Power grid network attack detection method and system based on deep learning

Abstract

The invention discloses a power grid network attack detection method and system based on deep learning, and the method comprises the steps: collecting power grid node data in real time, dividing node groups according to regions, and carrying out the hierarchical storage of the data according to the node groups; performing segmentation processing on the hierarchical data by using a fixed time window to generate a standardized hierarchical data set; extracting feature information for different network attack types; capturing features of false data injection, denial of service and distributed denial of service attacks by analyzing abnormal changes, node access frequency changes and frequency domain features in the time sequence, and generating a comprehensive feature set; a distributed deep learning model composed of power grid node group models is constructed, the power grid node group models are combined with a long-short-term memory network and a graph convolution network, a local objective function of the power grid node group models is optimized, and parameters of all the power grid node group models are synchronously optimized on the global level; and generating a classification report containing the affected nodes and the propagation paths, and planning a load redistribution and isolation strategy according to the real-time load and the transmission state.

Description

Technical Field

[0001] The present invention belongs to the technical field of power system security and network security, and more specifically, to a power grid network attack detection method and system based on deep learning. Background Art

[0002] Power system security technology refers to a technical system that uses various means and technical measures to ensure the stable, safe and reliable operation of the power system in the face of various potential threats. These threats include natural disasters, equipment failures, and increasingly serious cyber attacks in recent years. It covers all aspects from power production, transmission to distribution, and aims to ensure the normal operation of the power system and the continuity of power supply.

[0003] In recent years, with the widespread application of smart grid and Internet of Things technologies, the automation level of power systems has been greatly improved, but it has also made them face unprecedented network security challenges. Cyber ​​attacks, especially false data injection (FDI) attacks on power grids, have become an important factor threatening the security of power systems. Research in the field of power system security, especially the development of technologies that can effectively detect and respond to these cyber attacks, is of great significance to ensuring the stable operation of the social economy. By strengthening research in this field, the protection capabilities of power systems can be improved and the risks and losses caused by cyber attacks can be reduced.

[0004] At present, the relevant technologies in the field of power grid network attack detection have the following shortcomings: First, most detection methods lack generalization ability and are difficult to adapt to different attack scenarios. Second, some detection methods rely heavily on detection thresholds and lack flexibility. Third, existing technologies are difficult to efficiently detect known and unknown attacks at the same time.

[0005] Prior art document 1 (CN113281998B) discloses a method for detecting multi-point FDI attacks on industrial information-physical systems using a generative adversarial network, comprising the following steps: 1) establishing different types of FDI attack models; 2) establishing a GAN model; 3) establishing an LR-GAN model using LSTM-RNN as a generator and discriminator unit; 4) designing a multi-point FDI attack detection algorithm based on LR-GAN; 5) designing a multi-point FDI attack detection framework based on LR-GAN.

[0006] The existing technical document 1 has the following deficiencies: First, the limitation of the detection framework: the existing technical document 1 only focuses on the detection of FDI attacks, and fails to form a comprehensive detection capability for various types of network attacks (such as DoS attacks, DDoS attacks, etc.), while the deep learning-based detection method proposed in this patent can achieve efficient identification and classification of various types of attacks; Second, insufficient model parameter optimization: the existing technical document 1 mainly relies on basic Adam optimization and gradient descent optimization for parameter update, lacking an adaptive adjustment mechanism for model parameters, while this patent introduces a fuzzy adaptive hybrid configuration method (SPSO and DE algorithms) and a dynamic parameter adjustment mechanism to improve the performance and adaptability of the model. Third, the evaluation system is imperfect: the existing technical document 1 has not established a systematic performance evaluation index system, and only judges whether an attack exists through a simple detection flag function, while this patent designs a complete evaluation system including accuracy, precision, recall and specificity, which can comprehensively measure the performance of the detection framework. Summary of the invention

[0007] In order to solve the deficiencies in the prior art, the present invention provides a power grid network attack detection method based on deep learning.

[0008] The present invention adopts the following technical solution.

[0009] A first aspect of the present invention provides a power grid network attack detection method based on deep learning, comprising the following steps:

[0010] Step 1: collect voltage, current, power and frequency data of power grid nodes in real time, divide node groups by region, and process voltage, current, power and frequency data by node groups in layers; segment the layered data using a fixed time window to generate a layered segmented data set;

[0011] Step 2: Based on the hierarchical and segmented data set, extract the feature information of different types of network attacks; obtain the features of false data injection, denial of service and distributed denial of service attacks by analyzing the abnormal changes in the time series, the changes in node access frequency and the frequency domain characteristics, and fuse the time series features, spatial features and frequency domain features to generate a comprehensive feature set;

[0012] Step 3: A power grid node group model is established based on a long short-term memory network and a graph convolutional network, and multiple power grid node group models constitute a distributed deep learning model; according to the comprehensive feature set, each power grid node group model obtains its own time-dependent features and node-related features under the optimal local objective function, and the distributed deep learning model synchronously optimizes the time-dependent features and node-related features of each power grid node group model under the optimal global objective function;

[0013] Step 4: Use the distributed deep learning model to generate a classification report containing the affected nodes and propagation paths, and plan the load redistribution and isolation strategy based on the real-time load and transmission status.

[0014] Preferably, step 1 comprises:

[0015] The collected data is transmitted to the data center through remote terminal devices and intelligent electronic devices;

[0016] Based on the topological structure of the power grid, the power grid operation nodes are divided into multiple regional groups according to their geographical locations and functional characteristics, and each regional group contains interrelated nodes;

[0017] The node operation data of each layer is segmented and processed according to fixed time windows, including dividing into independent data segments according to time intervals of 1 second, 10 seconds and 1 minute to capture the operation characteristics of different time granularities;

[0018] The voltage, current and power of each segment of hierarchical data are normalized respectively, and the normalized hierarchical segmented data are stored as a multidimensional data set; each data set includes a time dimension, a space dimension and a characteristic dimension; the time dimension is used to record the time segment information of the data; the space dimension is used to record the area or topological position of the node; the characteristic dimension contains the standardized values ​​of voltage, current, power and frequency, and finally a hierarchical segmented data set is generated.

[0019] Preferably, the division is into multiple regional groups, each of which contains mutually related nodes, and the hierarchical rules are as follows:

[0020] According to the physical location of the nodes, there are city-level, regional-level and provincial-level power grids;

[0021] According to the role of nodes in the power grid, they include main grid nodes and distribution nodes; main grid nodes include substations, and distribution nodes include end users.

[0022] Preferably, step 2 comprises:

[0023] Based on the generated hierarchical segmented data set, the long short-term memory network is used to capture the dependencies of time series, identify anomalies in the power grid node operation data that continuously deviate from the normal range, and use the dynamic comparison between the historical state and the current state to construct the distribution of time series anomaly deviations as the feature of false data injection attacks, and identify the time offset features in the node operation data;

[0024] The topological structure between power grid nodes is modeled through graph convolutional networks, the spatial distribution characteristics of node access frequency in the power grid are extracted, network load anomalies are identified, and node overload characteristics are extracted by comparing the changes in node centrality between normal and attack states.

[0025] Through fast Fourier transform, the time domain signal is converted into the frequency domain signal, the abnormal distribution characteristics of the frequency domain are extracted, and the bandwidth occupancy anomaly caused by distributed attacks is identified;

[0026] The importance of the extracted time offset features, node overload features, and frequency domain abnormal distribution features is analyzed. Based on their contribution to the classification of the target attack type, the screened time series features, spatial features, and frequency domain features are weighted fused. The weights are calculated according to their contribution to the target attack classification, and they are fused according to the contribution ratio to finally generate a comprehensive feature set.

[0027] The final generated comprehensive feature set includes relevant features of false data injection attacks, denial of service attacks and distributed denial of service attacks: time offset features, node overload features and frequency domain abnormal distribution features.

[0028] Preferably, the importance analysis of the extracted time offset features, node overload features, and frequency domain abnormal distribution features is performed based on the classification contribution to the target attack type, including:

[0029] Compare the changes in features under different attack types and monitor the extent of changes in each feature when different attacks occur, including:

[0030] By comparing the node voltage, current and power offsets of the time offset feature under the false data injection attack, which exceeds 5%, and the offsets under other attack types, which are within 5%, the time offset feature offsets are sorted from large to small, and the corresponding contributions are allocated in turn;

[0031] By comparing the access frequency of nodes with node overload characteristics in denial of service attacks, which increases by 30%, and the increase is less than 30% in other types of attacks, we first sort the offsets of these node overload characteristics from large to small, sort the access frequencies of node overload characteristics from large to small, and assign corresponding contributions in turn;

[0032] By performing fast Fourier transform on the power grid frequency domain signal and comparing the bandwidth occupancy fluctuations of the nodes, if the standard deviation of the frequency signal increases by more than 50% and the standard deviation increases by less than 50% under other attack types, the standard deviations of the frequency domain abnormal features are sorted from large to small and the corresponding contributions are allocated in sequence.

[0033] Preferably, step 3 comprises:

[0034] Establish a power grid node group model. Multiple power grid node group models constitute a distributed deep learning model. Multiple power grid node group models are deployed at different nodes of the power grid. Each power grid node group model uses a long short-term memory network module to process temporal features and a graph convolutional network module to process spatial features. All power grid node group models share parameters through collaborative training and output attack detection results in the area.

[0035] The grid node group model adjusts parameters through local training, uploads them to the central server for global parameter update, and optimizes local parameter anomaly detection through reinforcement learning; global parameters are updated through weighted average and sent to the grid node group model;

[0036] The cross entropy loss function is used to optimize global parameters. The power grid node group model optimizes the detection accuracy through the local objective function, and the distributed Adam optimizer is used to optimize global and local parameters.

[0037] The grid node group model updates local parameters and uploads them to the server. The server aggregates the parameters and synchronously updates the global parameters. The training is iterated until the change in the global loss function is less than the threshold.

[0038] The grid node group model outputs the attack detection results of the node area and aggregates them to the central server to generate an attack detection report, including the attack type, affected nodes and propagation path.

[0039] Preferably, the global parameters and local parameters are optimized as follows:

[0040]

[0041] Where L is the value of the loss function, which represents the error between the state of the power grid node and the true label; N is the total number of samples in the data set, which represents the number of collected power grid node data;

[0042] y i is the true label of the i-th sample, y i =0 means "normal", y i =1 means "attack";

[0043] p i is the state output value of the grid node of the i-th sample, ranging from 0 to 1; log(p i ) Calculate the logarithm of the state output value of the power grid node;

[0044] y i log(p i ) is the loss term for the positive class, when the true label y i =1 means being attacked, which mainly depends on log(p i ), if p i If p is equal to 0, it means that the attack is misidentified; if p i Equal to 1, indicating that the attack is correctly identified;

[0045] (1-y i )log(1-p i ) is the loss term for the negative class, when the true label yi = 0 means no attack, mainly depends on log(1-p i ), if p i If p is equal to 1, it means that the node that has not been attacked is identified as an attack; if p i Equal to 0, indicating that the nodes that are not attacked are identified as normal.

[0046] Preferably, step 4 comprises:

[0047] The attack detection report in the detection results of the distributed deep learning model includes the attack type, affected nodes and propagation path; the attack types include FDI attack, DoS attack and DDoS attack

[0048] Based on the attack detection report and the topological information of the power grid nodes, the risk score of each node of concern is evaluated and generated, and the response strategy is dynamically planned, including isolating the attacked nodes and reallocating the attacked nodes with abnormal loads.

[0049] Preferably, the step of evaluating and generating a risk score for each node of interest based on the attack detection report and the topology information of the power grid node includes:

[0050]

[0051] In the formula, S j Score the risk of the jth node; is the predicted attack probability of the i-th node; w ij is the connection weight between node i and node j, which is used to reflect the strength of the association between nodes.

[0052] The second aspect of the present invention provides a power grid network attack detection system based on deep learning, comprising: a data acquisition and preprocessing module, a feature extraction and construction module, a distributed deep learning model construction and training module, and an attack detection and response strategy module;

[0053] The data acquisition and preprocessing module is used to collect voltage, current, power and frequency data from power grid nodes in real time, divide node groups by region for hierarchical storage, and process data in segments using fixed time windows to generate standardized hierarchical data sets;

[0054] Feature extraction and construction module, used to extract features of hierarchical data sets, analyze time series, node access frequency and frequency domain characteristics, capture the features of false data injection, denial of service and distributed denial of service attacks, and integrate them into a comprehensive feature set;

[0055] The distributed deep learning model construction and training module is used to build a distributed deep learning model composed of a power grid node group model. The power grid node group model uses a long short-term memory network module to process timing features, a graph convolutional network module to process node association features, and optimizes local objective functions while optimizing parameters through global synchronization.

[0056] The attack detection and response strategy module is used to use distributed deep learning models to identify attack types, generate classification reports including affected nodes and propagation paths, and plan load redistribution and isolation strategies based on real-time load and transmission status.

[0057] Compared with the prior art, the beneficial effects of the present invention include at least:

[0058] 1. Efficient detection capability: The detection method proposed in the present invention shows excellent detection capability in various network attacks (such as DoS, DDoS and FDI attacks), and the detection rate can reach 99.46%.

[0059] 2. Robustness: This method can maintain stable performance in different types of power grid network attacks, especially showing high robustness when dealing with complex and changeable attack environments.

[0060] 3. Real-time response: Through the introduction of LSTM, the present invention can analyze the real-time data in the power grid and quickly identify potential network attacks, thereby reducing the impact on the power system and improving the overall security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] Figure 1 It is a suggested structural diagram of the LSTM topology provided according to an embodiment of the present invention;

[0062] Figure 2 is a flow chart of a detection framework provided according to an embodiment of the present invention;

[0063] Figure 3 is an optimal hyperparameter structure diagram of a neural network provided according to an embodiment of the present invention;

[0064] Figure 4 It is a structure diagram of ROC curves related to DoS attacks and DDoS attacks provided in accordance with an embodiment of the present invention. DETAILED DESCRIPTION

[0065] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0066] The technical solution of the present invention is further described below in conjunction with the accompanying drawings.

[0067] Figure 1 The proposed structure diagram of the LSTM topology shows the internal structure of the memory unit and the interaction of various gating mechanisms. Specifically, the figure shows how the input signal x(t) regulates the state change of the memory unit through three gating units (α(t), ψ(t), and β(t)). Among them, α(t) determines the change state of the memory unit, ψ(t) identifies the memory state to be changed based on the input of the previous time step, and β(t) is responsible for remembering the state. Finally, the processed output h(t) is generated from the memory unit for subsequent calculations.

[0068] Figure 2 The flowchart of the proposed detection framework shows the entire processing flow from the input layer to the output layer. Specifically, after the input layer receives the data, it is preprocessed by the threshold definer to filter out negative values ​​and ensure that only positive values ​​are passed. The LSTM subsystem then processes these preprocessed data and performs overfitting checks in the process to ensure the effectiveness of the network. Next, the interconnected layer acts as a hidden layer to further process the data, and finally the data classifier classifies the data into two categories: clean data and malicious data, and finally the final classification result is given in the output layer.

[0069] Figure 3 The first embodiment is shown. In this embodiment, the proposed method is coded in the MATLAB 2018B environment and simulated and verified on a computer equipped with an Intel (R) Core (TM) i5-7500 CPU @ 3.4GHz processor. In order to solve the formula The optimization problem in , the population size and the maximum number of iterations of the algorithm are set to 200 and 100 respectively. The main goal of this embodiment is to improve the performance of the neural network by optimizing its internal parameters. Two different case studies are considered in the experiment, and the performance of the detection framework is evaluated from different perspectives. During the simulation process, key parameters are set: the initial value of the learning rate is 0.00001, and the batch size is 3000. These two parameters directly affect the training speed and effect of the neural network. The learning rate determines the speed at which the neural network adapts to the problem, while the batch size indicates the number of samples processed before the next iteration. In order to verify the generalization ability of the model, 75% of the data is used for training in the experiment, and the remaining 25% of the data is used to test the model performance.

[0070] Figure 3 (a) shows the effect of the end layer ratio on the model accuracy. The results show that when the end layer ratio is close to 0.175, the model accuracy is the highest. Figure 3 (b) shows the optimization curve of the number of hidden layers, and the optimal number of hidden layers is 400; Figure 3 (c) shows the effect of the number of LSTM subsystems on the model accuracy. When the number of LSTM subsystems is 8, the model has the best performance. Therefore, the optimal parameters in this embodiment are set as: end layer rate 0.175, number of hidden layers 400, and number of LSTM subsystems 8.

[0071] Figure 4 A second embodiment is shown, and this embodiment uses the CIC-IDS2017 data set for example testing. The CIC-IDS2017 data set was developed by the Canadian Institute for Cyber ​​Security (CIC) and is used to evaluate the performance of intrusion detection systems (IDS). The data set contains the latest network attacks, simulates the real-world network environment, and the data format is a pcap file. In addition, the data set also performs network traffic analysis through CICFlowMeter to generate a csv file of network traffic characteristics. CICFlowMeter is an Ethernet bidirectional traffic generator and analyzer that can mark traffic according to timestamps, source and destination IPs, source and destination ports, and the final protocol and attack type. In order to verify the effectiveness of the detection method proposed in the present invention, this embodiment evaluates its detection effect on two destructive network attacks on the CIC-IDS2017 data set, including denial of service (DoS) attacks and distributed denial of service (DDoS) attacks.

[0072] Figure 4 It is a ROC curve diagram, which shows the performance of this embodiment when detecting two network attacks. Figure 4In (a), the ROC curve corresponds to the detection performance of DoS attacks. The detection results show that the sensitivity of the detection mechanism proposed in the present invention to DoS attacks reaches 91.73%, that is, it can detect DoS attacks more efficiently at a lower false positive rate. Figure 4 (b) shows the detection performance of DDoS attacks. The results show that its sensitivity reaches 99.59%, indicating that the present invention has extremely high detection capabilities when dealing with DDoS attacks. By comparing the ROC curves in the two figures, it can be concluded that the detection mechanism proposed in the present invention shows extremely high accuracy in distinguishing normal traffic from malicious traffic, among which the detection effect of DDoS attacks is better than that of DoS attacks, and it can detect two types of network attacks with an accuracy rate of more than 97%. This shows that the proposed method has strong adaptability and efficiency in dealing with different types of network attacks.

[0073] Example 1 of the present invention provides a power grid network attack detection method based on deep learning, comprising the following steps:

[0074] Step 1: collect voltage, current, power and frequency data of power grid nodes in real time, divide node groups by region, and process voltage, current, power and frequency data by node groups in layers; segment the layered data using a fixed time window to generate a layered segmented data set;

[0075] Preferably, step 1 comprises:

[0076] Collect real-time data from each operating node of the power grid, including the voltage, current, power and frequency of the node. The collected data is transmitted to the data center through the remote terminal unit (RTU) and intelligent electronic device (IED);

[0077] Based on the topological structure of the power grid, the power grid operation nodes are divided into multiple regional groups according to their geographical locations and functional characteristics, and each regional group contains interrelated nodes;

[0078] The node operation data of each layer is segmented and processed according to fixed time windows, including dividing into independent data segments according to time intervals of 1 second, 10 seconds and 1 minute to capture the operation characteristics of different time granularities;

[0079] The voltage, current and power of each segment of hierarchical data are normalized respectively, and the normalized hierarchical segmented data are stored as a multidimensional data set. Each data set includes a time dimension, a space dimension and a characteristic dimension. The time dimension is used to record the time segment information of the data; the space dimension is used to record the area or topological position of the node; the characteristic dimension contains the standardized values ​​of voltage, current, power and frequency.

[0080] Preferably, the division is into multiple regional groups, each of which contains mutually related nodes, and the hierarchical rules are as follows:

[0081] According to the physical location of the nodes, there are city-level, regional-level and provincial-level power grids;

[0082] According to the role of nodes in the power grid, they include main grid nodes and distribution nodes; main grid nodes include substations, and distribution nodes include end users.

[0083] Preferably, an intelligent weighting mechanism is used for the collected data to assign dynamic weights to the data of different nodes according to the operating status of the power grid (such as load, frequency fluctuation, etc.). The weight calculation formula is:

[0084]

[0085] Among them, w i is the weight of node i, α i Indicates the priority of node i in the current power grid state.

[0086] The collected data is standardized and the standardization formula is:

[0087]

[0088] Among them, x is the original data, μ is the mean, σ is the standard deviation, and x norm is the standardized data;

[0089] Step 2: Based on the hierarchical and segmented data set, extract the feature information of different types of network attacks; obtain the features of false data injection, denial of service and distributed denial of service attacks by analyzing the abnormal changes in the time series, the changes in node access frequency and the frequency domain characteristics, and fuse the time series features, spatial features and frequency domain features to generate a comprehensive feature set;

[0090] Preferably, step 2 comprises:

[0091] Based on the generated standardized hierarchical data set, the dependencies of time series are captured through long short-term memory networks to identify anomalies in the operation data of power grid nodes that continuously deviate from the normal range. The distribution of abnormal deviations of time series is constructed by dynamically comparing the historical state with the current state, which is used as the feature of false data injection attack to identify the time offset features in the node operation data.

[0092] The topological structure between power grid nodes is modeled through graph convolutional networks, the spatial distribution characteristics of node access frequency in the power grid are extracted, network load anomalies are identified, and node overload characteristics are extracted by comparing the changes in node centrality between normal and attack states.

[0093] Through fast Fourier transform, the time domain signal is converted into the frequency domain signal, the abnormal distribution characteristics of the frequency domain are extracted, and the bandwidth occupancy anomaly caused by distributed attacks is identified;

[0094] The extracted time offset features, node overload features, and frequency domain abnormal distribution features are analyzed for their importance. Based on the contribution of each feature to the classification of the target attack type, the screened time series features, spatial features, and frequency domain features are weighted fused. The weight is calculated according to the contribution of each feature to the target attack classification, and they are fused according to the contribution ratio to finally generate a comprehensive feature set.

[0095] The final generated comprehensive feature set includes relevant features of false data injection attacks, denial of service attacks and distributed denial of service attacks: time offset features, node overload features and frequency domain abnormal distribution features.

[0096] Preferably, the importance analysis of the extracted time offset features, node overload features and frequency domain abnormal distribution features is performed based on the contribution of each feature to the classification of the target attack type, including:

[0097] Compare the changes in features under different attack types and monitor the extent of changes in each feature when different attacks occur, including:

[0098] By comparing the node voltage, current and power offsets of the time offset feature under the false data injection attack, which exceeds 5%, and the offsets under other attack types, which are within 5%, the time offset feature offsets are sorted from large to small, and the corresponding contributions are allocated in turn;

[0099] By comparing the access frequency of nodes with node overload characteristics in denial of service attacks, which increases by 30%, and the increase is less than 30% in other types of attacks, we first sort the offsets of these node overload characteristics from large to small, sort the access frequencies of node overload characteristics from large to small, and assign corresponding contributions in turn;

[0100] By performing fast Fourier transform on the power grid frequency domain signal and comparing the bandwidth occupancy fluctuations of the nodes, if the standard deviation of the frequency signal increases by more than 50% and the standard deviation increases by less than 50% under other attack types, the standard deviations of the frequency domain abnormal features are sorted from large to small and the corresponding contributions are allocated in sequence.

[0101] Preferably, the time series feature captures the time dependency of the data through a long short-term memory network (LSTM), and the update formula of the LSTM network is:

[0102] h t =σ1(W h ·[h t-1 ,x t ]+b h )

[0103] Among them, h t is the hidden state at the current moment, capturing important information in the input sequence and continuously updated with time steps; is the activation function, which transforms the linear combination result of the network into nonlinearity; W h is a weight matrix, which is a learnable parameter matrix used to adjust the current input x t and the hidden state h at the previous moment t-1 Weighting is performed to ensure that during network training, the model can adjust parameters based on these inputs and learn different patterns. The weight matrix W h The dimension of h depends on the dimension of the input and hidden state; t-1 is the hidden state at the previous moment; x t is the input at the current moment, which is the data measured by the power grid at time step t, such as voltage and power; b h It is a bias term used to adjust the weighted sum result to avoid the model output being zero and improve the performance of the network.

[0104] The spatial features are extracted through the graph convolutional network (GCN) to extract the topological relationship between the power grid nodes and dynamically model the dependency between the nodes. The update formula is:

[0105]

[0106] Among them, H (l+1) is the node feature matrix of the l+1th layer, which represents the output after the lth layer of graph convolution, and contains the updated features of each node in the graph; σ2(x)=max(0,x) is a nonlinear activation function, which performs a nonlinear transformation on the result after the convolution operation to enhance the expressiveness of the model; It is an adjacency matrix with self-loops added. Self-loops refer to adding an edge to each node to ensure that each node can retain its own information during the convolution process. The original adjacency matrix A represents the connection relationship of the graph. The element A ij Indicates whether there is an edge connecting nodes i and j. The self-loop is introduced by Implementation, where I is the identity matrix, representing the connection between each node and itself; is the degree matrix, the elements on the diagonal represent the degree of each node (that is, the number of edges of each node), Indicates how many other nodes each node is connected to, including self-loops; is the inverse square root of the degree matrix, which is used to calculate the adjacency matrix Normalization is performed to avoid the influence of node degree on feature update; H (l)The node feature matrix of the lth layer contains the features of all nodes in the graph at the lth layer. Each row of the matrix represents the feature vector of a node. (l) It is the learnable weight matrix of the lth layer, which is used to perform linear transformation on the features.

[0107] Frequency domain features are extracted from time domain data through fast Fourier transform (FFT), and the formula is:

[0108]

[0109] Among them, X(f) is the frequency domain signal, which represents the complex value at frequency f, reflecting the amplitude and phase information of the input signal at this frequency; x(n) is the time domain signal, which represents the value of the original signal at the nth sampling point; N is the number of sampling points, that is, the total number of data points collected by the signal in the time domain. Because the signal is discrete, a limited number of N sampling points is used to represent it; f is the frequency, which refers to the component of the signal at a specific frequency; e -j2πfn / N is a rotation factor used to transform the time domain signal into the frequency domain; j is an imaginary unit e -jθ Represents a complex rotation on a unit circle. 2πfn / N is an angle (radian) value, which represents the angle of rotation of the signal around the unit circle at a certain time n. The phase difference between different frequencies f and different sampling points n is expressed by this factor. This formula obtains the frequency domain signal X(f) by performing a complex rotation on each sampling point n of the time domain signal x(n) and summing all the sampling points.

[0110] Step 3: A power grid node group model is established based on a long short-term memory network and a graph convolutional network, and multiple power grid node group models constitute a distributed deep learning model; according to the comprehensive feature set, each power grid node group model obtains its own time-dependent features and node-related features under the optimal local objective function, and the distributed deep learning model synchronously optimizes the time-dependent features and node-related features of each power grid node group model under the optimal global objective function;

[0111] Preferably, step 3 comprises:

[0112] Based on the generated comprehensive feature set, a distributed deep learning model is constructed, including multiple power grid node group models, which are deployed at different nodes of the power grid. Each power grid node group model uses a long short-term memory network module to process temporal features and a graph convolutional network module to process spatial features. All power grid node group models share parameters through collaborative training and output attack detection results within the area.

[0113] The grid node group model adjusts parameters through local training, uploads them to the central server for global parameter update, and optimizes local parameter anomaly detection through reinforcement learning; global parameters are updated through weighted average and sent to the grid node group model;

[0114] The cross entropy loss function is used to optimize global parameters. The power grid node group model optimizes the detection accuracy through the local objective function, and the distributed Adam optimizer is used to optimize global and local parameters.

[0115] The grid node group model updates local parameters and uploads them to the server. The server aggregates the parameters and synchronously updates the global parameters. The training is iterated until the change in the global loss function is less than the threshold.

[0116] The grid node group model outputs the attack detection results of the node area and aggregates them to the central server to generate an attack detection report, including the attack type, affected nodes and propagation path.

[0117] Preferably, LSTM is responsible for processing time series features and predicting the future state of power grid nodes by capturing historical state values. The formula is: t =σ1(W h ·[h t-1 ,x t ]+b h );

[0118] RNN is responsible for capturing the complex dependencies between features, and the formula is:

[0119] s t =tanh(W s ·[s t-1 ,h t ]+b s )

[0120] Among them, s t is the state vector at the current moment, which represents the information about the input sequence stored by the network at that moment; is the activation function, mapping the input to the interval [-1,1]; W s Is the weight matrix, responsible for the state s at the previous moment t-1 and the current hidden state h t Weighted; t-1 is the state vector at the previous moment; h t is the hidden state at the current moment; b s It is a bias term that can provide valid output even when there is no input, preventing the network from falling into a dead zone (output is zero).

[0121] Preferably, the global parameters and local parameters are optimized as follows:

[0122]

[0123] Where L is the value of the loss function, which represents the error between the state of the power grid node and the true label; N is the total number of samples in the data set, which represents the number of collected power grid node data;

[0124] y i is the true label of the i-th sample, y i =0 means "normal", y i =1 means "attack";

[0125] p i is the state output value of the grid node of the i-th sample, ranging from 0 to 1; log(p i ) Calculate the logarithm of the state output value of the power grid node;

[0126] y i log(p i ) is the loss term for the positive class, when the true label y i =1 means being attacked, which mainly depends on log(p i ), if p i If p is equal to 0, it means that the attack is misidentified; if p i Equal to 1, indicating that the attack is correctly identified;

[0127] (1-y i )log(1-p i ) is the loss term for the negative class, when the true label y i = 0 means no attack, mainly depends on log(1-p i ), if p i If p is equal to 1, it means that the node that has not been attacked is identified as an attack; if p i Equal to 0, indicating that the nodes that are not attacked are identified as normal.

[0128] The significant difference between the present invention and the prior art is:

[0129] First, the detection scope is different. The prior art document 1 only detects FDI attacks, while the present invention constructs a deep learning model including LSTM and RNN, which can detect various types of network attacks such as FDI attacks, DoS attacks, DDoS attacks, etc.

[0130] Second, the parameter optimization methods are different. The prior art document 1 adopts basic Adam optimization and gradient descent optimization to update parameters, while the present invention introduces a fuzzy adaptive hybrid configuration method of SPSO and DE algorithms to optimize model parameters by dynamically adjusting the inertia weight and learning factor.

[0131] Third, the evaluation methods are different. The prior art document 1 only uses a simple detection flag function to judge the attack, while the present invention establishes a complete evaluation index system including accuracy, precision, recall rate and specificity.

[0132] Fourth, the data processing method is different. The present invention adds a threshold definer to pre-process the input data, and extracts time series features, spatial features and frequency domain features as model input.

[0133] The beneficial effects achieved by the present invention compared with the prior art are:

[0134] First, by building a hybrid deep learning model, the generalization ability of the detection framework is improved, enabling it to adapt to different types of attack scenarios and significantly improving detection accuracy.

[0135] Second, the fuzzy adaptive hybrid configuration method is used to optimize the model parameters, which enhances the model's adaptability and improves the stability and reliability of detection.

[0136] Third, a complete evaluation index system is established to achieve a comprehensive evaluation of detection performance and provide a more reliable performance measurement standard.

[0137] Fourth, through data preprocessing and feature extraction, the impact of data noise is reduced and the robustness of the model is improved.

[0138] Fifth, an adaptive update mechanism for the model is implemented, enabling the system to continuously adapt to new attack patterns and maintain high detection efficiency.

[0139] Step 4: Use the distributed deep learning model to generate a classification report containing the affected nodes and propagation paths, and plan the load redistribution and isolation strategy based on the real-time load and transmission status.

[0140] Preferably, step 4 comprises:

[0141] The attack detection report in the detection results of the distributed deep learning model includes the attack type, affected nodes and propagation path; the attack types include FDI attack, DoS attack and DDoS attack

[0142] Based on the attack detection report and the topological information of the power grid nodes, the risk score of each node of concern is evaluated and generated, and the response strategy is dynamically planned, including isolating the attacked nodes and reallocating the attacked nodes with abnormal loads.

[0143] Preferably, the step of evaluating and generating a risk score for each node of interest based on the attack detection report and the topology information of the power grid node includes:

[0144]

[0145] In the formula, S j Score the risk of the jth node; is the predicted attack probability of the i-th node; w ij is the connection weight between node i and node j, which is used to reflect the strength of the association between nodes.

[0146] Preferably, the classification result can determine whether each node is attacked by the following formula:

[0147]

[0148] in, is the prediction result of node i, indicating whether it is attacked. is the activation function, which normalizes the output to the range [0,1]; W is the model weight matrix, X i is the feature vector of node i, and b is the bias term.

[0149] By introducing a key node weighting mechanism, the model can dynamically adjust the data weight of each node, thereby more accurately identifying network attacks.

[0150] The alert mechanism is divided into the following levels:

[0151] Emergency level: When an important node or large-scale attack occurs, the power grid command center is notified immediately and an automatic defense strategy is initiated.

[0152] General level: For general attacks, an alert is sent to the zone operator, allowing manual intervention.

[0153] Information level: For low-impact abnormal situations, only record them in the log for subsequent analysis.

[0154] Feedback time T of the alarm mechanism f It can be calculated using the following formula:

[0155] T f =T d +T a +T r

[0156] Among them, T f is the total feedback time; T d is the data processing time; T a T is the attack identification time; r is the alarm response time.

[0157] Through the above detection and alarm mechanisms, the system can ensure that operators at all levels of the power grid can respond quickly and take appropriate countermeasures when a cyber attack occurs.

[0158] Through the adaptive update mechanism, the parameters are dynamically adjusted according to the newly detected attack mode. The core formula of the adaptive update is:

[0159]

[0160] Among them, θ t is the current parameter vector; θ t+1 is the updated parameter vector. At each iteration, the parameters are adjusted in the direction that can reduce the loss function value. η is the learning rate, which is used to control the step size of each parameter update. is the loss function with respect to the parameter θ t The gradient of L(θ) can gradually reduce the loss function value by updating the parameters along the negative gradient direction. t ) is the loss function, which measures the gap between the model's predicted output and the true label (i.e., the model's error).

[0161] This update formula ensures that the model can optimize parameter configuration in a timely manner according to new attack patterns and enhance the ability to detect new types of attacks.

[0162] In the model building step, the input of the LSTM subsystem is data processed by a threshold definer, and the threshold definer acts as a filter, only passing positive values ​​and adjusting negative values ​​to zero to reduce data noise; the LSTM subsystem includes multiple internal layers, which have the same probability distribution, and avoids overfitting by setting the input data, thereby improving the effectiveness of the model.

[0163] The interconnected layers of the RNN subsystem in the model building step are used as the hidden layers of the neural network, and a fuzzy adaptive hybrid configuration method, namely a joint adaptive particle swarm optimization (SPSO) and differential evolution (DE) algorithm, is used to find the optimal value of the hidden layer, the number of neurons in each hidden layer, and the probability distribution of each layer; the performance of the RNN subsystem is optimized by minimizing the perplexity index, and the perplexity is represented by the exponent of the cross entropy loss, and its calculation formula is: Where s is the number of samples and p is the predicted probability distribution.

[0164] In order to evaluate the effectiveness of the detection framework, four different evaluation indicators are defined, including accuracy (A), precision (P), recall (R) and specificity (S), and their calculation formulas are:

[0165]

[0166] Among them, Φ is a true positive example; γ is a true negative example; Θ is a false positive example; Γ is a false negative example.

[0167] The SPSO algorithm in the RNN subsystem dynamically adjusts the position and velocity of particles through the following steps:

[0168] The position of the nth particle at the τth iteration By formula calculate;

[0169] The particle speed By formula calculate;

[0170] In the formula, and denote the position of the nth particle at the τth and τ+1th iterations, respectively. and denote the speed of the nth particle at the τth and τ+1th iterations, respectively. α is the inertia weight of the particle. η1 and η2 are the individual and social learning factors of the particle, respectively. is the individual best position of the nth particle at the τth iteration, GB (τ) is the global optimal position of the entire population at the τth iteration, and Rand(·) represents the random number generation function.

[0171] The particle's inertia weight α is linearly reduced from 0.9 to 0.4 during the iteration process, specifically through the formula Dynamic adjustment, where α max and α min are the maximum and minimum values ​​of the inertia weight, τ max is the maximum number of iterations.

[0172] In order to solve the problem of the SPSO algorithm in the RNN subsystem taking too long to execute and / or converging to a suboptimal solution too early, a fuzzy inference system (FIS) is designed to dynamically set the inertia weight α of the particle, where the updated value of the inertia weight α Updated Through the formula α Updated =α Initial +Δα calculation, α Initial is the initial value of the inertia weight, and Δα is the improvement range allowed by FIS.

[0173] In the model adaptive update step, an adaptive mechanism is established to improve the convergence characteristics of the SPSO algorithm by dynamically setting the learning factors η1 and η2 of the particles during the iteration process, where the learning factor η i The calculation formula is Among them, δ is the inverse of the objective function value of the optimization problem, and f represents the objective function. The DE algorithm is combined with the SPSO algorithm, and operators such as mutation, crossover, and selection are added to the modified SPSO algorithm to enhance its search ability and improve the efficiency of solving the global optimal solution.

[0174] Example 2 of the present invention provides a power grid network attack detection system based on deep learning, including: a data acquisition and preprocessing module, a feature extraction and construction module, a distributed deep learning model construction and training module, and an attack detection and response strategy module;

[0175] The data acquisition and preprocessing module is used to collect voltage, current, power and frequency data from power grid nodes in real time, divide node groups by region for hierarchical storage, and process data in segments using fixed time windows to generate standardized hierarchical data sets;

[0176] Feature extraction and construction module, used to extract features of hierarchical data sets, analyze time series, node access frequency and frequency domain characteristics, capture the features of false data injection, denial of service and distributed denial of service attacks, and integrate them into a comprehensive feature set;

[0177] The distributed deep learning model construction and training module is used to build a distributed deep learning model composed of a power grid node group model. The power grid node group model uses a long short-term memory network module to process timing features, a graph convolutional network module to process node association features, and optimizes local objective functions while optimizing parameters through global synchronization.

[0178] The attack detection and response strategy module is used to use deep learning models to identify attack types, generate classification reports including affected nodes and propagation paths, and plan load redistribution and isolation strategies based on real-time load and transmission status.

[0179] Compared with the prior art, the beneficial effects of the present invention include at least:

[0180] 1. Efficient detection capability: The detection method proposed in the present invention shows excellent detection capability in various network attacks (such as DoS, DDoS and FDI attacks), and the detection rate can reach 99.46%.

[0181] 2. Robustness: This method can maintain stable performance in different types of power grid network attacks, especially showing high robustness when dealing with complex and changeable attack environments.

[0182] 3. Real-time response: Through the introduction of LSTM, the present invention can analyze the real-time data in the power grid and quickly identify potential network attacks, thereby reducing the impact on the power system and improving the overall security of the system.

[0183] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0184] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A power grid network attack detection method based on deep learning, characterized in that: The following steps are involved: Step 1: collect voltage, current, power and frequency data of power grid nodes in real time, divide node groups by region, and process voltage, current, power and frequency data by node groups in layers; Using a fixed time window to segment the hierarchical data, a hierarchical segmented data set is generated; Step 2: Based on the hierarchical segmented data set, extract the feature information of different types of network attacks; obtain the features of false data injection, denial of service and distributed denial of service attacks by analyzing the abnormal changes in the feature information, changes in node access frequency and frequency domain characteristics, and integrate the time series features, spatial features and frequency domain features to generate a comprehensive feature set; Step 3: Establish a power grid node group model based on the long short-term memory network and the graph convolutional network, and multiple power grid node group models constitute a distributed deep learning model; according to the comprehensive feature set, each power grid node group model obtains its own time-dependent characteristics and node-related characteristics under the optimal local objective function, and the distributed deep learning model synchronously optimizes the time-dependent characteristics and node-related characteristics of each power grid node group model under the optimal global objective function; Step 4: Use the distributed deep learning model to generate a classification report containing affected nodes and propagation paths, and plan load redistribution and isolation strategies based on real-time load and transmission status.

2. The power grid network attack detection method based on deep learning according to claim 1 is characterized in that: Step 1 includes: The collected data is transmitted to the data center through remote terminal devices and intelligent electronic devices; Based on the topological structure of the power grid, the power grid operation nodes are divided into multiple regional groups according to their geographical locations and functional characteristics, and each regional group contains interrelated nodes; The node operation data of each layer is segmented and processed according to fixed time windows, including dividing into independent data segments according to time intervals of 1 second, 10 seconds and 1 minute to capture the operation characteristics of different time granularities; The voltage, current and power of each segment of hierarchical data are normalized respectively, and the normalized hierarchical segmented data are stored as a multidimensional data set; each data set includes a time dimension, a space dimension and a characteristic dimension; the time dimension is used to record the time segment information of the data; the space dimension is used to record the area or topological position of the node; the characteristic dimension contains the standardized values ​​of voltage, current, power and frequency, and finally a hierarchical segmented data set is generated.

3. The power grid network attack detection method based on deep learning according to claim 2 is characterized in that: The division is into multiple area groups, each area group contains interrelated nodes, and the layering rules are as follows: According to the physical location of the nodes, there are city-level, regional-level and provincial-level power grids; According to the role of nodes in the power grid, they include main grid nodes and distribution nodes; main grid nodes include substations, and distribution nodes include end users.

4. The power grid network attack detection method based on deep learning according to claim 1 is characterized in that: Step 2 includes: Based on the generated hierarchical segmented data set, the long short-term memory network is used to capture the dependencies of time series, identify anomalies in the power grid node operation data that continuously deviate from the normal range, and use the dynamic comparison between the historical state and the current state to construct the distribution of time series anomaly deviations as the feature of false data injection attacks, and identify the time offset features in the node operation data; The topological structure between power grid nodes is modeled through graph convolutional networks, the spatial distribution characteristics of node access frequency in the power grid are extracted, network load anomalies are identified, and node overload characteristics are extracted by comparing the changes in node centrality between normal and attack states. Through fast Fourier transform, the time domain signal is converted into the frequency domain signal, the abnormal distribution characteristics of the frequency domain are extracted, and the bandwidth occupancy anomaly caused by distributed attacks is identified; The importance of the extracted time offset features, node overload features, and frequency domain abnormal distribution features is analyzed. Based on their contribution to the classification of the target attack type, the screened time series features, spatial features, and frequency domain features are weighted fused. The weights are calculated according to their contribution to the target attack classification, and they are fused according to the contribution ratio to finally generate a comprehensive feature set. The final generated comprehensive feature set includes relevant features of false data injection attacks, denial of service attacks and distributed denial of service attacks: time offset features, node overload features and frequency domain abnormal distribution features.

5. A power grid network attack detection method based on deep learning according to claim 4, characterized in that: The importance analysis of the extracted time offset features, node overload features, and frequency domain abnormal distribution features is based on the classification contribution to the target attack type, including: Compare the changes in features under different attack types and monitor the extent of changes in each feature when different attacks occur, including: By comparing the node voltage, current and power offsets of the time offset feature under the false data injection attack, which exceeds 5%, and the offsets under other attack types, which are within 5%, the time offset feature offsets are sorted from large to small, and the corresponding contributions are allocated in turn; By comparing the access frequency of nodes with node overload characteristics in denial of service attacks, which increases by 30%, and the increase is less than 30% in other types of attacks, we first sort the offsets of these node overload characteristics from large to small, sort the access frequencies of node overload characteristics from large to small, and assign corresponding contributions in turn; By performing fast Fourier transform on the power grid frequency domain signal and comparing the bandwidth occupancy fluctuations of the nodes, if the standard deviation of the frequency signal increases by more than 50% and the standard deviation increases by less than 50% under other attack types, the standard deviations of the frequency domain abnormal features are sorted from large to small and the corresponding contributions are allocated in sequence.

6. The power grid network attack detection method based on deep learning according to claim 1 is characterized in that: Step 3 includes: Establish a power grid node group model. Multiple power grid node group models constitute a distributed deep learning model. Multiple power grid node group models are deployed at different nodes of the power grid. Each power grid node group model uses a long short-term memory network module to process temporal features and a graph convolutional network module to process spatial features. All power grid node group models share parameters through collaborative training and output attack detection results in the area. The grid node group model adjusts parameters through local training, uploads them to the central server for global parameter update, and optimizes local parameter anomaly detection through reinforcement learning; global parameters are updated through weighted average and sent to the grid node group model; The cross entropy loss function is used to optimize global parameters. The power grid node group model optimizes the detection accuracy through the local objective function, and the distributed Adam optimizer is used to optimize global and local parameters. The grid node group model updates local parameters and uploads them to the server. The server aggregates the parameters and synchronously updates the global parameters. The training is iterated until the change in the global loss function is less than the threshold. The grid node group model outputs the attack detection results of the node area and aggregates them to the central server to generate an attack detection report, including the attack type, affected nodes and propagation path.

7. A power grid network attack detection method based on deep learning according to claim 6, characterized in that: The global and local parameters are optimized as follows: Where l is the value of the loss function, which represents the error between the state of the power grid node and the true label; n is the total number of samples in the data set, which represents the number of collected power grid node data; y i is the true label of the i-th sample, y i =0 means "normal", y i =1 means "attack"; p i is the state output value of the grid node of the i-th sample, ranging from 0 to 1; log(p i ) Calculate the logarithm of the state output value of the power grid node; y i log(p i ) is the loss term for the positive class, when the true label y i =1 means being attacked, which mainly depends on log(p i ), if p i If it is equal to 0, it means that the attack is misidentified; If p i Equal to 1, indicating that the attack is correctly identified; (1-y i )log(1-p i ) is the loss term for the negative class, when the true label y i = 0 means no attack, which mainly depends on log(1-p i ), if p i If p is equal to 1, it means that the node that has not been attacked is identified as an attack; if p i Equal to 0, indicating that the nodes that are not attacked are identified as normal.

8. The power grid network attack detection method based on deep learning according to claim 1 is characterized by: Step 4 includes: The attack detection report in the detection results of the distributed deep learning model includes the attack type, affected nodes and propagation path; the attack types include FDI attacks, DoS attacks and DDoS attacks. According to the attack detection report and the topological information of the power grid nodes, the risk score of each node of concern is evaluated and generated, and the response strategy is dynamically planned, including isolating the attacked nodes and reallocating the attacked nodes with abnormal loads.

9. A power grid network attack detection method based on deep learning according to claim 8, characterized in that: The risk score of each node of interest is evaluated and generated based on the attack detection report and the topology information of the power grid node, including: In the formula, S j Score the risk of the jth node; is the predicted attack probability of the i-th node; w ij is the connection weight between node i and node j, which is used to reflect the strength of the association between nodes.

10. A power grid network attack detection system based on deep learning, comprising: Data collection and preprocessing module, feature extraction and construction module, distributed deep learning model construction and training module, and attack detection and response strategy module; characterized by: The data acquisition and preprocessing module is used to collect voltage, current, power and frequency data from power grid nodes in real time, divide node groups by region for hierarchical storage, and process data in segments using fixed time windows to generate standardized hierarchical data sets; Feature extraction and construction module, used to extract features of hierarchical data sets, analyze time series, node access frequency and frequency domain characteristics, capture the features of false data injection, denial of service and distributed denial of service attacks, and integrate them into a comprehensive feature set; The distributed deep learning model construction and training module is used to build a distributed deep learning model composed of a power grid node group model. The power grid node group model uses a long short-term memory network module to process timing features, a graph convolutional network module to process node association features, and optimizes local objective functions while optimizing parameters through global synchronization. The attack detection and response strategy module is used to use distributed deep learning models to identify attack types, generate classification reports including affected nodes and propagation paths, and plan load redistribution and isolation strategies based on real-time load and transmission status.

Images