False data injection attack position detection method and device for smart power grid, and medium

Abstract

The invention relates to a smart power grid false data injection attack position detection method and device and a medium, and the method comprises the following steps: S1, obtaining a measurement value of a monitoring and data collection system, defining the output classification of a label and an encoder, converting the measurement value into a vector, inputting the vector into the encoder, and carrying out the position encoding, thereby obtaining a relative position code; s2, inputting the position code into a multi-head attention mechanism layer of an encoder, and taking the output of the multi-head attention mechanism layer as the input of a feed-forward network of the encoder; and S3, inputting the output of the feed-forward network into a full connection layer of the encoder, outputting a prediction result of each position of the false data injection attack by the full connection layer, judging whether the prediction result is greater than a threshold value or not, if so, attacking the position, and otherwise, not attacking the position. Compared with the prior art, the method has the advantages of capturing complex spatial dependence characteristics, providing an accurate FDIA generation position in the whole power grid and the like.

Description

Technical Field

[0001] The present invention relates to the technical field of attack position detection, and in particular to a method, device and medium for detecting attack positions of false data injection into smart grids. Background Art

[0002] With the rapid development of industrial Internet of Things technology, the power system has undergone profound changes. Among them, smart grid has become one of the most important components of modern power system with its reliable and efficient characteristics. By widely integrating advanced information and communication technologies, smart grid has greatly improved the efficiency and reliability of the power grid. However, with the increasing threat of cyber attacks, the new information and communication technology systems adopted by smart grid and other Internet of Things networks are facing huge security challenges.

[0003] State estimation (SE) refers to the calculation of the state of the power network system based on the raw measurements collected by the Supervisory Control and Data Acquisition (SCADA) system, and plays a very important role in the smart grid control center. In particular, the attacked system state estimation may interfere with the operation of the power system, because many power system applications (such as economic dispatch, emergency analysis, etc.) rely on the results of state estimation.

[0004] Among all cyber attacks, false data injection attacks (FDIA) have become one of the most pressing challenges. The goal of FDIA is to compromise the state estimation of the power system by injecting false data into meter measurements. A well-structured FDIA can circumvent the traditional bad data detection (BDD) mechanism in SCADA systems and is therefore considered one of the most challenging threats to state estimation. Due to FDIA's ability to circumvent traditional residual detection methods, a successful false data injection attack can have a significant negative impact on the physical or economic functions of the power grid.

[0005] At present, the detection schemes for FDIA can be mainly divided into two types: model-based and data-driven. Early research mainly focused on mathematical modeling systems based on static data. However, the main disadvantage of model-based schemes is that they require explicit system models and parameters, and there is uncertainty in these parameters, which may produce erroneous detection results. Therefore, these algorithms are gradually unable to adapt to today's complex smart grid working scenarios.

[0006] In contrast, data-driven detection methods use data mining and machine learning methods to learn data relationships. The advantage is that they do not rely on system parameters and specific structures for detection, and can reduce detection errors caused by parameter and modeling uncertainties. In recent years, machine learning and deep learning algorithms have gradually been applied to the detection of malicious network attacks in smart grids, and the detection performance has been significantly improved compared to traditional detection methods. Deep learning methods allow the system to learn models directly from training data, and have achieved good results in FDIA detection.

[0007] However, existing methods have several drawbacks that hinder the further development of FDIA detection. In addition to its complex network characteristics, the power grid also has unique electrical characteristics, such as source-load correlation and functional similarity between buses. Existing methods can only capture local spatial dependencies and underestimate the global dependencies between unconnected buses in the power grid. In addition, existing methods almost only focus on detecting the existence of attacks, that is, whether there is a malicious attack. In practice, in addition to detecting whether there is an attack, it is also necessary to identify the attack location to quickly deploy effective countermeasures. Summary of the invention

[0008] The purpose of the present invention is to provide a method, device and medium for detecting the location of false data injection attacks in a smart grid in order to capture complex spatial dependency features and provide an accurate FDIA occurrence location in the entire power grid.

[0009] The purpose of the present invention can be achieved by the following technical solutions:

[0010] A method for detecting a location of a false data injection attack in a smart grid, the method comprising the following steps:

[0011] S1. Obtain the measurement values ​​of the monitoring and data acquisition system and define the labels and the output classification of the Transformer encoder, the label is used to train the Transformer encoder, the measurement value is converted into a vector and then input into the Transformer encoder for position encoding to obtain a relative position encoding;

[0012] S2, the position code is input into the multi-head attention mechanism layer of the Transformer encoder, the output of the multi-head attention mechanism layer is used as the input of the feedforward network of the Transformer encoder, the output of the feedforward network is input into the fully connected layer of the Transformer encoder, and the fully connected layer outputs the prediction results of each position of the false data injection attack;

[0013] S3. Determine whether the prediction result is greater than a threshold. If so, the location is attacked, otherwise it is not attacked.

[0014] Furthermore, the specific steps of converting the measured value into a vector and then inputting it into the Transformer encoder for position encoding to obtain the relative position encoding are:

[0015] After the measured value is converted into a vector, it is input into the activation function of the Transformer encoder for convolution operation, batch normalization and nonlinear transformation to generate high-dimensional features and obtain the feature map x j , for the feature map x j Compute the relative position encoding.

[0016] Furthermore, the feature map x j for:

[0017] x j =ReLU(z*h j +b j )

[0018] Among them, ReLU represents the activation function, z represents the vector, and h j represents the jth convolution kernel, b j represents the corresponding scalar bias.

[0019] Furthermore, the relative position is encoded as:

[0020]

[0021] Among them, pos represents the position index in the input sequence, i represents the index in the hidden dimension, and d model Represents the size of the hidden dimension, each dimension is sampled from a sine curve.

[0022] Furthermore, the specific steps of S2 are:

[0023] The position code is input into the multi-head attention mechanism layer of the Transformer encoder, the output of the multi-head attention mechanism layer passes through the first residual connection normalization layer, the output of the first residual connection normalization layer is input into the feedforward network, the output of the feedforward network passes through the second residual connection normalization layer, the second residual connection normalization layer is input into the fully connected layer, and the fully connected layer outputs the prediction results of each position of the false data injection attack.

[0024] Furthermore, the output of the first residual connection normalization layer is:

[0025] LayerNorm(X+MultiHeadAttention(X))

[0026] Among them, LayerNorm represents normalization processing, MultiHeadAttention represents multi-head attention mechanism layer processing, and X represents the input of the multi-head attention mechanism layer;

[0027] The input of the multi-head attention mechanism layer is divided according to the number of heads, and then multiplied by the corresponding weights to obtain the corresponding query, key, and value vectors. The query and key-value vectors are passed through the Softmax function as the output of each head. The outputs of each head are concatenated to generate the output of the multi-head attention mechanism layer.

[0028] The output of the multi-head attention mechanism layer is:

[0029] MultiHead(Q,K,V)=Concat(head1,...,head n )W O ,

[0030] Where Q, K, V represent query, key, and value vectors, Concat represents the concatenation function, head represents the head, n represents the number of heads, and W O Represents the weight, and MultiHead represents the output of the multi-head attention mechanism layer.

[0031] Furthermore, the feedforward network is a fully connected network, and the output of the second residual connection normalization layer is:

[0032] LayerNorm(X1+FeedForward(X1))

[0033] Among them, FeedForward represents the feedforward network, and X1 represents the input of the feedforward network.

[0034] Furthermore, the label is:

[0035]

[0036] Among them, Represents the label of the i-th position.

[0037] Another aspect of the present invention further provides a device for detecting the location of false data injection attacks in a smart grid, comprising a memory, a processor, and a program stored in the memory, wherein the processor implements the above method when executing the program.

[0038] Another aspect of the present invention provides a computer-readable storage medium having a program stored thereon, wherein the program implements the above method when executed.

[0039] Compared with the prior art, the present invention has the following beneficial effects:

[0040] The present invention formulates the FDIA position detection problem as a multi-label classification problem, and proposes a Transformer-based FDIA position detection model that takes into account the spatial dependency of the power grid. The self-attention mechanism is used to capture the global spatial dependency of the power grid topology, while paying attention to the local spatial dependency of the power grid topology. It can capture the inconsistency and concurrency correlation in the power flow measurement caused by potential attacks, and then capture the complex spatial dependency feature model. The model has good generalization ability and scalability, has better detection performance in the FDIA position detection problem, can accurately perform positioning detection under various noise and attack conditions, and has good robustness. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 is a flow chart of the present invention;

[0042] Figure 2 This is a feature extraction flow chart of the present invention. DETAILED DESCRIPTION

[0043] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0044] Example 1

[0045] The present invention proposes a method for detecting the location of a false data injection attack in a smart grid. The flowchart of the method is as follows: Figure 1 shown.

[0046] The method comprises the following steps:

[0047] S1. Obtain the measurement values ​​of the monitoring and data acquisition system and define the labels and the output classification of the Transformer encoder, the label is used to train the Transformer encoder, the measurement value is converted into a vector and then input into the Transformer encoder for position encoding to obtain a relative position encoding;

[0048] S2, the position code is input into the multi-head attention mechanism layer of the Transformer encoder, the output of the multi-head attention mechanism layer is used as the input of the feedforward network of the Transformer encoder, the output of the feedforward network is input into the fully connected layer of the Transformer encoder, and the fully connected layer outputs the prediction results of each position of the false data injection attack;

[0049] S3. Determine whether the prediction result is greater than a threshold. If so, the location is attacked, otherwise it is not attacked.

[0050] The model first receives measurements from a continuous series of discrete sampling time instances, i.e., when traditional state estimation takes place, i.e., the time instances where the sampling rates of SCADA systems range from 100 Hz (burst mode recording) to hourly readings.

[0051] The input (i.e., the measurement value), the ground-truth label (i.e., the classification of whether the instrument is attacked), and the output (i.e., the output classification of the Transformer) are represented as and The vector dimension is determined by the number of measurements in the power system. The ground-truth label of meter i at time t is determined according to the following rule:

[0052]

[0053] Output of the Transformer classifier is a continuous number between 0 and 1. Accordingly, the classifier defines a recognition threshold to quantize the output into 0 or 1.

[0054] After the smart grid measurement data is converted into a vector, the vector is then fed into the Transformer encoder to extract the positional features of the vector. First, the input vector is positionally encoded, and each filter in a convolutional layer is applied to the window of the input layer. High-dimensional features are generated by convolution operations, batch normalization, and nonlinear transformations using the rectified-linear unit (ReLU) activation function. The feature map x generated by the input data z j , which can be expressed as:

[0055] x j =ReLU(z*h j +b j )

[0056] h j is the jth convolution kernel, which is essentially a one-dimensional filter, b j is the corresponding scalar bias. The convolution operation is represented by *, and the output at position i is defined as:

[0057]

[0058] Through the above method, we get the high-dimensional feature encoding x. Next, we add position information to the sequence vector. The relative position encoding is expressed as:

[0059]

[0060]

[0061] Where pos represents the position and i represents the dimension. Each dimension of the relative position encoding is sampled from the sine curve.

[0062] After position encoding, the model uses a multi-head attention layer and a position feed-forward network to further extract the positional relationship of the feature vector. The model feature extraction process is as follows: Figure 2 shown.

[0063] The self-attention mechanism maps a query vector Q and a set of key-value vector pairs (K, V) to the output. The query vector Q and the key vector K are used to calculate the weights corresponding to each value vector V, and the weighted sum of the value vector V is used as the output. For the feature vector Z, the query vector Q, the key vector K and the value vector V, the relationship is expressed as:

[0064] Q=ZW Q

[0065] K=ZW K

[0066] V=ZW V

[0067] Finally, the output of self-attention is expressed as:

[0068]

[0069] Among them, Softmax is used for normalization of spatial dependence, and the scaling factor This prevents saturation caused by the Softmax function. Finally, the weighted sum is calculated to obtain a new feature representation.

[0070] On the basis of the self-attention mechanism, the multi-head attention mechanism is introduced to further enhance the feature extraction capability. Multi-head attention allows the model to simultaneously focus on information from different representation subspaces at different positions, specifically expressed as:

[0071] MultiHead(Q,K,V)Concat(head1,...,head n )W O ,

[0072] where head i =Attention(QW i Q ,KW i K ,VW i V )

[0073] After the self-attention layer, the model uses residual connections and layer normalization to make it easier for gradients to backpropagate, which helps train deep networks. Finally, the output of the multi-head attention layer is expressed as:

[0074] LayerNorm(X+MultiHeadAttention(X))

[0075] In addition to the multi-head attention layer, each layer of the encoder also contains a fully connected position feed-forward network, which is applied to each position separately. The fully connected layer is a two-layer neural network consisting of two linear transformations and a ReLU activation function in the middle, expressed as:

[0076] FFN(x)=max(0,xW1+b1)W2+b2

[0077] After the fully connected layer, the model also needs to be optimized through residual connection and layer normalization. Finally, the output of the position feedforward network is expressed as:

[0078] LayerNorm(X+FeedForward(X))

[0079] The model uses a fully connected layer and a Sigmoid activation function to convert the feature representation into a prediction result for each position of the FDIA, with a value between 0 and 1.

[0080]

[0081] The prediction result of each position is compared with the threshold. If it is greater than the threshold, the output is attacked (the prediction value is 1), otherwise the output is not attacked (the prediction value is 0).

[0082] Example 2

[0083] The present invention also provides a corresponding Figure 1 A schematic diagram of a smart grid false data injection attack location detection device. At the hardware level, the power load forecasting device based on causal characteristics may include multiple processors, an internal bus, a network interface, a memory, and a non-volatile memory, and of course may also include hardware required for other services. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 Of course, in addition to the software implementation, the present invention does not exclude other implementations, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0084] For the improvement of a technology, it can be clearly distinguished whether it is a hardware improvement (for example, improvement of the circuit structure of diodes, transistors, switches, etc.) or a software improvement (improvement of the method flow). However, with the development of technology, many improvements of the method flow today can be regarded as direct improvements of the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that the improvement of a method flow cannot be implemented with a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming themselves, without having to ask chip manufacturers to design and make dedicated integrated circuit chips. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0085] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0086] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0087] For the convenience of description, the above device is described as being divided into various units according to their functions. Of course, when implementing the present invention, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0088] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0089] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0090] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0091] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0092] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0093] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0094] Example 3

[0095] The present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed, the method in the embodiment is implemented.

[0096] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0097] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0098] It will be appreciated by those skilled in the art that embodiments of the present invention may be provided as methods, systems or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0099] The present invention may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. The present invention may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0100] Each embodiment of the present invention is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0101] The preferred specific embodiments of the present invention have been described. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

[0102] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A method for detecting the location of false data injection attacks in smart grids, characterized in that: The method comprises the following steps: S1. Obtain the measurement values ​​of the monitoring and data acquisition system and define the labels and the output classification of the Transformer encoder, the label is used to train the Transformer encoder, the measurement value is converted into a vector and then input into the Transformer encoder for position encoding to obtain a relative position encoding; S2, the position code is input into the multi-head attention mechanism layer of the Transformer encoder, the output of the multi-head attention mechanism layer is used as the input of the feedforward network of the Transformer encoder, the output of the feedforward network is input into the fully connected layer of the Transformer encoder, and the fully connected layer outputs the prediction results of each position of the false data injection attack; S3. Determine whether the prediction result is greater than a threshold. If so, the location is attacked, otherwise it is not attacked.

2. A method for detecting a location of a false data injection attack in a smart grid according to claim 1, characterized in that: The specific steps of converting the measured value into a vector and then inputting it into the Transformer encoder for position encoding to obtain the relative position encoding are as follows: After the measured value is converted into a vector, it is input into the activation function of the Transformer encoder for convolution operation, batch normalization and nonlinear transformation to generate high-dimensional features and obtain the feature map x j , for the feature map x j Compute the relative position encoding.

3. A method for detecting a location of a false data injection attack in a smart grid according to claim 2, characterized in that: The feature map x j for: x j =ReLU(z*h j +b j ) Among them, ReLU represents the activation function, z represents the vector, and h j represents the jth convolution kernel, b j represents the corresponding scalar bias.

4. A method for detecting a location of a false data injection attack in a smart grid according to claim 3, characterized in that: The relative position encoding is: Among them, pos represents the position index in the input sequence, i represents the index in the hidden dimension, and d model Represents the size of the hidden dimension, each dimension is sampled from a sine curve.

5. The method for detecting the location of false data injection attack in a smart grid according to claim 1, characterized in that: The specific steps of S2 are: The position code is input into the multi-head attention mechanism layer of the Transformer encoder, the output of the multi-head attention mechanism layer passes through the first residual connection normalization layer, the output of the first residual connection normalization layer is input into the feedforward network, the output of the feedforward network passes through the second residual connection normalization layer, the second residual connection normalization layer is input into the fully connected layer, and the fully connected layer outputs the prediction results of each position of the false data injection attack.

6. A method for detecting a location of a false data injection attack in a smart grid according to claim 5, characterized in that: The output of the first residual connection normalization layer is: LayerNorm(X+MultiHeadAttention(X)) Among them, LayerNorm represents normalization processing, MultiHeadAttention represents multi-head attention mechanism layer processing, and X represents the input of the multi-head attention mechanism layer; The input of the multi-head attention mechanism layer is divided according to the number of heads, and then multiplied by the corresponding weights to obtain the corresponding query, key, and value vectors. The query and key-value vectors are passed through the Softmax function as the output of each head. The outputs of each head are concatenated to generate the output of the multi-head attention mechanism layer. The output of the multi-head attention mechanism layer is: MultiHead(Q,K,V)=Concat(head1,...,head n )W O , Where Q, K, + represent query, key and value vectors, Concat represents the concatenation function, head represents the head, n represents the number of heads, and W O Represents the weight, and MultiHead represents the output of the multi-head attention mechanism layer.

7. A method for detecting a location of a false data injection attack in a smart grid according to claim 6, characterized in that: The feedforward network is a fully connected network, and the output of the second residual connection normalization layer is: LayerNorm(X1+FeedForward(X1)) Among them, FeedForward represents the feedforward network, and X1 represents the input of the feedforward network.

8. A method for detecting a location of a false data injection attack in a smart grid according to claim 1, characterized in that: The tags are: Among them, Represents the label of the i-th position.

9. A device for detecting a location of a false data injection attack in a smart grid, comprising a memory, a processor, and a program stored in the memory, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 8 is implemented.

10. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed, the method according to any one of claims 1 to 8 is implemented.

Images