A source network load system attack path tracking and security protection method

Abstract

The application discloses a kind of source network load system attack path tracking and security protection method, first, source network load system network attack monitoring collection technology is proposed, and power generation side, energy storage system, load side, power grid operation, environmental factors and network security data are collected.Then, whether the instruction or the information collected is subjected to network attack by verifying whether the instruction and the uploaded power consumption data are reasonable;Secondly, according to the monitored source network load system network attack behavior, based on the mechanism of infectious disease model, the path of the source network load system subjected to network attack is given by reverse tracking the uploaded data subjected to attack.Finally, based on the key network node in the source network load system attack path selected by the sea squirt colony algorithm, the security protection measures are configured, considering the deployment cost and the expected effect, and finally outputting the protection scheme to guide the source network load system to deploy defense measures at the key nodes of the attack path and improve the security of the power grid.

Description

Technical Field

[0001] This invention relates to the field of power system control technology, and in particular to a method for tracing attack paths and protecting the security of a power source-grid-load system. Background Technology

[0002] By tracing attack paths in the power grid-grid-load system and proposing security protection strategies, the system can accurately identify attack sources, analyze attack propagation paths, and implement targeted security measures (such as firewalls and isolation devices). This helps improve the network security of the power grid, prevent malicious attacks from affecting power dispatching and load management, and ensure the stable operation of the power system. Simultaneously, by intelligently optimizing protection strategies, the system can maximize protection effectiveness while minimizing costs, enhancing the overall defense capabilities of the power grid and strengthening the security and resilience of the energy system.

[0003] However, existing methods still have the following shortcomings: 1) Insufficient network attack monitoring, passive defense, and lack of active monitoring: Existing methods rely heavily on post-event analysis such as log analysis and anomaly detection, making it difficult to detect attacks in real time. Limited monitoring scope: Traditional methods mainly focus on communication network security, while lacking in-depth monitoring of power physical information (such as power flow and load changes), resulting in low attack identification rates. Difficulty in detecting data tampering: Attackers may forge load data, power generation instructions, etc., and existing methods struggle to distinguish between data anomalies and equipment failures. 2) Insufficient attack path tracing and difficulty in identifying attack propagation paths: Existing network log analysis methods lack effective modeling of attack propagation chains and cannot track the evolution of attacks. Insufficient ability to cope with complex attacks: Faced with multi-point attacks (such as DDoS attacks and data tampering attacks), traditional methods struggle to trace the source of the attack. 3) Insufficiently intelligent protection strategies and unreasonable configuration of protection measures: Existing methods often adopt fixed strategies (such as deploying a network-wide firewall), but lack intelligent optimization, resulting in high protection costs and low effectiveness. Inability to dynamically adjust protection strategies: Different attack types have different impact ranges, and there is a lack of precise protection strategies for different attack paths.

[0004] To address these issues, we have designed a source-network-load system attack path tracing and security protection method. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies, such as difficulty in actively monitoring using monitoring data, insufficient attack path tracing, difficulty in identifying attack propagation paths, and unreasonable deployment of protective measures. This invention proposes a source-network-load system attack path tracing and security protection method based on an infectious disease model and the tunicate swarm algorithm. It introduces attack monitoring and acquisition technology to enhance the integrity and real-time nature of attack data; constructs a physical information verification method to improve attack detection accuracy; identifies command tampering and data deception attacks; and selects the optimal security defense strategy within a limited budget.

[0006] To achieve the above objectives, the present invention adopts the following technical solution:

[0007] A method for tracing attack paths and protecting against security breaches in a source-network-load system includes the following steps:

[0008] Step (1) involves collecting data from the power generation side, energy storage system, load side, power grid operation, environmental factors, and network security.

[0009] Step (2) involves verifying whether the issued instructions and uploaded electricity consumption data are reasonable, and identifying whether the instructions or collected information have been subjected to network attacks.

[0010] Step (3): Based on the network attack behavior of the source network load system, reverse trace the attacked instructions or uploaded data to give the path of the network attack on the source network load system.

[0011] Step (4): Select key network nodes in the source network load system attack path, configure security protection measures, and take into account both deployment costs and expected effects to obtain the optimal protection strategy.

[0012] As a further preferred embodiment of the present invention, step (1) involves collecting generation-side data, energy storage system data, load-side data, power grid operation data, environmental factors, and network security data, including:

[0013] Real-time active power output of generator, real-time reactive power of generator, system frequency, generator switching status, generator power generation dispatching command, energy storage unit charging and discharging power, energy storage unit state of charge, energy storage unit maximum charging and discharging power, energy storage unit minimum charging and discharging power, energy storage unit energy storage power command, load active power, load data, load adjustment command, transmission line power, substation / bus voltage, grid loss, outdoor temperature, and air humidity.

[0014] As a further preferred embodiment of the present invention, in step (2), the operation process of verifying whether the issued instruction and the uploaded electricity consumption data are reasonable and identifying whether the instruction or the collected information has been subjected to a network attack is as follows:

[0015] Step (21): In the instruction verification stage, the matching degree between the total output of the system and the total load is calculated through the power balance constraint. The power generation, energy storage and load regulation instructions are checked to see if they meet the physical constraints. If the instructions cause the system power to be unbalanced or exceed the equipment operating range, then there is an abnormality in the system.

[0016] Step (22) Equipment operation constraint verification ensures that generator output, energy storage charging and discharging and load regulation meet the equipment parameter limits. In the data verification part, the current load is predicted by using historical load data and environmental factors and compared with the uploaded data to determine whether the data has been tampered with. If the actual data deviates from the predicted value by more than the set threshold, it is determined that the data has been attacked.

[0017] Step (23): Through comprehensive network attack judgment, combined with command verification and data verification results, identify whether an attack has occurred, and take alarm and defense measures.

[0018] As a further preferred embodiment of the present invention, in step (3), the process of reverse tracing the attacked instructions or uploaded data based on the network attack behavior of the source-network-load system and giving the path of the network attack suffered by the source-network-load system is as follows:

[0019] The source-network-load system network attack monitoring technology based on physical information verification treats the attack behavior as an infection event after detecting abnormal commands or abnormal data, and analyzes the propagation path of the attack in the system based on the infectious disease model to trace the source of the attack.

[0020] Step (31): Use physical information verification to identify attacked nodes and mark them as infected, while unattacked nodes are marked as susceptible.

[0021] Step (32): Construct an attack propagation model, assuming that the attack spreads in the topology of the source network load system at a certain propagation rate, while the protected or repaired nodes enter the recovery state according to the recovery rate, and track which node the attack spreads from to the current victim node.

[0022] Step (33) involves identifying the attack source node through reverse path tracing.

[0023] As a further preferred embodiment of the present invention, step (4), selecting key network nodes in the source network load system attack path and configuring security protection measures, taking into account both deployment costs and expected effects, the process of obtaining the optimal protection strategy is as follows:

[0024] Step (41): Use attack path tracing technology based on infectious disease model to determine the attack path and its key nodes, and construct a protection optimization model;

[0025] Step (42) defines the protection effect and deployment cost of each node, and optimizes the total budget with the goal of maximizing the protection effect and minimizing the cost;

[0026] Step (43): In the optimization process, based on the salps group algorithm, by simulating the foraging behavior of the salps group, the leader-follower mechanism is used to iteratively search for the optimal protection scheme. Based on the leader node, the position is adjusted according to the global best solution, and the follower node gradually converges to the optimal protection strategy through group collaborative optimization decision-making.

[0027] Step (44) outputs the key nodes in the attack path and deploys the optimal protection strategy on these key nodes.

[0028] Compared with existing technologies, the beneficial effects of this invention are as follows: This invention proposes a method for attack path tracing and security protection of source-grid-load systems based on an infectious disease model and the tunicate swarm algorithm. It proposes monitoring and collecting attack data parameters to enhance the integrity and real-time performance of attack data. Through physical information verification methods, it improves attack detection accuracy, efficiently locates attack sources and propagation paths, and, combined with physical constraints and data analysis, achieves effective monitoring of command tampering, data deception, and communication hijacking, thereby enhancing the security and defense capabilities of the source-grid-load system. It can effectively respond to network attacks such as command tampering and data deception, improving the security and emergency response capabilities of the source-grid-load system. By tracing attack paths through an infectious disease model, it identifies the attack propagation process and traces the attack source. By employing the tunicate swarm algorithm to optimize security protection strategies, it can dynamically adapt to different attack scenarios, select the optimal protection deployment scheme under limited resource constraints, achieve optimal protection configuration and the best security defense strategy, improve the security and anti-attack capabilities of the source-grid-load system, and ensure the stable operation of the power grid. Attached Figure Description

[0029] Figure 1 This is a flowchart illustrating a source-network-load system attack path tracing and security protection method proposed in this invention. Detailed Implementation

[0030] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0031] This embodiment proposes a source-network-load system attack path tracing and security protection method based on an infectious disease model and the Salp Swarm Algorithm (SSA). The method mainly utilizes: source-network-load system network attack monitoring and acquisition technology, source-network-load system network attack monitoring technology based on physical information verification, source-network-load system attack path tracing technology based on an infectious disease model, and a source-network-load system attack path security protection strategy based on SSA.

[0032] Specifically, the following section will provide a detailed explanation of the attack path tracing and security protection scheme for the aforementioned source-network-load system. (Refer to...) Figure 1The method includes the following steps:

[0033] Step (1) proposes a monitoring and acquisition technology for data parameters of network attacks on the power generation, grid, and load system, collecting data from the power generation side, energy storage system, load side, power grid operation, environmental factors, and network security. This proposed data parameter monitoring and acquisition technology enhances the integrity and real-time nature of attack data.

[0034] Specifically, this includes the real-time active power output of generators, real-time reactive power of generators, system frequency, generator switching status, generator power dispatching commands, energy storage unit charging and discharging power, energy storage unit state of charge, energy storage unit maximum / minimum charging and discharging power, energy storage unit energy storage power commands, load active power, load data, load adjustment commands, transmission line power, substation / bus voltage, grid losses, temperature, humidity, meteorological conditions, command source, and communication status.

[0035] The collected power generation data, energy storage system data, load side data, power grid operation data, and environmental factors are shown in formula (1):

[0036]

[0037] In the formula: X(t) represents the collected data from the generation side, energy storage system, load side, power grid operation, and environmental factors. Let be the real-time active power output of the i-th generator. Let f(t) be the real-time reactive power of the i-th generator, and f(t) be the system frequency. This indicates the generator is on / off. This is the power generation dispatch instruction for generator i at time t. Let SOC be the charging / discharging power of the j-th energy storage unit. j (t) represents the state of charge of the j-th energy storage unit. This represents the maximum charge and discharge power of the energy storage unit. This represents the minimum charge and discharge power of the energy storage unit. The energy storage power command for the energy storage unit. Let P be the active power of the k-th load. L (tn) represents the load data for the past n time points. P is the adjustment command for load k. line,l (t) represents the power on transmission line l, V(t) represents the substation / bus voltage, and P loss (t) represents the power grid loss, T(t) represents the outdoor temperature, H(t) represents the air humidity, and W(t) represents the weather conditions.

[0038] Step (2) proposes a network attack behavior monitoring technology for source-grid-load system based on physical information verification. By verifying whether the issued instructions are reasonable and whether the uploaded electricity consumption data is reasonable, it can identify whether the instructions or collected information have been attacked, thereby realizing the monitoring of network attack behavior of source-grid-load system.

[0039] Specifically, this technology detects potential network attacks by verifying the rationality of scheduling instructions and the authenticity of user-uploaded data. Based on the physical constraints of the source-network-load system, it performs multi-level verification on scheduling instructions and real-time monitoring data parameters to ensure the security and stability of the system.

[0040] First, in the command verification phase, the matching degree between the system's total output and total load is calculated using power balance constraints. This checks whether the generation power command, energy storage power command, and load regulation command comply with physical constraints. If the command causes system power imbalance or exceeds the equipment's operating range, an anomaly may exist. The expression for the power balance constraint in physical information command verification is:

[0041]

[0042] In the formula, E c (t) represents the instruction verification error. Let G be the power generation dispatch instruction for generator i at time t, and let G represent the total number of generators. This is the energy storage power command for the energy storage unit, where S represents the total number of energy storage units. The load is k, and L represents the set of transmission lines. loss (t) represents grid losses, and Θ represents the power balance tolerance threshold. If δ C =0, the instruction may be abnormal (tampered with or attacked), if δ c =1 indicates that the instruction is working correctly (it has not been tampered with or attacked).

[0043] Secondly, equipment operation constraint verification ensures that generator output, energy storage charging and discharging, and load regulation meet their equipment parameter constraints, thus avoiding abnormal commands from affecting system operation.

[0044] The expression for the generator operating constraints in the physical information equipment operating constraint verification is as follows:

[0045]

[0046] The expression for the operating constraints of the energy storage system for verifying the equipment operating constraints of physical information is as follows:

[0047]

[0048] In the above formula, Δt represents the energy storage operating time. Indicates the maximum charging capacity of the energy storage. These represent the maximum and minimum values ​​of the energy storage SOC, respectively.

[0049] The expression for the load regulation constraint in the equipment operation constraint verification of physical information is as follows:

[0050]

[0051] In the above formula, This represents the minimum charge / discharge power of the energy storage unit. The maximum charge / discharge power of the energy storage unit; SOC j (t) represents the state of charge of the j-th energy storage unit. Let be the minimum active power of the k-th load. This represents the maximum active power of the k-th load.

[0052] If any device instruction is outside the constraints, it is marked as an abnormal instruction.

[0053] In the data verification section, historical load data and environmental factors (temperature, humidity, weather conditions) are used to predict real-time load, which is then compared with the uploaded data to determine if the data has been tampered with. If the actual data deviates from the predicted value by more than a set threshold, the data may have been compromised.

[0054] The expression for verifying physical load data, based on historical load data and environmental factors, predicting load, and testing the reliability of that data, is as follows:

[0055]

[0056] In the formula, To predict real-time load, P L (tn) represents the load data for the past n time points, P L (t) represents the load data at time t, X = (T(t), H(t), W(t)) represents environmental factors, T(t) represents the outdoor temperature, H(t) represents the air humidity, W(t) represents the weather conditions, and f(·) represents the trained load prediction model (LightGBM, LSTM, etc. can be used).

[0057] The comprehensive judgment expression for network attacks involving physical information is:

[0058]

[0059] In the formula, if δ D =0 indicates that the load data is abnormal and may have been tampered with. If δ attack =1, the system may be subject to a cyberattack, δ attack =0 indicates that the system has not been subjected to a network attack;

[0060] Ultimately, by comprehensively assessing network attacks and combining command and data verification results, the system identifies whether an attack has occurred and can take alerts and defensive measures. This technology combines physical constraints and data analysis to effectively monitor command tampering, data deception, and communication hijacking, thereby improving the security and defense capabilities of the source-network-load system.

[0061] Step (3): In this step, the attack path tracing technology of the source network load system of the infectious disease model is proposed. Based on the network attack behavior (instruction tampering, data deception and communication hijacking) of the source network load system monitored in the previous step, the attacking instructions or uploaded data are traced in reverse based on the mechanism of the infectious disease model, and the path of the network attack on the source network load system is given.

[0062] Source-network-load system attack path tracing technology based on infectious disease models is a method for reverse tracing network attack paths using the transmission mechanism of infectious diseases. This technology combines source-network-load system network attack monitoring technology based on physical information verification. Upon detecting abnormal commands or data, it treats the attack behavior as an "infection event" and analyzes the propagation path of the attack within the system based on infectious disease models (such as the SIR model), thereby tracing the source of the attack. Specifically:

[0063] First, physical information is used to verify and identify attacked nodes, marking them as infected, while unattacked nodes are marked as susceptible.

[0064] Variables consistent with the network attack detection technology of source-network-load system based on physical information verification are set, and network attack monitoring variables and infectious disease model-related variables (system node status, propagation parameters, network topology variables) are introduced, as shown in formula (8); the physical information verification detection attack model is shown in formula (9), and the initial infection state model is set as shown in formulas (10) and (11). Formula (10) sets the attacked node as the initial infected node, and formula (11) is the formula for the state of susceptible nodes.

[0065]

[0066] S n (0)=1-I n (0)(11)

[0067] In the above formula, X attack (t) represents the attack monitoring sample data, δ attack Indicates whether an attack was detected (1: attack detected, 0: no attack), δ C For the instruction verification result (1: normal, 0: abnormal), δ D For the data validation results (1: normal, 0: abnormal), E C(t) represents the instruction verification error. Power data for generation, energy storage, and load, respectively, S n (t) represents the vulnerable state: a source-network-load system node that has not been attacked, indicating the probability that node n is in a vulnerable state; I n (t) represents the infected state, i.e., the source network load system node that has been attacked, and indicates the probability that node n is attacked at time t. R n (t) represents the recovered state: the repaired node, β is the propagation rate, i.e., the probability that an attack propagates from one node to another, γ is the recovery rate, i.e., the probability that an attacked node recovers to normal, and A mn This represents the adjacency matrix between nodes m and n (1: connected, 0: not connected).

[0068] Then, an attack propagation model is constructed, assuming that the attack spreads in the topology of the source-network-load system at a certain propagation rate (β), while the protected or repaired nodes enter the recovered state according to the recovery rate (γ). The expressions of the attack propagation model are shown in formulas (12)-(14):

[0069]

[0070] In the above formula, the attack propagation rate β depends on the number of attacked neighboring nodes. The recovery rate γ depends on the system's defense mechanism. If a node n becomes infected at a certain time t (i.e., I... n If (t)>0), it means that the attack has spread from the adjacent node m to node n.

[0071] The calculation of the attack propagation path model is shown in Equation (15), where the attack propagation path consists of infected nodes. The reverse tracing attack source model is shown in Equation (16). Assuming T is the time when the attack is detected, the attack source node n0 satisfies this condition. From Equation (16), the reverse tracing attack source model can also be shown in Equation (17).

[0072]

[0073] P = (n0, n1, n2, ..., n T (17)

[0074] In the above formula, P attack-path This represents the calculated attack path, P = (n0, n1, n2, ..., n T ) represents the attack path, indicating the set of attack sources; n represents the traced attack source, and the initial infection state I of attack source node n0. n (0) = 1, the node with the longest infection time and the shortest attack path in the entire infection process.

[0075] Ultimately, by tracing the reverse path, the attack source node is identified, and the attack propagation path is reconstructed, providing a basis for attack attribution and defense strategies. This method can effectively address network attacks such as command tampering and data deception, improving the security and emergency response capabilities of the source-network-load system.

[0076] Step (4) In this step, a security protection strategy for the source-network-load system attack path based on the Salp Swarm Algorithm (SSA) is proposed. Security protection measures are configured for key network nodes in the source-network-load system attack path, such as adding firewalls and isolation devices, while taking into account deployment costs and expected effects.

[0077] First, attack path P and its key nodes are determined using attack path tracing technology based on infectious disease models. A protection optimization model is then constructed, defining the protection effect E for each node. n and deployment cost C n With the goal of maximizing protection effectiveness and minimizing cost, and constraining the total budget B, an optimization problem is formed; the expression of the protection optimization model is as follows:

[0078]

[0079] In the formula, P = (n0, n1, n2, ..., n T (I) represents the attack path, derived from the tracking results of an infectious disease model. n S(t) represents the probability that node n is attacked at time t. n (t) represents the probability that node n is in a susceptible state, A mn Given an adjacency matrix (1: connected, 0: not connected), x n To determine whether to deploy security measures at node n (1: deploy, 0: do not deploy), C n E represents the cost of deploying protective measures at node n. n To determine the expected protection effect of deploying protective measures at node n, let B be the total budget constraint and λ be the protection effect weighting coefficient. Let i be the protection strategy (i.e., the selected security protection node) for the i-th tunicate individual at time t. Let be the objective function, representing the overall protection effect of the strategy. This is currently the optimal protection strategy.

[0080] Security measures are deployed at key nodes in the attack path to maximize the protection effect. The objective function considering cost constraints is shown in formula (19), and the constraints are shown in formula (20).

[0081]

[0082] In the above formula: λ represents the trade-off between the protective effect and the cost, i.e., the protective effect weighting coefficient, E n x n Represents protective effect, C n x n This represents the cost of protection.

[0083] During the optimization process, the salver swarm algorithm simulates the foraging behavior of salver swarms and iteratively searches for the optimal protection strategy using a leader-follower mechanism. The leader node adjusts its position based on the globally optimal solution, while the follower nodes gradually converge to the optimal protection strategy through collaborative optimization decisions.

[0084] The initialization expression of the tunic swarm model based on the tunic swarm algorithm is shown in formula (21). M candidate schemes (individuals) are initialized, and each individual represents a set of protection strategies.

[0085]

[0086] In the formula: Initialize randomly between [0,1] and perform binarization (such as sigmoid transform).

[0087] Based on the tunic group algorithm, individual positions are updated using formulas (22)-(23), and the navigator-follower mechanism is used to update positions.

[0088]

[0089] In the formula: Let c1 be the protection strategy (i.e., the selection of security protection nodes) for the i-th tunicate individual at time t, where c1 is a random factor that controls the search range. The protective strategy for the first individual tunicate at time t. The best protection strategy for the current iteration of the salps at time t-1. Let i be the protective strategy of the i-th tunicate individual at time t-1. Let i be the protective strategy of the (i-1)th tunicate individual at time t-1.

[0090] The objective function for computation based on the tunic group algorithm is shown in the following equation:

[0091]

[0092] In the formula: Let i be the protection strategy (i.e., the selected security protection node) for the i-th tunicate individual at time t. Let E be the objective function, representing the overall protection effect of the strategy. λ is the weighting coefficient for the protection effect, controlling the trade-off between protection effect and cost. nTo determine the expected protective effect of deploying protective measures at node n, C represents whether to deploy security measures at node n at time t (1: deploy, 0: do not deploy). n The cost of deploying protective measures at node n.

[0093] The optimal solution selected based on the tunic group algorithm is shown in the following equation:

[0094]

[0095] In the formula, The current optimal protection strategy Let i be the protection strategy (i.e., the selected security protection node) for the i-th tunicate individual at time t. Let be the objective function, representing the overall protection effect of the strategy. The optimal protection strategy is output when the algorithm converges or reaches the maximum number of iterations.

[0096] Ultimately, the system identifies key nodes in the attack path and deploys optimal protection strategies at these nodes, including firewalls, isolation devices, or other security measures, to mitigate the risk of attack propagation. This strategy dynamically adapts to different attack scenarios, achieving optimal protection configurations under limited resource constraints, enhancing the security and resilience of the power grid system, and ensuring stable grid operation.

[0097] If the attack path is long, the swarm algorithm prioritizes deploying protective measures at key nodes with significant propagation impact (such as nodes with high connectivity). If the budget is limited, the swarm algorithm balances protection effectiveness and cost, selecting the optimal configuration within the limited budget. The final output protection plan guides the source network payload system in deploying firewalls, isolation devices, etc., at key nodes along the attack path to improve network security.

[0098] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for tracing attack paths and protecting the security of a source-network-load system, characterized in that, Includes the following steps: Step (1): Collect data from the power generation side, energy storage system, load side, power grid operation, environmental factors, and network security. Step (2): By verifying whether the issued instructions and uploaded electricity consumption data are reasonable, it is possible to identify whether the instructions or collected information have been subjected to network attacks. Step (3): Based on the network attack behavior of the source-network-load system, reverse trace the attacked instructions or uploaded data to give the path of the network attack on the source-network-load system. The process is as follows: Step (31): Use physical information verification to identify attacked nodes and mark them as infected, while unattacked nodes are marked as susceptible. Step (32): Construct an attack propagation model, assuming that the attack spreads in the topology of the source network load system at a certain propagation rate, while the protected or repaired nodes enter the recovery state according to the recovery rate, and track which node the attack spreads from to the current victim node. Step (33): Identify the attack source node by tracing the reverse path; Step (4): Select key network nodes in the source-network-load system attack path, configure security protection measures, and obtain the optimal protection strategy by taking into account both deployment costs and expected effects. The process is as follows: Step (41): Use attack path tracing technology based on infectious disease model to determine the attack path and its key nodes, and construct a protection optimization model; Step (42) defines the protection effect and deployment cost of each node, and optimizes the total budget with the goal of maximizing the protection effect and minimizing the cost; Step (43): In the optimization process, based on the salps group algorithm, by simulating the foraging behavior of the salps group, the leader-follower mechanism is used to iteratively search for the optimal protection scheme. Based on the leader node, the position is adjusted according to the global best solution, and the follower node gradually converges to the optimal protection strategy through group collaborative optimization decision-making. Step (44) outputs the key nodes in the attack path and deploys the optimal protection strategy on these key nodes.

2. The method for tracing attack paths and providing security protection for a source-network-load system according to claim 1, characterized in that, In step (1), data is collected from the generation side, energy storage system, load side, power grid operation, environmental factors, and network security, including: The system includes the generator's real-time active power output, generator's real-time reactive power, system frequency, generator switching status, generator power generation dispatching commands, energy storage unit's charging and discharging power, energy storage unit's state of charge, energy storage unit's maximum charging and discharging power, energy storage unit's minimum charging and discharging power, energy storage unit's energy storage power commands, load's active power, load data, load adjustment commands, transmission line power, substation / bus voltage, grid losses, outdoor temperature, air humidity, command source, and communication status.

3. The method for tracing attack paths and providing security protection for a source-network-load system according to claim 1, characterized in that, In step (2), the process of verifying whether the issued instruction and uploaded electricity consumption data are reasonable and identifying whether the instruction or collected information has been subjected to a network attack is as follows: Step (21): In the instruction verification stage, the matching degree between the total output and the total load of the system is calculated through the power balance constraint. The power generation, energy storage and load regulation instructions are checked to see if they meet the physical constraints. If the instructions cause the system power to be unbalanced or exceed the equipment operating range, then the system is abnormal. Step (22) Equipment operation constraint verification ensures that the generator output, energy storage charging and discharging and load regulation meet the equipment parameter limits. In the data verification part, the current load is predicted by using historical load data and environmental factors and compared with the uploaded data to determine whether the data has been tampered with. If the actual data deviates from the predicted value by more than the set threshold, it is determined that the data has been attacked. Step (23): Through comprehensive network attack judgment, combined with command verification and data verification results, identify whether an attack has occurred, and take alarm and defense measures.

Images