Enhanced zero dynamic attack method for automatic voltage regulator

Abstract

The invention discloses an enhanced zero-dynamic attack method for an automatic voltage regulator, which comprehensively analyzes influence factors of zero-dynamic attack destructiveness, and enhances the zero-dynamic attack destructiveness by modifying attack signals and sacrificing certain concealment. A transfer function is used for representing a relation model between an input signal and an output signal of the automatic voltage regulator, destructive influence factors of zero-dynamic attacks are analyzed, a coefficient matrix of attack signals is adjusted, additional items are added, enhanced zero-dynamic attack signals are constructed, and the enhanced zero-dynamic attacks are initiated to the automatic voltage regulator. Compared with the existing zero-dynamic attack method, the enhanced zero-dynamic attack designed by the invention is stronger in destructiveness and wider in selectable attack objects.

Description

Technical Field

[0001] The present invention mainly relates to the technical field of zero dynamic attack, and in particular to an enhanced zero dynamic attack method for an automatic voltage regulator. Background Art

[0002] The power grid plays a vital role in the development of modern society. It not only ensures the continuous supply of electricity, supports the stable operation of economic activities, but also promotes technological innovation and the application of sustainable energy. Among the multiple components of the power grid, the automatic voltage regulator (AVR) system plays a core role. The AVR system is responsible for maintaining the stability of the generator output voltage and ensuring that the voltage level of the power grid fluctuates within a predetermined range, thereby protecting the power grid equipment and improving the efficiency of power transmission. The integration of the AVR system with the Supervisory Control and Data Acquisition (SCADA) system further enhances the operational efficiency and reliability of the power grid. The SCADA system monitors the operating status of the power grid in real time, collects key data, and feeds this data back to the AVR system. This high degree of interconnection allows the AVR to automatically adjust the control strategy and optimize voltage management according to the real-time changes in the power grid load.

[0003] Zero-dynamic attack is a network attack that has attracted people's attention in recent years. Zero-dynamic attack can silently change the operating status of equipment or trigger system failure, and even cause catastrophic consequences without being discovered. Its concealment and destructive power make defense and detection extremely complicated, and its potential harm is usually greater than false data injection attack and denial of service attack. It is an advanced false data injection attack. In non-minimum phase systems, due to the existence of unstable zero points, attackers can use the structural parameters of the system to construct attack signals. After the attack is injected into the system, the attacker manipulates the internal state of the control system to diverge, but the output behavior of the system remains the same as when it is not attacked. Due to the concealment of zero-dynamic attacks, traditional detection technologies are difficult to detect zero-dynamic attacks.

[0004] Taking the attack intensity as the starting point, there are three existing methods to increase the intensity of zero dynamic attacks. The first is to use the input and output signals of the system to separate the true zero dynamics and replace it with an auxiliary nominal zero dynamic. This alternative attack no longer requires precise model knowledge, but it is still destructive and hidden. The second is to obtain the degree of damage to the system by analysis, which depends on the state vector coefficient matrix of the designed attack signal. When the matrix is ​​greater than one, the zero dynamic attack is highly destructive, and the larger the matrix, the more destructive the attack is. The third is a method to avoid directly quantizing the attack signal to reduce the detection of the attack through the system output. This method is based on an improved version of dynamic quantization technology and zero dynamic attack, and uses the knowledge of system dynamics to make the error in the output less than the specified level. The present invention is to design the attack signal, while changing the attack signal coefficient matrix, to make additional additions to the internal state, so that after the attack signal is injected, the internal state of the system diverges faster, thereby enhancing the destructiveness of the zero dynamic attack, the attack effect is stronger, the application objects are wider, and it has broad application prospects. Summary of the invention

[0005] The present invention aims to solve the problems existing in the existing technology by providing a method for strengthening zero dynamic attack on automatic voltage regulator, aiming to solve the problems existing in practical applications. To achieve the above purpose, the present invention provides the following technical solution: a method for strengthening zero dynamic attack on automatic voltage regulator, specifically comprising the following steps:

[0006] S1: Construct an automatic voltage regulator AVR system model. The AVR system consists of an amplifier subsystem, an exciter subsystem, a generator subsystem, and a sensor subsystem. Each subsystem is described by a first-order transfer function defined by a gain and a time constant. Saturation and nonlinearity are ignored. The model is expressed as follows:

[0007] The transfer function of the amplifier is:

[0008]

[0009] The transfer function of the exciter is:

[0010]

[0011] The transfer function of the generator is:

[0012]

[0013] The transfer function of the sensor is:

[0014]

[0015] Among them, K a represents the gain of the amplifier transfer function, τ aRepresents the time constant of the amplifier's transfer function; K e represents the gain of the exciter transfer function, τ e K represents the time constant of the transfer function of the exciter; g represents the gain of the generator transfer function, τ g Represents the time constant of the generator transfer function; K s represents the gain of the sensor transfer function, τ s represents the time constant of the sensor's transfer function;

[0016] The open-loop transfer function of the AVR system can be expressed as:

[0017]

[0018] Under the action of PI controller, PI controller K p is the proportionality coefficient, K i is the integral coefficient, then the closed-loop system model of the AVR system is:

[0019]

[0020] in,

[0021] K0=K a K e K g K p

[0022] K1=K a K e K g K i

[0023] τ0=τ a τ e τ g τ s

[0024] τ1=τ a τ e τ g +τ a τ e τ s +τ a τ g τ s +τ e τ g τ s

[0025] τ2=τ a τ e +τ a τ g +τa τ s +τ e τ g +τ e τ s +τ g τ s

[0026] τ3=τ a +τ e +τ g +τ s

[0027] τ4=1+K a K e K g K p

[0028] τ5=K a K e K g K i

[0029] Select the state vector V e is the voltage error of the closed-loop system input, and the calculation formula of the state space representation is:

[0030]

[0031] y(t)=Cx(t) (7b)

[0032] Among them, A is the state matrix of the closed-loop system, B is the input matrix of the closed-loop system, C is the output matrix of the closed-loop system, x(t) is the state vector of the system, u(t) is the system input voltage error, y(t) is the output terminal voltage of the closed-loop system, is the change of the state vector of the closed-loop system;

[0033] S2: Analyze the destructive influencing factors of zero dynamic attack, including the coefficient matrix of the internal state in the attack signal design and the selection of additional terms in the internal state expression; the analysis of the influencing factors is specifically for a discrete system, and the general form of the state equation of the discrete system is:

[0034] x(t+1)=A n x(t)+B n u(t) (8a)

[0035] y(t)=C n x(t) (8b)

[0036] Among them, A n is the state matrix of the discrete system, B n is the input matrix of the discrete system, Cn is the output matrix of the discrete system, x(t) is the state vector of the discrete system, x(t+1) is the change of the state vector of the discrete system, u(t) is the input of the discrete system, y(t) is the output of the discrete system, A n , B n and C n The specific calculation formula is:

[0037]

[0038] The designed zero dynamic attack signal includes the internal state replacement vector and coefficient matrix as the attack model. The specific calculation formula is:

[0039] z e (t+1)=G e z e (t) (9a)

[0040] ae ( t)=C o z e (t) (9b)

[0041] Among them, z e (t) is the vector designed by the attacker to replace the original internal state of the discrete system, z e (t+1) is the change of the internal state of the design, G e is the coefficient matrix of the internal state change of the discrete system after the attack, a e (t) Attack data designed for the attacker, C o is the attack data transformation matrix. For such an attack signal and discrete system, the attack law is calculated as:

[0042]

[0043] Among them, Φ∈R, ||G e || is the absolute value of the determinant. The degree of damage to the discrete system depends on Φ, and the attack state z(t) depends entirely on G e ∈R (n-ρ)×(n-ρ) , ρ is the relative order of the discrete system, ||G e The larger || is, the faster the destruction is. At this time, the discrete system loses its internal state and the attack state tends to diverge;

[0044] S3: Adjust the coefficient matrix of the attack signal and add additional terms to construct an enhanced zero-dynamic attack signal. Apply the Euclidean algorithm to rewrite the transfer function as follows:

[0045]

[0046] Among them, Den(s) = Quo(s)Num(s) + Rem(s). Let deg Den = n, deg Num = m, deg Quo = n - m = p, deg Rem < m. The product of Quo(s) and Rem(s) constitutes the minimum-degree term of the polynomial, and the coefficient of the minimum-degree term in Quo(s) is 1 / b m ;

[0047] S4: Initiate a strengthened zero-dynamics attack based on the modeling of the automatic voltage regulator and the construction of the strengthened zero-dynamics attack signal, and verify the attack effect.

[0048] As a preferred technical solution of the present invention, the automatic voltage regulator AVR system model described in step S1 is specifically composed of the following modules:

[0049] P1: A controller, responsible for calculating the excitation current according to the signal provided by the voltage sensor;

[0050] P2: An amplifier, responsible for amplifying a small error signal to a level sufficient to drive the excitation current;

[0051] P3: An exciter, used to provide the excitation current required for the generator rotor to generate a rotating magnetic field;

[0052] P4: A generator, which converts mechanical energy into electrical energy;

[0053] P5: A sensor, used to monitor the output voltage of the generator in real time;

[0054] Among them, the AVR system uses the voltage error to regulate the generator output. The error signal is transmitted to the amplifier, and the amplifier regulates the exciter, thereby changing the magnetic field current of the generator to control the output voltage of the generator; subsequently, the output voltage converts the generator voltage into a suitable induction level through a step-down transformer; finally, the voltage sensor continuously monitors the output voltage and feeds it back into the control loop to maintain the required voltage level.

[0055] As a preferred technical solution of the present invention, a digital controller is used to operate the closed-loop system described in step S1. The input of the closed-loop system will be sampled at discrete times, and the sampled-data system in formulas (7a) and (7b) is expressed as:

[0056] x((m + 1)T s ) = G(T s )x(mT s ) + H(T s )u(mT s ) (12a)

[0057] y(mT s ) = C(Ts )x(mT s ) (12b)

[0058] Among them, G(T s ) is the system state matrix after sampling, H(T s ) is the system input matrix after sampling, C(T s ) is the output matrix of the system after sampling, u(mT s ) is the system input voltage error after sampling, x(mT s ) is the state vector after sampling, x((m+1)T s ) is the change of the system state vector after sampling, y(mT s ) is the system output terminal voltage after sampling, sampling time t=mT s , where T s represents the sampling period, m is an integer, and the input and output of the controller are respectively represented as u(mT S ) and y(mT S ), formula (12a) and formula (12b) are simplified to:

[0059] x(t+1)=Gx(t)+Hu(t) (13a)

[0060] y(t)=Cx(t) (13b)

[0061] Where G = G(T s ),H=H(T s ),C=C(T s ), x(t) is the system state vector selected after simplification.

[0062] As a preferred technical solution of the present invention, when there is no zero dynamic attack, the discrete system in step S2 undergoes a Byrnes-Isidori paradigm transformation to obtain the internal state change of the system:

[0063] φ(t+1)=G o φ(t)+M o N c δ(t) (14)

[0064] Among them, φ(t) is the internal state of the system after the conversion, φ(t+1) is the change of the internal state of the system after the conversion, G o is the internal state change matrix of the system after conversion, M o is the minimum implementation of the feedback path, N c =[1 0 0 0], δ(t) is the external state of the system after transformation, and the internal state change in the enhanced zero-dynamic attack is:

[0065] z e(t+1)=G e z e (t)+M o N c δ a (t) (15)

[0066] For formula (15), by recursively solving its expression, we get:

[0067]

[0068] in, It means that the discrete system has initial condition z e (0) For the spontaneously divergent part, the second term is the additional term M o N c δ a (t) Impact on system behavior, It's G e kth power, due to The behavior is exponential growth, The maximum eigenvalue of is λ, then (where λ>1), δ a (t) is a constant input vector with the same dimension as δ(t), and formula (16) is simplified to:

[0069]

[0070] The geometric series and of formula (17) can be further written as:

[0071]

[0072] From this we can get:

[0073]

[0074] When t→∞, λ t →∞, so the sum of formula (19) also tends to infinity, that is, the additional term M o N c δ a (t) accelerates the overall divergence speed of the discrete system.

[0075] As a preferred technical solution of the present invention, the attack signal in step S3 is enhanced by the following steps:

[0076] Formula (12a) and Formula (12b) are expressed by the Byrnes-Isidori form as follows:

[0077] φ(t+1)=G o φ(t)+M o N cδ(t) (20a)

[0078] δ(t+1)=(G c +M c λ T )δ(t)+M c b m (u(t)-N o φ(t)) (20b)

[0079] y(t)=N c δ(t) (20c)

[0080] Among them, δ(t) is the external state of the discrete system, δ(t+1) is the change of the external state of the discrete system, u(t) is the input of the discrete system, and the forward path is represented by the column vector of the output data corresponding to the discrete system. G o 、M o and N o is the minimum implementation of the feedback path after conversion; 1 / b m is the coefficient in Quo(s), λ T is the solution of formula (21b), G c 、M c 、N c The calculation formula is:

[0081] δ(t)=[y(t) y(t+1) y(t+2) y(t+3)] T (21a)

[0082] λ T δ(t)=y(t)+b m N o φ(t)-b m u(t) (21b)

[0083]

[0084] M c =[0 0 0 1] T (21d)

[0085] N c =[1 0 0 0] (21e)

[0086] In order to optimize the attack strength, the attack model has been modified. The modified attack model is:

[0087] z e (t+1)=G e z e (t)+M o N c δ a(t) (22a)

[0088] a e (t) = N o z e (t) (22b)

[0089] Among them, N o To strengthen the attack data transformation matrix, we design z e (t) is designed to destroy the closed-loop system and deceive the administrator. e (t) is mainly to destroy the stability of the internal state of the system. After being attacked by this enhanced zero-dynamic attack, the internal state will diverge. The destructiveness of the enhanced zero-dynamic attack is determined by G e and M o N c δ a (t) determines when ||G e The system will crash only when ||>1, G e The larger the value, the faster the discrete system collapses. In this case, the discrete system loses its internal state and the attack state tends to diverge.

[0090] As a preferred technical solution of the present invention, the step S4 is to launch an enhanced zero dynamic attack on the automatic voltage regulator based on the modeling of the automatic voltage regulator and the construction of the enhanced zero dynamic attack signal, wherein the calculation formula of the system model under the zero dynamic attack is:

[0091] φ(t+1)=G o φ(t)+M o N c δ(t) (23a)

[0092] δ(t+1)=(G c +M c λ T )δ(t)+M c b m (u(t)+a(t)-N o φ(t)) (23b)

[0093] y(t)=N c δ(t) (23c)

[0094] Among them, a(t) is the attack signal, G c 、M c 、N c The calculation formulas are in formula (21c), formula (21d), and formula (21e);

[0095] Construct an attack signal that matches the zero dynamics of the system after the attack, so that the internal state of the system is separated from the external state:

[0096] z(t+1)=G o z(t) (24a)

[0097] a(t)=N o z(t) (24b)

[0098] Where a(t) represents the attack data added to u(t) through logical operations, and z(t) is the state vector calculated by the attacker using the system matrix. After the system is attacked, formulas (20a), (20b), and (20c) are transformed into:

[0099] z(t+1)=G o z(t) (25a)

[0100] δ(t+1)=(G c +M c λ T )δ(t)+M c b m u(t) (25b)

[0101] y(t)=N c δ(t) (25c)

[0102] Injecting the designed enhanced zero dynamic attack signal into the AVR, we can get:

[0103] z e (t+1)=G e z e (t)+M o N c δ a (t) (26a)

[0104] δ e (t+1)=(G c +M c λ T )δ e (t)+M c b m u(t) (26b)

[0105] y e (t) = N c δ e (t) (26c)

[0106] Among them, y e (t) represents the output data after the enhanced attack, δ e (t) is the external state of the system after the enhanced attack, δ e (t+1) is the change of the external state of the system after the enhanced attack. Compared with the ordinary zero-dynamic attack, ||G e||, so that ||G e ||≥1, and an additional term M is introduced when constructing the attack signal o N c δ a (t), these two elements together produce a more destructive enhanced zero-dynamic attack signal.

[0107] Compared with the related prior art, the beneficial effects of the present invention are:

[0108] Accelerating system instability: By modifying the coefficient matrix of the attack signal and adding additional items to the internal state, the method of the present invention can quickly cause the divergence of the internal state of the automatic voltage regulator system, significantly accelerate the instability of the system, and cause the system to transition from a normal state to a fault state in a very short time.

[0109] Efficiently bypass feedback mechanism: Enhanced zero-dynamic attacks cleverly bypass the system's feedback control mechanism, making the attack more covert and destructive, and unable to be effectively detected or compensated by conventional control strategies, thereby ensuring the maximum attack effect.

[0110] Powerful destructive capability: Compared with traditional attack methods, the method of the present invention can more efficiently disrupt the internal state of the system, causing the voltage regulation function of the system to fail quickly and posing a serious threat to the stability of the entire power system.

[0111] Reduce response time: By introducing additional items, the internal state of the system quickly deviates from the normal range, thereby significantly reducing the response time of the system from stability to collapse, enhancing the immediate destructiveness of the attack, and bringing higher risks to the power network and critical infrastructure.

[0112] Precise control of attack effects: The attack design of the present invention can flexibly adjust additional items and coefficient matrices according to actual needs, so that the attack has controllable and customized characteristics to achieve precise strikes on specific system targets. BRIEF DESCRIPTION OF THE DRAWINGS

[0113] Figure 1 A schematic diagram of a flow chart of an enhanced zero dynamic attack method for an automatic voltage regulator proposed by the present invention;

[0114] Figure 2 Provides a system structure diagram of an automatic voltage regulator in an embodiment of the present invention;

[0115] Figure 3 Provide a block diagram of a closed-loop automatic voltage regulator control system in an embodiment of the present invention;

[0116] Figure 4 A schematic diagram of an attack signal injection automatic voltage regulator system in an embodiment of the present invention is provided;

[0117] Figure 5 Provide state variables, internal states and external state changes of an automatic voltage regulator system with zero-point instability under zero dynamic attack in an embodiment of the present invention;

[0118] Figure 6 The present invention provides state variables, internal states and external state changes of the automatic voltage regulator system under enhanced zero dynamic attack in an embodiment. DETAILED DESCRIPTION

[0119] The present invention is further described below in conjunction with the accompanying drawings and examples. However, the present invention can be implemented in many different ways and should not be construed as being limited to the embodiments shown; on the contrary, these embodiments provide those skilled in the art with implementation methods that meet applicable legal requirements.

[0120] Example 1: According to Figure 1 As shown in FIG. 1 , a complete workflow of a method for strengthening zero dynamic attack on an automatic voltage regulator according to the present invention is shown; the system to which the method is applied is as follows Figure 2 As shown, the specific system structure includes: a controller responsible for calculating the excitation current based on the signal provided by the voltage sensor; an amplifier responsible for amplifying the smaller error signal to a level that can drive the excitation current; an exciter that provides the excitation current required by the generator rotor to generate a rotating magnetic field; a generator that converts mechanical energy into electrical energy; and a sensor responsible for real-time monitoring of the output voltage of the generator.

[0121] S1: Construct an automatic voltage regulator (AVR) system model, the AVR system consists of an amplifier, an exciter, a generator and a sensor, each subsystem is described by a first-order transfer function defined by gain and time constant, ignoring saturation and nonlinearity, the automatic voltage regulator (AVR) system model, the system consists of the following modules: P1: controller, responsible for calculating the excitation current based on the signal provided by the voltage sensor; P2: amplifier, responsible for amplifying the small error signal to a level sufficient to drive the excitation current; P3: exciter, used to provide the excitation current required by the generator rotor to generate a rotating magnetic field; P4: generator, converting mechanical energy into electrical energy; P5: sensor, used to monitor the output voltage of the generator in real time; Among them, the AVR system uses the voltage error to adjust the generator output, the error signal is transmitted to the amplifier, the amplifier adjusts the exciter, and then changes the field current of the generator to control the output voltage of the generator; then, the output voltage converts the generator voltage to a suitable induction level through a step-down transformer; finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage level.

[0122] The control system block diagram is as follows Figure 3As shown in the figure, the AVR system model consists of four subsystems: amplifier, exciter, generator and sensor. Each subsystem can be modeled by a first-order transfer function defined by gain and time constant, ignoring saturation and nonlinearity. The AVR system uses voltage error to regulate the generator output. The error signal is sent to the amplifier, and the amplifier adjusts the exciter. Next, the exciter changes the field current of the generator to control the output voltage of the generator. The output voltage then passes through a step-down transformer to convert the generator voltage into a suitable sensing level. Finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the desired voltage. As shown in the figure Figure 4 The AVR system shown is connected to the SCADA system through the network. The SCADA system monitors the real-time operation status of the power grid, collects key data, and feeds it back to the AVR system. The input voltage error passes through the PI controller, then through the zero-order holder, and finally inputs into the AVR system. The output is then obtained by the AVR system and fed back to the SCADA system and PI controller through the network. The attack signal a(t) is injected at the input through the network. Its model is expressed as follows:

[0123] The transfer function of the amplifier is:

[0124]

[0125] The transfer function of the exciter is:

[0126]

[0127] The transfer function of the generator is:

[0128]

[0129] The transfer function of the sensor is:

[0130]

[0131] The gain of the amplifier is represented by K a The time constant is τ a Indicates; the transfer function of the exciter is the gain K e The time constant is τ e Indicated by: The transfer function between the generator terminal voltage and the field voltage is expressed by gain K g and the time constant τ g to describe; sensor gain is K s The time constant is τ s The open-loop transfer function of the system can be expressed as:

[0132]

[0133] Under the action of PI controller, PI controller K p is the proportionality coefficient, K i is the integral coefficient, then the closed-loop system model is:

[0134]

[0135] where

[0136] K0 = K a K e K g K p

[0137] K1 = K a K e K g K i

[0138] τ0 = τ a τ e τ g τ s

[0139] τ1 = τ a τ e τ g + τ a τ e τ s + τ a τ g τ s + τ e τ g τ s

[0140] τ2 = τ a τ e + τ a τ g + τ a τ s + τ e τ g + τ e τ s + τ g τ s

[0141] τ3 = τ a + τ e + τ g + τ s

[0142] τ4 = 1 + K a K e K g K p

[0143] τ5 = K aK e K g K i

[0144] Select the state vector V e is the voltage error of the system input, and the calculation formula of the state space representation is:

[0145]

[0146] y(t)=Cx(t) (7b)

[0147] Among them, A is the state matrix of the system, B is the input matrix of the system, C is the output matrix of the system, x(t) is the state vector of the system, u(t) is the input voltage error of the system, y(t) is the output terminal voltage of the system, is the change of the system state vector;

[0148] The system described in step S1 is operated by a digital controller. The input of the system is sampled at discrete moments. The sampled data system in formula (7) is expressed as:

[0149] x((m+1)T s )=G(T s )x(mT s )+H(T s )u(mT s ) (8a)

[0150] y(mT s )=C(T s )x(mT s ) (8b)

[0151] Among them, G(T s ) is the system state matrix after sampling, H(T s ) is the system input matrix after sampling, C(T s ) is the output matrix of the system after sampling, u(mT s ) is the system input voltage error after sampling, x(mT s ) is the state vector after sampling, y(mT s ) is the system output terminal voltage after sampling, sampling time t=mT s , where T s represents the sampling period, m is an integer, and the input and output of the controller are respectively represented as u(mT s ) and y(mT s ), formula (8a) and formula (8b) are simplified to:

[0152] x(t+1)=Gx(t)+Hu(t) (9a)

[0153] y(t)=Cx(t) (9b)

[0154] Where G = G(T s ),H=H(T s ),C=C(T s ), x(t) is the selected system state vector, x(t+1) is the change of the simplified system state vector, u(t) is the system input voltage error, and y(t) is the system output terminal voltage.

[0155] S2: Analysis of the destructive influencing factors of zero dynamic attack, including the coefficient matrix of the internal state in the attack signal design and the selection of additional terms in the internal state expression; the analysis of the influencing factors is specifically for a discrete system, and the general form of the state equation of the system is:

[0156] x(t+1)=A n x(t)+B n u(t) (10a)

[0157] y(t)=C n x(t) (10b)

[0158] Among them, A n is the state matrix of the discrete system, B n is the input matrix of the discrete system, C n is the output matrix of the discrete system, x(t) is the state vector of the discrete system, u(t) is the input of the discrete system, y(t) is the output of the discrete system, A n , B n and C n The specific calculation formula is:

[0159]

[0160] The designed zero dynamic attack signal includes the internal state replacement vector and coefficient matrix as the attack model. The specific calculation formula is:

[0161] z e (t+1)=G e z e (t) (11a)

[0162] a e (t) = C o z e (t) (11b)

[0163] Among them, z e (t) is the vector designed by the attacker to replace the original internal state of the system, z e(t+1) is the change of the internal state of the design, G e is the coefficient matrix of the internal state change of the system after the attack, a e (t) Attack data designed for the attacker, C o is the attack data transformation matrix. For such an attack signal and system, the attack law is calculated as:

[0164]

[0165] Among them, Φ∈R, ||G e || is the absolute value of the determinant. The degree of damage to the system depends on Φ, and the attack state z(t) depends entirely on G e ∈R (n-ρ)×(n-ρ) , ρ is the relative order of the system, ||G e The larger the ||, the faster the destruction. At this point, the system loses its internal state and the attack state tends to diverge.

[0166] Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero dynamic attack signal, an enhanced zero dynamic attack is launched on it. The injection method is as follows Figure 4 shown.

[0167] When there is no zero-dynamic attack, the system described in step S2 undergoes a Byrnes-Isidori paradigm transformation to obtain the internal state change of the system:

[0168] φ(t+1)=G o φ(t)+M o N c δ(t) (13)

[0169] Among them, φ(t) is the internal state of the system after the conversion, φ(t+1) is the change of the internal state of the system after the conversion, G o is the internal state change matrix of the system after conversion, M o is the minimum implementation of the feedback path, N c =[1 0 0 0], δ(t) is the external state of the system after transformation, and the internal state change in the enhanced zero-dynamic attack is:

[0170] z e (t+1)=G e z e (t)+M o N c δ a (t) (14)

[0171] Among them, z e (t) is the vector designed by the attacker to replace the original internal state of the system, z e (t+1) is the change of the internal state of the design, Ge is the coefficient matrix of the internal state change of the system after the attack, and a e (t) is the attack data designed by the attacker; for formula (14), by recursively unraveling its expression, we get:

[0172]

[0173] where represents the part where the system spontaneously diverges due to the initial condition z e (0), and the second term is the additional term M o N c δ a (t)'s influence on the system behavior, where k and t are integers, is the k-th power of G e , and since 's behavior is exponential growth, 's largest eigenvalue is λ, then we have (where λ > 1), and formula (15) simplifies to:

[0174]

[0175] The geometric series sum of formula (16) is further written as:

[0176]

[0177] From this, we can obtain:

[0178]

[0179] When t → ∞, λ t → ∞, so the sum of the above formula also tends to infinity, that is, the additional term M o N c δ a (t) accelerates the overall divergence speed of the system.

[0180] S3: Adjust the coefficient matrix of the attack signal and increase the additional term to construct a strengthened zero-dynamics attack signal, and use the Euclidean algorithm to rewrite the transfer function as:

[0181]

[0182] where Den(s) = Quo(s)Num(s) + Rem(s), let deg Den = n, deg Num = m, deg Quo = n - m = p, deg Rem < m, where the product of Quo(s) and Rem(s) constitutes the smallest-degree term of the polynomial, and the coefficient of the smallest-degree term in Quo(s) is 1 / b m ;

[0183] The attack signal is enhanced by the following steps: Formula (8a) and Formula (8b) are expressed by the Byrnes-Isidori paradigm as follows:

[0184] φ(t+1)=G o φ(t)+M o N c δ(t) (20a)

[0185] δ(t+1)=(G c +M c λ T )δ(t)+M c b m (u(t)-N o φ(t)) (20b)

[0186] y(t)=N c δ(t) (20c)

[0187] Among them, φ(t) is the internal state of the system after conversion, φ(t+1) is the change of the internal state of the system after conversion, δ(t) is the external state of the system after conversion, δ(t+1) is the change of the external state of the system after conversion, G o is the system internal state change matrix, u(t) is the system input, and the forward path is represented by the column vector of the output data corresponding to the system. o 、M o and N o is the minimum implementation of the feedback path after conversion; 1 / b m is the coefficient in Quo(s), λ T is the solution of formula (21b), G c 、M c 、N c The calculation formula is:

[0188] δ(t)&=[y(t) y(t+1) y(t+2) y(t+3)] T (21a)

[0189] λ T δ(t)&=y(t)+b m N o φ(t)-b m u(t) (21b)

[0190]

[0191] M c =[0 0 0 1] T (21d)

[0192] N c=[1 0 0 0] (21e)

[0193] In order to optimize the attack strength, the attack model has been modified. The modified attack model is:

[0194] z e (t+1)=G e z e (t)+M o N c δ a (t) (22a)

[0195] a e (t) = N o z e (t) (22b)

[0196] Among them, z e (t) is the vector designed by the attacker to replace the original internal state of the system, z e (t+1) is the change of the internal state of the design, G e is the coefficient matrix of the internal state change of the system after the attack, a e (t) Attack data designed for the attacker, N o To strengthen the attack data transformation matrix, we design z e (t) is designed to destroy the closed-loop system and deceive the administrator. e (t) is mainly to destroy the stability of the internal state of the system. After being attacked by this enhanced zero-dynamic attack, the internal state will diverge. The destructiveness of the enhanced zero-dynamic attack is determined by G e and M o N c δ a (t) decide, when |G e The system will crash only when |>1, G e The larger the value, the faster the system crashes. In this case, the system loses its internal state and the attack state tends to diverge.

[0197] S4: Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal, an enhanced zero-dynamic attack is launched to verify the attack effect. The calculation formula of the system model under the zero-dynamic attack is:

[0198] φ(t+1)=G o φ(t)+M o N c δ(t) (23a)

[0199] δ(δ+1)=(G c +M c λ T )δ(t)+M c bm (u(t)+a(t)-N o φ(t)) (23b)

[0200] y(t)=N c δ(t) (23c)

[0201] Construct an attack signal that matches the system's zero dynamics, separating the system's internal state from its external state:

[0202] z(t+1)=G o z(t) (24a)

[0203] a(t)=N o z(t) (24b)

[0204] Where a(t) represents the attack data added to u(t) through logical operations, z(t) is the state vector calculated by the attacker using the system matrix, and z(t+1) is the internal state change of the design. After the system is attacked, formulas (20a), (20b) and (20c) are transformed into:

[0205] z(t+1)=G o z(t) (25a)

[0206] δ(t+1)=(G c +M c λ T )δ(t)+M c b m u(t) (25b)

[0207] y(t)=N c δ(t) (25c)

[0208] Injecting the designed enhanced zero dynamic attack signal into the AVR, we can get:

[0209] z e (t+1)=G e z e (t)+M o N c δ a (t) (26a)

[0210] δ e (t+1)=(G c +M c λ T )δ e (t)+M c b m u(t) (26b)

[0211] y e(t) = N c δ e (t) (26c)

[0212] Among them, y e (t) represents the output data after the enhanced attack, z e (t) is the internal state of the system after the enhanced attack, z e (t+1) is the change of the internal state of the system after the enhanced attack, δ e (t) is the external state of the system after the enhanced attack, δ e (t+1) is the change of the external state of the system after the enhanced attack, and u(t) is the input of the system. Compared with the ordinary zero-dynamic attack, ||G e ||, so that ||G e ||≥1, and an additional term M is introduced when constructing the attack signal o N c δ a (t), these two elements together produce a more destructive enhanced zero-dynamic attack signal.

[0213] Experimental results: Figure 5 As shown in the figure, the state variables, internal state and external state changes of the automatic voltage regulator system with zero point instability under zero dynamic attack are shown. The system has an unstable zero point, and the controller coefficient K is set at this time. p =0.126, K i = 0.126, and a zero dynamic attack is launched on the system at 101s. The effect is as follows Figure 5 As shown in (a), when the output y fluctuates by 4, the attack will be exposed. Between 101s and 120s, the externally observable output y of the system only fluctuates by about 1 during the attack, and the subsequent fluctuations are slightly less than 1, which shows that the attack is less affected, proving that the attack is well concealed. When the internal state φ fluctuates by more than 5, it proves that the internal state φ of the system has been destroyed. After 101s, the internal state φ fluctuates by 7, which has produced a large range of fluctuations. The internal state φ of the system has been destroyed, and the attack is destructive. Figure 5 In (b), we can clearly see that between 101s and 120s, the component vector V of the external state e Similar to the observable output y, it fluctuates around 1 only during the attack, and the subsequent fluctuations are slightly less than 1. After 101s, the four vectors that make up the internal state of the system All of them oscillate within the upper and lower range of 3. The oscillations of these four vectors together constitute the oscillation of the internal state φ within the upper and lower range of 7. The zero-dynamic attack launched was successful, and the attack took into account both destructiveness and concealment.

[0214] like Figure 6As shown in the figure, the state variables, internal state and external state changes of the automatic voltage regulator system under the enhanced zero dynamic attack are shown. At this time, the controller coefficient K is set p =0.126, K i =0.126, modify the coefficient matrix G in the attack signal e = -1.5, and add an additional term M to the internal state o N c δ a (t). At 101s, the attack is injected. Figure 6 In (a), when the internal state φ fluctuates by more than 25, it proves that the internal state of the system has been severely damaged and has entered a divergent state. At 160s, the internal state φ of the system has fluctuated by more than 25, and the internal state φ of the system has entered a divergent state in a very short time. The destructiveness of the attack is much greater than that of an ordinary zero-dynamic attack. However, compared to an ordinary zero-dynamic attack, the external system output of the enhanced zero-dynamic attack will enter a divergent state at around 230s. At 300s, the externally observable output y of the system has fluctuated by 5, which exceeds the concealment range of 4. At this time, the attack is easily detected by the system's detector, and the concealment of the enhanced zero-dynamic attack is poor. Figure 6 In (b), the degree of damage to the system's state vector can be clearly shown. After 260 seconds, the external state vector V e After 101 seconds, the four vectors that make up the internal state of the system All of them begin to diverge to varying degrees. The gradual divergence of these four vectors from 101s to 160s together constitutes the divergent behavior of the internal state φ oscillating up and down by more than 25 at 160s.

[0215] This embodiment shows through experimental comparison that the enhanced zero dynamic attack on the automatic voltage regulator proposed by the present invention has obvious advantages in enhancing destructiveness. The adopted enhanced zero dynamic attack can make the internal state of the system diverge faster, significantly improving the efficiency of system collapse. It proves that this method has important reference value and development potential in the automatic voltage regulator.

[0216] The above embodiments only express the implementation methods of the present invention, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention. It should be pointed out that, for those of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present invention, and these all belong to the protection scope of the present invention.

Claims

1. An enhanced zero-dynamic attack method for an automatic voltage regulator, characterized in that: The specific steps include: S1: Construct an automatic voltage regulator AVR system model. The AVR system consists of an amplifier subsystem, an exciter subsystem, a generator subsystem, and a sensor subsystem. Each subsystem is described by a first-order transfer function defined by a gain and a time constant. Saturation and nonlinearity are ignored. The model is expressed as follows: The transfer function of the amplifier is: The transfer function of the exciter is: The transfer function of the generator is: The transfer function of the sensor is: Among them, K a represents the gain of the amplifier transfer function, τ a Represents the time constant of the amplifier's transfer function; K e represents the gain of the exciter transfer function, τ e Represents the time constant of the exciter transfer function; K g represents the gain of the generator transfer function, τ g Represents the time constant of the generator transfer function; K s represents the gain of the sensor transfer function, τ s represents the time constant of the sensor's transfer function; The open-loop transfer function of the AVR system can be expressed as: Under the action of PI controller, PI controller K p is the proportionality coefficient, K i is the integral coefficient, then the closed-loop system model of the AVR system is: in, K0=K a K e K g K p K1=K a K e K g K i τ0=τ a t e t g t s τ1=τ a t e t g +t a t e t s +t a t g t s +t a t g t s τ2=τ a t e +t a t g +t a t s +t e t g +t e t s +t g t s τ3=τ a +t e +t g +t s τ4=1+K a K e K g K p τ5=K a K e K g K i Select the state vector V e is the voltage error of the closed-loop system input, and the calculation formula of the state space representation is: y(t)=Cx(t) (7b) Among them, A is the state matrix of the closed-loop system, B is the input matrix of the closed-loop system, C is the output matrix of the closed-loop system, x(t) is the state vector of the system, u(t) is the system input voltage error, y(t) is the output terminal voltage of the closed-loop system, is the change of the state vector of the closed-loop system; S2: Analyze the destructive influencing factors of zero dynamic attack, including the coefficient matrix of the internal state in the attack signal design and the selection of additional terms in the internal state expression; the analysis of the influencing factors is specifically for a discrete system, and the general form of the state equation of the discrete system is: x(t+1)=A n x(t)+B n u(t) (8a) y(t)=C n x(t) (8b) Among them, A n is the state matrix of the discrete system, B n is the input matrix of the discrete system, C n is the output matrix of the discrete system, x(t) is the state vector of the discrete system, x(t+1) is the change of the state vector of the discrete system, u(t) is the input of the discrete system, y(t) is the output of the discrete system, A n , B n and C n The specific calculation formula is: The designed zero dynamic attack signal includes the internal state replacement vector and coefficient matrix as the attack model. The specific calculation formula is: z e (t+1)=G e z e (t) (9a) a e (t)=C o z e (t) (9b) Among them, z e (t) is the vector designed by the attacker to replace the original internal state of the discrete system, z e (t+1) is the change of the internal state of the design, G e is the coefficient matrix of the internal state change of the discrete system after the attack, a e (t) Attack data designed for the attacker, C o is the attack data transformation matrix. For such an attack signal and discrete system, the attack law is calculated as: Among them, Φ∈R, ||G e || is the absolute value of the determinant. The degree of damage to the discrete system depends on Φ, and the attack state z(t) depends entirely on G e ∈R (n-ρ)×(n-ρ) , ρ is the relative order of the discrete system, ||G e The larger || is, the faster the destruction is. At this time, the discrete system loses its internal state and the attack state tends to diverge; S3: Adjust the coefficient matrix of the attack signal and add additional terms to construct an enhanced zero-dynamic attack signal. Apply the Euclidean algorithm to rewrite the transfer function as follows: where Den(s) = Quo(s)Num(s) + Rem(s), let degDen = n, degNum = m, degQuo = n - m = p, degRem < m, and the product of Quo(s) and Rem(s) forms the lowest-degree term of the polynomial, and the coefficient of the lowest-degree term in Quo(S) is 1 / b m ; S4: Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal, an enhanced zero-dynamic attack is launched on it to verify the attack effect.

2. The method for enhancing zero dynamic attack on an automatic voltage regulator according to claim 1, characterized in that: The automatic voltage regulator AVR system model described in step S1 is specifically composed of the following modules: P1: Controller, responsible for calculating the excitation current based on the signal provided by the voltage sensor; P2: Amplifier, responsible for amplifying the small error signal to a level sufficient to drive the excitation current; P3: Exciter, used to provide the excitation current required by the generator rotor to generate a rotating magnetic field; P4: Generator, converts mechanical energy into electrical energy; P5: sensor, used to monitor the output voltage of the generator in real time; Among them, the AVR system uses voltage error to adjust the generator output. The error signal is transmitted to the amplifier, which adjusts the exciter and then changes the field current of the generator to control the output voltage of the generator; then, the output voltage is converted to a suitable induction level through a step-down transformer; finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage level.

3. The method for enhancing zero dynamic attack on an automatic voltage regulator according to claim 1, characterized in that: The closed-loop system in step S1 is operated by a digital controller. The input of the closed-loop system is sampled at discrete moments. The sampled data system in formula (7a) and formula (7b) is expressed as: x((m+1)T s )=G(T s )x(mT s )+H(T s )u(mT s ) (12a) y(mT s )=C(T s )x(mT s ) (12b) Among them, G(T s ) is the system state matrix after sampling, H(T s ) is the system input matrix after sampling, C(T s ) is the output matrix of the system after sampling, u(mT s ) is the system input voltage error after sampling, x(mT s ) is the state vector after sampling, x((m+1)T s ) is the change of the system state vector after sampling, y(mT s ) is the system output terminal voltage after sampling, sampling time t=mT s , where T s represents the sampling period, m is an integer, and the input and output of the controller are respectively represented as u(mT s ) and y(mT S ), formula (12a) and formula (12b) are simplified to: x(t+1)=Gx(t)+Hu(t) (13a) y(t)=Cx(t) (13b) Where G = G(T s ),H=H(T s ),C=C(T s ), x(t) is the system state vector selected after simplification.

4. The method for enhancing zero dynamic attack on an automatic voltage regulator according to claim 1, characterized in that: When there is no zero dynamic attack, the discrete system in step S2 undergoes a Byrnes-Isidori paradigm transformation to obtain the internal state change of the system: φ(t+1)=G o φ(t)+M o N c δ(t) (14) Among them, φ(t) is the internal state of the system after the conversion, φ(t+1) is the change of the internal state of the system after the conversion, G o is the internal state change matrix of the system after conversion, M o is the minimum implementation of the feedback path, N c =[1 0 0 0], δ(t) is the external state of the system after transformation, and the internal state change in the enhanced zero-dynamic attack is: z e (t+1)=G e z e (t)+M o N c δ a (t) (15) For formula (15), by recursively solving its expression, we get: in, It means that the discrete system has initial condition z e (0) For the spontaneously divergent part, the second term is the additional term M o N c δ a (t) Impact on system behavior, It's G e kth power, due to The behavior is exponential growth, The maximum eigenvalue of is λ, then (where λ>1), δ a (t) is a constant input vector with the same dimension as δ(t), and formula (16) is simplified to: The geometric series and of formula (17) can be further written as: From this we can get: When t→∞, λ t →∞, so the sum of formula (19) also tends to infinity, that is, the additional term M o N c δ a (t) accelerates the overall divergence speed of the discrete system.

5. The method for enhancing zero dynamic attack on an automatic voltage regulator according to claim 1, characterized in that: The attack signal in step S3 is enhanced by the following steps: Formula (12a) and Formula (12b) are expressed by the Byrnes-Isidori form as follows: φ(t+1)=G o φ(t)+M o N c δ(t) (20a) δ(t+1)=(G c +M c λ T )δ(t)+M c b m (u(t)-N o φ(t)) (20b) y(t)=N c δ(t) (20c) Among them, δ(t) is the external state of the discrete system, δ(t+1) is the change of the external state of the discrete system, u(t) is the input of the discrete system, and the forward path is represented by the column vector of the output data corresponding to the discrete system. G o 、M o and N o is the minimum implementation of the feedback path after conversion; 1 / b m is the coefficient in Quo(s), λ T is the solution of formula (21b), G c 、M c 、N c The calculation formula is: δ(t)=[y(t) y(t+1) y(t+2) y(t+3)] T (21a) l T δ(t)=y(t)+b m N o φ(t)-b m u(t) (21b) M c =[0 0 0 1] T (21d) N c =[1 0 0 0] (21e) In order to optimize the attack strength, the attack model has been modified. The modified attack model is: z e (t+1)=G e z e (t)+M o N c δ a (t) (22a) a e (t)=N o z e (t) (22b) Among them, N o To strengthen the attack data transformation matrix, we design z e (t) is designed to destroy the closed-loop system and deceive the administrator. e (t) is mainly to destroy the stability of the internal state of the system. After being attacked by this enhanced zero-dynamic attack, the internal state will diverge. The destructiveness of the enhanced zero-dynamic attack is determined by G e and M o N c δ(t) determines that when ||G e The system will crash only when ||>1, G e The larger the value, the faster the discrete system collapses. In this case, the discrete system loses its internal state and the attack state tends to diverge.

6. The method for enhancing zero dynamic attack on an automatic voltage regulator according to claim 5, characterized in that: In step S4, based on the modeling of the automatic voltage regulator and the construction of the enhanced zero dynamic attack signal, an enhanced zero dynamic attack is launched on it, wherein the calculation formula of the system model under the zero dynamic attack is: φ(t+1)=G o φ(t)+M o N c δ(t) (23a) δ(t+1)=(G c +M c λ T )δ(t)+M c b m (u(t)+a(t)-N o φ(t)) (23b) y(t)=N c δ(t) (23c) Among them, a(t) is the attack signal, G c 、M c 、N c The calculation formulas are in formula (21c), formula (21d), and formula (21e); Construct an attack signal that matches the zero dynamics of the system after the attack, so that the internal state of the system is separated from the external state: z(t+1)=G o z(t) (24a) a(t)=N o z(t) (24b) Where a(t) represents the attack data added to u(t) through logical operations, and z(t) is the state vector calculated by the attacker using the system matrix. After the system is attacked, formulas (20a), (20b), and (20c) are transformed into: z(t+1)=G o z(t) (25a) δ(t+1)=(G c +M c λ T )δ(t)+M c b m u(t) (25b) y(t)=N c δ(t) (25c) Injecting the designed enhanced zero dynamic attack signal into the AVR, we can get: z e (t+1)=G e z e (t)+M o N c δ a (t) (26a) δ e (t+1)=(G c +M c λ T )δ e (t)+M c b m u(t) (26b) y e (t)=N c δ e (t) (26c) Among them, y e (t) represents the output data after the enhanced attack, δ e (t) is the external state of the system after the enhanced attack, δ e (t+1) is the change of the external state of the system after the enhanced attack. Compared with the ordinary zero-dynamic attack, ||G e ||, so that ||G e ||≥1, and an additional term M is introduced when constructing the attack signal o N c δ a (t), these two elements together produce a more destructive enhanced zero-dynamic attack signal.

Images