Virtual power plant data attack detection method and system based on improved binary tree group

Abstract

The invention discloses a virtual power plant data attack detection method and system based on an improved binary tree group. According to the method, data preprocessing and feature fusion are carried out by collecting multi-dimensional data of a physical layer and an information layer of a virtual power plant, and an improved binary tree group model is constructed based on weighted features. A dynamic depth adjustment and cooperative detection mechanism is introduced into the model, and the detection model can be adjusted in real time according to the operation condition of the power virtual power plant. In actual operation, the multiple nodes improve the recognition capability of complex data exception through collaborative analysis. And when an abnormity is detected, an alarm is triggered and a response is made. The method has the advantages of being high in detection precision, high in adaptability and low in false alarm rate, and is particularly suitable for network attack identification and protection aiming at information physical double layers in a complex electric power virtual power plant system.

Description

Technical Field

[0001] The present invention belongs to the field of power system security protection, and more specifically, relates to a virtual power plant data attack detection method and system based on an improved binary tree group. Background Art

[0002] VPP (Virtual Power Plant) is a new type of power system that integrates and optimizes the dispatch of distributed resources such as distributed energy, electric vehicles, and energy storage equipment through information and communication technology. With the large-scale access of new energy and distributed power sources, virtual power plants, as a flexible dispatching and management platform, can achieve unified coordination of multiple energy resources and improve the stability of the power grid and energy utilization efficiency. However, since virtual power plants rely on a large amount of network communication and information exchange, their data security faces huge challenges.

[0003] First, the operation of virtual power plants requires the real-time collection, transmission and processing of a large amount of energy data, including the operating status of power generation equipment, load demand, power trading information, etc. These data are highly sensitive, and once maliciously attacked or tampered with, they may lead to serious consequences such as loss of control of the energy system, economic losses or large-scale power outages.

[0004] Secondly, virtual power plants involve extensive communication networks and control systems. The coupling between the physical layer and the information layer is enhanced, making them easy targets for cyber attacks, especially phishing attacks, DDOS (Distributed Denial of Service) attacks, and data tampering attacks. Attackers may tamper with dispatch instructions, forge data, or manipulate energy resources by invading the communication network of virtual power plants, threatening the security and stability of the power system.

[0005] Therefore, how to detect attacks on virtual power plant data is an urgent problem to be solved.

[0006] The prior art document (CN117499145A) discloses a method for detecting abnormalities of communication nodes in an electric power system, comprising the following steps: Step 1, when a communication abnormality occurs in the electric power system, collecting flow characteristic data of all communication nodes, and calculating the node priority based on the flow characteristic data; Step 2, selecting a network node to be tested according to the node priority, performing binary tree partitioning on the network communication node to construct a plurality of network characteristic trees to be tested; Step 3, inputting the characteristic data of the current node into each of the network characteristic trees to be tested to detect the degree of abnormality of the current node.

[0007] However, existing technical documents only consider node traffic characteristic data, ignoring the physical safety and stability characteristics represented by the electrical quantities of the power system and the communication security attributes mapped at the communication layer, which reduces the accuracy of attack detection on virtual power plant data. Summary of the invention

[0008] In order to address the deficiencies in the prior art, the present invention provides a virtual power plant data attack detection method and system based on an improved binary tree group, which can effectively integrate the multi-dimensional data of the virtual power plant, use an improved algorithm to improve the accuracy and response speed of attack detection, and ensure the safe and stable operation of the power system.

[0009] The present invention adopts the following technical solution.

[0010] The first aspect of the present invention provides a virtual power plant data attack detection method based on an improved binary tree group, comprising: collecting multidimensional data from the physical layer and information layer of the virtual power plant system; preprocessing the multidimensional data to obtain feature data; constructing a binary tree group model based on the preprocessed feature data, the depth of the binary tree group model being dynamically adjusted according to the power load characteristics and information attributes corresponding to the feature data; deploying the binary tree group model on multiple virtual power plant system nodes, and each node collaboratively detecting to determine whether the virtual power plant data is under attack.

[0011] Optionally, the characteristic data includes part or all of voltage, current, frequency, network traffic, line delay and communication data.

[0012] Optionally, constructing a binary tree group model based on the preprocessed feature data includes: selecting a sub-sample set from the original data set, the original data set includes multiple samples, each sample includes sample data corresponding to the feature data; starting from the root node, selecting a feature from the multiple feature data as a basis for binary tree splitting, and dividing the sub-sample set into a binary tree until each terminal node contains only one or zero samples, thereby completing the construction of the binary tree group model.

[0013] Optionally, selecting a feature from multiple feature data as a basis for splitting the binary tree, and dividing the sub-sample set into a binary tree includes: selecting a feature from multiple feature data; determining the sample data corresponding to the median point of the sample data corresponding to the selected feature in the first sub-sample set as the classification threshold, and forming a second sub-sample set with sample data corresponding to the selected feature in the first sub-sample set that is smaller than the classification threshold as the left subtree; and forming a third sub-sample set with sample data corresponding to the selected feature in the first sub-sample set that is greater than or equal to the classification threshold as the right subtree.

[0014] Optionally, the depth of the binary tree group model is dynamically adjusted according to the power load characteristics and information attributes corresponding to the characteristic data according to the following formula: : , in, is the sample corresponding to the terminal node, is the subsample size, is the real-time load per unit value of sample x, For sample The corresponding information attribute.

[0015] Optionally, each node collaborates to detect and determine whether the virtual power plant data is under attack, including: each node separately detects and calculates the anomaly score of each sample in the corresponding binary tree group; calculates a comprehensive anomaly score based on the anomaly scores of the nodes participating in the collaborative detection; and determines whether the virtual power plant data is under attack based on the comprehensive anomaly score.

[0016] Optionally, a comprehensive anomaly score is calculated based on the anomaly scores of the nodes participating in the collaborative detection according to the following formula: , in, is the number of nodes participating in collaborative detection, For the Samples detected by the node The anomaly score.

[0017] Optionally, the anomaly score of each sample is calculated according to the following formula: , in, For sample The average path length in each binary tree group, is the normalization coefficient, For the A harmonic number, is the subsample size.

[0018] Optionally, when the comprehensive anomaly score exceeds a preset alarm threshold, it is determined that the virtual power plant data is under attack and an early warning is issued.

[0019] Optionally, the alarm threshold is calculated according to the following formula: , in, is the mean of the comprehensive anomaly scores in historical data, is the standard deviation of the comprehensive anomaly score in the historical data, is an adjustable coefficient used to adjust the weight between the standard deviation and the mean.

[0020] The second aspect of the present invention provides a virtual power plant data attack detection system, including an acquisition module, a processing module, a construction module and a judgment module. Among them, the acquisition module is used to collect multidimensional data from the physical layer and information layer of the virtual power plant system. The processing module is used to preprocess the multidimensional data to obtain feature data. The construction module is used to construct a binary tree group model based on the preprocessed feature data, and the depth of the binary tree group model is dynamically adjusted according to the power load characteristics and information attributes corresponding to the feature data. The judgment module is used to deploy the binary tree group model on multiple virtual power plant system nodes, and each node cooperates to detect and determine whether the virtual power plant data is attacked.

[0021] The third aspect of the present invention provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the computer program is loaded into the processor, the method for detecting data attacks on a virtual power plant based on an improved binary tree group is implemented.

[0022] A fourth aspect of the present invention provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the above-mentioned virtual power plant data attack detection method based on the improved binary tree group.

[0023] Compared with the prior art, the beneficial effects of the present invention include at least: The present invention simultaneously considers the electrical quantity characteristics of the physical layer and the traffic signal characteristics of the information layer, forms a set of information-physical correlation vectors, and uses the comprehensive information-physical importance of the nodes to adjust the weights of abnormal results; the present invention can more completely grasp the cross-domain impact and propagation characteristics of attack signals, and can identify attack behaviors that are more important and have a greater impact on the safe and stable operation characteristics of the power physical layer.

[0024] The present invention realizes accurate network attack identification of multi-dimensional data on both sides of information physics by improving the binary tree group model. Its advantages include high detection accuracy, low false alarm rate, strong dynamic adaptability, and can effectively respond to complex network attacks and ensure the security and stability of the virtual power plant system. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them: Figure 1 A schematic diagram of a virtual power plant data attack detection process based on an improved binary tree group provided by an embodiment of the present invention; Figure 2 A schematic diagram of the structure of a virtual power plant system provided by an embodiment of the present invention; Figure 3 A schematic diagram comparing binary array model training results under different sample sampling modes provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0027] Combination Figure 1 As shown, embodiment 1 of the present invention provides a virtual power plant data attack detection method based on an improved binary tree group, including the following contents: S200. Collect multi-dimensional data from the physical layer and information layer of the virtual power plant system.

[0028] Multi-dimensional data is collected from the physical layer and information layer of the virtual power plant system. The physical layer data includes power parameters such as voltage, current, and frequency, and the information layer data includes network traffic, line delay, and communication data. Multi-dimensional data also includes the operating status of power generation equipment, load demand, power trading information, etc.

[0029] S400: Preprocess the multidimensional data to obtain feature data.

[0030] Optionally, the characteristic data includes part or all of voltage, current, frequency, network traffic, line delay and communication data.

[0031] Specifically, the collected multidimensional data is cleaned, feature extracted and standardized to eliminate noise and outliers, and the data of the physical layer and information layer are standardized into a unified feature space.

[0032] The preprocessing in S400 specifically includes: S410: Clean the collected physical layer and information layer data to remove noise and abnormal values, and extract features from the cleaned data to obtain feature data.

[0033] S420, converting the characteristic data of the physical layer and the information layer into a unified characteristic space, constructing a characteristic vector ,in ~ is the physical layer feature vector, ~ is the information layer feature vector.

[0034] S430, normalize the feature vector, and the normalization formula is as follows: , in, is the i-th eigenvalue of the original feature data, is the mean value of this feature, is the standard deviation of the feature, is the i-th eigenvalue in the unified feature space.

[0035] S600: construct a binary tree group model based on the preprocessed feature data, wherein the depth of the binary tree group model is adjusted according to the power load characteristics and information attributes of the sample.

[0036] Based on the feature fused data, an improved binary tree group model is constructed. The model introduces a dynamic adjustment mechanism to adapt to the dynamic changes in the operation of the virtual power plant system. The depth of the binary tree is adaptively adjusted according to the characteristics of real-time data.

[0037] In S600, constructing the binary tree group model specifically includes: S610: Select a sub-sample set from the original data set, where the original data set includes multiple samples, and each sample includes sample data corresponding to feature data.

[0038] For example, each sample includes voltage data, current data, frequency data, network traffic data, line delay data, and communication data.

[0039] Specifically, a binary tree group model is constructed based on the standardized feature vector F , the binary tree group model consists of t binary trees Each tree uses a subsample set randomly selected from the original dataset. And feature subsets This random generation method ensures the differences between binary trees, thereby improving the generalization ability of the model. Defining a binary tree group model for: , S620, starting from the root node, select a feature from multiple feature data as the basis for binary tree splitting, and divide the sub-sample set into binary trees until each terminal node contains only one or zero samples, completing the construction of the binary tree group model.

[0040] Optionally, selecting one feature from the plurality of feature data as a binary tree splitting basis in S620, and performing binary tree partitioning on the sub-sample set includes: In the first sub-sample set, the sample data corresponding to the median point of the sample data corresponding to the selected feature is determined as the classification threshold. In the first sub-sample set, the sample data corresponding to the selected feature that is less than the classification threshold constitute the second sub-sample set as the left subtree; in the first sub-sample set, the sample data corresponding to the selected feature that is greater than or equal to the classification threshold constitute the third sub-sample set as the right subtree.

[0041] S620 specifically includes: S621. For the i-th binary tree, its construction is based on recursive partitioning of the data set. Starting from the root node, for the first subtree, randomly select a feature As the basis for splitting, and taking sub-sample sets About Features The median point of the value As the classification threshold, the subsample set is divided into two parts and As the first left and right subtrees, where , For example, there are 100 samples in the sub-sample set, each of which contains voltage, current, frequency, network traffic, line delay and communication data. The voltage feature is selected as the basis for sorting, and the sample data corresponding to the voltage feature in the 100 samples are sorted. The 50th sample data is taken as the classification threshold, and the sample data corresponding to the voltage feature in the sub-sample set that is less than the classification threshold constitutes the left subtree, and the sample data corresponding to the voltage feature in the sub-sample set that is greater than or equal to the classification threshold constitutes the right subtree. It is also possible not to sort the sample data corresponding to the voltage feature in the 100 samples, and directly select the median point, such as the 50th sample data, as the classification threshold. The classification threshold can also be selected according to actual design requirements. Selecting the median point as the classification threshold is only an unrestricted embodiment provided by the present invention.

[0042] S622. For the left subtree and the right subtree, and They are respectively used as new sub-sample sets and the process of S21 is performed respectively until each terminal node contains only one or zero samples.

[0043] S623. For each terminal node, first calculate the sum of the number of paths from the root node as the basic path length of the node, and then adjust it according to the power load characteristics and information attributes corresponding to the node.

[0044] Optionally, adjust the formula to: , Among them, x is the sample corresponding to the terminal node, n is the size of the subsample set, is the real-time load per unit value of sample x, is the information attribute corresponding to sample x. When the information attribute corresponding to sample x is the control master station The value is 3. When the information attribute corresponding to sample x is the control substation, The value is 2, and the information attribute corresponding to sample x is the execution station The value is 1.

[0045] The real-time load per unit value is a relative value used to describe electrical quantities and engineering parameters in the power system. It can intuitively and quickly determine the correctness of system components and state variables.

[0046] The improvement of the binary tree group model is that it can automatically adjust the depth of the tree according to the changes in power load characteristics and information attributes, thereby improving the adaptability of the model to the actual virtual power plant cyber-physical system.

[0047] Furthermore, in S600, a binary tree group model is constructed based on the preprocessed feature data and the pre-trained binary tree parameters, wherein the binary tree parameters include a sampling scale and an integration scale, wherein the sampling scale is used to characterize the number of samples in each binary tree in the binary tree group, and the integration scale is used to characterize the number of binary trees in the binary tree group.

[0048] In this embodiment, the binary tree group model is trained using historical normal data and attack data, and by comparing the training effects of the binary tree group models constructed with different binary tree group model parameters, the parameters corresponding to the binary tree with the best training effect are selected as the parameters for constructing the binary tree group model.

[0049] S800, deploy the binary tree group model on multiple virtual power plant system nodes, and the multiple virtual power plant system nodes jointly analyze abnormal situations through a collaborative detection mechanism to comprehensively determine whether there is a network attack behavior.

[0050] S800 specifically includes: S810. Deploy an improved binary tree group model on multiple virtual power plant system nodes, and each node independently detects and calculates the data anomaly score in its area.

[0051] Optionally, calculate an anomaly score for each sample , the formula is as follows: , in, is the average path length of sample x in each tree group, is the normalization coefficient, and the approximate formula is ,

[0052] in, For the The harmonic number, n is the sub-sample size.

[0053] S820. Calculate a comprehensive anomaly score according to the anomaly scores of the nodes participating in the collaborative detection.

[0054] Optionally, nodes share their detected anomaly scores ,in For the detection nodes, comprehensive anomaly score The calculation formula is as follows: ,

[0055] in, is the number of nodes participating in collaborative detection, For the Samples detected by nodes The anomaly score.

[0056] S830. Determine whether the virtual power plant data is attacked based on the comprehensive anomaly score.

[0057] Optionally, when it is detected that the comprehensive anomaly score exceeds a preset alarm threshold, it is determined that the virtual power plant data is attacked, and the alarm mechanism is triggered, and corresponding emergency response measures are taken to prevent the virtual power plant system from being further damaged.

[0058] S830 specifically includes: When the comprehensive abnormality score Exceeding the preset alarm threshold , the alarm system is triggered and it is determined that there is an attack in the data of sample x.

[0059] Optionally, the alarm threshold is calculated based on the mean and standard deviation in the historical data, as follows: , in, is the mean of the comprehensive anomaly scores in historical data, is the standard deviation of the comprehensive anomaly score in the historical data, is an adjustable coefficient used to adjust the weight between the standard deviation and the mean.

[0060] Optionally, The value is 3.

[0061] It is understandable that, in practical applications, those skilled in the art set specific values ​​of the adjustable coefficients according to actual needs and historical experience, and the embodiments of the present invention do not limit the specific values ​​of the adjustable coefficients.

[0062] Embodiment 2 of the present invention provides a virtual power plant data attack detection system, which runs the virtual power plant data attack detection method based on the improved binary tree group as described in Embodiment 1, and the system includes: an acquisition module, a processing module, a construction module and a judgment module. Among them, the acquisition module is used to collect multidimensional data from the physical layer and information layer of the virtual power plant system. The processing module is used to preprocess the multidimensional data to obtain feature data. The construction module is used to construct a binary tree group model based on the preprocessed feature data, and the depth of the binary tree group model is dynamically adjusted according to the power load characteristics and information attributes corresponding to the feature data. The judgment module is used to deploy the binary tree group model on multiple virtual power plant system nodes, and each node cooperates to detect and determine whether the virtual power plant data is attacked.

[0063] Embodiment 3 of the present invention provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is loaded into the processor, the method for detecting data attacks on a virtual power plant based on an improved binary tree group as described in Embodiment 1 is implemented.

[0064] Embodiment 4 of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the virtual power plant data attack detection method based on the improved binary tree group according to Embodiment 1 is implemented.

[0065] Embodiment 5 of the present invention provides a verification embodiment for verifying the effectiveness and feasibility of the virtual power plant data attack detection method based on the improved binary tree group provided in Embodiment 1 of the present invention.

[0066] The virtual power plant system topology used in this embodiment is shown in the figure Figure 2 The load condition of the physical system is set to a normal distribution with fluctuations in the range of [0.8, 1.2]. The sampling frequency on the information side is 1 time / 15s, and a total of 1000 samples are sampled.

[0067] In this embodiment, the information side communication nodes correspond to the physical side busbars one by one, and the communication network topology is a multi-ring structure based on the simplified power topology. The data used in the calculation example include the voltage, current, frequency of each node, and the network flow, line flow and line delay of each line.

[0068] In this embodiment, AUC (Area Under Curve) is used as an important indicator to measure model performance and is used to evaluate the performance of the binary tree group model. AUC is the area under the ROC (Receiver Operating Characteristic curve), which is a curve drawn with FPR (False Positive Rate) as the horizontal axis and TPR (True Positive Rate) as the vertical axis.

[0069] During the model training and testing process, the overall samples were divided into training samples and test samples in a ratio of 4:1. By comparing the selection method of the sub-sample set sampling scale ψ of each binary tree and the integrated scale t of the binary tree group, the AUC evaluation results under different parameters were analyzed. Figure 3 It can be seen that when ψ=131 and t=50 are selected, the accuracy of the model reaches the maximum value, and further adjustment of the parameters will not achieve better results.

[0070] In addition to the AUC value, the false positive rate is also taken , Missed Detection Rate Evaluate the performance of the anomaly detection algorithm, which is calculated as: , On this basis, in order to verify the effectiveness of the model in detecting attack activities, the proposed improved binary tree group algorithm is compared with existing common algorithms, including LOF (Local Outlier Factor) algorithm, OCSVM (OneClass Support Vector Machine) and original iForest (isolationForest) algorithm. The verification effect of each method on each evaluation index is shown in Table 1.

[0071] Table 1 method AUC Np Nr LOF 0.924 0.942 0.903 OCSVM 0.913 0.952 0.905 iForest 0.942 0.937 0.908 Improved Binary Tree Group Algorithm 0.956 0.961 0.919 The results show that the proposed method is more adaptable to complex and time-varying power information-physical collaborative operation conditions, can adapt to virtual power plant systems with constantly changing operating conditions, and maintain high accuracy of abnormal data monitoring.

[0072] Compared with the prior art, the beneficial effects of the present invention include at least: The present invention simultaneously considers the electrical quantity characteristics of the physical layer and the traffic signal characteristics of the information layer, forms a set of information-physical correlation vectors, and uses the comprehensive information-physical importance of the nodes to adjust the weights of abnormal results; the present invention can more completely grasp the cross-domain impact and propagation characteristics of attack signals, and can identify attack behaviors that are more important and have a greater impact on the safe and stable operation characteristics of the power physical layer.

[0073] The present invention realizes accurate network attack identification of multi-dimensional data on both sides of information physics by improving the binary tree group model. Its advantages include high detection accuracy, low false alarm rate, strong dynamic adaptability, and can effectively respond to complex network attacks and ensure the security and stability of the virtual power plant system.

[0074] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0075] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0076] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the above. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the above. The computer-readable storage medium used herein is not to be interpreted as a transient signal itself, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0077] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0078] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. The computer-readable program instructions may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect through the Internet). In some embodiments, by using the state information of the computer-readable program instructions to personalize an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), the electronic circuit may execute the computer-readable program instructions, thereby implementing various aspects of the present disclosure.

[0079] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A virtual power plant data attack detection method based on improved binary tree group, characterized in that: include: Collect multi-dimensional data from the physical layer and information layer of the virtual power plant system; Preprocess multidimensional data to obtain feature data; Constructing a binary tree group model based on the preprocessed feature data, wherein the improved binary tree group refers to a binary tree group model whose depth is dynamically adjusted according to the power load characteristics and information attributes corresponding to the feature data; The binary tree group model is deployed on multiple virtual power plant system nodes, and each node cooperates in detection to determine whether the virtual power plant data is attacked.

2. The virtual power plant data attack detection method based on improved binary tree group according to claim 1 is characterized by: The characteristic data includes part or all of voltage, current, frequency, network traffic, line delay and communication data.

3. The virtual power plant data attack detection method based on improved binary tree group according to claim 1 is characterized by: Building a binary tree group model based on preprocessed feature data includes: Selecting a sub-sample set from an original data set, where the original data set includes a plurality of samples, each of which includes sample data corresponding to the feature data; Starting from the root node, one feature is selected from multiple feature data as the basis for binary tree splitting, and the sub-sample set is divided into binary trees until each terminal node contains only one or zero samples, completing the construction of the binary tree group model.

4. The virtual power plant data attack detection method based on improved binary tree group according to claim 3 is characterized by: Selecting one feature from multiple feature data as the basis for binary tree splitting, and dividing the sub-sample set into binary trees includes: Select a feature from multiple feature data; In the first sub-sample set, the sample data corresponding to the median point of the sample data corresponding to the selected feature is determined as the classification threshold, In the first sub-sample set, sample data corresponding to the selected features that are smaller than the classification threshold constitute a second sub-sample set as the left subtree; In the first sub-sample set, sample data corresponding to the selected features that are greater than or equal to the classification threshold are used to form a third sub-sample set as the right subtree.

5. The virtual power plant data attack detection method based on improved binary tree group according to claim 3 is characterized by: According to the following formula, the depth of the binary tree group model is dynamically adjusted according to the power load characteristics and information attributes corresponding to the characteristic data. : , in, is the sample corresponding to the terminal node, is the subsample size, is the real-time load per unit value of sample x, For sample The corresponding information attribute.

6. The virtual power plant data attack detection method based on improved binary tree group according to any one of claims 1 to 5, characterized in that: Each node cooperates to detect and determine whether the virtual power plant data is attacked, including: Each node detects and calculates the anomaly score of each sample in the corresponding binary tree group; Calculate the comprehensive anomaly score based on the anomaly scores of the nodes participating in the collaborative detection; Determine whether the virtual power plant data is attacked based on the comprehensive anomaly score.

7. The virtual power plant data attack detection method based on improved binary tree group according to claim 6 is characterized by: The comprehensive anomaly score is calculated based on the anomaly scores of the nodes participating in the collaborative detection according to the following formula: ， in, is the number of nodes participating in collaborative detection, For the Samples detected by nodes The anomaly score.

8. The virtual power plant data attack detection method based on improved binary tree group according to claim 7 is characterized by: The anomaly score of each sample is calculated according to the following formula: , in, For sample The average path length in each binary tree group, is the normalization coefficient, For the A harmonic number, is the subsample size.

9. The virtual power plant data attack detection method based on improved binary tree group according to claim 6 is characterized by: When the comprehensive anomaly score exceeds the preset alarm threshold, it is judged that the virtual power plant data is under attack and an early warning is issued.

10. The virtual power plant data attack detection method based on improved binary tree group according to claim 9 is characterized in that: The alarm threshold is calculated according to the following formula: ， in, is the mean of the comprehensive anomaly scores in historical data, is the standard deviation of the comprehensive anomaly score in the historical data, is an adjustable coefficient used to adjust the weight between the standard deviation and the mean.

11. A virtual power plant data attack detection system using the virtual power plant data attack detection method based on the improved binary tree group as described in any one of claims 1 to 10, characterized in that: include: A collection module, used to collect multi-dimensional data from the physical layer and information layer of the virtual power plant system; A processing module, used for preprocessing multidimensional data to obtain feature data; A construction module, for constructing a binary tree group model based on the preprocessed feature data, wherein the depth of the binary tree group model is dynamically adjusted according to the power load characteristics and information attributes corresponding to the feature data; The judgment module is used to deploy the binary tree group model on multiple virtual power plant system nodes, and each node cooperates to detect and judge whether the virtual power plant data is attacked.

12. An electronic device, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instructions to execute the steps of the virtual power plant data attack detection method based on the improved binary tree group according to any one of claims 1-10.

13. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the steps of the virtual power plant data attack detection method based on the improved binary tree group described in any one of claims 1-10 are implemented.

Images