Information physical attack vector generation method of power monitoring system and related device

Abstract

The invention discloses an information physical attack vector generation method of an electric power monitoring system and a related device, and relates to the technical field of information security of the electric power monitoring system.The method comprises the steps that a simulation model of the electric power monitoring system is established, and the simulation model is controlled to operate according to the actual operation condition of the electric power monitoring system; performing load flow calculation on the simulation model to obtain an initial measurement value, performing state estimation based on the initial measurement value to obtain an initial state, taking the initial state as input, determining an action and a Q value corresponding to the initial state by using a GCN-Dueling DQN algorithm, and acting the action on the simulation model to obtain a next state and a return corresponding to the initial state. And continuously iterating until the Q value converges, ending iteration, and selecting the action with the maximum return as an information physical attack vector. According to the invention, the efficiency and precision of generating the information physical attack vector can be improved.

Description

Technical Field

[0001] The present application relates to the field of information security technology for power monitoring systems, and in particular to a method and related device for generating information physical attack vectors for power monitoring systems based on a GCN-DuelingDQN algorithm. Background Art

[0002] The power monitoring system is a system used to monitor and control the power production and supply process. It is based on computer and network technology, combined with intelligent devices and communication networks and data networks as the basic support, to achieve real-time data collection, switch status detection and remote control of the power system. However, with the deep integration of power systems and information and communication technologies, power monitoring systems are also facing increasingly severe threats of cyber-physical attacks. In recent years, many cyber security incidents targeting power monitoring systems have occurred. In the above cyber security incidents, attackers launched cyber-physical coordinated attacks, which paralyzed the power monitoring system and caused huge losses. Therefore, from the perspective of attack, it is particularly important to study the generation method of covert cyber-physical attack vectors, which will help improve the resilience of power monitoring systems and promote the innovation of security protection technologies.

[0003] There are two common ideas for generating cyber-physical attack vectors. The first is that the attacker launches a physical attack and then launches a network attack to cover up the current state and mislead the control center to make wrong decisions. The second is that the attacker first launches a network attack and then launches a physical attack to cover up the current state and mislead the control center to make wrong decisions. The combination of network attacks and physical attacks causes greater harm to the power monitoring system than a single attack. At present, the traditional generation methods for the second idea include: generation methods based on heuristic search and optimization algorithms, generation methods based on mixed integer programming, and generation methods based on relaxation and approximation methods. Although the above traditional generation methods have shown certain effectiveness in processing the generation of cyber-physical attack vectors of traditional power monitoring systems, with the increasing complexity and intelligence of power monitoring systems, traditional generation methods face huge challenges in efficiency and accuracy, and it is difficult to accurately capture and simulate the generation and evolution process of cyber-physical attack vectors under new attack scenarios. Therefore, it is urgent to study more efficient and high-precision generation methods to meet the security challenges of new power monitoring systems. Summary of the invention

[0004] The purpose of this application is to provide a method and related device for generating information-physical attack vectors for an electric power monitoring system, which can improve the efficiency and accuracy of generating information-physical attack vectors.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In a first aspect, the present application provides a method for generating a cyber-physical attack vector for a power monitoring system, the method comprising:

[0007] Establishing a simulation model of the power monitoring system, controlling the operation of the simulation model according to the actual operation of the power monitoring system, and performing power flow calculation on the simulation model to obtain initial measurement values; the circuit topology of the simulation model and the power monitoring system are completely the same; the measurement values ​​include the active power of each node in the power monitoring system and the active power at both ends of each transmission line, and the nodes include load nodes, generator nodes and busbar nodes;

[0008] Perform state estimation based on the initial measurement value to obtain an initial state; the initial state includes the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line, and the state includes normal and abnormal;

[0009] Taking the initial state as input, the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state; the action includes a load redistribution attack action and a physical manipulation attack action; the load redistribution attack action includes a number of selected load nodes to be attacked and a tampered injection power corresponding to each load node to be attacked; the physical manipulation attack action includes a number of selected overload lines to be attacked and a tampered reactance parameter corresponding to each overload line to be attacked; the overload line is a transmission line that is overloaded due to the load redistribution attack action;

[0010] Applying the action to the simulation model to obtain a next state and a reward corresponding to the initial state;

[0011] Determine whether the Q value converges and obtain the judgment result;

[0012] If the judgment result is yes, the iteration ends, and the action with the maximum reward is selected as the cyber-physical attack vector;

[0013] If the judgment result is no, then determine whether the current number of iterations reaches the preset number of iterations; if so, update the GCN-Dueling DQN algorithm to obtain an updated GCN-Dueling DQN algorithm, set the current number of iterations to 0, and use the updated GCN-Dueling DQN algorithm as the GCN-Dueling DQN algorithm for the next iteration, use the next state as the initial state of the next iteration, and return to the step of "taking the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state". If not, add 1 to the current number of iterations, and use the next state as the initial state of the next iteration, and return to the step of "taking the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state".

[0014] In a second aspect, the present application provides a computer device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-mentioned method for generating an information-physical attack vector for a power monitoring system.

[0015] In a third aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the above-mentioned method for generating an information-physical attack vector for a power monitoring system.

[0016] In a fourth aspect, the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the above-mentioned method for generating an information-physical attack vector for a power monitoring system.

[0017] According to the specific embodiments provided in this application, this application discloses the following technical effects:

[0018] The present application provides a method and related device for generating an information-physical attack vector for an electric power monitoring system. First, a simulation model of the electric power monitoring system is established. The operation of the simulation model is controlled according to the actual operation of the electric power monitoring system. The simulation model is subjected to flow calculation to obtain an initial measurement value. The state is estimated based on the initial measurement value to obtain an initial state. The initial state is used as input, and the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state. The action is applied to the simulation model to obtain the next state and reward corresponding to the initial state. The iteration is continued until the Q value converges, and the iteration is terminated. The action with the largest reward is selected as the information-physical attack vector. The present application introduces the Dueling DQN algorithm. By separating the state value function and the action advantage function, not only the number of Q values ​​that need to be calculated in each iteration is reduced, but also the number of parameters and the computational complexity are reduced, and the computational efficiency is improved. At the same time, the information-physical attack vector can be generated through the training process. Compared with the method of generating the information-physical attack vector by training first and then applying, the computational efficiency can be further improved. The introduction of the GCN model can process graph-structured data and extract useful feature information through the connection relationship between nodes. When data is insufficient, it can supplement and enhance the feature representation in the learning process through graph structure information to generate better quality cyber-physical attack vectors. It can solve the problem that the generated cyber-physical attack vectors may be relatively single and cannot cover all potential threats, affecting the diversity and flexibility of attack strategies, making it more difficult to cope with changing defense mechanisms. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 This is an application environment diagram of a method for generating an information-physical attack vector for an electric power monitoring system provided in Example 1 of the present application.

[0021] Figure 2 A flowchart of a method for generating an information-physical attack vector for an electric power monitoring system provided in Example 1 of the present application.

[0022] Figure 3 A schematic diagram of the principles of a method for generating an information-physical attack vector for an electric power monitoring system provided in Example 1 of the present application.

[0023] Figure 4 A schematic diagram of the flow of the GCN-Dueling DQN algorithm provided in Example 1 of the present invention.

[0024] Figure 5 A schematic diagram of the structure of a computer device provided in Example 2 of the present application. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0026] Example 1

[0027] The method for generating a cyber-physical attack vector for a power monitoring system provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Among them, the terminal communicates with the server through the network. The data storage system can store the data that the server needs to process. The data storage system can be set up separately, integrated on the server, or placed on the cloud or other servers. The terminal can send the pending generation request (used to generate the information-physical attack vector of the power monitoring system) to the server. After the server receives the pending generation request, for the pending generation request, the server establishes a simulation model of the power monitoring system, controls the operation of the simulation model according to the actual operation of the power monitoring system, and performs power flow calculation on the simulation model to obtain the initial measurement value; based on the initial measurement value, the state is estimated to obtain the initial state; with the initial state as input, the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state; the action is applied to the simulation model to obtain the next state and reward corresponding to the initial state; whether the Q value converges to obtain the judgment result; if the judgment result is yes, the iteration is terminated, and the action with the largest reward is selected as the information-physical attack vector. The server can feedback the obtained information-physical attack vector for the generation request to the terminal.

[0028] In addition, in some embodiments, the information-physical attack vector generation method of the power monitoring system can also be implemented independently by a server or a terminal. For example, the terminal can directly process the generation request to be processed, or the server can obtain the generation request to be processed from the data storage system and process the generation request to be processed.

[0029] The terminal may be, but is not limited to, various desktop computers, laptops, smart phones, tablet computers, IoT devices, and portable wearable devices. The server may be implemented as an independent server or a server cluster consisting of multiple servers, or may be a cloud server.

[0030] With the development of computing power and distributed computing, generation methods based on deep reinforcement learning have become a research hotspot for generating cyber-physical attack vectors. For example, the DQN (Deep Q-Learning) algorithm is used to generate cyber-physical attack vectors. The algorithm is divided into two stages:

[0031] The first stage is the training of the DQN algorithm. The specific process includes: initializing the DQN algorithm parameters; because the agent knows nothing about the environment, it is necessary to initialize the Q table in the network environment, with an initial value of 0. The information in the Q table represents the knowledge or experience that the agent continuously acquires during the learning process; starting iteration and determining the initial state; starting training and selecting a new action with probability ε, otherwise selecting the action that maximizes the Q value; evaluating the action; observing the reward and the next state; storing the record (state s t , action a t , reward r t , the next state s t+1 ) to the experience replay buffer pool D; randomly collect N records (state s t , action a t , reward r t , the next state s t+1 ); if s i+1 is the final state, then r i The value is assigned to y i Otherwise, y i Press y i =r i +γmax a Q(s i+1 ,a;θ) is calculated, γ is the learning rate; according to The loss function is minimized by gradient descent to update the DQN algorithm parameters θ.

[0032] The second stage is the generation of cyber-physical attack vectors. The specific process includes: loading the trained DQN algorithm parameters θ; starting iterations and obtaining the initial state; physically disconnecting a transmission line and updating the topology of the power monitoring system; removing a transmission line from the network layer and causing the power monitoring system to re-dispatch power generation; updating the power flow and evaluating whether the key transmission line is overloaded; calculating the Q value from the Q network and t = arg max a Q(s t ,a;θ) select the action, and after the iteration, the information physical attack vector is obtained.

[0033] However, the above method has several shortcomings. First, it is highly dependent on a large amount of high-quality training data, and insufficient data will lead to poor training results. Second, it consumes a lot of computing resources in large-scale power monitoring systems, and has weak generalization capabilities. When the power monitoring system changes, it must be retrained. Finally, the generated cyber-physical attack vectors may be relatively single and cannot cover all potential threats, affecting the diversity and flexibility of attack strategies, making it more difficult to cope with changing defense mechanisms.

[0034] In order to solve the above problems, Figure 2 and Figure 3 As shown, this embodiment provides a method for generating an information physical attack vector for an electric power monitoring system. The method is executed by a computer device, and can be executed by a computer device such as a terminal or a server alone, or by a terminal and a server together. In the embodiment of the present application, the method is applied to Figure 1 The server in the example is used to illustrate the following steps:

[0035] Step S1, establish a simulation model of the power monitoring system, control the operation of the simulation model according to the actual operation of the power monitoring system, and perform power flow calculation on the simulation model to obtain initial measurement values; the circuit topology structure of the simulation model and the power monitoring system are exactly the same; the measurement values ​​include the active power of each node in the power monitoring system and the active power at both ends of each transmission line, and the nodes include load nodes, generator nodes and bus nodes.

[0036] Step S2, performing state estimation based on the initial measurement value to obtain an initial state; the initial state includes the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line, and the state includes normal and abnormal.

[0037] Step S3, taking the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state; the action includes a load redistribution attack action and a physical manipulation attack action; the load redistribution attack action includes a selected number of load nodes to be attacked and a tampered injection power corresponding to each load node to be attacked; the physical manipulation attack action includes a selected number of overload lines to be attacked and a tampered reactance parameter corresponding to each overload line to be attacked; the overload line is a transmission line that is overloaded due to the load redistribution attack action.

[0038] Step S4, applying the action to the simulation model to obtain the next state and reward corresponding to the initial state.

[0039] Step S5, judging whether the Q value is converged, and obtaining a judgment result.

[0040] Step S6: If the judgment result is yes, the iteration ends and the action with the maximum reward is selected as the cyber-physical attack vector.

[0041] Step S7, if the judgment result is no, determine whether the current number of iterations reaches the preset number of iterations; if so, update the GCN-Dueling DQN algorithm to obtain an updated GCN-Dueling DQN algorithm, set the current number of iterations to 0, and use the updated GCN-Dueling DQN algorithm as the GCN-Dueling DQN algorithm for the next iteration, use the next state as the initial state of the next iteration, and return to the step of "using the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state". If not, add 1 to the current number of iterations, use the next state as the initial state of the next iteration, and return to the step of "using the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state".

[0042] Implement the above-mentioned steps S1 to S7. This embodiment uses the GCN (Graph Convolutional Network)-Dueling DQN algorithm to generate the information-physical attack vector of the power monitoring system, introduces the Dueling DQN algorithm, and focuses more on learning the state value and action advantage by separating the state value function and the action advantage function. Since the state value function outputs a scalar and the action advantage function outputs a vector with the same dimension as the action space, this design not only reduces the number of Q values ​​that need to be calculated in each iteration, but also reduces the number of parameters and the computational complexity, thereby reducing the consumption of computing resources, especially in the environment of large-scale power monitoring systems with complex state spaces and action spaces, the computing efficiency can be improved. At the same time, the information-physical attack vector can be generated through the training process, which can further improve the computing efficiency compared to the method of generating the information-physical attack vector by training first and then applying it. The introduction of the GCN model can process graph-structured data and extract useful feature information through the connection relationship between nodes. In the case of insufficient data, it can supplement and enhance the feature representation in the learning process through graph structure information to generate better quality cyber-physical attack vectors, solve the problem that the generated cyber-physical attack vectors may be relatively single and cannot cover all potential threats, affecting the diversity and flexibility of attack strategies, making it more difficult to cope with changing defense mechanisms, and solve the problem of high reliance on a large amount of high-quality training data and insufficient data leading to poor training results. Subsequently, by setting up an experience replay pool, by simulating the operating status and attack scenarios of different power monitoring systems, a variety of experiences are generated and pre-stored in the experience replay pool. This increase in data diversity helps to better generalize to unknown or new power monitoring system environments and improve generalization capabilities.

[0043] This embodiment can adopt the third-party library pandapower in python, customize the simulate_and_add_measurement function through the existing functions in the pandapower library, use the customized simulate_and_add_measurement function to load the predefined power monitoring system, establish a simulation model of the power monitoring system, the circuit topology structure of the simulation model and the power monitoring system is exactly the same, the operation of the simulation model is controlled according to the actual operation of the power monitoring system, and the simulation model is subjected to power flow calculation, and the initial measurement values ​​are obtained by simulation collection, the measurement values ​​include the active power of each node in the power monitoring system and the active power at both ends of each transmission line, the nodes include load nodes, generator nodes and bus nodes, the bus nodes include transformer nodes and contact nodes, etc., the transmission line is used to connect two nodes, and the active power at both ends of the transmission line includes the active power at the first end of the transmission line and the active power at the second end of the transmission line.

[0044] After loading and running the current power monitoring system, this embodiment generates a noisy measurement value based on the power flow calculation results of the simulation model and the specified noise level, and simulates the measurement errors that may exist in the actual power monitoring system by adding random noise, that is, adding noise of the specified noise level to the measurement value obtained by the power flow calculation to obtain a noisy measurement value, and using the noisy measurement value as the initial measurement value.

[0045] After obtaining the initial measurement value, this embodiment first performs system state estimation and bad data detection to verify the validity of the measurement data simulated before the attack (i.e., the initial measurement value). Specifically, the system state estimation algorithm and the bad data detection algorithm are further called. The system state estimation algorithm and the bad data detection algorithm are both functions in pandapower. Specifically, the system state estimation algorithm can select a state estimation algorithm based on weighted least squares method, and the bad data detection algorithm can select a chi-square test method. The system state estimation is performed by the system state estimation algorithm, and the bad data detection is performed by the bad data detection algorithm. If the system state estimation is successful and no bad data is detected, it indicates that the measurement data simulated before the attack is valid. Subsequently, state estimation can be further performed based on the initial measurement value. If the system state estimation is not successful or bad data is detected, it indicates that the measurement data simulated before the attack is invalid. The initial measurement value is regenerated by adjusting the input parameters of the custom simulate_and_add_measurement function.

[0046] At this time, in S2, the state estimation is performed based on the initial measurement value to obtain the initial state, which specifically includes:

[0047] (1) Taking the initial measurement value as input, the system state estimation algorithm is used to determine the initial system state quantity, which includes the voltage and phase angle of each node in the power monitoring system.

[0048] (2) Taking the initial system state as input, the bad data detection algorithm is used to determine the initial bad data.

[0049] (3) If the difference between the initial system state quantity and the normal system state quantity is less than the preset difference, and the number of initial bad data is 0, a state estimation is performed based on the initial measurement value to obtain the initial state.

[0050] In this embodiment, the GCN model in the GCN-Dueling DQN algorithm can be used to perform state estimation on the initial measurement value, form state perception of the environment of the power monitoring system, and obtain the initial state. The initial state includes the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line. The state includes normal and abnormal. In the initial state, the state of each node and the state of each transmission line are normal, and the attention weight remains unchanged in subsequent iterations. Among them, the generation method of attention weight includes: while using the GCN model to learn the characteristics of the power monitoring system, using the task encoder to obtain the task representation, calculating the attention weight according to the characteristics and task representation, thereby determining the attention weight of each node and each transmission line, and optimizing the state representation of the power monitoring system.

[0051] like Figure 4 As shown, in S2, state estimation is performed based on the initial measurement value to obtain the initial state, which specifically includes:

[0052] (1) Control the simulation model according to the preset task and perform power flow calculation on the simulation model to obtain the measurement value corresponding to the task, which includes covering up the line overload.

[0053] (2) Using the measurement value corresponding to the task as input, the first GCN model is used to obtain the first feature.

[0054] (3) Using the measurement value corresponding to the task as input, the second feature is obtained using the second GCN model.

[0055] (4) Based on the measurement value corresponding to the task and the initial measurement value, the system state vector is determined. The system state vector includes the coding value of each node in the power monitoring system and the coding value of each transmission line. The coding value takes 1 when the measurement value changes, and takes 0 when the measurement value does not change.

[0056] For each node, if the value of the node in the measurement value corresponding to the task is the same as the value of the node in the initial measurement value, the code value of the node is 0, otherwise, the code value of the node is 1. For each transmission line, if the value of the transmission line in the measurement value corresponding to the task is the same as the value of the transmission line in the initial measurement value, the code value of the transmission line is 0, otherwise, the code value of the transmission line is 1.

[0057] (5) Taking the system state vector as input, the task encoder is used to obtain the task representation.

[0058] Among them, the task encoder is a multilayer perceptron (MLP), which is used to automatically learn and extract task-related feature representations to obtain task representations.

[0059] (6) Use the Softmax function to process the first feature and the task representation to obtain the processed feature.

[0060] (7) Pooling the second feature and the processed feature (i.e. Figure 4 The attention weight of each node and the attention weight of each transmission line in the power monitoring system are determined by WeightingPooling in the power monitoring system.

[0061] (8) The state of each node and the state of each transmission line in the power monitoring system are set to normal, and the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line form the initial state.

[0062] This embodiment first defines multiple parameters in the GCN-Dueling DQN algorithm, as follows:

[0063] (1) State: The state includes the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line. The state of the node and the state of the transmission line can be of two types: normal and abnormal.

[0064] (2) Action, which represents the selectable action type, including two action types: tampering with the load node injection power and the overload line reactance parameters, and tampering with the load node injection power but not tampering with the overload line reactance parameters. This embodiment specifically defines a load redistribution attack action and a physical manipulation attack action. The load redistribution attack action includes a selected number of load nodes to be attacked and the tampered injection power corresponding to each load node to be attacked. The physical manipulation attack action includes a selected number of overload lines to be attacked and the tampered reactance parameters corresponding to each overload line to be attacked. The overload line is a transmission line that is overloaded due to the load redistribution attack action. The number of overload lines to be attacked can be 0, which is equivalent to not tampering with the overload line reactance parameters.

[0065] (3) Reward, which represents the reward obtained after choosing a certain action in a certain state.

[0066] (4) Q function table, which reflects the discounted cumulative return that can be expected by selecting an action in a certain state and following the strategy until the terminal state, and this representation is achieved by decomposing the state value function and the action advantage function.

[0067] (5) Attack strategy set P. The format of attack strategy set P is <action, pre, post>, which means: after applying action action to the environment of the power monitoring system, in the current state pre, the next state that can be reached by the cyber-physical attack is post.

[0068] (6) Learning rate α, which is a preset parameter.

[0069] (7) Experience replay pool, used to store the experience generated during the training process to update the network parameters.

[0070] In this embodiment, the preparation work before generating the information physical attack vector is first completed. The preparation work is specifically divided into parameter initialization preparation work and parameter input preparation work. The parameter initialization preparation work includes: initializing the Q function table in the GCN-Dueling DQN algorithm, specifically setting all values ​​to 0, and the parameter input preparation work includes: inputting the attack strategy set P and inputting the learning rate α. Then, according to the initial state, the information physical attack vector is constructed through the training process, that is, S3 is performed.

[0071] In S3, the initial state is taken as input and the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state, specifically including: taking the initial state as input and using the third GCN model to determine the first node feature corresponding to the initial state; taking the first node feature corresponding to the initial state as input and using the Dueling DQN algorithm to determine the action and Q value corresponding to the initial state.

[0072] The GCN-Dueling DQN algorithm combines the GCN model and the Dueling DQN algorithm. The GCN model is a neural network that performs convolution operations on graph data. The Dueling DQN algorithm is an improved algorithm of the traditional DQN algorithm. It consists of three parts: input layer, hidden layer, and output layer. The input layer contains multiple system state nodes. The number of system state nodes is determined by the number of state variables. The Dueling DQN algorithm divides the Q value function into two parts: the state value function V and the action advantage function A. The GCN-Dueling DQN algorithm outputs the action and the state value and action advantage of the action. The sum of the state value and the centralized action advantage is the Q value corresponding to the action. Among them, the centralized action advantage is the action advantage of each action minus the average action advantage of all possible actions in the state. It should be noted that when calculating the sum of the state value and the centralized action advantage, since the state value is a scalar and the centralized action advantage is a vector, the state value and each element of the centralized action advantage are summed separately to obtain the Q value, and the final Q value is a vector.

[0073] In the GCN-Dueling DQN algorithm, the GCN model and the Dueling DQN algorithm are fused and executed. Specifically, the GCN model is responsible for extracting the node features of the initial state and using these node features as the input of the Dueling DQN algorithm. Then, the Dueling DQN algorithm uses these node features to perform Q value decomposition and strategy selection, and outputs actions and Q values ​​corresponding to the actions. At this time, the action is selected based on the initial state, the subsequent nodes and transmission lines that may have abnormalities corresponding to the initial state, the action markers Sc and Sp, the attack strategy set P, the Q function table, and the learning rate α. Among them, the subsequent nodes and transmission lines that may have abnormalities are actually part of the attack strategy set. According to the attack strategy set, the load nodes that may be tampered with in the future and the transmission lines that are overloaded due to tampering with the load nodes can be obtained. Sc and Sp represent whether to execute the load redistribution attack action and the physical manipulation attack action respectively. Among them, 1 indicates that this attack action is executed, and 0 indicates that this attack action is not executed. In this way, the GCN model and Dueling DQN algorithm can work together to improve the ability to generate cyber-physical attack vectors for power monitoring systems. After executing an action, the next state and reward returned by the environment are received, and the GCN-Dueling DQN algorithm is updated based on the initial state, action, next state, and reward.

[0074] When selecting an action, the GCN-Dueling DQN algorithm depends on the Q-value function in the current state, which is updated during the training process. In order to balance exploration and utilization, the GCN-Dueling DQN algorithm adopts an ε-greedy search strategy. Specifically, it randomly explores new actions with a probability of ε, and selects the action with the largest Q value from the known attack strategy set with a probability of 1-ε to obtain the action corresponding to the initial state.

[0075] In this embodiment, the GCN-Dueling DQN algorithm enhances the perception of state variables by integrating the GCN model and the Dueling DQN algorithm, so that the decision-making actions have a certain degree of consistency and better quality.

[0076] In this embodiment, after the selected action is applied to the environment of the power monitoring system, the current state of the power monitoring system environment is sensed, that is, the next state is obtained, and the action is fed back and a corresponding reward is given. Then, in S4, the action is applied to the simulation model to obtain the next state and reward corresponding to the initial state. When calculating the reward, after the selected action is applied to the simulation model, a power flow calculation is performed, and then the relevant parameters in the power flow calculation result are analyzed to determine the effect of the cyber-physical attack and give a corresponding reward.

[0077] In order to improve the memory function and convergence effect of the algorithm, the reward settings are divided into the following situations:

[0078] (1) When the attacker successfully masks the overloaded line and remains undetected, that is, the attacker successfully injects power by tampering with the load node and collaboratively tampering with the overloaded line reactance parameters, so that the line overload is completely concealed and the dispatcher cannot find any abnormalities through conventional monitoring methods, the maximum positive reward is given on the basis of the economic dispatch cost, and the maximum positive reward value is 100.

[0079] (2) When the attacker launches a load redistribution attack and successfully evades system state estimation and bad data detection, the power flow calculation results are analyzed to see whether they cause line overload. If so, an appropriate positive reward is given based on the economic dispatch cost. The appropriate positive reward value is 20.

[0080] (3) When the attacker launches a load redistribution attack and fails to successfully evade the system state estimation and bad data detection, or successfully evades the system state estimation and bad data detection but does not cause line overload, a maximum negative reward is given based on the economic dispatch cost, and the maximum negative reward value is -100.

[0081] The return is calculated as:

[0082]

[0083] In formula (1), R is the return; R ed is the dispatching cost, that is, the economic dispatching cost; a, b, and c are all conditions; a means that both the load redistribution attack action and the physical manipulation attack action are verified to be successful, and after the load redistribution attack action successfully causes the line overload, the line overload is successfully covered up by the physical manipulation attack action; b means that the load redistribution attack action is verified to be successful, and the load redistribution attack action successfully causes the line overload; c means that the load redistribution attack action verification fails or the load redistribution attack action verification passes, but fails to successfully cause the line overload.

[0084]

[0085] In formula (2), N G is the total number of generator nodes in the power monitoring system; α i is the first power generation cost coefficient of the i-th generator node; is the active power of the i-th generator node; β i is the second power generation cost coefficient of the i-th generator node; i is the third power generation cost coefficient of the i-th generator node.

[0086] The specific methods for determining conditions a, b, and c in the return calculation formula include:

[0087] (1) Apply the load redistribution attack action to the simulation model to obtain the first post-attack model, and perform power flow calculation on the first post-attack model to obtain the first post-attack measurement value.

[0088] In this embodiment, after the selected load redistribution attack action is applied to the environment of the power monitoring system, power flow calculation is performed to obtain the measurement value after the first attack.

[0089] (2) The load redistribution attack action is verified based on the measurement value after the first attack to obtain a first verification result.

[0090] In this embodiment, based on the tampered measurement data (i.e., the measurement value after the first attack), the system state quantity after the network attack is obtained through the system state estimation algorithm, and the bad data in the tampered measurement data is detected through the bad data detection algorithm. If the tampered measurement data successfully avoids the system state estimation and bad data detection, the power flow calculation is then performed.

[0091] At this time, the load redistribution attack action is verified based on the measurement value after the first attack to obtain a first verification result, which specifically includes: taking the measurement value after the first attack as input, and using the system state estimation algorithm to determine the system state quantity after the first attack; taking the system state quantity after the first attack as input, and using the bad data detection algorithm to determine the bad data after the first attack; if the difference between the system state quantity after the first attack and the normal system state quantity is less than the preset difference, and the amount of bad data after the first attack is 0, then the first verification result is verification passed; otherwise, the first verification result is verification failed.

[0092] (3) If the first verification result is verification failure, it is determined that the action belongs to condition c, and the reward corresponding to the action is further calculated using formula (1).

[0093] (4) If the first verification result is that the verification is passed, the power flow calculation is performed on the first post-attack model to obtain the actual current value of each transmission line in the power monitoring system, and the transmission line whose actual current value is greater than the maximum rated current is recorded as an overloaded line.

[0094] This embodiment further analyzes the actual current value of each transmission line in the power flow calculation result. If the actual current value is greater than the maximum rated current of the line, the transmission line is determined to be an overloaded line, and all overloaded lines are grouped into an overloaded line set L.

[0095] (5) Determine whether the number of overloaded lines is 0; if so, determine that the action belongs to condition c, and further use formula (1) to calculate the reward corresponding to the action; if not, determine that the action belongs to condition b, and further use formula (1) to calculate the reward corresponding to the action.

[0096] (6) Applying the physical manipulation attack action to the first post-attack model to obtain a second post-attack model, and performing power flow calculation on the second post-attack model to obtain the second post-attack measurement value.

[0097] In this embodiment, according to the overload line set L, the selected physical manipulation attack action is applied to the environment of the power monitoring system to cover up the line overload caused by the load redistribution attack action, and the flow calculation is performed to obtain the measurement value after the second attack.

[0098] (7) Verifying the physical manipulation attack action based on the measurement value after the second attack to obtain a second verification result.

[0099] In this embodiment, based on the tampered measurement data (i.e., the measurement value after the second attack), the system state estimation algorithm is used to estimate the system state after the physical attack, and the bad data in the tampered measurement data is detected by the bad data detection algorithm. If the tampered measurement data successfully evades the system state estimation and bad data detection, the power flow calculation is then performed.

[0100] At this time, the physical manipulation attack action is verified based on the measured value after the second attack to obtain a second verification result, which specifically includes: taking the measured value after the second attack as input, and using the system state estimation algorithm to determine the system state quantity after the second attack; taking the system state quantity after the second attack as input, and using the bad data detection algorithm to determine the bad data after the second attack; if the difference between the system state quantity after the second attack and the normal system state quantity is less than the preset difference, and the amount of bad data after the second attack is 0, then the second verification result is verification passed; otherwise, the second verification result is verification failed.

[0101] (8) If the second verification result is verification failure, it is determined that the action belongs to condition b, and the reward corresponding to the action is further calculated using formula (1); if the second verification result is verification success, it is determined that the action belongs to condition a, and the reward corresponding to the action is further calculated using formula (1).

[0102] In this embodiment, an experience replay pool is set up for the GCN-Dueling DQN algorithm. It is the training sample library of the GCN-Dueling DQN algorithm, obtained by the agent continuously interacting with the environment for trial-and-error learning, which solves the problem of overfitting in traditional reinforcement learning and improves the convergence effect of the algorithm. The training process is mainly reflected in the process of the agent optimizing its strategy through continuous iteration and trial-and-error, including the entire process from state perception to action selection, action execution and feedback, policy update, and iteration and convergence judgment. The agent continuously interacts with the environment and updates its policy according to the received rewards until the Q value converges.

[0103] Among them, the setting of the experience in the experience replay pool is as follows: <state, action, reward, state'>, where state is the current state, action is the action taken in the current state, reward is the corresponding reward after taking the action in the current state, and state' is the next state entered after executing the action. During the learning process, new experiences are continuously added to the experience replay pool. To ensure that the latest experience can be used to train the network, the update rule of the experience replay pool is set as the first-in, first-out principle.

[0104] In this embodiment, it is judged whether the Q value converges to obtain a judgment result. The Dueling DQN algorithm uses a loss function to measure the gap between the currently estimated Q value and the target Q value. When the value of the loss function tends to be stable in consecutive multiple iterations, that is, no significant change occurs, it indicates that the Q value converges. If the judgment result is yes, that is, the Q value converges, then the iteration ends, and the action with the largest reward is selected as the cyber-physical attack vector. If the judgment result is no, that is, the Q value does not converge, then it is judged whether the current iteration number reaches the preset iteration number; if so, the GCN-Dueling DQN algorithm is updated to obtain the updated GCN-Dueling DQN algorithm, the current iteration number is set to 0, and the updated GCN-Dueling DQN algorithm is used as the GCN-Dueling DQN algorithm for the next iteration, and the next state is used as the initial state for the next iteration, and the step of "using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state with the initial state as the input" is returned; if not, the current iteration number is incremented by 1, and the next state is used as the initial state for the next iteration, and the step of "using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state with the initial state as the input" is returned.

[0105] After obtaining the next state and reward corresponding to the initial state, the information-physical attack vector generation method of the power monitoring system of this embodiment also includes: the initial state and the action, next state and reward corresponding to the initial state form an experience, and the experience is stored in an experience replay pool. The experience replay pool pre-stores the experience generated by simulating information-physical attacks on different power monitoring systems. At this time, the GCN-Dueling DQN algorithm is updated to obtain an updated GCN-Dueling DQN algorithm, specifically including: selecting part of the experience from the experience replay pool according to the first-in-first-out principle, and using part of the experience to update the GCN-Dueling DQN algorithm to obtain an updated GCN-Dueling DQN algorithm.

[0106] According to the reward, the Q value in the GCN-Dueling DQN algorithm is updated according to the following formula (3), and the network parameters of the Dueling DQN algorithm are further updated later:

[0107]

[0108] In formula (3), Q(state, action) is the Q value, state is the initial state, action is the action corresponding to the initial state; R(state, action) is the reward; α is the learning rate; state' is the next state; action' is the action corresponding to the next state.

[0109] This embodiment further adopts two standard power monitoring system test cases, case 39 and case 118, for simulation and analysis. The results show that the method of this embodiment has excellent performance and can generate cyber-physical attack vectors efficiently and accurately.

[0110] This embodiment provides a method for generating a cyber-physical attack vector for a power monitoring system based on the GCN-Dueling DQN algorithm. The method first launches a load redistribution network attack, and then launches a physical manipulation attack to cover up the actual overload line caused by the network attack, so that the control center issues a non-optimal dispatch instruction based on the wrong state estimation result, thereby affecting the normal operation of the power monitoring system. First, through the custom simulate_and_add_measurement function, the predefined power monitoring system is loaded and run to simulate the measurement values ​​of the acquisition nodes and transmission lines; then, the state of the measurement values ​​is estimated to form an environmental perception of the power monitoring system and obtain the initial state; finally, according to the initial state, the cyber-physical attack vector is constructed through the training process of the GCN-Dueling DQN algorithm. This embodiment uses the GCN-DuelingDQN algorithm to improve the efficiency and scale of information-physical attack vector generation, and can generate information-physical attack vectors dynamically and in real time. The improvement in scale is due to the ability to select better actions during the iteration process, thereby speeding up iterations and reducing the number of iterations; the Dueling DQN algorithm is introduced, and each learning process does not necessarily depend on other learning scenarios; the GCN model is introduced to learn the node characteristics of the operating status of the power monitoring system, so as to achieve better training effects and obtain better information-physical attack vectors.

[0111] The method of this embodiment has the following advantages:

[0112] (1) Customized generation of cyber-physical attack vectors based on the GCN-Dueling DQN algorithm can not only improve the efficiency and scale of cyber-physical attack vector generation, but also dynamically generate cyber-physical attack vectors in real time by setting the experience replay pool, thereby improving the generalization ability.

[0113] (2) By introducing the GCN-Dueling DQN algorithm, a variety of action types can be selected according to different system states and attack targets, making the attack strategy more flexible and changeable, thereby quickly generating more covert attack strategies and increasing the difficulty of defense.

[0114] (3) After generating the cyber-physical attack vector of the power monitoring system, the attack and defense of the entire cyber-physical attack vector can be simulated through the GCN-Dueling DQN algorithm, and the cyber-physical attack vector can be constructed in the simulation.

[0115] The embodiment of the present application also provides an application scenario, which applies the above-mentioned method for generating information-physical attack vectors for the power monitoring system. Specifically, the method for generating information-physical attack vectors for the power monitoring system provided in this embodiment can be applied in the power monitoring system defense scenario. The power monitoring system defense scenario includes a processing link and a defense link. The processing link is used to generate information-physical attack vectors, and the defense link is used to study corresponding defense measures based on the information-physical attack vectors to defend the power monitoring system. The method for generating information-physical attack vectors for the power monitoring system provided in this embodiment belongs to the processing link.

[0116] Example 2

[0117] In an exemplary embodiment, a computer device is provided. The computer device may be a server or a terminal. The internal structure diagram thereof may be as follows: Figure 5 As shown. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for generating an information physical attack vector for a power monitoring system is implemented.

[0118] Those skilled in the art will understand that Figure 5 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0119] In an exemplary embodiment, a computer device is also provided, including: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for generating an information-physical attack vector for the power monitoring system described in Example 1.

[0120] Example 3

[0121] An embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the method for generating an information-physical attack vector for the power monitoring system described in Embodiment 1 is implemented.

[0122] Example 4

[0123] An embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the method for generating an information-physical attack vector for the power monitoring system described in Embodiment 1.

[0124] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0125] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for generating a cyber-physical attack vector for a power monitoring system, characterized in that: The method for generating a cyber-physical attack vector of the power monitoring system includes: Establishing a simulation model of the power monitoring system, controlling the operation of the simulation model according to the actual operation of the power monitoring system, and performing power flow calculation on the simulation model to obtain initial measurement values; the circuit topology of the simulation model and the power monitoring system are completely the same; the measurement values ​​include the active power of each node in the power monitoring system and the active power at both ends of each transmission line, and the nodes include load nodes, generator nodes and busbar nodes; Perform state estimation based on the initial measurement value to obtain an initial state; the initial state includes the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line, and the state includes normal and abnormal; Taking the initial state as input, the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state; the action includes a load redistribution attack action and a physical manipulation attack action; the load redistribution attack action includes a number of selected load nodes to be attacked and a tampered injection power corresponding to each load node to be attacked; the physical manipulation attack action includes a number of selected overload lines to be attacked and a tampered reactance parameter corresponding to each overload line to be attacked; the overload line is a transmission line that is overloaded due to the load redistribution attack action; Applying the action to the simulation model to obtain a next state and a reward corresponding to the initial state; Determine whether the Q value converges and obtain the judgment result; If the judgment result is yes, the iteration ends, and the action with the maximum reward is selected as the cyber-physical attack vector; If the judgment result is no, then determine whether the current number of iterations reaches the preset number of iterations; if so, update the GCN-Dueling DQN algorithm to obtain an updated GCN-Dueling DQN algorithm, set the current number of iterations to 0, and use the updated GCN-Dueling DQN algorithm as the GCN-Dueling DQN algorithm for the next iteration, use the next state as the initial state of the next iteration, and return to the step of "taking the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state". If not, add 1 to the current number of iterations, and use the next state as the initial state of the next iteration, and return to the step of "taking the initial state as input, and using the GCN-Dueling DQN algorithm to determine the action and Q value corresponding to the initial state".

2. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 1, characterized in that: Based on the initial measurement value, the state is estimated to obtain the initial state, which includes: Controlling the operation of the simulation model according to a preset task, and performing power flow calculation on the simulation model to obtain a measurement value corresponding to the task; the task includes covering up the occurrence of line overload; Taking the measurement value corresponding to the task as input, obtaining a first feature by using a first GCN model; Using the measurement value corresponding to the task as input, obtaining a second feature using a second GCN model; Based on the measured value corresponding to the task and the initial measured value, a system state vector is determined; the system state vector includes a code value of each node in the power monitoring system and a code value of each transmission line, and the code value takes 1 when the measured value changes, and takes 0 when the measured value does not change; Taking the system state vector as input, obtaining a task representation using a task encoder; Using a Softmax function to process the first feature and the task representation to obtain a processed feature; Pooling the second feature and the processed feature to determine an attention weight of each node and an attention weight of each transmission line in the power monitoring system; The state of each node and the state of each transmission line in the power monitoring system are set to normal, and the state and attention weight of each node in the power monitoring system and the state and attention weight of each transmission line form the initial state.

3. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 1, characterized in that: The return is calculated as: Among them, R is the return; R ed is the dispatching cost; a, b, and c are all conditions; a represents that both the load redistribution attack action and the physical manipulation attack action are verified, and after the load redistribution attack action successfully causes the line overload, the line overload is successfully covered up by the physical manipulation attack action; b represents that the load redistribution attack action is verified, and the load redistribution attack action successfully causes the line overload; c represents that the load redistribution attack action is not verified or the load redistribution attack action is verified, but it does not successfully cause the line overload; Among them, N G is the total number of generator nodes in the power monitoring system; α i is the first power generation cost coefficient of the i-th generator node; is the active power of the i-th generator node; β i is the second power generation cost coefficient of the i-th generator node; i is the third power generation cost coefficient of the i-th generator node.

4. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 3, characterized in that: The specific methods for determining conditions a, b, and c in the return calculation formula include: Applying the load redistribution attack action to the simulation model to obtain a first post-attack model, and performing power flow calculation on the first post-attack model to obtain a first post-attack measurement value; Verifying the load redistribution attack action based on the measurement value after the first attack to obtain a first verification result; If the first verification result is verification failure, determining that the action belongs to condition c; If the first verification result is that the verification is passed, the power flow calculation is performed on the first post-attack model to obtain the actual current value of each transmission line in the power monitoring system, and the transmission line whose actual current value is greater than the maximum rated current is recorded as an overloaded line; Determine whether the number of overloaded lines is 0; if so, determine that the action belongs to condition c; if not, determine that the action belongs to condition b; Applying the physical manipulation attack action to the first post-attack model to obtain a second post-attack model, and performing power flow calculation on the second post-attack model to obtain a second post-attack measurement value; Verifying the physical manipulation attack action based on the measurement value after the second attack to obtain a second verification result; If the second verification result is that the verification fails, it is determined that the action belongs to condition b; if the second verification result is that the verification passes, it is determined that the action belongs to condition a.

5. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 4, characterized in that: Based on the initial measurement value, the state is estimated to obtain the initial state, which includes: Taking the initial measured value as input, the initial system state quantity is determined by using the system state estimation algorithm; the system state quantity includes the voltage and phase angle of each node in the power monitoring system; Taking the initial system state quantity as input, the bad data detection algorithm is used to determine the initial bad data; If the difference between the initial system state quantity and the normal system state quantity is less than the preset difference, and the number of initial bad data is 0, the state is estimated based on the initial measurement value to obtain the initial state; The load redistribution attack action is verified based on the measured value after the first attack to obtain a first verification result, which specifically includes: Taking the measured value after the first attack as input, using the system state estimation algorithm to determine the system state quantity after the first attack; Taking the system state quantity after the first attack as input, using the bad data detection algorithm to determine the bad data after the first attack; If the difference between the system state quantity after the first attack and the normal system state quantity is less than the preset difference, and the amount of bad data after the first attack is 0, the first verification result is verification passed; otherwise, the first verification result is verification failed; The physical manipulation attack action is verified based on the measured value after the second attack to obtain a second verification result, which specifically includes: Taking the measured value after the second attack as input, using the system state estimation algorithm to determine the system state quantity after the second attack; Taking the system state quantity after the second attack as input, using the bad data detection algorithm to determine the bad data after the second attack; If the difference between the system state quantity after the second attack and the normal system state quantity is less than the preset difference, and the amount of bad data after the second attack is 0, the second verification result is verification passed; otherwise, the second verification result is verification failed.

6. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 1, characterized in that: Taking the initial state as input, the GCN-Dueling DQN algorithm is used to determine the action and Q value corresponding to the initial state, specifically including: Taking the initial state as input, determining a first node feature corresponding to the initial state using a third GCN model; The first node feature corresponding to the initial state is used as input, and the action and Q value corresponding to the initial state are determined using the Dueling DQN algorithm.

7. The method for generating a cyber-physical attack vector for a power monitoring system according to claim 1, characterized in that: After obtaining the next state and reward corresponding to the initial state, the information-physical attack vector generation method of the power monitoring system also includes: combining the initial state and the action, next state and reward corresponding to the initial state into an experience, and storing the experience in an experience replay pool; the experience replay pool pre-stores the experience generated by simulating information-physical attacks on different power monitoring systems; at this time, the GCN-Dueling DQN algorithm is updated to obtain an updated GCN-Dueling DQN algorithm, specifically including: selecting part of the experience from the experience replay pool according to the first-in-first-out principle, and using part of the experience to update the GCN-Dueling DQN algorithm to obtain an updated GCN-DuelingDQN algorithm.

8. A computer device comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method for generating an information-physical attack vector for an electric power monitoring system according to any one of claims 1 to 7.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method for generating an information-physical attack vector for an electric power monitoring system according to any one of claims 1 to 7 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the method for generating an information-physical attack vector for an electric power monitoring system according to any one of claims 1 to 7 is implemented.

Images