False data injection detection method and system based on bidirectional long short-term memory network

Abstract

The invention discloses a false data injection detection method and system based on a bidirectional long short-term memory network, and belongs to the field of distributed automation system and FDIA detection in a new energy power grid, and the method comprises the steps: constructing a new energy power grid load redistribution attack model based on local information; constructing a new energy power grid false data injection detection model based on a bidirectional long short-term memory network; taking the output of the constructed new energy power grid load redistribution attack model as the input of a false data injection detection model; acquiring data of a new energy power grid; new energy power grid data are incorporated into an IEEE node system to verify the adaptive capacity of the detection model after renewable energy integration; operating data of the power system are collected in real time, preprocessed and input into the verified false data injection detection model, whether the power system is abnormal or not is judged according to a detection result output by the false data injection detection model, and corresponding response measures are taken.

Description

Technical Field

[0001] The present invention belongs to the field of distributed automation system and FDIA detection in new energy power grid, and in particular to a new energy power grid false data injection detection method and system based on a bidirectional long short-term memory network. Background Art

[0002] The development of new energy grids relies on the integration of computing, communication and automation technologies. However, this high dependence also exposes new energy grids to a wide range of cyberattacks that may weaken the reliability of smart grids and ultimately undermine the stability of critical infrastructure. False data injection attack (FDIA) is a relatively hidden and dangerous attack method that bypasses the traditional bad data detection (BDD) method by manipulating the integrity of sensor data, thereby affecting the accuracy of state estimation (SE) and posing a huge threat to the security of the power grid. FDIA can introduce random deviations in SE outputs, leading to large-scale power outages and economic losses (accurate false data injection attack). To address this threat, many data-driven detection methods have been proposed. However, existing methods are often optimized for specific grid architectures and are difficult to adapt to the evolving grid. In particular, with the increase in the penetration rate of renewable energy systems (RES), the unpredictability of the grid has increased significantly, which has reduced the accuracy of existing FDIA detection methods (accurate false data injection attack).

[0003] CN201911097514.2A discloses a method, computer equipment and storage medium for detecting data attacks in a power system, including: obtaining data-driven historical measurement data of the power system and normalizing and preprocessing it; inputting time series data into a convolutional neural network in batches according to time / time period and capturing spatial features; outputting the full connection layer FC of the convolutional neural network by the long short-term memory neural network and capturing time features; setting a Dropout layer and a batch normalization layer in the convolutional neural network and the long short-term memory neural network, and setting an attention mechanism in the output layer of the long short-term memory neural network; setting a support vector machine classifier in the output layer of the long short-term memory neural network and outputting the judgment result of attack detection. Disadvantages and shortcomings: High model complexity: This method adopts a combination of convolutional neural network (CNN) and long short-term memory neural network (LSTM), and adds a Dropout layer, a batch normalization layer and an attention mechanism. Although these enhance the flexibility and detection ability of the model, they also greatly increase the computational complexity and training difficulty, and have high requirements for computing resources. Overfitting risk: Due to the use of multiple deep learning modules and the addition of an attention mechanism to LSTM, the model may perform well on training data, but overfit on actual unseen data, resulting in insufficient generalization in real environments. High real-time requirements: This method requires batch processing of time series data and real-time detection, but in actual power systems, data traffic is large and has strong time dependence, which places high demands on the system's real-time performance and data throughput. If the system has high latency or insufficient processing speed, attacks may not be detected in a timely manner.

[0004] CN202111123740.0A provides a detection system for false data injection attacks in smart grids based on deep learning, which belongs to the field of smart grids, including a static detector, which is built outside the dynamic detector and connected to the alarm to receive a first input source; a dynamic detector, which is connected to the alarm to receive real-time detection and network packet transmission data, the network packet can be captured by instructions to identify high-level time series characteristics of FDI attacks; a deep learning model supports offline training by using real-time collected measurement data, and updates the prediction model after training. Disadvantages and shortcomings: Static detector limitations: The invention relies on a combination of static detectors and dynamic detectors, in which the static detector detects based on historical data, but this method may not be able to effectively deal with new and unknown attack patterns, especially when the attack characteristics evolve over time. Dependence on offline training: The deep learning model relies on offline training, and the data in the smart grid system is constantly updated. The model after offline training may not be able to quickly adapt to the new data, resulting in a decrease in detection effect. The model update cycle is long, and the opportunity for real-time detection may be missed. Lack of multi-layer defense mechanism: The system mainly relies on a single deep learning model for attack detection, lacks consideration of multi-layer defense, such as abnormal behavior detection, physical rule verification, etc., and may perform insufficiently when facing complex attacks.

[0005] CN202211461395.6A provides a multi-source sensor data fusion method for a virtual power plant information-physical system, which establishes a data fusion model based on a convolutional neural network (CNN) and a long short-term memory (LSTM) neural network, and uses the data fusion model to extract features from each single-source data in the collected virtual power plant multi-source sensor data, and performs deep convolution fusion on the extracted features. The invention uses a hybrid neural network structure to extract and fuse features from multi-source heterogeneous data under the virtual power plant information-physical system model, and uses false data injection attack FDIA detection to verify the effect of data fusion. Disadvantages and shortcomings: High dependence on data quality: This method relies on the fusion of multi-source heterogeneous data to improve the accuracy of detection, but in actual applications, sensor data may be lost, noisy, and interfered, resulting in inaccurate data fusion results, thereby affecting the effect of attack detection. Multi-source data synchronization problem: In a virtual power plant, sensor data comes from different sources, and the time synchronization problem of these data may cause deviations in the data fusion process, affecting the accuracy of detection. If the data sources cannot be accurately synchronized, the performance of the fusion model will be greatly reduced. High consumption of computing resources: Convolutional neural network (CNN) and long short-term memory network (LSTM) are used to extract and fuse features from multi-source data, which has high computational complexity and may lead to system performance bottlenecks, especially when processing large-scale real-time data. Summary of the invention

[0006] In order to solve the deficiencies in the prior art, the present invention provides a scientific and reasonable method for improving the robustness and safety of smart grids based on the Bi-LSTM deep learning algorithm, which has strong practicality, accurate and reliable detection results, and can be intelligentized to ensure the safety and stability of the power grid.

[0007] The present invention adopts the following technical solution.

[0008] A first aspect of the present invention provides a false data injection detection method based on a bidirectional long short-term memory network, comprising the following steps:

[0009] Construct a new energy grid load redistribution attack model based on local information;

[0010] Construct a false data injection detection model for new energy power grid based on bidirectional long short-term memory network;

[0011] The output of the new energy grid load redistribution attack model is used as the input of the false data injection detection model to detect false data;

[0012] Obtain data on new energy power grids;

[0013] Incorporate new energy grid data into the IEEE node system to verify the adaptability of the false data injection detection model after renewable energy integration;

[0014] The operation data of the power system is collected in real time, and the pre-processed and verified false data is injected into the detection model. According to the detection results output by the false data injection detection model, it is judged whether there is an abnormality in the power system, and corresponding response measures are taken.

[0015] Optionally, the local information includes node status information, local load information, power generation information, topology information, scheduling information, security information and communication information.

[0016] Optionally, the constructing of a load redistribution attack model based on local information includes:

[0017] Set the sum of power load and loss to be fixed;

[0018] The voltage amplitude and phase angle of the boundary nodes are set to remain fixed;

[0019] The interval analysis method is used to calculate the state scalar interval.

[0020] Optionally, setting the voltage amplitude and phase angle of the boundary node to remain fixed includes:

[0021] The voltage amplitude and phase angle of the boundary nodes satisfy the following formula constraints:

[0022]

[0023] Among them, ω A is the set of attacked nodes, ω load is the power load set in the attack area, ω gen is the set of generators in the attack area, ω0 is the set of zero-injected nodes in the attack area, d represents the set of boundary nodes, and x d is the initialization state array of the boundary bus, For the i th The node and the jth th The actual active power between nodes, For the i th The node and the jth th The actual reactive power between nodes;

[0024] represents the actual power of the load L, Indicates the reference power value of load L, represents the actual reactive power of load L, Indicates the reference reactive power value of load L, represents the actual voltage of the generator G, represents the reference voltage value of the generator G, Indicates the actual value of the active power of the generator G, It represents the active power reference value of the generator G, where G represents the generator. Indicates the upper capacity limit of branch k, where k represents the branch. Represents the actual state value of node d, Indicates the baseline state value of node d.

[0025] Optionally, the construction of a new energy grid false data injection detection model based on a bidirectional long short-term memory network specifically includes:

[0026] Use bidirectional LSTM for feedforward and backward information transfer;

[0027] Introduce the Dropout mechanism to prevent overfitting;

[0028] Use the SoftMax function to classify and output attacks.

[0029] Optionally, the use of bidirectional LSTM to perform feedforward and reverse information transfer specifically includes:

[0030] According to the following formula, the hidden state is used to complete the information transfer in both the feedforward and reverse directions:

[0031]

[0032] Where σ is the logarithmic sigmoid function, and Represent the forward and backward hidden states respectively, W x , W h Represent the weight matrix input to the hidden layer, the hidden state at the previous moment to the weight matrix of the current hidden state, They represent the hidden state vector transmitted from the future time t+1 to the current time t, and the hidden state vector transmitted from the previous time t-1 to the current time t, respectively. t represents the input vector at the current time t, b h Represents the bias vector of the hidden layer.

[0033] Optionally, the introduction of the Dropout mechanism to prevent overfitting specifically includes the following formula:

[0034]

[0035] Among them, p is the probability of Dropout, h t represents the hidden layer output vector at the current time t, Represents the hidden layer output vector after the Dropout operation.

[0036] Optionally, the classification and output of the attack using the SoftMax function includes:

[0037] The probability of attack category i is calculated as follows:

[0038]

[0039] Where P(y=i|x) is the probability of attacking category i, W i and b i are weight and bias respectively, K represents the total number of attack categories, x represents the independent variable, and y represents the dependent variable that changes with x.

[0040] Optionally, the output of the new energy grid load redistribution attack model includes prediction results, possible attack locations and types, wherein the prediction results include normal and abnormal; the output of the false data injection detection model includes the specific location or scope of the attack.

[0041] A second aspect of the present invention provides a false data injection detection system based on a bidirectional long short-term memory network. Based on the false data injection detection method based on a bidirectional long short-term memory network described in the first aspect of the present invention, the system comprises:

[0042] An attack model building module, used to build a new energy grid load redistribution attack model based on local information;

[0043] A detection model building module, used to build a false data injection detection model based on a bidirectional long short-term memory network;

[0044] The detection simulation module is used to use the output of the constructed attack model as the input of the constructed detection model to realize the detection of false data.

[0045] Adaptability verification module, which is used to incorporate wind farm data into the IEEE node test system to verify the adaptability of the established detection model after renewable energy integration;

[0046] The model application module applies the verified detection model to detect whether there is a false data injection attack in the power system.

[0047] The present invention proposes a false data injection detection method for a new energy power grid based on a bidirectional long short-term memory network, which effectively improves the security and stability of the power grid by introducing a load redistribution attack model based on local information and using a bidirectional long short-term memory network (Bi-LSTM) for false data injection (FDIA) detection. Bi-LSTM can perform well in processing long-term data and time series data, and maintain efficient attack detection capabilities in a dynamic power grid environment after the introduction of renewable energy. Compared with traditional methods, it has obvious advantages in accuracy and adaptability, thereby ensuring that the power grid can operate reliably in a changing environment.

[0048] The further beneficial effects of the false data injection detection method for a new energy power grid based on a bidirectional long short-term memory network of the present invention are as follows:

[0049] (1) By deploying redundant phase measurement units and strengthening inspections, the state variables of the power system are ensured not to be tampered with, thereby improving the security of the power grid. The load redistribution attack model based on local information makes the attack more concealed, effectively bypassing traditional detection methods, and improving the stability and defense capabilities of the power grid;

[0050] (2) This method uses recurrent neural networks (RNN) and long short-term memory networks (LSTM) to solve the problems encountered by traditional methods when processing long-term data, such as the explosive growth of data volume: With the continuous development of new energy power grids, the number of sensors and monitoring equipment has increased dramatically, resulting in an exponential growth in the amount of data collected; the huge amount of data accumulated over a long period of time has put forward extremely high requirements for storage, processing and analysis capabilities. Traditional detection methods may encounter performance bottlenecks when processing such large-scale data, resulting in low detection efficiency; the challenge of data timeliness: Long-term data contains a large amount of historical information, but not all data has the same reference value for the current system status. Traditional detection methods may not be able to effectively distinguish the timeliness of data, resulting in excessive attention to historical data and ignoring the real-time changes of the current system status when processing long-term data; the adaptability problem of system dynamics: The new energy power grid is a highly dynamic system, and its operating status will fluctuate with changes in weather, load demand, equipment failure and other factors. Traditional detection methods are often based on static models or rules and are difficult to adapt to the dynamic changes of the system. When processing long-term data, this inadaptability may lead to a decrease in the accuracy and reliability of the detection results. Bi-LSTM improves the modeling ability of time series data through bidirectional information transmission and effectively avoids overfitting. Experiments show that Bi-LSTM performs well in detecting false data injection (FDIA) attacks, ensuring accurate analysis and prediction of long-term data of power systems;

[0051] (3) The proposed Bi-LSTM framework performs well in dynamic power grids containing renewable energy, and can effectively identify FDIA and manage the integration of distributed generation. Compared with traditional detection methods, Bi-LSTM can accurately describe the basic distribution of power grid measurements, overcome the uncertainty caused by the introduction of renewable energy, and ensure that the power grid maintains efficient operation in a changing environment. Experimental results show that the detection accuracy and adaptability of Bi-LSTM after the introduction of wind power generation are significantly better than other traditional methods.

[0052] The beneficial effect of the present invention is that, compared with the prior art, by introducing bidirectional long short-term memory network (Bi-LSTM) technology, it can effectively cope with the security threat brought by false data injection attack (FDIA) in the new energy power grid, and improve the stability and security of the power grid.

[0053] Compared with the prior art, the main differences and technical effects of the present invention are embodied in the following aspects:

[0054] 1. Efficient processing of dynamic data: Traditional FDIA detection methods are usually optimized for static data and cannot cope with the complexity of data fluctuations over time in new energy power grids. However, the present invention uses a Bi-LSTM network, which can perform well in processing long-term data and time series data, effectively distinguishing between inherent uncertainty and FDIA in the power grid, and greatly improving the accuracy of detection.

[0055] 2. Strong adaptability: As the penetration rate of renewable energy increases, the uncertainty of the power grid increases significantly, and traditional methods are often unable to cope with such complex environments. The Bi-LSTM framework proposed in this paper can maintain efficient attack detection capabilities in a dynamic power grid environment that integrates multiple renewable energy sources, ensuring that the power grid can operate reliably in a constantly changing environment.

[0056] 3. Effectively bypass traditional detection methods: The present invention uses a load redistribution attack model based on local information to make the attack behavior more concealed and effectively bypass the traditional bad data detection (BDD) mechanism. The introduction of redundant phase measurement units and enhanced inspections further improve the security of the power grid.

[0057] 4. Prevent overfitting: Overfitting is a common problem in deep learning models. To this end, the present invention introduces a Dropout mechanism in the Bi-LSTM network to avoid the occurrence of overfitting and ensure the generalization ability of the model.

[0058] 5. Efficiently identify and manage distributed generation integration: Compared with traditional detection methods, the Bi-LSTM framework of the present invention can not only accurately describe the basic distribution of grid measurements, but also effectively identify FDIA and manage the integration of distributed generation, especially after the introduction of renewable energy such as wind power generation, the detection accuracy and adaptability have been significantly improved. In summary, the present invention effectively improves the robustness and security of the new energy grid through advanced Bi-LSTM detection technology, which is significantly better than the traditional FDIA detection method, especially in the face of dynamic grid environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] Figure 1 It is the structural diagram of LSTM unit;

[0060] Figure 2 This is the structural architecture diagram of the Bi-LSTM network;

[0061] Figure 3 It is the IEEE14 bus power supply test system;

[0062] Figure 4 This is the network topology for the IEEE57 bus test case. DETAILED DESCRIPTION

[0063] In order to make the purpose, technical scheme and advantages of the present invention clearer, the technical scheme of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. The embodiments described in this application are only embodiments of a part of the present invention, rather than all embodiments. Based on the spirit of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work belong to the protection scope of the present invention.

[0064] like Figure 1 As shown,

[0065] In Example 1, the present invention provides a false data injection detection method based on a bidirectional long short-term memory network, comprising the following steps:

[0066] Step 1: Construct a new energy grid load redistribution attack model based on local information;

[0067] In a further preferred but non-limiting embodiment, in step 1, the local information includes:

[0068] Node status information, local load information, power generation information, topology information, scheduling information, security information and communication information;

[0069] Specifically, node status information includes voltage, current and power. Voltage is the voltage amplitude and phase angle of each node, which is the basic parameter of the grid operation status; current is the current flowing into and out of the node, which can help analyze the load and power supply situation; power is the distribution of active power and reactive power, which reflects the supply and demand balance of the node;

[0070] Local load information includes load demand and load forecast. The load demand is the actual power demand in the area where the node is located, including real-time load and historical load data. The load forecast is the future load demand predicted based on historical data and models, which is an important basis for load redistribution decisions.

[0071] The power generation information includes local power generation and power generation curves, wherein the local power generation is the real-time power generation of local power generation resources, and the local power generation resources include new energy such as wind power and photovoltaic power; the power generation curve includes the power generation capacity forecast for the current and future period, especially the forecast for intermittent new energy power generation;

[0072] Topology information includes network connection status and power flow distribution. The network connection status refers to the connection relationship between the local node and other nodes, and the line status (such as disconnection and load status). The power flow distribution refers to the power flow from the local node to other nodes, which helps to understand the role of the local node in the entire power grid.

[0073] The dispatch information includes dispatch commands and spare capacity. Dispatching commands refer to dispatch instructions issued by the central control system to local nodes, such as adjusting power generation and load reduction. Spare capacity refers to the spare capacity information of local power plants to ensure timely response when load changes.

[0074] Security information includes protection device status and alarm information. The protection device status refers to the status of local relay protection and automation equipment, such as whether it is activated; alarm information refers to various local alarm information, reflecting equipment abnormalities or potential security threats;

[0075] Local information includes communication information and packet loss rate. Communication information refers to data transmission delay: the communication delay between the local and central control systems or other nodes; packet loss rate refers to the reliability of the local communication network, such as packet loss during data transmission.

[0076] In a further preferred but non-limiting embodiment, in step 1, constructing a load redistribution attack model based on local information includes:

[0077] Set the sum of power load and loss to be fixed;

[0078] The voltage amplitude and phase angle of the boundary nodes are set to remain fixed;

[0079] The interval analysis method is used to calculate the state scalar interval.

[0080] Specifically, the load redistribution attack means that the attacker can only attack the injected power and branch power flow, but cannot attack the power station and zero injection node. The difference with the traditional attack mode can be summarized as follows. The traditional attack mode assumes that complete information can be obtained, but this is unrealistic. Therefore, the attack mode proposed in the present invention is based on local information. The traditional attack model assumes that the total power load is fixed and the load redistribution remains unchanged, while the proposed attack model assumes that the sum of the power load and the power loss is fixed, which makes the attack more concealed. To ensure that the attack can bypass the traditional residual test, in the proposed attack model, the voltage amplitude and phase angle of the boundary node remain fixed.

[0081] In a further preferred but non-limiting embodiment, the setting of the voltage amplitude and phase angle of the boundary node to remain fixed comprises:

[0082] The voltage amplitude and phase angle of the boundary nodes satisfy the following formula constraints:

[0083]

[0084]

[0085] Among them, ω Ais the set of attacked nodes, ω load is the power load set in the attack area, ω gen is the set of generators in the attack area, ω0 is the set of zero-injected nodes in the attack area, d represents the set of boundary nodes, and x d is the initialization state array of the boundary bus, For the i th The node and the jth th The actual active power between nodes, For the i th The node and the jth th The actual reactive power between nodes;

[0086] represents the actual power of the load L, Indicates the reference power value of load L, represents the actual reactive power of load L, Indicates the reference reactive power value of load L, represents the actual voltage of the generator G, represents the reference voltage value of the generator G, Indicates the actual value of the active power of the generator G, It represents the active power reference value of the generator G, where G represents the generator. Indicates the upper capacity limit of branch k (apparent power), where k represents the branch. Represents the actual state value of node d, Represents the baseline state value of node d;

[0087] In a further preferred but non-limiting embodiment, the using interval analysis method to calculate the state scalar interval includes:

[0088] (1) Definition of interval variables:

[0089] In the interval analysis method, state scalars such as voltage, current, and power are represented as interval variables. Each interval variable is described by an upper and lower bound. For example, the voltage V may vary within a certain interval.

[0090] (2) Uncertainty description:

[0091] Interval variables are used to describe various uncertainties in the system, such as measurement errors, model uncertainties, or external disturbances.

[0092] (3) Interval solution of the state equation:

[0093] Representation of state equation: The state equation of the power grid is usually expressed in linear or nonlinear form as z=h(x), where z is the measurement value and x is the state variable.

[0094] For nonlinear equations, it may be necessary to use an iterative algorithm (such as the interval Newton method) to gradually narrow the interval of the solution until the accuracy requirements are met.

[0095] (4) Propagation and merging of intervals:

[0096] Interval propagation: When state variables are propagated through a power grid model (such as the power balance equation), the output interval needs to be calculated. For example, the current interval of a line is obtained through power flow calculation.

[0097] Interval merging: If different computational paths produce multiple interval estimates for the same variable, these intervals need to be merged to obtain an interval that includes all possibilities.

[0098] (5) Sensitivity analysis:

[0099] Interval sensitivity: Analyze the sensitivity of the system state to different input interval variables and determine which input interval changes have the greatest impact on the interval of the system state. This helps to understand the most uncertain factors in the system.

[0100] (6) Uncertainty Propagation Analysis:

[0101] Global uncertainty: Combine the uncertainties of all input variables and analyze their impact on the system state range. The final state range reflects the combined effect of all uncertainties in the system.

[0102] Step 2, construct a new energy grid false data injection detection model based on a bidirectional long short-term memory network;

[0103] In a further preferred but non-limiting embodiment, the step 2 specifically comprises:

[0104] Use bidirectional LSTM for feedforward and backward information transfer;

[0105] Introduce the Dropout mechanism to prevent overfitting;

[0106] Use the SoftMax function to classify and output attacks.

[0107] In a further preferred but non-limiting embodiment, the feedforward and reverse information transfer using bidirectional LSTM specifically includes:

[0108] According to the following formula, the hidden state is used to complete the information transfer in both the feedforward and reverse directions:

[0109]

[0110] Where σ is the logarithmic sigmoid function, and Represent the forward and backward hidden states respectively, W x , W h Represent the weight matrix input to the hidden layer, the hidden state at the previous moment to the weight matrix of the current hidden state, They represent the hidden state vector transmitted from the future time t+1 to the current time t, and the hidden state vector transmitted from the previous time t-1 to the current time t, respectively. t represents the input vector at the current time t, b h Represents the bias vector of the hidden layer.

[0111] In a further preferred but non-limiting embodiment, the formula is as follows:

[0112]

[0113] Among them, p is the probability of Dropout, h t represents the hidden layer output vector at the current time t, Represents the hidden layer output vector after the Dropout operation.

[0114] In a further preferred but non-limiting embodiment, the classification and output of attacks using the SoftMax function includes calculating the probability of attack category i according to the following formula:

[0115]

[0116] Where P(y=i|x) is the probability of attacking category i, W i and b i are weight and bias respectively, K represents the total number of attack categories, x represents the independent variable, and y represents the dependent variable that changes with x.

[0117] In a further preferred but non-limiting embodiment, the false data injection detection model based on the bidirectional long short-term memory network includes:

[0118] Real-time measurement of redundancy in renewable energy grid systems;

[0119] According to the following formula, the LSTM network is used to solve the gradient disappearance and explosion problems when processing long-term data:

[0120] i t =σ(W i x t +U i h i-1 +b i )

[0121] f t =σ(W f xt +U f h t-1 +b f )

[0122] o t =σ(W o x t +U o h t-1 +b o )

[0123] c t =f t ⊙c t-1 +i t ⊙tanh(W c x t +U c h t-1 +b c )

[0124] h t =o t ⊙tanh(c t )

[0125] Among them, i t is the input gate, f t For the forget gate, t is the output gate, c t is the cell state, h t is the hidden state, σ is the logarithmic sigmoid function and Represent the trainable weights of each gate, the operator ⊙ represents the Hadamard product, x t Represents the input vector at the current moment, including the features of the input layer, h t-1 represents the hidden state of the previous moment, represents the output result of the previous moment, and serves as one of the inputs calculated at the current moment, b i represents the linear transformation of the bias term used for the input gate, b f Denotes the linear transformation of the bias term used for the forget gate, U i Represents the weight matrix of the hidden state, which is used to adjust the hidden state h at the previous moment t-1 Perform linear transformation, U f Represents the weight matrix of the hidden state, which is used to adjust the hidden state h at the previous moment t-1 Perform a linear transformation, b o represents the linear transformation of the bias term used for the output gate, b c represents the linear transformation of the bias term used for the unit state,

[0126] In a further preferred but non-limiting embodiment, the false data injection detection model based on the bidirectional long short-term memory network also includes:

[0127] The Bi-LSTM network is used to model the dynamic characteristics of the power grid and distinguish between inherent uncertainty and FDIA;

[0128] The power flow on each bus is described using the following equation:

[0129] P ij =V i V j (G ij cosθ ij +B ij sinθ ij )

[0130] Q ij =V i V j (G ij sinθ ij -B ij cosθ ij )

[0131] Among them, P ij and Q ij are active power and reactive power respectively, V i and V j are the node voltage, G ij and G ij are the real and imaginary parts of the admittance, θ ij is the phase angle difference.

[0132] Step 3: Use the output of the new energy grid load redistribution attack model constructed in step 1 as the input of the false data injection detection model constructed in step 2 to detect false data.

[0133] In a further preferred but non-limiting embodiment, in step 3,

[0134] The output of the new energy grid load redistribution attack model includes prediction results (normal / abnormal labels), possible attack locations and types;

[0135] The input of the false data injection detection model includes specific types of network traffic characteristics, sensor signals and system logs, and the output of the false data injection detection model includes the specific location or scope of the attack, clearly indicating the network nodes, sensors or control system parts that are attacked. For example, which group of sensors or network nodes are injected with false data.

[0136] Step 4, obtaining data of the new energy grid;

[0137] In a further preferred but non-limiting embodiment, in step 4, the data of the new energy grid includes power generation data, power demand data, grid operation data, energy storage system data, meteorological data, market transaction data, power quality data, status monitoring and fault diagnosis data and communication network data;

[0138] Specifically, power generation data includes:

[0139] Photovoltaic power generation data: including photovoltaic power generation power, light intensity, panel temperature and other parameters;

[0140] Wind power data: including wind speed, wind direction, wind turbine power output, speed and other information;

[0141] Hydropower data: reservoir water level, flow, power generation, etc. Biomass power generation data: fuel consumption, power generation, etc.

[0142] Specifically, the electricity demand data includes:

[0143] Load demand: including real-time power demand, historical load data, load distribution in different regions, etc.;

[0144] Load curve: Time series data showing how electricity demand changes over time.

[0145] Specifically, the grid operation data includes:

[0146] Voltage and current: including the voltage and current values ​​of each node, usually expressed as three-phase data;

[0147] Power flow: real-time distribution and flow of active power and reactive power

[0148] Frequency: Real-time monitoring data of power grid frequency;

[0149] Phase angle difference: Phase angle difference data between different nodes, usually used for stability analysis.

[0150] Specifically, energy storage system data includes:

[0151] Battery energy storage data: battery pack charge and discharge status, remaining capacity (SOC), voltage, current, etc.;

[0152] Energy storage efficiency: charging and discharging efficiency and energy loss data of the energy storage system.

[0153] Specifically, meteorological data include:

[0154] Weather forecast data: including temperature, humidity, wind speed, wind direction, precipitation, etc., used to predict renewable energy power generation;

[0155] Sunshine duration: Especially for photovoltaic systems, it affects the power generation.

[0156] Specifically, market transaction data includes:

[0157] Electricity market prices: real-time electricity prices, historical electricity prices, market supply and demand conditions, etc.;

[0158] Trading volume: data on the amount of electricity traded in the electricity market.

[0159] Specifically, power quality data includes:

[0160] Harmonic content: detection data of harmonic components in the power grid;

[0161] Voltage fluctuation and flicker: record the data related to voltage stability;

[0162] Specifically, the condition monitoring and fault diagnosis data include:

[0163] Equipment operating status: health status of transformers, switches, lines, operating temperature, etc.;

[0164] Fault alarm data: records and alarm information of various equipment faults.

[0165] Specifically, communication and control data includes:

[0166] Communication network data: operating status, delay, packet loss rate, etc. of the power grid communication network;

[0167] Dispatching control instructions: control instruction data from the power grid dispatching center.

[0168] Step 5, incorporating the new energy grid data obtained in step 4 into the IEEE14 bus test system to verify the adaptability of the detection model established in step 2 after the integration of renewable energy;

[0169] In a further preferred but non-limiting embodiment, step 5 specifically comprises:

[0170] Take IEEE57-bus test cases as the object, such as Figure 4As shown, MATLAB is used to simulate network attack and defense behaviors. The attacker's goal is to overload transmission lines 39-57 and 56-57, and the attack area includes PQ nodes 11, 35,...; it is assumed that the attacker can obtain the following measurement information of the above area: voltage amplitude, node injection power, and branch power; it is assumed that the attacker can obtain the following measurement information of the area boundary: branch power entering the above area; the attacker can tamper with the following measurement information: voltage amplitude, node injection power, and branch power in the area; the attacker cannot tamper with the following measurement information: boundary node voltage amplitude and zero injection node injection power. The detection error setting parameters of interval estimation are as follows. The present invention proposes an FDI attack model to verify the performance of the proposed method, while considering power loss and power load, and considering the measurement error constraint of the boundary node voltage amplitude.

[0171] The recursive neural network (RNN) is used to solve problems with continuous input. The main purpose of RNN is to learn the long-term correlation between input data and build models for future predictions. Modeling large amounts of data over a long period of time has problems that plague other traditional methods. However, despite the many advantages of RNN, these methods also have some major problems, such as gradient disappearance and explosion. The present invention solves the related problems of RNN by introducing a deep architecture called long short-term memory (LSTM).

[0172] LSTM is able to retain previous information during training, so it shows its advantages in processing long-term data. Figure 1 The schematic diagram of the structure of the LSTM unit is shown. It can be seen that the adjustment of the structure is based on the input, forget and output gates, and the signal flow is performed by the storage unit state block in this structure. Each gate has a unique function, and the calculation process of each variable at time t is as follows:

[0173] f t =σ(W lf × t +W mf ×m t-1 +b f )

[0174] i t =σ(W li × t +W mi ×m t-1 +b i )

[0175] o t =σ(W lo × t +W mo ×m t-1 +bo )

[0176] a t =tanh(W la × t +W ma ×m t-1 +b a )

[0177] c t =c t-1 Φf t +i t Φa t

[0178] m t =o t Φtanh c t

[0179] Where σ is the logarithmic sigmoid function, f t ,i t ,o t ,c t and a t Represent the forget gate, input gate, output gate, storage unit and hidden vector respectively; and They represent the trainable weights of each gate respectively; the operator Φ represents the Hadamard product.

[0180] Bi-LSTM is an improved version of LSTM network and is widely used to model massive data and extract features from time series data. Figure 2 This is a schematic diagram of the Bi-LSTM structure. Unlike traditional LSTM, the training process of Bi-LSTM uses hidden states to complete feedforward ( Figure 2 The black line in the figure) and the reverse direction ( Figure 2 The blue line in the figure shows the information transmission in two directions. In this structure, at time t, the bidirectional calculation between the hidden layer and the output layer is as follows:

[0181]

[0182] In artificial intelligence applications, especially deep learning algorithms, tuning hyperparameters is a time-consuming operation and is often not feasible. The measurements of the system phase angle are used as input to the cyber attack detection model. The total number of labels in the dataset is 16, which is also the number of neurons in a single fully connected layer, i.e., 16. It is important to emphasize that the number of hidden layers chosen also depends on trial and error, and experience with different models has shown that 3 or 4 hidden layers are suitable for modeling the uncertainties associated with the properties of power systems. There are a total of 22 forward layers and 22 reverse layers in the model bidirectional network. In this structure, the merge mode is set to sum mode, which merges the outputs of the forward and backward LSTMs together.

[0183] The activation process of the bidirectional layer is achieved by the hyperbolic tangent activation function. In addition, the last layer of the structure also uses the SoftMax function as the activation function. Dropout and sequence length are two other key criteria that determine the performance of the BiLSTM network. Both of these features can affect the performance of the network. Dropout is used to avoid the overfitting process and is therefore considered a regulation scheme. The values ​​of the bi-LSTM model parameters are usually set between 0 and 1. The value of the network constructed in this embodiment is 0.4. When the current sample is imported into the network, the sequence length specifies the number of samples before it.

[0184] The present invention determines the value of the dual LSTM model parameters through multiple experiments. After selecting several values, 1 is determined to be the most suitable parameter value in the present invention. Time is an important aspect in industrial applications, and the technical solution of the present invention also takes this into account in network training and testing. The Bi-LSTM training phase takes 06:27 (minutes: seconds), and the test and detection of each data sample takes 0.2 seconds. Table I lists the parameters of the Bi-LSTM model in this embodiment.

[0185] Table I. Parameters of the dual LSTM model

[0186]

[0187]

[0188] Further, in step 5 of Example 1, the IEEE14 bus test system uses MATPOWER to complete the experiment. In order to provide a more accurate simulation, the load data used in the simulation is provided by NYISO. The load curves of 11 regions are provided online every five minutes. To generate SE data, the load bus of the test system is associated with the NYISO region, and then the pre-processed data is incorporated into the MATPOWER test case. It is worth noting that the data set contains T = 2045 normal samples.

[0189] In this embodiment, two unique FDIAs are introduced in each attacked system state, which are 90% and 110% of its true value. Specifically, in each system state and multiple states θ 2,7 and θ 5,9 False data is injected into the system at the same time. Active power and system status are selected as features of the proposed method. Table II summarizes the features of the generated dataset.

[0190] Table II Description of simulation data

[0191]

[0192] The F1 score is used to evaluate the proposed method. The mathematical calculation of each indicator is as follows:

[0193]

[0194] Among them, p and r represent precision and recall respectively, and the calculation formula is:

[0195]

[0196] TP represents a true positive, FP represents a false positive, and FN represents a false negative.

[0197] In Example I, it is assumed that the network has been operating normally until the 7th day, so there are six days of normal observations and the last day is completely replaced by the attack. In order to compare the proposed BiLSTM-based detection framework with the current mature FDIA detection algorithms, machine learning-based methods such as SVM, KNN, and C4.5 are also trained on the generated dataset. Table III shows the evaluation results of this case. It can be seen that without integrating RES, most methods can successfully detect all attack samples.

[0198] TABLE III Training Results - Example I

[0199]

[0200]

[0201] The growing energy consumption requires the inclusion of renewable energy sources in the current power grid. However, the substantial growth of renewable energy sources increases uncertainty, causing changes in the underlying distribution of the collected samples and reducing the accuracy of the current FDIA detection method. In order to test the adaptability of the developed framework when incorporating renewable energy into the system, an FDIA is performed after incorporating a wind farm as a renewable energy source. For this purpose, it is assumed that the network will continue to operate normally on the fourth day. Figure 3 As shown, on the fourth day, two wind farms and a total of 36 wind turbines were connected to provide at least 18 MW of load to buses 3 and 4.

[0202] The wind turbines used in the test system are of the same design, with a capacity of 1 MW, a rated speed of 14 m / s, a cut-in speed of 4 m / s, and a rated power of 1000 kW, with a cut-out speed of 25 m / s. The wind turbine output energy is measured as follows:

[0203]

[0204] Among them, v f represents the predicted wind speed, P rated represents the rated power of the wind turbine, v ci Indicates the cutting speed, v r Indicates rated speed, v co Represents the cut-off speed of the wind turbine.

[0205] Assume that the attacker thoroughly targets the observations from the seventh day, which indicates that the FDIA occurred 3 days after the wind turbine was installed. Table IV summarizes the results of running the pre-built and saved ML models from Case I on this case dataset, and it can be seen that the current pre-trained ML models used to detect FDIA lose their ability to reliably classify samples and provide major efficiencies when new renewable energy sources are integrated into the system. The main reason for this decline is that the inclusion of RES introduces natural oscillations in the data, increasing the variance, but does not introduce attacks that would confuse current FDIA identification tools. This is in stark contrast to the carefully developed FDIA detection framework, which is able to identify FDIA and effectively manage the integration of RESs. This occurs because the developed techniques are precisely designed to correctly describe the underlying distribution of grid measurements and overcome the uncertainties introduced by the inclusion of distributed generation into the grid. As a result, traditional methods are unable to manage the dynamic nature of future grids, resulting in inaccurate classification of observations.

[0206] Table IV Test Results

[0207]

[0208]

[0209] FDIA can lead to inaccurate state estimates, which can result in erroneous monitoring actions. Existing FDIA detection techniques have been optimized for specific system settings, but ignore the reality of the evolving grid due to increasing integration of renewable energy sources. This enhanced uncertainty negatively impacts the performance of existing FDIA classifiers, leading to mislabeling of fresh samples.

[0210] Step 6, collect the operation data of the power system in real time, input the pre-processed and verified false data into the detection model, judge whether there is an abnormality in the power system according to the detection results output by the false data injection detection model, and take corresponding response measures.

[0211] In a further preferred but non-limiting embodiment, step 6 further includes collecting data in real time through sensors, measuring devices or system logs in the operating environment.

[0212] In a further preferred but non-limiting embodiment, step 6 also includes a false data injection detection model to detect whether there is a false data injection attack, and output a "normal" or "abnormal" label through a classification task; the nature of the false data injection includes the attack type, location, intensity and affected system nodes.

[0213] In a further preferred but non-limiting embodiment, in step 6, taking corresponding response measures according to the abnormal result includes:

[0214] After the model detects an anomaly, it feeds the detection result back to the operation and maintenance personnel through the alarm system;

[0215] Depending on the type and scope of the detected attack, the corresponding defense mechanism is triggered, such as switching the operating mode, isolating the affected area, adjusting the system operating parameters, etc.

[0216] Embodiment 2, the present invention provides a false data injection detection system based on a bidirectional long short-term memory network in embodiment 2, based on the false data injection detection method based on a bidirectional long short-term memory network described in embodiment 1, the system comprises:

[0217] An attack model building module, used to build a new energy grid load redistribution attack model based on local information;

[0218] A detection model building module, used to build a false data injection detection model based on a bidirectional long short-term memory network;

[0219] The detection simulation module is used to use the output of the constructed attack model as the input of the constructed detection model to realize the detection of false data.

[0220] Adaptability verification module, which is used to incorporate wind farm data into the IEEE14 bus test system to verify the adaptability of the established detection model after renewable energy integration;

[0221] The model application module applies the verified detection model to detect whether there is a false data injection attack in the power system.

[0222] Preferably, in one embodiment, the model is equipped with a performance monitoring module during operation to evaluate the accuracy and real-time performance of the detection results; if the detection effect decreases, the model can be updated through an online learning module to ensure the continuity of the detection capability.

[0223] The present disclosure may be a system, a method and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for causing a processor to implement various aspects of the present disclosure.

[0224] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, ordinary technicians in the relevant field should understand that the specific implementation methods of the present invention can still be modified or replaced by equivalents, and any modifications or equivalent replacements that do not depart from the spirit and scope of the present invention should be covered within the scope of protection of the claims of the present invention.

Claims

1. A false data injection detection method based on a bidirectional long short-term memory network, characterized in that: The steps include: Construct a new energy grid load redistribution attack model based on local information; Construct a false data injection detection model for new energy power grid based on bidirectional long short-term memory network; The output of the new energy grid load redistribution attack model is used as the input of the false data injection detection model to detect false data; Obtain data on new energy power grids; Incorporate new energy grid data into the IEEE node system to verify the adaptability of the false data injection detection model after renewable energy integration; The operation data of the power system is collected in real time, and the pre-processed and verified false data is injected into the detection model. According to the detection results output by the false data injection detection model, it is judged whether there is an abnormality in the power system, and corresponding response measures are taken.

2. The false data injection detection method based on bidirectional long short-term memory network according to claim 1 is characterized in that: The local information includes node status information, local load information, power generation information, topology information, scheduling information, security information and communication information.

3. The false data injection detection method based on bidirectional long short-term memory network according to claim 1 is characterized in that: The construction of the load redistribution attack model based on local information includes: Set the sum of power load and loss to be fixed; The voltage amplitude and phase angle of the boundary nodes are set to remain fixed; The interval analysis method is used to calculate the state scalar interval.

4. The false data injection detection method based on bidirectional long short-term memory network according to claim 3 is characterized in that: The setting of the voltage amplitude and phase angle of the boundary node to remain fixed includes: The voltage amplitude and phase angle of the boundary nodes satisfy the following formula constraints: Among them, ω A is the set of attacked nodes, ω load is the power load set in the attack area, ω gen is the set of generators in the attack area, ω0 is the set of zero-injected nodes in the attack area, d represents the set of boundary nodes, and x d is the initialization state array of the boundary bus, For the i th The node and the jth th The actual active power between nodes, For the i th The node and the jth th The actual reactive power between nodes; represents the actual power of the load L, Indicates the reference power value of load L, represents the actual reactive power of load L, Indicates the reference reactive power value of load L, represents the actual voltage of the generator G, represents the reference voltage value of the generator G, Indicates the actual value of the active power of the generator G, It represents the active power reference value of the generator G, where G represents the generator. Indicates the upper capacity limit of branch k, where k represents the branch. Represents the actual state value of node d, Indicates the baseline state value of node d.

5. The false data injection detection method based on bidirectional long short-term memory network according to claim 1 is characterized in that: The construction of a new energy grid false data injection detection model based on a bidirectional long short-term memory network specifically includes: Use bidirectional LSTM for feedforward and backward information transfer; Introduce the Dropout mechanism to prevent overfitting; Use the SoftMax function to classify and output attacks.

6. The false data injection detection method based on bidirectional long short-term memory network according to claim 5 is characterized in that: The use of bidirectional LSTM for feedforward and reverse information transfer specifically includes: According to the following formula, the hidden state is used to complete the information transfer in both the feedforward and reverse directions: Where σ is the logarithmic sigmoid function, and Represent the forward and backward hidden states respectively, W x , W h Represent the weight matrix input to the hidden layer, the hidden state at the previous moment to the weight matrix of the current hidden state, They represent the hidden state vector transmitted from the future time t+1 to the current time t, and the hidden state vector transmitted from the previous time t-1 to the current time t, respectively. t represents the input vector at the current time t, b h Represents the bias vector of the hidden layer.

7. The false data injection detection method based on bidirectional long short-term memory network according to claim 5 is characterized in that: The introduction of the Dropout mechanism to prevent overfitting specifically includes the following formula: Among them, p is the probability of Dropout, h y represents the hidden layer output vector at the current time t, Represents the hidden layer output vector after the Dropout operation.

8. The false data injection detection method based on bidirectional long short-term memory network according to claim 5 is characterized in that: The classification and output of the attack using the SoftMax function include: The probability of attack category i is calculated as follows: Where P(y=i|x) is the probability of attacking category i, W i and b i are weight and bias respectively, K represents the total number of attack categories, x represents the independent variable, and y represents the dependent variable that changes with x.

9. The false data injection detection method based on bidirectional long short-term memory network according to claim 1 is characterized in that: The output of the new energy grid load redistribution attack model includes prediction results, possible attack locations and types, wherein the prediction results include normal and abnormal; the output of the false data injection detection model includes the specific location or scope of the attack.

10. A false data injection detection system based on a bidirectional long short-term memory network, based on a false data injection detection method based on a bidirectional long short-term memory network according to any one of claims 1 to 9, characterized in that: The system includes: An attack model building module, used to build a new energy grid load redistribution attack model based on local information; A detection model building module, used to build a false data injection detection model based on a bidirectional long short-term memory network; The detection simulation module is used to use the output of the constructed attack model as the input of the constructed detection model to realize the detection of false data; Adaptability verification module, which is used to incorporate wind farm data into the IEEE node test system to verify the adaptability of the established detection model after renewable energy integration; The model application module applies the verified detection model to detect whether there is a false data injection attack in the power system.

Images