the method for identifying network attacks in a power market based on a gated cycle unit.

Images