New energy fluctuation and data injection attack superposed cyber-physical fusion hazard assessment method and system

Abstract

The invention relates to a new energy fluctuation and data injection attack superposed cyber-physical fusion hazard assessment method and system, and the method comprises the following steps: constructing a new energy fluctuation and data injection attack superposed attack model, the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line power flow; and through calculation of the line load security constraint, determining the information physical fusion hazard under the superposition of the new energy fluctuation and the data injection attack based on an attack model. Compared with the prior art, the method has the advantages that the level of power grid body harm caused by superposition of new energy output uncertainty and malicious data attack under the worst case can be determined, and operation and maintenance personnel can be helped to find key risk nodes in a power system.

Description

Technical Field

[0001] The present invention relates to the field of electric power information security, and in particular to an information-physical fusion hazard assessment method and system for superposition of new energy fluctuation and data injection attack. Background Art

[0004] Considering that the uncertainty of renewable energy will bring certain risks to the power system, the existing literature has conducted extensive research on the uncertainty of wind power. However, the existing research on FDIA and wind power generation has a major drawback: almost all methods for studying FDIA and renewable energy are independent. In other words, the impact of wind power uncertainty on the system is not combined in the study of FDIA, and the impact of FDIA cyber attacks on the system is not considered when studying the uncertainty of renewable energy. This is obviously inconsistent with the actual risks faced by the power grid, because renewable energy is increasingly integrated into the power grid, and the power grid is becoming more and more intelligent, and security protection issues face greater challenges. Summary of the invention

[0005] The purpose of the present invention is to provide a method and system for evaluating the hazard of information-physical fusion of superposition of new energy fluctuation and data injection attack.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack, the method comprising the following steps:

[0008] Constructing an attack model of superposition of new energy fluctuation and data injection attack, wherein the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line power flow;

[0009] By calculating the line load security constraints, the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks are determined based on the attack model.

[0010] In the attack model, the calculation method of the real line flow is:

[0011]

[0012] Where SF represents the shift factor matrix, KP represents the bus-generator correlation matrix, represents the generator output power (MW) under attack conditions, represents the wind power output power (MW) under attack, KD represents the bus load correlation matrix, Indicates the line load data under attack, ΔP wis the change vector caused by the uncertainty of renewable energy output, ΔD is the load data injection attack vector, ΔP w is the change vector caused by the uncertainty of renewable energy output, and ΔD is the load data injection attack vector.

[0013] The cyber-physical fusion hazard under the superposition of the new energy fluctuation and data injection attack is expressed as:

[0014] max:|F| / F r

[0015] Among them, F is the real current considering the superposition of new energy fluctuations and data injection attacks, and F r Represents the line power flow restriction vector.

[0016] The line load safety constraints include power balance constraints, load attack range constraints and new energy output fluctuation range constraints.

[0017] The power balance constraint is expressed as:

[0018] 1 T ΔD=1 T ΔP w

[0019] Among them, ΔP w is the change vector caused by the uncertainty of renewable energy output, and ΔD is the load data injection attack vector.

[0020] The attack range constraint of the payload is expressed as:

[0021]

[0022] in, It represents the line load data under attack, ΔD is the load data injection attack vector, and ε represents the load attack amplitude.

[0023] The fluctuation range constraint of the new energy output is expressed as:

[0024]

[0025] in, Indicates the wind power output power under attack, ΔP w is the change vector caused by the uncertainty of the new energy output, and δ represents the predicted attack amplitude of the new energy.

[0026] The value of the predicted attack amplitude δ of the new energy is determined according to the accuracy of the new energy prediction. The higher the accuracy, the smaller the δ value.

[0027] Generator output power under the described attack scenario Wind power output under attack conditions The value of is calculated using the traditional SCED model.

[0028] An information-physical fusion hazard assessment system for superposition of new energy fluctuation and data injection attack, used to implement the above method, the system comprising:

[0029] Attack model construction module: constructs an attack model of superposition of new energy fluctuation and data injection attack, wherein the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line flow;

[0030] Hazard assessment module: By calculating the line load safety constraints, the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks are determined based on the attack model.

[0031] Compared with the prior art, the present invention has the following beneficial effects:

[0032] (1) The present invention provides a modeling method for the superposition attack of new energy fluctuation uncertainty and malicious data injection attack in the information-physical fusion environment of the power grid, which can accurately model the new energy fluctuation uncertainty and malicious data injection attack.

[0033] (2) The present invention implements cyber-physical fusion hazard assessment to determine the worst-case hazard level of the power grid caused by the superposition of uncertainty in new energy output and malicious data attacks. The assessment results can help operation and maintenance personnel find key risk nodes in the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 A flowchart of the cyber-physical fusion hazard assessment method of the present invention;

[0035] Figure 2 This is a schematic diagram of the power grid dispatching model;

[0036] Figure 3 Schematic diagram of line overload mechanism under the combined effect of FDIA and new energy uncertainty. DETAILED DESCRIPTION

[0037] The present invention is described in detail below in conjunction with the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0038] This embodiment provides a method for assessing the hazards of information-physical fusion when new energy fluctuations and data injection attacks are superimposed. First, the malicious data injection attack methods of the power system in the new energy scenario are modeled. Secondly, from the perspective of information-physical fusion attacks, a method for assessing the hazard of physical overload of power lines caused by malicious data injection attacks is provided. Next, an attack model is given when new energy output fluctuation uncertainty and malicious data injection attacks are superimposed. Finally, by calculating the line load safety constraints, a method for assessing the hazard of line overload caused by the superposition of the two is given, thereby achieving a quantitative assessment of the hazard under information-physical fusion attacks.

[0039] Specifically, Figure 1 As shown, the method comprises the following steps:

[0040] S1, construct an attack model of superposition of new energy fluctuation and data injection attack. The attack model introduces data injection attack vector and change vector caused by uncertainty of new energy output into the line flow.

[0041] In the present invention, under normal circumstances without network attacks, the power dispatch strategy (such as thermal power output Pg and renewable energy output Pw) is usually determined by the security-constrained economic dispatch SCED model. Figure 2 In the example, the thermal power output Pg and the power flow F are predicted based on the renewable energy output Pw and load data D, thus forming a grid dispatching strategy and the power flow F also meets the system security constraints. However, the renewable energy output Pw and load data D are obtained through smart meter measurements and can be maliciously tampered with by network attackers. In this case, the power flow F will be affected by the attack and may violate the security constraints. Figure 2 In , the power flow F represents the erroneous power flow due to the erroneous data of ΔPw and ΔD.

[0042] Based on the above premise, this embodiment first constructs the FDIA attack model.

[0043] Considering the situation where the FDIA malicious data injection attack causes damage alone, the entire FDIA attack process is constructed as follows: Figure 3 As shown in the figure, first, the attacker obtains the smart meter measurement value through illegal means. Second, the attacker carefully designs false data and injects it into the measurement value of the smart meter, and ensures that the false data bypasses the detection of BDD. Then, the dispatch center is induced to formulate an incorrect dispatch strategy. Finally, the incorrect dispatch strategy will cause serious line overload, thus achieving the attacker's purpose.

[0044] In this attack, the attacker usually selects a random attack vector to construct a false injection value. In order to bypass BDD, the payload attack vector is usually limited to a certain range and designed as a vector with a sum of zero. The formula is as follows:

[0045] 1 T ΔD=0 (1)

[0046] -ε·D≤ΔD≤ε·D (2)

[0047] Where D represents the line load data, ΔD is the load data injection attack vector, and ε represents the load attack amplitude.

[0048] When constraint (1) is satisfied, the false measurements constructed by the FDIA attacker can ensure that the system maintains power balance. Constraint (2) limits the level of load data injection on each line. A larger ε value means that the attacker can induce a more severe attack.

[0049] Under the influence of the constructed attack vector ΔD, the line flow will be modified and rewritten as:

[0050] F=SF·(KP·(P g +P w )-KD·(D+ΔD)) (3)

[0051] -F r ≤F≤F r (4)

[0052] Where SF represents the shift factor matrix, KP represents the bus-generator correlation matrix, and P g Indicates the generator output power (MW), P w represents the wind power output power (MW), and KD represents the bus load correlation matrix. Because the line flow in equation (3) is calculated based on the damaged load vector D+ΔD, constraint (4) will impose safety constraints on the wrong power flow vector F. In other words, the safety of the actual line flow cannot be guaranteed.

[0053] Since the real load vector is D, the real line flow F 0 for:

[0054] F 0 =SF·(KP·(p g +p w )-KD·D) (5)

[0055] By introducing equation (5) into equation (3), we get:

[0056] -F r +SF·KD·ΔD≤F 0 ≤F r +SF·KD·ΔD (6)

[0057] In equation (6), it can be seen that due to the influence of the false injection data SF·KD·ΔD, the upper and lower limits of the real power flow may exceed the line power flow limit vector F r , and the degree of hazard can be calculated.

[0058] On the other hand, as the proportion of renewable energy generation connected to the power system increases, the uncertainty of a large amount of renewable energy output may also cause some lines to overload. This is mainly due to the strong randomness and variability of renewable energy output. The range of change in renewable energy generation can reach 20% within 10 minutes, making it difficult to accurately predict renewable energy output data.

[0059] However, existing studies have not considered the cyber-physical fusion hazards brought about by the superposition of FDIA attacks and renewable energy output uncertainty, and network risks may be underestimated. This paper will study the network risks of power systems with high renewable energy penetration by considering FDIA target loads and predicted renewable energy generation data. Figure 3 The principle of line overload caused by FDIA-DW is explained. Based on equation (3), it is assumed that there is another change vector ΔP caused by the uncertainty of renewable energy output. w Added into the system to produce an impact, the actual line flow F 0 It is expressed as:

[0060]

[0061] Among them, ΔP w is the change vector caused by the uncertainty of new energy output.

[0062] Therefore constraint (6) is rewritten as:

[0063]

[0064] Constraint (8) shows that due to the error data SF·KD·ΔD and SF·KP·ΔP w , the real flow vector F 0 The line power flow limit vector F may be exceeded r Given the attacks on renewable energy generation data, FDIA will lead to more severe line overloads in the power grid.

[0065] Based on the above analysis, in order to accurately predict and evaluate the degree of harm caused by injection attack and the superposition of uncertainty in new energy output, the present invention develops a linear programming model to evaluate the line overload hazard caused by FDIA-DW, as described below:

[0066] max:|F| / F r (9)

[0067]

[0068] Among them, F is the real current considering the superposition of new energy fluctuations and data injection attacks, represents the generator output power (MW) under attack conditions, represents the wind power output power (MW) under attack conditions, Represents line load data under attack conditions. and The value of is calculated using the traditional SCED model. Equation (9) represents the maximum overload level of each line in the system caused by FDIA-DW. Equation (10) represents the real power flow on each line.

[0069] S2, through the calculation of line load security constraints, determines the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks based on the attack model.

[0070] Line load safety constraints include power balance constraints, load attack range constraints, and new energy output fluctuation range constraints, which can be expressed as:

[0071] 1 T ΔD=1 T ΔP w (11)

[0072]

[0073] Among them, the parameters ε and δ represent the attack range of the load and the predicted new energy, respectively. Usually, a high-precision new energy prediction corresponds to a smaller δ value, and a low-precision new energy prediction corresponds to a larger δ value. Formula (11) ensures the power balance in the system, and formulas (12) and (13) limit the attack range of the load and the fluctuation range of the new energy output.

[0074] According to this assessment model, the maximum overload level of FDIA-DW in the worst case scenario can be determined. In addition, the deep relationship between network risk and the penetration level of new energy generation can be analyzed.

[0075] The above is an introduction to the method embodiment. The following is a further explanation of the solution of the present invention through a system embodiment.

[0076] This embodiment also provides a cyber-physical fusion hazard assessment system for superposition of new energy fluctuation and data injection attack, which is used to implement the above method, and the system includes:

[0077] Attack model construction module: constructs an attack model of superposition of new energy fluctuation and data injection attack, wherein the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line flow;

[0078] Hazard assessment module: By calculating the line load safety constraints, the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks are determined based on the attack model.

[0079] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working process of the described module can refer to the corresponding process in the aforementioned method embodiment, and will not be repeated here.

[0080] The preferred specific embodiments of the present invention are described in detail above. It should be understood that a person skilled in the art can make many modifications and changes based on the concept of the present invention without creative work. Therefore, any technical solution that can be obtained by a person skilled in the art through logical analysis, reasoning, or limited experiments based on the concept of the present invention on the basis of the prior art should be within the scope of protection determined by the claims.

Claims

1. A cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack, characterized in that: The method comprises the following steps: Constructing an attack model of superposition of new energy fluctuation and data injection attack, wherein the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line power flow; By calculating the line load security constraints, the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks are determined based on the attack model.

2. According to claim 1, the cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack is characterized in that: In the attack model, the calculation method of the real line flow is: Where SF represents the shift factor matrix, KP represents the bus-generator correlation matrix, represents the generator output power under attack conditions, represents the wind power output power under attack, KD represents the bus load correlation matrix, Indicates the line load data under attack, ΔP w is the change vector caused by the uncertainty of renewable energy output, and ΔD is the load data injection attack vector.

3. The cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack according to claim 2 is characterized in that: The cyber-physical fusion hazard under the superposition of the new energy fluctuation and data injection attack is expressed as: max:|F| / F r Among them, F is the real current considering the superposition of new energy fluctuations and data injection attacks, and F r Represents the line power flow restriction vector.

4. According to claim 1, the cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack is characterized in that: The line load safety constraints include power balance constraints, load attack range constraints and new energy output fluctuation range constraints.

5. According to claim 4, the cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack is characterized in that: The power balance constraint is expressed as: 1 T ·ΔD=1 T ·ΔP w Among them, Δp w is the change vector caused by the uncertainty of renewable energy output, and ΔD is the load data injection attack vector.

6. The cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack according to claim 4 is characterized in that: The attack range constraint of the payload is expressed as: in, It represents the line load data under attack, ΔD is the load data injection attack vector, and ε represents the load attack amplitude.

7. The cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack according to claim 4 is characterized in that: The fluctuation range constraint of the new energy output is expressed as: in, Indicates the wind power output power under attack, ΔP w is the change vector caused by the uncertainty of the new energy output, and δ represents the predicted attack amplitude of the new energy.

8. The cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack according to claim 7 is characterized in that: The value of the predicted attack amplitude δ of the new energy is determined according to the accuracy of the new energy prediction. The higher the accuracy, the smaller the δ value.

9. The cyber-physical fusion hazard assessment method for superposition of new energy fluctuation and data injection attack according to claim 2 is characterized in that: Generator output power under the described attack scenario Wind power output under attack conditions The value of is calculated using the traditional SCED model.

10. An information-physical fusion hazard assessment system for superposition of new energy fluctuations and data injection attacks, characterized in that: For implementing the method according to any one of claims 1 to 9, the system comprises: Attack model construction module: constructs an attack model of superposition of new energy fluctuation and data injection attack, wherein the attack model introduces a data injection attack vector and a change vector caused by uncertainty of new energy output into the line flow; Hazard assessment module: By calculating the line load safety constraints, the cyber-physical fusion hazards under the superposition of new energy fluctuations and data injection attacks are determined based on the attack model.

Images