A false data injection attack positioning detection method and system based on an improved extreme learning machine

Abstract

The application discloses a false data injection attack positioning detection method and system based on an improved extreme learning machine, relates to the field of smart grids, and comprises the following steps: a hybrid FDIA model of attack cost-benefit balance is constructed to obtain an attack measurement data set; a GRU algorithm is used to extract time sequence features of the attack measurement data set, an ELM algorithm is used to perform two classification on the state of each node of a power system, and a GRU-ELM attack positioning detection algorithm is obtained; the hyperparameters of the GRU-ELM attack positioning detection algorithm are globally optimized based on a Bayesian optimization algorithm to obtain an optimal hyperparameter combination; a BO-GRU-ELM-based power grid FDIA positioning detection algorithm is obtained according to the optimal hyperparameter combination, and a hybrid FDIA attack is positioned. The extreme learning machine algorithm is improved and optimized through the optimization algorithm, and efficient and accurate positioning detection of the false data injection attack of the power system can be effectively realized.

Description

Technical Field

[0001] This invention relates to the field of smart grid technology, and more specifically to a method and system for locating and detecting spoofing data injection attacks based on an improved extreme learning machine. Background Technology

[0002] With the continuous development of new power systems, the coupling between power information and the physical world is deepening, exacerbating the potential threat of network attacks to the security, stability, and economic operation of the power grid. Among these attacks, false data injection attacks can construct attack vectors with invariant residuals, compromising the integrity and accuracy of power system terminal data. This can affect power system state estimation results, mislead dispatchers' decisions, and seriously threaten the operational safety of the power system. Therefore, researching methods for locating and detecting false data injection attacks can improve the security and stability of power systems and provide assistance for post-incident analysis and anomaly repair.

[0003] Currently, although some progress has been made in the detection and localization of False Data Injection Attacks (FDIA) based on Extreme Learning Machines (ELM), several shortcomings remain. First, existing research primarily focuses on detecting attacks related to the operating status of power systems, neglecting the diverse nature of FDIA attack targets. In fact, attackers can target not only the system's operating status but also influence power generation costs by manipulating load demand data, leading to significant economic losses. Second, in terms of feature extraction methods, existing research fails to fully utilize the temporal characteristics of power system measurement data; in-depth mining of its time-series features can significantly improve detection accuracy. Finally, the traditional random initialization of input weights in ELM algorithms often results in insufficient stability of detection results. Furthermore, in complex machine learning tasks, although hyperparameter optimization methods based on metaheuristic algorithms can obtain better solutions, their limitations of high computational resource consumption and low optimization efficiency remain prominent.

[0004] Therefore, how to improve and optimize the Extreme Learning Machine algorithm through optimization algorithms, so as to effectively and accurately locate and detect false data injection attacks in the power system, is a technical problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides a method and system for locating and detecting fake data injection attacks based on an improved extreme learning machine, which solves the problems existing in the background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solution:

[0007] A method for locating and detecting spoofing attacks based on an improved extreme learning machine includes the following steps:

[0008] S1: Construct a hybrid FDIA model that balances attack cost-benefit to obtain an attack measurement dataset;

[0009] S2: The GRU algorithm is used to extract time-series features from the attack measurement dataset, and the ELM algorithm is used to perform binary classification of the state of each node in the power system to obtain the GRU-ELM attack localization and detection algorithm.

[0010] S3: The hyperparameters of the GRU-ELM attack localization and detection algorithm are globally optimized based on the Bayesian optimization algorithm to obtain the optimal hyperparameter combination;

[0011] S4: Based on the optimal hyperparameter combination, a power grid FDIA location and detection algorithm based on BO-GRU-ELM is obtained to locate hybrid FDIA attacks and output the FDIA location and detection results.

[0012] Optionally, in S1, a hybrid FDIA model balancing attack cost-benefit is constructed to obtain the attack measurement dataset, specifically including the following steps:

[0013] S11: Taking into account both attack costs and benefits, the attack strategy is transformed into an optimization problem, with the objective function being:

[0014] min F=min(f attack -k×f power )

[0015] In the formula: f attack =||h(x) a )-h(x)||0 indicates the sparsity of the attack vector. Indicates the cost of electricity generation; x a h(x) represents the estimated state after the attack. a Let ) represent the measurement value after the attack, x represent the state estimate before the attack, and h(x) represent the measurement value before the attack. The output active power of the generator is represented by , where a represents the coefficient of the quadratic term, b represents the coefficient of the linear term, c represents the constant term, and k represents the balance coefficient.

[0016] S12: The following constraints are also listed for the above objective function:

[0017]

[0018] In the formula: x i and V represents the state estimates before and after the attack, respectively. i and θ iThese represent the state estimates of voltage magnitude and phase angle, respectively. Ω represents the deviation of the state estimate after the attack. net x represents the set of nodes in a power system. imin x represents the minimum state value. imax This indicates the maximum value of the state.

[0019] The state estimates before and after the attack x i and Substituting the formula for the FDIA attack construction principle, we obtain the following equation:

[0020]

[0021] In the formula: This represents SCADA measurement attack vector data, including node voltage amplitude, node active power, node reactive power, line active power, and line reactive power. This represents the PMU measurement attack vector data, including node voltage magnitude and phase angle, and the real and imaginary parts of the line current;

[0022]

[0023] In the formula: P represents the spurious load value of node i. di This represents the actual load value of node i. This indicates the load deviation value intentionally injected by the attacker;

[0024] The power balance formula for each node in the system is:

[0025]

[0026] In the formula: This represents the generator injection power at node i; The injected power at node i is equal to the difference between the power flowing into and out of node i; the active and reactive power injected by the generator must meet the set maximum and minimum value constraints [P]. gimin ,P gimax ] and [Q gimin Q gimax ].

[0027] Optionally, in S2, the GRU-ELM attack localization and detection algorithm is obtained, which specifically includes the following steps:

[0028] S21: Use GRU to extract features from the attack measurement dataset to obtain the hidden layer output matrix H;

[0029] S22: Use the hidden layer output matrix H of GRU as the input matrix of ELM hidden layer. Use ELM to perform binary classification and label determination on the status of each node in the power system. A label of 0 indicates that the detection result is normal, and a label of 1 indicates that the detection result is abnormal.

[0030] S23: Calculate the loss function L based on binary classification cross-entropy. The overall loss function L is defined as the loss function L for each dimension. j The sum, expressed as follows:

[0031]

[0032] In the formula: n represents the number of samples, c represents the output dimension, and t ij Represents the true value, y ij Indicates the predicted value;

[0033] S24: Gradient optimization of the GRU weight function is performed based on error backpropagation, using ELM as the output, and the loss function is applied to the GRU unit output h. ij The gradient changes, and the updated gradient is shown in the following equation:

[0034]

[0035] Where: β + This represents the inverse matrix of the output weight β;

[0036] Obtain the loss function with respect to the GRU parameters W z W r W h The gradient is calculated, and the weights are optimized based on the following formula:

[0037]

[0038] In the formula: W (k+1) W represents the weight at time k+1. (k) Let represent the weights at time k, η represent the learning rate, and L represent the loss function.

[0039] Optionally, in S22, ELM directly calculates the output weights by randomly initializing the weights and using the least squares method, without iterative training. The specific details are as follows:

[0040] Based on the hidden layer output matrix H obtained from S21, let the output weights be β=[β1,…,β c ] T ∈R c×k The formula for calculating the output layer Y from the hidden layer H is as follows:

[0041] βH=Y

[0042] For the objective function min||βH-Y||2 The output weight β, obtained using the least squares method, is:

[0043] β=YH +

[0044] Where: H + Let H denote the Moore-Penrose generalized inverse of matrix H.

[0045] Optionally, in S3, obtaining the optimal hyperparameter combination involves the following steps:

[0046] S31: The attack-type data samples are balanced by using synthetic minority oversampling technology to obtain the model training dataset;

[0047] S32: The objective function f(x) is approximated by constructing a probabilistic surrogate model through a Gaussian process, i.e., the F2 score;

[0048] S33: Select the next most promising combination of hyperparameters based on the acquisition function EI+, and re-evaluate the objective function;

[0049] S34: Repeat S32 and S33, and continuously optimize through iteration until the convergence condition or the number of iterations is met, output the best historical evaluation point, and obtain the best combination of hyperparameters.

[0050] A fake data injection attack localization and detection system based on an improved extreme learning machine, comprising executing any of the above-described fake data injection attack localization and detection methods based on an improved extreme learning machine, including:

[0051] The data acquisition module is used to construct a hybrid FDIA model that balances attack cost-benefit, and obtain an attack measurement dataset.

[0052] The algorithm establishment module is used to extract time-series features from the attack measurement dataset using the GRU algorithm and perform binary classification of the state of each node in the power system using the ELM algorithm to obtain the GRU-ELM attack location and detection algorithm.

[0053] The BO algorithm optimization module is used to globally optimize the hyperparameters of the GRU-ELM attack location and detection algorithm using the Bayesian optimization algorithm to obtain the best hyperparameter combination.

[0054] The location detection module is used to obtain a BO-GRU-ELM-based power grid FDIA location detection algorithm based on the optimal hyperparameter combination, locate hybrid FDIA attacks, and output FDIA location detection results.

[0055] As can be seen from the above technical solution, compared with the prior art, the present invention discloses a method and system for locating and detecting spoofing data injection attacks based on an improved extreme learning machine, which has the following beneficial effects:

[0056] (1) This invention constructs a hybrid FDIA model that balances attack cost and benefit, which breaks through the limitation of traditional FDIA attacks that only focus on the system's operating state and can more comprehensively reflect the diverse characteristics of actual attacks.

[0057] (2) This invention proposes an FDIA localization detection architecture based on GRU-ELM, which deeply mines the temporal features of measurement data and introduces an error backpropagation mechanism to optimize and improve the weight function of GRU, thereby improving the accuracy of feature extraction and the stability of detection results.

[0058] (3) The present invention designs a GRU hyperparameter adaptive tuning scheme based on Bayesian optimization. Compared with the traditional heuristic algorithm, it can significantly improve the running efficiency of FDIA positioning and detection algorithm while maintaining optimization accuracy.

[0059] (4) This invention can efficiently and accurately detect and locate hybrid FDIA attacks, providing an important basis for power system security defense, post-event analysis, and anomaly repair. Attached Figure Description

[0060] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0061] Figure 1 A flowchart of the spoofing attack localization and detection method based on an improved extreme learning machine provided by the present invention;

[0062] Figure 2 A comparison chart of measurement data before and after the attack provided by this invention;

[0063] Figure 3 A comparison diagram of state estimation results before and after the attack provided by this invention;

[0064] Figure 4 The loss function descent curve provided for this invention;

[0065] Figure 5 The Bayesian optimization convergence curve provided by this invention;

[0066] Figure 6 A flowchart of the FDIA positioning and detection algorithm based on BO-GRU-ELM provided by this invention;

[0067] Figure 7This invention provides a power system node FDIA detection accuracy diagram. Detailed Implementation

[0068] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0069] This invention discloses a method for locating and detecting spoofing data injection attacks based on an improved extreme learning machine, such as... Figure 1 As shown, it includes the following steps:

[0070] S1: Construct a hybrid FDIA model that balances attack cost-benefit to obtain an attack measurement dataset;

[0071] S2: The GRU algorithm is used to extract time-series features from the attack measurement dataset, and the ELM algorithm is used to perform binary classification of the state of each node in the power system to obtain the GRU-ELM attack localization and detection algorithm.

[0072] S3: The hyperparameters of the GRU-ELM attack localization and detection algorithm are globally optimized based on the Bayesian optimization algorithm to obtain the optimal hyperparameter combination, thereby further improving the accuracy of the attack detection model.

[0073] S4: Based on the optimal hyperparameter combination, a power grid FDIA location and detection algorithm based on BO-GRU-ELM is obtained to locate hybrid FDIA attacks and output the FDIA location and detection results.

[0074] Furthermore, in S1, a hybrid FDIA model balancing attack costs and benefits is constructed to obtain the attack measurement dataset, specifically including the following steps:

[0075] S11: Taking into account both attack costs and benefits, the attack strategy is transformed into an optimization problem, with the objective function being:

[0076] min F=min(f attack -k×f power )

[0077] In the formula: f attack =||h(x) a )-h(x)||0 indicates the sparsity of the attack vector. Indicates the cost of electricity generation; x a h(x) represents the estimated state after the attack. aLet ) represent the measurement value after the attack, x represent the state estimate before the attack, and h(x) represent the measurement value before the attack. The output active power of the generator is represented by , where a represents the coefficient of the quadratic term, b represents the coefficient of the linear term, c represents the constant term, and k represents the balance coefficient.

[0078] Specifically, FDIA attacks in power systems target system instability, economic losses, and power outages. Currently, most research focuses on analyzing the operational state of power systems. However, from an economic perspective, load redistribution attacks that manipulate load demand data, forcing generation resource scheduling to deviate from optimal conditions, can increase the overall generation cost of the power system. Furthermore, attackers often aim to cause significant damage at low cost. However, these two goals are contradictory: the greater the attack's effectiveness—the more system state values ​​affected and the larger the deviation—the more measurement units need to be manipulated, resulting in higher attack costs and a higher probability of detection. Simultaneously, considering the attack vector sparsity f... attack and power generation cost f power They have different orders of magnitude. Therefore, this embodiment introduces a balance coefficient k. By adjusting the value of k, the importance ratio of the two in the objective function F is changed, thereby obtaining an optimal objective optimization function that balances sparsity and power generation cost. Through example simulation verification, this embodiment selects k = 1.5.

[0079] S12: The following constraints are also listed for the above objective function:

[0080]

[0081] In the formula: x i and V represents the state estimates before and after the attack, respectively. i and θ i These represent the state estimates of voltage magnitude and phase angle, respectively. Ω represents the deviation of the state estimate after the attack. net x represents the set of nodes in a power system. imin x represents the minimum state value. imax This represents the maximum state value; this formula shows the deviation constraint of FDIA on the state estimate, ensuring the voltage amplitude V after the attack. i and phase angle θ i Estimated value x i Still within the non-alarm range [x] imin ,x imax ]Inside;

[0082] The state estimates before and after the attack x i and Substituting the formula for the FDIA attack construction principle, we obtain the following equation:

[0083]

[0084] In the formula: This represents SCADA measurement attack vector data, including node voltage amplitude, node active power, node reactive power, line active power, and line reactive power. This represents the attack vector data measured by the PMU, including the node voltage magnitude and phase angle, and the real and imaginary parts of the line current. This formula ensures that the residuals of the system remain unchanged before and after the attack, which means that it can successfully pass the power system's bad data detection.

[0085]

[0086] In the formula: P represents the spurious load value of node i. di This represents the actual load value of node i. This indicates a load deviation value intentionally injected by the attacker to construct false load demand data;

[0087] The power balance formula for each node in the system is:

[0088]

[0089] In the formula: This represents the generator injection power at node i; The injected power at node i is equal to the difference between the power flowing into and out of node i. This can be simplified to obtain generator P. g The calculation formula; the active and reactive power injected by the generator must meet the set maximum and minimum value constraints [P] gimin ,P gimax ] and [Q gimin Q gimax ].

[0090] Specifically, in the simulation example, the measurement data and state estimation results of the power system before and after the FDIA attack are as follows: Figure 2 , Figure 3 As shown, the attack effectively caused some nodes to shift, and the power generation cost of the power system increased from 7.3729e+03 to 1.84e+04 after the attack, resulting in economic losses for the power system.

[0091] Furthermore, in S2, the GRU-ELM attack localization and detection algorithm is obtained, which specifically includes the following steps:

[0092] S21: Use GRU to extract features from the attack measurement dataset to obtain the hidden layer output matrix H;

[0093] Specifically, power measurement data mainly includes key parameters such as node voltage amplitude, phase angle, line current, and active and reactive power, exhibiting time-series characteristics related to the cyclical fluctuations of power grid load. In-depth analysis of time-series characteristics such as voltage volatility and power trends can improve the accuracy of data feature extraction, providing reliable support for FDIA detection in power systems. The Gated Recurrent Unit (GRU), a variant of the Long Short-Term Memory (LSTM) network, is suitable for processing time-series data and reduces model complexity by simplifying the control gate structure. Based on this characteristic, GRU has significant advantages in real-time FDIA attack detection tasks, enabling rapid response and mitigation of the attack's impact on the system.

[0094] By controlling the update and reset gates, the GRU unit can efficiently capture the temporal features contained in the measurement data, while avoiding the problems of gradient vanishing or exploding, as shown below:

[0095] z t =σ(W z ·[h t-1 ,x t ])

[0096] r t =σ(W r ·[h t-1 ,x t ])

[0097] h' t =tanh(W h ·[r t ⊙h t-1 ,x t ])

[0098] h t =(1-z) t )⊙h t-1 +z t ⊙h' t

[0099] In the formula: x t h represents the input state of the GRU unit at time t; t-1 h t W represents the output state of the GRU unit at times t-1 and t, respectively; z W r W h These represent update gate z. t Reset door r t Hidden layer h' tThe weight matrix is ​​denoted by σ and tanh, where σ represents the sigmoid function and ⊙ represents the element-wise product of vectors. The update gate determines the degree of information transmission, while the reset gate controls the degree of information forgetting. The hidden layer state h' of the measured features at time t is calculated. t Combined with updating the gate pair h t-1 and h' t By summing the results, we can obtain the output state h of the GRU unit at time t. t That is, the time-series characteristic value of the measurement data.

[0100] S22: Use the hidden layer output matrix H of GRU as the input matrix of ELM hidden layer. Use ELM to perform binary classification and label determination on the status of each node in the power system. A label of 0 indicates that the detection result is normal, and a label of 1 indicates that the detection result is abnormal.

[0101] Specifically, ELM is a fast single-hidden-layer feedforward neural network algorithm that directly calculates output weights by randomly initializing weights and using the least squares method, without the need for iterative training. Due to its simplicity, efficiency, and suitability for large-scale data, the ELM algorithm is widely used in attack detection.

[0102] For an ELM model with k hidden layer neurons, based on the hidden layer output matrix H obtained from S21, let the output weights be β=[β1,…,β c ] T ∈R c×k The formula for calculating the output layer Y from the hidden layer H is as follows:

[0103] βH=Y

[0104] For the objective function min||βH-Y|| 2 The output weight β, obtained using the least squares method, is:

[0105] β=YH +

[0106] Where: H + Let H denote the Moore-Penrose generalized inverse of matrix H.

[0107] Meanwhile, the ELM algorithm features multiple inputs and multiple outputs, enabling the detection and location of attacks on power system node state estimates through a multi-label binary classification method. In practical applications, the output result y is labeled based on the following formula:

[0108]

[0109] In this context, a label of 0 indicates a normal test result, while a label of 1 indicates an abnormal test result.

[0110] S23: Calculate the loss function L based on binary classification cross-entropy. Since the output is multi-dimensional, the overall loss function L is defined as the loss function L for each dimension. j The sum, expressed as follows:

[0111]

[0112] In the formula: n represents the number of samples, c represents the output dimension, and t ij Represents the true value, y ij Indicates the predicted value;

[0113] S24: Gradient optimization of the GRU weight function is performed based on error backpropagation, using ELM as the output, and the loss function is applied to the GRU unit output h. ij The gradient changes, and the updated gradient is shown in the following equation:

[0114]

[0115] Where: β + This represents the inverse matrix of the output weight β;

[0116] Obtain the loss function with respect to the GRU parameters W z W r W h The gradient is calculated, and the weights are optimized based on the following formula:

[0117]

[0118] In the formula: W (k+1) W represents the weight at time k+1. (k) Let represent the weights at time k, η represent the learning rate, and L represent the loss function.

[0119] Specifically, traditional ELM suffers from instability due to random weight initialization, while the BP mechanism stabilizes the output through error backpropagation and iterative optimization. Furthermore, GRU, as a differentiable neural network, can fully utilize gradient optimization when combined with the BP mechanism, improving the accuracy of feature extraction from measurement data and significantly enhancing the algorithm's performance and accuracy. The BP algorithm is a classic method in neural network training; it adjusts network parameters through gradient descent, causing the loss function to gradually converge to its minimum, thus optimizing the model. The descent curve of the loss function is shown below. Figure 4 As shown, although the loss function fluctuates, the overall trend is significantly downward, with the loss value decreasing from 0.011 to 0.0029 and eventually stabilizing, thus verifying the effectiveness of the error backpropagation algorithm.

[0120] Furthermore, in S3, the optimal combination of hyperparameters is obtained, specifically including the following steps:

[0121] S31: Dataset preprocessing: Attack data samples are balanced using the Synthetic Minority Over-sampling Technique (SMOTE) to obtain the model training dataset;

[0122] Specifically, the multidimensional measurement data generated by the hybrid FDIA model is used as input and divided into training and testing sets. To address the imbalance between attack and normal data in the dataset, a synthetic minority oversampling technique is employed to balance the attack data samples.

[0123] S32: The objective function f(x) is approximated by constructing a probabilistic surrogate model using Gaussian Processes (GPs), i.e., the F2 score;

[0124] S33: Select the next most promising combination of hyperparameters based on the acquisition function EI+, and re-evaluate the objective function;

[0125] S34: Repeat S32 and S33, and continuously optimize through iteration until the convergence condition or the number of iterations is met, output the best historical evaluation point, and obtain the best combination of hyperparameters.

[0126] Specifically, the Bayesian Optimization (BO) algorithm mainly consists of two core parts: a probabilistic surrogate model and a data acquisition function. Its core idea is to approximate the objective function by constructing a surrogate model and then combining it with the data acquisition function to select the most promising parameter combination, gradually approaching the global optimum. In the FDIA localization detection algorithm of this embodiment, the probabilistic surrogate model approximates the objective function f(x) through a Gaussian process. The data acquisition function guides the hyperparameter optimization process; this embodiment uses EI+ to select the next most promising hyperparameter combination. To address the gradient fluctuations and noise issues that may exist in GRU-ELM training under hybrid FDIA scenarios, EI+ introduces a smoothing factor based on the traditional Expected Improvement (EI) method, enhancing the algorithm's robustness to complex attack data and enabling it to efficiently select the optimal parameter combination, thereby improving the convergence efficiency of the FDIA localization detection model and the accuracy of attack feature recognition.

[0127] Furthermore, the performance of the GRU-ELM algorithm is significantly affected by hyperparameters such as learning rate, batch size, and number of hidden layer units. To maximize the performance of the attack detection algorithm, this embodiment uses the F2 score as the objective function and employs the Bayesian optimization algorithm to optimize these hyperparameters. The convergence curve of the Bayesian optimization process is shown below. Figure 5As shown, through continuous iterative optimization, the best F2 score of 0.9863 was finally obtained, and the corresponding optimal hyperparameter combination was: learning rate 0.02, batch size 124, and number of hidden layer units 85.

[0128] This embodiment combines the adaptive and efficient parameter optimization capabilities of Bayesian optimization, the temporal feature extraction capabilities of GRU, and the fast and accurate classification capabilities of ELM to propose an attack localization and detection method based on Bayesian optimized GRU-ELM, achieving accurate localization and detection of FDIA. The specific architecture and process of the algorithm are as follows: Figure 6 As shown.

[0129] and Figure 1 Corresponding to the method described above, this embodiment of the invention also provides a fake data injection attack localization and detection system based on an improved extreme learning machine, used for detecting... Figure 1 The specific implementation of the method, a fake data injection attack localization and detection system based on an improved extreme learning machine provided in this embodiment of the invention, can be applied to computer terminals or various mobile devices, specifically including:

[0130] The data acquisition module is used to construct a hybrid FDIA model that balances attack cost-benefit, and obtain an attack measurement dataset.

[0131] The algorithm establishment module is used to extract time-series features from the attack measurement dataset using the GRU algorithm and perform binary classification of the state of each node in the power system using the ELM algorithm to obtain the GRU-ELM attack location and detection algorithm.

[0132] The BO algorithm optimization module is used to globally optimize the hyperparameters of the GRU-ELM attack location and detection algorithm using the Bayesian optimization algorithm to obtain the best hyperparameter combination.

[0133] The location detection module is used to obtain a BO-GRU-ELM-based power grid FDIA location detection algorithm based on the optimal hyperparameter combination, locate hybrid FDIA attacks, and output FDIA location detection results.

[0134] To further analyze and verify the effectiveness of the algorithm proposed in this embodiment, accuracy was used as the evaluation index. Simulations were performed on three FDIA positioning and detection algorithms: BO-GRU-ELM, GRU-ELM, and ELM. The experimental results are as follows: Figure 7 As shown. Figure 7As shown, the BO-GRU-ELM algorithm exhibits good detection performance on almost all nodes. Specifically, it significantly outperforms the other two methods in amplitude detection at nodes 6, 10, and 13, further validating the effectiveness of the proposed algorithm. Overall, the algorithms demonstrate significantly better performance in phase angle detection than in amplitude detection, indicating that phase angle features may be more discriminative in FDIA detection. In conclusion, the BO-GRU-ELM algorithm demonstrates superior performance in FDIA detection and localization, effectively improving the safety of power systems.

[0135] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple; relevant parts can be referred to the method section.

[0136] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An improved extreme learning machine based false data injection attack positioning detection method, characterized in that, Comprising the following steps: S1: construct an attack cost-benefit balanced hybrid FDIA model to obtain an attack measurement data set; S2: adopt a GRU algorithm to extract time sequence features of the attack measurement data set, and perform two classification on states of each node of the power system through an ELM algorithm to obtain a GRU-ELM attack positioning detection algorithm; S3: based on a Bayesian optimization algorithm, globally optimize hyperparameters of the GRU-ELM attack positioning detection algorithm to obtain an optimal hyperparameter combination; S4: based on the optimal hyperparameter combination, obtain a BO-GRU-ELM-based power grid FDIA positioning detection algorithm, position a hybrid FDIA attack, and output an FDIA positioning detection result; In S1, the attack cost-benefit balanced hybrid FDIA model is constructed to obtain the attack measurement data set, specifically comprising the following steps: S11: considering the attack cost and the attack benefit, the attack strategy is converted into an optimization problem, and the objective function is: wherein: represents attack vector sparsity, represents generation cost; represents post-attack state estimate, represents post-attack measurement, x represents pre-attack state estimate, represents pre-attack measurement, represents generator output real power, a represents quadratic coefficient, b represents linear coefficient, c represents constant term, k represents balancing coefficient; S12: for the above objective function, the following constraint conditions are listed: In the formulae: and denote state estimation values before and after the attack, respectively, and denote state estimation values of voltage amplitude and phase angle, respectively, denotes the state estimation value deviation after the attack, denotes the power system node set, denotes the state value minimum, denotes the state value maximum; The state estimation values before and after the attack and Substituting the FDIA attack construction principle formula, the following formula can be obtained: wherein: represents SCADA measurement attack vector data, including node voltage magnitude, node active power, node reactive power, line active power, and line reactive power; represents PMU measurement attack vector data, including node voltage magnitude and phase angle, line current real part and imaginary part; In the formula: represents the false load value of the node i , represents the real load value of the node i , represents the load deviation value intentionally injected by the attacker; The power balance formula of each node of the system is: where: Pgenrepresents the generator injection power at node i . Pnodeinjrepresents the node injection power, equal to the difference between the power flowing into the lines and the power flowing out of the lines at node i . The generator injection active and reactive power must satisfy the set maximum and minimum constraints and .

2. The false data injection attack positioning and detection method based on improved extreme learning machine according to claim 1, characterized in that, In S2, the GRU-ELM attack positioning detection algorithm is obtained, specifically comprising the following steps: S21: using GRU to perform feature extraction on the attack measurement data set to obtain a hidden layer output matrix H ; S22: the hidden layer output matrix of the GRU H As the input matrix of the ELM hidden layer, the power system node state is classified by the ELM, and the label is 0, indicating that the detection result is normal, and the label is 1, indicating that the detection result is abnormal. S23: Calculate the loss function based on binary cross-entropy L , the overall loss function L is defined as the sum of the loss functions of each dimension , expressed as follows: In the formula: n denotes the number of samples, c denotes the output dimension, denotes the true value, denotes the predicted value; S24: Gradient optimization is performed on the GRU weight function based on error back propagation, ELM is used as the output, and the loss function is changed for the gradient of the GRU unit output The updated gradient is as follows: In the formulae: denotes the inverse matrix of the output weight ; The gradient of the acquisition loss function with respect to the GRU parameters is computed and the optimization of the weights is implemented based on the following equation: In the formula: represents k the weight value at time t, represents k the weight value at time t, represents the learning rate, L represents the loss function.

3. The false data injection attack positioning and detection method based on improved extreme learning machine according to claim 2, characterized in that, In S22, the ELM directly calculates the output weight through random initialization of the weight and the least square method without iterative training, and the specific content is: The hidden layer output matrix obtained based on S21 H , let the output weight be , then the hidden layer H to the output layer Y The calculation formula is represented as: For the objective function , the output weight is solved based on the least square method : In the formulae: denotes the Moore-Penrose generalized inverse of the matrix H.

4. The false data injection attack positioning and detection method based on improved extreme learning machine according to claim 1, characterized in that, In S3, the optimal hyperparameter combination is obtained, specifically comprising the following steps: S31: through the use of the synthetic minority over-sampling technique, the attack class data samples are balanced to obtain a model training data set; S32: Constructing a probabilistic surrogate model by a Gaussian process to approximate the objective function i.e., F2 score; S33: based on the acquisition function EI+, the next most potential hyperparameter combination is selected, and the objective function is re-evaluated; S34: repeat S32 and S33, and through continuous iterative optimization, until the convergence condition or the iteration number is met, the best historical evaluation point is output, and the optimal hyperparameter combination is obtained.

5. An improved extreme learning machine based false data injection attack localization detection system, characterized in that, The improved extreme learning machine-based false data injection attack positioning detection method according to any one of claims 1-4 is executed, comprising: A data acquisition module is configured to construct an attack cost-benefit balanced hybrid FDIA model to obtain an attack measurement data set; An algorithm establishment module is configured to adopt a GRU algorithm to extract time sequence features of the attack measurement data set, and perform two classification on states of each node of the power system through an ELM algorithm to obtain a GRU-ELM attack positioning detection algorithm; A BO algorithm optimization module is configured to globally optimize hyperparameters of the GRU-ELM attack positioning detection algorithm through a Bayesian optimization algorithm to obtain an optimal hyperparameter combination; A positioning detection module is configured to obtain a BO-GRU-ELM-based power grid FDIA positioning detection algorithm based on the optimal hyperparameter combination, position a hybrid FDIA attack, and output an FDIA positioning detection result.

Images