A fdi attack detection method for wind farm power prediction

Abstract

The present application belongs to the technical field of FDI attack detection, in particular to a kind of FDI attack detection method for wind farm power prediction.The method comprises the following steps: firstly, the wind farm power data obtained is preprocessed using principle and sliding window technology, and is cut into training set, verification set and test set suitable for xLSTM-AE model processing.Then, the xLSTM-AE model is constructed, and the model is trained using the above training set data, and the model parameters are fine-tuned using the verification set to avoid overfitting phenomenon.After the model training is completed, the specific threshold value for each wind turbine is calculated according to the principle.Finally, the FDI attack detector is used to detect the FDI attack of the test set data, and the test set data whose square residual exceeds the respective threshold value is identified and marked as FDI attack data.The present application can enhance the security and reliability of wind farm power prediction system, improve the economic benefit of wind farm and the stability of power grid.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of FDI attack detection, and particularly relates to an FDI attack detection method for wind farm power prediction. BACKGROUND

[0002] With the increase of greenhouse gas emissions, the gradual construction of new power systems and the promotion of energy structure transformation are important issues in the energy and power industry. Therefore, the installed capacity of renewable energy continues to achieve new breakthroughs. As of the end of June 2024, the installed capacity of renewable energy power generation in China reached 165.3 GW, accounting for about 53.8% of the total installed capacity of power generation in China. Among them, the cumulative grid-connected capacity of wind power reached 467 million kilowatts, including 429 million kilowatts of onshore wind power and 37.17 million kilowatts of offshore wind power. This progress provides an important experience for global energy transformation and helps China achieve the "carbon peak and carbon neutrality" goal and move towards a green and low-carbon future.

[0003] The accuracy of wind power prediction is crucial for ensuring the stable operation of new power systems and optimizing the scheduling of renewable energy. Depending on the differences in prediction objectives, prediction models can be divided into two categories: single-machine and whole-field output power prediction. For a single wind turbine, methods such as Heteroscedastic Spline Regression Model (HSRM), Robust Spline Regression Model (RSRM), Back Propagation Neural Networks (BPNN), Deep Belief Network (DBN), and Long Short-Term Memory networks (LSTM) can predict its future power output by analyzing the output data of the wind turbine. For wind farm-level prediction, the temporal and spatial dependencies between the historical output data of multiple wind turbines are analyzed to predict the whole-field power or the output power of multiple units. Currently, various deep neural network structures, including Deep Convolutional Network (DCN), Long Short-Term Memory (LSTM), Sparse Autoencoder (SAE), Mixture Density Network (MDN), and Graph Convolutional Long Short-Term Memory (GC-LSTM), have been used to extract complex spatio-temporal correlation features within wind farms and successfully applied to whole-field power prediction problems.

[0004] These power prediction models are mainly deployed in the central control room of the wind farm or the dispatch center, in order to centrally manage and optimize the operation of the wind farm. The wind turbines inside the wind farm collect data through sensors and transmit the data to the central control room or cloud server through the Supervisory Control and Data Acquisition (SCADA) system, realizing real-time data monitoring and communication. This deployment and communication mechanism enables the operation and maintenance personnel to more accurately predict power output, optimize power grid scheduling and operation, but at the same time increases the risk of system being attacked by network attack, especially False Data Injection (FDI) attack. According to the report of General Electric (GE), 96% of wind farms have at least one machine operating system vulnerable to network attack. FDI attackers reduce the prediction accuracy of wind power prediction system by injecting false data into the SCADA system, while the power grid dispatch center usually requires wind farms to submit wind power output prediction for future time in advance in order to conduct power grid scheduling. Therefore, inaccurate power generation prediction will not only affect the stable operation of the power grid, but also cause the wind farm to face economic penalties. In this context, ensuring the network security of wind power generation system, accurately detecting and defending FDI attacks, has become an urgent problem to be solved.

[0005] In existing literature, FDI attack detection methods are mainly divided into two categories: one is model-based algorithm, which analyzes the difference between state estimation value and measurement value to realize the detection of FDI attack, but this method needs accurate system parameters and mathematical model, and its scalability is poor; the other method is data-based algorithm, which does not depend on system model or parameters, but learns the feature pattern of FDI attack or normal behavior pattern existing in the historical data of system under attack or normal operation by using machine learning algorithms such as Reinforcement Learning (RL), Convolutional Neural Network (CNN), K-Means Clustering Algorithm (K-Means), and then realizes online detection of attack using the trained detection model, due to the development of artificial intelligence and big data analysis technology, this kind of algorithm has obtained more and more attention.

[0006] Although these methods have achieved certain research results in other fields, in the specific field of wind farm power prediction, there are relatively few studies on FDI attack detection in existing literature. Currently, existing FDI attack detection methods mainly focus on the time series characteristics of single wind turbine output power, ignoring the spatial correlation between wind turbines within the wind farm. This limitation makes these methods unable to fully capture and identify attack behavior, especially in complex wind farm environments. In order to improve the accuracy of FDI attack detection, the detection method needs to consider the time and spatial correlation between wind turbines within the wind farm. In addition, most existing supervised learning attack detection methods rely on labeled data sets of specific attack types, which limits their ability to identify unknown new attacks.

[0007] To address these issues, the present application proposes an FDI attack detection method based on xLSTM-AE (Extended Long Short-Term Memory Autoencoders). This method can meet the needs of FDI attack detection in wind farm power prediction systems, effectively capture the time series characteristics of wind turbine output power, and deeply analyze the spatial dependence between different wind turbines within the wind farm. It also enhances its adaptability and generalization ability when facing unknown attacks. Therefore, the attack detection method proposed in this application is of great significance in improving the security and reliability of wind farm power prediction, and provides a powerful security tool for wind power prediction. First, the 3-σ principle and sliding window technology are used to preprocess the acquired wind farm power data, which is cut into training set, validation set and test set suitable for xLSTM-AE model processing. Then, the xLSTM-AE model is constructed, and the training set data is used for training, and the validation set is used to fine-tune the model parameters to avoid overfitting. After the model training is completed, the specific threshold for each wind turbine is calculated according to the 3-σ principle. Finally, the FDI attack detector is used to detect FDI attacks on the test set data, and those test set data whose squared residuals exceed the respective threshold are identified and labeled as FDI attack data. SUMMARY

[0008] The present application develops an FDI attack detection method for wind farm power prediction, which is based on xLSTM-AE and can capture the temporal and spatial correlation between wind turbines within the wind farm and effectively identify FDI attacks. It is specifically designed for wind farm power prediction scenarios and is of great significance for improving the accuracy of wind power prediction and the stability of the power grid.

[0009] The method comprises the following steps:

[0010] (1) Obtain wind farm power data to obtain an original data set;

[0011] (2) Preprocessing of wind power data;

[0012] ① To test the FDI attack detection model, randomly select the data of two days in the original data set as the test set X s , and the rest of the data is divided into training set X and validation set X v in the ratio of 8:2;

[0013] ② Simulate the FDI attack suffered by the wind farm, process the output power data of a certain wind turbine in the test set X s , simulate different types of FDI attacks, including basic FDI attack, stealth FDI attack and replay attack;

[0014] ③ Use 3-σ principle to identify outliers in training set X, validation set X v and attacked test set , for the processing of outliers, choose linear interpolation method instead of simple discard, in order to keep the integrity of time series data;

[0015] ④ Use sliding window technology to divide the training set X, validation set X v and test set after steps ①②③, ensure that the sample number M is determined according to the following formula:

[0016]

[0017] Wherein, n represents the total data amount of the data set; ω represents the size of the sliding window; s represents the moving step; Indicates the integer operation, ensures that the obtained sample number is an integer; in addition, the sliding window technology of the present application is the prior art, which creates training samples by sliding a fixed size window on the data set, so as to capture the time sequence characteristics and local mode in the data;

[0018] (3) Training and verification of xLSTM-AE;

[0019] Extended Long Short-Term Memory (xLSTM) is an enhanced version of the traditional LSTM. It improves performance by introducing exponential gating and new memory structures, including sLSTM, which has scalar storage, update, and new memory mixing mechanisms, and mLSTM, which has matrix memory and covariance update rules, supporting fully parallel processing. These improved LSTM variants are integrated into residual blocks, forming xLSTM blocks, and a complete xLSTM architecture is built through residual stacking. These innovations make xLSTM perform well when processing large-scale datasets, especially in capturing temporal dependencies between samples in time series, significantly improving model performance.

[0020] Autoencoders (AE) is an unsupervised learning neural network that learns compressed representations of data through backpropagation algorithms and attempts to reconstruct the original input data from these low-dimensional representations. The model consists of an input layer, one or more hidden layers, and an output layer. From input to hidden layer, it is an encoder, and from hidden layer to output, it is a decoder. Autoencoders aim to minimize the difference between input and reconstructed data, capturing the intrinsic structure and features of the data.

[0021] The xLSTM-AE model is a deep learning architecture that combines xLSTM units and autoencoder structures. The encoder of this model consists of two layers of xLSTM, responsible for encoding input time series data into a fixed-size latent space vector, which is stored in the model's intermediate layer, also known as the "data bridge". The first xLSTM layer of the encoder has a number of units matching the number of input features, achieving a direct mapping of features to xLSTM units; the second xLSTM layer has half the number of units of the first layer, which helps further compress data and extract higher-level abstract features. The decoder is symmetric to the encoder structure and also contains two xLSTM layers, aiming to reconstruct the original input sequence from the latent space vector. This design enables the model to effectively capture the spatiotemporal coupling characteristics of time series data, making it particularly suitable for analyzing complex data sequences such as wind farm output power.

[0022] In the given multi-element time series training set of wind farm output power in the invention where m represents the input feature dimension, i.e., the number of entire wind turbine units;

[0023] The xLSTM-AE model can be represented as:

[0024]

[0025] where, and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; represents the reconstructed wind farm output power data; in the conventional operation, take

[0026] By minimizing the residual error between the training data composed of wind farm output power data and the reconstructed wind farm output power data, the optimal parameter set of the model can be obtained as follows:

[0027]

[0028] The reconstruction error of the xLSTM-AE model is:

[0029]

[0030] where, represents the wind power data of the i-th wind turbine at time t in m wind turbines; and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; represents the optimal parameter set of the model;

[0031] The xLSTM-AE model learns the spatio-temporal features in the time series data of wind farm output power by optimizing parameters to minimize the reconstruction error. After training, the model can reconstruct the input wind farm power data with the minimum reconstruction error. In order to avoid overfitting and adjust the hyperparameters of the model, the model performance is evaluated on the validation set X v to fine-tune the model parameters. If the model performs well on the training set but the performance decreases on the validation set, it usually means that the model may be too complex or overtrained, and the model structure or training strategy needs to be adjusted accordingly. Through such monitoring and adjustment, it is ensured that the model not only effectively captures the key features of the data during the training process, but also maintains good generalization ability. Specifically, the model training includes setting 800 training cycles, learning rate of 0.01, and the number of units of the second LSTM layer of the encoder is half of the first layer. The selection of these parameters is based on the performance feedback on the validation set to optimize the performance of the model.

[0032] (4) Identify the attacked data;

[0033] The FDI attack detector is constructed as:

[0034]

[0035] wherein, represents the detection output of the i-th wind turbine in the m wind turbines at time t, 1 represents that the FDI attack is detected, and 0 represents that the FDI attack is not detected; τ i represents a specific threshold value calculated for each wind turbine according to the square residual error of the attack-free training set X; represents the square residual error of the wind power data of the i-th wind turbine in the m wind turbines at time t, and the calculation formula of the square residual error is:

[0036]

[0037] wherein, represents the wind power data of the i-th wind turbine in the m wind turbines at time t; respectively represent the encoding and decoding nonlinear functions of the xLSTM-AE model; and represents the optimal parameter set of the xLSTM-AE model.

[0038] After training the xLSTM-AE model using the attack-free training set X, the xLSTM-AE detection algorithm is adopted to test the test set X s A FDI attack detection, and those test set data in all wind turbines whose square residual error is greater than the respective set threshold value are identified and marked as FDI attack data. The method for calculating the specific threshold value for each wind turbine follows the 3-σ principle, that is, 68% of the data is distributed within one standard deviation of the mean, 95% is distributed within two standard deviations, and 99.7% is distributed within three standard deviations. Therefore, in this study, the data points of each wind turbine in the test set whose square residual error exceeds the mean of the square residual error of the corresponding wind turbine in the training set plus 2.5 standard deviations are considered as data attacked by FDI.

[0039] Further, in ② of step (2), the output power data of the 14th wind turbine in the test set X s is operated as follows:

[0040] The basic FDI attack with an attack multiplier of 1.25 and an attack adder of 0.35 MW is added to the data points from the 30th to the 50th;

[0041] The hidden FDI attack is applied to the data points from the 100th to the 130th;

[0042] An FDI attack with a multiplier of 1.25 and an addend of -0.45 MW is added to the data points 180-200.

[0043] A replay attack is applied to the data points 250-270 (using data points 200-220 in place of current values).

[0044] Further, in step (2) ii, the FDI attack is implemented by changing a single measurement value, which is described by the following equation:

[0045]

[0046] where, Xi represents the i-th measurement value under attack; X i represents the actual measurement value, A i is an arbitrary attack addend; a i is an arbitrary attack multiplier, which results in over-scaling (a i > 1), under-scaling (0 < a i < 1), or negative scaling (a i < 0).

[0047] Further, in step (2) ii, the stealth FDI attack has an attack vector that includes a time-varying addend and multiplier, which dynamic approach enables the attacker to gradually tamper with the data in an imperceptible manner. The stealth FDI attack is described by the following equation:

[0048]

[0049] where, Xi represents the i-th measurement value under attack; X i represents the actual measurement value; A i (t) is a time-varying attack addend; a i (t) is a time-varying attack multiplier.

[0050] Further, in step (2) ii, in a replay attack, the attacker replaces the current measurement value with previously intercepted data, which is considered to be:

[0051]

[0052] where, is the data under attack, is a record of system measurement values at an earlier time.

[0053] The test set X s is represented by .

[0054] Further, in ③ of step (3), the 3-σ rule is based on the normal distribution in statistics, that is, 68% of the data is within one standard deviation of the mean, 95% is within two standard deviations, and 99.7% is within three standard deviations; the specific formula is as follows:

[0055] P(mu-sigma <= X <= mu+sigma) = 0.68

[0056] P(mu-2sigma <= X <= mu+2sigma) = 0.95

[0057] P(mu-3sigma <= X <= mu+3sigma) = 0.997

[0058] Where, X is a random variable, mu represents the mean of the sequence, assuming there is a sequence {x1, x2,..., xn}, and its expression is: n

[0059]

[0060] Sigma represents the standard deviation of the sequence, and its calculation formula is:

[0061]

[0062] Compared with the prior art, the present application has the advantages of:

[0063] 1. The present application proposes a FDI attack detection method for wind farm power prediction. The method effectively integrates the spatio-temporal correlation of wind farm output power data using xLSTM-AE technology, which is crucial for identifying and defending against complex FDI attacks.

[0064] 2. The xLSTM-AE model of the present application is completely data-driven and uses an unsupervised learning mechanism, which can intelligently identify abnormal patterns in data. This feature gives the present application a significant advantage in detecting unknown or new attacks, saving time and resources by eliminating the tedious data labeling and model training process for each potential attack.

[0065] 3. The present application has the ability to be applied in real time and can be deployed in a wind farm power prediction system to detect and prevent FDI attacks, thereby ensuring the safe and stable operation of the wind farm. This real-time protection mechanism is of great significance for maintaining the reliability of new power systems and resisting external threats. BRIEF DESCRIPTION OF DRAWINGS

[0066] The present application will be further described below in conjunction with the accompanying drawings.

[0067] Figure 1 is a schematic diagram of the sliding window technology;

[0068] Figure 2 ​is a structure diagram of xLSTM;

[0069] Figure 3 is a structure diagram of AE with one hidden layer;

[0070] Figure 4 is an FDI attack detection algorithm based on xLSTM-AE;

[0071] Figure 5 is a detection effect diagram of xLSTM-AE;

[0072] Figure 6 is a square residual diagram between FDI attack values and xLSTM-AE output values;

[0073] Figure 7 is a flowchart of a wind farm power prediction-oriented FDI attack detection method. DETAILED DESCRIPTION

[0074] The application will be further described below with reference to the accompanying drawings.

[0075] Embodiment 1

[0076] A wind farm power prediction-oriented FDI attack detection method, comprising the following steps:

[0077] (1) Obtain wind farm power data to obtain an original data set;

[0078] (2) Preprocess the wind power data;

[0079] ① To test the FDI attack detection model, randomly select the data of two days in the original data set as a test set X s , and the remaining data is divided into a training set X and a verification set X v in a ratio of 8:2;

[0080] ② Simulate the FDI attack suffered by the wind farm, randomly select the output power data of a wind turbine in the test set X s , simulate different types of FDI attacks, including basic FDI attacks, invisible FDI attacks and replay attacks, wherein the basic FDI attacks, invisible FDI attacks and replay attacks in the test set meet the intelligence of FDI attacks, and the 3-σ principle cannot be identified;

[0081] The basic FDI attack is achieved by changing a single measurement value, and this attack is described by the following formula:

[0082]

[0083] , wherein, X iThis refers to the actual measured value, A. i It is any attack addend; a i It is an arbitrary attack multiplier that causes overscaling (a i >1) Underscaling (0 < a i <1) or negative scaling (a i <0).

[0084] Stealth FDI attacks employ attack vectors that vary over time, including addends and multipliers. This dynamic approach allows attackers to progressively tamper with data in a way that is difficult to detect. Stealth FDI attacks are described by the following formula:

[0085]

[0086] in, This refers to the i-th measurement value that has been attacked; X i This refers to the actual measured value; A i (t) is the attack addend that varies over time; a i (t) is the attack multiplier that varies over time.

[0087] In a replay attack, the attacker uses previously intercepted data to replace the current measurement value, treating it as:

[0088]

[0089] in, This is data after an attack. These are records of system measurements from an earlier time period.

[0090] Test set X after performing an FDI attack s Use X s A express.

[0091] ③ Use the 3-σ principle to identify the training set X and the validation set X. v and the test set after the attack For outliers, linear interpolation is chosen instead of simple discarding to maintain the integrity of the time series data.

[0092] The 3-σ principle is based on the normal distribution in statistics, which states that 68% of the data lies within one standard deviation of the mean, 95% within two standard deviations, and 99.7% within three standard deviations. The specific formula is as follows:

[0093] P(μ-σ≤X≤μ+σ)≈0.68

[0094] P(μ-2σ≤X≤μ+2σ)≈0.95

[0095] P(μ-3σ≤X≤μ+3σ)≈0.997

[0096] where X is a random variable, μ represents the mean of the sequence, and σ represents the standard deviation of the sequence. n The expression is:

[0097]

[0098] The calculation formula is:

[0099]

[0100] ④ Use the sliding window technique to divide the training set X, the verification set X v and the test set data after steps ①, ② and ③, to ensure that the sample size M is determined according to the following formula:

[0101]

[0102] where n represents the total data size of the data set, ω represents the size of the sliding window, and s represents the moving step size. The floor operation ensures that the obtained sample size is an integer.

[0103] (3) Training and verification of xLSTM-AE;

[0104] xLSTM-AE model is a deep learning architecture that combines xLSTM units and autoencoder structure. The encoder of this model is composed of two layers of xLSTM, which is responsible for encoding the input time series data into a fixed size latent space vector. This vector is stored in the middle layer of the model, also known as the "data bridge". The first xLSTM layer of the encoder has the same number of units as the number of input features, which realizes the direct mapping of features to xLSTM units; the number of units of the second xLSTM layer is half of the first layer, which helps to further compress the data and extract higher level abstract features. The decoder is symmetrical to the encoder structure, also containing two xLSTM layers, whose goal is to reconstruct the original input sequence from the latent space vector. This design enables the model to effectively capture the spatio-temporal coupling characteristics in time series data, making it particularly suitable for analyzing complex data sequences such as wind farm output power.

[0105] In the given multi-element time series training set of wind farm output power in the invention m represents the input feature dimension, i.e. the number of whole wind turbine generators;

[0106] The xLSTM-AE model can be represented as:

[0107]

[0108] wherein, and ψ represent the encoding and decoding process, respectively; H represents the compression space of latent features; and represent the set of nonlinear mapping functions in the encoding and decoding process of the model, respectively; and represent the set of matrices of training weights (W) and bias (b) in the encoding and decoding process of the model, respectively; X represents the training data composed of wind farm output power data; represents the reconstructed wind farm output power data; in the conventional operation, generally

[0109] By minimizing the residual error between the training data composed of wind farm output power data and the reconstructed wind farm output power data, the optimal parameter set of the model can be obtained as follows:

[0110]

[0111] The reconstruction error of the xLSTM-AE model is:

[0112]

[0113] wherein, x i t represents the wind power data of the i-th wind turbine in the m wind turbines at time t; and represent the set of nonlinear mapping functions in the encoding and decoding process of the model, respectively; ||·||2 represents the L2 norm, that is, the Euclidean distance; and represents the optimal parameter set of the model;

[0114] The xLSTM-AE model learns the spatiotemporal features in the time series data of the wind farm output power by optimizing the parameters to minimize the reconstruction error. After the training is completed, the model can reconstruct the input wind farm power data with the minimum reconstruction error. In order to avoid overfitting and adjust the hyperparameters of the model, the present application uses the validation set X vThe model performance is evaluated to fine-tune the model parameters. If the model performs well on the training set but the performance decreases on the validation set, it usually means that the model may be too complex or over-trained, and the model structure or training strategy needs to be adjusted accordingly. Through such monitoring and adjustment, it is ensured that the model not only effectively captures the key features of the data during training, but also maintains good generalization ability. Specifically, the model training includes setting 800 training cycles, a learning rate of 0.01, and the number of units of the second LSTM layer of the encoder is half of the first layer. The selection of these parameters is based on the performance feedback on the validation set to optimize the performance of the model.

[0115] (4) identifying the attacked data;

[0116] The FDI attack detector is constructed as:

[0117]

[0118] wherein, represents the detection output of the i th wind turbine generator of the m wind turbine generators at time t, 1 represents that the FDI attack is detected, and 0 represents that the FDI attack is not detected; τ i represents a specific threshold value calculated for each wind turbine generator according to the square residual error of the attack-free training set X; represents the square residual error of the wind power data of the i th wind turbine generator of the m wind turbine generators at time t, and the calculation formula of the square residual error is:

[0119]

[0120] wherein, represents the wind power data of the i th wind turbine generator of the m wind turbine generators at time t; respectively represent the encoding and decoding nonlinear functions of the xLSTM-AE model; and represent the optimal parameter set of the xLSTM-AE model.

[0121] After training the xLSTM-AE using the attack-free training set X, the xLSTM-AE detection algorithm as shown in Figure 4 is used to detect the FDI attack on the test set X s A .

[0122] In this embodiment, the validation set X vThe model performance is evaluated to fine-tune the model parameters, and the model training includes setting 800 training cycles, a learning rate of 0.01, and the number of units of the second LSTM layer of the encoder is half of the first layer, and the selection of these parameters is based on the performance feedback on the validation set to optimize the performance of the model.

[0123] Embodiment 2

[0124] The application develops a FDI attack detection method for wind farm power prediction, which is specially designed for wind farm power prediction scenarios, and is of great significance for improving the accuracy of wind power prediction and the stability of the power grid.

[0125] The method comprises the following steps:

[0126] (1) Obtain wind farm power data to obtain an original data set;

[0127] Specifically, the output power data of 14 wind turbine units of a certain wind farm in the United Kingdom from 2021-01-01 00:00:00 to 2021-07-01 00:00:00 (a total of 181 days) is obtained, and the original data set is constructed by recording every 10 minutes.

[0128] (2) Preprocess the wind power data;

[0129] ① To test the FDI attack detection model, the application selects 2 days of data in the original data set as the test set X s . The remaining data is divided into a training set X and a validation set X v in a ratio of 8:2.

[0130] ② In order to simulate the FDI attack suffered by the wind farm, the application performs the following operations on the output power data of the 14th wind turbine unit of the test set X s .

[0131] Add a basic FDI attack with an attack multiplier of 1.25 and an attack additive of 0.35 MW on the 30th to 50th data points;

[0132] Apply a stealth FDI attack on the 100th to 130th data points;

[0133] Add a basic FDI attack with an attack multiplier of 1.25 and an attack additive of -0.45 MW on the 180th to 200th data points;

[0134] Apply a replay attack (use the 200th to 220th data points to replace the current value) on the 250th to 270th data points.

[0135] In this example, a basic FDI attack is introduced at the 30th to 50th data points, with an attack multiplier set to 1.25 and an attack additive set to 0.35 MW. Since wind power data is usually positive and the original data in this interval is relatively small, a positive attack additive is chosen to help ensure that the data after the attack remains within a reasonable range. At the 180th to 200th data points, a basic FDI attack is introduced again, with the attack multiplier remaining the same and the attack additive adjusted to -0.45 MW. Considering that the original data in this interval is larger, and a negative attack additive can be chosen to contrast with the positive attack additive, the FDI attack detection capability of the system is further tested. The attack multiplier and attack additive can be chosen arbitrarily, but they must ensure that the data after the attack cannot be identified by the 3-σ rule.

[0136] These attacks simulate different types of FDI attacks, including basic FDI attacks, stealth FDI attacks, and replay attacks. A basic FDI attack is achieved by changing a single measurement value, and this attack can be described by the following formula:

[0137]

[0138] where, Xi represents the i-th measurement value under attack; X i represents the actual measurement value; A i is an arbitrary attack additive; a i is an arbitrary attack multiplier, which causes over-scaling (a i > 1), under-scaling (0 < a i < 1), or negative scaling (a i < 0).

[0139] Compared with the basic FDI attack, the stealth FDI attack adopts a more subtle strategy, with an attack vector including a time-varying additive and multiplier. This dynamic approach enables the attacker to gradually tamper with the data in a way that is difficult to detect. The stealth FDI attack can be described by the following formula:

[0140]

[0141] where, Xi represents the i-th measurement value under attack; X i represents the actual measurement value; A i a(t) is a time-varying attack additive; a i (t) is a time-varying attack multiplier.

[0142] In a replay attack, the attacker replaces the current measurement value with previously intercepted data. This can be regarded as:

[0143]

[0144] wherein, is the data after being attacked, is the record of the system measurement value at an earlier time.

[0145] Test set X after FDI attack s with denoted.

[0146] ③During the operation of the wind turbine, due to daily maintenance, sensor failure and environmental factors such as high temperature and extreme cold, there will always be some abnormal values in the collected data. In order to improve the data quality and the detection performance of the model, the present application adopts the 3-σ principle to identify the abnormal values in the training set X, the verification set X v and the test set after attack (the FDI attack in has intelligence and cannot be identified by the 3-σ principle). This principle is based on the normal distribution in statistics, that is, about 68% of the data is within one standard deviation of the mean, 95% is within two standard deviations, and 99.7% is within three standard deviations. The specific formula is as follows:

[0147] P(μ-σ≤X≤μ+σ)≈0.68

[0148] P(μ-2σ≤X≤μ+2σ)≈0.95

[0149] P(μ-3σ≤X≤μ+3σ)≈0.997

[0150] wherein, X is a random variable, μ represents the mean of the sequence, assuming that there is a sequence {x1, x2,..., x n}, and its expression is:

[0151]

[0152] σ represents the standard deviation of the sequence, and its calculation formula is:

[0153]

[0154] For the processing of abnormal values, the present application selects the linear interpolation method instead of simply discarding, in order to maintain the integrity of the time series data. The linear interpolation method can effectively correct the abnormal values, thereby improving the continuity and quality of the data.

[0155] ④Using the sliding window technology as shown in Figure 1 , the present application divides the training set X, the verification set X v and the test set data after steps ①, ② and ③, to ensure that the sample number M is determined according to the following formula:

[0156]

[0157] where n represents the total data amount of the dataset; ω represents the size of the sliding window (set to 144 in the present application); s represents the moving step (set to 144 in the present application); represents the floor operation, ensuring that the number of samples obtained is an integer.

[0158] (3) Training and verification of the xLSTM-AE;

[0159] The xLSTM-AE model is a deep learning architecture that combines xLSTM units and an autoencoder structure. The encoder of the model is composed of two layers of xLSTM, which is responsible for encoding the input time series data into a fixed-size latent space vector, which is stored in the intermediate layer of the model, also known as the "data bridge". The first xLSTM layer of the encoder has a number of units that matches the number of input features, realizing a direct mapping of features to xLSTM units; the number of units of the second xLSTM layer is half of the first layer, which helps to further compress the data and extract higher-level abstract features. The decoder is symmetrical to the encoder structure, also containing two xLSTM layers, whose goal is to reconstruct the original input sequence from the latent space vector. This design enables the model to effectively capture the spatiotemporal coupling characteristics in time series data, making it particularly suitable for analyzing complex data sequences such as wind farm output power.

[0160] The given multi-element time series training set of wind farm output power in the present application where m represents the input feature dimension, i.e. the number of wind turbines in the entire wind farm;

[0161] The xLSTM-AE model can be represented as:

[0162]

[0163] where, and ψ represent the encoding and decoding processes, respectively; H represents the compressed space of latent features; and represent the nonlinear mapping functions in the encoding and decoding processes of the model, respectively; and represent the set of matrices of training weights (W) and biases (b) in the encoding and decoding processes of the model, respectively; X represents the training data composed of wind farm output power data; represents the reconstructed wind farm output power data; in conventional operations, generally

[0164] The optimal parameter set of the model can be obtained by minimizing the residual between the training data consisting of wind farm output power data and the reconstructed wind farm output power data, as follows:

[0165]

[0166] The reconstruction error of the xLSTM-AE model is:

[0167]

[0168] wherein, represents the wind power data of the i-th wind turbine at time t among m wind turbines; and respectively represent the nonlinear mapping functions in the encoding and decoding processes of the model; ||·||2 represents the L2 norm, that is, the Euclidean distance; and represents the optimal parameter set of the model;

[0169] The xLSTM-AE model learns the spatio-temporal features in the time series data of the wind farm output power by optimizing the parameters to minimize the reconstruction error. After training, the model can reconstruct the input wind farm power data with the minimum reconstruction error. In order to avoid overfitting and adjust the hyperparameters of the model, the performance of the model is evaluated on the validation set X v to fine-tune the model parameters. If the model performs well on the training set but the performance decreases on the validation set, it usually means that the model may be too complex or overtrained, and the model structure or training strategy needs to be adjusted accordingly. Through such monitoring and adjustment, it is ensured that the model not only effectively captures the key features of the data during the training process, but also maintains good generalization ability. Specifically, the model training includes setting 800 training cycles, the learning rate is 0.01, and the number of units of the second LSTM layer of the encoder is half of the first layer. The selection of these parameters is based on the performance feedback on the validation set to optimize the performance of the model.

[0170] (4) Identify the attacked data;

[0171] The squared residual (Squared Residual) is the square of the difference between the actual observation and the model prediction value, and the abnormal value or outlier may produce a very large squared residual. By monitoring the squared residual, the abnormal value or outlier in the data set can be identified. Therefore, the FDI attack detector is constructed as:

[0172]

[0173] wherein, represents the detection output of the i-th wind turbine at time t among m wind turbines, 1 represents detecting FDI attack, 0 represents not detecting FDI attack; τ i represents the specific threshold value calculated for each wind turbine according to the square residual error of the attack-free training set X; represents the square residual error of the wind power data of the i-th wind turbine at time t among m wind turbines, the calculation formula of the square residual error is:

[0174]

[0175] wherein, represents the wind power data of the i-th wind turbine at time t among m wind turbines; respectively represent the encoding and decoding nonlinear functions of the xLSTM-AE model; and represents the optimal parameter set of the xLSTM-AE model.

[0176] After training the xLSTM-AE model using the attack-free training set X, the xLSTM-AE detection algorithm is used to detect FDI attacks on the test set , and those test set data in all wind turbines whose square residual error is greater than the respective set threshold value are identified and marked as FDI attack data. The method for calculating the specific threshold value for each wind turbine follows the 3-σ principle, that is, 68% of the data is distributed within one standard deviation of the mean, 95% is distributed within two standard deviations, and 99.7% is distributed within three standard deviations. Therefore, in this study, the data points of each wind turbine in the test set whose square residual error exceeds the mean of the square residual error of the corresponding wind turbine in the training set plus 2.5 standard deviations are considered as data attacked by FDI.

[0177] The FDI attack detection results show that in the test set , no FDI attack is detected for the remaining wind turbines (the output of the FDI attack detector is 0) except for the 14th wind turbine. For the 14th wind turbine, the detection performance of the xLSTM-AE model is shown in Figure 5 . In the figure, the xLSTM-AE output value is represented by a solid line, the true value is represented by a dashed line, and the FDI attack value is represented by a dotted line. The analysis results show that in the four different time periods, the xLSTM-AE output value curve is basically consistent with the true value curve, while there is a significant difference with the FDI attack value curve. This phenomenon clearly indicates that the xLSTM-AE model effectively identifies and distinguishes normal wind power data from wind power data attacked by FDI.

[0178] In addition, Figure 6Further provided is a visual presentation of the squared residuals between the FDI attack values and the xLSTM-AE output values. As can be seen from the figure, when the squared residuals exceed the preset threshold limit, the attack behavior is accurately captured, thereby revealing the existence of the FDI attack and further illustrating the effectiveness and accuracy of the xLSTM-AE in detecting FDI attacks.

[0179] In order to comprehensively evaluate the statistical performance of the developed xLSTM-AE detection method, the present application employs four key evaluation indicators:

[0180]

[0181] Among them, TP represents correctly identified attacks, FP represents incorrectly identified attacks, TN represents correctly identified non-attack data points, and FN represents incorrectly identified non-attack data points. The accuracy measures the overall prediction accuracy of the model; the recall rate (also known as sensitivity) measures the ability of the model to identify all actual attacks; the false alarm rate (FAR) measures the frequency of the model incorrectly labeling normal data points as attacks; the F1 score is the harmonic mean of precision and recall, and a high F1 score means low FP and low FN. Table 1 shows the evaluation indicators of the xLSTM-AE model studied.

[0182] Table 1. Evaluation indicators of the xLSTM-AE detection method

[0183] Accuracy Recall False Positive Rate F1 Score 0.9722 0.9255 0.0052 0.9560

Claims

1. A method for detecting FDI attacks in wind farm power prediction, characterized in that, Includes the following steps: (1) Obtain wind farm power data to obtain the raw dataset; (2) Preprocess the wind power data; ① To test the FDI attack detection model, data from two days in the original dataset were randomly selected as the test set. The remaining data were split into training sets in an 8:2 ratio. Sum check set ; ② Simulate FDI attacks on wind farms, and randomly select test sets. The output power data of one of the wind turbines is processed to simulate different types of FDI attacks, including basic FDI attacks, stealth FDI attacks, and replay attacks. ③ Adopt Principles for identifying the training set , check set and the test set after the attack For outliers in the data, linear interpolation is chosen instead of simply discarding them in order to maintain the integrity of the time series data. ④ Using the sliding window technique, the training set after steps ①②③ is processed. , check set and test set The data is divided to ensure that the sample size is determined according to the following formula: ； in, This represents the total amount of data in the dataset; Represents the size of the sliding window; Represents the step size; This indicates a floor operation, ensuring that the number of samples obtained is an integer. (3) Training and validation of xLSTM-AE; The xLSTM-AE model combines xLSTM units and an autoencoder structure. The encoder consists of two xLSTM layers, responsible for encoding the input time-series data into a fixed-size latent space vector. This vector is stored in the middle layer of the model, also known as the "data bridge." The first xLSTM layer of the encoder has a number of units that matches the number of input features, achieving a direct mapping from features to xLSTM units. The second xLSTM layer has half the number of units as the first layer, which helps to further compress the data and extract higher-level abstract features. The decoder is symmetrical to the encoder structure and contains two xLSTM layers. Its goal is to reconstruct the original input sequence from the latent space vector. Given a multivariate time series training set of wind farm output power middle, This indicates the input feature dimension, i.e., the number of wind turbines in the entire field; The xLSTM-AE model is represented as follows: ； in, and These represent the encoding and decoding processes, respectively. A compressed space representing latent features; , These represent the nonlinear mapping functions in the encoding and decoding process of the model, respectively; , These represent the training weights during the encoding and decoding process of the model. and bias The set of matrices; This represents training data consisting of wind farm output power data. This represents the reconstructed wind farm output power data; in routine operations, it is generally taken as... , ; The optimal parameter set for this model can be obtained by minimizing the residual between the training data (composed of wind farm output power data) and the reconstructed wind farm output power data, as follows: ； The reconstruction error of the xLSTM-AE model is: ； in, express In the time of typhoon turbine units The first Wind power output data for typhoon turbine generators; , These represent the nonlinear mapping functions in the encoding and decoding process of the model, respectively; This represents the L2 norm, which is the Euclidean distance. and This represents the optimal parameter set for the model; (4) Identify the attacked data; The FDI attack detector was constructed as follows: ； in, express The detection output of the first wind turbine at time twentieth time: 1 indicates that an FDI attack has been detected, and 0 indicates that no FDI attack has been detected. Indicates based on the non-attack training set The squared residual is a specific threshold calculated for each wind turbine unit; express The squared residual of the wind power data of the th wind turbine at time t is calculated using the following formula: ； in, express In the time of typhoon turbine units The first Wind power output data for typhoon turbine generators; , These represent the encoding and decoding nonlinear functions of the xLSTM-AE model, respectively. and This represents the optimal parameter set for the xLSTM-AE model; Using a non-attack training set After training xLSTM-AE, the xLSTM-AE detection algorithm is used on the test set. Perform FDI attack detection.

2. The method according to claim 1, characterized in that, In step (2) ②, the basic FDI attack, the stealth FDI attack and the replay attack in the test set satisfy the FDI attack's intelligence and cannot be identified by the 3-σ principle.

3. The method according to claim 1, characterized in that, In step (2) ②, the test set The output power data of the 14th wind turbine unit was processed as follows: Add a base FDI attack with an attack multiplier of 1.25 and an attack adder of 0.35MW at data points 30 to 50; Apply stealth FDI attack on data points 100 to 130; Add a base FDI attack with an attack multiplier of 1.25 and an attack adder of -0.45MW at data points 180 to 200; Apply a replay attack on data points 250 to 270.

4. The method according to claim 1, characterized in that, In step (2) ②, the basic FDI attack is achieved by changing a single measurement value, and this attack is described by the following formula: ； in, This refers to the attacked party. One measurement value; This refers to the actual measured value. It is any attack increment; It is an arbitrary attack multiplier that causes overscaling. Underscaling or negative scaling .

5. The method according to claim 1, characterized in that, In step (2) ②, the attack vector of the stealth FDI attack includes addends and multipliers that change over time. This dynamic approach allows attackers to gradually tamper with data in a way that is difficult to detect. The stealth FDI attack is described by the following formula: ； in, This refers to the attacked party. One measurement value; This refers to the actual measured value; It is an attack increment that changes over time; It is an attack multiplier that changes over time.

6. The method according to claim 1, characterized in that, In step (2) ②, during a replay attack, the attacker uses previously intercepted data to replace the current measurement value, treating it as: ； in, This is data after an attack. These are records of system measurements from earlier times; a test set following an FDI attack. use express.

7. The method according to claim 1, characterized in that, In step (3) ③, The principle is based on the normal distribution in statistics, which states that 68% of the data lies within one standard deviation of the mean, 95% within two standard deviations, and 99.7% within three standard deviations. The specific formula is as follows: ； in, It is a random variable. This represents finding the mean of a sequence. Assume we have a sequence... Its expression is: ； The standard deviation of a sequence is expressed by the following formula: 。 8. The method according to claim 1, characterized in that, In step (3), the verification set The model performance was evaluated to fine-tune the model parameters. The model training included setting 800 training epochs with a learning rate of 0.01, and the number of units in the second LSTM layer of the encoder was half that of the first layer. These parameters were chosen based on performance feedback on the validation set to optimize model performance.

Images