False data injection attack design and detection method for wind power equipment
By constructing a normal output model of wind turbines and an equivalent model of voltage-controlled inverters, combined with two-dimensional similarity measurement and SVDD algorithm, the problem of identifying false data injection attacks on wind power equipment is solved, efficient wind farm inverter attack detection is achieved, and the stability of the power system is guaranteed.
Patent Information
- Application Number
- CN202510590554.X
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-08
- Publication Date
- 2025-09-16
AI Technical Summary
Existing technologies have difficulty in effectively identifying false data injection attacks on wind power equipment, especially when the static detection model and the dynamic attack mode are mismatched, resulting in high false alarm and missed alarm rates, which affects the stability of the power system.
By constructing a normal output model of wind turbines and an equivalent model of voltage-controlled inverters, combined with two-dimensional similarity measurement and support vector data description (SVDD) algorithm, an optimal hypersphere model is trained to realize attack detection on wind farm inverters.
It has achieved accurate identification of inverters of wind farm power electronic equipment, reduced the missed reporting rate to 0.06%, and increased the accuracy of abnormal identification to 99.1%, effectively blocking the risk of failure caused by tampering of inverter parameters.
Smart Images
Figure CN120658423A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the technical field of power system information security, and in particular to a design and detection method for false data injection attacks on wind power equipment. Background Art
[0002] In recent years, global wind power installed capacity has climbed rapidly, reaching 117GW in 2023. This has intensified the threat of false data attacks facing power systems. Traditional detection methods primarily rely on rule engines and statistical models. Their core flaw lies in the mismatch between static detection mechanisms and dynamic attack patterns. Research has shown that rule-based approaches based on threshold judgments have a false alarm rate exceeding 15% when responding to new attacks, while shallow machine learning algorithms consume over 70% of computing power to process massive amounts of wind power data, making it difficult to meet real-time detection requirements. Furthermore, existing machine learning methods generally rely on large numbers of labeled samples, yet in actual operating environments, anomalous data accounts for less than 0.1%, resulting in a 30%-40% drop in detection accuracy when deployed.
[0003] Current technology lacks consideration for attacks on wind turbine power electronics. By tampering with wind turbine inverter control parameters (such as the voltage phase angle δ), attackers can create power output anomalies within 0.5 seconds. These attacks often disguise themselves as normal fluctuations, making them difficult to detect due to the lack of time-series correlation analysis capabilities of traditional methods. Experimental data shows that when the power deviation caused by the attack is controlled within the 5%-15% range, the existing detection system has a false alarm rate of up to 65%. Successful bypasses of the attack can trigger cascading failures, resulting in a 12%-18% decrease in regional power grid stability.
[0004] These issues expose technical bottlenecks: a mismatch between static detection models and the dynamic evolution of attacks, and insufficient learning capabilities for small sample sizes and anomaly scenarios. There is an urgent need to develop a detection system that integrates time series feature analysis and unsupervised learning to accurately identify covert attacks and ensure the safe and stable operation of power systems in scenarios with a high proportion of wind power integration. Summary of the Invention
[0005] 1. Technical problems to be solved:
[0006] To address the above technical issues, this paper provides a design and detection method for false data injection attacks on wind power equipment. First, a feasible design for false data injection attacks against wind power equipment is described. Next, a positive sample matrix is generated by integrating the wind power system's day-ahead forecast curve with its intraday operating trajectory. A two-dimensional similarity measurement model is designed, combining the amplitude-sensitive nature of the Euclidean distance with the morphological matching capabilities of the Fréchet distance to construct a two-dimensional trajectory feature library. Finally, when only positive samples are available, an SVDD optimal hypersphere model is trained for attack detection.
[0007] 2. Technical solution:
[0008] A design and detection method for false data injection attacks on wind power equipment, characterized by comprising the following steps:
[0009] Step 1: Analyze the feasibility model of wind farm inverter attacks and construct a normal wind turbine output model: Build an equivalent model of a voltage-controlled inverter and derive the attack principle of wind farm wind turbine inverters. Use the Weibull distribution wind speed as the normal wind speed and establish the wind farm wind turbine output formula when obtaining normal wind speed data.
[0010] Step 2: Collect the normal wind farm's historical day-ahead predicted power series and daily actual power series as training samples; preprocess the training samples to remove noise and dimension differences; perform trajectory similarity measurement on the preprocessed training samples, and form the results of the trajectory similarity measurement into a two-dimensional feature vector;
[0011] Step 3: Input the two-dimensional feature vector into the SVDD training module for optimal hypersphere training. Calculate the trajectory similarity measure between the current predicted value and the actual power value and form the result into a two-dimensional feature vector. Substitute the result into the trained SVDD detection module for detection. When the test sample exceeds the hypersphere boundary, an alarm is triggered, and the control instruction is frozen and historical data is back-tested.
[0012] Furthermore, step one specifically includes the following steps:
[0013] S11: The voltage-controlled grid-connected inverter is equivalent to an ideal voltage source and an impedance in series; the inverter output active power is:
[0014]
[0015] γ c =δ+arctan(r / X)
[0016] In the equivalent model, E represents the inverter output voltage, δ is the angle of the inverter output voltage, Ug is the grid voltage, r is the equivalent output resistance of the inverter and the grid, X is the equivalent output reactance of the inverter and the grid, γ c Intermediate variables for calculation;
[0017] Since the equivalent reactance in the actual circuit is much larger than the resistance, the resistance r can be ignored in the formula, and the inverter output active power formula is simplified to:
[0018]
[0019] When the inverter is attacked, it only needs to change the inverter's δ to change the inverter's final output power, thus achieving the attack.
[0020] S12: Preset normal scenario, where the basic wind speed follows the Weibull distribution:
[0021] v r ~W(c,k)
[0022] Among them, v r is the true wind speed, W is the Weibull distribution, k and c are the parameters of the Weibull distribution;
[0023] S13: Generate normal fan output:
[0024]
[0025] Among them, P N is the rated output of the fan, v r is the true wind speed, v N is the rated wind speed, v i is the cut-in wind speed, v o To cut out wind speed.
[0026] Furthermore, step 2 specifically includes:
[0027] S21: Convert the 96-point vector data predicted on the day ahead and the 96-point vector data measured on the day into a 24-point output trajectory matrix:
[0028] Tp=[p t-23 ,...,p t ]
[0029] Tr=[r t-23 ,....,r t ]
[0030] In the above formula, Tp is the 24-point output trajectory matrix predicted on the day before, Tr is the 24-point output trajectory matrix measured on the day, and p t is the predicted value at a certain time of day, r t It is the measured value at a certain time of day;
[0031] S22: Adaptive normalization algorithm is used to eliminate the dimensional difference between the two output trajectory matrices, as shown in the following formula:
[0032]
[0033] In the above formula, x is the original data value; x min is the minimum value in the data, x max is the maximum value in the data; min is the minimum value of the target data range; y max is the maximum value of the target data range; y is the normalized data;
[0034] S23: Use the Euclidean distance to calculate the trajectory similarity of the elements in the two normalized output trajectory matrices, as follows:
[0035]
[0036] In the above formula, x 1k Describe a point on the first trajectory; x 2k represents a point on the second trajectory; d represents the Euclidean distance between the two trajectories;
[0037] S24: Calculate the trajectory similarity of the two output trajectory matrices using the following Fréchet distance:
[0038]
[0039] Among them, X ai is a point on the first trajectory; Y bi is a point on the second trajectory, X T is the coordinate vector on the first trajectory, Y T is the coordinate vector on the second trajectory, d F (X T ,Y T ) is the Fréchet distance between trajectories a and b;
[0040] S25: The results of the similarity of the two trajectories calculated in steps S23 and S24 are combined into a two-dimensional feature vector as a trajectory similarity measure; all the two-dimensional feature vectors are combined as the final training sample.
[0041] Furthermore, the final training samples extracted in step 3 are input into the optimal hypersphere training module of SVDD, where the optimal hypersphere objective function is:
[0042]
[0043] ST
[0044]
[0045] Among them, α is the center of the hypersphere, R is the radius of the hypersphere, and x i is the original data, C is a constant, ζ i is the relaxation factor; the calculation formula of the hypersphere radius R is:
[0046]
[0047] Among them, K is the kernel function, x is the support vector, β i is x i The corresponding coefficient, β j is x j The corresponding coefficient.
[0048] Furthermore, in step 3, the trajectory similarity measure between the current predicted value and the actual power value is calculated and the result is formed into a two-dimensional feature vector. When the vector is substituted into the trained SVDD detection module for detection, if the elements of the feature vector fall within the optimal hypersphere, the inverter state at that moment is determined to be normal. If the elements of the feature vector fall outside the optimal hypersphere, the inverter state at that moment is determined to be under attack.
[0049] 3.Beneficial effects:
[0050] (1) This paper innovatively considers the attack situation of wind farm power electronic equipment inverter. By constructing the normal output model of wind turbine and the equivalent model of voltage-controlled inverter, it reveals the formation mechanism of attack on wind farm power electronic equipment in the energy conversion link.
[0051] (2) The present invention innovatively introduces the training samples of the trajectory similarity measurement of the improved support vector data description (SVDD) algorithm, maps the high-dimensional features to the hypersphere classification space through the adaptive Gaussian kernel function, and only requires normal working condition data to train the detection model, thereby achieving accurate identification of micro-attacks with low rate deviation.
[0052] (3) The detection method provided by this solution implements dynamic normalization preprocessing on real-time data and eliminates false triggering caused by sudden changes in wind speed through two-dimensional trajectory similarity judgment; the decision-making part deploys the SVDD classifier and confidence assessment module, achieving an anomaly recognition accuracy of 99.1% with a false negative rate of less than 0.06%, effectively blocking the failure risk caused by tampering of the δ parameters of the inverter of the wind farm power electronic equipment. BRIEF DESCRIPTION OF THE DRAWINGS
[0053] Figure 1 is an example flow chart of the present invention;
[0054] Figure 2 It is the decision diagram of SVDD for training data in a specific embodiment;
[0055] Figure 3 It is a decision diagram of SVDD for test data in a specific embodiment. DETAILED DESCRIPTION
[0056] The present invention will be described in detail below with reference to the accompanying drawings.
[0057] As attached Figure 1 As shown, a false data injection attack design and detection method for wind power equipment is characterized by comprising the following steps:
[0058] Step 1: Analyze the feasibility model of wind farm inverter attacks and construct a normal wind turbine output model: Build an equivalent model of a voltage-controlled inverter and derive the attack principle of wind farm wind turbine inverters. Use the Weibull distribution wind speed as the normal wind speed and establish the wind farm wind turbine output formula when obtaining normal wind speed data.
[0059] Step 2: Collect the normal wind farm's historical day-ahead predicted power series and daily actual power series as training samples; preprocess the training samples to remove noise and dimension differences; perform trajectory similarity measurement on the preprocessed training samples, and form the results of the trajectory similarity measurement into a two-dimensional feature vector;
[0060] Step 3: Input the two-dimensional feature vector into the SVDD training module for optimal hypersphere training. Calculate the trajectory similarity measure between the current predicted value and the actual power value and form the result into a two-dimensional feature vector. Substitute the result into the trained SVDD detection module for detection. When the test sample exceeds the hypersphere boundary, an alarm is triggered, and the control instruction is frozen and historical data is back-tested.
[0061] Furthermore, step one specifically includes the following steps:
[0062] S11: The voltage-controlled grid-connected inverter is equivalent to an ideal voltage source and an impedance in series; the inverter output active power is:
[0063]
[0064] γ c =δ+arctan(r / X)
[0065] In the equivalent model, E represents the inverter output voltage, δ is the angle of the inverter output voltage, Ug is the grid voltage, r is the equivalent output resistance of the inverter and the grid, X is the equivalent output reactance of the inverter and the grid, γ c Intermediate variables for calculation;
[0066] Since the equivalent reactance in the actual circuit is much larger than the resistance, the resistance r can be ignored in the formula, and the inverter output active power formula is simplified to:
[0067]
[0068] When the inverter is attacked, it only needs to change the inverter's δ to change the inverter's final output power, thus achieving the attack.
[0069] S12: Preset normal scenario, where the basic wind speed follows the Weibull distribution:
[0070] v r ~W(c,k)
[0071] Among them, v r is the true wind speed, W is the Weibull distribution, k and c are the parameters of the Weibull distribution;
[0072] S13: Generate normal fan output:
[0073]
[0074] Among them, P N is the rated output of the fan, v r is the true wind speed, v N is the rated wind speed, v i is the cut-in wind speed, v o To cut out wind speed.
[0075] Furthermore, step 2 specifically includes:
[0076] S21: Convert the 96-point vector data predicted on the day ahead and the 96-point vector data measured on the day into a 24-point output trajectory matrix:
[0077] Tp=[p t-23 ,...,p t ]
[0078] Tr=[r t-23 ,....,r t ]
[0079] In the above formula, Tp is the 24-point output trajectory matrix predicted on the day before, Tr is the 24-point output trajectory matrix measured on the day, and p t is the predicted value at a certain time of day, r t It is the measured value at a certain time of day;
[0080] S22: Adaptive normalization algorithm is used to eliminate the dimensional difference between the two output trajectory matrices, as shown in the following formula:
[0081]
[0082] In the above formula, x is the original data value; x min is the minimum value in the data, x max is the maximum value in the data; min is the minimum value of the target data range; y max is the maximum value of the target data range; y is the normalized data;
[0083] S23: Use the Euclidean distance to calculate the trajectory similarity of the elements in the two normalized output trajectory matrices, as follows:
[0084]
[0085] In the above formula, x 1kDescribe a point on the first trajectory; x 2k represents a point on the second trajectory; d represents the Euclidean distance between the two trajectories;
[0086] S24: Calculate the trajectory similarity of the two output trajectory matrices using the following Fréchet distance:
[0087]
[0088] Among them, X ai is a point on the first trajectory; Y bi is a point on the second trajectory, X T is the coordinate vector on the first trajectory, Y T is the coordinate vector on the second trajectory, d F (X T ,Y T ) is the Fréchet distance between trajectories a and b;
[0089] S25: The results of the similarity of the two trajectories calculated in steps S23 and S24 are combined into a two-dimensional feature vector as a trajectory similarity measure; all the two-dimensional feature vectors are combined as the final training sample.
[0090] Furthermore, the final training samples extracted in step 3 are input into the optimal hypersphere training module of SVDD, where the optimal hypersphere objective function is:
[0091]
[0092] ST
[0093]
[0094] Among them, α is the center of the hypersphere, R is the radius of the hypersphere, and x i is the original data, C is a constant, ζ i is the relaxation factor; the calculation formula of the hypersphere radius R is:
[0095]
[0096] Among them, K is the kernel function, x is the support vector, β i is x i The corresponding coefficient, β j is x j The corresponding coefficient.
[0097] Furthermore, in step 3, the trajectory similarity measure between the current predicted value and the actual power value is calculated and the result is formed into a two-dimensional feature vector. When the vector is substituted into the trained SVDD detection module for detection, if the elements of the feature vector fall within the optimal hypersphere, the inverter state at that moment is determined to be normal. If the elements of the feature vector fall outside the optimal hypersphere, the inverter state at that moment is determined to be under attack. Specific embodiment:
[0099] To verify the effectiveness of the detection method of the present invention, this embodiment selects three wind farms in a regional power grid as experimental subjects. Wind farms A and B both provide historical day-ahead forecast data and daily measured data, with wind farm C serving as the target for attack, simulating a false data injection scenario. The normalized target range values are set to 0 and 10, respectively. A Gaussian kernel function (gamma value 0.05, cost value 0.04) is used to generate a normally distributed wind speed corresponding to the Weibull distribution of wind farm C. The wind turbine output under this normally distributed wind speed is set as the target value for the false data attack.
[0100] Figure 2 This figure shows the optimal decision obtained by training SVDD using the training sample (a two-dimensional vector composed of the trajectory similarities of wind farm A and B data) in this example. The outer red ellipse is the decision boundary, representing the minimum enclosing hypersphere projection constructed by SVDD in high-dimensional space. Over 200 blue scattered points are densely distributed linearly along the x=y diagonal (with coordinates concentrated in the 10-12 range), consistent with the normal operating parameters of the wind farm inverter. The six green support vector markers, distributed at both ends of the data trajectory, represent key boundary samples in the data distribution. The decision boundary compactness index reaches 0.87 (area / perimeter ratio), indicating that the SVDD model accurately describes normal operating conditions.
[0101] Figure 3 The distribution of the test data of this embodiment (a two-dimensional vector composed of the trajectory similarity of the wind farm C data) in the two-dimensional feature space and the effect of decision boundary division are demonstrated. The square sensitive scattered points are densely distributed in the coordinate interval [2,8]×[5,12], while the circle point samples in the normal area enclosed by the ellipse (coordinate range [10,14]×[10,14]) are distributed in a straight line. The decision boundary effectively separates the normal area from the abnormal area. Experimental data show that the anomaly detection rate based on this decision boundary reaches 99.1% (100% of the samples outside the ellipse area are judged as abnormal). The results show that the present invention, through the design of the decision boundary, accurately captures high-dimensional feature offset samples (abnormal sensitive areas) while ensuring the integrity of the main data area, verifying the spatial segmentation advantages and engineering applicability of this method in complex data scenarios.
[0102] Although the present invention has been disclosed above in terms of preferred embodiments, they are not intended to limit the present invention. Anyone skilled in the art can make various changes or modifications without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention should be based on the scope of protection defined by the claims of this application.
Claims
1. A design and detection method for false data injection attacks on wind power equipment, characterized by: The following steps are involved: Step 1: Analyze the feasibility model of wind farm inverter attacks and construct a normal wind turbine output model: Build an equivalent model of a voltage-controlled inverter and derive the attack principle of wind farm wind turbine inverters. Use the Weibull distribution wind speed as the normal wind speed and establish the wind farm wind turbine output formula when obtaining normal wind speed data. Step 2: Collect the normal wind farm historical day-ahead predicted power series and daily actual power series as training samples; Preprocess the training samples to remove noise and dimension differences; Perform trajectory similarity measurement on the preprocessed training samples, and form the results of trajectory similarity measurement into a two-dimensional feature vector; Step 3: Input the two-dimensional feature vector into the SVDD training module for optimal hypersphere training; The trajectory similarity measure between the current predicted value and the actual power value is calculated and the result is combined into a two-dimensional feature vector. The vector is then substituted into the trained SVDD detection module for detection. When the test sample exceeds the boundary of the hypersphere, an alarm is triggered, and the control instruction is frozen and historical data is back-tested.
2. A false data injection attack design and detection method for wind power equipment according to claim 1, characterized in that: Step 1 specifically includes the following steps: S11: The voltage-controlled grid-connected inverter is equivalent to an ideal voltage source and an impedance in series; the inverter output active power is: γ c =δ+arctan(r / X) In the equivalent model, E represents the inverter output voltage, δ is the angle of the inverter output voltage, Ug is the grid voltage, r is the equivalent output resistance of the inverter and the grid, X is the equivalent output reactance of the inverter and the grid, γ c Intermediate variables for calculation; Since the equivalent reactance in the actual circuit is much larger than the resistance, the resistance r can be ignored in the formula, and the inverter output active power formula is simplified to: When the inverter is attacked, it only needs to change the inverter's δ to change the inverter's final output power, thus achieving the attack. S12: Preset normal scenario, where the basic wind speed follows the Weibull distribution: v r ~W(c,k) Among them, v r is the true wind speed, W is the Weibull distribution, k and c are the parameters of the Weibull distribution; S13: Generate normal fan output: Among them, P N is the rated output of the fan, v r is the true wind speed, v N is the rated wind speed, v i is the cut-in wind speed, v o To cut out wind speed.
3. A false data injection attack design and detection method for wind power equipment according to claim 2, characterized in that: Step 2 specifically includes: S21: Convert the 96-point vector data predicted on the day ahead and the 96-point vector data measured on the day into a 24-point output trajectory matrix: Tp=[p t-23 ,...,p t ] Tr＝[r t-23 ,....,r t ] In the above formula, Tp is the 24-point output trajectory matrix predicted on the day before, Tr is the 24-point output trajectory matrix measured on the day, and p t is the predicted value at a certain time of day, r t It is the measured value at a certain time of day; S22: Adaptive normalization algorithm is used to eliminate the dimensional difference between the two output trajectory matrices, as shown in the following formula: In the above formula, x is the original data value; x min is the minimum value in the data, x max is the maximum value in the data; min is the minimum value of the target data range; y max is the maximum value of the target data range; y is the normalized data; S23: Use the Euclidean distance to calculate the trajectory similarity of the elements in the two normalized output trajectory matrices, as follows: In the above formula, x 1k Describe a point on the first trajectory; x 2k represents a point on the second trajectory; d represents the Euclidean distance between the two trajectories; S24: Calculate the trajectory similarity of the two output trajectory matrices using the following Fréchet distance: Among them, X ai is a point on the first trajectory; Y bi is a point on the second trajectory, X T is the coordinate vector on the first trajectory, Y T is the coordinate vector on the second trajectory, d F (X T ,Y T ) is the Fréchet distance between trajectories a and b; S25: The results of the similarity of the two trajectories calculated in steps S23 and S24 are combined into a two-dimensional feature vector as a trajectory similarity measure; all the two-dimensional feature vectors are combined as the final training sample.
4. A false data injection attack design and detection method for wind power equipment according to claim 3, characterized in that: The final training samples extracted in step 3 are input into the optimal hypersphere training module of SVDD, where the optimal hypersphere objective function is: ST Among them, α is the center of the hypersphere, R is the radius of the hypersphere, and x i is the original data, C is a constant, ζ i is the relaxation factor; the calculation formula of the hypersphere radius R is: Among them, K is the kernel function, x is the support vector, β i is x i The corresponding coefficient, β j is x j The corresponding coefficient.
5. A false data injection attack design and detection method for wind power equipment according to claim 4, characterized in that: In step 3, the trajectory similarity measure between the current predicted value and the actual power value is calculated and the result is formed into a two-dimensional feature vector. When it is substituted into the trained SVDD detection module for detection, if the elements of the feature vector fall within the optimal hypersphere, the inverter state at that moment is determined to be normal. If the elements of the feature vector fall outside the optimal hypersphere, the inverter state at that moment is determined to be in an attacked state.