Method and system for identifying and actively reducing attack signal of electric power internet of things sensor

Abstract

The invention discloses a method and system for identifying and actively reducing attack signals of an electric power Internet of Things sensor, and the method comprises the steps: collecting output signals of the electric power Internet of Things sensor, constructing a signal feature library based on the output signals in the step 1, solving features in the feature library, and carrying out the recognition and active reduction of the attack signals; obtaining a feature extraction result, and analyzing the difference degree between the collected signal features and the normal signal features based on the feature extraction result, thereby carrying out attack signal identification, collecting attack signals, and analyzing related parameters of the attack signals; wherein the attack signal related parameters comprise the amplitude and frequency of the attack signal, and generating a reverse discrete digital signal of the attack signal based on the attack signal related parameters; high-frequency components in the reverse discrete digital signals are filtered out, sine waves of fundamental frequency are left, the sine waves and the collected signals are added, and final signals are generated. The method has the outstanding advantages of good protection effect, high effectiveness and the like.

Description

Technical Field

[0001] The present invention belongs to the field of smart grid security and relates to a method and system for identifying and actively eliminating attack signals of power Internet of Things sensors. Background Art

[0002] The power IoT sensor is a detection device that can sense the measured information and convert it into electrical signals or other forms of information output to meet the needs of information transmission, processing, storage, display, recording and control. The measured information can be various environmental phenomena such as light, heat, movement, humidity, pressure, etc. Since the sensor output electrical signals are generally weak and have nonlinearity and various errors, in order to facilitate signal processing, the sensor must also be equipped with an appropriate signal conditioning circuit to convert the sensor output electrical signals into useful signals that are easy to transmit, process, display, record and control.

[0003] As the main component of field acquisition components, power IoT sensors are used to obtain various parameters of the power system and its operating environment in real time. However, power IoT sensors that lack protection measures will face a series of problems in practical applications. First, sensors and their conditioning circuits are susceptible to electromagnetic interference and environmental noise, resulting in signal distortion or inaccurate data. Second, when sensors operate in harsh environments, they may be damaged by external factors such as high temperature, high humidity, corrosive gases or mechanical shock, which may shorten their service life or cause failures. In addition, malicious injection signals can interfere with the normal operation of sensors, causing the sensors to output incorrect data. This interference may manifest as random noise, constant deviation or interference signals of a specific frequency, making the sensor data received by the system inconsistent with the actual situation, affecting the accuracy and reliability of the data, and thus misleading system decisions. However, there are still few security protection measures for data uploading, and the security protection of sensor data acquisition and data storage is in a blank stage.

[0004] Signal reverse cancellation is an effective technology for reducing interference signals. This method has been maturely applied in active noise reduction technology. Modern adaptive active noise control AANC systems apply adaptive digital filtering. The principle is to collect noise signals through microphones, generate sound waves with opposite phases to the noise after real-time processing by the noise reduction circuit, and achieve the effect of eliminating noise after superposition with the noise. First, the noise signals in the environment are collected in real time through the microphone array. These signals are converted into electrical signals and transmitted to the noise reduction processing unit. Subsequently, the system analyzes the noise signals in the time domain and frequency domain to identify the main noise frequency components. The adaptive filter dynamically adjusts the parameters according to the input noise signal to generate an anti-phase signal with opposite phase to the original noise signal. Next, the noise reduction circuit converts the anti-phase signal into a sound wave through a speaker. The anti-phase sound wave is superimposed with the original noise sound wave in space. Due to the opposite phase, the superposition of the two sound waves produces a mutual cancellation effect, thereby achieving noise reduction.

[0005] CN115859283A discloses a data security defense system based on multi-agent reinforcement learning, which relates to the field of reinforcement learning and network security technology, including a data poisoning attack filtering module, a collaborative defense module and an interactive reward confidence module; the data poisoning attack filtering module is arranged at the sensor end, and the state disturbance attack of the state data is filtered through a pre-trained poisoning attack filtering network; the collaborative defense module is arranged at the controller end of the system, and the filtered state data is subjected to consistency analysis, and the communication cooperation strategy is adjusted; the interactive reward confidence module is arranged at the actuator end of the system, and the confidence of the interactive reward between multiple agents is output. This patent focuses on filtering data poisoning attacks, and processes disturbance attacks on state data through a pre-trained poisoning attack filtering network, but does not include active mitigation and signal recovery, so the patent is not very practical. In addition, this patent uses multi-agent reinforcement learning to achieve defense, but it is not very targeted in processing actual attack signals in complex working conditions of the power Internet of Things.

[0006] CN114338161A discloses an attack detection method, system, device, equipment and computer-readable storage medium for an information-physical system for privacy protection. When transmitting real-time data collected by a monitoring terminal, the aggregated data to be transmitted obtained by performing a preset nonlinear transformation on the noisy aggregated data generated based on the differential privacy mechanism is transmitted through a network communication channel. The data receiving end performs an inverse transformation of the preset nonlinear transformation on the received first aggregated data to obtain the second aggregated data. Then, attack detection is performed based on the estimated residual of the optimal estimate obtained by performing an optimal estimation of the aggregated data at the current moment based on the second aggregated data and the Kalman filter. This patent uses a differential privacy mechanism and noisy data to protect privacy, but this method will affect the accuracy of the data and the reliability of detection. This patent increases the randomness of real-time data to deal with the threshold problem caused by the differential privacy mechanism, but this method has limited effect on the attenuation and recovery of attack signals. Summary of the invention

[0007] In order to solve the shortcomings of the prior art such as low reliability, limited effect, weak practicality and weak pertinence, the present invention provides a method and system for identifying and actively reducing attack signals of power Internet of Things sensors.

[0008] The present invention adopts the following technical solution.

[0009] The present invention discloses a method for identifying attack signals of a power IoT sensor, comprising:

[0010] Step 1: Collect historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0011] Step 2: Fuse the historical output data of sensors of the same type as the historical collaborative sensing data of sensors of this type; preprocess the historical collaborative sensing data of sensors of different types, and construct a data set based on the preprocessing results;

[0012] Step 3: Build an attack signal detection model based on convolutional neural network (CNN);

[0013] Step 4: Train the attack signal detection model constructed in step 3 based on the data set in step 2;

[0014] Step 5: Collect the output data of the power IoT sensors in real time, calculate the real-time collaborative sensing data of each type of sensor, and perform the preprocessing described in step 2 on it. Input the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0015] More preferably,

[0016] In step 1, the multiple types of sensors include a voltage sensor, a current sensor, a frequency sensor, a temperature sensor, and a load sensor.

[0017] More preferably,

[0018] In step 2, the method of preprocessing the historical collaborative sensing data of different types of sensors and constructing a data set based on the preprocessing results is:

[0019] Perform data fusion preprocessing on the historical collaborative sensing data of each sensor at each sampling moment;

[0020] A label is set for each data fusion result, and a data set is constructed based on the data fusion results and the set labels.

[0021] More preferably,

[0022] The data fusion preprocessing of the historical collaborative sensing data of each sensor at each sampling moment is to perform weighted summation of the historical collaborative sensing data of each sensor at each sampling moment according to the following formula:

[0023]

[0024] Among them, V weighted,t is the weighted sum of the historical collaborative sensing data of each sensor at time t; k is an integer, and k∈[1,l], l is the total number of sensor types in the power IoT sensor; w k is the weight of the kth type of sensor; f k,t is the historical collaborative sensing data of the k-th type of sensor at time t;

[0025] The calculation formula of the weight of the k-th type of sensor is as follows:

[0026]

[0027] Among them I k is the data importance of the k-th type of sensor; R k is the data reliability of the kth type of sensor; h is an integer, and h∈[1,l]; I h is the data importance of the h-th type of sensor; R h is the data reliability of the hth type of sensor.

[0028] On the other hand, the present invention discloses a power IoT sensor attack signal recognition system based on a power IoT sensor attack signal recognition method, including a power IoT sensor historical data acquisition module, a data set construction module, an attack signal detection model construction module, an attack signal detection model training module and an attack signal real-time detection module:

[0029] The power Internet of Things sensor historical data collection module collects historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0030] The data set construction module fuses historical output data of sensors of the same type as historical collaborative sensing data of sensors of the same type; preprocesses historical collaborative sensing data of sensors of different types and constructs a data set based on the preprocessing results;

[0031] The attack signal detection model building module builds an attack signal detection model based on a convolutional neural network (CNN);

[0032] The attack signal detection model training module trains the attack signal detection model constructed by the attack signal detection model construction module based on the data set in the data set construction module;

[0033] The attack signal real-time detection module collects the output data of the power Internet of Things sensors in real time, calculates the real-time collaborative sensing data of various types of sensors, and performs the preprocessing described in the data set construction module on it, and inputs the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0034] The present invention discloses a method for identifying attack signals of a power IoT sensor, comprising:

[0035] Step 1: Collect the output signal of the power IoT sensor;

[0036] Step 2: construct a signal feature library based on the output signal in step 1, and obtain the features in the feature library to obtain the feature extraction result;

[0037] Step 3: Analyze the difference between the collected signal features and the normal signal features based on the feature extraction results, so as to identify the attack signal;

[0038] Step 4: Collect the attack signal and analyze the attack signal related parameters; the attack signal related parameters include the amplitude and frequency of the attack signal;

[0039] Step 5: Generate an inverse discrete digital signal of the attack signal based on the attack signal related parameters; filter out the high-frequency components in the inverse discrete digital signal, leaving the base frequency sine wave;

[0040] Step 6: Add the sine wave obtained in step 5 to the signal collected in step 1 to generate the final signal.

[0041] More preferably,

[0042] In step 2, the feature library is constructed based on the output signal in step 1, which is to select the features set corresponding to each output signal type to form an attack signal feature library; the signal types include voltage signals, current signals, frequency signals, temperature signals and load signals.

[0043] More preferably,

[0044] In step 3, the difference Δ between the acquired signal characteristics and the normal signal characteristics is as follows:

[0045] Δ=[Δ1,……,Δ n ];

[0046] Among them, Δ1 is the difference between the collected signal and the normal signal in the first feature; Δ n It is the difference between the collected signal and the normal signal in the nth feature; n is the total number of features.

[0047] More preferably,

[0048] The difference between the i-th feature of the collected signal and the i-th feature of the normal signal Δ i As shown below:

[0049]

[0050] Where i is an integer and i∈[1,n]; T i is the ith normal eigenvector; t′ ij is the eigenvalue of the i-th feature at the j-th sampling point; j is an integer, and j∈[1,m]; m is the total number of sampling points in the output signal collected in step 1.

[0051] More preferably,

[0052] In step 3, the difference degree D between the acquired signal characteristics and the normal signal characteristics is as follows:

[0053] D=[D1,……,D m ];

[0054] Where D1 is the comprehensive difference between the characteristics of the collected signal at the first sampling point and the normal signal characteristics; D m is the comprehensive difference between the characteristics of the collected signal at the mth sampling point and the normal signal characteristics; m is the total number of sampling points in the output signal collected in step 1.

[0055] More preferably,

[0056] The comprehensive difference between the collected signal characteristics and the normal signal characteristics at the jth sampling point D j :

[0057]

[0058] Where j is an integer and j∈[1,m]; m is the total number of sampling points in the output signal collected in step 1; r is an integer and r∈[1,n]; n is the total number of features; w f,i is the weight of the difference vector of the i-th feature; d ij is the jth difference vector of the ith feature; w f,r is the weight of the difference vector of the rth feature;

[0059] The difference vector d of the sth feature sj Calculated according to the following formula:

[0060] d sj =t′ sj -T s ;

[0061] Among them, t′ sj is the characteristic value of the sth feature at the jth sampling point; T s is the sth normal eigenvector.

[0062] More preferably,

[0063] In step 3, the method for identifying the attack signal based on the difference degree is as follows:

[0064] Calculate the standard deviation of each feature based on the collected signal, and use three times the standard deviation of the i-th feature as the i-th feature attack signal recognition threshold;

[0065] When the difference between the collected signal and the normal signal in the i-th feature is greater than the i-th feature attack signal recognition threshold, the signal collected by the sensor corresponding to the i-th feature is determined to be an attack signal.

[0066] More preferably,

[0067] In step 3, the attack signal identification method based on the difference degree is as follows:

[0068] Calculate the standard deviation of each feature based on the collected signal, obtain the mean of each standard deviation, and use three times of the mean as the first attack signal recognition threshold;

[0069] When the comprehensive difference between the collected signal characteristics and the normal signal characteristics at the j-th sampling point is greater than the first attack signal recognition threshold, it is preliminarily determined that there is an attack signal at the moment corresponding to the j-th sampling point;

[0070] When it is determined that there is an attack signal at a certain moment, the standard quantity of each feature is solved;

[0071] When the standard values ​​of all features belong to [-3,3], it is determined that there is no attack signal;

[0072] When the standard quantity of the i-th feature does not satisfy ζ i ∈[-3,3], then the signal collected by the sensor corresponding to the i-th feature is determined to be an attack signal;

[0073] The standard quantity of the i-th feature is as follows:

[0074]

[0075] in, is the mean of the eigenvalues ​​at each sampling point in the eigenvector of the i-th feature; T′ i,E is the expected value of the i-th feature; σ i is the standard deviation of the eigenvalues ​​at each sampling point in the i-th eigenvector.

[0076] On the other hand, the present invention discloses a power IoT sensor attack signal recognition system based on a power IoT sensor attack signal recognition method, including a power IoT sensor signal acquisition module, a feature extraction module, an attack signal recognition module, an attack signal acquisition module, an attack signal processing module and an attack signal active reduction module:

[0077] The power Internet of Things sensor signal acquisition module collects the output signal of the power Internet of Things sensor;

[0078] The feature extraction module constructs a signal feature library based on the output signal of the power IoT sensor signal acquisition module, and obtains the features in the feature library to obtain a feature extraction result;

[0079] The attack signal recognition module analyzes the difference between the collected signal features and the normal signal features based on the feature extraction result, thereby performing attack signal recognition;

[0080] The attack signal acquisition module acquires the attack signal and analyzes the attack signal related parameters; wherein the attack signal related parameters include the amplitude and frequency of the attack signal;

[0081] The attack signal processing module inputs the attack signal related parameters into the digital signal processing chip, and the digital signal processing chip generates a reverse discrete digital signal of the attack signal according to the attack signal related parameters; filters out the high-frequency components in the reverse discrete digital signal, leaving the base frequency sine wave;

[0082] The attack signal active reduction module adds the sine wave obtained in the attack signal processing module to the signal collected by the power Internet of Things sensor signal collection module to generate a final signal.

[0083] On the other hand, the present application discloses an electronic device, including a processor and a storage medium; the characteristics are:

[0084] The storage medium is used to store instructions;

[0085] The processor is used to operate according to the instructions to execute the aforementioned power Internet of Things sensor attack signal identification method or attack signal identification and active mitigation method.

[0086] The present application also discloses a computer-readable storage medium having a computer program stored thereon, characterized in that when the program is executed by a processor, the power Internet of Things sensor attack signal recognition method or the attack signal recognition and active mitigation method is implemented.

[0087] The beneficial effect of the present invention is that, compared with the prior art,

[0088] The present invention aims at the potential safety hazards in the data acquisition and data storage of power IoT sensors, and proposes a method for identifying and actively reducing malicious attack signals in complex power working conditions, which effectively defends against malicious attacks that cause data errors in power IoT sensors through transduction attacks. After the power IoT sensor senses the measured signal and converts it into an electrical signal or other form of signal, it extracts features and performs mathematical and statistical analysis on the output signal of the power IoT sensor to identify whether an attack signal has appeared, and actively reduces the impact of a single sensor being attacked on the overall system output based on the neural network fusion of multi-modal sensors or the mean summation of similar sensors.

[0089] Aiming at the potential safety protection problems of sensor data acquisition and data storage, the present invention proposes a method for attack signal recognition and active reduction of power IoT devices. The method is based on magneto-optical-acoustic-electrical signal feature analysis technology, circuit design optimization and signal processing technology, and can effectively defend against malicious attacks that tamper with the parameters of power IoT sensors. By performing signal processing and intrinsic analysis on the output signal of the sensor, the method can monitor whether the feedback data is likely to be tampered with; by integrating the spatial, temporal and frequency domain difference information of the same type of sensors and the multimodal information obtained by different types of sensors, the method can actively reduce the attack signal, realize the detection and defense of malicious attack signals in complex power working conditions, and ensure the authenticity and accuracy of the perceived data.

[0090] The present invention focuses on the authenticity and accuracy of data, and may provide better protection effects in practical applications;

[0091] The present invention can more effectively deal with malicious attack signals through active mitigation technology and signal offset strategy.

[0092] The present invention not only focuses on attack identification, but also includes active mitigation and signal recovery, which is more comprehensive.

[0093] The present invention can more specifically handle anomalies and malicious attacks of power sensor data through feature extraction and multimodal sensor fusion.

[0094] In addition, the present invention has outstanding advantages such as good protective effect and high effectiveness. BRIEF DESCRIPTION OF THE DRAWINGS

[0095] Figure 1 It is a flowchart of the attack detection method based on signal intrinsic difference;

[0096] Figure 2 This is a schematic diagram of the sensing enhancement process based on multi-dimensional information fusion.

[0097] Figure 3 The invention is a flowchart of an attack signal recognition and active mitigation method for power Internet of Things equipment. DETAILED DESCRIPTION

[0098] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only part of the embodiments of the present invention, not all of them. Based on the spirit of the present invention, other embodiments obtained by ordinary technicians in this field without creative work are all within the scope of protection of the present invention.

[0099] The present application discloses a method for identifying attack signals of a power IoT sensor, comprising:

[0100] Step 1: Collect historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0101] The multiple types of sensors include a voltage sensor, a current sensor, a frequency sensor, a temperature sensor and a load sensor.

[0102] Step 2: Fuse the historical output data of sensors of the same type as the historical collaborative sensing data of sensors of this type; preprocess the historical collaborative sensing data of sensors of different types, and construct a data set based on the preprocessing results;

[0103] Preferably, the historical output data of sensors of the same type are fused as the historical collaborative sensing data of sensors of this type by obtaining the average value of the historical output data of sensors of the same type at each sampling moment and taking the average value as the historical collaborative sensing data at the corresponding moment.

[0104] The method of preprocessing the historical collaborative sensing data of different types of sensors and constructing a data set based on the preprocessing results is preferably:

[0105] Perform data fusion preprocessing on the historical collaborative sensing data of each sensor at each sampling moment;

[0106] The data fusion preprocessing of the historical collaborative sensing data of each sensor at each sampling moment is to perform weighted summation of the historical collaborative sensing data of each sensor at each sampling moment according to the following formula:

[0107]

[0108] Among them, V weighted,t is the weighted sum of the historical collaborative sensing data of each sensor at time t; k is an integer, and k∈[1,l], l is the total number of sensor types in the power IoT sensor; w k is the weight of the kth type of sensor; f k,t is the historical collaborative sensing data of the k-th type of sensor at time t;

[0109] The calculation formula of the weight of the k-th type of sensor is as follows:

[0110]

[0111] Among them I k is the data importance of the k-th type of sensor; R k is the data reliability of the kth type of sensor; h is an integer, and h∈[1,l]; I h is the data importance of the h-th type of sensor; R h is the data reliability of the hth type of sensor.

[0112] In a preferred embodiment, the preferred values ​​of the importance and reliability of the voltage, current, frequency, temperature and load sensors are shown in Table 1;

[0113] Table 1 Preferred values ​​of importance and reliability of voltage, current, frequency, temperature and load sensors

[0114] sensor <![CDATA[Importance I i > <![CDATA[Reliability R i > Voltage 0.6 0.9 Current 0.5 0.85 frequency 0.8 0.95 temperature 0.4 0.8 load 0.7 0.9

[0115] In a preferred embodiment of the present invention, the data reliability of the u-th type of sensor is expressed as follows:

[0116]

[0117] Among them, R u is the data reliability of the u-th type of sensor; u is an integer, and u∈[1,l]; σ u is the standard deviation of the u-th type of sensor data; σ h is the standard deviation of the h-th type of sensor data; Rr uis the initial reliability of the u-th type of sensor data;

[0118]

[0119] Where e is the natural base; is the mean value of the u-th type of sensor data.

[0120] A label is set for each data fusion result, and a data set is constructed based on the data fusion results and the set labels.

[0121] The preprocessing of the historical collaborative sensing data of different types of sensors may also be performed in the following manner:

[0122] Normalize and pre-process the historical collaborative sensing data of each sensor respectively;

[0123] Labels are set for the normalized data, and a dataset is constructed based on the normalized data and the set labels.

[0124] The set labels include label 1 and label 2, wherein label 1 corresponds to a detected attack, and label 2 corresponds to an undetected attack.

[0125] Step 3: Build an attack signal detection model based on convolutional neural network (CNN);

[0126] Step 4: Train the attack signal detection model constructed in step 3 based on the data set in step 2;

[0127] Step 5: Collect the output data of the power IoT sensors in real time, calculate the real-time collaborative sensing data of each type of sensor, and perform the preprocessing described in step 2 on it. Input the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0128] Example 1

[0129] A method for identifying attack signals of power Internet of Things sensors.

[0130] Step 1: Collect historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0131] The application scenarios of the method include but are not limited to a power grid security detection system. In one embodiment, the power grid security status monitoring system monitors key parameters of the power grid in real time through multiple sensors, such as voltage, current, frequency, temperature, and power load. These sensors are distributed at different nodes of the power grid, and the collected information can be processed by the information fusion center to ensure the stability and security of the power grid.

[0132] In one embodiment, the sensor includes a voltage sensor, a current sensor, a frequency sensor, a temperature sensor and a load sensor; the voltage sensor is used to monitor the voltage level of each node; the current sensor is used to monitor the current flow of each line or device; the frequency sensor is used to monitor the frequency stability of the power grid; the temperature sensor is used to monitor the temperature of key equipment such as transformers and generators; the load sensor is used to monitor the power load of the system. The information fusion center first performs a weighted summation on the data of each sensor. The purpose of this step is to assign different weights to different sensor data to reflect their different impacts on the safety status of the power grid. For example, frequency fluctuations may have a greater impact on power grid security, so the data of the frequency sensor can be assigned a higher weight, and the calculation method is as follows:

[0133] Step 2: Fuse the historical output data of sensors of the same type as the historical collaborative sensing data of sensors of this type; preprocess the historical collaborative sensing data of sensors of different types, and construct a data set based on the preprocessing results;

[0134] The preprocessing of the historical collaborative sensing data of different types of sensors is to perform weighted summation of the data of each sensor, and the formula is as follows:

[0135] V weighted =w1·f1+w2·f2+…+w n ·f n ;

[0136] Where V weighted is the result of weighted summation of the data of each sensor; n is the total number of sensors for weighted summation, in the present invention n=5, f1 is the output result of the first sensor, w1 is the weight of the output result of the first sensor; f2 is the output result of the second sensor, w2 is the weight of the output result of the second sensor; f n is the output of the nth sensor, w n is the weight of the output result of the nth sensor.

[0137] Assume that the output of the voltage sensor is V, the output of the current sensor is I, the output of the frequency sensor is F, the output of the temperature sensor is T, and the output of the load sensor is L. The weighted summation calculation formula is:

[0138] V weighted =w V ·V+w I I+w f ·f+w T ·T+w L ·L

[0139] Assume that the importance and reliability of sensor data are denoted as I i and R i , then the weight of the sensor w i It can be determined by the following formula:

[0140]

[0141] I i is the importance of sensor i to the security status of the power grid. i is the reliability of sensor i, which is used to measure the accuracy or credibility of sensor data. An initial importance value I can be assigned to each sensor based on historical experience or expert system. i Through data evaluation, calibration, etc., the reliability value R of each sensor is determined i

[0142] In one embodiment, preferred values ​​of the importance and reliability of voltage, current, frequency, temperature and load sensors are shown in Table 1;

[0143] Calculate the sensor weight as According to the weights, we can get:

[0144] V weighted =0.21·V+0.17·I+0.30·f+0.11·T+0.21·L

[0145] Step 3: Build an attack signal detection model based on convolutional neural network (CNN);

[0146] Step 4: Train the attack signal detection model constructed in step 3 based on the data set in step 2;

[0147] Step 5: Collect the output data of the power IoT sensors in real time, calculate the real-time collaborative sensing data of each type of sensor, and perform the preprocessing described in step 2 on it. Input the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0148] The weighted summed data is used as input to the trained neural network model. This neural network has been trained with a large amount of historical data and can identify the characteristics of the power grid in normal, abnormal, and faulty states. Its input layer receives weighted sensor data, and the hidden layer operates through multiple neurons. The output layer outputs the safety status of the power grid, including multiple categories such as "normal", "warning", and "fault". If an abnormality is detected, the system can issue an alarm or automatically perform certain safety measures, such as cutting off certain lines or adjusting the operating parameters of the power grid to ensure overall safety.

[0149] Example 2

[0150] Step 1: Collect historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0151] Step 2: Fuse the historical output data of sensors of the same type as the historical collaborative sensing data of sensors of this type; preprocess the historical collaborative sensing data of sensors of different types, and construct a data set based on the preprocessing results;

[0152] The spatial, temporal and frequency domain difference information of the same type of sensors and the multimodal information obtained by different types of sensors are integrated to enhance the credibility of the sensing results.

[0153] For similar sensors, such as Figure 1 As shown in the figure, considering that attackers usually attack a single sensor, the fusion of multiple sensor data can enhance the sensing reliability and increase the attack cost. The average algorithm is used for the multi-information fusion of the same type of sensors. The data provided by a group of similar sensors are summed and averaged, and the average is used as the output value of the collaborative sensing of this type of sensors, so that attacking a single sensor cannot achieve the desired attack effect.

[0154] For different types of multimodal sensors, such as Figure 1 As shown, a group of suitable sensors are selected according to different perception objects and perception requirements, and then the artificial neural network algorithm is used to fuse the multi-dimensional data to obtain the perception output.

[0155] Step 3: Build an attack signal detection model based on convolutional neural network (CNN);

[0156] Step 4: Train the attack signal detection model constructed in step 3 based on the data set in step 2;

[0157] The neural network determines the classification criteria based on the similarity of the samples accepted by the current system, which is mainly reflected in the weight distribution of the network, which is obtained through the training process. In the training stage, the neural network uses a large amount of sample data and continuously adjusts the weights in the network through optimization algorithms such as gradient descent to minimize the prediction error. At the same time, a learning algorithm is used to acquire knowledge and obtain an uncertainty reasoning mechanism. Knowledge refers to the model parameters obtained through the training process, namely weights and biases. These parameters reflect the learning results of the network on the input data, including the characteristics and patterns of the data. The signal processing capabilities and automatic reasoning functions of the neural network are used to realize multi-sensor data fusion.

[0158] Step 5: Collect the output data of the power IoT sensors in real time, calculate the real-time collaborative sensing data of each type of sensor, and perform the preprocessing described in step 2 on it. Input the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0159] The multi-sensor collaborative working scheme based on the neural network intelligent fusion algorithm combines the information of multi-modal sensors to enhance the credibility and robustness of the measurement results and resist the system-level impact of attacks.

[0160] The machine learning model selected in the neural network intelligent fusion algorithm can be a convolutional neural network CNN, a recurrent neural network RNN, a long short-term memory network LSTM, etc.; in a preferred embodiment of the present invention, a convolutional neural network CNN is used for implementation.

[0161] The present application also discloses a power IoT sensor attack signal identification system based on a power IoT sensor attack signal identification method, including a power IoT sensor historical data acquisition module, a data set construction module, an attack signal detection model construction module, an attack signal detection model training module and an attack signal real-time detection module:

[0162] The power Internet of Things sensor historical data collection module collects historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors;

[0163] The data set construction module fuses historical output data of sensors of the same type as historical collaborative sensing data of sensors of the same type; preprocesses historical collaborative sensing data of sensors of different types and constructs a data set based on the preprocessing results;

[0164] The attack signal detection model building module builds an attack signal detection model based on a convolutional neural network (CNN);

[0165] The attack signal detection model training module trains the attack signal detection model constructed by the attack signal detection model construction module based on the data set in the data set construction module;

[0166] The attack signal real-time detection module collects the output data of the power Internet of Things sensors in real time, calculates the real-time collaborative sensing data of various types of sensors, and performs the preprocessing described in the data set construction module on it, and inputs the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

[0167] The present application discloses a method for identifying and actively mitigating attack signals of power IoT sensors, including:

[0168] Step 1: Collect the output signal of the power IoT sensor;

[0169] The power Internet of Things sensor includes a voltage sensor, a current sensor, a frequency sensor, a temperature sensor and a load sensor.

[0170] Step 2: construct a signal feature library based on the output signal in step 1, and obtain the features in the feature library to obtain the feature extraction result;

[0171] The feature library is constructed based on the output signal in step 1, which is to select the features set corresponding to each output signal type to form an attack signal feature library; the signal types include voltage signals, current signals, frequency signals, temperature signals and load signals.

[0172] Obtain the features in the feature library and obtain the feature extraction results;

[0173] Characteristic vector array T′:

[0174] T′=(T′1,……,T′ n );

[0175] Among them, T′1 is the feature vector of the first feature; T′ n is the feature vector of the nth feature; n is the total number of features;

[0176] The feature vector T′ of the i-th feature i As shown below:

[0177] T′ i =(t′ i1 ,……,t′ im );

[0178] Where i is an integer and i∈[1,n]; t′ i1 is the eigenvalue of the i-th feature at the first sampling point; t′ im is the eigenvalue of the ith feature at the mth sampling point; m is the total number of sampling points in the output signal collected in step 1.

[0179] Step 3: Analyze the difference between the collected signal features and the normal signal features based on the feature extraction results, so as to identify the attack signal;

[0180] Preferably, the difference degree Δ between the collected signal characteristics and the normal signal characteristics is as follows:

[0181] Δ=[Δ1,……,Δ n ];

[0182] Among them, Δ1 is the difference between the collected signal and the normal signal in the first feature; Δ n It is the difference between the collected signal and the normal signal in the nth feature; n is the total number of features.

[0183] The difference between the i-th feature of the collected signal and the i-th feature of the normal signal Δ i As shown below:

[0184]

[0185] Among them, T i is the ith normal eigenvector; t′ ij is the eigenvalue of the i-th feature at the j-th sampling point; j is an integer, and j∈[1,m].

[0186] In a preferred embodiment, the method for identifying attack signals based on the degree of difference is: calculate the standard deviation of each feature based on the collected signal, and use three times the standard deviation of the ith feature as the attack signal identification threshold of the ith feature; when the degree of difference between the collected signal and the normal signal in the ith feature is greater than the attack signal identification threshold of the ith feature, the signal collected by the sensor corresponding to the ith feature is determined to be an attack signal.

[0187] Preferably, the difference between the collected signal characteristics and the normal signal characteristics can also be calculated according to the following formula:

[0188] The degree of difference D between the acquired signal characteristics and the normal signal characteristics is as follows:

[0189] D=[D1,……,D m ];

[0190] Where D1 is the comprehensive difference between the characteristics of the collected signal at the first sampling point and the normal signal characteristics; D m is the comprehensive difference between the characteristics of the collected signal at the mth sampling point and the normal signal characteristics; m is the total number of sampling points in the output signal collected in step 1.

[0191] The comprehensive difference between the collected signal characteristics and the normal signal characteristics at the jth sampling point D j :

[0192]

[0193] Where j is an integer and j∈[1,m]; m is the total number of sampling points in the output signal collected in step 1; r is an integer and r∈[1,n]; n is the total number of features; w f,i is the weight of the difference vector of the i-th feature; d ij is the difference vector of the i-th feature; w f,r is the weight of the difference vector of the rth feature;

[0194] The weight of each feature vector is set according to the sensor type corresponding to the feature vector:

[0195] The calculation formula of the weight of the k-th type of sensor is as follows:

[0196]

[0197] Among them I k is the data importance of the k-th type of sensor; R k is the data reliability of the kth type of sensor; h is an integer, and h∈[1,l]; I h is the data importance of the h-th type of sensor; R h is the data reliability of the hth type of sensor.

[0198] In a preferred embodiment, the preferred values ​​of the importance and reliability of the voltage, current, frequency, temperature and load sensors are shown in Table 2;

[0199] Table 2 Preferred values ​​of importance and reliability of voltage, current, frequency, temperature and load sensors

[0200] sensor <![CDATA[Importance I i > <![CDATA[Reliability R i > Voltage 0.6 0.9 Current 0.5 0.85 frequency 0.8 0.95 temperature 0.4 0.8 load 0.7 0.9

[0201] In a preferred embodiment of the present invention, the data reliability of the u-th type of sensor is expressed as follows:

[0202]

[0203] Among them, R u is the data reliability of the u-th type of sensor; u is an integer, and u∈[1,l]; σ u is the standard deviation of the u-th type of sensor data; σ h is the standard deviation of the h-th type of sensor data; Rr u is the initial reliability of the u-th type of sensor data;

[0204] The difference vector d of the sth feature sj Calculated according to the following formula:

[0205] d sj =t′ sj -T s ;

[0206] Among them, t′ sj is the characteristic value of the sth feature at the jth sampling point; T s is the sth normal eigenvector.

[0207] In a preferred embodiment, the attack signal identification method based on the difference degree is as follows:

[0208] Calculate the standard deviation of each feature based on the collected signal, obtain the mean of each standard deviation, and use three times of the mean as the first attack signal recognition threshold;

[0209] When the comprehensive difference between the collected signal characteristics and the normal signal characteristics at the j-th sampling point is greater than the first attack signal recognition threshold, it is preliminarily determined that there is an attack signal at the moment corresponding to the j-th sampling point;

[0210] When it is determined that there is an attack signal at a certain moment, the standard quantity of each feature is solved;

[0211] When the standard values ​​of all features belong to [-3,3], it is determined that there is no attack signal;

[0212] When the standard quantity of the i-th feature does not satisfy ζ i ∈[-3,3], then the signal collected by the sensor corresponding to the i-th feature is determined to be an attack signal;

[0213] The standard quantity of the i-th feature is as follows:

[0214]

[0215] in, is the mean of the eigenvalues ​​at each sampling point in the eigenvector of the i-th feature; T′ i,E is the expected value of the i-th feature; σ i is the standard deviation of the eigenvalues ​​at each sampling point in the i-th eigenvector.

[0216] In a preferred embodiment, the attack signal recognition is performed based on the difference degree, and the difference degree is input into a pre-trained attack signal recognition model constructed based on a convolutional neural network (CNN) to obtain an attack signal recognition result;

[0217] During the attack signal recognition model training process, the training output is 6 labels corresponding to the input settings, namely label 1, label 2, label 3, label 4, label 5, and label 6; wherein label 1 corresponds to no attack signal detected, label 2 corresponds to a voltage signal detected as an attack signal, label 3 corresponds to a current signal detected as an attack signal, label 4 corresponds to a frequency signal detected as an attack signal, label 5 corresponds to a temperature signal detected as an attack signal, and label 6 corresponds to a load signal detected as an attack signal.

[0218] Step 4: Collect the attack signal and analyze the attack signal related parameters; the attack signal related parameters include the amplitude and frequency of the attack signal;

[0219] Step 5: Generate an inverse discrete digital signal of the attack signal based on the attack signal related parameters; filter out the high-frequency components in the inverse discrete digital signal, leaving the base frequency sine wave;

[0220] Step 6: Add the sine wave obtained in step 5 to the signal collected in step 1 to generate the final signal.

[0221] Example 3

[0222] The present invention discloses a method for identifying and eliminating attack signals of power IoT sensors, such as Figure 2 As shown, attack signal recognition is first performed. Attack signal recognition realizes the recognition of malicious signals through signal feature selection, feature extraction and mathematical statistical analysis. When a malicious signal is recognized, the attack signal, i.e., the malicious signal, is actively reduced. The active reduction of the malicious signal is achieved by summing the mean of the same type of sensors or fusion of multi-modal sensor neural networks. If no malicious signal is recognized, the recognition process is terminated.

[0223] Step 1: Collect the output signal of the power Internet of Things sensor; and perform signal processing on the output signal of the power Internet of Things sensor.

[0224] like Figure 3 As shown, the output signal of the power Internet of Things sensor is first processed, including amplification, filtering, and spectrum analysis. Amplification refers to enhancing the amplitude or voltage of the signal, and filtering is used to eliminate noise and useless frequencies in the signal. Spectral analysis is used to decompose the signal into amplitude and phase information of different frequency components, so as to deeply understand the frequency distribution characteristics of the signal. The power Internet of Things sensor includes a voltage sensor, a current sensor, an acceleration sensor, a frequency sensor, a temperature sensor, a load sensor, etc.

[0225] Step 2: construct a signal feature library based on the output signal in step 1, and obtain the features in the feature library to obtain the feature extraction result;

[0226] 2.1 As Figure 3 As shown, for signal types of different sensors, a corresponding attack signal recognition feature library is constructed, and during actual detection, the features set for each signal type are selected according to the sensor output signal type to form the feature library;

[0227] Those skilled in the art should know that the set features are features that can represent the characteristics of the signal type and can be set by those skilled in the art according to actual conditions. In order to improve calculation accuracy, the method of setting features corresponding to each signal type proposed in the embodiment of the present invention is only a preferred embodiment and is not an inevitable limitation for implementing the method for identifying attack signals of power Internet of Things sensors of the present invention.

[0228] Preferably, Figure 3 As shown, when the sensor output signal type includes current signal, voltage signal, etc., the characteristics set for the current signal include amplitude-frequency curve, phase-frequency curve, heat dissipation power, etc.; the characteristics set for the voltage signal include change trend, high-order noise, peak frequency, etc.;

[0229] The constructed attack signal recognition feature library includes amplitude-frequency curve, phase-frequency curve, heat dissipation power, change trend, high-order noise, peak frequency, etc.

[0230] The features contained in the feature library of the present invention are all presented in time series. Those skilled in the art should know that the amplitude-frequency curve is presented in a time series composed of the amplitude of each sampling point, and the phase-frequency curve is presented in a time series composed of the phase of each sampling point; that is, at a certain sampling point, the amplitude-frequency curve feature in the feature library is presented as the amplitude of the sampling point; the phase-frequency curve feature in the feature library is presented as the phase of the sampling point; the feature recording method in other feature libraries is similar to that of the amplitude-frequency curve and the phase-frequency curve. Those skilled in the art should know how to obtain the values, so they will not be repeated here.

[0231] 2.2 Perform feature extraction and mathematical statistical analysis to achieve attack signal identification;

[0232] Extract features of the input sample signal according to the selected feature library to obtain features in the feature library;

[0233] In the preferred embodiment of the present invention, the input signal is subjected to real-time feature dimension reduction by using eigenanalysis, thereby achieving feature extraction and obtaining a feature vector array T′:

[0234] T′=(T′1,T′2,T′3,…,T′ n );

[0235] Among them, T′1 is the real-time feature vector of the first dimension; T′2 is the real-time feature vector of the second dimension; T′3 is the real-time feature vector of the third dimension; T′ n is the real-time feature vector of the nth dimension; T′ i is the real-time feature vector of the i-th dimension; i is an integer, and i∈[1,n]; n is the total number of dimensions; the i-th dimension is the i-th feature in the feature library.

[0236] Those skilled in the art should know that the intrinsic analysis is a feature extraction method, which uses methods such as calculating eigenvalues ​​or eigenvectors to obtain a feature vector array of the input signal; that is, the existing technology is used to obtain each feature in the attack signal feature library constructed in step 2. For example, when the input signal includes current, the heat dissipation power in its feature library can be calculated based on the current signal and resistance characteristics. That is, assuming that the load resistance R and the current signal I are known, the heat dissipation power can be calculated according to the existing formula as the feature vector of the heat dissipation power.

[0237] For each dimension of the real-time feature vector, the difference between it and the corresponding normal signal feature vector is calculated as the degree of signal difference; the normal signal feature vector array T = [T1, T2, T3, ..., T n]; T1 is the first normal eigenvector; T2 is the second normal eigenvector; T3 is the third normal eigenvector; T n is the nth normal eigenvector; the i-th normal eigenvector T i The acquisition method is: sampling the output results of the sensor within a set time period under normal circumstances, and calculating and obtaining the i-th eigenvector at each sampling point, and taking the average of the i-th eigenvectors of each sampling point as the i-th normal eigenvector; the preferred set time period is 1 hour and the sampling frequency is 1 minute.

[0238] Step 3: Analyze the difference between the collected signal features and the normal signal features based on the feature extraction results, so as to identify the attack signal;

[0239] Those skilled in the art should know that the difference between calculated vectors can be achieved through commonly used distance measurement methods such as cosine similarity, Hamming distance, Manhattan distance, Chebyshev distance, Minkal distance, Jacquard index, etc., and those skilled in the art can choose according to actual conditions; in order to improve the calculation accuracy, the distance calculation method proposed in the embodiment of the present invention is only a preferred embodiment, and is not an inevitable limitation for implementing the method for identifying attack signals of power Internet of Things sensors of the present invention.

[0240] Preferably, the signal difference degree Δ is calculated according to the following formula:

[0241]

[0242] Where Diff is the intrinsic difference degree calculation function; T i is the i-th normal eigenvector; T′ i is the i-th real-time feature vector; i is an integer, and i∈[1,n]; n is the total number of feature vectors; that is, the total number of normal feature vectors or the total number of real-time feature vectors.

[0243] The obtained characteristic difference calculation results are subjected to mathematical and statistical analysis to detect and determine whether there is an attack signal.

[0244] Samples composed of multi-dimensional difference degree vectors are classified by machine learning models such as neural networks, or classified by simple criteria such as Gaussian mixture models or threshold comparison. For example, the comprehensive difference degree of the signal is calculated by weighted average, and the calculation method is as follows:

[0245] Assume there are m difference vectors, each of which is n-dimensional, and the difference vector group is: d1, d2, …, d m , each vector d j =[d j1 ,d j2 ,…,d jn ], where j = 1, 2, ..., m; where dji =t′ ji -t ji ; In addition, each difference vector is given a weight w = [w1, w2, ..., w m ], the weighted average comprehensive vector D = [D1, D2, ..., D n ], the calculation formula of its i-th dimension is:

[0246]

[0247] When detecting anomalies or faults in signals, preferably, the preset threshold is set to 3 times the standard deviation of the signal mean, i.e., the 3σ principle, which is used to detect signals that significantly deviate from normal behavior. If the comprehensive difference is greater than the preset threshold, it is considered that the current sensor output signal is affected by the attack. In general, normal signals usually have similar mathematical and statistical characteristics, such as the same amplitude range, median variance range, etc., while artificially introduced abnormal signals usually exceed the normal range in the value of one or more characteristics.

[0248] Step 4: Collect the attack signal and analyze the attack signal related parameters; the attack signal related parameters include the amplitude and frequency of the attack signal;

[0249] For the attack signal, the parameters such as the amplitude and frequency of the abnormal signal are output to the signal generation module.

[0250] Step 5: Generate an inverse discrete digital signal of the attack signal based on the attack signal related parameters; filter out the high-frequency components in the inverse discrete digital signal, leaving the base frequency sine wave;

[0251] The reverse signal is generated according to the parameters. The signal generation module is completed by the coordination of software and hardware. Preferably, DSP and low-pass filter are used for construction.

[0252] Step 6: Add the sine wave obtained in step 5 to the signal collected in step 1 to generate the final signal.

[0253] DSP can quickly generate accurate discrete digital signals, but this signal cannot reversely cancel the original signal in the analog domain. A low-pass filter can be used to filter out high-frequency components, leaving the baseband sine wave. After the reverse cancellation module is generated, it is added to the original signal to generate the final signal.

[0254] Generating a reverse signal of an abnormal signal according to signal-related parameters is a prior art, and those skilled in the art should know how to implement it.

[0255] Example 4

[0256] When the equipment is in normal working condition, the time series of each node signal [S1, S2, S3…Sn ], where S i is the time series of the i-th group of signals collected. Through signal processing methods such as discrete Fourier transform FFT and wavelet transform, the characteristic quantities of these signal time series such as frequency distribution and phase curve [f1,f2,f3…f n ], where f i is the characteristic of the i-th group of signals. The amplitudes of the frequency components of these characteristic quantities should be constrained by certain physical laws. We use theoretical derivation to obtain their expected values ​​f E , the amplitude of a certain frequency component should be within the expected value range. When the number of sampling times is large enough, the eigenvalue will also show a certain distribution law. The mathematical statistics method is used to characterize the eigenvalue distribution model.

[0257] The eigenvalue distribution model is obtained as follows:

[0258] Calculate the feature quantity f i The mean and variance of :

[0259]

[0260] According to the Lindberg-Levi theorem, the expression of the standard quantity ζ of the characteristic quantity is obtained:

[0261]

[0262] The standard quantity ζ conforms to the standard normal distribution. According to the probability distribution of the standard quantity ζ, the characteristic value f of the i-th group of signals can be inferred. i The probability distribution of the eigenvalue, i.e., the distribution model of the eigenvalue, and then the eigenvalue f i The probability of taking a certain value. The "3σ" rule is usually used to determine whether a value is abnormal, that is, when ζ∈[-3,3], it means that the signal at this time is normal. This range is set as the normal value range. If the signal difference is greater than the preset threshold, it is considered that the current sensor output signal is affected by the attack.

[0263] For the attack signal, the parameters such as the amplitude and frequency of the abnormal signal are output to the signal generation module. A reverse signal is generated according to the parameters. The signal generation module is completed by the collaboration of software and hardware. Preferably, it is constructed using DSP and low-pass filter. DSP can quickly generate accurate discrete digital signals, but the signal cannot reversely cancel the original signal in the analog domain. A low-pass filter can be used to filter out high-frequency components, leaving the baseband sine wave. After the reverse cancellation module is generated, it is added to the original signal to generate the final signal.

[0264] Example 5

[0265] Suppose there is a running mechanical equipment, and acceleration sensors are installed at different nodes of the equipment to monitor the vibration of the equipment. It is hoped that the data collected by these sensors can be used to analyze whether the operation status of the equipment is normal. When the equipment is in normal working condition, the vibration signals of each node are collected at different time points. These signals can be expressed as a time series [S1, S2, S3…S n ]. Among them, S i Represents the vibration data collected from the sensor in the i-th time period. i After FFT processing, the vibration characteristic value f of the i-th time period is obtained. i , the vibration feature quantity of the i-th time period includes the main frequency, amplitude and phase of the vibration frequency in the frequency domain of the vibration data of the i-th time period. Calculate the feature quantity f i The mean and variance of .

[0266] Since the physical process in the system exhibits different vibration characteristics in different time periods, such as changes in system response caused by load, temperature, interference, etc., the frequency distribution obtained after FFT processing in different time periods is usually different.

[0267] The amplitude of the vibration frequency can be directly calculated based on the average of the amplitudes of different frequencies. When calculating the phase of the vibration frequency, it must be converted into a complex form, and then its average value and variance are calculated to avoid errors caused by the phase crossing π and -π.

[0268] Calculate the feature quantity f i After calculating the mean and variance of the signal, the characteristic value f of the i-th group is inferred according to the probability distribution of the standard quantity ζ. i The probability distribution of i The probability of taking a certain value. The "3σ" rule is usually used to determine whether a value is abnormal, that is, when ζ∈[-3,3], it means that the signal at this time is a normal value, and this range is set as the normal value range. Otherwise, it is identified as a malicious injection signal.

[0269] For the attack signal, the parameters such as the amplitude and frequency of the abnormal signal are output to the signal generation module. A reverse signal is generated according to the parameters. The signal generation module is completed by the collaboration of software and hardware. Preferably, it is constructed using DSP and low-pass filter. DSP can quickly generate accurate discrete digital signals, but the signal cannot reversely cancel the original signal in the analog domain. A low-pass filter can be used to filter out high-frequency components, leaving the baseband sine wave. After the reverse cancellation module is generated, it is added to the original signal to generate the final signal.

[0270] The present application also discloses a power IoT sensor attack signal recognition and active mitigation system based on a power IoT sensor attack signal recognition and active mitigation method, including a power IoT sensor signal acquisition module, a feature extraction module, an attack signal recognition module, an attack signal acquisition module, an attack signal processing module, and an attack signal active mitigation module:

[0271] The power Internet of Things sensor signal acquisition module collects the output signal of the power Internet of Things sensor;

[0272] The feature extraction module constructs a signal feature library based on the output signal of the power IoT sensor signal acquisition module, and obtains the features in the feature library to obtain a feature extraction result;

[0273] The attack signal recognition module analyzes the difference between the collected signal features and the normal signal features based on the feature extraction result, thereby performing attack signal recognition;

[0274] The attack signal acquisition module acquires the attack signal and analyzes the attack signal related parameters; wherein the attack signal related parameters include the amplitude and frequency of the attack signal;

[0275] The attack signal processing module inputs the attack signal related parameters into the digital signal processing chip, and the digital signal processing chip generates a reverse discrete digital signal of the attack signal according to the attack signal related parameters; filters out the high-frequency components in the reverse discrete digital signal, leaving the base frequency sine wave;

[0276] The attack signal active reduction module adds the sine wave obtained in the attack signal processing module to the signal collected by the power Internet of Things sensor signal collection module to generate a final signal.

[0277] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0278] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples of computer-readable storage media (a non-exhaustive list) include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disk read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be interpreted as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through a wire.

[0279] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, optical fiber transmissions, wireless transmissions, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in the computer-readable storage medium in each computing / processing device.

[0280] The computer program instructions for performing the operation of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages, such as Smalltalk, C++, etc., and conventional procedural programming languages, such as "C" language or similar programming languages. Computer-readable program instructions may be executed completely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or completely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., using an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be customized by utilizing the state information of the computer-readable program instructions, and the electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0281] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A method for identifying attack signals of power IoT sensors, characterized in that: include: Step 1: Collect historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors; Step 2: Fuse the historical output data of sensors of the same type as the historical collaborative sensing data of sensors of this type; preprocess the historical collaborative sensing data of sensors of different types, and construct a data set based on the preprocessing results; Step 3: Build an attack signal detection model based on convolutional neural network (CNN); Step 4: Train the attack signal detection model constructed in step 3 based on the data set in step 2; Step 5: Collect the output data of the power IoT sensors in real time, calculate the real-time collaborative sensing data of each type of sensor, and perform the preprocessing described in step 2 on it. Input the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

2. The attack signal recognition method according to claim 1, characterized in that: In step 1, the multiple types of sensors include a voltage sensor, a current sensor, a frequency sensor, a temperature sensor, and a load sensor.

3. The attack signal recognition method according to claim 1, characterized in that: In step 2, the method of preprocessing the historical collaborative sensing data of different types of sensors and constructing a data set based on the preprocessing results is: Perform data fusion preprocessing on the historical collaborative sensing data of each sensor at each sampling moment; A label is set for each data fusion result, and a data set is constructed based on the data fusion results and the set labels.

4. The attack signal recognition method according to claims 1-3, characterized in that: The data fusion preprocessing of the historical collaborative sensing data of each sensor at each sampling moment is to perform weighted summation of the historical collaborative sensing data of each sensor at each sampling moment according to the following formula: Among them, V weighted,t is the weighted sum of the historical collaborative sensing data of each sensor at time t; k is an integer, and k∈[1,l], l is the total number of sensor types in the power IoT sensor; w k is the weight of the kth type of sensor; f k,t is the historical collaborative sensing data of the k-th type of sensor at time t; The calculation formula of the weight of the k-th type of sensor is as follows: Among them I k is the data importance of the k-th type of sensor; R k is the data reliability of the kth type of sensor; h is an integer, and h∈[1,l]; I h is the data importance of the h-th type of sensor; R h is the data reliability of the hth type of sensor.

5. An attack signal recognition system using the attack signal recognition method according to any one of claims 1 to 4, characterized in that: It includes the power IoT sensor historical data collection module, data set construction module, attack signal detection model construction module, attack signal detection model training module and attack signal real-time detection module: The power Internet of Things sensor historical data collection module collects historical output data of each sensor in the power Internet of Things sensor; the power Internet of Things sensor is composed of multiple types of sensors; The data set construction module fuses historical output data of sensors of the same type as historical collaborative sensing data of sensors of the same type; preprocesses historical collaborative sensing data of sensors of different types and constructs a data set based on the preprocessing results; The attack signal detection model building module builds an attack signal detection model based on a convolutional neural network (CNN); The attack signal detection model training module trains the attack signal detection model constructed by the attack signal detection model construction module based on the data set in the data set construction module; The attack signal real-time detection module collects the output data of the power Internet of Things sensors in real time, calculates the real-time collaborative sensing data of various types of sensors, and performs the preprocessing described in the data set construction module on it, and inputs the preprocessed real-time collaborative sensing data into the trained attack signal detection model to perform attack signal detection.

6. A method for identifying and actively reducing attack signals of power IoT sensors, characterized in that: include: Step 1: Collect the output signal of the power IoT sensor; Step 2: construct a signal feature library based on the output signal in step 1, and obtain the features in the feature library to obtain the feature extraction result; Step 3: Analyze the difference between the collected signal features and the normal signal features based on the feature extraction results, so as to identify the attack signal; Step 4: Collect attack signals and analyze attack signal related parameters; The attack signal related parameters include the amplitude and frequency of the attack signal; Step 5: Generate an inverse discrete digital signal of the attack signal based on the attack signal related parameters; filter out the high-frequency components in the inverse discrete digital signal, leaving the base frequency sine wave; Step 6: Add the sine wave obtained in step 5 to the signal collected in step 1 to generate the final signal.

7. The attack signal identification and active mitigation method according to claim 6, characterized in that: In step 2, the feature library is constructed based on the output signal in step 1, which is to select the features set corresponding to each output signal type to form an attack signal feature library; the signal types include voltage signals, current signals, frequency signals, temperature signals and load signals.

8. The attack signal identification and active mitigation method according to claim 6, characterized in that: In step 3, the difference Δ between the acquired signal characteristics and the normal signal characteristics is as follows: Δ=[Δ1,……,Δ n ]; Among them, Δ1 is the difference between the collected signal and the normal signal in the first feature; Δ n It is the difference between the collected signal and the normal signal in the nth feature; n is the total number of features.

9. The attack signal identification and active mitigation method according to claim 6 or 8, characterized in that: The difference between the i-th feature of the collected signal and the i-th feature of the normal signal Δ i As shown below: Where i is an integer and i∈[1,n]; T i is the ith normal eigenvector; t′ ij is the eigenvalue of the i-th feature at the j-th sampling point; j is an integer, and j∈[1,m]; m is the total number of sampling points in the output signal collected in step 1.

10. The attack signal identification and active mitigation method according to claim 6, characterized in that: In step 3, the difference degree D between the acquired signal characteristics and the normal signal characteristics is as follows: D=[D1,……,D m ]; Where D1 is the comprehensive difference between the characteristics of the collected signal at the first sampling point and the normal signal characteristics; D m is the comprehensive difference between the characteristics of the collected signal at the mth sampling point and the normal signal characteristics; m is the total number of sampling points in the output signal collected in step 1.

11. The attack signal identification and active mitigation method according to claim 6 or 10, characterized in that: The comprehensive difference between the collected signal characteristics and the normal signal characteristics at the jth sampling point D j : Where j is an integer and j∈[1,m]; m is the total number of sampling points in the output signal collected in step 1; r is an integer and r∈[1,n]; n is the total number of features; w f,i is the weight of the difference vector of the i-th feature; d ij is the jth difference vector of the ith feature; w f,r is the weight of the difference vector of the rth feature; The difference vector d of the sth feature sj Calculated according to the following formula: d sj =t sj -T′ s ; Among them, t′ sj is the characteristic value of the sth feature at the jth sampling point; T s is the sth normal eigenvector.

12. The attack signal identification and active mitigation method according to claim 6 or 8, characterized in that: In step 3, the method for identifying the attack signal based on the difference degree is as follows: Calculate the standard deviation of each feature based on the collected signal, and use three times the standard deviation of the i-th feature as the i-th feature attack signal recognition threshold; When the difference between the collected signal and the normal signal in the i-th feature is greater than the i-th feature attack signal recognition threshold, the signal collected by the sensor corresponding to the i-th feature is determined to be an attack signal.

13. The attack signal identification and active mitigation method according to claim 6 or 10, characterized in that: In step 3, the attack signal identification method based on the difference degree is as follows: Calculate the standard deviation of each feature based on the collected signal, obtain the mean of each standard deviation, and use three times of the mean as the first attack signal recognition threshold; When the comprehensive difference between the collected signal characteristics and the normal signal characteristics at the j-th sampling point is greater than the first attack signal recognition threshold, it is preliminarily determined that there is an attack signal at the moment corresponding to the j-th sampling point; When it is determined that there is an attack signal at a certain moment, the standard quantity of each feature is solved; When the standard values ​​of all features belong to [-3,3], it is determined that there is no attack signal; When the standard quantity of the i-th feature does not satisfy ζ i ∈[-3,3], then the signal collected by the sensor corresponding to the i-th feature is determined to be an attack signal; The standard quantity of the i-th feature is as follows: in, is the mean of the eigenvalues ​​at each sampling point in the eigenvector of the i-th feature; T i ' ,E is the expected value of the i-th feature; σ i is the standard deviation of the eigenvalues ​​at each sampling point in the i-th eigenvector.

14. A power IoT sensor attack signal recognition and active mitigation system using the attack signal recognition and active mitigation method according to any one of claims 6 to 13, characterized in that: It includes power IoT sensor signal acquisition module, feature extraction module, attack signal recognition module, attack signal acquisition module, attack signal processing module and attack signal active mitigation module: The power Internet of Things sensor signal acquisition module collects the output signal of the power Internet of Things sensor; The feature extraction module constructs a signal feature library based on the output signal of the power IoT sensor signal acquisition module, and obtains the features in the feature library to obtain a feature extraction result; The attack signal recognition module analyzes the difference between the collected signal features and the normal signal features based on the feature extraction result, thereby performing attack signal recognition; The attack signal acquisition module collects attack signals and analyzes attack signal related parameters; The attack signal related parameters include the amplitude and frequency of the attack signal; The attack signal processing module inputs the attack signal related parameters into the digital signal processing chip, and the digital signal processing chip generates a reverse discrete digital signal of the attack signal according to the attack signal related parameters; filters out the high-frequency components in the reverse discrete digital signal, leaving the base frequency sine wave; The attack signal active reduction module adds the sine wave obtained in the attack signal processing module to the signal collected by the power Internet of Things sensor signal collection module to generate a final signal.

15. An electronic device, comprising a processor and a storage medium; characterized in that: The storage medium is used to store instructions; The processor is used to operate according to the instruction to execute the attack signal identification method according to claims 1-4 or the attack signal identification and active mitigation method according to claims 6-13.

16. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the attack signal recognition method described in claims 1-4 or the attack signal recognition and active mitigation method described in claims 6-13 is implemented.

Images