Intelligent power grid intrusion detection method and system based on event triggering

Abstract

The invention discloses a smart power grid intrusion detection method and system based on event triggering. Establishing a federal learning architecture and defining an optimization target and an event triggering mechanism; training an intrusion detection model according to the SCADA collected data to serve as a global model for federal learning architecture maintenance; the server side selects the client side based on a preset selection proportion and sends the global model to the selected client side; the client receives the global model and loads local SCADA acquisition data to execute the global model to perform intrusion detection on the smart power grid; the client verifies the local model parameters obtained by the current round of learning through an event trigger mechanism, and determines whether to upload the local model parameters to the server in the current round; and the server side aggregates the local model parameters uploaded by the client side and updates the global model parameters to enter the next round of learning. According to the method, through combination of federal learning and an event triggering mechanism, the performance of intelligent power grid intrusion detection is improved, the communication overhead is reduced, and the learning efficiency is improved.

Description

Technical Field

[0001] This invention belongs to the field of smart grid intrusion detection technology, specifically relating to an event-triggered smart grid intrusion detection method and system. Background Technology

[0002] In recent years, malicious attacks targeting Supervisory Control and Data Acquisition (SCADA) systems, smart meters, and distributed energy control units have become increasingly frequent, with attack methods becoming increasingly covert and collaborative. Therefore, research on network intrusion detection in smart grids is of great significance. Significant progress has been made in building intrusion detection models using machine learning or deep learning algorithms. However, the current urgent need is to find a way to balance privacy protection and efficient collaboration in intrusion detection technology.

[0003] Experts have proposed federated learning based on distributed computing principles. Its core lies in allowing multiple participants to collaboratively train a global model without sharing original data. This effectively mitigates data privacy risks and reduces the load on central nodes by leveraging distributed computing power. For example, patent application CN114980109A employs a Transformer-based interactive detection model trained locally on smart meters, a sparse training framework combining local aggregation on 5G base station edge servers and global aggregation on cloud servers, along with 5G network transmission and network slicing technologies. This achieves high-efficiency protection of eavesdropping detection performance, user data privacy, and effective reduction of network traffic. Patent application CN115208604A addresses the issue of terminal device node failure by proposing an AMI (Automatic Intrusion Detection) method for network intrusion detection. This avoids training data failure due to the failure of a terminal node during current data processing, fully utilizing local resources to improve the convergence speed of federated learning and the efficiency of intrusion detection. The patent application with publication number CN116260617A addresses the problem of insufficient data volume caused by data privacy and security issues. It utilizes generative adversarial networks based on federated learning to augment data and improve the accuracy of anomaly detection tasks.

[0004] The shortcoming of the existing technology is that in the power system intrusion detection task, the client in the federated learning framework needs to upload the trained parameters to the aggregation server in each round. During the training process, especially when the algorithm tends to converge in the later stage of training, the changes in model parameters are not very obvious, resulting in the uploading of a lot of useless model parameters. Since the model parameters are usually very large, this process generates a lot of useless communication overhead. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides an event-triggered smart grid intrusion detection method and system. A federated learning architecture is established, and optimization objectives and event-triggered mechanisms are defined. An intrusion detection model is trained based on SCADA data, serving as the global model maintained by the federated learning architecture. The server selects clients based on a preset selection ratio and sends the global model to the selected clients. The client receives the global model, loads local SCADA data, and executes the global model to perform intrusion detection on the smart grid. The client verifies the local model parameters learned in this round using the event-triggered mechanism to determine whether to upload the local model parameters to the server in this round. The server aggregates the local model parameters uploaded by the clients and updates the global model parameters for the next round of learning.

[0006] The first aspect of this application discloses an event-triggered smart grid intrusion detection method, which adopts the following technical solution:

[0007] Establish a federated learning architecture and define optimization goals, initialize the server and client sides, and define the event triggering mechanism;

[0008] Based on the SCADA data collected by the power system, an intrusion detection model is constructed and trained, and the trained intrusion detection model is defined as a global model maintained by the federated learning architecture.

[0009] The server selects clients based on a preset selection ratio and sends the global model to the selected clients; the clients receive the global model and load local SCADA data to perform this round of learning, which involves using the global model to perform intrusion detection on the smart grid.

[0010] The client verifies the local model parameters learned in this round of learning through an event-triggered mechanism to determine whether to upload the local model parameters to the server in this round; the server aggregates the local model parameters uploaded by the client and updates the global model parameters to enter the next round of learning.

[0011] Furthermore, the federated learning adopts a parameter server architecture with one server and multiple clients;

[0012] The server is used to store, update, and synchronize global model parameters; the client is used to perform intrusion detection tasks using local SCADA collected data and to interact with the server to obtain local model parameters.

[0013] The optimization objective is to find a globally optimal model parameter that minimizes the weighted expectation of the globally optimal model parameter across all clients.

[0014] Furthermore, the definition of the event triggering mechanism includes:

[0015] An event is defined as the difference between the local model parameters learned by the client in this round and the local model parameters uploaded to the server in the previous round; when the difference is greater than the event trigger threshold, an update operation is triggered.

[0016] Different clients use different event trigger thresholds; for the i-th client, the event trigger threshold is calculated as the ratio of the initial threshold to the comprehensive value of the power grid characteristics of client i.

[0017] Furthermore, the training process of the intrusion detection model includes:

[0018] The SCADA data collected by the power system is multi-dimensional operational status data.

[0019] The SCADA data acquired by the power system is preprocessed into time series samples with a structure of a three-dimensional tensor X∈R. T×F×C That is, there are T time steps, each time step contains F-dimensional features, which constitute the input tensor of C channels;

[0020] A one-dimensional convolutional neural network is used to extract local time series features from time series samples, and a single-layer BiLSTM is used to extract long-term dependency features from the local time series features.

[0021] For the output of BiLSTM at each time step, a linear layer with an attention mechanism and a softmax function are used to assign weights, and the weighted sum is used to generate a context vector.

[0022] The context vector output by the attention mechanism is processed by applying dropout and fully connected layers to output logits representing m types of intrusion behaviors. The logits are then transformed into a probability distribution of intrusion behaviors through a softmax layer.

[0023] Furthermore, the server sends the global model to the selected client, including:

[0024] The preset client selection ratio is C = N / K. Based on the client number, N clients are selected from a total of K clients in a completely random manner for this round of learning.

[0025] In this round of learning, the server will use the global model and global model parameters w. (t) Send to N clients;

[0026] The client receives w (t) The global model is run based on locally collected SCADA data to perform intrusion detection in the smart grid, and local model parameters are obtained.

[0027] Furthermore, the determination of whether the local model parameters have been uploaded includes:

[0028] For client i, i∈[1,N], the local model parameters obtained in this round of learning Combine this with the local model parameters that client i uploaded to the server in the previous round. Perform difference calculations.

[0029] When the difference meets the triggering condition, client i will then change the local model parameters. Uploaded to the server, server updated. If the difference does not meet the triggering condition, client i will not upload local model parameters, and the server will use the local model parameters uploaded by client i in the previous round.

[0030] Furthermore, the updating of global model parameters includes:

[0031] The server aggregates all Update global model parameters using a weighted average strategy:

[0032]

[0033] Among them, w t+1 For the global model parameters updated in this round, |D i |and|D j | represents the number of time series samples on the local client i and j, respectively.

[0034] The second aspect of this application discloses an event-triggered smart grid intrusion detection method, employing the smart grid intrusion detection method described in the first aspect, wherein the system includes:

[0035] Federated learning initialization module: Establishes the federated learning architecture and defines optimization goals, initializes the server and client sides, and defines the event triggering mechanism;

[0036] Global model building module: Based on the SCADA data collected by the power system, build and train an intrusion detection model, and define the trained intrusion detection model as a global model maintained by the federated learning architecture;

[0037] A distributed intrusion detection module; the server selects clients based on a preset selection ratio and sends the global model to the selected clients; the client receives the global model and loads local SCADA collected data to perform this round of learning, wherein the learning is to use the global model to perform intrusion detection on the smart grid;

[0038] The global update and iteration module: The client verifies the local model parameters learned in this round of learning through an event-triggered mechanism to determine whether to upload the local model parameters to the server in this round; The server aggregates the local model parameters uploaded by the client and updates the global model parameters to enter the next round of learning.

[0039] The beneficial effects of this invention are compared with those of the prior art:

[0040] 1. This application, by introducing a federated learning architecture and an event-triggered mechanism, enables the sharing of training experience among multiple clients while maintaining data privacy and security. The server first trains a global model, which is then distributed to multiple clients for intrusion detection using local SCADA data. The server then updates the global model by aggregating the local model parameters uploaded by the clients, thereby enhancing the model's accuracy and robustness. Especially in complex and distributed environments such as power systems, the model can better adapt to the characteristics of different regions and devices, improving the accuracy of intrusion detection.

[0041] 2. The event-triggered mechanism proposed in this application adaptively adjusts the update frequency based on the grid characteristics of different clients (such as the proportion of core equipment, load change rate, network status, and grid health status), thereby ensuring high efficiency and stability during grid operation. By customizing trigger thresholds for each client, model updates can be triggered promptly when grid conditions are poor or load fluctuations are large, improving the system's responsiveness and adaptability. Furthermore, this personalized strategy optimizes resource utilization, reduces unnecessary update frequency, and improves model training efficiency, thereby ensuring the safe and stable operation of the grid.

[0042] 3. The global model proposed in this application employs a combined CNN-LSTM-Attention training process. This training process integrates Convolutional Neural Networks (CNN), Long Short-Term Memory Networks (LSTM), and attention mechanisms, enabling the model to extract temporal features from power system SCADA data at multiple levels. CNN extracts local time-series features, LSTM captures long-term dependencies, and the attention mechanism further focuses on information about key intrusion behaviors. This multi-level feature extraction method helps the model more accurately identify intrusion behaviors, improving the sensitivity and accuracy of intrusion detection. Attached Figure Description

[0043] Figure 1 This is a flowchart illustrating an event-triggered smart grid intrusion detection method.

[0044] Figure 2 For model performance comparison experiments—loss curves;

[0045] Figure 3For model performance comparison experiments—accuracy curves;

[0046] Figure 4 For model performance comparison experiments—accuracy curves;

[0047] Figure 5 For model performance comparison experiments—recall rate curves;

[0048] Figure 6 For model performance comparison experiments—F1 value curves;

[0049] Figure 7 A comparative experiment on communication overhead—the communication status of different models;

[0050] Figure 8 A comparison experiment of communication overhead—loss curves;

[0051] Figure 9 A comparison experiment of communication overhead—accuracy curve;

[0052] Figure 10 A comparison experiment of communication overhead—accuracy curves;

[0053] Figure 11 A comparative experiment on communication overhead—recall rate curve;

[0054] Figure 12 For the communication overhead comparison experiment—F1 value curve. Detailed Implementation

[0055] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of this invention. The embodiments described in this application are merely some embodiments of this invention, and not all embodiments. Based on the spirit of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the protection scope of this invention.

[0056] Example 1

[0057] This embodiment describes a specific implementation of an event-triggered smart grid intrusion detection method.

[0058] Step 1: Initialization and dataset partitioning.

[0059] Step 1.1: Federated Learning Modeling Architecture and Definition of Federated Optimization Objectives;

[0060] A ParameterServe (PS) architecture with one server and K clients is adopted. The server is responsible for storing, updating and synchronizing global model parameters for power system intrusion detection, while the clients use datasets collected by SCADA to perform calculation tasks and interact with the server to obtain and update local model parameters.

[0061] Given a SCADA dataset of power systems that are independent and identically distributed. Where N is the number of clients participating in each round of updates;

[0062] The goal of iterative updates is to find a globally optimal model parameter w. * , so that:

[0063]

[0064] Among them, w i These are the local model parameters for the i-th client;

[0065] f i () is the local loss function for the i-th client, defined as Let L represent the expected loss of the data sample on the i-th client, where L is used to evaluate the performance of the model parameters, and z follows a probability distribution P. i For a dataset D with independent and identically distributed random variables, we have P i =P j ;where P i and P j Let be the probability distributions of the i-th and j-th clients, respectively;

[0066] D represents the aggregate weight of the i-th client. i For the local dataset of the i-th client, For the global dataset; for p i ,have p i >0 is always true;

[0067] Step 1.2: Initialize the server and client, and define the event triggering mechanism;

[0068] Server-side initialization: Initialize global model parameters and distribute these global model parameters to all clients;

[0069] Client initialization: Preparing the local dataset D for training i The event triggering mechanism is initialized; wherein, the event refers to the local model parameters of client i after local training in the current round. Compared with the local model parameters uploaded to the server in the previous round The differences between them; the triggering condition is:

[0070]

[0071] in, Let ||·|| be the event trigger threshold for client i in the current round, and ||·|| be the Euclidean norm. It is a sequence that decays with the number of training epochs, defined as Where m0 is a constant greater than 0, used to control the initial threshold; τ i The event triggering threshold for client i, where t is the current training round. max λ represents the maximum number of training rounds, and λ is a constant used to control the threshold decay rate.

[0072] In this embodiment, the event triggering threshold is not the same for all clients, but is determined based on the power grid characteristics of each client. Specifically, for the i-th client, its power grid characteristics include the proportion of core equipment, load status, network status, and power grid health status.

[0073] The core equipment ratio is the proportion of core equipment among all power equipment in the i-th client. In this embodiment, the core equipment of the i-th client is defined as transformer, key switchgear, and main power distribution equipment, which can be added by power personnel according to the actual situation of the client.

[0074] The load situation is represented by the load change rate of the i-th client. If the load change rate of a client is higher, it indicates that the load change is larger, which means that the client may need more frequent model updates.

[0075] The network state reflects the communication quality between the i-th client and the server, and is represented by the sum of normalized network latency, the reciprocal of bandwidth, and packet loss rate. It is expressed as:

[0076]

[0077] Among them, C i,network This represents the network status of the i-th client. These represent the normalized values ​​of network latency and packet loss rate, respectively. This represents the normalized value of the inverse of the bandwidth.

[0078] The power grid health status is represented by the device failure rate of the i-th client, which is the ratio of device downtime to total device uptime. A higher failure rate indicates a worse power grid health status for the client, requiring more frequent updates.

[0079] Then the threshold τ for triggering the i-th client event i for:

[0080]

[0081] Where τ0 is the initial threshold used uniformly by all clients, and the denominator is the comprehensive electrical characteristic value, including: R i,coredevice R i,loadchange C i,network and C i,gridhealth These represent the core device percentage, load status, network status, and power grid health status of the i-th client, respectively; β1, β2, β3, and β4 represent R... i,coredevice R i,loadchange C i,network and C i,gridhealth The weights are determined by power company personnel based on the importance of different power grid characteristics to different clients, with β1+β2+β3+β4=1.

[0082] The event trigger threshold for each client is customized based on its grid characteristics. Specifically, when a client has a high proportion of core devices, significant load fluctuations, poor network conditions, or poor grid health, the threshold is lowered, allowing for more frequent model updates for that client. This helps ensure timely model updates under more complex and unstable grid conditions, maintaining system stability and reliability. When the trigger condition is met, client i will update the local model parameters obtained in this update. Upload to the server and update If the triggering condition is not met, no upload will be performed, and the server will use the local model parameters uploaded by client i in the previous round. Right now It should be noted that each client will upload local model parameters to the server in the first round.

[0083] Step 2: Define the global model maintained by federated learning in this method.

[0084] The global model has the structure of CNN-BiLSTM-Attention, and consists of five parts: a preprocessing module, a feature extraction module, a sequence modeling module, an attention mechanism module, and a classification module.

[0085] The input samples are multi-dimensional operating status data collected by the power system SCADA system, which are time series data, including but not limited to voltage, current, frequency, etc.

[0086] Preprocessing module: This module processes the input samples—the raw multidimensional time-series data collected by the power system SCADA system—through preprocessing steps such as time alignment, normalization, and sliding window segmentation, transforming them into time-series samples with a uniform structure, represented by a three-dimensional tensor X∈R. 122×122×1This means that within 122 time steps, each time step contains 122-dimensional features, forming a single-channel input tensor. Each sample represents the operating status of a monitoring point in the power system over 122 consecutive sampling times, exhibiting significant temporal correlation. This input sample preserves the dynamic evolution characteristics of the system operation, effectively reflecting potential operational anomalies and providing fundamental data support for subsequent feature extraction, sequence modeling, and other modules.

[0087] Feature extraction module: A one-dimensional CNN convolutional layer is used to extract local time series features from time series samples; the one-dimensional convolutional layer has 64 channels, a kernel size of 122, and contains 7872 parameters. Then, the ReLU activation function is applied, and a max pooling layer (kernel size 2, stride 2) is used to reduce the sequence length from 122 to 61.

[0088] Finally, local convolutional features, i.e. local time series features, are extracted through a batch normalization layer (containing 128 parameters). The output dimension is [61, 64], that is, 61 time steps, each with 64-dimensional local convolutional features.

[0089] Sequence modeling module: A single-layer BiLSTM is used to extract long-term dependency features from local time series features; the BiLSTM has an input dimension of 64, a hidden unit of 64, and an output dimension of 128, containing 66048 parameters, and uses sigmoid and tanh activation functions; the output dimension of each time step is [61, 128], which is the sequence feature encoding result of each time step.

[0090] Attention mechanism module: For each time step output in the range [61, 128], weights are assigned through a linear layer with 129 parameters and a softmax function, and the weighted sum is used to generate a 128-dimensional context vector. This step aims to identify the time segments that have the greatest impact on intrusion behavior, thereby enhancing the model's sensitivity to abnormal behavior.

[0091] The classification module applies a dropout layer with a dropout rate of 0.5 and a fully connected layer (mapping from 128 dimensions to 5 dimensions, containing 645 parameters) to the 128-dimensional context vector output by the attention mechanism module. This outputs five classes of logits, representing the model's original predictions for five types of intrusion behaviors or operational states, used to characterize the scores of samples in different categories. A softmax layer transforms the logits into a probability distribution, and the classification is performed using the cross-entropy loss function. Five classification labels are provided, corresponding to five typical operational states or attack behaviors in the smart grid network environment. Table 1 shows the correspondence between the classification labels and the typical operational states or attack behaviors.

[0092] Table 1. Correspondence between category labels and typical operating states or attack behaviors

[0093]

[0094] In this embodiment, the loss function is the cross-entropy function, and the optimizer is ADAM. This model outputs five classes of raw predicted values ​​(logits), containing 74,822 trainable parameters.

[0095] The CNN-BiLSTM-Attention model proposed in this step extracts local features through CNN, models long-term dependencies through BiLSTM, focuses key information through the attention mechanism, and combines dropout and batch normalization to improve generalization ability, and is used for power system intrusion detection tasks.

[0096] Step 3: Select a client and begin training;

[0097] 3.1: The server randomly selects a client for this round of training.

[0098] The preset client selection ratio is C. In each round, the server selects N clients for model training in this round using a completely random method based on the client number, according to the preset client selection ratio. Here, N is the number of clients trained in this round, and K is the total number of clients in the federated learning architecture.

[0099] 3.2: In each training round, the server will transfer the global model parameters w (t) Send to the N clients selected in 3.1;

[0100] 3.3: The selected client accepts w (t) The global model from step 2 is trained on the local dataset to obtain the local model parameters.

[0101] For client i, it loads its own local dataset D. i The local dataset is the SCADA data collected by client i; the batch size for local training is set to B and the number of local training rounds is set to E, and E rounds of mini-batch training are performed on the local dataset.

[0102] The model parameters are updated using the gradient descent algorithm. Specifically, for each local batch b∈B, the gradient of the loss function under the current model parameters is calculated, and the model parameters are adjusted along the negative gradient direction;

[0103] After E rounds of local iterative training, client i obtains the local model parameters.

[0104] Step 4: Client i determines the trigger threshold τ. (t) Determine whether to include local model parameters in this iteration. Uploaded to the server;

[0105] If the event trigger threshold is met, then update. If the triggering condition is not met, no upload will be performed, and the server will use the model parameters uploaded by the client in the previous round. Right now

[0106] Step 5: The server aggregates the model parameters uploaded by the client and updates the global model.

[0107] The server receives local model parameters uploaded by clients that meet the triggering mechanism. For clients that do not meet the triggering mechanism, the server uses the local model parameters uploaded in the previous round.

[0108] The server updates global model parameters using a weighted average strategy:

[0109]

[0110] Among them, w t+1 For the global model parameters updated in this round, |D i |and|D j | represents the number of local samples in clients i and j, respectively.

[0111] The server enters the next round of learning with the updated global model parameters.

[0112] To verify the practicality of the algorithm of this invention in reducing communication costs and the performance of the proposed base model, simulation analysis of the following two scenarios is provided: (1) Model performance comparison experiment; (2) Communication overhead comparison experiment.

[0113] Experiments were conducted using the NSL-KDD dataset, which contains a large number of malicious network intrusion behaviors, covering the types of network attacks that may be suffered in the smart grid field, and is widely used in the field of smart grid intrusion detection.

[0114] After performing one-hot encoding, Min-Max Normalization, and other data preprocessing operations on the dataset, we obtain data that can be input into the model. Ultimately, the feature attribute dimension of each data sample is 122 dimensions.

[0115] Accuracy, precision, recall, and F1-score are used to analyze model performance. Accuracy refers to the proportion of correctly classified samples out of the total number of samples. Precision is the proportion of samples predicted as positive that were actually positive out of the total number of predicted positive samples. Recall is the proportion of all actual positive samples that were correctly predicted as positive. The F1-score is the harmonic mean of precision and recall.

[0116] The relevant parameter settings are as follows:

[0117] The training rounds are T=50, the total number of clients is K=10, the proportion of clients selected in each round is C=0.3, the number of local training rounds is E=1, the local batch size is B=64, the learning rate is η=0.01, the loss function is the cross-entropy function, and the optimizer is ADAM.

[0118] Scenario 1: Model Performance Comparison Experiment. This experiment will use three base models to compare their performance in performing intrusion detection tasks under federated learning. These three models are the classic CNN model, CNN-BiLstm, and the CNN-BiLstm-Attention model proposed in this application.

[0119] from Figure 2 It can be seen that all three models converge quickly during training. From Figure 3 , Figure 4 ,picture,- Figure 6 As can be seen, the CNN-BiLStm-Attention model has a certain performance advantage in detection compared to the other two models. This advantage is due to the attention mechanism module, which adjusts the attention weights of different features, allowing the model to automatically focus on the features that contribute the most to the detection results.

[0120] Scenario 2: Communication Overhead Comparison Experiment. This experiment compares the communication overhead and performance differences between the Fed-Avg (without event triggering mechanism) and Fed-CoID (with event triggering mechanism) models. In this experiment, the review function takes the form τ. t =α×ρ t =m0×N P ×0.99 t ; where τ t Let ρ be the event trigger threshold at time t, α be a constant that does not change with time, and ρ be the event trigger threshold at time t. t This is a term that gradually decays over time t. In this formula, α = m0 × N p ρ is set to 0.99. m0 is a constant used to control the initial threshold to be greater than 0, m0∈[0.001,0.1]; N P This represents the total number of parameters in the model, which is automatically obtained depending on the specific model.

[0121] Get the communication status of all clients, such as Figure 7As shown in the figure. In this experiment, each client has three states in each round: selected to participate in training and upload model parameters to the server (communicating with the server, red square in the figure), selected to participate in training but not uploaded model parameters to the server (no communication, the server uses the parameters uploaded by the client last time for aggregation, blue square in the figure), and not selected (yellow square in the figure). It can be seen that the algorithm proposed in this application can achieve the effect of reducing the number of communications on different models, avoiding invalid model parameter uploads.

[0122] The performance of the model after introducing an event-triggered mechanism, for example Figure 8 , Figure 9 , Figure 10 , Figure 11 and Figure 12 As shown in the figure, the dashed lines represent the aggregation algorithm used by the model without an event-triggered mechanism (i.e., Fed-Avg), while the solid lines represent the algorithm used by the model with an event-triggered mechanism (Fed-CoID). It can be concluded that after introducing the event-triggered mechanism, the detection performance of the model is comparable to that of the original algorithm. This further demonstrates that the algorithm proposed in this application reduces communication costs without affecting detection performance.

[0123] Example 2

[0124] This embodiment provides an event-triggered smart grid intrusion detection system, employing a specific implementation of the smart grid intrusion detection method from Embodiment 1. The system includes:

[0125] Federated learning initialization module: Establishes the federated learning architecture and defines optimization goals, initializes the server and client sides, and defines the event triggering mechanism;

[0126] Global model building module: Based on the SCADA data collected by the power system, build and train an intrusion detection model, and define the trained intrusion detection model as a global model maintained by the federated learning architecture;

[0127] A distributed intrusion detection module; the server selects clients based on a preset selection ratio and sends the global model to the selected clients; the client receives the global model and loads local SCADA collected data to perform this round of learning, wherein the learning is to use the global model to perform intrusion detection on the smart grid;

[0128] The global update and iteration module: The client verifies the local model parameters learned in this round of learning through an event-triggered mechanism to determine whether to upload the local model parameters to the server in this round; The server aggregates the local model parameters uploaded by the client and updates the global model parameters to enter the next round of learning.

[0129] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the specific implementation of the present invention. Any modifications or equivalent substitutions that do not depart from the spirit and scope of the present invention should be covered within the protection scope of the claims of the present invention.

Claims

1. An event-triggered smart grid intrusion detection method, characterized in that, include: Establish a federated learning architecture and define optimization goals, initialize the server and client sides, and define different event triggering mechanisms based on the power grid characteristics of each client; Based on the SCADA data collected by the power system, an intrusion detection model is constructed and trained, and the trained intrusion detection model is defined as a global model maintained by the federated learning architecture. The server selects clients based on a preset selection ratio and sends the global model to the selected clients; the clients receive the global model and load local SCADA data to perform this round of learning, which involves using the global model to perform intrusion detection on the smart grid. The client verifies the local model parameters learned in this round of learning through an event-triggered mechanism to determine whether to upload the local model parameters to the server in this round; the server aggregates the local model parameters uploaded by the client and updates the global model parameters to enter the next round of learning.

2. The event-triggered smart grid intrusion detection method according to claim 1, characterized in that, The federated learning adopts a parameter server architecture with one server and multiple clients; The server is used to store, update, and synchronize global model parameters; the client is used to perform intrusion detection tasks using local SCADA collected data and to interact with the server to obtain local model parameters. The optimization objective is to find a globally optimal model parameter that minimizes the weighted expectation of the globally optimal model parameter across all clients.

3. The event-triggered smart grid intrusion detection method according to claim 1, characterized in that, The definition of the event triggering mechanism includes: An event is defined as the difference between the local model parameters learned by the client in this round and the local model parameters uploaded to the server in the previous round; when the difference is greater than the event trigger threshold, an update operation is triggered. Different clients use different event trigger thresholds; for the i-th client, the event trigger threshold is calculated as the ratio of the initial threshold to the comprehensive value of the power grid characteristics of client i.

4. The event-triggered smart grid intrusion detection method according to claim 1, characterized in that, The training process of the intrusion detection model includes: The SCADA data collected by the power system is multi-dimensional operational status data. The SCADA data acquired by the power system is preprocessed into time series samples with a structure of a three-dimensional tensor X∈R. T×F×C That is, there are T time steps, each time step contains F-dimensional features, which constitute the input tensor of C channels; A one-dimensional convolutional neural network is used to extract local time series features from time series samples, and a single-layer BiLSTM is used to extract global dependency features from the local time series features. For the output of BiLSTM at each time step, a linear layer with an attention mechanism and a softmax function are used to assign weights, and the weighted sum is used to generate a context vector. The context vector output by the attention mechanism is processed by applying dropout and fully connected layers to output logits representing m types of intrusion behaviors. The logits are then transformed into a probability distribution of intrusion behaviors through a softmax layer.

5. The event-triggered smart grid intrusion detection method according to claim 1, characterized in that, The server sends the global model to the selected client, including: The preset client selection ratio is C = N / K. Based on the client number, N clients are selected from a total of K clients in a completely random manner for this round of learning. In this round of learning, the server will use the global model and global model parameters w. (t) Send to N clients; The client receives w (t) The global model is run based on locally collected SCADA data to perform intrusion detection in the smart grid, and local model parameters are obtained.

6. The event-triggered smart grid intrusion detection method according to claim 5, characterized in that, The determination of whether the local model parameters are uploaded includes: For client i, i∈[1,N], the local model parameters obtained in this round of learning Combine this with the local model parameters that client i uploaded to the server in the previous round. Perform difference calculations. When the difference meets the triggering condition, client i will then change the local model parameters. Uploaded to the server, server updated. If the difference does not meet the triggering condition, client i will not upload local model parameters, and the server will use the local model parameters uploaded by client i in the previous round.

7. A smart grid intrusion detection method based on event triggering according to any one of claims 1 or 6, characterized in that, The updated global model parameters include: The server aggregates all Update global model parameters using a weighted average strategy: Among them, w t+1 For the global model parameters updated in this round, |D i |and|D j | represents the number of time series samples on the local client i and j, respectively.

8. An event-triggered smart grid intrusion detection system, executing the smart grid intrusion detection method as described in any one of claims 1-7, characterized in that, The system includes: Federated learning initialization module: Establishes the federated learning architecture and defines optimization goals, initializes the server and client sides, and defines the event triggering mechanism; Global model building module: Based on the SCADA data collected by the power system, build and train an intrusion detection model, and define the trained intrusion detection model as a global model maintained by the federated learning architecture; A distributed intrusion detection module; the server selects clients based on a preset selection ratio and sends the global model to the selected clients; the client receives the global model and loads local SCADA collected data to perform this round of learning, wherein the learning is to use the global model to perform intrusion detection on the smart grid; The global update and iteration module: The client verifies the local model parameters learned in this round of learning through an event-triggered mechanism to determine whether to upload the local model parameters to the server in this round; The server aggregates the local model parameters uploaded by the client and updates the global model parameters to enter the next round of learning.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the computer program is loaded into the processor, it implements the smart grid intrusion detection method according to any one of claims 1-7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the smart grid intrusion detection method according to any one of claims 1-7.

Images