Latent attack identification method, system and device for active power distribution network and storage medium

Abstract

The invention belongs to the field of electric power information physical systems, and relates to a latent attack identification method, system and device for an active power distribution network and a storage medium, and the method comprises the steps: collecting the real-time output active power of each distributed power supply in a distributed power supply cluster of a distributed cluster control power distribution network information physical system in real time; calculating the output power ratio of each distributed power supply; generating a synchronous detection signal of each slave control type distributed power supply in the distributed cluster and a time sequence of the synchronous detection signal; calculating a false information injection latent attack dynamic identification index; using the false information injection latent attack dynamic identification index to locate the slave control type distributed power supply suffered from the false information injection latent attack; and calculating the size of a latent attack signal according to the synchronous detection signal time sequence. According to the method, the distributed power supply cluster subjected to false information injection latent attack and the specific attack signal in the active power distribution network cyber-physical system can be accurately identified, and a cluster manager can conveniently eliminate potential security vulnerabilities in the cluster.

Description

Technical Field

[0001] The present invention belongs to the technical field of electric power information-physical systems, and specifically relates to a method, system, device and storage medium for identifying latent attacks in an active distribution network. Background Art

[0002] The proportion of distributed power sources represented by wind power and photovoltaic power continues to rise, and active distribution networks are developing rapidly. At the same time, the information-physical system in the power field is constantly being built. The information-physical system of the active distribution network is based on the data transmission requirements and collaborative functional goals of the control center-communication network-control terminal-physical network. It realizes data protocol conversion through interactive devices such as gateways and switches and meets the security requirements of data transmission through communication carriers such as optical fiber and Ethernet. The information-physical system enables the control center to observe the state of the power grid in real time and effectively issue control instructions. However, the information-physical deep coupling characteristics of the information-physical system provide attackers with a channel to interfere with the normal operation of the distribution network through information attacks. Information attacks on active distribution networks may cause the control of distributed power sources to fail, thereby affecting the security of active distribution networks.

[0003] According to the different communication network architectures of cyber-physical systems, the control modes of distributed power sources in active distribution networks include centralized control and decentralized control. The centralized control mode has the characteristics of one-to-many, and is susceptible to interference and has low reliability. Decentralized control adopts a one-to-one mode, which can be individually regulated by a dedicated controller, but it is difficult to achieve coordinated optimization of multiple controlled objects. Therefore, distributed cluster control is applied. Distributed cluster control realizes regional management of adjacent active distribution networks through collaborative control of active distribution network clusters, and reduces the deployment of communication links. However, although the communication channel of the existing distribution network terminal access control center has been configured with a firewall and a visitor identity authentication mechanism, and the transmission interaction procedures of business messages have also been encrypted, the wireless private network architecture between the access layer and the terminal layer of the cyber-physical system of the distribution network still provides an entry point for attackers to attack the network. Attackers can implement false information injection attacks on distributed cluster control by tampering with the electrical quantity data of the monitoring system, thereby disturbing the normal operation of the active distribution network.

[0004] False information injection attacks can immediately invade the information system to paralyze the physical system, or secretly invade the information system to seize control of the physical system. According to different intentions, false information injection attacks can be divided into latent attack stage and destructive attack stage. Latent attack can inject attack signals into the information-physical system without affecting the normal operation of the information-physical system. After the latent attack is successful, the destructive attack modifies the attack signal lurking in the information-physical system to disrupt the realization of the control target. In the active distribution network controlled by distributed clusters, attackers often first use latent attacks to invade the information-physical system, and then use destructive attacks to make the control ineffective. Therefore, identifying false information injection latent attacks is the key to preventing the active distribution network from being further damaged.

[0005] At present, the research on false information injection attacks on active distribution networks mainly focuses on the pre-attack and defense and post-isolation of sabotage attacks, and there are few studies on latent attacks. Some experts analyzed the characteristics of false information injection attacks against different attack targets from the perspective of the attacker, but did not distinguish the difference between latent attacks and sabotage attacks. Some experts proposed an attack and defense game strategy for power information-physical systems under false information injection attacks, but did not analyze the cross-domain propagation process of false information injection attacks. Other experts summarized the detection and defense methods of false information injection attacks from the information side and physical side of the power information-physical system, but all of them are highly dependent on communication.

[0006] In summary, the current research on latent attacks of false information injection into active distribution networks is still in its infancy. The information-physical interaction characteristics of the information-physical system of the active distribution network under latent attacks are still unclear. There is currently no feasible technical solution for effectively identifying latent attacks of false information injection into distributed cluster-controlled active distribution networks. Summary of the invention

[0007] In view of the deficiencies of the above-mentioned prior art, the present invention provides a method, device and equipment for identifying latent attacks of false information injection in active distribution networks, which can solve the problem in the prior art that latent attacks of false information injection in distributed cluster-controlled active distribution networks cannot be effectively identified. By constructing a synchronous detection signal and its time series, a dynamic identification index of latent attacks is generated, which can effectively locate latent attacks of false information injection and reliably identify attack signals.

[0008] To achieve the above object, the present invention provides a method for identifying latent attacks in an active power distribution network, the method comprising:

[0009] S101, collecting the real-time output active power of each distributed power source in the distributed power source cluster, and calculating the output power ratio of each distributed power source; the distributed power sources in the distributed power source cluster include master-controlled distributed power sources and slave-controlled distributed power sources;

[0010] S102, calculating the synchronous detection signal of the slave-controlled distributed power source in the distributed power source cluster according to the output power ratio, and constructing a discrete sequence of the synchronous detection signal at time l;

[0011] S103, calculating a dynamic identification index of a latent attack of false information injection according to a discrete sequence of synchronous detection signals;

[0012] S104, setting a positioning criterion. If the dynamic identification index of the false information injection latent attack meets the positioning criterion, executing step S105, otherwise setting l=l+1 and returning to step S103;

[0013] S105, locate the slave-controlled distributed power source that is under potential attack;

[0014] S106, calculating the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source that is under latent attack;

[0015] S107. Set a threshold. If the correlation coefficient of the discrete sequence of the synchronous detection signal is greater than the threshold, identify the false information injection latent attack signal and complete the false information injection latent attack identification; otherwise, set l=l+1, regenerate the discrete time sequence of the synchronous detection signal of the slave-controlled distributed power source that is subject to the latent attack, and return to step S106.

[0016] A latent attack identification system for an active power distribution network, the system comprising: a data acquisition module, a first calculation module, a second calculation module, a third calculation module, a fourth calculation module, a fifth calculation module, a first comparison module and a second comparison module;

[0017] The data acquisition module is used to collect the real-time output active power of each distributed power source in the distributed power source cluster of the distributed cluster control distribution network;

[0018] The first calculation module calculates the output power ratio of each distributed power source according to the active power collected by the data collection module;

[0019] The second calculation module is used to calculate the synchronous detection signal of the slave-controlled distributed power source and the discrete time series at time l;

[0020] The third calculation module calculates the dynamic identification index of false information injection latent attack according to the discrete time series;

[0021] The first comparison module is used to compare the latent attack dynamic identification index with the threshold value, and if the latent attack dynamic identification index is reliably greater than the threshold value, the fourth calculation module is called, otherwise the third calculation module is called;

[0022] The fourth calculation module is used to calculate the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source subjected to the latent attack;

[0023] The second comparison module is used to compare the correlation coefficient of the discrete sequence of synchronous detection signals with the threshold value, and if the correlation coefficient of the discrete sequence of synchronous detection signals is greater than the threshold value, the fifth calculation module is called, otherwise the fourth calculation module is called;

[0024] The fifth computing module is used to identify false information injection latent attack signals.

[0025] To achieve the above objectives, the present invention also provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, any of the above-mentioned latent attack identification methods for an active power distribution network is implemented.

[0026] To achieve the above-mentioned purpose, the present invention also provides a latent attack identification device for an active distribution network, comprising a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory, and is used to execute the computer program stored in the memory, so that the latent attack identification device for an active distribution network executes any of the above-mentioned latent attack identification methods for an active distribution network.

[0027] Beneficial effects of the present invention:

[0028] The present invention establishes a synchronous detection signal model and a latent attack dynamic identification model, proposes a false information injection latent attack positioning and attack signal identification method based on the synchronous detection signal dynamic identification, realizes the distributed dynamic identification of false information injection latent attacks, and facilitates cluster managers to carry out subsequent defense measures to eliminate potential security vulnerabilities in the cluster, and prevents attackers from taking further measures to destroy the safe and stable operation of the active distribution network information-physical system by relying on latent attack signals. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0030] Figure 1 A flowchart of the method for identifying latent attacks of false information injection into active power distribution networks of the present application;

[0031] Figure 2 This is a schematic diagram of the structure of a 10kV distributed cluster control distribution network in an embodiment of the present application;

[0032] Figure 3A waveform diagram of the output characteristics of a distributed power supply cluster under normal operation in an embodiment of the present application;

[0033] Figure 4 This is a waveform diagram of the output characteristics of a distributed power cluster under a latent attack of false information injection in an embodiment of the present application;

[0034] Figure 5 This is a schematic diagram of the calculation results of the latent attack dynamic identification index in the embodiment of the present application;

[0035] Figure 6 This is a block diagram of a system for identifying latent attacks of false information injection into active distribution networks in an embodiment of the present application. DETAILED DESCRIPTION

[0036] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0037] The present invention discloses a method for identifying a latent attack of false information injection in an active distribution network, which is applied to computer devices and equipment, such as terminals or servers. The method collects the real-time output active power of each distributed power source in a distributed power source cluster of a distributed cluster control distribution network information physical system; calculates the output power ratio of each distributed power source; generates a synchronous detection signal and its time series of each slave-controlled distributed power source in the distributed cluster; calculates a dynamic identification index of a latent attack of false information injection; uses the dynamic identification index of a latent attack of false information injection to locate the slave-controlled distributed power source that suffers from a latent attack of false information injection; and calculates the size of the latent attack signal according to the time series of the synchronous detection signal.

[0038] A latent attack identification method for active distribution networks, such as Figure 1 As shown, the method includes:

[0039] S101, collecting the real-time output active power of each distributed power source in the distributed power source cluster, and calculating the output power ratio of each distributed power source; the distributed power sources in the distributed power source cluster include master-controlled distributed power sources and slave-controlled distributed power sources;

[0040] S102, calculating the synchronous detection signal of the slave-controlled distributed power source in the distributed power source cluster according to the output power ratio, and constructing a discrete sequence of the synchronous detection signal at time l;

[0041] S103, calculating a dynamic identification index of a latent attack of false information injection according to a discrete sequence of synchronous detection signals;

[0042] S104, setting a positioning criterion. If the dynamic identification index of the false information injection latent attack meets the positioning criterion, executing step S105, otherwise setting l=l+1 and returning to step S103;

[0043] S105, locate the slave-controlled distributed power source that is under potential attack;

[0044] S106, calculating the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source that is under latent attack;

[0045] S107. Set a threshold. If the correlation coefficient of the discrete sequence of the synchronous detection signal is greater than the threshold, identify the false information injection latent attack signal and complete the false information injection latent attack identification; otherwise, set l=l+1, regenerate the discrete time sequence of the synchronous detection signal of the slave-controlled distributed power source that is subject to the latent attack, and return to step S106.

[0046] In this embodiment, the output power ratio of the distributed power source is the ratio of the active power output by the distributed power source to the maximum allowable output power of the distributed power source. Its expression is:

[0047]

[0048] Where i = 1, 2, ..., n, n is the number of distributed generation in the cluster; is the active power output by the i-th distributed power source; is the maximum allowable output power of the i-th distributed generation.

[0049] In this specific implementation, the distributed cluster control distribution network is divided into master-controlled distributed power sources and slave-controlled distributed power sources. The master-controlled distributed power source is the only one in the cluster and directly receives the control instructions issued by the distribution network control center; that is, the information node corresponding to the master-controlled distributed power source is the central information node of the information-physical system, and has more defense resources deployed. Therefore, false information injection attacks often select slave-controlled distributed power sources with weaker defense deployment as attack targets. The slave-controlled distributed power source directly or indirectly interacts with the master-controlled distributed power source. The synchronous detection signal x of the jth slave-controlled distributed power source at time l j (l) is generated as follows:

[0050]

[0051] Among them, x j (l) represents the synchronous detection signal generated by the jth slave-controlled distributed power source at time l; j - is the parent distributed power source number of the jth slave-controlled distributed power source; represents the communication coupling gain parameter between the jth slave-controlled distributed power source and its upper-level distributed power source; is the output power ratio of the jth slave-controlled distributed generation at time l; is the output power ratio of the jth slave-controlled distributed power source at time l-1; is the output power ratio of the jth slave-controlled upper distributed power source at time l-1.

[0052] In this specific implementation, the discrete time sequence X of the synchronous detection signal of the jth slave-controlled distributed power source at time l j (l) is constructed as follows:

[0053] X j (l) = {x j (l-m+1),x j (l-m+2),…,x j (l-m+p),…,x j (l)}

[0054] Among them, x j (l-m+p) is the pth element in the time series, 1≤p≤m; m is the number of elements in the time series. In order to ensure that the calculation period of the discrete sequence of synchronous detection signals is greater than the duration period of the information disturbance, m is set to 10 to 12.

[0055] In this specific implementation, the jth slave-controlled distributed power source at time l injects false information into the latent attack dynamic identification index FQ j (l) Calculate as follows:

[0056] FQ j (l) = β j d(X j (l), 0)

[0057] Among them, β j is the adjustment coefficient, β j >0;d(X j (l), 0) is the discrete sequence of synchronous detection signal X j (l) and the minimum difference cumulative distance between the zero sequence and is calculated as follows:

[0058]

[0059] Among them, min{x j (l-m+p),x j (l-m+p+1)} is X j The minimum value between the p-th element and the p+1-th element in (l).

[0060] In this specific implementation, a positioning criterion for the latent attack of false information injection is set, and the positioning criterion includes a reliability coefficient, and the reliability coefficient is set in such a way as to ensure that the dynamic identification index of the latent attack of false information injection is reliably greater than the threshold value; wherein the value of the reliability coefficient is 1.2 to 1.3. The positioning criterion is:

[0061] FQ j (l)>K rel FQ th

[0062] Among them, K rel is the reliability coefficient; FQ th is the threshold value, and is set according to the dynamic identification index of the maximum potential attack that may be generated by other slave-controlled distributed power sources under information disturbance:

[0063]

[0064] Among them, Ω j It is a collection of slave-controlled distributed power sources; FQ j,max It represents the maximum potential attack dynamic identification index that may be generated by the j-th slave-controlled distributed power source under information disturbance, and is calculated according to the maximum output power ratio deviation under 5 consecutive cycles.

[0065] In this specific implementation, the discrete sequence correlation coefficient r of the synchronous detection signal of the slave-controlled distributed power supply subjected to the latent attack j (l) Calculate as follows:

[0066]

[0067] Among them, r j (l) represents the time series correlation coefficient of the synchronous detection signal at time l and the previous time, r j (l) between 0 and 1; x l-1,j (p), x l,j (p) is the discrete sequence X of synchronous detection signals of the jth slave-controlled distributed power source at time l-1 and l that is attacked by false information injection. j (l-1), X j (l) in the element.

[0068] In this specific implementation, the threshold value r th,j For X j (l-1) contains m-1 non-zero elements, X j (l) The correlation coefficient of the discrete sequence of synchronous detection signals calculated when all elements are non-zero is calculated as follows:

[0069]

[0070] In this specific implementation manner, the false information injection latent attack signal on the jth slave-controlled distributed power source is calculated as follows:

[0071]

[0072] To verify the effectiveness of the method of the present invention, the schematic diagram of the 10kV distributed cluster control distribution network is shown in Figure 2 shown. Figure 2 In the example, distributed power sources are connected at nodes 822, 828, 832, 838, and 848 respectively. Distributed power sources 1 to 5 adopt a distributed cluster control strategy and output power to the distribution network as a controllable whole. Among them, distributed power source 1 is a master-controlled distributed power source with a maximum allowable output power of 6MW; distributed power sources 2 and 3 are first-level slave-controlled distributed power sources with a maximum allowable output power of 4MW; DG4 and DG5 are second-level slave-controlled distributed power sources with a maximum allowable output power of 3MW. The loads all adopt a constant power model, and the active power is 0.6MW. The threshold value of the correlation coefficient of the synchronous detection signal time series is 0.99.

[0073] In this specific implementation, the power command value of the distributed power cluster is set to 3.5MW, and is modified to 6.5MW at t=1.5s. The attack target is set to the output power ratio of distributed power 3, and an attack signal of 0.2 is injected at t=0.8s, and the attack signal persists. The output power of the distributed power in the cluster and its power under normal operation and false information injection latent attack are shown in Figure 2. Figure 3 and Figure 4 shown.

[0074] In this specific implementation mode, Figure 3 As shown in (a) and (b), at t = 0.51s, the output power of the distributed power cluster tracks the power command value of 3.5MW, and the output power ratio of each distributed power source converges to 0.325. When the power command value switches from 3.5MW to 6.5MW, the output power of the distributed power cluster quickly tracks the command value, and the output power ratio of each distributed power source converges to 0.475 again. The active distribution network under the control of the distributed cluster can deliver a certain amount of power according to the control command.

[0075] In this specific implementation mode, Figure 4 As shown in (a), at t = 0.8s, the output power of the distributed power cluster fluctuates. Under different power command values, the output power of the distributed power cluster achieves tracking command values ​​at t = 1.15s and 2.04s respectively. Figure 4In (b), the output power ratio of distributed power source 3 fluctuates with an amplitude of 0.2 at t = 0.8s, and the output power ratios of the other distributed power sources also fluctuate accordingly. However, the output power ratios of each distributed power source still converge at t = 1.15s and 2.04s.

[0076] In this specific implementation, a synchronous detection signal of each slave-controlled distributed power source is constructed at each sampling moment, and a discrete sequence of synchronous detection signals at time 1 is constructed and substituted into step S103 to calculate a latent attack dynamic identification index. Among them, the number of elements in the synchronous detection signal time series is 12; the adjustment coefficient is 0.3; the threshold value is adjusted according to the maximum identification index that may be generated by the slave-controlled DG output power ratio under the longest information disturbance period, that is, the latent attack dynamic identification index calculated by the output power ratio disturbance of 5 consecutive periods and the value of 1, and the threshold value is adjusted to 1.5. The latent attack dynamic identification index is as follows Figure 5 shown.

[0077] In this specific implementation, before t=0.8s, the distributed power supply cluster has not been subjected to a latent attack of false information injection, and the dynamic identification indexes of the slave-controlled distributed power supplies are all 0, which is reliably less than the threshold value. After t=0.8s, the attack signal is continuously injected into distributed power supply 3, and the dynamic identification index of the latent attack of distributed power supply 3 is greater than the threshold value. The dynamic identification indexes of the latent attack of the remaining slave-controlled distributed power supplies increased slightly but are still within the normal range. At t=1.5s, the power command value controlled by the distributed cluster is switched, and the output power of the distributed power supply cluster fluctuates, causing the dynamic identification index of the latent attack of the slave-controlled distributed power supply to fluctuate, but the dynamic identification index result of the distributed power supply 3 still meets the positioning criterion, which can prove that the switching of the power command value does not affect the effectiveness of the positioning method of the latent attack of false information injection.

[0078] In this specific implementation, after t=0.8s, the correlation coefficient of the discrete sequence of the synchronous detection signal of the distributed power source 3 is calculated according to step S106 as shown in Table 1 below. From Table 1, the correlation coefficient calculated from the time series of the synchronous detection signal of the distributed power source 3 at the 11th sampling moment and the previous adjacent moment after t=0.8s is 0.9901, which is greater than the threshold value. The time series of the synchronous detection signal of the distributed power source 3 at the 10th and 11th sampling moments after t=0.8s is taken to identify the latent attack signal injected with false information, and the constant attack signal value for the distributed power source 3 is equal to 0.1977. The error between this result and the actual attack signal is 0.0023, indicating that the proposed method has high reliability.

[0079] Table 1 Correlation coefficients of synchronous detection signal time series

[0080]

[0081] A latent attack identification system for active distribution networks, such as Figure 6 As shown, it includes: a data acquisition module, a first calculation module, a second calculation module, a third calculation module, a fourth calculation module, a fifth calculation module, a first comparison module and a second comparison module;

[0082] The data acquisition module is used to collect the real-time output active power of each distributed power source in the distributed power source cluster of the distributed cluster control distribution network;

[0083] The first calculation module calculates the output power ratio of each distributed power source according to the active power collected by the data collection module;

[0084] The second calculation module is used to calculate the synchronous detection signal of the slave-controlled distributed power source and the discrete time series at time l;

[0085] The third calculation module calculates the dynamic identification index of false information injection latent attack according to the discrete time series;

[0086] The first comparison module is used to compare the latent attack dynamic identification index with the threshold value, and if the latent attack dynamic identification index is reliably greater than the threshold value, the fourth calculation module is called, otherwise the third calculation module is called;

[0087] The fourth calculation module is used to calculate the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source subjected to the latent attack;

[0088] The second comparison module is used to compare the correlation coefficient of the discrete sequence of synchronous detection signals with the threshold value, and if the correlation coefficient of the discrete sequence of synchronous detection signals is greater than the threshold value, the fifth calculation module is called, otherwise the fourth calculation module is called;

[0089] The fifth computing module is used to identify false information injection latent attack signals.

[0090] In this embodiment, the specific implementation of the system is the same as the specific implementation of the method.

[0091] In one embodiment of the present invention, the present invention further includes a computer-readable storage medium having a computer program stored thereon, and when the program is executed by a processor, the program implements any of the above-mentioned latent attack identification methods for an active power distribution network.

[0092] Those skilled in the art can understand that all or part of the steps of implementing the above-mentioned method embodiments can be completed by hardware related to the computer program. The aforementioned computer program can be stored in a computer-readable storage medium. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes.

[0093] A latent attack identification device for an active distribution network comprises a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the latent attack identification device for an active distribution network executes any of the above-mentioned latent attack identification methods for an active distribution network.

[0094] Specifically, the memory includes: ROM, RAM, magnetic disk, USB flash drive, memory card or optical disk, etc., which can store program codes.

[0095] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components.

[0096] The above embodiments further illustrate the purpose, technical solutions and advantages of the present invention in detail. It should be understood that the above embodiments are only preferred implementation modes of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made to the present invention within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A latent attack identification method for an active distribution network, characterized in that: include: S101, collecting the real-time output active power of each distributed power source in the distributed power source cluster, and calculating the output power ratio of each distributed power source; The distributed power sources in the distributed power source cluster include master-controlled distributed power sources and slave-controlled distributed power sources; S102, calculating the synchronous detection signal of the slave-controlled distributed power source in the distributed power source cluster according to the output power ratio, and constructing a discrete sequence of the synchronous detection signal at time l; S103, calculating a dynamic identification index of a latent attack of false information injection according to a discrete sequence of synchronous detection signals; S104, setting a positioning criterion. If the dynamic identification index of the false information injection latent attack meets the positioning criterion, executing step S105, otherwise setting l=l+1 and returning to step S103; S105, locate the slave-controlled distributed power source that is under potential attack; S106, calculating the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source that is under latent attack; S107. Set a threshold. If the correlation coefficient of the discrete sequence of the synchronous detection signal is greater than the threshold, identify the false information injection latent attack signal and complete the false information injection latent attack identification; otherwise, set l=l+1, regenerate the discrete time sequence of the synchronous detection signal of the slave-controlled distributed power source that is subject to the latent attack, and return to step S106.

2. A latent attack identification method for active distribution network according to claim 1, characterized in that: The output power ratio of the distributed power source is the ratio of the active power output by the distributed power source to the maximum allowable output power of the distributed power source.

3. A latent attack identification method for active distribution network according to claim 1, characterized in that: There is only one master-controlled distributed power source in the distributed power source cluster, which is used to directly receive control instructions issued by the distribution network control center; the slave-controlled distributed power sources directly or indirectly exchange information with the master-controlled distributed power source.

4. A latent attack identification method for active distribution network according to claim 1, characterized in that: Calculating the dynamic identification index of the latent attack by injecting false information includes: calculating the minimum difference cumulative distance between the discrete sequence of the synchronous detection signal and the zero sequence; setting the adjustment coefficient; and taking the product of the minimum difference cumulative distance and the adjustment coefficient as the dynamic identification index of the latent attack by injecting false information.

5. A latent attack identification method for active distribution network according to claim 1, characterized in that: Setting the positioning criterion includes: setting the reliability coefficient, calculating the maximum latent attack dynamic identification index generated by the slave-controlled distributed power source under information disturbance; if the latent attack dynamic identification index injected by false information at the lth moment is greater than the product of the maximum latent attack dynamic identification index and the reliability coefficient, the positioning criterion is met, otherwise the positioning criterion is not met.

6. A latent attack identification method for active distribution network according to claim 1, characterized in that: Calculating the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power supply under latent attack includes: Among them, r j (l) represents the time series correlation coefficient of the synchronous detection signal at time l and the previous time, x l-1,j (p) is the discrete sequence X of synchronous detection signals of the jth slave-controlled distributed power source at time l-1 that is attacked by false information injection. j The elements in (l-1), x l,j (p) is the discrete sequence X of synchronous detection signals of the jth slave-controlled distributed power source at time l that is attacked by false information injection. j (l) in the element.

7. A latent attack identification method for active distribution network according to claim 1, characterized in that: The potential attack signals for identifying false information injection are: Among them, m is the number of elements in the time series, x l-1,j (p) is the discrete sequence X of synchronous detection signals of the jth slave-controlled distributed power source at time l-1 that is attacked by false information injection. j The elements in (l-1), x l,j (p) is the discrete sequence X of synchronous detection signals of the jth slave-controlled distributed power source at time l that is attacked by false information injection. j (l) in the element.

8. A latent attack identification system for an active distribution network, the system being used to execute a latent attack identification method for an active distribution network as claimed in any one of claims 1 to 7, characterized in that: include: A data acquisition module, a first calculation module, a second calculation module, a third calculation module, a fourth calculation module, a fifth calculation module, a first comparison module and a second comparison module; The data acquisition module is used to collect the real-time output active power of each distributed power source in the distributed power source cluster of the distributed cluster control distribution network; The first calculation module calculates the output power ratio of each distributed power source according to the active power collected by the data collection module; The second calculation module is used to calculate the synchronous detection signal of the slave-controlled distributed power source and the discrete time series at time l; The third calculation module calculates the dynamic identification index of false information injection latent attack according to the discrete time series; The first comparison module is used to compare the latent attack dynamic identification index with the threshold value, and if the latent attack dynamic identification index is reliably greater than the threshold value, the fourth calculation module is called, otherwise the third calculation module is called; The fourth calculation module is used to calculate the discrete sequence correlation coefficient of the synchronous detection signal of the slave-controlled distributed power source subjected to the latent attack; The second comparison module is used to compare the correlation coefficient of the discrete sequence of synchronous detection signals with the threshold value, and if the correlation coefficient of the discrete sequence of synchronous detection signals is greater than the threshold value, the fifth calculation module is called, otherwise the fourth calculation module is called; The fifth computing module is used to identify false information injection latent attack signals.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the latent attack identification method for an active power distribution network according to any one of claims 1 to 7.

10. A latent attack identification device for an active distribution network, characterized in that: It comprises a processor and a memory; the memory is used to store a computer program; the processor is connected to the memory and is used to execute the computer program stored in the memory, so that the latent attack identification device for an active distribution network executes any one of claims 1 to 7 of the latent attack identification method for an active distribution network.

Images