Power grid out-of-distribution false data injection attack detection method

Abstract

The invention relates to a power grid out-of-distribution false data injection attack detection method, which comprises the following steps: collecting power grid data, inputting the power grid data into a trained double-branch detection model for injection data attack detection, and outputting a detection result that the input power grid data is out-of-distribution data, normal data or abnormal data. According to the invention, the out-of-distribution detection module is additionally arranged at the output end of the full-connection neural network, the out-of-distribution detection module carries out Monte Carlo calculation on the output of the full-connection neural network, then the mutual information is calculated, out-of-distribution detection judgment is carried out through the mutual information, and out-of-distribution data is effectively and accurately detected.

Description

Technical Field

[0001] This invention relates to the field of power grid attack detection technology, specifically to a method for detecting fake data injection attacks outside the power grid distribution network. Background Technology

[0002] With the continuous development and application of power information and communication technologies, power flow and information flow in power systems are gradually merging. Their combination supports panoramic state perception and intelligent control decision-making, driving the power system towards becoming a cyber-physical system. Against this backdrop, the open communication network environment and complex cyber-physical interaction mechanisms significantly impact the security and stability of power systems. Among these, spoofed data injection attacks are a typical type of network attack. By tampering with the integrity of transmitted data, they mislead system state estimation and control strategies, seriously affecting the security and stability of power systems.

[0003] Currently, there are two main categories of methods for detecting fake data injection attacks: model-based methods and data-driven methods. Model-driven methods rely on physical modeling and state estimation, analyzing the physical mathematics and state variance of the system to achieve anomaly detection. Data-driven methods focus primarily on system operational information, enhancing the system's state estimation capabilities, and mainly utilize deep learning methods to detect fake data injection attacks. Examples include Chinese patents CN202510040958.1 (A Machine Learning-Based Method for Detecting Fake Data Injection Attacks in Smart Grids) and CN119203126A (A Method and System for Detecting Fake Data Attacks in the Power Industry Based on Graph Convolutional Networks).

[0004] Traditional deep learning methods for detecting fake data injection typically follow the closed-world assumption, meaning that training and test samples have the same distribution. However, in the real world, we often encounter novel fake data injection attacks that differ from known attacks, and the distribution of real-world data often differs from the training distribution—a phenomenon known as the out-of-distribution problem. When faced with out-of-distribution fake data injection attacks, traditional deep learning detection methods incorrectly classify the attack as a known category, even though the classified category is fundamentally different from the actual attack category. In other words, current detection methods cannot detect out-of-distribution fake data injections, resulting in inaccurate detection results. Summary of the Invention

[0005] To address the problems existing in the prior art, the purpose of this invention is to provide a method for detecting spoofed data injection attacks outside the power grid distribution, which can effectively detect out-of-distribution data and improve the ability to detect out-of-distribution attacks.

[0006] To achieve the above objectives, the technical solution adopted by the present invention is as follows: A method for detecting spoofed data injection attacks outside the power grid distribution involves collecting power grid data and inputting it into a trained dual-branch detection model for data injection attack detection. The output result indicates whether the input power grid data is outside the distribution, normal data, or abnormal data. The dual-branch detection model includes a convolutional module, a dual-branch fusion module, a fully connected neural network, and an out-of-distribution detection module. The input power grid data is processed sequentially by the convolutional module and the dual-branch fusion module before being input into the fully connected neural network for classification and prediction. The out-of-distribution detection module performs Monte Carlo approximation calculations based on the predicted values ​​output by the fully connected neural network, and then calculates the mutual information. Finally, the mutual information is compared with a preset threshold. If the mutual information is greater than the threshold, the input power grid data is determined to be out-of-distribution data; otherwise, the input power grid data is determined to be in-distribution data. The binary vector is used to determine whether the input power grid data is abnormal or normal data.

[0007] The dual-branch fusion module includes a high-resolution branch and a low-resolution branch. Different residual blocks are set on the high-resolution branch and the low-resolution branch for feature extraction. A pyramid module is set at the end of the low-resolution branch. Feature interaction and fusion are performed between the high-resolution branch and the low-resolution branch. The high-resolution branch is used to preserve the details of the original data information, while the low-resolution branch extracts deep semantic features through fast downsampling. In the pyramid module of the low-resolution branch, multi-scale contextual information is captured and spatial features are recovered through pooling and upsampling at different scales. Finally, the output features of the high-resolution branch and the low-resolution branch are fused by summation and used as the output of the dual-branch fusion module.

[0008] The dual-branch fusion module has three residual blocks on its high-resolution branch, used to extract feature maps at 1 / 2, 1 / 4, and 1 / 8 resolutions, respectively. The low-resolution branch has four residual blocks and a pyramid module; the four residual blocks are used to extract feature maps at 1 / 8, 1 / 16, 1 / 32, and 1 / 64 resolutions, respectively.

[0009] In the residual block of the dual-branch fusion module, after the data enters the model, it first passes through a batch normalization layer to stabilize the training, and then enters the convolution to extract features. Next, the features are introduced with nonlinearity through the ReLU activation function, and a dropout layer is used to prevent overfitting. The output of the dropout layer is added to the unprocessed original input x, which is the residual connection. Finally, it is passed through a ReLU activation function to obtain the final output. The specific operation of the pyramid module in the dual-branch fusion module is as follows: First, the original feature map obtained by fast downsampling is pooled at multiple scales respectively; then, the number of channels is uniformly adjusted to 1 through 1×1 convolution; next, it is upsampled to restore the size of the original feature map to 1 / 8; finally, the multi-scale features are concatenated and then restored to the number of channels of the original feature map through 1×1 convolution.

[0010] The fully connected neural network introduces Logit normalization and dropout to improve the loss function.

[0011] The training process of the dual-branch detection model is as follows: S10. Acquire power grid data and standardize the data; S20. Generate training data using the principle of fake data injection attack; Based on the following weighted least squares state estimation objective function, the system state vector is obtained. System state vector Includes voltage amplitude data set voltage phase angle data set ; From the system state vector By taking voltage amplitude data and voltage phase angle data, adding a disturbance factor, and constructing a state deviation vector, a state deviation vector can be formed. ; Then, fake data is obtained using the following formula. :

[0012] Finally, substituting the values ​​into the following formula yields the abnormal data:

[0013] in, 'This is standardized power grid data,' It's fake data. This is the final abnormal data obtained; abnormal data and collected power grid data The training data is then mixed and divided into training data, validation set, and test set. S30. Initialize the network weight parameters and hyperparameter settings of the dual-branch detection model; The weight parameters of the convolutional layers in the convolutional module and the dual-branch fusion module are initialized using the Kaiming normal distribution, and the convolutional layer bias is initialized to 0; in the fully connected neural network, the network weight parameters are initialized using a normal distribution with a mean of 0 and a variance of 0.01, and the fully connected neural network bias is also initialized to 0. Set the hyperparameters for the training process, including the number of training epochs, learning rate, batch size, and dropout rate; S40. Train the dual-branch detection model; The training data is input into the dual-branch detection model for model training; The loss function during training is calculated as follows:

[0014] In the formula, This is the final loss value. This is the normalized cross-entropy loss value. It is the regularization coefficient. It is the number of network layers in the dual-branch detection model. It is the dropout probability of the l-th layer. It is the weight matrix of the l-th layer. It is the bias vector of the l-th layer. It is the squared L2 norm, a penalty applied to the square of the parameter.

[0015] In the normalized cross-entropy loss value S20, the weighted least squares state estimation objective function is as follows:

[0016] in, It is standardized power grid data. These are nonlinear power flow equations used to characterize the system's state vector. and The relationship between them, where R is the covariance matrix, and it is a diagonal matrix with diagonal elements. The variance of each measurement reflects the magnitude of uncertainty in different measurements; The state deviation vector is calculated as follows:

[0017] in, and These are the voltage amplitude and phase angle obtained through state estimation, respectively. and These are the disturbance factors for voltage amplitude and phase angle, respectively, and are random numbers ranging from 20% to 30%, representing the artificial amplification or reduction of voltage amplitude and phase angle on the bus. and These are from the system state vector Obtain the set of buses representing the applied voltage amplitude and the set of buses representing the applied voltage phase angle; and These represent the busbars respectively. busbar The estimated voltage amplitude and phase angle.

[0018] The formula for calculating the normalized cross-entropy loss value is as follows:

[0019] In the formula, This is the normalized cross-entropy loss value, where N is the number of training samples and C is the number of classes. It is the one-hot encoded value of the i-th class of the k-th sample. The predicted probability of the k-th sample in the i-th class is:

[0020] in, It is the k-th sample in the training data; i is the class. It is the network weight of the k-th sample corresponding to class i in a fully connected neural network. It is the output value of the normalized logit vector.

[0021] The Monte Carlo approximation calculation for the out-of-distribution detection module is as follows:

[0022] In the formula, Indicates input Belongs to the Class expectations Indicates that the target category is the first The classes are divided into normal and abnormal categories. Indicates the first Secondary from network weight variational distribution The network parameters obtained from sampling, This indicates the total number of samples. Indicates the first The prediction under the second sampling belongs to the th The probability of a class.

[0023] Mutual information in the distributed detection module The calculation formula is as follows:

[0024]

[0025] in, It is the total entropy, representing the overall uncertainty of the prediction; is the average conditional entropy, which represents the average prediction uncertainty of the model parameters under different dropout methods, and C is the total number of categories; The out-of-distribution detection function is as follows:

[0026] In the formula, It is a preset threshold used to determine the degree of uncertainty. If the score is less than the threshold, it is within the distribution and the value is 0. If the score is greater than the threshold, it is outside the distribution.

[0027] After adopting the above scheme, the present invention adds an out-of-distribution detection module at the output end of the fully connected neural network. This out-of-distribution detection module performs Monte Carlo calculation on the output of the fully connected neural network to obtain the uncertainty distribution of the prediction. Then, it calculates the mutual information between the input and the output and uses the mutual information to make out-of-distribution detection judgment. Mutual information can effectively measure the degree of uncertainty of the prediction result. When the mutual information is high, it indicates that the prediction of the sample is unstable, that is, it belongs to out-of-distribution data. Based on this, the out-of-distribution detection module can effectively and accurately detect out-of-distribution data.

[0028] Furthermore, this invention designs a dual-branch fusion module. The high-resolution branch of this module effectively preserves detailed information, while the low-resolution branch aggregates deep semantic features. Through multiple bilateral fusions, efficient information integration is achieved, thus simultaneously considering both local and global semantics in the feature space. This dual-branch fusion module enables the model to more sensitively capture anomalous patterns when facing out-of-distribution data, providing a more accurate measure of uncertainty in Monte Carlo sampling and mutual information calculation, thereby improving out-of-distribution detection performance.

[0029] Furthermore, this invention introduces Logit normalization and dropout into the fully connected neural network, which can effectively alleviate overfitting and excessive confidence during the training of the dual-branch detection model. Logit normalization reduces the scale difference of logit between categories, making the output distribution of the model smoother when facing uncertain inputs, avoiding incorrect judgments due to overconfidence. Dropout randomly discards some neurons during training, increasing the robustness of the model, reducing the training burden and suppressing overfitting, resulting in better performance in mutual information metric and thus better out-of-distribution detection. Attached Figure Description

[0030] Figure 1 This is a block diagram illustrating the principle of the dual-branch detection model of the present invention; Figure 2 This is a processing diagram of the dual-branch fusion module; Figure 3 This is a block diagram illustrating the principle of the residual block; Figure 4 This is a schematic diagram of the pyramid module. Figure 5 This is a flowchart of the training process for the dual-branch detection model. Detailed Implementation

[0031] This invention discloses a method for detecting spurious data injection attacks outside the power grid distribution. The method involves collecting power grid data and inputting it into a trained dual-branch detection model to detect data injection attacks. The method outputs the detection results, which indicate whether the input power grid data is outside the distribution, normal data, or abnormal data.

[0032] like Figures 1 to 4 As shown, the dual-branch detection model includes a convolutional module, a dual-branch fusion module, a fully connected neural network, and an out-of-distribution detection module.

[0033] The convolutional module (1×1 convolutional layer) adjusts the number of input channels while maintaining spatial dimension. The dual-branch fusion module includes a high-resolution branch and a low-resolution branch, each with different residual blocks for feature extraction. A pyramid module is located at the end of the low-resolution branch, facilitating feature interaction between the two branches. The high-resolution branch preserves details of the original data, while the low-resolution branch extracts deep semantic features through rapid downsampling. The pyramid module in the low-resolution branch captures multi-scale contextual information and recovers spatial features through pooling and upsampling at different scales. Finally, the output features of the high-resolution and low-resolution branches are fused using a summation operation and used as the output of the dual-branch fusion module.

[0034] The fully connected neural network performs classification prediction based on the output of the two-branch module and outputs the predicted value.

[0035] The out-of-distribution detection module performs Monte Carlo approximation calculations based on the predicted values ​​output by the fully connected neural network, and then calculates the mutual information. Finally, it compares the mutual information with a preset threshold. If the mutual information is greater than the threshold, the input power grid data is determined to be out-of-distribution data; otherwise, the input power grid data is determined to be in-distribution data. The binary vector is used to determine whether the input power grid data is abnormal or normal data.

[0036] In this embodiment, the high-resolution branch of the dual-branch fusion module has three residual blocks, used to extract feature maps at 1 / 2, 1 / 4, and 1 / 8 resolutions, respectively. The low-resolution branch has four residual blocks and a pyramid module. The four residual blocks are used to extract feature maps at 1 / 8, 1 / 16, 1 / 32, and 1 / 64 resolutions, respectively. The 1 / 2 resolution feature map from the high-resolution branch is downsampled and then merged with the 1 / 32 resolution feature map; the 1 / 16 resolution feature map from the low-resolution branch is upsampled and then merged with the 1 / 4 resolution feature map from the high-resolution branch. Subsequently, the 1 / 4 resolution feature map from the high-resolution branch is downsampled and then fused with the 1 / 64 resolution feature map. The fused features are then pooled and upsampled at different scales to capture multi-scale contextual information and recover spatial features, serving as the output of the low-resolution branch. The 1 / 32 resolution feature map from the low-resolution branch is upsampled and then fused with the 1 / 8 resolution feature map from the high-resolution branch, serving as the output of the high-resolution branch. Finally, the outputs of the low-resolution branch and the high-resolution branch are fused by summation. The dual-branch fusion module performs high-to-low and low-to-high feature interactions simultaneously, enabling each branch to not only learn the details of the original data information but also retain the overall structure.

[0037] like Figure 3 As shown, in the residual block of the dual-branch fusion module above, after the data enters the model, it first passes through a batch normalization layer to stabilize the training, and then enters the convolution for feature extraction. Next, the features are introduced with nonlinearity through the ReLU activation function, and a dropout layer is used to prevent overfitting. After a series of operations, the output of the module is added to the unprocessed original input x, i.e., the residual connection, and finally, it passes through another ReLU activation function to obtain the final output. The residual block alleviates the gradient vanishing problem through "skip connections," allowing the network to deepen significantly without degrading, thereby improving the feature learning ability.

[0038] The pyramid module in the dual-branch fusion module operates as follows: First, the original feature map obtained by rapid downsampling is pooled at multiple scales; then, a 1×1 convolution is used to uniformly adjust the number of channels to 1; next, upsampling is performed to restore the original feature map to 1 / 8 of its original size; finally, the multi-scale features are concatenated and then restored to the original number of channels using a 1×1 convolution. This pyramid module fully extracts global information using multi-scale pooling. The features output by the pyramid module are then upsampled to restore high resolution, and then summed and fused with the high-resolution branch features.

[0039] In fully connected neural networks, Logit normalization and dropout are introduced to improve the loss function, in order to alleviate data overfitting and excessive confidence during the training of dual-branch detection models.

[0040] like Figure 5 As shown, the training process of the dual-branch detection model is as follows: S10. Acquire power grid data and standardize the data.

[0041] First, real observation data, including measurements of voltage and power, is obtained from the power grid data acquisition and monitoring system and then standardized. Specifically, the mean and variance of each characteristic are calculated, and then the data is normalized according to the following formula:

[0042] In the formula, This represents a sample value from the original data. and These represent the mean and standard deviation of all samples for that feature, respectively. This is the new value after standardization.

[0043] S20. Training data is generated using the principle of fake data injection attack.

[0044] Data processed by S10 Including data such as grid voltage and power, the system state vector needs to be obtained based on the following weighted least squares state estimation objective function. .

[0045]

[0046] In state estimation, It is standardized power grid data. These are nonlinear power flow equations used to characterize the system's state vector. and The relationship between states and vectors It consists of the voltage magnitude and phase angle of each bus. R is the covariance matrix, and it is a diagonal matrix with diagonal elements. The variance of each measurement reflects the magnitude of uncertainty in different measurements. The system state vector can be obtained using the above formula. .

[0047] The power flow equation in the above formula It can and Establish correlation. Power flow equations. There are several methods, which are determined based on the characteristics collected by SCADA. If the collected data is active power, the following formula is used; the same applies to other characteristics.

[0048]

[0049] in the formula yes Middle busbar The amount of active power injected. The real part of the admittance matrix corresponds to the conductance and represents the energy loss portion. The imaginary part of the admittance matrix, corresponding to susceptance, represents the reactive power transmission capacity of the power system. and These are the busbars and phase angle, and It corresponds to the voltage amplitude of the bus.

[0050] System state vector Includes voltage amplitude data set voltage phase angle data set All of these are normal data; we need to construct abnormal samples based on the following formula.

[0051] First, construct the state deviation vector according to the formula for constructing a region spurious injection attack. :

[0052] in, and These are the voltage amplitude and phase angle obtained through state estimation, respectively. and These are the disturbance factors for voltage amplitude and phase angle, respectively, and are random numbers ranging from 20% to 30%, representing the artificial amplification or reduction of voltage amplitude and phase angle on the bus. and These are from the system state vector Obtain the set of buses representing the applied voltage amplitude and the set of buses representing the applied voltage phase angle. and These represent the busbars respectively. busbar The estimated voltage magnitude and phase angle are obtained from the system state vector. By obtaining partial voltage amplitude and voltage phase angle data, and adding a disturbance factor, a state deviation vector is constructed. .

[0053] Then, substituting the data into the following formula yields the false data. .

[0054]

[0055] in the formula From the previous formula, The results from the previous formula are used to substitute the data into the power flow equations of the power system. Obtaining false data Finally, substituting the values ​​into the following formula yields the altered measurement values.

[0056]

[0057] 'This is standardized power grid data,' It's fake data. This is the final abnormal data. (The abnormal data...) and collected power grid data The data is then mixed to form the training data used in the following steps.

[0058] S30. Initialize the network weight parameters and hyperparameter settings of the dual-branch detection model.

[0059] To prevent gradient vanishing or exploding issues during deep neural network training, a scientific initialization strategy was employed for the model parameters. The weights of the convolutional layers in the convolutional module and the two-branch fusion module were initialized using a Kaiming normal distribution to ensure stable gradient propagation under the ReLU activation function; the convolutional layer biases were initialized to 0. In the fully connected neural network, the weights were initialized using a normal distribution with a mean of 0 and a variance of 0.01, and the biases were also initialized to 0. This initialization method effectively improves the network's convergence speed and stability.

[0060] During training, the hyperparameters were set as follows: 250 training epochs, Adam optimizer, learning rate of 0.0005, and batch size of 80. To mitigate overfitting, dropout was introduced during training, randomly disabling some neurons at a dropout rate of 0.1. All experiments were performed on an NVIDIA A6000 GPU to ensure efficient model training and convergence.

[0061] S40. Train the dual-branch detection model.

[0062] The training data x, obtained by normalizing the cross-entropy loss value S20, is input into the two-branch detection model for model training. After being processed by the convolution module and the two-branch fusion module, the training data x is then fed into the fully connected neural network.

[0063] The operating formula for a fully connected neural network:

[0064] In the formula, It is the k-th sample in the training data. is the network weight corresponding to class i for the k-th sample in the fully connected neural network, and b is the bias vector of the fully connected neural network. It is an activation function. It is a binary vector, where the first value corresponds to the prediction score when the input power grid data is normal, and the second value corresponds to the prediction score when the input power grid data is abnormal.

[0065] In this embodiment, the fully connected neural network uses the ReLU activation function, with the following formula:

[0066] In the ReLU activation function, t is the output of a certain layer in the neural network. When the derivative is greater than 0, it is always equal to 1; when it is less than 0, the derivative is 0. This function has the advantages of being simple to calculate and effectively avoiding gradient vanishing.

[0067] We introduce the Logit normalization formula for processing:

[0068] In the formula, It is the k-th sample in the training data. It is the network weight of the k-th sample corresponding to class i in a fully connected neural network. It is the L2 norm of the vector. It is the temperature scaling factor. These are unnormalized logit vector values. It is the normalized logit vector output value, which scales the original vector and controls the problem of excessively high confidence.

[0069] By applying the softmax function to the logit vector output value, the probability distribution of whether a sample belongs to the normal or abnormal category can be obtained. The calculation is as follows:

[0070] This formula represents the prediction of the probability of a certain class using the softmax function. It is the k-th sample in the training data, during the inference and detection phase. This refers to real-time collected power grid data; i represents the category. It is the network weight of the k-th sample corresponding to class i in a fully connected neural network. It is the normalized logit vector output value. Let be the probability that the k-th sample belongs to the i-th class, calculated using softmax.

[0071] Fake data attack detection is a multi-class classification task. Traditional models use the cross-entropy loss function to determine how close the predicted result is to the expected result. The smaller the cross-entropy, the closer the two probabilities are. The formula is as follows:

[0072] C is the total number of categories. It is a unique hot code for the real label. This is the probability distribution of the samples across each category obtained by the Softmax function. As will be explained below, when calculating the loss, only the dimension corresponding to the true label will contribute, while the values ​​of the other dimensions are all zero.

[0073] In this invention, the Logit normalization formula is introduced to improve the cross-entropy loss function. The improved cross-entropy loss function formula is as follows:

[0074] in the formula This is the normalized cross-entropy loss value, where N is the number of training samples and C is the number of classes. It is the one-hot encoded value of the i-th class of the k-th sample. It is the predicted probability of the i-th class for the k-th sample.

[0075] By introducing dropout and a logistic normalized loss function, the final function formula is obtained:

[0076] In the formula, This is the final loss value. It is the normalized cross-entropy loss value. It is a regularization coefficient used to control model complexity. It is the number of network layers in the dual-branch detection model. It is the dropout probability of the l-th layer. It is the weight matrix of the l-th layer. It is the bias vector of the l-th layer. It is the squared L2 norm, a penalty applied to the square of the parameter.

[0077] The above loss function formula is used for gradient descent during model training. The formula combines Logit normalization and dropout to alleviate overfitting and excessively high confidence levels that occur when training a two-branch detection model.

[0078] While fully connected neural networks can distinguish between attack data and normal data based on the final softmax output, their limitation lies in their lack of ability to discriminate against out-of-distribution attacks. Without addressing this, the model will still be forced to make a prediction of a certain class when faced with unknown data not encountered during training, which is clearly unreasonable. To solve this problem, it is necessary to introduce a derivation process based on Bayesian theory to obtain an out-of-distribution detection formula, thereby effectively enhancing the model's robustness and reliability in dealing with unknown attack scenarios.

[0079] For ease of understanding of the formulas, the following text will... Rewrite as follows:

[0080] This represents the input data value for a given sample k. and model parameters Under the given conditions, the conditional probability that the sample belongs to class i.

[0081] To address the aforementioned issues, the out-of-distribution detection module incorporates a Bayesian learning framework, eliminating the need to refactor neural network weights. Instead of treating it as a fixed value, we treat it as a distribution, making the prediction a weighted average of all possible weights. This makes the prediction depend not only on the input but also on the uncertainty of the weight distribution. The Bayesian marginal prediction distribution formula is as follows:

[0082] In the formula, Indicates the given input In this case, the model predicts the probability of belonging to category i. It is the k-th sample in the training data. It's a tag, p Network weight parameters Fully connected neural network pairs The output prediction, This represents the integral over the network weights. Represents network weights The variational distribution is used to approximate the true posterior distribution. The common form is the Gaussian distribution:

[0083] These are the mean and variance, learned through a neural network, depending on the input data x. This is the symbol for the Gaussian distribution function.

[0084] For the above marginal distribution formula, computers cannot directly calculate the integral; the following formula is needed for Monte Carlo approximation:

[0085] In the formula, Indicates input Belongs to the Class expectations Indicates that the target category is the first The classes are divided into normal and abnormal categories. Indicates the first Secondary variational distribution The network parameters obtained from sampling, i.e., the parameters obtained by the first dropout method. This indicates the total number of samples. Indicates the first The prediction under the second sampling belongs to the th The probability of a class.

[0086] The out-of-distribution detection module then calculates mutual information. Specifically, it first calculates the formula for entropy, and then calculates the formula for mutual information to further quantify cognitive uncertainty:

[0087] =

[0088] formula It is the calculation of the entropy of the predicted category information, representing the information entropy in the input data. In the case of labels The entropy value, Indicates the first The prediction under the second sampling belongs to the th The probability of a class It represents the total number of categories.

[0089] The formula for mutual information is as follows:

[0090]

[0091] The model's cognitive uncertainty about the input in the formula is equal to the uncertainty of predicting the label minus the model's average uncertainty when the parameters are known. It is the total entropy, representing the overall uncertainty of the prediction. Mutual information is the average conditional entropy, representing the average prediction uncertainty of the model parameters under different dropout methods. A large mutual information value indicates that the model's predictions differ greatly under different samplings, suggesting that the model is uncertain about the input. A small mutual information value indicates that the predictions are consistent under different samplings, suggesting that the model is more certain about the input.

[0092] Below is the out-of-distribution detection function:

[0093] in the formula It is a preset threshold used to determine the degree of uncertainty. If the score is less than the threshold, it is within the distribution and the value is 0. If the score is greater than the threshold, it is outside the distribution.

[0094] The ultimate goal of this invention is to accurately detect out-of-distribution data and accurately determine whether in-distribution data is normal or abnormal.

[0095] The key to this invention lies in: 1. An out-of-distribution detection module is added to the output of the fully connected neural network. This out-of-distribution detection module performs Monte Carlo calculation on the output of the fully connected neural network to obtain the uncertainty distribution of the prediction. Then, it calculates the mutual information between the input and the output and uses the mutual information to detect out-of-distribution data. Mutual information can effectively measure the degree of uncertainty of the prediction result. When the mutual information is high, it indicates that the prediction of the sample is unstable, that is, it belongs to out-of-distribution data. Based on this, the out-of-distribution detection module can effectively and accurately detect out-of-distribution data.

[0096] 2. A dual-branch fusion module was designed. The high-resolution branch effectively preserves detailed information, while the low-resolution branch aggregates deep semantic features. The two branches are fused through multiple bilateral fusions to achieve efficient information integration, thus simultaneously considering both local and global semantics in the feature space. This dual-branch fusion module enables the model to more accurately capture anomalous patterns when dealing with out-of-distribution data, providing a more accurate measure of uncertainty in Monte Carlo sampling and mutual information calculation, thereby improving out-of-distribution detection performance.

[0097] 3. Introducing Logit normalization and dropout into fully connected neural networks can effectively alleviate overfitting and excessively high confidence during the training of dual-branch detection models. Logit normalization reduces the scale difference of logit between categories, making the output distribution smoother when facing uncertain inputs and avoiding incorrect judgments due to overconfidence. Dropout randomly discards some neurons during training, increasing model robustness, reducing training burden and suppressing overfitting, resulting in better performance in mutual information metrics and thus better out-of-distribution detection.

[0098] The above description is merely an embodiment of the present invention and does not constitute any limitation on the technical scope of the present invention. Therefore, any minor modifications, equivalent changes, and alterations made to the above embodiments based on the technical essence of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A method for detecting spoofed data injection attacks outside the power grid distribution network, characterized in that: The method collects power grid data and inputs the power grid data into a trained dual-branch detection model to detect injected data attacks, and outputs the detection results. The detection results are: the input power grid data is out-of-distribution data, normal data, or abnormal data. The dual-branch detection model includes a convolutional module, a dual-branch fusion module, a fully connected neural network, and an out-of-distribution detection module. The input power grid data is processed sequentially by the convolutional module and the dual-branch fusion module before being input into the fully connected neural network for classification and prediction. The out-of-distribution detection module performs Monte Carlo approximation calculations based on the predicted values ​​output by the fully connected neural network, and then calculates the mutual information. Finally, the mutual information is compared with a preset threshold. If the mutual information is greater than the threshold, the input power grid data is determined to be out-of-distribution data; otherwise, the input power grid data is determined to be in-distribution data. The binary vector is used to determine whether the input power grid data is abnormal or normal data.

2. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 1, characterized in that: The dual-branch fusion module includes a high-resolution branch and a low-resolution branch. Different residual blocks are set on the high-resolution branch and the low-resolution branch for feature extraction. A pyramid module is set at the end of the low-resolution branch. Feature interaction and fusion are performed between the high-resolution branch and the low-resolution branch. The high-resolution branch is used to preserve the details of the original data information, while the low-resolution branch extracts deep semantic features through fast downsampling. In the pyramid module of the low-resolution branch, multi-scale contextual information is captured and spatial features are recovered through pooling and upsampling at different scales. Finally, the output features of the high-resolution branch and the low-resolution branch are fused by summation and used as the output of the dual-branch fusion module.

3. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 2, characterized in that: The dual-branch fusion module has three residual blocks on the high-resolution branch, which are used to extract feature maps at 1 / 2, 1 / 4, and 1 / 8 resolutions, respectively; and four residual blocks and a pyramid module on the low-resolution branch, which are used to extract feature maps at 1 / 8, 1 / 16, 1 / 32, and 1 / 64 resolutions, respectively.

4. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 2, characterized in that: In the residual block of the dual-branch fusion module, after the data enters the model, it first passes through a batch normalization layer to stabilize the training, and then enters the convolution to extract features. Next, the features are introduced with nonlinearity through the ReLU activation function, and a dropout layer is used to prevent overfitting. The output of the dropout layer is added to the unprocessed original input x, which is the residual connection. Finally, it is passed through a ReLU activation function to obtain the final output. The specific operation of the pyramid module in the dual-branch fusion module is as follows: First, the original feature map obtained by fast downsampling is pooled at multiple scales respectively; then, the number of channels is uniformly adjusted to 1 through 1×1 convolution; next, it is upsampled to restore the size of the original feature map to 1 / 8; finally, the multi-scale features are concatenated and then restored to the number of channels of the original feature map through 1×1 convolution.

5. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 1, characterized in that: The fully connected neural network introduces Logit normalization and dropout to improve the loss function.

6. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 5, characterized in that: The training process of the dual-branch detection model is as follows: S10. Acquire power grid data and standardize the data; S20. Generate training data using the principle of fake data injection attack; Based on the following weighted least squares state estimation objective function, the system state vector is obtained. System state vector Includes voltage amplitude data set voltage phase angle data set ; From the system state vector By taking voltage amplitude data and voltage phase angle data, adding a disturbance factor, and constructing a state deviation vector, a state deviation vector can be formed. ; Then, fake data is obtained using the following formula. : in, This is false data. Let be the system state vector. This is the state deviation vector. It is a nonlinear power flow equation; Finally, substituting the values ​​into the following formula yields the abnormal data: in, 'This is standardized power grid data,' It's fake data. This is the final abnormal data obtained; abnormal data and collected power grid data The training data is then mixed and divided into training data, validation set, and test set. S30. Initialize the network weight parameters and hyperparameter settings of the dual-branch detection model; The weight parameters of the convolutional layers in the convolutional module and the dual-branch fusion module are initialized using the Kaiming normal distribution, and the convolutional layer bias is initialized to 0; in the fully connected neural network, the network weight parameters are initialized using a normal distribution with a mean of 0 and a variance of 0.01, and the fully connected neural network bias is also initialized to 0. Set the hyperparameters for the training process, including the number of training epochs, learning rate, batch size, and dropout rate; S40. Train the dual-branch detection model; The training data is input into the dual-branch detection model for model training; The loss function during training is calculated as follows: In the formula, This is the final loss value. It is the normalized cross-entropy loss value. It is the regularization coefficient. It is the number of network layers in the dual-branch detection model. It is the dropout probability of the l-th layer. It is the weight matrix of the l-th layer. It is the bias vector of the l-th layer. It is the squared L2 norm, a penalty applied to the square of the parameter.

7. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 6, characterized in that: In S20, the weighted least squares state estimation objective function is as follows: in, It is standardized power grid data. These are nonlinear power flow equations used to characterize the system's state vector. and The relationship between them, where R is the covariance matrix, and it is a diagonal matrix with diagonal elements. The variance of each measurement reflects the magnitude of uncertainty in different measurements; The state deviation vector is calculated as follows: in, and These are the voltage amplitude and phase angle obtained through state estimation, respectively. and These are the disturbance factors for voltage amplitude and phase angle, respectively, representing the artificial amplification or reduction of voltage amplitude and phase angle on the bus. and These are from the system state vector Obtain the set of buses representing the applied voltage amplitude and the set of buses representing the applied voltage phase angle; and These represent the busbars respectively. busbar The estimated voltage amplitude and phase angle.

8. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 6, characterized in that: The formula for calculating the normalized cross-entropy loss value is as follows: In the formula, This is the normalized cross-entropy loss value, where N is the number of training samples and C is the number of classes. It is the one-hot encoded value of the i-th class of the k-th sample. The predicted probability of the k-th sample in the i-th class is: in, It is the k-th sample in the training data; i is the class. It is the network weight of the k-th sample corresponding to class i in a fully connected neural network. It is the output value of the normalized logit vector.

9. The method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 1, characterized in that: The Monte Carlo approximation calculation for the out-of-distribution detection module is as follows: In the formula, Indicates input Belongs to the Class expectations Indicates that the target category is the first The classes are divided into normal and abnormal categories. Indicates the first Secondary from network weight variational distribution The network parameters obtained from sampling, This indicates the total number of samples. Indicates the first The prediction under the second sampling belongs to the th The probability of a class.

10. A method for detecting spoofed data injection attacks outside the power grid distribution system according to claim 9, characterized in that: Mutual information in the distributed detection module The calculation formula is as follows: in, It is the total entropy, representing the overall uncertainty of the prediction; is the average conditional entropy, which represents the average prediction uncertainty of the model parameters under different dropout methods, and C is the total number of categories; Out-of-distribution detection is as follows: In the formula, It is a preset threshold used to determine the degree of uncertainty. If the score is less than the threshold, it is within the distribution and the value is 0. If the score is greater than the threshold, it is outside the distribution.

Images