A method and device for detecting interference from power system timing attacks

Abstract

The present application relates to an interference detection method and device for power system timing attacks. The method includes: setting the false alarm probability, the order of the whitening filter, and the size of the sliding window; calculating a prediction model of the whitening filter used to predict the timing signal based on the timing signal output by the time synchronization device under normal timing conditions; using the prediction model to predict the clock error at the next moment to obtain a predicted value, and obtaining a normal residual value based on the predicted value and the actual value of the clock error at the next moment; using a sliding window to slide the normal residual value to obtain the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance; and constructing a T-test model and a Z_score detection model for joint detection based on the false alarm probability, the window clock error average value, the normal clock error average value, and the normal clock error variance. This method can achieve rapid interference detection.

Description

Technical Field

[0001] The present application relates to the field of satellite timing technology, and in particular to a method and device for detecting interference with power system timing attacks. Background Art

[0002] The power system is a critical infrastructure that supports economic development and ensures people's livelihoods. As the power system develops toward intelligence, automation, and information technology, its reliance on precise time synchronization is increasing. Timing systems based on the Global Navigation Satellite System (GNSS), due to their high precision and wide-area coverage, are widely used for time synchronization in the power system.

[0003] However, time synchronization devices in power systems are vulnerable to external timing attacks. This can prevent Phasor Measurement Units (PMUs), which rely on precise time synchronization, from accurately measuring and recording phasor information of electrical quantities such as voltage and current at different locations, threatening the safe and stable operation of the power system. Timing interference typically involves spoofing and jamming. Spoofing typically involves forging or tampering with satellite signals to mislead receivers, leading to time synchronization errors. Jamming, on the other hand, involves transmitting powerful noise or other signals to cover or mask the signals transmitted by GNSS satellites, making it difficult or impossible for GNSS receivers to receive authentic satellite signals.

[0004] At present, the detection methods for timing attacks mainly focus on the following categories: based on statistical features, based on time-frequency analysis, based on machine learning and neural networks, and innovative methods based on other perspectives. The principle of the statistical-based method is relatively simple, but it is insensitive to slight interference and relies on prior knowledge; the method based on time-frequency analysis can effectively process time-varying signals, but the calculation and hardware costs are high; the method based on machine learning has strong adaptability, but requires a large amount of data training. Although other innovative methods have their own advantages, they also have limitations. Based on this, the present invention obtains the clock error data in the form of B code output by the time synchronization device in the power system under different deception interference scenarios by building a practical experimental platform, and proposes a joint detection method based on T test and Z_score test under the condition of few samples. It does not require additional hardware facilities and complex mathematical tools, does not require a large amount of original training data, and can achieve effective detection of timing interference in static scenarios. Summary of the Invention

[0005] Based on this, it is necessary to provide an interference detection method and device for power system timing attacks to address the above technical problems.

[0006] A method for detecting interference from power system timing attacks, the method comprising:

[0007] Obtain the clock difference between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions;

[0008] Set the false alarm probability, whitening filter order, and sliding window size;

[0009] Calculate a prediction model of a whitening filter for predicting the timing signal based on the timing signal output by the time synchronization device under normal timing conditions;

[0010] Predicting the clock difference at the next moment using the prediction model to obtain a predicted value, and obtaining a normal residual value based on the predicted value and the actual value of the clock difference at the next moment;

[0011] Using a sliding window to slide detect the normal residual value, obtaining the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance;

[0012] Constructing a T-test model and a Z_score detection model respectively according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance;

[0013] After using the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured are calculated respectively, and the T test model and Z_score detection model are used to detect the interference of the power system timing attack.

[0014] In one embodiment, the method further includes: according to the equivalence between the M-order whitening filter and the M-1-order single-step predictor, obtaining:

[0015] A M (z) = 1 - z -1 H M-1 (z)

[0016] Among them, H M-1 (z) is the system function of the sampled response h(m) of the M-1 order best linear one-step predictor, and:

[0017] H M-1 (z)=h(1)+h(2)z -1 +…+h(M)z -(M-1)

[0018] Simplifying, we get:

[0019] A M (z)G(z)=G(z)-z -1 HM-1 (z)G(z)

[0020] =z -1 [F(z)-H M-1 (z)G(z)]

[0021] Further simplification yields:

[0022] ||a*g|| 2 =||fg*h|| 2

[0023] Where a represents the response of the M-order whitening filter and h represents the response of the M-1-order single-step predictor;

[0024] According to the response characteristics of the single-step predictor, the output time series data [x(1), x(2), …, x(N)] of the time synchronization device under normal timing conditions are obtained, and the design matrix X and the target vector y are constructed as follows:

[0025]

[0026] Solve the parameter w through the canonical equation:

[0027] w=(X T X) -1 X T y

[0028] Among them, the parameter w is the parameter of the M-order whitening filter of the prediction model.

[0029] In one embodiment, the method further includes: using the prediction model to predict the clock difference at the next moment to obtain a predicted value Xw; and obtaining a normal residual value based on the predicted value and the actual value of the clock difference at the next moment:

[0030] res=y-Xw

[0031] Among them, res represents the normal residual value.

[0032] In one embodiment, the method further includes: constructing a T-test model based on the false alarm probability, the window clock error average value, the normal clock error average value, and the normal clock error variance:

[0033] Null hypothesis H0 and alternative hypothesis H1:

[0034] H0:μ=μ0,H1:μ≠μ0

[0035]

[0036] Where T represents the T statistic, is the input data of the window clock error average, μ0 is the input data of the normal clock error average, s is the normal clock error variance, and n is the sample size;

[0037] According to the degrees of freedom df and the false alarm probability FA, ​​the critical value Th is found from the distribution table of the T statistic, or calculated using the following formula:

[0038]

[0039] In one embodiment, the method further includes calculating the Z-score as follows:

[0040]

[0041] The upper and lower thresholds of the Z_score detection model are calculated based on the Z-score score:

[0042] upper_th=μ+z_score×σ

[0043] lower_th=μ-z_score×σ

[0044] Wherein, μ is the input data of the normal clock error mean value, and σ is the input data of the normal clock error variance.

[0045] In one embodiment, the method further includes: performing a T test and a Z_score test simultaneously, and if both detect anomalies, determining that a timing attack exists.

[0046] An interference detection device for power system timing attacks, the device comprising:

[0047] The clock error data acquisition module is used to obtain the clock error between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions;

[0048] The prediction model calculation module is used to set the false alarm probability, the order of the whitening filter and the sliding window size; based on the timing signal output by the time synchronization device under normal timing conditions, the prediction model of the whitening filter used to predict the timing signal is calculated;

[0049] A normal parameter calculation module is configured to use the prediction model to predict the clock error at the next moment to obtain a predicted value, and to obtain a normal residual value based on the predicted value and the actual value of the clock error at the next moment; to use a sliding window to slide detect the normal residual value to obtain the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance;

[0050] A detection model construction module is used to construct a T-test model and a Z_score detection model according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance;

[0051] The interference detection module is used to use the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, and then calculate the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured, and use the T test model and Z_score detection model to detect interference caused by power system timing attacks.

[0052] In one embodiment, the prediction model calculation module is further configured to obtain, based on the equivalence between the M-order whitening filter and the M-1-order single-step predictor:

[0053] A M (z) = 1 - z -1 H M-1 (z)

[0054] Among them, H M-1 (z) is the system function of the sampled response h(m) of the M-1 order best linear one-step predictor, and:

[0055] H M-1 (z)=h(1)+h(2)z -1 +…+h(M)z -(M-1)

[0056] Simplifying, we get:

[0057] A M (z)G(z)=G(z)-z -1 H M-1 (z)G(z)

[0058] =z -1 [F(z)-H M-1 (z)G(z)]

[0059] Further simplification yields:

[0060] ||a*g|| 2 =||fg*h|| 2

[0061] Where a represents the response of the M-order whitening filter and h represents the response of the M-1-order single-step predictor;

[0062] According to the response characteristics of the single-step predictor, the output time series data [x(1), x(2), …, x(N)] of the time synchronization device under normal timing conditions are obtained, and the design matrix X and the target vector y are constructed as follows:

[0063]

[0064] Solve the parameter w through the canonical equation:

[0065] w=(X T X) -1 X T y

[0066] Among them, the parameter w is the parameter of the M-order whitening filter of the prediction model.

[0067] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0068] Obtain the clock difference between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions;

[0069] Set the false alarm probability, whitening filter order, and sliding window size;

[0070] Calculate a prediction model of a whitening filter for predicting the timing signal based on the timing signal output by the time synchronization device under normal timing conditions;

[0071] Predicting the clock difference at the next moment using the prediction model to obtain a predicted value, and obtaining a normal residual value based on the predicted value and the actual value of the clock difference at the next moment;

[0072] Using a sliding window to slide detect the normal residual value, obtaining the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance;

[0073] Constructing a T-test model and a Z_score detection model respectively according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance;

[0074] After using the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured are calculated respectively, and the T test model and Z_score detection model are used to detect the interference of the power system timing attack.

[0075] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0076] Obtain the clock difference between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions;

[0077] Set the false alarm probability, whitening filter order, and sliding window size;

[0078] Calculate a prediction model of a whitening filter for predicting the timing signal based on the timing signal output by the time synchronization device under normal timing conditions;

[0079] Predicting the clock difference at the next moment using the prediction model to obtain a predicted value, and obtaining a normal residual value based on the predicted value and the actual value of the clock difference at the next moment;

[0080] Using a sliding window to slide detect the normal residual value, obtaining the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance;

[0081] Constructing a T-test model and a Z_score detection model respectively according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance;

[0082] After using the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured are calculated respectively, and the T test model and Z_score detection model are used to detect the interference of the power system timing attack.

[0083] The above-mentioned interference detection method and device for power system timing attacks transforms timing attack detection into clock difference abnormality detection by utilizing the difference between normal and timing attack clock differences, thus simplifying the complexity of the problem; whitening filtering is used to obtain residuals, and normal and abnormal clock differences are clearly distinguished based on their statistical characteristics, laying the foundation for accurate detection; the T-test and Z_score test are combined and combined with the sliding window mechanism, which not only ensures the reliability of detection, but also can keenly capture subtle changes in the residual sequence, making the detection more sensitive and timely; and compared with traditional methods, it does not require a large amount of training data, complex algorithms and high hardware costs, and shows good generalization, effectively improving the accuracy, timeliness, economy and versatility of power system timing interference detection, and providing a strong guarantee for the safe and stable operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 1 is a flow chart of a method for detecting interference against power system timing attacks according to an embodiment;

[0085] Figure 2 A schematic diagram of obtaining clock error data under normal timing conditions in one embodiment;

[0086] Figure 3 1 is a structural block diagram of an interference detection device for power system timing attacks in one embodiment;

[0087] Figure 4FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0088] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0089] In one embodiment, Figure 1 As shown, a method for detecting interference against timing attacks on a power system is provided, comprising the following steps:

[0090] Step 102: Obtain the clock difference between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions.

[0091] like Figure 2 As shown, the time synchronization device receives the satellite timing signal through the receiving antenna and outputs the 1PPS signal. The 1PPS signal output by the reference time source is calculated by the time interval counter, and the clock difference is recorded by the recording and analysis equipment.

[0092] Step 104 , setting the false alarm probability, the order of the whitening filter and the size of the sliding window, and calculating a prediction model of the whitening filter for predicting the timing signal based on the timing signal output by the time synchronization device under normal timing conditions.

[0093] The whitening filter is used as the prediction model because whitening converts data into a more standardized and normalized form, making it more suitable for efficient analysis and modeling, thereby improving model training efficiency and prediction accuracy. When predicting data, the optimal linear prediction error (LPE) filter used for transient monitoring can perfectly decorrelate the signal. Therefore, in this step, based on the equivalence principle between the single-step predictor and the whitening filter, the parameters of the whitening filter are calculated to establish the prediction model.

[0094] Step 106: Use the prediction model to predict the clock difference at the next moment to obtain a predicted value, and obtain a normal residual value based on the predicted value and the actual value of the clock difference at the next moment. Use a sliding window to slide and detect the normal residual value to obtain the window clock difference average value of the clock difference in each window, as well as the normal clock difference average value and the normal clock difference variance.

[0095] In this step, by establishing a prediction model, the average window clock error when the window slides, as well as the average normal clock error and the normal clock error variance can be calculated based on normal data to anticipate normal data and provide a basis for subsequent detection.

[0096] Step 108 : constructing a T-test model and a Z_score detection model according to the false alarm probability, the window clock error average, the normal clock error average, and the normal clock error variance.

[0097] This step is based on the idea of ​​joint detection, in which the T-test model can detect the significance of mean differences in the data. It focuses on the sample mean, and based on key indicators such as the variance and degrees of freedom of the sample data, fully considers factors such as sample size and data distribution form. It is especially suitable for situations where the sample size is small and the data is approximately normally distributed. It can accurately test whether there are significant differences between the means of different groups of data and identify the central trend between data groups. The Z_score detection model can detect the abnormal fluctuation amplitude characteristics of outliers in the data. By converting the original data into a standard normal distribution, the degree of deviation of each data point from the mean can be intuitively shown. If the mean of a window exceeds the specified threshold, it indicates that there may be abnormal fluctuations in the window, and the degree of deviation from the overall data distribution is too high. It is likely that it has been subjected to abnormal interference, so those individual windows that are significantly different from the overall data distribution and may be affected by interference sources can be locked, thereby providing a basis for rapid interference detection.

[0098] In the above interference detection method for power system timing attacks, the difference between normal and timing attack clock differences is utilized to transform timing attack detection into clock difference abnormality detection, thus simplifying the complexity of the problem; whitening filtering is used to obtain residuals, and normal and abnormal clock differences are clearly distinguished based on their statistical characteristics, laying the foundation for accurate detection; the T test and Z_score test are combined and combined with the sliding window mechanism, which not only ensures the reliability of detection, but also can keenly capture subtle changes in the residual sequence, making the detection more sensitive and timely; and compared with traditional methods, it does not require a large amount of training data, complex algorithms and high hardware costs, and shows good generalization, effectively improving the accuracy, timeliness, economy and versatility of power system timing interference detection, and providing a strong guarantee for the safe and stable operation of the power system.

[0099] In one embodiment, according to the equivalence between the M-order whitening filter and the M-1-order single-step predictor, we obtain:

[0100] A M (z) = 1 - z -1 H M-1 (z)

[0101] Among them, H M-1 (z) is the system function of the sampled response h(m) of the M-1 order best linear one-step predictor, and:

[0102] H M-1 (z)=h(1)+h(2)z -1 +…+h(M)z -(M-1)

[0103] Simplifying, we get:

[0104] A M (z)G(z)=G(z)-z -1 H M-1 (z)G(z)

[0105] =z -1 [F(z)-H M-1 (z)G(z)]

[0106] Further simplification yields:

[0107] ||a*g|| 2 =||fg*h|| 2

[0108] Where a represents the response of the M-order whitening filter and h represents the response of the M-1-order single-step predictor;

[0109] According to the response characteristics of the single-step predictor, the output time series data [x(1), x(2), …, x(N)] of the time synchronization device under normal timing conditions are obtained, and the design matrix X and the target vector y are constructed as follows:

[0110]

[0111] Solve the parameter w through the canonical equation:

[0112] w=(X T X) -1 X T y

[0113] Among them, the parameter w is the parameter of the M-order whitening filter of the prediction model.

[0114] In another embodiment, the prediction model is used to predict the clock difference at the next moment to obtain a predicted value Xw. According to the predicted value and the actual value of the clock difference at the next moment, the normal residual value is obtained as follows:

[0115] res=y-Xw

[0116] Among them, res represents the normal residual value.

[0117] In one embodiment, a T-test model is constructed based on the false alarm probability, the window clock error average, the normal clock error average, and the normal clock error variance:

[0118] Null hypothesis H0 and alternative hypothesis H1:

[0119] H0:μ=μ0,H1:μ≠μ0

[0120]

[0121] Where T represents the T statistic, is the input data of the window clock error average, μ0 is the input data of the normal clock error average, s is the normal clock error variance, and n is the sample size;

[0122] According to the degrees of freedom df and the false alarm probability FA, ​​the critical value Th is found from the distribution table of the T statistic, or calculated using the following formula:

[0123]

[0124] In another embodiment, the Z-score is calculated as:

[0125]

[0126] The upper and lower thresholds of the Z_score detection model are calculated based on the Z-score score:

[0127] upper_th=μ+z_score×σ

[0128] lower_th=μ-z_score×σ

[0129] Wherein, μ is the input data of the normal clock error mean value, and σ is the input data of the normal clock error variance.

[0130] Therefore, the prediction model w is used to perform whitening filtering to obtain the residual res1 to be tested. The residual res1 to be tested is averaged, and the T test and Z_score test are jointly tested. If both detect anomalies, it is determined that a timing attack may have occurred.

[0131] It should be understood that although Figure 1 The steps in the flowchart are shown in sequence as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified in this document, there is no strict order restriction for the execution of these steps, and these steps can be executed in other orders. In addition, Figure 1 At least part of the steps may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily executed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be executed in turn or alternately with other steps or at least part of the sub-steps or stages of other steps.

[0132] In one embodiment, Figure 3As shown, an interference detection device for power system timing attacks is provided, including: a clock error data acquisition module 302, a prediction model calculation module 304, a normal parameter calculation module 306, a detection model construction module 308 and an interference detection module 310, wherein:

[0133] The clock error data acquisition module 302 is used to obtain the clock error between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions;

[0134] The prediction model calculation module 304 is used to set the false alarm probability, the whitening filter order and the sliding window size; based on the timing signal output by the time synchronization device under normal timing conditions, the prediction model of the whitening filter used to predict the timing signal is calculated;

[0135] The normal parameter calculation module 306 is configured to use the prediction model to predict the clock error at the next moment to obtain a predicted value, and to obtain a normal residual value based on the predicted value and the actual value of the clock error at the next moment; to use a sliding window to detect the normal residual value, and to obtain the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance;

[0136] A detection model construction module 308 is used to construct a T-test model and a Z_score detection model according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance;

[0137] The interference detection module 310 is used to use the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, and then calculate the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured, and use the T test model and Z_score detection model to detect interference caused by power system timing attacks.

[0138] The specific limitations of the interference detection device for power system timing attacks can be found in the limitations of the interference detection method for power system timing attacks described above, and will not be repeated here. The various modules in the above-mentioned interference detection device for power system timing attacks can be implemented in whole or in part through software, hardware, or a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory of the computer device in software form, so that the processor can call and execute the operations corresponding to the above modules.

[0139] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 4As shown. The computer device includes a processor, memory, network interface, display screen, and input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, it implements an interference detection method for power system timing attacks. The display screen of the computer device can be a liquid crystal display or an electronic ink display screen. The input device of the computer device can be a touch layer covering the display screen, or it can be a key, trackball, or touchpad provided on the computer device housing, or it can be an external keyboard, touchpad, or mouse.

[0140] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0141] In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program, and the processor implements the steps of the method in the above embodiment when executing the computer program.

[0142] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the method in the above embodiment are implemented.

[0143] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0144] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0145] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for detecting interference from power system timing attacks, characterized in that: The method comprises: Obtain the clock difference between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions; Set the false alarm probability, whitening filter order, and sliding window size; Calculate a prediction model of a whitening filter for predicting the timing signal based on the timing signal output by the time synchronization device under normal timing conditions; Predicting the clock difference at the next moment using the prediction model to obtain a predicted value, and obtaining a normal residual value based on the predicted value and the actual value of the clock difference at the next moment; Using a sliding window to slide detect the normal residual value, obtaining the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance; Constructing a T-test model and a Z_score detection model respectively according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance; After using the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured are calculated respectively, and the T test model and Z_score detection model are used to detect the interference of the power system timing attack.

2. The method according to claim 1, characterized in that The prediction model of the whitening filter used to predict the timing signal is calculated based on the timing signal output by the time synchronization device under normal timing conditions, including: According to the equivalence between the M-order whitening filter and the M-1-order single-step predictor, we can obtain: in, for M -1st order best linear one-step predictor sampled response , and: Simplifying, we get: Further simplification yields: in, express M The response of the order whitening filter, express M -Response of 1st-order one-step predictor; According to the response characteristics of the single-step predictor, the time series data output by the time synchronization device under normal timing conditions is obtained. , construct the design matrix and the target vector for: Solving for parameters through canonical equations : Among them, the parameters For the prediction model M Parameters of the 1-order whitening filter.

3. The method according to claim 2, characterized in that The prediction model is used to predict the clock difference at the next moment to obtain a predicted value, and a normal residual value is obtained based on the predicted value and the actual value of the clock difference at the next moment, including: Use the prediction model to predict the next time difference and get the prediction value , according to the actual value of the clock difference between the predicted value and the next moment, the normal residual value is: in, represents the normal residual value.

4. The method according to claim 1, wherein Constructing a T-test model based on the false alarm probability, the window clock error average, the normal clock error average, and the normal clock error variance, including: According to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance, a T-test model is constructed as follows: Null hypothesis and the alternative hypothesis : in, T express T Statistics, is the input data of the window clock error average, is the input data of the normal clock error average value, is the normal clock error variance, n is the sample size; According to the degree of freedom df and the false alarm probability FA ,from T Finding critical values ​​in a distribution table of a statistic Th, Or use the following formula to calculate: 。 5. The method according to claim 4, characterized in that Constructing a Z_score detection model based on the false alarm probability, the window clock error average, the normal clock error average, and the normal clock error variance, including: calculate Z -score score is: according to Z -score score calculation The upper and lower thresholds of the Z_score detection model are: in, is the input data of the normal clock error average value, is the input data of the normal clock error variance.

6. The method according to claim 5, characterized in that The T-test model and Z_score detection model are used to detect interference from power system timing attacks, including: The T test and Z_score test are performed simultaneously. If both detect anomalies, it is determined that a timing attack has occurred.

7. An interference detection device for power system timing attacks, characterized in that: The device comprises: The clock error data acquisition module is used to obtain the clock error between the 1PPS signal output by the time synchronization device and the 1PPS signal output by the reference time source under normal timing conditions; The prediction model calculation module is used to set the false alarm probability, the order of the whitening filter and the sliding window size; based on the timing signal output by the time synchronization device under normal timing conditions, the prediction model of the whitening filter used to predict the timing signal is calculated; A normal parameter calculation module is configured to use the prediction model to predict the clock error at the next moment to obtain a predicted value, and to obtain a normal residual value based on the predicted value and the actual value of the clock error at the next moment; to use a sliding window to slide detect the normal residual value to obtain the window clock error average value of the clock error in each window, as well as the normal clock error average value and the normal clock error variance; A detection model construction module is used to construct a T-test model and a Z_score detection model according to the false alarm probability, the window clock error average value, the normal clock error average value and the normal clock error variance; The interference detection module is used to use the prediction model to predict the clock error data to be measured to obtain the predicted value of the data to be measured, and then calculate the window clock error average value, normal clock error average value and normal clock error variance of the predicted value of the data to be measured, and use the T test model and Z_score detection model to detect interference caused by power system timing attacks.

8. The device according to claim 7, characterized in that The prediction model calculation module is also used to obtain the following equation based on the equivalence between the M-order whitening filter and the M-1-order single-step predictor: in, for M -1st order best linear one-step predictor sampled response , and: Simplifying, we get: Further simplification yields: in, express M The response of the order whitening filter, express M -Response of 1st-order one-step predictor; According to the response characteristics of the single-step predictor, the time series data output by the time synchronization device under normal timing conditions is obtained. , construct the design matrix and the target vector for: Solving for parameters through canonical equations : Among them, the parameters For the prediction model M Parameters of the 1-order whitening filter.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images