A method for a reinforced zero dynamic attack on an automatic voltage regulator

Abstract

The application discloses a method for reinforcing zero dynamic attack on an automatic voltage regulator, which comprehensively analyzes factors influencing the destructiveness of zero dynamic attack, and enhances the destructiveness of zero dynamic attack by modifying the attack signal and sacrificing certain concealment. A transfer function is used to represent the relationship model between the input signal and the output signal of the automatic voltage regulator, factors influencing the destructiveness of zero dynamic attack are analyzed, a coefficient matrix of the attack signal is adjusted and an additional term is added, a reinforced zero dynamic attack signal is constructed, and the reinforced zero dynamic attack is launched on the automatic voltage regulator. Compared with the existing zero dynamic attack method, the reinforced zero dynamic attack designed by the application has stronger destructiveness and can be applied to more attack objects.

Description

Technical Field

[0001] This invention mainly relates to the field of zero-dynamic attack defense and detection, and in particular to an enhanced zero-dynamic attack method for automatic voltage regulators. Background Technology

[0002] The power grid plays a vital role in the development of modern society. It not only ensures a continuous power supply and supports the stable operation of economic activities, but also promotes technological innovation and the application of sustainable energy. Among the various components of the power grid, the Automatic Voltage Regulator (AVR) system plays a central role. The AVR system is responsible for maintaining the stability of generator output voltage, ensuring that the grid voltage level fluctuates within a predetermined range, thereby protecting grid equipment and improving power transmission efficiency. The integration of the AVR system with Supervisory Control and Data Acquisition (SCADA) systems further enhances the operational efficiency and reliability of the power grid. The SCADA system monitors the grid's operating status in real time, collects key data, and feeds this data back to the AVR system. This high degree of interconnectivity allows the AVR to automatically adjust its control strategy based on real-time changes in grid load, optimizing voltage management.

[0003] Zero-dynamic attacks have emerged as a type of cyberattack that has garnered significant attention in recent years. These attacks can silently alter device operating states or trigger system malfunctions, even causing catastrophic consequences without being detected. Their stealth and destructive power make defense and detection extremely complex, and their potential harm is often greater than that of spoofing attacks and denial-of-service attacks. Zero-dynamic attacks are a sophisticated form of spoofing attack. In non-minimum-phase systems, due to the presence of unstable zeros, attackers can exploit the system's structural parameters to construct attack signals. After injection, the attacker manipulates the internal state of the control system, causing it to diverge, but the system's output behavior remains identical to when it was not attacked. Due to the stealth of zero-dynamic attacks, traditional detection techniques struggle to detect them.

[0004] There are three existing methods to increase the strength of zero-dynamic attacks, focusing on attack intensity. The first method separates the true zero-dynamic state from the system's input and output signals and replaces it with an auxiliary nominal zero-dynamic state. This substitution attack no longer requires precise model knowledge but remains destructive and stealthy. The second method analyzes how the system's destructive power depends on the state vector coefficient matrix of the designed attack signal. A zero-dynamic attack is more destructive when the matrix is ​​larger than one; the larger the matrix, the stronger the attack. The third method avoids directly quantizing the attack signal to reduce the detection of the attack through the system output. This method is based on dynamic quantization technology and an improved version of zero-dynamic attacks, utilizing knowledge of system dynamics to make the error in the output less than a specified level. This invention, when designing the attack signal, adds extra internal states while changing the attack signal coefficient matrix, causing the system's internal states to diverge faster after the attack signal is injected, thereby enhancing the destructiveness of the zero-dynamic attack. This attack is more powerful, has a wider range of applications, and has broad application prospects. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies by providing an enhanced zero-dynamic attack method for automatic voltage regulators, aiming to solve problems encountered in practical applications. To achieve the above objective, this invention provides the following technical solution: an enhanced zero-dynamic attack method for automatic voltage regulators, specifically comprising the following steps:

[0006] S1: Construct an automatic voltage regulator (AVR) system model. The AVR system consists of an amplifier subsystem, an exciter subsystem, a generator subsystem, and a sensor subsystem. Each subsystem is described by a first-order transfer function defined by gain and time constant. Ignoring saturation and nonlinearity, its model expression is as follows:

[0007] Amplifier transfer function:

[0008] ,

[0009] Exciter transfer function:

[0010] ,

[0011] Generator transfer function:

[0012] ,

[0013] Sensor transfer function:

[0014] ,

[0015] in, The gain represents the transfer function of the amplifier. The time constant representing the amplifier's transfer function; The gain represents the transfer function of the exciter. The time constant representing the transfer function of the exciter; The gain represents the transfer function of the generator. The time constant representing the transfer function of the generator; The gain represents the transfer function of the sensor. The time constant representing the transfer function of the sensor;

[0016] The open-loop transfer function of an AVR system can be expressed as:

[0017] ,

[0018] Under the action of the PI controller, the PI controller , This is the proportionality coefficient. The integral coefficients are then used to define the closed-loop system model of the AVR system:

[0019] ,

[0020] in,

[0021] ,

[0022] Selecting the state vector , The voltage error input to the closed-loop system is calculated using the state-space representation formula as follows:

[0023] ,

[0024] ,

[0025] Where A is the state matrix of the closed-loop system, B is the input matrix of the closed-loop system, and C is the output matrix of the closed-loop system. Let be the state vector of the system. For system input voltage error, This refers to the output terminal voltage of the closed-loop system. It represents the change in the state vector of the closed-loop system;

[0026] S2: Analyze the destructive factors of zero-dynamic attacks, including the coefficient matrix of the internal state in the attack signal design and the selection of additional terms in the internal state expression; the analysis of influencing factors specifically targets a discrete system, whose state equation has the following general form:

[0027] ,

[0028] in, Let be the state matrix of the discrete system. Let be the input matrix of the discrete system. Let be the output matrix of the discrete system. For the state vector of a discrete system, It is the change in the state vector of the discrete system. For the input of the discrete system, For the output of the discrete system, , and The specific calculation formula is as follows:

[0029] ,

[0030] The designed zero-dynamic attack signal includes an internal state replacement vector and a coefficient matrix, which serve as the attack model. The specific calculation formula is as follows:

[0031] ,

[0032] ,

[0033] in, A vector designed for attackers to replace the original internal states of a discrete system. For changes in the internal state of the design, This is the coefficient matrix representing the changes in the internal state of the discrete system after the attack. Attack data designed for attackers, Given the attack data transformation matrix, for such an attack signal and discrete system, the attack pattern is calculated as follows:

[0034] ,

[0035] in, , The absolute value of the determinant determines the degree of damage to the discrete system. Attack status Completely dependent on , Let be the relative order of the discrete system. The larger the value, the faster the destruction. At this point, the discrete system loses its internal state, and the attack state tends to diverge.

[0036] S3: Adjust the coefficient matrix of the attack signal and add additional terms to construct a reinforced zero-dynamic attack signal. Apply the Euclidean algorithm to rewrite the transfer function as follows:

[0037] ,

[0038] in, ,set up ,in and The product of and forms the least-order term of the polynomial, and the least-order term is in The coefficient in is ;

[0039] S4: Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal, launch an enhanced zero-dynamic attack on it to verify the attack effect.

[0040] As a preferred technical solution of the present invention, the automatic voltage regulator (AVR) system model described in step S1 specifically consists of the following modules:

[0041] P1: Controller, responsible for calculating the excitation current based on the signal provided by the voltage sensor;

[0042] P2: Amplifier, responsible for amplifying small error signals to a level sufficient to drive the magnetizing current;

[0043] P3: Exciter, used to provide the excitation current required by the generator rotor to generate a rotating magnetic field;

[0044] P4: Generator, which converts mechanical energy into electrical energy;

[0045] P5: Sensor used to monitor the generator's output voltage in real time;

[0046] The AVR system uses voltage error to regulate generator output. The error signal is transmitted to an amplifier, which regulates the exciter, thereby changing the generator's magnetic field current to control the generator's output voltage. Subsequently, the output voltage is converted into a suitable induced level by a step-down transformer. Finally, a voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage level.

[0047] As a preferred technical solution of the present invention, a digital controller is used to operate the closed-loop system described in step S1. The input of the closed-loop system will be sampled at discrete times, and the sampled data system in formulas (7a) and (7b) is expressed as follows:

[0048] ,

[0049] ,

[0050] in, This is the sampled system state matrix. The sampled system input matrix, The output matrix of the system after sampling. The error is the sampled system input voltage. This is the sampled state vector. The change in the system state vector after sampling. The sampled system output terminal voltage, sampling time ,in The sampling period is represented by m, which is an integer. The input and output of the controller are represented as follows: and Formulas (12a) and (12b) simplify to:

[0051] ,

[0052] ,

[0053] in, , The system state vector selected for simplification.

[0054] As a preferred technical solution of the present invention, when there is no zero-dynamic attack, the discrete system described in step S2 undergoes Byrnes-Isidori paradigm transformation to obtain the internal state changes of the system:

[0055] ,

[0056] in, The internal state of the system after the transformation. This refers to the change in the internal state of the system after the transformation. This is the internal state change matrix of the system after transformation. For the minimum implementation of the feedback path, , To represent the external state of the transformed system, the internal state changes in an enhanced zero-dynamic attack are as follows:

[0057] ,

[0058] By recursively solving the expression of formula (15), we obtain:

[0059] ,

[0060] in, This indicates that the discrete system is affected by initial conditions. As for the spontaneously divergent part, the second term is an additional term. Impact on system behavior yes of The power, because Its behavior grows exponentially. The largest eigenvalue is Then there is (in ), Is with For constant input vectors of the same dimension, formula (16) simplifies to:

[0061] ,

[0062] The geometric series of formula (17) can be further written as:

[0063] ,

[0064] Therefore, we can conclude that:

[0065] ,

[0066] when hour, Therefore, the sum of formula (19) also tends to infinity, i.e., the additional term It accelerates the overall divergence speed of discrete systems.

[0067] As a preferred technical solution of the present invention, the attack signal in step S3 is enhanced by the following steps:

[0068] Formulas (12a) and (12b) are expressed in Byrnes-Isidori normal form as follows:

[0069] ,

[0070] ,

[0071] ,

[0072] in, For the external state of a discrete system, For changes in the external state of a discrete system, For the input of the discrete system, the forward path is represented by a column vector of the output data corresponding to the discrete system. and It is the minimum implementation of the transformed feedback path; for The coefficients in The solution to formula (21b) is... , , The calculation formula is:

[0073] ,

[0074] ,

[0075] ,

[0076] ,

[0077] ,

[0078] To optimize attack strength, the attack model was modified. The modified attack model is as follows:

[0079] ,

[0080] in, To enhance the attack data transformation matrix, design It was designed to disrupt the closed-loop system and deceive the administrator. The main purpose is to disrupt the stability of the system's internal state. After being subjected to this enhanced zero-dynamic attack, the internal state will diverge, and the destructive power of the enhanced zero-dynamic attack will be greatly increased. and Decision, when The system will only crash when... The larger the value, the faster the discrete system collapses. In this case, the discrete system loses its internal state, and the attack state tends to diverge.

[0081] As a preferred technical solution of the present invention, step S4 involves launching an enhanced zero-dynamic attack based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal. The calculation formula for the system model under the zero-dynamic attack is as follows:

[0082] ,

[0083] ,

[0084] ,

[0085] in, This is an attack signal. , , The calculation formulas are in formulas (21c), (21d), and (21e);

[0086] Construct an attack signal that dynamically matches the attacked system, thus separating the system's internal state from its external state:

[0087] ,

[0088] ,

[0089] in, This indicates adding via logical operations. The attack data in the middle, The state vector is calculated by the attacker using the system matrix. After the system is attacked, formulas (20a), (20b), and (20c) transform into:

[0090] ,

[0091] By injecting the designed enhanced zero-dynamic attack signal into the AVR, we can obtain:

[0092] ,

[0093] ,

[0094] ,

[0095] in, This indicates the output data after the enhanced attack. To enhance the external state of the system after an attack, To enhance the changes in the system's external state after an attack, modifications were made compared to ordinary zero-dynamic attacks. ,make And an additional term was introduced when constructing the attack signal. Together, these two elements produce a more destructive enhanced zero-dynamic attack signal.

[0096] Compared with the relevant prior art, the beneficial effects of the present invention are:

[0097] Accelerating System Instability: By modifying the coefficient matrix of the attack signal and adding additional terms to the internal state, the method of this invention can quickly induce the divergence of the internal state of the automatic voltage regulator system, significantly accelerating the system instability and causing the system to transition from a normal state to a fault state in a very short time.

[0098] Efficient bypass of feedback mechanism: Enhanced zero-dynamic attack cleverly bypasses the system's feedback control mechanism, making the attack more covert and destructive, and impossible to be effectively detected or compensated for by conventional control strategies, thereby ensuring the maximum effect of the attack.

[0099] Powerful destructive capability: Compared with traditional attack methods, the method of this invention can more efficiently disrupt the internal state of the system, causing the voltage regulation function of the system to fail rapidly and posing a serious stability threat to the entire power system.

[0100] Reduced response time: By introducing additional features, the internal state of the system can deviate rapidly from the normal range, thereby significantly reducing the system's response time from stability to collapse, enhancing the immediate destructiveness of attacks, and posing a higher risk to power networks and critical infrastructure.

[0101] Precise control of attack effects: The attack design of this invention can flexibly adjust the additional items and coefficient matrix according to actual needs, so that the attack has controllability and customization characteristics, so as to achieve precise strikes on specific system targets. Attached Figure Description

[0102] Figure 1 This is a flowchart illustrating an enhanced zero-dynamic attack method for automatic voltage regulators proposed in this invention.

[0103] Figure 2 A system structure diagram of the automatic voltage regulator in an embodiment of the present invention is provided;

[0104] Figure 3 A block diagram of a closed-loop automatic voltage regulator control system is provided in an embodiment of the present invention;

[0105] Figure 4 This invention provides a schematic diagram of an automatic voltage regulator system for injecting attack signals in an embodiment.

[0106] Figure 5 The present invention provides the state variables, internal state, and external state changes of an automatic voltage regulator system under zero-point instability under zero dynamic attack in the embodiments of the present invention;

[0107] Figure 6 This invention provides state variables, internal states, and external state changes of an automatic voltage regulator system under enhanced zero dynamic attack conditions in embodiments of the invention. Detailed Implementation

[0108] The present invention will be further described below with reference to the accompanying drawings and embodiments. However, the present invention can be implemented in many different ways and should not be construed as limited to the embodiments shown; rather, these embodiments provide those skilled in the art with implementation methods that meet applicable legal requirements.

[0109] Example 1: According to Figure 1 The diagram illustrates the complete workflow of the enhanced zero-dynamic attack method for automatic voltage regulators described in this invention; the system to which this method is applied is as follows: Figure 2 As shown, the specific system composition includes: a controller responsible for calculating the excitation current based on the signal provided by the voltage sensor; an amplifier responsible for amplifying the small error signal to a level that can drive the excitation current; an exciter that provides the excitation current required by the generator rotor to generate a rotating magnetic field; a generator that converts mechanical energy into electrical energy; and a sensor responsible for monitoring the generator's output voltage in real time.

[0110] S1: Construct an Automatic Voltage Regulator (AVR) system model. The AVR system consists of an amplifier, exciter, generator, and sensor. Each subsystem is described by a first-order transfer function defined by gain and time constant, ignoring saturation and nonlinearity. The AVR system model consists of the following modules: P1: Controller, responsible for calculating the excitation current based on the signal provided by the voltage sensor; P2: Amplifier, responsible for amplifying small error signals to a level sufficient to drive the excitation current; P3: Exciter, used to provide the excitation current required by the generator rotor to generate a rotating magnetic field; P4: Generator, converting mechanical energy into electrical energy; P5: Sensor, used to monitor the generator's output voltage in real time. The AVR system uses voltage error to regulate the generator output. The error signal is transmitted to the amplifier, which regulates the exciter, thereby changing the generator's magnetic field current to control the generator's output voltage. Subsequently, the output voltage is converted to a suitable induced level by a step-down transformer. Finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage level.

[0111] Control system block diagram as follows Figure 3 As shown, the AVR system model consists of four subsystems: an amplifier, an exciter, a generator, and a sensor. Each subsystem can be modeled using a first-order transfer function defined by gain and time constant, neglecting saturation and nonlinearity. The AVR system uses voltage error to regulate the generator output; the error signal is sent to the amplifier, which adjusts the exciter. Next, the exciter changes the generator's magnetic field current, controlling the generator's output voltage. The output voltage then passes through a step-down transformer, converting the generator voltage to a suitable induced level. Finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage. Figure 4 The AVR system shown is connected to a SCADA system via a network. The SCADA system monitors the real-time operating status of the power grid, collects key data, and feeds it back to the AVR system. The input voltage error passes through a PI controller, then a zero-order hold, and finally into the AVR system. The AVR system then outputs the error and feeds it back to the SCADA system and the PI controller via the network. An attack signal can be injected into the input via the network. Its model is expressed as follows:

[0112] Amplifier transfer function:

[0113] ,

[0114] Exciter transfer function:

[0115] ,

[0116] Generator transfer function:

[0117] ,

[0118] Sensor transfer function:

[0119] ,

[0120] Among them, the amplifier gain is used The time constant is represented by... Indicates that the transfer function of the exciter is the gain function. The time constant is represented by... The transfer function of the generator terminal voltage and the field voltage is represented by the gain. and time constant To describe; sensor gain is used The time constant is represented by... This means that the open-loop transfer function of the system can be expressed as:

[0121] ,

[0122] Under the action of the PI controller, the PI controller , This is the proportionality coefficient. Let be the integral coefficient, then the closed-loop system model is:

[0123] ,

[0124] in,

[0125] ,

[0126] Selecting the state vector , The voltage error input to the system is calculated using the state-space representation formula as follows:

[0127] ,

[0128] ,

[0129] Where A is the system's state matrix, B is the system's input matrix, and C is the system's output matrix. Let be the state vector of the system. For system input voltage error, This is the system output terminal voltage. It is a change in the system state vector;

[0130] The system described in step S1 is operated using a digital controller. The system input is sampled at discrete times, and the sampled data in formula (7) is represented as follows:

[0131] ,

[0132] ,

[0133] in, This is the sampled system state matrix. The sampled system input matrix, The output matrix of the system after sampling. The error is the sampled system input voltage. This is the sampled state vector. The sampled system output terminal voltage, sampling time ,in The sampling period is represented by m, which is an integer. The input and output of the controller are represented as follows: and Formulas (8a) and (8b) can be simplified to:

[0134] ,

[0135] ,

[0136] in, , For the selected system state vector, It is the change in the simplified system state vector. For system input voltage error, This is the system output terminal voltage.

[0137] S2: Analyze the destructive factors of zero-dynamic attacks, including the coefficient matrix of the internal state in the attack signal design and the selection of additional terms in the internal state expression; the analysis of influencing factors specifically targets a discrete system, the general form of which is:

[0138] ,

[0139] in, Let be the state matrix of the discrete system. Let be the input matrix of the discrete system. Let be the output matrix of the discrete system. For the state vector of a discrete system, For the input of the discrete system, For the output of the discrete system, , and The specific calculation formula is as follows:

[0140] ,

[0141] The designed zero-dynamic attack signal includes an internal state replacement vector and a coefficient matrix, which serve as the attack model. The specific calculation formula is as follows:

[0142] ,

[0143] ,

[0144] in, A vector designed to replace the original internal state of the system for attackers. For changes in the internal state of the design, This is the coefficient matrix representing the changes in the internal state of the system after the attack. Attack data designed for attackers, Given the attack data transformation matrix, for such attack signals and systems, the attack pattern is calculated as follows:

[0145] ,

[0146] in, , The absolute value of the determinant determines the degree of damage to the system. Attack status Completely dependent on , The relative order of the system. The larger the size, the faster the destruction. At this point, the system loses its internal state, and the attack state tends to diverge.

[0147] Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal, an enhanced zero-dynamic attack is launched against it. The injection method is as follows: Figure 4 As shown.

[0148] In the absence of zero-dynamic attacks, the system described in step S2 undergoes a Byrnes-Isidori paradigm transformation, resulting in the following internal state changes:

[0149] ,

[0150] in, The internal state of the system after the transformation. This refers to the change in the internal state of the system after the transformation. This is the internal state change matrix of the system after transformation. For the minimum implementation of the feedback path, , To represent the external state of the transformed system, the internal state changes in an enhanced zero-dynamic attack are as follows:

[0151] ,

[0152] in, A vector designed to replace the original internal state of the system for attackers. For changes in the internal state of the design, This is the coefficient matrix representing the changes in the internal state of the system after the attack. Attack data designed for attackers; by recursively solving the expression of formula (14), we obtain:

[0153] ,

[0154] in, This indicates that the system is affected by initial conditions. As for the spontaneously divergent part, the second term is an additional term. Impact on system behavior and Take the integer. yes of The power, because Its behavior grows exponentially. The largest eigenvalue is Then there is (in Formula (15) simplifies to:

[0155] ,

[0156] The geometric series of formula (16) can be further written as:

[0157] ,

[0158] Therefore, we can conclude that:

[0159] ,

[0160] when hour, Therefore, the sum of the above expression also tends to infinity, i.e., the additional term. This accelerated the overall divergence speed of the system.

[0161] S3: Adjust the coefficient matrix of the attack signal and add additional terms to construct a reinforced zero-dynamic attack signal. Apply the Euclidean algorithm to rewrite the transfer function as follows:

[0162] ,

[0163] in, ,set up ,in and The product of and forms the least-order term of the polynomial, and the least-order term is in The coefficient in is ;

[0164] The attack signal is enhanced through the following steps: Equations (8a) and (8b) are expressed in the Byrnes-Isidori paradigm as follows:

[0165] ,

[0166] ,

[0167] ,

[0168] in, The internal state of the system after the transformation. This refers to the changes in the internal state of the system after the transformation. The external state of the system after the transformation. This refers to the change in the external state of the system after the transformation. This is the system's internal state change matrix. As the input to the system, the forward path is represented by a column vector of the output data corresponding to the system. and It is the minimum implementation of the transformed feedback path; for The coefficients in The solution to formula (21b) is... , , The calculation formula is:

[0169] ,

[0170] ,

[0171] ,

[0172] ,

[0173] ,

[0174] To optimize attack strength, the attack model was modified. The modified attack model is as follows:

[0175] ,

[0176] in, A vector designed to replace the original internal state of the system for attackers. For changes in the internal state of the design, This is the coefficient matrix representing the changes in the internal state of the system after the attack. Attack data designed for attackers, To enhance the attack data transformation matrix, design It was designed to disrupt the closed-loop system and deceive the administrator. The main purpose is to disrupt the stability of the system's internal state. After being subjected to this enhanced zero-dynamic attack, the internal state will diverge, and the destructive power of the enhanced zero-dynamic attack will be greatly increased. and Decision, when The system will only crash when... The larger the value, the faster the system crashes. In this case, the system loses its internal state, and the attack state tends to diverge.

[0177] S4: Based on the modeling of the automatic voltage regulator and the construction of the enhanced zero-dynamic attack signal, an enhanced zero-dynamic attack is launched to verify the attack effect. The calculation formula for the system model under the zero-dynamic attack is as follows:

[0178] ,

[0179] ,

[0180] ,

[0181] Construct an attack signal that dynamically matches the system to separate the system's internal state from its external state:

[0182] ,

[0183] ,

[0184] in, This indicates adding via logical operations. The attack data in the middle, It is a state vector calculated by the attacker using the system matrix. For the internal state changes of the design, after the system is attacked, equations (20a), (20b), and (20c) transform into:

[0185] ,

[0186] By injecting the designed enhanced zero-dynamic attack signal into the AVR, we can obtain:

[0187] ,

[0188] ,

[0189] ,

[0190] in, This indicates the output data after the enhanced attack. To enhance the internal state of the system after an attack, To enhance the changes in the system's internal state after an attack, To enhance the external state of the system after an attack, To enhance the changes in the system's external state after an attack, This is the system's input. Compared to a typical zero-dynamic attack, it has been modified. ,make And an additional term was introduced when constructing the attack signal. Together, these two elements produce a more destructive enhanced zero-dynamic attack signal.

[0191] Experimental results: such as Figure 5 As shown in the figure, this diagram illustrates the state variables, internal state, and external state changes of an automatic voltage regulator system with zero-point instability under zero dynamic attack conditions. The system has unstable zeros, and the controller coefficient is set accordingly. A zero-dynamic attack was launched on the system at 101 seconds. The effect was as follows. Figure 5 As shown in (a), when the output An attack will be detected when the fluctuation value is 4, and the externally observable output of the system will be visible between 101 and 120 seconds. The fluctuation only occurred around 1 during the attack, with subsequent fluctuations being slightly less than 1, indicating minimal impact from the attack and demonstrating good stealth. (When the internal state...) When the fluctuations exceed 5, it indicates the internal state of the system. It has been destroyed; after 101 seconds, its internal state... The oscillation value is 7, indicating a significant range of fluctuations. This reflects the internal state of the system. It was destroyed; the attack was destructive. Figure 5 In (b), it can be clearly seen that between 101s and 120s, the composition vector of the external state... With observable output The situation was similar, with fluctuations around 1 only occurring during the attack, and subsequent fluctuations slightly less than 1. After 101 seconds, the four vectors constituting the system's internal state... All four vectors oscillated within a range of 3, and these oscillations together constitute the internal state. The oscillation ranged from 7. The zero-dynamic attack was successful, achieving both destructiveness and stealth.

[0192] like Figure 6 As shown in the figure, this diagram illustrates the state variables, internal state, and external state changes of an automatic voltage regulator system under enhanced zero-dynamic attack conditions. At this point, the controller coefficients are set... Modify the coefficient matrix in the attack signal At the same time, add additional items to the internal state. An attack was injected at 101 seconds. Figure 6 In (a), when the internal state When the oscillation exceeds 25, it indicates that the internal state of the system has been severely disrupted and has entered a divergent state. At 160 seconds, the internal state of the system... The fluctuation range has exceeded 25, indicating the internal state of the system. It enters a divergent state very quickly, and its destructive power is far greater than that of a normal zero-dynamic attack. However, compared to a normal zero-dynamic attack, the external system output of the enhanced zero-dynamic attack enters a divergent state in about 230 seconds, and at 300 seconds, the externally observable output of the system reaches a certain level. The fluctuation has reached 5, exceeding the concealment range of 4. At this point, the attack is easily detected by the system's detector, making the concealment of the enhanced zero-dynamic attack poor. Figure 6 In (b), the degree of destruction of the system's state vector is clearly presented. After 260 seconds, the composition vector of the external state... It also begins to gradually diverge. After 101 seconds, the four vectors that make up the internal state of the system... All four vectors begin to diverge to varying degrees, gradually diverging from 101s to 160s, together forming the internal state. It exhibits divergent behavior with oscillations exceeding 25 at 160s.

[0193] This embodiment demonstrates through experimental comparison that the enhanced zero-dynamic attack proposed in this invention for automatic voltage regulators has a significant advantage in increasing destructive power. The enhanced zero-dynamic attack can cause the internal state of the system to diverge more quickly, significantly improving the efficiency of system collapse. This proves that the method has important reference value and development potential in automatic voltage regulators.

[0194] The above embodiments merely illustrate implementation methods of the present invention, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention.

Claims

1. A method for enhanced zero dynamics attack against automatic voltage regulator, used in the field of zero dynamics attack defense and detection, characterized in that: Specifically comprising the following steps: S1: Construct an automatic voltage regulator (AVR) system model, which is composed of an amplifier subsystem, an exciter subsystem, a generator subsystem, and a sensor subsystem, each subsystem is described by a first-order transfer function defined by gain and time constant, ignoring saturation and nonlinearity, the model is expressed as follows: Transfer function of the amplifier: ， Transfer function of the exciter: ， Transfer function of the generator: ， Transfer function of the sensor: ， wherein, represents a gain of the transfer function of the amplifier, represents a time constant of the transfer function of the amplifier; represents a gain of the transfer function of the exciter, represents a time constant of the transfer function of the exciter; represents a gain of the transfer function of the generator, represents a time constant of the transfer function of the generator; represents a gain of the transfer function of the sensor, represents a time constant of the transfer function of the sensor; The open-loop transfer function of the AVR system can be expressed as: ， Under the action of the PI controller, the PI controller , is a proportional coefficient, is an integral coefficient, then the closed-loop system model of the AVR system is: ， wherein, ， Selecting state vector , The voltage error input for the closed-loop system is calculated by the state space representation formula: ， ， wherein A is a state matrix of the closed loop system, B is an input matrix of the closed loop system, C is an output matrix of the closed loop system, is a state vector of the system, is a system input voltage error, is a closed loop system output terminal voltage, is a change in the closed loop system state vector; S2: Analyze the destructive impact factors of zero dynamics attack, including the selection of the coefficient matrix of the internal state in the attack signal design and the additional term in the internal state expression; wherein, the analysis of the impact factors is specifically for a discrete system, the general form of the state equation of the discrete system is: ， wherein is the state matrix of the discrete system, is the input matrix of the discrete system, is the output matrix of the discrete system, is the state vector of the discrete system, is the change of the state vector of the discrete system, is the input of the discrete system, is the output of the discrete system, , and the specific calculation formulas are: ， The designed zero dynamics attack signal includes an internal state replacement vector and a coefficient matrix, which is used as an attack model, and the specific calculation formula is: ， ， wherein, a vector of the original internal state of the discrete system to be replaced by the attacker, a change in the designed internal state, a coefficient matrix of the change in the internal state of the discrete system after the attack, attack data designed by the attacker, a transformation matrix of the attack data, and the attack rule is calculated for such an attack signal and a discrete system as follows: ， wherein, , is the absolute value of the determinant, the degree of damage to the discrete system depends on , the attack state is completely determined by , is the relative order of the discrete system, The larger, the faster the damage, at this time, the discrete system loses the internal state, and the attack state tends to diverge; S3: Adjust the coefficient matrix of the attack signal and add additional terms to construct a reinforced zero dynamics attack signal, and apply the Euclidean algorithm to rewrite the transfer function as: ， wherein , let wherein and the product of the coefficients of the smallest term in is ; S4: Launch a reinforced zero dynamics attack on the automatic voltage regulator based on the modeling and construction of the reinforced zero dynamics attack signal, and verify the attack effect.

2. The method of claim 1, wherein the method is characterized by: The automatic voltage regulator (AVR) system model in step S1 is specifically composed of the following modules: P1: Controller, responsible for calculating the field current based on the signal provided by the voltage sensor; P2: Amplifier, responsible for amplifying the small error signal to a level sufficient to drive the field current; P3: Exciter, used to provide the required field current for the generator rotor to generate a rotating magnetic field; P4: Generator, converts mechanical energy into electrical energy; P5: Sensor, used to monitor the output voltage of the generator in real time; Wherein, the AVR system uses voltage error to regulate the output of the generator, the error signal is transmitted to the amplifier, the amplifier adjusts the exciter, and then changes the magnetic field current of the generator to control the output voltage of the generator; then, the output voltage is converted to a suitable induction level by the step-down transformer; finally, the voltage sensor continuously monitors the output voltage and feeds it back to the control loop to maintain the required voltage level.

3. The method of claim 1, wherein the method is characterized by: The closed-loop system in step S1 is operated using a digital controller, the input of the closed-loop system will be sampled at discrete time, and the sampled data system in formula (7a) and formula (7b) is represented as: ， ， wherein, is the sampled system state matrix, is the sampled system input matrix, is the sampled system output matrix, is the sampled system input voltage error, is the sampled state vector, is the change in the sampled system state vector, is the sampled system output terminal voltage, sampling time wherein denotes the sampling period, m is an integer, the input and output of the controller are denoted as and , equations (12a) and (12b) are simplified as: ， ， wherein , to simplify the post-selected system state vector.

4. The method of claim 1, wherein the method is characterized by: When there is no zero dynamics attack, the discrete system in step S2 is converted by Byrnes-Isidori norm to obtain the internal state change of the system: ， where is the internal state of the transformed system, is the change in the internal state of the transformed system, is the change in the internal state of the transformed system matrix, is the minimal realization of the feedback path, , is the external state of the transformed system, the change in the internal state in a zero dynamics attack is ， For formula (15), its expression is solved recursively to obtain: ， where represents the part of the discrete system that diverges spontaneously due to initial conditions , the second term is an additional term that influences the behavior of the system, is a power of , since the behavior of is exponentially increasing, then , is a constant input vector of the same dimension as , equation (16) simplifies to: ， The geometric series of formula (17) is further written as: ， Thus we have: ， When time, So the sum of formula (19) also tends to infinity, that is, the additional term accelerates the overall divergence speed of the discrete system.

5. The method of claim 1, wherein the method is characterized by: The attack signal in step S3 is enhanced by the following steps: Formula (12a) and formula (12b) are expressed by Byrnes-Isidori norm as: ， ， ， wherein is the external state of the discrete system, is the change in the external state of the discrete system, is the input to the discrete system, the forward path being represented by a column vector of output data corresponding to the discrete system, and is the minimum realization of the transformed feedback path; is the coefficient in is the solution of equation (21b), , , the calculation formula of is: ， ， ， ， ， In order to optimize the attack strength, the attack model is modified, and the modified attack model is: ， wherein, To strengthen the attack data transformation matrix, design To destroy the closed-loop system, deceive the administrator, and design Mainly to destroy the stability of the internal state of the system, after being subjected to such a strong zero dynamic attack, the internal state will diverge, the destructive nature of the strong zero dynamic attack is determined by and When The system will collapse, The greater the value, the faster the discrete system collapses, in which case the discrete system loses its internal state and the attack state tends to diverge.

6. The method of claim 5, wherein the method is characterized by: The automatic voltage regulator is modeled and the enhanced zero-dynamics attack signal is constructed in step S4, and the enhanced zero-dynamics attack is launched on the basis of the modeling, wherein a calculation formula of a system model under the zero-dynamics attack is as follows: ， ， ， wherein is an attack signal, , , the calculation formula of is in formula (21c), formula (21d), formula (21e); An attack signal matching the zero-dynamics of the attacked system is constructed, so that the internal state and the external state of the system are separated: ， ， wherein, represents the attack data added to by logical operation, is the state vector calculated by the attacker using the system matrix, after the system is attacked, formulas (20a), (20b) and (20c) are transformed into: ， The designed enhanced zero-dynamics attack signal is injected into the AVR, and the following equation is obtained: ， ， ， wherein, represents the output data after the strengthening attack, is the external state of the system after the strengthening attack, is the change in the external state of the system after the strengthening attack, and compared to the ordinary zero dynamics attack, the modification results in and an additional term is introduced in the construction of the attack signal These two elements together produce a more disruptive enhanced zero dynamics attack signal.

Images