Power system attack detection method and device and electronic equipment

Abstract

The invention provides an electric power system attack detection method and device and electronic equipment, and belongs to the technical field of electric power system security, and the method comprises the steps: determining a target detection parameter based on a preset false alarm probability and a preset detection probability, and during attack detection, according to an obtained real-time graph model of a to-be-detected electric power system and a corresponding graph Laplacian matrix, determining a target detection parameter of the to-be-detected electric power system; and determining the frequency characteristics of the corresponding graph signals according to the target detection parameters, further detecting the real-time state of the to-be-detected power system based on the target detection parameters and the frequency characteristics, and determining the attack detection result of the to-be-detected power system. Wherein the preset false alarm probability and the preset detection probability can be determined according to the actual situation, the actual detection demand is fully considered, the missed alarm risk and false alarm interference are effectively balanced, the credibility of the detection result is improved, and the real-time state of the power system is detected according to the target detection parameter. The method can accurately identify the fine abnormal change in the operation process of the power system, and improves the attack detection precision.

Description

Technical Field

[0001] The present invention relates to the field of power system security technology, and in particular to a power system attack detection method, device and electronic equipment. Background Art

[0002] The core of power system cybersecurity technology is to ensure the safety, stability, and reliability of power systems in the face of cyberattacks. In recent years, with the increasing complexity and automation of power systems, cybersecurity issues have become increasingly prominent. False data injection attacks, a typical cybersecurity threat, can tamper with sensor data and manipulate state estimation processes, potentially leading to serious power outages and economic losses.

[0003] Most related technologies use fixed detection thresholds or static feature extraction methods to assess power system data quality, detect network anomalies, and identify erroneous data. However, these methods cannot accurately capture the characteristics of the power system's real-time operating conditions and are slow to respond to attack-induced fluctuations, resulting in poor detection accuracy and a failure to meet the requirements for reliable power system operation. Summary of the Invention

[0004] Embodiments of the present invention provide a power system attack detection method, device, and electronic equipment to solve the problem of low attack detection accuracy.

[0005] In a first aspect, an embodiment of the present invention provides a method for detecting an attack on a power system, comprising:

[0006] Acquire a real-time graph model of the power system to be detected, and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model;

[0007] Performing eigendecomposition on the graph Laplacian matrix to obtain frequency characteristics of the graph signal;

[0008] According to the target detection parameters and the frequency characteristics, the real-time status of the power system to be detected is detected and processed to determine the attack detection result of the power system to be detected; wherein, the target detection parameters are determined based on a preset false alarm probability and a preset detection probability.

[0009] In one possible implementation, the target detection parameters include a target cutoff frequency and a target detection threshold; the target cutoff frequency is determined based on at least one of the preset false alarm probability and the preset detection probability, and the target detection threshold is determined based on at least one of the preset false alarm probability and the preset detection probability;

[0010] The detecting and processing the real-time state of the power system to be detected based on the target detection parameter and the frequency characteristics to determine the attack detection result of the power system to be detected includes:

[0011] Adjusting the frequency characteristic according to the target cutoff frequency to obtain an adjusted image signal;

[0012] Calculating the signal energy corresponding to the image signal after the adjustment process; wherein the signal energy represents the abnormality degree of the image signal after the adjustment process;

[0013] If the signal energy is greater than the target detection threshold, it is determined that the power system to be detected is attacked;

[0014] If the signal energy is less than or equal to the target detection threshold, it is determined that the power system to be detected has not been attacked.

[0015] In one possible implementation, before detecting and processing the real-time state of the power system to be detected based on the target detection parameter and the frequency characteristics and determining the attack detection result of the power system to be detected, the method further includes:

[0016] Obtaining a normal graph model of the power system to be detected when it is not attacked, and performing attack detection on the normal graph model based on a plurality of preset detection parameters, and determining a false alarm probability corresponding to each detection parameter;

[0017] Acquire an abnormal graph model of the power system to be detected when it is attacked, perform attack detection on the abnormal graph model based on the multiple detection parameters, and determine a detection probability corresponding to each detection parameter;

[0018] Obtaining a receiver operating characteristic curve corresponding to the power system to be detected based on false alarm probabilities and detection probabilities corresponding to a plurality of detection parameters;

[0019] The target detection parameters are determined based on the receiver operating characteristic curve, the preset false alarm probability, and the preset detection probability.

[0020] In a possible implementation, the eigendecomposition of the graph Laplacian matrix to obtain the frequency characteristics of the graph signal includes:

[0021] Performing eigenvalue decomposition on the graph Laplacian matrix to obtain a corresponding eigenvector matrix and an eigenvalue diagonal matrix; wherein each column of the eigenvector matrix represents a vibration mode of the graph signal, and each eigenvalue in the eigenvalue diagonal matrix represents a frequency of the graph signal in the corresponding vibration mode;

[0022] The frequency characteristics of the image signal are determined according to the eigenvector matrix and the eigenvalue diagonal matrix.

[0023] In a possible implementation, adjusting the frequency characteristic according to the target cutoff frequency to obtain an adjusted image signal includes:

[0024] according to Get the frequency response function corresponding to the graph signal; where λ i is the i-th eigenvalue in the eigenvalue diagonal matrix, f id (λ i ) is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix, λ cut is the target cutoff frequency;

[0025] According to the frequency response function, a frequency response matrix corresponding to the image signal is obtained; wherein the i-th diagonal element in the frequency response matrix is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix;

[0026] The image signal is subjected to frequency domain conversion processing according to the eigenvector matrix, and the frequency characteristics of the converted image signal are adjusted based on the frequency response matrix to obtain the adjusted image signal.

[0027] In one possible implementation, obtaining a real-time graphical model of the power system to be detected includes:

[0028] Mapping the busbars in the power system to be detected to a node set of the real-time graph model, mapping the transmission lines in the power system to be detected to an edge set of the real-time graph model, and mapping the admittance value of each transmission line to weight information of the corresponding edge, thereby obtaining a graph structure mapped to the power system to be detected; wherein the weight information represents the contribution of the admittance value of the corresponding transmission line to the real-time graph model;

[0029] Real-time measurement data corresponding to preset measurement points in the power system to be detected is obtained, and the real-time measurement data is mapped to the graph structure to obtain the real-time graph model; wherein the types of the preset measurement points include power injection measurement points and power flow measurement points.

[0030] In a possible implementation, obtaining a graph Laplacian matrix corresponding to the real-time graph model includes:

[0031] According to the edge set and the weight information of each edge, the graph Laplacian matrix corresponding to the real-time graph model is constructed; wherein L k,l is the matrix element in the graph Laplace matrix. When k=l, L k,lis the sum of the weights of all edges connected to node k, denoted as m represents the node connected to node k; when (k, l)∈edge set ξ, then L k,l =-ω k,l ,ω k,l is the weight of the edge (k, l) in the real-time graph model; in other cases, L k,l =0.

[0032] In a possible implementation, before obtaining the graph Laplacian matrix corresponding to the real-time graph model, the method further includes:

[0033] Determining a measurement matrix corresponding to the real-time graph model according to the type of preset measurement points in the real-time graph model and the admittance value of each transmission line; wherein the measurement matrix is used to characterize the measurement relationship of the power system to be detected;

[0034] Based on the measurement matrix, data cleaning processing is performed on the real-time measurement data.

[0035] In a second aspect, an embodiment of the present invention provides a power system attack detection device, the method and device comprising:

[0036] A first processing unit is configured to obtain a real-time graph model of the power system to be detected and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model;

[0037] a second processing unit, configured to perform eigendecomposition on the graph Laplacian matrix to obtain frequency characteristics of the graph signal;

[0038] A detection unit is used to detect and process the real-time status of the power system to be detected based on the target detection parameters and the frequency characteristics, and determine the attack detection result of the power system to be detected; wherein the target detection parameters are determined based on a preset false alarm probability and a preset detection probability.

[0039] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, it implements the power system attack detection method as described in the first aspect or any possible implementation of the first aspect.

[0040] Embodiments of the present invention provide a method, device, and electronic device for detecting attacks on a power system. These methods determine target detection parameters based on a preset false alarm probability and a preset detection probability. During attack detection, the method first determines the frequency characteristics of the corresponding graph signal based on a real-time graph model of the power system to be detected and its corresponding graph Laplacian matrix. Furthermore, the real-time state of the power system to be detected is detected and processed based on the target detection parameters and the frequency characteristics to determine an attack detection result for the power system to be detected. On the one hand, this embodiment determines the target detection parameters based on the preset false alarm probability and the preset detection probability. The preset false alarm probability and the preset detection probability can be determined based on actual conditions, fully considering the actual requirements for the accuracy and reliability of the detection results in different situations. This effectively balances the risk of missed alarms and the interference of false alarms, significantly improving the credibility of the detection results. On the other hand, by determining the frequency characteristics of the graph signal using the graph Laplacian matrix and then processing the real-time state based on the target detection parameters, the method can accurately identify subtle abnormal changes during power system operation, improve attack detection accuracy, effectively protect the power system, and ensure stable, safe, and efficient operation of the power system. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0042] Figure 1 This is a flowchart of an implementation method for detecting power system attacks provided by an embodiment of the present invention;

[0043] Figure 2 This is a flowchart of another method for detecting power system attacks provided by an embodiment of the present invention;

[0044] Figure 3 Schematic diagram of ROC curves for different attack types in a DC power system provided by an embodiment of the present invention;

[0045] Figure 4 Schematic diagram of ROC curves for different attack types in an AC power system provided by an embodiment of the present invention;

[0046] Figure 5 1 is a schematic diagram of the structure of a power system attack detection device provided by an embodiment of the present invention;

[0047] Figure 6 is a schematic diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0048] In the following description, specific details such as particular system structures and techniques are provided for purposes of illustration, not limitation, to facilitate a thorough understanding of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail. SUMMARY OF THE INVENTION

[0050] The core of power system cybersecurity technology is to ensure the safety, stability, and reliability of power systems when subjected to cyber attacks, and to enhance the resilience and response capabilities of power systems to cyber threats. In recent years, with the increasing complexity and automation of power systems, cybersecurity issues have become increasingly prominent. False data injection attacks, as a typical cybersecurity threat, can cause serious power accidents and economic losses by tampering with sensor data and manipulating state estimation processes. Currently, most data anomaly detection technologies for power system cybersecurity use fixed detection thresholds or static feature extraction methods, lacking adaptability and timeliness, resulting in low accuracy in detecting attacks on power systems.

[0051] In order to improve the accuracy of attack detection, in an embodiment of the present application, target detection parameters are determined based on a preset false alarm probability and a preset detection probability. When performing attack detection, first, based on the acquired real-time graph model of the power system to be detected and its corresponding graph Laplace matrix, the frequency characteristics of the corresponding graph signal are determined. Then, based on the target detection parameters and the frequency characteristics, the real-time state of the power system to be detected is detected and processed to determine the attack detection result of the power system to be detected. On the one hand, this embodiment determines the target detection parameters based on the preset false alarm probability and the preset detection probability. The preset false alarm probability and the preset detection probability can be determined according to actual conditions, which greatly improves the credibility of the detection results. On the other hand, by determining the frequency characteristics of the graph signal through the graph Laplace matrix and then processing the real-time state according to the target detection parameters, it is possible to accurately identify subtle abnormal changes in the operation of the power system, improve the accuracy of attack detection, and thus ensure the stable, safe, and efficient operation of the power system.

[0052] In order to make the purpose, technical solutions and advantages of the present invention more clear, specific embodiments will be described below with reference to the accompanying drawings.

[0053] Figure 1 The implementation flow chart of the new energy grid line loss quantification method provided in the embodiment of the present invention is detailed as follows:

[0054] Step 101: Acquire a real-time graph model of the power system to be detected and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model.

[0055] For example, the real-time graph model corresponding to the power system to be tested contains two key elements. On the one hand, there is the graph structure mapped to the power system to be tested. This is an abstraction and representation of the various electrical components in the power system (such as generators, transformers, transmission lines, etc.) and the connections between them, using graph theory methods. Specifically, the electrical components are abstracted as nodes in the graph, and the electrical connections between the components are represented as edges in the graph. This mapping method can clearly present the topological structure of the power system. On the other hand, there is the real-time measurement data corresponding to the power system to be tested. This data is collected in real time from pre-set measurement points in the power system and covers key parameters such as voltage, current, and power that reflect the operating status of the power system. Combining this real-time measurement data with the previously constructed graph structure forms a complete real-time graph model that can comprehensively and accurately reflect the actual operating status of the power system to be tested at a specific moment. After obtaining the real-time graph model, it is necessary to further calculate its corresponding graph Laplacian matrix. Specifically, the graph Laplacian matrix is calculated based on the graph's adjacency matrix and degree matrix, and can deeply characterize the connection relationships and interactions between nodes in the graph.

[0056] Step 102: Perform eigendecomposition on the graph Laplacian matrix to obtain the frequency characteristics of the graph signal.

[0057] For example, after obtaining the graph Laplacian matrix corresponding to the real-time graph model of the power system to be tested, eigendecomposition is performed on the graph Laplacian matrix to further analyze the characteristics of the graph signal it contains. Eigendecomposition converts the graph Laplacian matrix into a set of eigenvalues and eigenvectors. Eigenvalues are closely related to the frequency characteristics of the graph signal. By analyzing and interpreting these eigenvalues, the frequency characteristics corresponding to the graph signal can be accurately extracted.

[0058] Step 103 , based on the target detection parameters and frequency characteristics, the real-time status of the power system to be detected is detected and processed to determine the attack detection result of the power system to be detected; wherein the target detection parameters are determined based on the preset false alarm probability and the preset detection probability.

[0059] For example, this embodiment determines corresponding target detection parameters based on preset false alarm probabilities and preset detection probabilities, and then performs feature recognition on frequency features based on the target detection parameters to evaluate and detect the real-time status of the power system to be detected, thereby obtaining attack detection results for the power system to be detected. The preset false alarm probabilities and the preset detection probabilities can be determined based on actual conditions, such as the actual conditions of the power system in different application scenarios.

[0060] In summary, embodiments of the present invention provide a method for detecting attacks on a power system. Target detection parameters are determined based on a preset false alarm probability and a preset detection probability. During attack detection, the method first determines the frequency characteristics of the corresponding graph signal based on the acquired real-time graph model of the power system to be detected and its corresponding graph Laplacian matrix. Then, based on the target detection parameters and the frequency characteristics, the real-time state of the power system to be detected is detected and processed to determine an attack detection result for the power system to be detected. On the one hand, this embodiment determines the target detection parameters based on the preset false alarm probability and the preset detection probability. The preset false alarm probability and the preset detection probability can be determined based on actual conditions, fully considering the actual requirements for the accuracy and reliability of the detection results in different situations. This method can effectively balance the risk of missed alarms and the interference of false alarms, greatly improving the credibility of the detection results. On the other hand, by combining the graph Laplacian matrix to determine the frequency characteristics of the graph signal and then processing the real-time state based on the target detection parameters, it is possible to accurately identify subtle abnormal changes in the operation of the power system, improve the accuracy of attack detection, achieve effective protection of the power system, and ensure the stable, safe, and efficient operation of the power system.

[0061] In order to more accurately identify whether the power system has been attacked, this embodiment first maps the real-time graph model of the power system to be detected into a graph structure, then obtains the real-time measurement data corresponding to the preset measurement points in the power system to be detected, and maps the real-time measurement data to the graph structure to obtain a real-time graph model. This mapping method organically integrates the physical characteristics, power transmission characteristics and network topology characteristics of the power system, so that the system can keenly capture subtle data fluctuations and abnormal changes caused by attacks, and quickly identify and locate the position of abnormal points in the entire power system network; in addition, this embodiment also performs data cleaning on the real-time measurement data before performing graph Laplace matrix conversion on the graph model, which helps to remove noise in the data. After data cleaning, the graph Laplace matrix corresponding to the real-time graph model is constructed according to the edge set and the weight information of each edge to obtain the graph signal corresponding to the real-time graph model, thereby improving the accuracy of the real-time graph model and further improving the accuracy of the real-time graph model. The detection accuracy is improved in one step. At the same time, this embodiment pre-constructs a receiver operating characteristic curve corresponding to the target detection parameters of the power system to be detected based on the normal graph model of the power system to be detected when it is not attacked and the abnormal graph model of the power system to be detected when it is attacked. Then, the corresponding target detection parameters can be adaptively set according to actual detection requirements, such as the false alarm probability and the detection probability, to perform attack detection, thereby improving the adaptive ability of detection. When performing real-time detection according to the set target detection parameters, the eigenvector matrix and eigenvalue diagonal matrix corresponding to the graph Laplacian matrix are first obtained as the frequency characteristics of the graph signal, and then the frequency characteristics of the graph signal are adjusted based on the cutoff frequency in the target detection parameters, and the signal energy corresponding to the adjusted graph signal is calculated. Then, the signal energy is compared based on the target detection threshold in the target detection parameters, and based on the comparison result, it is determined whether the power system has been attacked. This embodiment performs attack detection based on the smoothness characteristics of the graph signal corresponding to the real-time graph model, effectively reducing the difficulty of detecting false data injection attacks, significantly reducing the reliance on additional hardware protection, and reducing the cost of system protection.

[0062] Figure 2 The following is a flowchart of another power system attack detection method provided by an embodiment of the present invention:

[0063] Step 201: Acquire a real-time graph model of the power system to be detected and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model.

[0064] In one example, step 201 includes the following steps:

[0065] The busbars in the power system to be tested are mapped into a set of nodes in a real-time graph model, the transmission lines in the power system to be tested are mapped into a set of edges in the real-time graph model, and the admittance value of each transmission line is mapped into the weight information of the corresponding edge to obtain the graph structure mapped by the power system to be tested; wherein the weight information represents the contribution of the admittance value of the corresponding transmission line to the real-time graph model.

[0066] Real-time measurement data corresponding to preset measurement points in the power system to be detected are obtained, and the real-time measurement data are mapped to a graph structure to obtain a real-time graph model; wherein the types of preset measurement points include power injection measurement points and power flow measurement points.

[0067] This embodiment first maps the real-time graph model of the power system to be detected into a graph structure, then obtains the real-time measurement data corresponding to the preset measurement points in the power system to be detected, and maps the real-time measurement data to the graph structure to obtain a real-time graph model. This mapping method organically integrates the physical characteristics, power transmission characteristics and network topology characteristics of the power system, enabling the system to keenly capture subtle data fluctuations and abnormal changes caused by attacks, and quickly identify and locate the position of abnormal points in the entire power system network.

[0068] According to the edge set and the weight information of each edge, the graph Laplacian matrix corresponding to the real-time graph model is constructed; where L k,l is the matrix element in the graph Laplace matrix. When k=l, L k,l is the sum of the weights of all edges connected to node k, denoted as m represents the node connected to node k; when (k, l)∈edge set ξ, then L k,l =-ω k,l ,ω k,l is the weight of the edge (k, l) in the real-time graph model; in other cases, L k,l =0.

[0069] The graph Laplacian matrix reflects the connection relationships and differences between nodes in the real-time graph model, as well as the key features of the real-time graph model. Subsequent analysis of the characteristics of the graph signal, such as the energy distribution of the signal, can effectively identify anomalies, helping to improve the efficiency and accuracy of attack detection.

[0070] In a feasible implementation, before obtaining the graph Laplacian matrix corresponding to the real-time graph model, the method further includes:

[0071] Based on the types of preset measurement points in the real-time graph model and the admittance value of each transmission line, the measurement matrix corresponding to the real-time graph model is determined; wherein the measurement matrix is used to characterize the measurement relationship of the power system to be tested; based on the measurement matrix, the real-time measurement data is cleaned.

[0072] This embodiment performs data cleaning on real-time measurement data, which helps to remove noise in the data, improve the accuracy of the real-time graph model, and further improve detection accuracy.

[0073] For example, this embodiment first collects the network topology information of the power system to be tested, records the bus node set V = {1, ..., N} of the power system to be tested, where V represents the bus node set in the system and N is the total number of buses. The set of transmission lines connecting the buses is recorded. Based on this information, a node connection relationship matrix is constructed, and the adjacent node set N of each node is marked. k , where N k is the set of nodes adjacent to node k. Node k is an element in V.

[0074] This embodiment maps the N buses in the power system to be tested into a graph node set V = {1,…,N}, recording the type of each node, such as generator node or load node. A node numbering rule is determined. Secondly, this embodiment maps the transmission lines in the power system to be tested into a graph edge set ξ. The edge connections are recorded in the form (k,l)∈V×V. (k,l) is an edge in the graph, indicating a connection between node k and node l, and V×V represents all possible connections between nodes.

[0075] For each edge (k, l), define its weight as:

[0076] ω k,l =-bk , l

[0077] Among them, ω k,l is the weight of edge (k, l), which represents the contribution of the admittance value of the transmission line to the graph model. k,l Is the admittance value between node k and node l, which represents the impedance or admittance characteristics of power transmission through these two points. When there is no connection between nodes k and l, ω k,l =0.

[0078] Thus, this embodiment obtains an undirected weighted graph G(V,ξ), including a complete set of nodes V, an edge set ξ, and weight information. Then obtain a real-time measurement data set M is the number of measurement points. A real-time graphical model corresponding to the power system to be tested is obtained. In this embodiment, the real-time measurement data may be real-time power measurement data. This embodiment records the type of each measurement point (power injection measurement point or power flow measurement point) and indicates the correspondence between each measurement point and the busbar.

[0079] Get the admittance value b of each transmission line k,n And record the physical parameters of the line, and finally establish the mapping relationship between system parameters and topology, b k,nrepresents the admittance value between node k and node n, which represents the impedance or admittance characteristics of power transmission through these two points. Node k and node n are both elements in V.

[0080] Among them, the measurement model of the power system can be expressed as:

[0081] z=Hθ+a+v

[0082] Where: z is an M-dimensional power measurement dataset containing power injection and power flow measurements; H is an M×N-dimensional measurement matrix reflecting the relationship between the measurements and the power system state; θ is an N-dimensional system state vector, such as the voltage phase; and a is an attack vector representing possible false data in the data. Therefore, this embodiment uses a real-time graphical model derived from real-time measurement data to perform power system state detection to determine whether the power system is under false data attack.

[0083] After obtaining the real-time graph model, this embodiment calculates the graph Laplacian matrix corresponding to the real-time graph model. In a feasible implementation, the element L of the graph Laplacian matrix L is k,l The definition is as follows:

[0084]

[0085] Among them, L k,l is the element of the graph Laplacian matrix. When k = l, L k,l is the degree of node k, that is, the sum of the weights of all edges connected to node k, denoted as When (k,l)∈ξ, it means that there is a connection between node k and node l, then L k,l =-ω k,l In other cases, L k,l =0.ω k,m It represents the weight of edge (k,m), which indicates the contribution of the admittance value of the transmission line to the graph model.

[0086] This results in an N×N-dimensional graph Laplacian matrix L. The graph Laplacian matrix has the following properties: (1) Matrix symmetry: L = L T ; (2) The row sum is zero: ∑L k,l =0; (3) Matrix semi-positive definiteness: x T Lx≥0, that is, the result of any non-zero vector x calculated by matrix L is greater than or equal to zero.

[0087] In a feasible implementation, before calculating the graph Laplacian matrix corresponding to the real-time graph model, this embodiment first constructs a measurement matrix H that accurately reflects the measurement relationship of the power system.

[0088] If the rth row of the measurement matrix H corresponds to the power flow measurement of line (k,n), then the matrix element Hr,j The composition is as follows:

[0089]

[0090] When j = k, the matrix element H r,k for b k,n , represents the admittance value from node k to n, characterizing the power flow characteristics on line (k,n). When j = n, the matrix element H r,n -b k,n , represents the negative admittance value from node n to k, reflecting the change in direction of the current. For other cases, the matrix element value is 0, indicating no direct impact.

[0091] If the rth row of the measurement matrix H is related to the power injection measurement of substation k, then the matrix element H r,j is calculated as follows:

[0092]

[0093] When j = k, the matrix element H r,k for That is, the sum of the admittance values from node k to all adjacent nodes, reflecting the total impact of power injection from node k to all adjacent nodes. k When the matrix element H r,j -b k,j , represents the negative impact of power injection from node k to adjacent node j, i.e., the negative impact of power transfer. For other cases, the matrix element value is 0, indicating no direct impact.

[0094] In one example, data cleaning includes the following steps:

[0095] (1) Noise elimination: This embodiment uses Kalman filtering for state estimation, and the updated state estimation is:

[0096]

[0097] in: is the current state estimation value, which represents the state of the power system to be detected after Kalman filtering; is the predicted state value, which represents the state of the power system to be tested estimated based on previous information; K k is the Kalman gain, which represents the weight adjustment coefficient between the current state estimate and the predicted state value; k is the current measurement value, which represents the real-time measurement data obtained from the sensor.

[0098] Among them, the Kalman gain K k The calculation formula is:

[0099] Kk =P k|k-1 H T (HP k|k-1 H T +R) -1

[0100] Where: P k|k-1 is the prediction error covariance matrix, which represents the uncertainty of system state prediction; H T is the transpose of the measurement matrix H.

[0101] (2) Data completion: This embodiment detects missing data points and uses interpolation to complete the missing data. The rationality of the completed data is also verified to ensure that it conforms to the physical characteristics of the power system.

[0102] In an example, the verification content may include one or more of the following: 1) Overall balance check: ensuring that the total power output of all nodes in the power grid matches the total load demand; 2) Inter-regional power balance: checking whether the power flow between regions is reasonable to ensure that there is no impossible large-scale power transmission; 3) Voltage constraint: the completed data should ensure that the voltage of all nodes fluctuates within the range allowed by the equipment to avoid being too high or too low; 4) Power limit: confirming that the power output of equipment such as generators and transmission lines does not exceed their rated capacity to prevent overload operation; 5) Line load check: confirming that the load of all transmission lines does not exceed its capacity limit after interpolation to prevent overload risks; 6) Mutation point check: checking whether there are sudden power changes and whether these changes are consistent with actual possible operations or fault conditions; 7) Line load check: confirming that the load of all transmission lines does not exceed its capacity limit after interpolation to prevent overload risks.

[0103] Step 202 , performing eigenvalue decomposition on the graph Laplace matrix to obtain a corresponding eigenvector matrix and an eigenvalue diagonal matrix; wherein each column of the eigenvector matrix represents a vibration mode of the graph signal, and each eigenvalue in the eigenvalue diagonal matrix represents the frequency of the graph signal in the corresponding vibration mode.

[0104] Exemplarily, this embodiment performs eigenvalue decomposition on the graph Laplacian matrix L:

[0105] L=UΛU T

[0106] Where: U is the eigenvector matrix, each column represents a vibration mode; Λ is the eigenvalue diagonal matrix, each eigenvalue represents the frequency of the corresponding vibration mode; U T is the transpose of U.

[0107] Sort the eigenvalues in ascending order:

[0108] λ1=0<λ2≤…≤λN

[0109] Among them, λ i is the i-th eigenvalue of the graph Laplacian matrix, where i is a positive integer greater than or equal to zero and less than or equal to N, representing the frequency component of the graph signal. λ1 = 0 is the smallest eigenvalue, and the other eigenvalues are arranged in ascending order. The smallest eigenvalue λ1 is always 0, reflecting the DC component of the graph signal. The second smallest eigenvalue λ2 is called the algebraic connectivity, which reflects the connectivity of the graph. Larger eigenvalues correspond to high-frequency vibration modes.

[0110] The normalized eigenvector u1,…,u corresponding to each eigenvalue N , and satisfy the orthogonality condition:

[0111]

[0112] Among them, U T U=I means that the eigenvector matrix U is orthogonal, Indicates that different eigenvectors are orthogonal, that is, when i≠j, the eigenvector u i and u j The inner product of is zero. These conditions ensure that the eigenvectors are orthogonal to each other, each eigenvector is a unit vector, and they form a complete basis.

[0113] Step 203: Determine the frequency characteristics of the image signal according to the eigenvector matrix and the eigenvalue diagonal matrix.

[0114] For example, in this embodiment, the eigenvalue matrix Λ=diag(λ1,…,λ N ) and the eigenvector matrix U=[u1,…,u N ], the frequency characteristics of the graph signal can be determined, where the eigenvalue represents the intensity of the signal at different frequencies, and the eigenvector provides the basis for analyzing the frequency composition of the signal.

[0115] This embodiment obtains corresponding frequency features through eigenvalue decomposition, which can help identify different frequency components in the image signal, facilitate subsequent targeted processing and analysis, and further improve detection efficiency.

[0116] Step 204: Adjust the frequency characteristics based on the target cutoff frequency to obtain an adjusted image signal. The target detection parameters include a target cutoff frequency and a target detection threshold. The target cutoff frequency is determined based on at least one of a preset false alarm probability and a preset detection probability, and the target detection threshold is determined based on at least one of a preset false alarm probability and a preset detection probability.

[0117] Among them, the target cutoff frequency and the target detection threshold can be determined by the preset false alarm probability and the preset detection probability respectively; or, the target cutoff frequency is determined based on at least one of the preset false alarm probability and the preset detection probability, and the target detection threshold is determined based on at least one of the preset false alarm probability and the preset detection probability.

[0118] This embodiment determines target detection parameters, including a target cutoff frequency, based on a receiver operating characteristic curve, a preset false alarm probability, and a preset detection probability, and adjusts the frequency characteristics according to the target cutoff frequency to obtain an adjusted image signal.

[0119] This embodiment can adaptively set corresponding target detection parameters for attack detection according to actual detection requirements, such as false alarm probability and detection probability. Users can adjust the target detection parameters according to actual needs, thereby improving the adaptive ability of detection.

[0120] In one example, step 204 includes:

[0121] according to Get the frequency response function corresponding to the graph signal; where λ i is the i-th eigenvalue in the eigenvalue diagonal matrix, f id (λ i ) is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix, λ cut is the target cutoff frequency.

[0122] According to the frequency response function, the frequency response matrix corresponding to the image signal is obtained; wherein the i-th diagonal element in the frequency response matrix is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix.

[0123] The image signal is subjected to frequency domain conversion processing according to the eigenvector matrix, and the frequency characteristics of the converted image signal are adjusted based on the frequency response matrix to obtain the adjusted image signal.

[0124] This embodiment obtains a frequency response matrix and adjusts the frequency characteristics of the image signal after frequency domain conversion based on this matrix, enabling a more detailed observation of the characteristics of the image signal at different frequencies. Because the diagonal elements of the frequency response matrix are related to the frequency response function values corresponding to the eigenvalues, this embodiment can understand the energy distribution of the image signal at different frequency scales, helping to discover hidden features in the signal and improve detection accuracy.

[0125] For example, this embodiment designs a high-pass filter to adjust the frequency characteristics of the image signal, and its frequency response function is:

[0126]

[0127] Where: cit The target cutoff frequency determines which frequency components can pass through the high-pass filter. It is usually selected as the N / 4th eigenvalue of the graph frequency as the high-frequency part of the graph signal.

[0128] f id (λ i ) is the frequency response function of the high-pass filter. Components below the cutoff frequency are completely suppressed (output is 0), and components above the cutoff frequency are completely retained (output is 1).

[0129] According to the frequency response function, the frequency response matrix f(Λ) corresponding to the image signal of the power system to be detected is constructed. f(Λ) is a diagonal matrix of frequency response, in which each diagonal element f(λ i ) corresponds to the frequency response of the i-th eigenvalue.

[0130] Then, the eigenvector matrix obtained by graph Laplace matrix decomposition is used to transform the graph signal into the frequency domain, and based on the frequency response matrix, the frequency characteristics of the transformed graph signal are adjusted to obtain the adjusted graph signal. This process can be understood as first using U T Convert the signal to the frequency domain, use f(Λ) to perform frequency adjustment in the frequency domain, that is, high-pass filtering, and finally use U to convert the signal back to the spatial domain.

[0131] f(L)=Uf(Λ)U T

[0132] Where: f(L) is the filter matrix, which represents the frequency adjustment operation in graph signal processing. The frequency of the signal is adjusted by combining the graph Laplacian matrix L and its frequency response matrix f(Λ).

[0133] Step 205 : Calculate the signal energy corresponding to the image signal after the adjustment process; wherein the signal energy represents the abnormality degree of the image signal after the adjustment process.

[0134] For example, this embodiment determines whether an attack exists by calculating the signal energy after adjustment. The signal energy can be calculated using the following formula:

[0135]

[0136] in: Represents the signal energy after frequency adjustment, reflecting the state estimation vector The greater the energy, the stronger the high-frequency component and the greater the possibility of attack. is the state estimation vector, which represents the estimated value of each node in the system, reflects the state estimation of the power system, and is used to infer the current operating status of the system; ∥·∥ represents the Euclidean norm, which is used to calculate the modulus of the vector and is usually used to measure the energy or amplitude of the signal; Represents the filter f(L) acting on the state estimation vector The result obtained after this process adjusts the frequency component of the signal through the filter and outputs a new signal.

[0137] In this embodiment, the overall characteristics of the signal are quantified by calculating the energy of the adjusted image signal, which helps to quickly locate and identify abnormalities.

[0138] In a feasible implementation manner, before step 204, the method further includes:

[0139] A normal graph model of the power system to be tested, when not under attack, is obtained. Attack detection is performed on the normal graph model based on multiple preset detection parameters, and the false alarm probability corresponding to each detection parameter is determined. An abnormal graph model of the power system to be tested, when under attack, is obtained. Attack detection is performed on the abnormal graph model based on multiple detection parameters, and the detection probability corresponding to each detection parameter is determined. Based on the false alarm probabilities and detection probabilities corresponding to the multiple detection parameters, a receiver operating characteristic curve corresponding to the power system to be tested is obtained.

[0140] This embodiment pre-constructs a receiver operating characteristic curve corresponding to the target detection parameters of the power system to be detected based on a normal graph model of the power system to be detected when it is not attacked and an abnormal graph model of the power system to be detected when it is attacked. Furthermore, according to actual detection requirements, such as the false alarm probability and the detection probability, the corresponding target detection parameters can be adaptively set to perform attack detection, thereby improving the adaptive capability of detection.

[0141] Exemplarily, this embodiment performs pre-verification of the detection parameters before performing detection processing on the real-time status of the power system to be detected based on the target detection parameters and frequency characteristics.

[0142] Get N s A normal state sample of the system to be detected when it is not attacked, that is, a normal graph model, and simulates the addition of measurement noise:

[0143]

[0144] Among them: θ is the true state value, which represents the true value of each node in the system; ν i is the measurement noise, which represents the error in data collection. The noise follows a normal distribution with mean 0 and variance R.

[0145] According to the method from step 201 to step 205, for each sample, And calculate its empirical distribution, including mean and variance. According to the preset false alarm probability α, the detection threshold γ is solved by the following formula:

[0146] P(T f (θ)>γ|H0)=α

[0147] Where: T f (θ) is the signal energy of the signal after frequency adjustment, which indicates the abnormality of the signal and is used to measure the abnormality of the signal. The larger the value, the more abnormal the signal. γ is the detection threshold to be determined, which indicates the standard for judging whether the signal is abnormal. f When (θ) > γ, the signal is considered abnormal; otherwise, it is considered normal. H0 is the no-attack hypothesis, indicating that the system is in a normal state. This means that in the absence of external attacks, the signal should follow a normal distribution. α is the preset false alarm probability, which indicates the probability that the system will mistakenly identify an abnormality under normal circumstances. α is a very small value (such as 0.01 or 0.05) used to determine the detection threshold γ, ensuring that the probability of false alarms under normal circumstances is lower than the preset false alarm probability.

[0148] Under the no-attack hypothesis H0, calculate the false alarm probability of the detection threshold γ:

[0149]

[0150] Among them, P f is the false alarm probability, which represents the probability of mistakenly judging a normal signal as abnormal under the no-attack hypothesis H0, that is, the probability that the detector mistakenly marks it as an attack when the system is normal.

[0151] Under the attack hypothesis H1, calculate the detection probability of the detection threshold γ:

[0152]

[0153] Where: P d is the detection probability, which indicates the probability of successfully detecting an attack under the attack hypothesis H1, that is, the probability that the detector correctly determines that the system is abnormal when it is attacked; H1 is the attack hypothesis, indicating that the signal has been tampered with or the system has been attacked, and the state of the system has changed.

[0154] By adjusting the detection threshold γ and cutoff frequency λ cut , record different working points (P f ,P d ) and draw the Receiver Operating Characteristic curve (ROC curve) to evaluate the performance of the detector. The ROC curve can be used to find the optimal operating parameters (such as detection threshold γ and cutoff frequency λ) cut), while weighing the relationship between the detection probability and the false alarm probability.

[0155] In one example, Figure 3 : is a schematic diagram of ROC curves of different attack types in a DC power system provided by an embodiment of the present invention, such as Figure 3 As shown, the ROC curve for the random injection attack is closest to the upper left corner, indicating that this type of attack is the easiest to detect and can achieve a high detection probability with a low false alarm probability. The ROC curves for the mixed perturbation attack and the mean attack are located in the middle, indicating that detection is moderately difficult. The ROC curves for the low-density attack and the optimization attack are closest to the diagonal, indicating that these two types of attacks are the most concealed and require a high false alarm probability to achieve ideal detection results. The ROC curves for all attack modes are better than the random detection baseline (diagonal line), demonstrating the effectiveness of the detection method proposed in this paper.

[0156] Therefore, the embodiment of the present invention can analyze and determine the most likely type of attack on the power system to be detected based on the historical attack data of the power system to be detected. Furthermore, based on the attack type, the preferred false alarm probability and detection probability can be determined. Then, based on the correspondence between the detection probability and the false alarm probability and the target detection parameters, the target detection parameters can be determined, thereby effectively identifying and detecting attacks against the power system.

[0157] Figure 4 : is a schematic diagram of ROC curves of different attack types in an AC power system provided by an embodiment of the present invention, such as Figure 4 As shown in the figure, random injection attacks are the easiest to detect, and their detection probability can quickly approach 1 when the false alarm probability is low; mixed perturbation attacks and mean attacks are second, showing medium detection difficulty; low-density attacks and optimized attacks are the most difficult to detect due to their sparse characteristics, and require a higher false alarm probability to achieve ideal detection results.

[0158] Similarly, the embodiment of the present invention can analyze and determine the most likely type of attack on the power system to be detected based on the historical attack data of the power system to be detected. Furthermore, based on the attack type, the preferred false alarm probability and detection probability can be determined. Then, based on the correspondence between the detection probability and the false alarm probability and the target detection parameters, the target detection parameters can be determined, thereby effectively identifying and detecting attacks against the power system.

[0159] In a feasible implementation, based on historical attack data, such as the number of times the power system has been attacked, the attack type of each attack, the time interval between each attack, and the trend of changes in attack types, the most likely attack type for the next time or in a preset time period in the future can be analyzed.

[0160] This embodiment combines historical attack data to reasonably set target detection parameters for different attack types, and can effectively detect different attack types.

[0161] Step 206: If the signal energy is greater than the target detection threshold, it is determined that the power system to be detected is attacked; if the signal energy is less than or equal to the target detection threshold, it is determined that the power system to be detected is not attacked.

[0162] Exemplarily, this embodiment determines target detection parameters, including a target detection threshold, based on a pre-constructed receiver operating characteristic curve, a preset false alarm probability, and a preset detection probability. If the signal energy is greater than the target detection threshold, it is determined that the power system to be detected is attacked, that is, the real-time measurement data includes false data; if the signal energy is less than or equal to the target detection threshold, it is determined that the power system to be detected is not attacked.

[0163] This embodiment performs attack detection based on the frequency characteristics of the graph signal corresponding to the real-time graph model, effectively reducing the difficulty of detecting false data injection attacks, and significantly reducing the dependence on additional hardware protection, thereby reducing system protection costs.

[0164] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present invention.

[0165] The following are device embodiments of the present invention. For details not fully described therein, reference may be made to the corresponding method embodiments described above.

[0166] Figure 5 The following is a schematic diagram showing the structure of a power system attack detection device provided by an embodiment of the present invention. For ease of explanation, only the parts related to the embodiment of the present invention are shown, which are described in detail as follows:

[0167] like Figure 5 As shown, the power system attack detection device 5 includes:

[0168] The first processing unit 51 is used to obtain a real-time graph model of the power system to be detected and obtain a graph Laplace matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; the graph Laplace matrix represents a graph signal corresponding to the real-time graph model.

[0169] The second processing unit 52 is configured to perform eigendecomposition on the graph Laplacian matrix to obtain frequency characteristics of the graph signal.

[0170] The detection unit 53 is used to detect and process the real-time status of the power system to be detected based on the target detection parameters and frequency characteristics, and determine the attack detection result of the power system to be detected; wherein the target detection parameters are determined based on the preset false alarm probability and the preset detection probability.

[0171] In one possible implementation, the target detection parameters include a target cutoff frequency and a target detection threshold; the target cutoff frequency is determined based on at least one of a preset false alarm probability and a preset detection probability, and the target detection threshold is determined based on at least one of a preset false alarm probability and a preset detection probability; the detection unit 53 is specifically configured to:

[0172] The frequency characteristics are adjusted according to the target cutoff frequency to obtain the adjusted graph signal; the signal energy corresponding to the adjusted graph signal is calculated; wherein the signal energy represents the degree of abnormality of the adjusted graph signal; if the signal energy is greater than the target detection threshold, it is determined that the power system to be detected has been attacked; if the signal energy is less than or equal to the target detection threshold, it is determined that the power system to be detected has not been attacked.

[0173] In one possible implementation, before the detection unit 53, the power system attack detection device 5 also includes: a preprocessing unit, which is used to: obtain a normal graph model of the power system to be detected when it is not attacked, and perform attack detection on the normal graph model based on multiple preset detection parameters, and determine the false alarm probability corresponding to each detection parameter; obtain an abnormal graph model of the power system to be detected when it is attacked, and perform attack detection on the abnormal graph model based on multiple detection parameters, and determine the detection probability corresponding to each detection parameter; obtain a receiver operating characteristic curve corresponding to the power system to be detected based on the false alarm probability and detection probability corresponding to the multiple detection parameters; determine the target detection parameter based on the receiver operating characteristic curve, the preset false alarm probability and the preset detection probability.

[0174] In a possible implementation, the second processing unit 52 is specifically configured to:

[0175] Perform eigenvalue decomposition on the graph Laplace matrix to obtain the corresponding eigenvector matrix and eigenvalue diagonal matrix; wherein each column of the eigenvector matrix characterizes a vibration mode of the graph signal, and each eigenvalue in the eigenvalue diagonal matrix represents the frequency of the graph signal under the corresponding vibration mode; determine the frequency characteristics of the graph signal based on the eigenvector matrix and the eigenvalue diagonal matrix.

[0176] In a possible implementation, the detection unit 53 is further configured to:

[0177] according to Get the frequency response function corresponding to the graph signal; where λ i is the i-th eigenvalue in the eigenvalue diagonal matrix, f id (λi ) is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix, λ cut is the target cutoff frequency; according to the frequency response function, the frequency response matrix corresponding to the image signal is obtained; wherein, the i-th diagonal element in the frequency response matrix is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix; the image signal is frequency-domain transformed according to the eigenvector matrix, and based on the frequency response matrix, the frequency characteristics of the transformed image signal are adjusted to obtain the adjusted image signal.

[0178] In a possible implementation, the first processing unit 51 is specifically configured to:

[0179] The busbars in the power system to be tested are mapped to a set of nodes in a real-time graph model, the transmission lines in the power system to be tested are mapped to a set of edges in the real-time graph model, and the admittance value of each transmission line is mapped to the weight information of the corresponding edge to obtain a graph structure mapped by the power system to be tested; wherein the weight information represents the contribution of the admittance value of the corresponding transmission line to the real-time graph model; real-time measurement data corresponding to preset measurement points in the power system to be tested are obtained, and the real-time measurement data are mapped to the graph structure to obtain a real-time graph model; wherein the types of preset measurement points include power injection measurement points and power flow measurement points.

[0180] In a possible implementation, the first processing unit 51 is further configured to:

[0181] According to the edge set and the weight information of each edge, the graph Laplacian matrix corresponding to the real-time graph model is constructed; where L k,l is the matrix element in the graph Laplace matrix. When k=l, L k,l is the sum of the weights of all edges connected to node k, denoted as m represents the node connected to node k; when (k, l)∈edge set ξ, then L k,l =-ω k,l ,ω k,l is the weight of the edge (k, l) in the real-time graph model; in other cases, L k,l =0.

[0182] In one possible implementation, the first processing unit 51 is further specifically used to: determine the measurement matrix corresponding to the real-time graph model based on the type of preset measurement points in the real-time graph model and the admittance value of each transmission line; wherein the measurement matrix is used to characterize the measurement relationship of the power system to be detected; and perform data cleaning processing on the real-time measurement data based on the measurement matrix.

[0183] Figure 6 Schematic diagram of an electronic device provided by an embodiment of the present invention. Figure 6As shown, the electronic device 6 of this embodiment includes a processor 60 and a memory 61. The memory 61 stores a computer program 62. When the processor 60 executes the computer program 62, the steps of the above-described method embodiments are implemented. Alternatively, when the processor 60 executes the computer program 62, the functions of the modules / units in the above-described device embodiments are implemented.

[0184] For example, the computer program 62 may be divided into one or more modules / units, which are stored in the memory 61 and executed by the processor 60 to implement the present invention. The one or more modules / units may be a series of computer program instruction segments capable of implementing specific functions, and the instruction segments are used to describe the execution process of the computer program 62 in the electronic device 6.

[0185] The electronic device 6 may include, but is not limited to, a processor 60 and a memory 61. Those skilled in the art will appreciate that Figure 6 It is only an example of electronic device 6 and does not constitute a limitation of electronic device 6. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, electronic device 6 may also include input and output devices, network access devices, buses, etc.

[0186] For the sake of convenience and brevity, the division of the above functional modules / units is only used as an example. In actual applications, the above functions can be assigned to different functional modules / units as needed. The above modules / units can be implemented in the form of hardware, software, or a combination of hardware and software.

[0187] In the above embodiments, the descriptions of each embodiment have their own focus. For parts not described or recorded in detail in one embodiment, please refer to the relevant descriptions of other embodiments. Unless otherwise specified or there is a logical conflict, the terms and / or descriptions between different embodiments are consistent and can be referenced to each other. The technical features of different embodiments can be combined to form new embodiments based on their inherent logical relationships.

[0188] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. These modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the various embodiments of the present invention, and should all be included in the scope of protection of the present invention.

Claims

1. A method for detecting power system attacks, characterized in that: The method comprises: Acquire a real-time graph model of the power system to be detected, and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model; Performing eigendecomposition on the graph Laplacian matrix to obtain frequency characteristics of the graph signal; According to the target detection parameters and the frequency characteristics, the real-time status of the power system to be detected is detected and processed to determine the attack detection result of the power system to be detected; wherein, the target detection parameters are determined based on a preset false alarm probability and a preset detection probability.

2. The power system attack detection method according to claim 1, characterized in that: The target detection parameters include a target cutoff frequency and a target detection threshold; the target cutoff frequency is determined based on at least one of the preset false alarm probability and the preset detection probability, and the target detection threshold is determined based on at least one of the preset false alarm probability and the preset detection probability; The detecting and processing the real-time state of the power system to be detected based on the target detection parameter and the frequency characteristics to determine the attack detection result of the power system to be detected includes: Adjusting the frequency characteristic according to the target cutoff frequency to obtain an adjusted image signal; Calculating the signal energy corresponding to the image signal after the adjustment process; wherein the signal energy represents the abnormality degree of the image signal after the adjustment process; If the signal energy is greater than the target detection threshold, it is determined that the power system to be detected is attacked; If the signal energy is less than or equal to the target detection threshold, it is determined that the power system to be detected has not been attacked.

3. The power system attack detection method according to claim 1, characterized in that: Before detecting and processing the real-time state of the power system to be detected based on the target detection parameter and the frequency characteristics and determining the attack detection result of the power system to be detected, the method further includes: Obtaining a normal graph model of the power system to be detected when it is not attacked, and performing attack detection on the normal graph model based on a plurality of preset detection parameters, and determining a false alarm probability corresponding to each detection parameter; Acquire an abnormal graph model of the power system to be detected when it is attacked, perform attack detection on the abnormal graph model based on the multiple detection parameters, and determine a detection probability corresponding to each detection parameter; Obtaining a receiver operating characteristic curve corresponding to the power system to be detected based on false alarm probabilities and detection probabilities corresponding to a plurality of detection parameters; The target detection parameters are determined based on the receiver operating characteristic curve, the preset false alarm probability, and the preset detection probability.

4. The power system attack detection method according to claim 2, characterized in that: The eigendecomposition of the graph Laplacian matrix to obtain the frequency characteristics of the graph signal includes: Performing eigenvalue decomposition on the graph Laplacian matrix to obtain a corresponding eigenvector matrix and an eigenvalue diagonal matrix; wherein each column of the eigenvector matrix represents a vibration mode of the graph signal, and each eigenvalue in the eigenvalue diagonal matrix represents a frequency of the graph signal in the corresponding vibration mode; The frequency characteristics of the image signal are determined according to the eigenvector matrix and the eigenvalue diagonal matrix.

5. The power system attack detection method according to claim 4, characterized in that: The adjusting the frequency characteristic according to the target cutoff frequency to obtain an adjusted image signal includes: according to Get the frequency response function corresponding to the graph signal; where λ i is the i-th eigenvalue in the eigenvalue diagonal matrix, f id (λ i ) is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix, λ cut is the target cutoff frequency; According to the frequency response function, a frequency response matrix corresponding to the image signal is obtained; wherein the i-th diagonal element in the frequency response matrix is the frequency response function value corresponding to the i-th eigenvalue in the eigenvalue diagonal matrix; The image signal is subjected to frequency domain conversion processing according to the eigenvector matrix, and the frequency characteristics of the converted image signal are adjusted based on the frequency response matrix to obtain the adjusted image signal.

6. The power system attack detection method according to any one of claims 1 to 5, characterized in that: The obtaining of a real-time graphical model of the power system to be detected includes: Mapping the busbars in the power system to be detected to a node set of the real-time graph model, mapping the transmission lines in the power system to be detected to an edge set of the real-time graph model, and mapping the admittance value of each transmission line to weight information of the corresponding edge, thereby obtaining a graph structure mapped to the power system to be detected; wherein the weight information represents the contribution of the admittance value of the corresponding transmission line to the real-time graph model; Real-time measurement data corresponding to preset measurement points in the power system to be detected is obtained, and the real-time measurement data is mapped to the graph structure to obtain the real-time graph model; wherein the types of the preset measurement points include power injection measurement points and power flow measurement points.

7. The power system attack detection method according to claim 6, characterized in that: Obtaining a graph Laplacian matrix corresponding to the real-time graph model includes: According to the edge set and the weight information of each edge, the graph Laplacian matrix corresponding to the real-time graph model is constructed; wherein L k,l is the matrix element in the graph Laplace matrix. When k=l, L k,l is the sum of the weights of all edges connected to node k, denoted as m represents the node connected to node k; when (k, l)∈edge set ξ, then L k,l =-ω k,l ,ω k,l is the weight of the edge (k, l) in the real-time graph model; in other cases, L k,l =0.

8. The power system attack detection method according to claim 6, characterized in that: Before obtaining the graph Laplacian matrix corresponding to the real-time graph model, the method further includes: Determining a measurement matrix corresponding to the real-time graph model according to the type of preset measurement points in the real-time graph model and the admittance value of each transmission line; wherein the measurement matrix is used to characterize the measurement relationship of the power system to be detected; Based on the measurement matrix, data cleaning processing is performed on the real-time measurement data.

9. A power system attack detection device, characterized in that: The method device comprises: A first processing unit is configured to obtain a real-time graph model of the power system to be detected and obtain a graph Laplacian matrix corresponding to the real-time graph model; wherein the real-time graph model includes a graph structure mapped by the power system to be detected and real-time measurement data corresponding to the power system to be detected; and the graph Laplacian matrix represents a graph signal corresponding to the real-time graph model; a second processing unit, configured to perform eigendecomposition on the graph Laplacian matrix to obtain frequency characteristics of the graph signal; A detection unit is used to detect and process the real-time status of the power system to be detected based on the target detection parameters and the frequency characteristics, and determine the attack detection result of the power system to be detected; wherein the target detection parameters are determined based on a preset false alarm probability and a preset detection probability.

10. An electronic device, characterized in that: The method comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the power system attack detection method according to any one of claims 1 to 8 when executing the computer program.

Images