Self-adaptive defense method for denial of service attack based on incomplete information random game

Abstract

The invention discloses a denial of service attack adaptive defense method based on incomplete information random game, and the method comprises the following steps: S1, building a system vulnerability model based on an observability Gramian matrix, and initializing an incomplete information random game framework; s2, respectively constructing complete information sub-game models under different attacker types, and solving corresponding Markov Nash equilibrium; s3, according to the system observation data and the Bayesian rule, the posterior belief for the attacker type is updated; s4, mixing the optimal strategies of different sub games based on posterior belief to form a final decision of a defender; and S5, executing a defense action, recording system state change, and circularly executing strategy updating and optimization. According to the method, intelligent, self-adaptive and resource-efficient defense functions can be realized when the wide-area damping control system is subjected to denial of service attack, and the system security and defense resource consumption are effectively balanced.

Description

Technical Field

[0001] The present invention belongs to the field of power system network security, and relates to a smart grid denial of service attack defense method, and specifically to a wide-area damping control system security protection method based on incomplete information random game and Bayesian reasoning. Background Art

[0002] As a key component of smart grids, wide-area damping control systems (WADCs) increasingly rely on information and communication technologies for remote monitoring and control as power systems evolve toward intelligent and digital development. These systems utilize phasor measurement units (PMUs) to collect and transmit data over a wide area, thereby improving grid stability and reducing operating costs. However, in the early stages of WADC design, most system designs focused on functional implementation and real-time performance due to a lack of comprehensive consideration of cybersecurity threats. Consequently, insufficient investment in security mechanisms has resulted in a lack of effective defense against denial-of-service (DoS) attacks. Furthermore, given the stringent communication latency and data integrity requirements of power system control, adopting traditional cybersecurity defense technologies for WADCs can introduce additional communication delays, reduce system response speed, and fail to meet the real-time control requirements of power systems. Therefore, designing a DoS attack defense method for WADCs that balances security protection with control performance is of great research significance.

[0003] When it comes to network security protection for wide-area damping control systems, traditional fixed-strategy defense methods struggle to cope with dynamically changing security threats due to the diverse types of attackers and the difficulty in accurately determining their intentions. Existing defense technologies typically employ rule-based intrusion detection systems, which have high computational overhead and high trigger frequency, resulting in a waste of system resources and difficulty balancing false alarm rates and missed alarm rates. Furthermore, most defense technologies fail to consider the strategic adversarial relationship between attackers and defenders, are unable to adaptively adjust to changes in attacker behavior patterns, and provide incomplete assessments of the performance impact on the system. Therefore, an adaptive defense method is needed that comprehensively considers system vulnerabilities, attack behavior characteristics, and defense resource constraints to improve the resistance and resilience of wide-area damping control systems when subjected to DoS attacks. Summary of the Invention

[0004] In response to the denial of service attack threat faced by wide-area damping control systems, traditional defense methods lead to system performance degradation while ensuring security, and are unable to dynamically adjust defense strategies according to attacker behavior. The present invention provides an adaptive defense method for denial of service attacks based on incomplete information random games. This method can dynamically identify and infer the attacker type, optimize the configuration of defense resources while ensuring system observability, balance the relationship between security protection strength and control performance, and improve the ability of wide-area damping control systems to resist DoS attacks.

[0005] The purpose of the present invention is achieved through the following technical solutions:

[0006] An adaptive defense method for denial of service attacks based on incomplete information random game includes the following steps:

[0007] Step S1: Establish a system vulnerability model based on the observability Gramian matrix and initialize the incomplete information random game framework. The specific steps are as follows:

[0008] Step S11: Use the power system linearization model to establish the continuous-time system dynamic equation:

[0009] in, is the system state vector, A is the system matrix, B is the control matrix, and u is the control input;

[0010] The measurement equation is:

[0011]

[0012] Where C is the output matrix, and y is the phase angle data obtained by PMU;

[0013] When the communication link is affected by a DoS attack, the system state measurement matrix changes to C(t), where c is the communication state variable, c=1 indicates normal communication, and c=0 indicates communication is under attack;

[0014] Step S12: Calculate the system observability Gramian matrix:

[0015]

[0016] in, is the transposed vector of the system state vector;

[0017] Obtained by solving the following Lyapunov equation:

[0018]

[0019] Take its trace value As an important indicator to quantify the vulnerability level of the system under DoS attack;

[0020] Step S13: Define the game subjects: attacker and defender; set the attacker type space ,in represents a normal PMU data sending node, 1 represents a malicious attacker; set the initial prior probability; define the system state vector, where is the trace of the observability Gramian of the k-th time slot, is the current packet loss rate;

[0021] Step S2: Define the game action space and transition probability, and construct the utility function. The specific steps are as follows:

[0022] Step S21: Set the attacker action set , where 1 means "launch DoS attack" and 0 means "do not launch attack"; set the defender action set , where 1 means "trigger intrusion detection system" and 0 means "do not trigger detection";

[0023] Step S22: Construct a state transition function and a state transition probability. The state transition probability is related to the bit error rate (BER) of the communication channel:

[0024]

[0025] Where, ( ) is the action state of the attacker and defender in the next state, ( ) is the action status of the attacker and defender in the current state;

[0026] BER is calculated using the following formula:

[0027]

[0028] Where, is the average SNR, , ;

[0029] Step S23: Define the reward function for different attacker types:

[0030] When the attacker type is malicious:

[0031]

[0032]

[0033]

[0034] Where, is the BER of wireless transmission of communication channel k; and are the energy consumption coefficients of the attacker and defender, respectively; The action reward value for the defender and attacker; is the reward value at the next moment;

[0035] When the attacker type is normal signal:

[0036]

[0037] in, Indicates that the current action is defense;

[0038] Step S3: Construct a complete information subgame model and solve the Nash equilibrium strategy. The specific steps are as follows:

[0039] Step S31: Construct a complete information random game model for the attacker type:

[0040]

[0041] Where, is the current state, Action for the attacker, Action for the defender, is the current action probability, The reward the attacker receives for attacking. The bonus for attackers when they attack and defenders when they defend;

[0042] Step S32: Construct a complete information random game model for the attacker type:

[0043]

[0044] Where, is the reward the attacker receives when he does not attack. The bonus for attackers when they attack and defenders when they defend;

[0045] Step S33: Use the minimax-Q learning algorithm to solve the optimal Markov strategy of the defender in the game and , these two strategies correspond to the defender's optimal action probability distribution under the two assumptions of "the attacker is determined to be malicious" and "the attacker is determined to be normal", and the Q value is updated by the following iterative formula:

[0046]

[0047] Among them, α is the learning rate, d is the discount factor, is the current state reward value, is the reward value at the next moment, is the attenuation coefficient;

[0048] Step S34: Verify the uniqueness of the Nash equilibrium solution to ensure policy convergence; set a convergence threshold during the Q learning iteration process, and consider the policy to have converged when the Q value change between two iterations is less than this threshold;

[0049] Step S4: Time slot cycle initialization and data acquisition preparation:

[0050] Step S41: Set the current time slot count k=0, the maximum operating time slot , the simulation time step is 100ms; collect the initial PMU data of the node test system and obtain the phase angle data of the key nodes;

[0051] Step S42: Establish a PMU data communication link topology diagram, determine the data flow direction and key communication nodes; initialize the system status monitor and record the number of packet losses per time slot in real time Communication delay ;

[0052] Step S5: Calculate and execute defensive actions based on the Bayesian hybrid strategy:

[0053] Step S51: Based on the current posterior probability , calculate the defender's mixed strategy:

[0054]

[0055] Step S52: Hybrid strategy calculation and execution:

[0056] Step S521: Based on the current system status Query the mixed strategy table to obtain the probability of "triggering detection" in this state ;

[0057] Step S522: Generate a random number ,like Then select action , trigger detection, otherwise select , does not trigger detection;

[0058] Step S523: Execute the selected defense action. If detection is triggered, activate the deep packet inspection (DPI) module to analyze the communication content.

[0059] Step S6: Attacker action generation and system state transition:

[0060] Step S61: The attacker selects an action based on its true type. If it is a malicious type, it randomly selects an action based on its strategy. If it selects an attack action, it sends interference data packets to the target PMU communication link, causing the packet loss rate to increase. If it is a normal node, it sends PMU data according to the regular communication protocol and does not perform interference.

[0061] Step S62: The system updates the state based on the actions of both parties, and the observability Gramian is updated to:

[0062]

[0063] Where η is the recovery coefficient when the detection is successful, is the observable coefficient of the current state, is the observation coefficient corresponding to the current attacker's action state, is the defender's current action, Action for the initial defender;

[0064] The packet loss rate is updated as:

[0065]

[0066] Where, is the next state packet loss rate, is the packet loss rate caused by the attacker’s current action, is the packet loss compensation for the defender’s current action, is the maximum packet loss rate;

[0067] Step S7: Observation data collection and likelihood calculation:

[0068] Step S71: Record observation data , including: number of lost packets , packet loss rate , Gramian trace changes;

[0069] Step S72: Establish a likelihood function to calculate the conditional probability of observing data under different attacker types: and ;

[0070] Step S73: Using a statistical model to estimate likelihood, packet loss at normal nodes follows a Poisson distribution, while packet loss at malicious nodes exhibits burst characteristics;

[0071] Step S8: Bayesian posterior update and belief maintenance:

[0072] Step S81: Apply the Bayesian formula to update the posterior probability:

[0073]

[0074] =1-

[0075] Where, is the attacker’s historical action set, The probability of an attack action to defend against an attacker;

[0076] Step S82: The defender uses the posterior Update the belief about the attacker type; set boundary conditions: if <0.01, set to 0.01. If > 0.99, set it to 0.99 to avoid extreme beliefs;

[0077] Step S9: Dynamic update of game strategy:

[0078] Set the threshold parameter ε, if , indicating that the belief in the attacker type has changed significantly, and the subgame equilibrium strategy needs to be re-solved and If the belief change is not significant, the original equilibrium strategy is used.

[0079] Step S10: Optimizing intrusion detection system parameters:

[0080] Step S101: Based on the current posterior probability Adjust the intrusion detection system parameters; when When >0.6, the detection depth and feature extraction dimension are increased; when When <0.6, reduce the detection frequency;

[0081] Step S102: Dynamically adjust the detection threshold , so that it is positively correlated with the posterior probability:

[0082]

[0083] in, is the basic threshold, λ is the adjustment coefficient;

[0084] Step S103: IDS parameter optimization:

[0085] Step S1031: Obtain the current posterior probability ;

[0086] Step S1032: If > 0.7, set the high-intensity detection mode and increase the feature extraction dimension to 100% of the full dimension;

[0087] Step S1033: If 0.3 < If ≤0.7, set the medium intensity detection mode and use 60% of the feature dimension;

[0088] Step S1034: If If ≤0.3, low-intensity detection mode is set, using only 30% of the feature dimensions;

[0089] Step S1035: According to the set detection mode, adjust the computing resource allocation and detection frequency, and output the optimized IDS parameter configuration;

[0090] Step S11: Security warning and log recording:

[0091] Step S111: Setting the alarm threshold ,like > , then a system security alarm is triggered, and the alarm information includes: the PMU node ID that may be attacked, the attack probability estimate, and the current system vulnerability index;

[0092] Step S112: Record the complete game information of each time slot k into the security log database, including: state, action, observation, and posterior probability; the log is stored in encrypted form to ensure security and integrity;

[0093] Step S12: Phase measurement unit data loss assessment:

[0094] The loss rate is defined to quantify the degree of decline in observation capability:

[0095]

[0096] Where, is the observation matrix under the current signal loss state, It is the full matrix under the current signal loss state; when it exceeds the preset threshold When , the PMU data compensation mechanism is triggered;

[0097] Step S13: Control performance evaluation and WADC adjustment:

[0098] Step S131: Evaluate the current packet loss rate Impact on WADC control performance; calculation of control performance indicators :

[0099]

[0100] in, is the system frequency deviation;

[0101] Step S132: Compare with the baseline performance without attack , evaluate the performance degradation rate:

[0102]

[0103] when When the system fails, it automatically switches to the backup control strategy to enhance the robustness of the system;

[0104] Step S14: Defense efficiency and resource consumption evaluation:

[0105] Step S141: Regularly collect statistics on defense efficiency index detection accuracy :

[0106]

[0107] Among them, TP is true positive, TN is true negative, FP is false positive, and FN is false negative.

[0108] Step S142: Calculate resource consumption index , represents the cumulative defense cost of nearly N time slots, where, The defender's action at time i, is the defense coefficient;

[0109] Step S143: Calculate performance-cost ratio , as a comprehensive evaluation of the efficiency of the defense strategy;

[0110] Step S144: Record the PCR time series and analyze the changing trend of defense efficiency;

[0111] Step S15: Adaptive adjustment of system parameters:

[0112] Step S151: Adjust the game model parameters based on the defense efficiency evaluation results; if the detection accuracy Acc<0.8, increase the α value to increase the emphasis on system performance; if the resource consumption is too high, increase the β value to control the defense cost;

[0113] Step S152: Dynamically adjust the threshold parameters ε and , so that it adapts to the current network security environment; the adjusted parameters must meet the consistency constraint: α+β=1, ensuring weight normalization;

[0114] Step S16: Network topology and security model update:

[0115] Step S161: Every M time slots, re-evaluate the network topology security characteristics based on the accumulated data; identify key communication nodes and vulnerable links, and update the system vulnerability map;

[0116] Step S162: Update the attacker behavior model and strategy distribution based on historical attack patterns; reconstruct the state space S and transition probability P based on new network characteristics to maintain the timeliness of the model;

[0117] Step S17: Loop iteration and end:

[0118] Step S171: Time slot count increments: ;like If the system stability index meets the requirements, the process returns to step S5 and the cycle continues. If the maximum time slot is reached or the system performance is severely degraded, the simulation ends.

[0119] Step S172: Generate a complete defense report, including statistical indicators, time series charts and security recommendations, and archive it for analysis and evaluation by the system administrator.

[0120] Compared with the prior art, the present invention has the following advantages:

[0121] The present invention uses an incomplete information random game framework to model the interactive behavior between attackers and defenders, dynamically updates beliefs about attacker types through a Bayesian inference mechanism, and can accurately infer attack intent under limited observation conditions. It evaluates system vulnerability based on the observable Gramian matrix, directly quantifies the impact of DoS attacks on power system stability, and closely integrates defense decisions with system control performance. It adaptively adjusts intrusion detection system parameters and detection trigger frequency based on the posterior probability of the current attacker type, achieving optimal configuration of defense resources, avoiding resource waste caused by excessive defense, and reducing the impact of defense actions on system communication performance. Through a collaborative mechanism with a wide-area damping controller, the control strategy is automatically adjusted when a high-probability attack is detected, improving the system's operational resilience under attack. The present invention can implement intelligent, adaptive, and resource-efficient defense functions for wide-area damping control systems when they are subjected to denial-of-service attacks, effectively balancing system security and defense resource consumption. BRIEF DESCRIPTION OF THE DRAWINGS

[0122] Figure 1 The flowchart of the adaptive defense method for denial of service attacks based on incomplete information random game.

[0123] Figure 2 The figure is a specific flow chart of the adaptive defense method for denial of service attacks based on incomplete information random game.

[0124] Figure 3 The figure is a specific flow chart for the calculation and execution of hybrid strategies.

[0125] Figure 4 Specific flowchart for IDS parameter optimization.

[0126] Figure 5 This is the defense strategy proposed by the defender when the attacker has no attack behavior on both channels.

[0127] Figure 6 It is the defense strategy proposed by the defender when the attacker chooses the [do not attack, attack] strategy.

[0128] Figure 7 It is the defense strategy proposed by the defender when the attacker chooses the [attack, do not attack] strategy.

[0129] Figure 8 It is the defense strategy proposed by the defender when the attacker adopts the attack strategy. DETAILED DESCRIPTION

[0130] The technical solution of the present invention is further described below with reference to the accompanying drawings, but is not limited thereto. Any modification or equivalent replacement of the technical solution of the present invention that does not depart from the spirit and scope of the technical solution of the present invention should be included in the scope of protection of the present invention.

[0131] The present invention provides a method for adaptive defense against denial of service attacks based on incomplete information random game. Figure 1 As shown, the method includes the following steps:

[0132] Step S1: Establish a system vulnerability model based on the observability Gramian matrix and initialize the incomplete information random game framework;

[0133] Step S2: Construct complete information subgame models under different attacker types and solve the corresponding Markov Nash equilibrium;

[0134] Step S3: Update the posterior belief about the attacker type based on the system observation data and Bayes’ rule;

[0135] Step S4: Based on the posterior belief, the optimal strategies of different sub-games are mixed to form the final decision of the defender;

[0136] Step S5: Execute defense actions and record system status changes, and perform strategy updates and optimizations in a loop.

[0137] like Figure 2 The specific implementation steps are as follows:

[0138] Step S1: Establish a system vulnerability model based on the observability Gramian matrix and initialize the incomplete information random game framework.

[0139] In this step, the power system linearization model is first used to establish the continuous-time system dynamic equation:

[0140]

[0141] in, is the system state vector, A is the system matrix, B is the control matrix, and u is the control input;

[0142] The measurement equation is:

[0143]

[0144] Where C is the output matrix and y is the phase angle data obtained by the PMU.

[0145] When the communication link is affected by a DoS attack, the system measurement matrix changes to C(c), where c is the communication state variable. c=1 indicates normal communication, and c=0 indicates that the communication is under attack.

[0146] In this step, the system observability Gramian matrix is ​​calculated:

[0147]

[0148] Where, is the transposed matrix of the C-state matrix;

[0149] It can be obtained by solving the following Lyapunov equation:

[0150]

[0151] And take its trace value As an important indicator to quantify the vulnerability level of the system under DoS attack, The lower the value, the more vulnerable the system is.

[0152] In this step, we define the game entities: Attacker and Defender; set the attacker type space ,in represents a normal PMU data sending node, 1 represents a malicious attacker; set the initial prior probability; define the system state vector, where is the trace of the observability Gramian of the k-th time slot, is the current packet loss rate.

[0153] Step S2: Define the game action space and transition probability, and construct the utility function.

[0154] In this step, the attacker action set is set , where 1 means "launch DoS attack" and 0 means "do not launch attack"; set the defender action set , where 1 means "trigger intrusion detection system" and 0 means "do not trigger detection".

[0155] In this step, the state transition function and transition probability are constructed. The state transition probability is related to the bit error rate (BER) of the communication channel:

[0156]

[0157] Where, ( ) is the action state of the attacker and defender in the next state, ( ) is the action status of the attacker and defender in the current state.

[0158] Among them, BER can be calculated by the following formula:

[0159]

[0160] Where, is the average SNR, , With the current state And it is related to the action states of the attacker and the defender.

[0161] In this step, we define the reward function for different attacker types:

[0162] When the attacker type is malicious (zero-sum game):

[0163]

[0164]

[0165] Where, is the BER of wireless transmission of communication channel k; and are the energy consumption coefficients of the attacker and defender, respectively; The action reward value for the defender and attacker; is the reward value at the next moment.

[0166] When the attacker type is normal signal:

[0167]

[0168] in, Indicates the current action is defense.

[0169] Step S3: Construct a complete information subgame model and solve the Nash equilibrium strategy.

[0170] In this step, a complete information random game model is constructed for the attacker type (malicious):

[0171]

[0172] Where, is the current state, Action for the attacker, Action for the defender, is the current action probability, The reward the attacker receives for attacking. The bonus for the attacker when attacking and the defender when defending.

[0173] For the attacker type (normal), a complete information random game model is constructed:

[0174]

[0175] Where, is the reward the attacker receives when he does not attack. The bonus for the attacker when attacking and the defender when defending.

[0176] In this step, the minimax-Q learning algorithm is used to solve the optimal Markov strategy of the defender in the game. and These two strategies correspond to the defender's optimal action probability distribution under the two assumptions of "the attacker is determined to be malicious" and "the attacker is determined to be normal".

[0177] The Q value is updated by the following iterative formula:

[0178]

[0179] Among them, α is the learning rate, d is the discount factor, is the current state reward value, is the reward value at the next moment, is the attenuation coefficient.

[0180] In this step, the uniqueness of the Nash equilibrium solution is verified to ensure policy convergence. A convergence threshold is set during the Q learning iteration process. When the change in Q value between two iterations is less than this threshold, the policy is considered to have converged.

[0181] Step S4: Time slot cycle initialization and data acquisition preparation.

[0182] In this step, set the current time slot count k=0 and the maximum running time slot , the simulation time step is 100ms; collect the initial PMU data of the IEEE 39-node test system and obtain the phase angle data of 10 key nodes.

[0183] In this step, the PMU data communication link topology is established to determine the data flow and key communication nodes; the system status monitor is initialized to record the number of packet losses per time slot in real time. Communication delay .

[0184] Step S5: Calculate and execute defense actions based on the Bayesian hybrid strategy.

[0185] In this step, based on the current posterior probability , calculate the defender's mixed strategy:

[0186]

[0187] This formula represents a weighted mixture of the "determine as malicious" and "determine as normal" strategies according to the posterior probability.

[0188] like Figure 3 As shown in Figure 2, the hybrid strategy calculation and execution process includes the following steps:

[0189] Step S51: According to the current system status Query the mixed strategy table to obtain the probability of "triggering detection" in this state ;

[0190] Step S52: Generate a random number ,like Then select action (Trigger detection), otherwise select (not triggered);

[0191] Step S53: Execute the selected defense action, and if detection is triggered, activate the deep packet inspection (DPI) module to analyze the communication content.

[0192] Step S6: Attacker action generation and system state transfer.

[0193] In this step, the attacker selects an action based on its true type; if it is a malicious type, it randomly selects an action based on its strategy; if it chooses an attack action, it sends interference data packets to the target PMU communication link, resulting in an increase in the packet loss rate; if it is a normal node, it sends PMU data according to the regular communication protocol without performing interference.

[0194] In this step, the system updates its state based on the actions of both parties, and the observability Gramian is updated as follows:

[0195]

[0196] Where η is the recovery coefficient when the detection is successful, is the observable coefficient of the current state, is the observation coefficient corresponding to the current attacker's action state, is the defender's current action, Action for the initial defender;

[0197] The packet loss rate is updated as:

[0198]

[0199] Where, is the next state packet loss rate, is the packet loss rate caused by the attacker’s current action, is the packet loss compensation for the defender’s current action, is the maximum packet loss rate.

[0200] Step S7: Observation data collection and likelihood calculation.

[0201] In this step, record the observation data , including: number of lost packets , packet loss rate , Gramian trace changes.

[0202] In this step, a likelihood function is established to calculate the conditional probability of observing data under different attacker types: and .

[0203] In this step, a statistical model is used to estimate the likelihood. The packet loss under normal nodes follows a Poisson distribution, while the packet loss under malicious nodes exhibits a burst characteristic.

[0204] Step S8: Bayesian posterior updating and belief maintenance.

[0205] In this step, the Bayesian formula is applied to update the posterior probability:

[0206]

[0207] =1-

[0208] Where, is the attacker’s historical action set, The probability of an attack action to defend against an attacker.

[0209] In this step, the defender is based on the posterior Update the belief about the attacker type; set boundary conditions: if <0.01, set to 0.01. If the value is >0.99, set it to 0.99 to avoid extreme beliefs.

[0210] Step S9: Dynamic update of game strategy.

[0211] In this step, the threshold parameter ε is set to 0.1. If , indicating that the belief in the attacker type has changed significantly, and the subgame equilibrium strategy needs to be re-solved and If the belief changes are not significant, the original equilibrium strategy is used to avoid resource consumption caused by frequent calculations.

[0212] Step S10: Optimizing intrusion detection system parameters.

[0213] In this step, according to the current posterior probability Adjust the intrusion detection system parameters; when When it is higher, the detection depth and feature extraction dimension are increased; when When the value is low, reduce the detection frequency and save resources.

[0214] In this step, the detection threshold is dynamically adjusted , so that it is positively correlated with the posterior probability:

[0215]

[0216] in is the basic threshold, and λ is the adjustment coefficient.

[0217] like Figure 4 As shown in the figure, IDS parameter optimization specifically includes the following steps:

[0218] Step S101: Obtain the current posterior probability ;

[0219] Step S102: If > 0.7, set the high-intensity detection mode and increase the feature extraction dimension to 100% of the full dimension;

[0220] Step S103: If 0.3 < If ≤0.7, set the medium intensity detection mode and use 60% of the feature dimension;

[0221] Step S104: If If ≤0.3, low-intensity detection mode is set, using only 30% of the feature dimensions;

[0222] Step S105: According to the set detection mode, the computing resource allocation and the detection frequency are adjusted, and the optimized IDS parameter configuration is output.

[0223] Step S11: Security warning and log recording.

[0224] In this step, set the alarm threshold ,like > , a system security alarm is triggered; the alarm information includes: the PMU node ID that may be attacked, the attack probability estimation, and the current system vulnerability index.

[0225] In this step, the complete game information of each time slot k is recorded in the secure log database, including: state, action, observation, and posterior probability; the log is stored in encrypted form to ensure security and integrity.

[0226] Step S12: phasor measurement unit data loss assessment.

[0227] In this step, the impact of the current PMU data loss on the system observability is calculated; the evaluation method is to compare the difference between the Gramian trace under the complete PMU data and the current Gramian trace.

[0228] In this step, the loss rate is defined to quantify the degree of decline in observation capability:

[0229]

[0230] Where, is the observation matrix under the current signal loss state, is the full matrix under the current signal loss state.

[0231] When the preset threshold is exceeded =0.4, the PMU data compensation mechanism is triggered.

[0232] Step S13: Control performance evaluation and WADC adjustment.

[0233] In this step, the current packet loss rate is evaluated Impact on WADC control performance; calculation of control performance indicators :

[0234]

[0235] in, is the system frequency deviation.

[0236] In this step, the baseline performance is compared with the non-attack case. = 0.1, evaluate the performance degradation rate:

[0237]

[0238] when When the fault occurs, it automatically switches to the backup control strategy to enhance the robustness of the system.

[0239] Step S14: Defense efficiency and resource consumption evaluation.

[0240] In this step, defense efficiency indicators are regularly counted (every N=100 time slots):

[0241] Detection accuracy , where TP is true positive, TN is true negative, FP is false positive, and FN is false negative.

[0242] In this step, the resource consumption indicators are calculated:

[0243]

[0244] Where, The defender's action at time i, is the defense coefficient, which is approximately 0.2.

[0245] Represents the cumulative defense cost of the last N time slots; calculates the performance-cost ratio , as a comprehensive evaluation of the efficiency of the defense strategy; record the PCR time series and analyze the changing trend of the defense efficiency.

[0246] Step S15: Adaptive adjustment of system parameters.

[0247] In this step, the game model parameters are adjusted according to the defense efficiency evaluation results. If the detection accuracy Acc<0.8, the α value is increased to increase the emphasis on system performance. If the resource consumption is too high, the β value is increased to control the defense cost.

[0248] In this step, the threshold parameters ε and , so that it adapts to the current network security environment; the adjusted parameters must satisfy the consistency constraint: α+β=1, ensuring weight normalization.

[0249] Step S16: Network topology and security model update.

[0250] In this step, every M = 1000 time slots, the network topology security characteristics are re-evaluated based on the accumulated data; key communication nodes and vulnerable links are identified, and the system vulnerability map is updated.

[0251] In this step, the attacker behavior model and strategy distribution are updated based on historical attack patterns; based on the new network characteristics, the state space S and transition probability P are reconstructed to maintain the timeliness of the model.

[0252] Step S17: loop iteration and end.

[0253] In this step, the time slot count is incremented: ;like If the system stability index meets the requirements, the process returns to step S5 and continues the cycle; if the maximum time slot is reached or the system performance is severely degraded, the simulation ends.

[0254] In this step, a complete defense report is generated, including statistical indicators (average detection rate, over-defense rate, resource saving ratio), time series charts and security recommendations, and archived for system administrators to analyze and evaluate.

[0255] The present invention designs attack and defense strategies for the two-channel communication channel. The results are as follows: Figures 5 to 8 As shown. Figure 5 As shown, the possibility that the defender takes action [0,0] is The probability that the defender takes [defense, defense] is 44.1%; the probability that the defender takes [no defense, defense] and [defense, no defense] is 0. Figure 6 As shown in , the probability that the defender proposes [no defense, no defense] for both channels is 0%, and the probability that the defender proposes [no defense, defense] for both channels is 87%. The probability that the defender adopts [defense, no defense] for both channels is 0%, and the probability that the defender adopts a defense strategy for both channels is 13%. Figure 7 As shown in , the probability that the defender proposes [no defense, no defense] for both channels is 0%, and the probability of proposing [no defense, defense] for both channels is 0%. The probability of adopting [defense, no defense] for the channels is 49%, and the probability of adopting a defense strategy for both channels is 51%. Figure 8 As shown, the probability that the defender proposes the strategy of [defense, defense] is 100%.

Claims

1. An adaptive defense method for denial of service attacks based on incomplete information random game, characterized by The method comprises the following steps: Step S1: Establish a system vulnerability model based on the observability Gramian matrix and initialize the incomplete information random game framework; Step S2: Define the game action space and transition probability, and construct the utility function; Step S3: Construct a complete information subgame model and solve the Nash equilibrium strategy; Step S4: Time slot cycle initialization and data acquisition preparation: Step S41: Set the current time slot count k=0, the maximum operating time slot , the simulation time step is 100ms; collect the initial PMU data of the node test system and obtain the phase angle data of the key nodes; Step S42: Establish a PMU data communication link topology diagram to determine the data flow direction and key communication nodes; Initialize the system status monitor and record the number of packet losses per time slot in real time Communication delay ; Step S5: Calculate and execute defensive actions based on the Bayesian hybrid strategy: Step S51: Based on the current posterior probability , calculate the defender's mixed strategy: Step S52: Hybrid strategy calculation and execution: Step S521: Based on the current system status Query the mixed strategy table to obtain the probability of "triggering detection" in this state ; Step S522: Generate a random number ,like Then select action , trigger detection, otherwise select , does not trigger detection; Step S523: Execute the selected defense action. If detection is triggered, activate the deep packet inspection (DPI) module to analyze the communication content. Step S6: Attacker action generation and system state transition: Step S61: The attacker selects an action based on its true type. If it is a malicious type, it randomly selects an action based on its strategy. If it selects an attack action, it sends interference data packets to the target PMU communication link, causing the packet loss rate to increase. If it is a normal node, it sends PMU data according to the regular communication protocol and does not perform interference. Step S62: The system updates the state based on the actions of both parties, and the observability Gramian is updated to: Where η is the recovery coefficient when the detection is successful, is the observable coefficient of the current state, is the observation coefficient corresponding to the current attacker's action state, is the defender's current action, Action for the initial defender; The packet loss rate is updated to: Where, is the next state packet loss rate, is the packet loss rate caused by the attacker’s current action, is the packet loss compensation for the defender’s current action, is the maximum packet loss rate; Step S7: Observation data collection and likelihood calculation: Step S71: Record observation data , including: number of lost packets , packet loss rate , Gramian trace changes; Step S72: Establish a likelihood function to calculate the conditional probability of observing data under different attacker types: and ; Step S73: Using a statistical model to estimate likelihood, packet loss at normal nodes follows a Poisson distribution, while packet loss at malicious nodes exhibits burst characteristics; Step S8: Bayesian posterior update and belief maintenance: Step S81: Apply the Bayesian formula to update the posterior probability: =1- Where, is the attacker’s historical action set, The probability of an attack action to defend against the attacker; Step S82: The defender uses the posterior Update the belief about the attacker type; set boundary conditions: if <0.01, set to 0.

01. If > 0.99, set it to 0.99 to avoid extreme beliefs; Step S9: Dynamic update of game strategy: Set the threshold parameter ε, if , indicating that the belief in the attacker type has changed significantly, and the subgame equilibrium strategy needs to be re-solved and If the belief change is not significant, the original equilibrium strategy is used. Step S10: Optimizing intrusion detection system parameters: Step S101: Based on the current posterior probability Adjust the intrusion detection system parameters; when When >0.6, the detection depth and feature extraction dimension are increased; when When <0.6, reduce the detection frequency; Step S102: Dynamically adjust the detection threshold , so that it is positively correlated with the posterior probability: in, is the basic threshold, λ is the adjustment coefficient; Step S103: IDS parameter optimization: Step S1031: Obtain the current posterior probability ; Step S1032: If > 0.7, set the high-intensity detection mode and increase the feature extraction dimension to 100% of the full dimension; Step S1033: If 0.3 < If ≤0.7, set the medium intensity detection mode and use 60% of the feature dimension; Step S1034: If If ≤0.3, low-intensity detection mode is set, using only 30% of the feature dimensions; Step S1035: According to the set detection mode, adjust the computing resource allocation and detection frequency, and output the optimized IDS parameter configuration; Step S11: Security warning and log recording: Step S111: Setting the alarm threshold ,like > , then a system security alarm is triggered, and the alarm information includes: the PMU node ID that may be attacked, the attack probability estimate, and the current system vulnerability index; Step S112: Record the complete game information of each time slot k into the security log database, including: state, action, observation, and posterior probability; the log is stored in encrypted form to ensure security and integrity; Step S12: Phase measurement unit data loss assessment: The loss rate is defined to quantify the degree of decline in observation capability: Where, is the observation matrix under the current signal loss state, It is the full matrix under the current signal loss state; when it exceeds the preset threshold When , the PMU data compensation mechanism is triggered; Step S13: Control performance evaluation and WADC adjustment: Step S131: Evaluate the current packet loss rate Impact on WADC control performance; calculation of control performance indicators : in, is the system frequency deviation; Step S132: Compare with the baseline performance without attack , evaluate the performance degradation rate: when When the system fails, it automatically switches to the backup control strategy to enhance the robustness of the system; Step S14: Defense efficiency and resource consumption evaluation: Step S141: Regularly collect statistics on defense efficiency index detection accuracy ; Step S142: Calculate resource consumption index , represents the cumulative defense cost of nearly N time slots; Step S143: Calculate performance-cost ratio , as a comprehensive evaluation of the efficiency of the defense strategy; Step S144: Record the PCR time series and analyze the changing trend of defense efficiency; Step S15: Adaptive adjustment of system parameters: Step S151: Adjust the game model parameters based on the defense efficiency evaluation results; if the detection accuracy Acc<0.8, increase the α value to increase the emphasis on system performance; if the resource consumption is too high, increase the β value to control the defense cost; Step S152: Dynamically adjust the threshold parameters ε and , so that it adapts to the current network security environment; the adjusted parameters must meet the consistency constraint: α+β=1, ensuring weight normalization; Step S16: Network topology and security model update: Step S161: Every M time slots, re-evaluate the network topology security characteristics based on the accumulated data; identify key communication nodes and vulnerable links, and update the system vulnerability map; Step S162: Update the attacker behavior model and strategy distribution based on historical attack patterns; reconstruct the state space S and transition probability P based on new network characteristics to maintain the timeliness of the model; Step S17: Loop iteration and end: Step S171: Time slot count increments: ;like If the system stability index meets the requirements, the process returns to step S5 and the cycle continues. If the maximum time slot is reached or the system performance is severely degraded, the simulation ends. Step S172: Generate a complete defense report, including statistical indicators, time series charts and security recommendations, and archive it for analysis and evaluation by the system administrator.

2. The method for adaptive defense against denial of service attacks based on incomplete information random game according to claim 1 is characterized in that The specific steps of step S1 are as follows: Step S11: Use the power system linearization model to establish the continuous-time system dynamic equation: in, is the system state vector, A is the system matrix, B is the control matrix, and u is the control input; The measurement equation is: Where C is the output matrix and y is the phase angle data obtained by the PMU. When the communication link is affected by a DoS attack, the system state measurement matrix changes to C(t), where c is the communication state variable. c = 1 indicates normal communication, and c = 0 indicates communication is under attack. Step S12: Calculate the system observability Gramian matrix: in, is the transposed vector of the system state vector; Obtained by solving the following Lyapunov equation: Take its trace value As an important indicator to quantify the vulnerability level of the system under DoS attack; Step S13: Define the game subjects: attacker and defender; set the attacker type space ,in represents a normal PMU data sending node, 1 represents a malicious attacker; set the initial prior probability; define the system state vector, where is the trace of the observability Gramian of the k-th time slot, is the current packet loss rate.

3. The method for adaptive defense against denial of service attacks based on incomplete information random game according to claim 1 is characterized in that The specific steps of step S2 are as follows: Step S21: Set the attacker action set , where 1 means "launch DoS attack" and 0 means "do not launch attack"; set the defender action set , where 1 means "trigger intrusion detection system" and 0 means "do not trigger detection"; Step S22: Construct a state transition function and a state transition probability. The state transition probability is related to the bit error rate (BER) of the communication channel: Where, ( ) is the action state of the attacker and defender in the next state, ( ) is the action status of the attacker and defender in the current state; Step S23: Define the reward function for different attacker types: When the attacker type is malicious: Where, is the BER of wireless transmission of communication channel k; and are the energy consumption coefficients of the attacker and defender, respectively; The action reward value for the defender and attacker; is the reward value at the next moment; When the attacker type is normal signal: in, Indicates the current action is defense.

4. The method for adaptive defense against denial of service attacks based on incomplete information random game according to claim 3 is characterized in that The BER is calculated by the following formula: Where, is the average SNR, , .

5. The method for adaptive defense against denial of service attacks based on incomplete information random game according to claim 1 is characterized in that The specific steps of step S3 are as follows: Step S31: Construct a complete information random game model for the attacker type: Where, is the current state, Action for the attacker, Action for the defender, is the current action probability, The reward the attacker receives for attacking. The bonus for attackers when they attack and defenders when they defend; Step S32: Construct a complete information random game model for the attacker type: Where, is the reward the attacker receives when he does not attack. The bonus for attackers when they attack and defenders when they defend; Step S33: Use the minimax-Q learning algorithm to solve the optimal Markov strategy of the defender in the game and , these two strategies correspond to the defender's optimal action probability distribution under the two assumptions of "the attacker is determined to be malicious" and "the attacker is determined to be normal", and the Q value is updated by the following iterative formula: Among them, α is the learning rate, d is the discount factor, is the current state reward value, is the reward value at the next moment, is the attenuation coefficient; Step S34: Verify the uniqueness of the Nash equilibrium solution to ensure strategy convergence; set a convergence threshold during the Q learning iteration process, and consider the strategy to have converged when the Q value change between two iterations is less than this threshold.

6. The method for self-adaptive defense against denial of service attacks based on incomplete information random game according to claim 1, characterized in that In step S141, the detection accuracy The calculation formula is: Among them, TP is true positive, TN is true negative, FP is false positive, and FN is false negative.

7. The method for self-adaptive defense against denial of service attacks based on incomplete information random game according to claim 1, characterized in that In step S142, the resource consumption index is calculated as follows: Where, The defender's action at time i, is the defense coefficient.

8. The method for self-adaptive defense against denial of service attacks based on incomplete information random game according to claim 1, characterized in that In step S143, the performance-cost ratio is calculated as follows: 。

Images