Distributed network routing attack generation method for smart power grid

Abstract

The invention discloses a distributed network routing attack generation method for a smart power grid, and belongs to the technical field of smart power grid system security. The method is characterized by comprising the following steps: step a, initializing parameters; b, updating an attacked sensor set in real time; c, obtaining an attack matrix; d, judging whether the attack matrixes of all the sensors are updated or not, and if the attack matrixes of all the sensors are updated, constructing a combined attack matrix of the system; e, tampering the measurement data of the intelligent power grid system according to the joint attack matrix phi k obtained in the step d; and f, judging whether the distributed network routing attack is ended or not. According to the distributed network routing attack generation method for the smart power grid, the problem that a novel network attack behavior in a smart power grid system is understood at present is solved, a system designer is assisted to complete a corresponding defense strategy, and safe and stable operation of the smart power grid is guaranteed.

Description

Technical Field

[0001] The invention discloses a distributed network routing attack generation method for a smart grid, belonging to the technical field of smart grid system security. Background Art

[0002] The modern power system is a smart grid that can intelligently integrate the behaviors of all users connected to it. It integrates high-tech technologies such as information communication, sensors and power electronics. Efficient load management and reduction of power loss require accurate information. It can be seen that the power system must rely on an efficient monitoring system to achieve efficient operation and management. State estimation with the help of the measurement values ​​provided by the on-site phase measurement unit and the remote terminal unit is an important technical means to monitor the operating status of the system. However, the above measurement information may be corrupted by network attacks during transmission via the communication link.

[0003] Recently, distributed fusion estimation has been widely used due to its low sensitivity to measurement information. However, the use of open communication technology makes data vulnerable to special types of cyber-attacks during packet transmission, especially novel cyber-routing attacks. Recently, existing research works have proposed some general cyber-attack protection methods, such as:

[0004] The Chinese invention patent with application number 202210997564.1 and application date August 19, 2022, and patent name "Microgrid network attack protection method, device and system based on istio" discloses a technical solution, in which the central controller realizes overall monitoring of the communication link of the server of distributed power source; in addition, the central controller can judge the data transmission anomaly caused by FDI attack and the communication traffic decrease caused by DOS attack, and take the approach of cutting off the communication link or terminating the service, so as to realize the protection of the microgrid against multiple network attacks at the same time.

[0005] The Chinese invention patent with application number 202011537404.6 and application date December 23, 2020, and patent name "A method for designing security protection for electric power Internet of Things" discloses a technical solution in which risk prevention measures are proposed to solve the risk problems that people tend to ignore when using the Internet of Things, making the collection and transmission of data more securely protected.

[0006] However, the above technical solutions are all generalized defenses against common network attacks from the perspective of system security, and there is still a lack of thorough analysis of intelligent network attack behaviors, making it difficult to prepare more targeted and effective countermeasures. At present, only a small number of works have been specifically studied for the detection of network routing attacks, such as:

[0007] The paper “Design and countermeasure of optimal cyber-routing attack on remote Kalman filter in stochastic microgrids” proposes a dual sequence number verification method to detect network routing attacks in the single sensor remote estimation process. It verifies the existence of the attack by comparing the consistency of the sequence number of the data packet itself with the attached sequence number.

[0008] In summary, the prior art including the above technical solutions generally has the following defects:

[0009] (1) There is insufficient understanding of the new types of network attacks generated by the cross-integration of information and communication technologies in smart grid systems, and it is impossible to design effective security protection mechanisms.

[0010] (2) Existing research on network routing attacks focuses only on the remote state estimation process of power systems, but does not involve the distributed fusion estimation process that is widely present in smart grids. Considering the detection cost, the network routing attack detection method for remote state estimation cannot be simply migrated to the distributed fusion process.

[0011] (3) Routing attacks in the communications field are different from novel distributed network routing attacks arising from interdisciplinary research, and lack relevant analysis of the destructiveness of attacks on the system. Summary of the invention

[0012] The technical problem to be solved by the present invention is: to overcome the deficiencies of the prior art, to provide a distributed network routing attack generation method for smart grids, to solve the current problem of insufficient understanding of new network attack behaviors in smart grid systems, to assist system designers in completing corresponding defense strategies, and to ensure the safe and stable operation of smart grids.

[0013] The technical solution adopted by the present invention to solve its technical problem is:

[0014] Step a, parameter initialization;

[0015] Step b: Update the set of attacked sensors in real time

[0016] Step c, obtain the attack matrix; determine whether the current sensor i belongs to the set If the current sensor i belongs to the set Then calculate the attack matrix If the current sensor i does not belong to the set Then directly let the attack matrix is the identity matrix of suitable dimension;

[0017] Step d, determine whether the attack matrices of all sensors have been updated. If the attack matrices of all sensors have been updated, construct the joint attack matrix of the system; if the attack matrices of all sensors have not been updated, recurse to sensor i+1 and continue to calculate the attack matrix;

[0018] Step e: Based on the joint attack matrix Φ obtained in step d k , tampering with the measurement data of smart grid systems;

[0019] Step f, determine whether the distributed network routing attack is over, if it is over, exit, if not, return to step a.

[0020] Preferably, in step a, the parameters to be initialized are the power system related parameters obtained by the attacker through identification technology, including: system matrix A, input matrix B, covariance Q of process noise, number of sensors L, and corresponding measurement matrix C i (i∈[1,L]) and the covariance R of the measurement noise i ; Through eavesdropping technology, the control input signal u is intercepted in real time k and the measurement signals of L sensors According to the real-time input characteristics of the external energy collector, the available attack energy at the current moment is updated instantly, specifically:

[0021]

[0022] Among them, B k Represents the attack energy available at the kth moment, a binary decision variable Indicates whether to attack the i-th sensor at the k-th moment, Representatives launched an attack, H stands for no attack; k represents the energy collected from the outside at the kth moment, B max represents the maximum energy value that the attacker can store, and ζ represents the energy value consumed by launching an attack on a single sensor.

[0023] Preferably, the number of attacked sensors at any k time is τ k satisfy:

[0024]

[0025] Among them, the given constant In order to ensure the concealment of the attack, B k represents the attack energy available at the kth moment, and ζ represents the energy consumed by launching an attack on a single sensor.

[0026] Preferably, in step b, the set of attacked sensors is updated in real time When , the rules are:

[0027] make Initialize the set of attacked sensors where τ k represents the number of sensors attacked at time k, Indicates the first attack time, represents a given constant, θ i Indicates the identifiable sensor serial number;

[0028] If τ k >τ k-1 ,So Fruit k <τ k-1 ,So in represents a known sensor set, and the operation M\N represents the set formed by removing the elements in set N from set M;

[0029] If τ k =τ k-1 ,So

[0030] Preferably, in step c, the attack matrix is ​​calculated When , the calculation method is:

[0031]

[0032] Among them, j∈{1,2}, represents the alternative attack matrix 1, which is expressed as: represents the alternative attack matrix 2, which is expressed as:

[0033] represents the impaired estimation error covariance of sensor i, which is expressed as:

[0034]

[0035] represents the steady-state estimation error covariance of sensor i, yes is the only positive semidefinite solution of , and and

[0036] C i represents the measurement matrix, Q represents the covariance of process noise, R i represents the covariance of the measurement noise,

[0037] Intermediate variables The expression is: Represents an intermediate variable The transposed matrix of

[0038] Intermediate variables The expression is:

[0039] Intermediate variables The expression is: Among them A k represents the kth power of the system matrix A, A kT Indicates A k The transposed matrix, B T represents the transposed matrix of the input matrix B, represents the control input vector u k-j-1 The transposed vector of j represents the jth power of the system matrix A, A jT Indicates A j The transposed matrix of

[0040] K i Represents the filter gain, and its expression is:

[0041] I represents the matrix Identity matrices of the same dimensions.

[0042] Preferably, in step d, the joint attack matrix of the constructed system is:

[0043]

[0044] Here, 0 represents an all-zero vector or matrix that is the same as the attack matrix.

[0045] Preferably, in step d, the measurement data of the smart grid system is tampered, and the execution method is as follows: in represents the measured data under attack, represents the collection of L sensor measurement data, Represents the measurement data of the i-th sensor.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] This distributed network routing attack generation method for smart grids solves the current problem of insufficient understanding of new network attack behaviors in smart grid systems, assists system designers to complete corresponding defense strategies, and ensures the safe and stable operation of smart grids.

[0048] Since the existing technologies focus on the research of their respective fields (communication or control), they ignore the new problems caused by the intersection of disciplines in the smart grid system. Through this technical solution, it can be considered that the distributed network routing attack may seriously corrupt the remote state estimation process of the system. Therefore, studying the potential attack behavior from the attacker's perspective has important guiding significance for ensuring the safe operation of the system.

[0049] In this technical solution, a vulnerability analysis is performed on the distributed fusion estimation process of the multi-regional power system when it is attacked by resource-constrained routing attackers, thereby ensuring the continuous and stable operation of the microgrid system.

[0050] The joint attack matrix designed in this technical solution can not only help system designers accurately predict the potential attack targets and specific attack behaviors of routing attackers under energy harvesting constraints, but also dynamically evaluate the impact of attack strategies on network stability and transmission efficiency, thereby providing a theoretical basis for formulating efficient and targeted security protection mechanisms. This precise prediction capability can significantly improve the practicality and reliability of security mechanisms.

[0051] In this technical solution, the network routing attack strategy designed for the attacked sensor set can effectively reduce the amount of calculation: the complexity is The calculation process of is reduced from m! times to 2 times at each moment. This not only greatly reduces the computational cost and improves the system operation efficiency, but also expands the applicability of this strategy in resource-constrained systems, providing important support for the deployment of real-time large-scale networks.

[0052] In this technical solution, the designed attack target generation rule has a typical threshold structure, which can effectively improve the execution efficiency of the attack. The rule can quickly locate the set of attacked targets and flexibly adjust the attack priority according to the dynamic changes of the network, thereby achieving the optimal attack effect under the condition of limited energy resources, further enhancing the practical value of the method. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] Figure 1 Flowchart of the method for generating distributed network routing attacks for smart grids.

[0054] Figure 2 Schematic diagram of distributed network routing attack implementation for smart grid.

[0055] Figures 3 to 6is the real rotor angle Δω of the synchronous motor in different regions i , local estimate and fusion estimation The trajectory change curve diagram. DETAILED DESCRIPTION

[0056] Figures 1 to 6 The best embodiment of the present invention is shown below in conjunction with the attached Figures 1 to 6 The present invention is further described.

[0057] like Figure 1 As shown, a distributed network routing attack generation method for smart grid includes the following steps:

[0058] Step 1001, start;

[0059] The distributed network routing attack generation method for smart grid is started and parameter initialization is entered.

[0060] Further integration Figure 2 ,The distributed fusion estimation process of smart grid includes three different levels: the underlying physical process, the wireless network transmission and aggregation process in the middle layer, and the fusion and monitoring center in the upper layer. The middle layer includes several sensors and several local estimators wirelessly connected to the sensors. The measurement data of the underlying physical process is transmitted from the sensor to the local estimator through the wireless network. It will be intercepted and tampered by the resource-constrained distributed network routing attackers, which will cause serious deviation of the fusion estimation by corrupting the local estimation.

[0061] When initializing parameters, the attacker obtains the relevant parameters of the power system through identification technology, including: system matrix A, input matrix B, covariance Q of process noise, number of sensors L, and corresponding measurement matrix C i (i∈[1,L]) and the covariance R of the measurement noise i ; Through eavesdropping technology, the control input signal u is intercepted in real time k and the measurement signals of L sensors According to the real-time input characteristics of the external energy collector, the available attack energy at the current moment is updated instantly, specifically:

[0062]

[0063] Among them, B k Represents the attack energy available at the kth moment, a binary decision variable Indicates whether to attack the i-th sensor at the k-th moment ( Representatives launched an attack, stands for no attack), H krepresents the energy collected from the outside at the kth moment, B max represents the maximum energy value that the attacker can store, ζ represents the energy value consumed by attacking a single sensor. The number of sensors attacked at any time k is τ k satisfy:

[0064]

[0065] Among them, the given constant In order to ensure the concealment of the attack, B k represents the attack energy available at the kth moment, and ζ represents the energy consumed by launching an attack on a single sensor.

[0066] Step 1002, updating the set of attacked sensors in real time;

[0067] The above method is to update the attacked sensor set in real time. The default rules are as follows:

[0068] make Initialize the set of attacked sensors where τ k represents the number of sensors attacked at time k, Indicates the first attack time, represents a given constant, θ i Indicates the identifiable sensor number. express The number of sensors under attack at any given moment.

[0069] If τ k >τ k-1 ,So If τ k <τ k-1 ,So in represents a known set of sensors, and the operation M\N represents the set formed by removing the elements in set N from set M, that is, Represents from the set Go out to gather The set of elements in , where τ k-1 Indicates the number of sensors attacked at time k-1.

[0070] Identifiable sensor numberθ i From the collection Satisfy the inequality relationship gather gather

[0071] represents the steady-state estimation error covariance of sensor i, represents the impaired estimation error covariance of sensor i.

[0072] If τ k =τ k-1 ,So

[0073] Step 1003, determining whether the current sensor belongs to a set;

[0074] Determine whether the current sensor i belongs to the set If the current sensor i belongs to the set Right now Execute step 1005. If the current sensor i does not belong to the set Right now Execute step 1004.

[0075] Step 1004, directly set the attack matrix to a unit matrix of appropriate dimension;

[0076] If the current sensor i does not belong to the set Then directly let the attack matrix is the identity matrix of suitable dimension, that is, I represents the attack matrix The unit matrix has the same dimension as the unit matrix, and executes step 1005.

[0077] Step 1005, obtaining an attack matrix;

[0078] If the current sensor i belongs to the set Then the attack matrix is ​​obtained according to a specific calculation method Attack Matrix The elements in are composed only of "0" and "1" and satisfy the constraint that the row sum and column sum are both 1. The specific calculation method is:

[0079]

[0080] Among them, j∈{1,2}, represents the alternative attack matrix 1, which is expressed as: represents the alternative attack matrix 2, which is expressed as:

[0081] represents the impaired estimation error covariance of sensor i, which is expressed as:

[0082]

[0083] represents the steady-state estimation error covariance of sensor i, yes is the only positive semidefinite solution of , and and

[0084] C i represents the measurement matrix, Q represents the covariance of process noise, R i represents the covariance of the measurement noise,

[0085] Intermediate variables The expression is: Represents an intermediate variable The transposed matrix of

[0086] Intermediate variables The expression is:

[0087] Intermediate variables The expression is: Among them A k represents the kth power of the system matrix A, A kT Indicates A k The transposed matrix, B T represents the transposed matrix of the input matrix B, represents the control input vector u k-j-1 The transposed vector of j represents the jth power of the system matrix A, A jT Indicates A j The transposed matrix of

[0088] K i Represents the filter gain, and its expression is:

[0089] I represents the matrix Identity matrices of the same dimensions.

[0090] Step 1006: Check whether the attack matrices of all sensors have been updated;

[0091] Determine whether the attack matrices of all sensors are updated. If the attack matrices of all sensors are updated, execute step 1008. If the attack matrices of all sensors are not updated, execute step 1007.

[0092] Step 1007, i=i+1;

[0093] The attack matrix of all sensors has not been updated, that is, i≤L holds, which means that the attack matrix The calculation is not yet complete, recurse to sensor i+1 and return to step 1002 to continue calculating the attack matrix

[0094] Step 1008, constructing a joint attack matrix of the system;

[0095] If i>L holds true, it means that the attack matrices of L sensors have been calculated, and the joint attack matrix is ​​constructed:

[0096]

[0097] Here, 0 represents an all-zero vector or matrix with the same dimension as the attack matrix.

[0098] Step 1009, tampering with the measurement data of the smart grid system;

[0099] According to the joint attack matrix Φ obtained in step 1008 k , the measurement data of the smart grid system is tampered, and the execution method is in represents the measured data under attack, represents the collection of L sensor measurement data, Represents the measurement data of the i-th sensor.

[0100] Step 1010, determining whether the distributed network routing attack is over;

[0101] Determine whether the distributed network routing attack is over. If so, execute step 1011. If not, return to step 1001.

[0102] Step 1011, exit;

[0103] After the distributed network routing attack ends, the distributed network routing attack generation method for the smart grid ends.

[0104] The following is a specific example to further illustrate the distributed network routing attack generation method for smart grids:

[0105] Considering the IEEE 39-line power system model, divide it into 10 regions, select the sampling time Δt=0.02 to linearize the IEEE 39-line system near the initial point and then discretize it, and obtain the corresponding discretization model to verify the effect of the distributed network routing attack generated by the present invention. Assuming that the output of the discretized IEEE 39-line model is measured by 4 sensors with different precisions, the traces of the corresponding steady-state estimation error covariance are:

[0106] Furthermore, the process noise covariance is set to Q = 10 -4 I 40 , where I40 Represents a 40-dimensional identity matrix; sets the measurement noise covariance to R 1 =10 -5 I7,R 2 =4×10 -4 I7,R 3 =6×10 -2 I7,R 4 =2×10 -2 I7. The relevant synchronous motor parameters include the load damping factor of the ith region The time delay constant of the non-heated steam turbine in the i-th region The time constant of the generator in the i-th region The speed adjustment constant of the i-th region The inertia coefficient of the i-th region Synchronous torque coefficient between regions i and j etc. are given in Table 1.

[0107] Table 1 Physical parameters of IEEE 39-wire system

[0108]

[0109] Based on the distributed network routing attack generation method introduced in the present invention, an attack is launched on the measurement data of the four sensors in the embodiment. Under the energy collection constraint, the goal is to maximize the fusion estimation error covariance of the fusion center. When the attack occurs in the time interval [45,60], the true trajectory of the rotor angle of sensors 1-4 for the 1st, 3rd, 6th and 8th regions, the comparison graphs of the local estimation and the fusion estimation curves are obtained as shown in the figure below. Figures 3 to 6 As shown in Figure 2, it can be observed that the existence of distributed network routing attacks causes both local estimates and fusion estimates to deviate seriously from the true trajectory. Figures 3 to 6 In the figure, the sampling time unit of the horizontal axis is seconds, and the interval between two adjacent samples is 0.02 seconds. Although the damage caused by the attack to the estimation is attenuated to a certain extent after the attack ends, its impact persists, which shows the effectiveness of the designed distributed network routing attack generation method.

[0110] The above is only a preferred embodiment of the present invention, and does not limit the present invention in other forms. Any technician familiar with the profession may use the above disclosed technical content to change or modify it into an equivalent embodiment with equivalent changes. However, any simple modification, equivalent change and modification made to the above embodiment according to the technical essence of the present invention without departing from the technical solution of the present invention still belongs to the protection scope of the technical solution of the present invention.

Claims

1. A distributed network routing attack generation method for smart grid, characterized by: The steps include: Step a, parameter initialization; Step b: Update the set of attacked sensors in real time Step c, obtain the attack matrix; determine whether the current sensor i belongs to the set If the current sensor i belongs to the set Then calculate the attack matrix If the current sensor i does not belong to the set Then directly let the attack matrix is the identity matrix of suitable dimension; Step d, determine whether the attack matrices of all sensors have been updated. If the attack matrices of all sensors have been updated, construct the joint attack matrix of the system; if the attack matrices of all sensors have not been updated, recurse to sensor i+1 and continue to calculate the attack matrix; Step e: Based on the joint attack matrix Φ obtained in step d k , tampering with the measurement data of smart grid systems; Step f, determine whether the distributed network routing attack is over, if it is over, exit, if not, return to step a.

2. The distributed network routing attack generation method for smart grid according to claim 1 is characterized in that: In step a, the parameters to be initialized are the power system related parameters obtained by the attacker through identification technology, including: system matrix A, input matrix B, covariance Q of process noise, number of sensors L, and corresponding measurement matrix C i (i∈[1,L]) and the covariance R of the measurement noise i ; Through eavesdropping technology, the control input signal u is intercepted in real time k and the measurement signals of L sensors According to the real-time input characteristics of the external energy collector, the available attack energy at the current moment is updated instantly, specifically: Among them, B k Represents the attack energy available at the kth moment, a binary decision variable Indicates whether to attack the i-th sensor at the k-th moment, Representatives launched an attack, H stands for no attack; k represents the energy collected from the outside at the kth moment, B max represents the maximum energy value that the attacker can store, and ζ represents the energy value consumed by launching an attack on a single sensor.

3. The distributed network routing attack generation method for smart grid according to claim 2 is characterized in that: The number of sensors attacked at any time k τ k satisfy: Among them, the given constant In order to ensure the concealment of the attack, B k represents the attack energy available at the kth moment, and ζ represents the energy consumed by launching an attack on a single sensor.

4. The distributed network routing attack generation method for smart grid according to claim 1 is characterized in that: In step b, the set of attacked sensors is updated in real time When , the rules are: make Initialize the set of attacked sensors where τ k represents the number of sensors attacked at time k, Indicates the first attack time, represents a given constant, θ i Indicates the identifiable sensor serial number; If τ k >τ k-1 ,So Fruit k <τ k-1 ,So in represents a known sensor set, and the operation M\N represents the set formed by removing the elements in set N from set M; If τ k =τ k-1 ,So 5. The distributed network routing attack generation method for smart grid according to claim 1 is characterized in that: In step c, the attack matrix is ​​calculated When , the calculation method is: Among them, j∈{1,2}, represents the alternative attack matrix 1, which is expressed as: represents the alternative attack matrix 2, which is expressed as: represents the impaired estimation error covariance of sensor i, which is expressed as: represents the steady-state estimation error covariance of sensor i, yes is the only positive semidefinite solution of , and and C i represents the measurement matrix, Q represents the covariance of process noise, R i represents the covariance of the measurement noise, Intermediate variables The expression is: Represents an intermediate variable The transposed matrix of Intermediate variables The expression is: Intermediate variables The expression is: Among them A k represents the kth power of the system matrix A, A kT Indicates A k The transposed matrix, B T represents the transposed matrix of the input matrix B, represents the control input vector u k-j-1 The transposed vector of j represents the jth power of the system matrix A, A jT Indicates A j The transposed matrix of K i Represents the filter gain, and its expression is: I represents the matrix Identity matrices of the same dimensions.

6. The distributed network routing attack generation method for smart grid according to claim 1 is characterized by: In step d, the joint attack matrix of the constructed system is: Here, 0 represents an all-zero vector or matrix with the same dimension as the attack matrix.

7. The distributed network routing attack generation method for smart grid according to claim 1 is characterized in that: In step d, the measurement data of the smart grid system is tampered, which is performed as follows: in represents the measured data under attack, represents the collection of L sensor measurement data, Represents the measurement data of the i-th sensor.

Images