Power grid attack behavior analysis method based on big data processing

Abstract

The invention discloses a power grid attack behavior analysis method based on big data processing, and relates to the technical field of data processing. Obtaining power operation data of the target area, and preprocessing the power operation data to obtain target operation data; performing feature extraction on the target operation data to obtain feature operation data, and detecting the feature operation data to obtain a classification result; and determining the type of the classification result, and if the classification result is an attack, carrying out fault early warning. Through the data preprocessing step, the data quality and consistency are improved, the low-dimensional features of the power system are extracted, the data dimension is reduced, key information is reserved, the problem that in a traditional method, attack related features are prone to being ignored is solved, and therefore the detection accuracy is improved, and the false alarm rate is reduced.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and more specifically to a method for analyzing power grid attack behavior based on big data processing. Background Technology

[0002] With the rapid development of smart grids, the informatization and automation levels of power grids have significantly improved, but they also face increasingly severe cybersecurity threats. Power grid attack behavior analysis, as a key technology for ensuring the safe and stable operation of power systems, has received widespread attention in recent years.

[0003] Patent No. CN115828233A discloses a data encapsulation method for a power grid dynamic security detection system. Based on the original network attack data, an attack behavior clustering parameter recombination array with a true distinguishing utility identifier for attack parameters is constructed. The attack behavior is pre-mapped onto the attack behavior clustering parameter recombination array by sequentially applying a preset data processing paradigm. Then, the pre-mapped array is parameterized using a "two-dimensional equivalence traversal combination differential data processing paradigm".

[0004] Traditional methods struggle with power operation data, which is characterized by high dimensionality and heterogeneity. This makes it easy for traditional methods to overlook key information related to attacks during the feature extraction stage, resulting in low detection accuracy and high false alarm rate. Summary of the Invention

[0005] The purpose of this invention is to address the problem mentioned in the background art that the high dimensionality and heterogeneity of power operation data lead to low detection accuracy and high false alarm rate, and to propose a power grid attack behavior analysis method based on big data processing.

[0006] A first aspect of this invention provides a method for analyzing power grid attack behavior based on big data processing, the method comprising:

[0007] Acquire power operation data for the target area, and preprocess the power operation data to obtain target operation data;

[0008] Feature extraction is performed on the target running data to obtain feature running data, and the feature running data is then detected to obtain classification results; the classification results include normal, attack, and fault types.

[0009] The type of the classification result is determined, and if the classification result is an attack, a fault warning is issued.

[0010] Optionally, before acquiring power operation data for the target area, the method further includes:

[0011] Obtain the topology data of the target area, and construct a topology map based on the topology data;

[0012] The topology diagram is input into a preset simulation model for configuration and initialization to obtain a target simulation model, and the target simulation model is executed to obtain simulation data.

[0013] The raw operating data of the target area is obtained, and the raw operating data is fused with the simulation data to obtain power operation data.

[0014] Optionally, the power operation data is preprocessed to obtain the target operation data, including:

[0015] The power operation data is subjected to outlier removal to obtain outlier-removed data. The outlier-removed data is then normalized to obtain normalized data. The normalized data is then expanded using the SMOTE algorithm to obtain the target operation data.

[0016] Optionally, before performing feature extraction on the target running data to obtain feature running data, the encoder update process includes:

[0017] Acquire target data, input the target data into the encoder, map the target data to the hidden layer to obtain low-dimensional features, and reconstruct the low-dimensional features to obtain reconstructed data;

[0018] The sample error is calculated from the target data and the reconstructed data. If the sample error is greater than a first threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the target configuration parameters.

[0019] Optionally, the encoder structure consists of an input layer, a hidden layer, and an output layer. A first weight matrix and a bias are determined based on the input layer and the hidden layer, and a second weight matrix is ​​determined based on the hidden layer and the output layer. The first weight matrix, the second weight matrix, and the bias constitute the configuration parameters.

[0020] Optionally, the configuration parameters are optimized to obtain the target configuration parameters, including:

[0021] The encoder in the first preset model is updated according to the target configuration parameters to obtain the first target model; the preset model consists of multiple encoders;

[0022] The target data is input into the first target model to obtain the final low-dimensional features, and the final low-dimensional features are reconstructed to obtain the target reconstructed data;

[0023] The target sample error is calculated from the target data and the target reconstructed data. If the target sample error is greater than the second threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the final configuration parameters.

[0024] The encoder in the first target model is updated according to the final configuration parameters to obtain the final model, and the target running data is input into the final model to obtain the feature running data.

[0025] Optionally, the process of detecting the feature running data to obtain classification results and then detecting them using the second target model includes:

[0026] The feature data is convolved to obtain a feature map, and the feature map is pooled to obtain a pooled feature map;

[0027] The pooled feature map is flattened to obtain a spatial feature vector, and the spatial feature vector is input into the LSTM module to obtain a temporal feature vector;

[0028] The spatial feature vector and the temporal feature vector are concatenated to obtain a fused feature vector. The fused feature vector is then input into a fully connected layer to obtain a classification probability, which is used as the classification result.

[0029] Optionally, before obtaining classification results by detecting the feature running data, the update process of the second target model includes:

[0030] Obtain a second preset model, determine the parameter combination of the second preset model, use the parameter combination as the initial solution, and randomly generate multiple initial solutions to obtain the original population;

[0031] The fitness of each initial solution in the original population is determined, and the initial solutions are sorted according to their fitness to obtain an initial solution sequence. The initial solution sequence is then divided into an exploration cluster, a search cluster, and a vigilance cluster according to a preset rule. The preset rule is to divide the initial solutions in the initial solution sequence into clusters according to a preset ranking.

[0032] The exploration cluster, the search cluster, and the vigilance cluster are updated until the maximum number of iterations is met, at which point the optimal initial solution is output; the optimal initial solution is the initial solution with the highest fitness corresponding to the maximum number of iterations.

[0033] Optionally, the alert cluster is updated, and the update formula includes:

[0034] If f i ≠f g ,but:

[0035]

[0036] If f i =f g ,but:

[0037]

[0038] in, Let be the position of the i-th initial solution in the (t+1)-th iteration in the d-dimensional parameter space, where t is the current iteration number. This represents the position of the optimal initial solution in the t-th iteration. This represents the position of the worst initial solution in the t-th iteration. Let f be the position of the i-th initial solution in the t-th iteration in the d-dimensional parameter space, β be a normally distributed random number, K be a random number following a uniform distribution (-1, 1), and f i Let f be the fitness of the i-th initial solution in the t-th iteration. g Let f be the fitness of the optimal initial solution in the t-th iteration. w Let ε be the fitness of the worst initial solution in the t-th iteration, and let ε be the minimum value.

[0039] Optionally, after determining the type of the classification result, the method further includes:

[0040] If the classification result is normal, no adjustment is made; if the classification result is faulty, a fault report is made.

[0041] The beneficial effects of this invention are:

[0042] This invention proposes a power grid attack behavior analysis method based on big data processing. It acquires power operation data from a target area, preprocesses the data to obtain target operation data, extracts features from the target operation data to obtain feature operation data, and then performs detection on the feature operation data to obtain classification results. The type of classification result is determined, and if the classification result indicates an attack, a fault warning is issued. The data preprocessing step improves data quality and consistency, extracts low-dimensional features related to the power system, reduces data dimensionality, and retains key information, avoiding the problem of traditional methods easily overlooking attack-related features. This improves detection accuracy and reduces false alarm rates. Attached Figure Description

[0043] Figure 1 A flowchart of a power grid attack behavior analysis method based on big data processing is provided for embodiments of the present invention. Detailed Implementation

[0044] To further illustrate the technical means and effects of the present invention in achieving its intended purpose, the following detailed description of the specific implementation methods, structures, features, and effects of the present invention, in conjunction with the accompanying drawings and preferred embodiments, is provided below.

[0045] The present invention provides a method for analyzing power grid attack behavior based on big data processing. See also: Figure 1 , Figure 1A flowchart illustrating a power grid attack behavior analysis method based on big data processing provided in an embodiment of the present invention. The method includes the following steps:

[0046] S101, Obtain power operation data of the target area, and preprocess the power operation data to obtain the target operation data;

[0047] S102, extract features from the target running data to obtain feature running data, and perform detection on the feature running data to obtain classification results;

[0048] S103, determine the type of classification result, and if the classification result is an attack, issue a fault warning.

[0049] The classification results include types such as normal, attack, and failure;

[0050] The power grid attack behavior analysis method based on big data processing provided in this invention improves data quality and consistency through data preprocessing steps and extracts low-dimensional features of the power system. This not only reduces the data dimensionality but also retains key information, avoiding the problem of easily ignoring attack-related features in traditional methods, thereby improving the detection accuracy and reducing the false alarm rate.

[0051] In one implementation, preprocessing the power operation data of the target area can effectively remove noise and outliers from the data, such as jump data caused by equipment failure; improve the quality and reliability of the data, and lay a solid foundation for subsequent feature extraction and model training. By normalizing the data to the [0,1] interval, the dimensional differences between different features are eliminated, enabling the model to process each feature more fairly during training, improving the convergence speed of the model, and enhancing the generalization ability of the model, so that it can better adapt to different types of input data.

[0052] In one implementation, feature extraction is performed on the preprocessed target operating data, which can extract low-dimensional features closely related to the operating state of the power system from high-dimensional data. The features not only significantly reduce the dimensionality of the data, but also retain key information, enabling the model to more intuitively reflect the normal, attack and fault states of the system.

[0053] In one implementation, the feature extraction process improves the interpretability of the data and the training efficiency of the model by removing redundant information and noise; the low-dimensional feature vector provides efficient and accurate input for subsequent classification and detection, enabling the model to identify the operating status of the power system more quickly.

[0054] In one implementation, detecting characteristic operational data enables rapid and accurate identification of the power system's operating status, including three types: normal, attack, and fault. This classification and detection mechanism can monitor the power system's operational status in real time, promptly identifying potential security threats or fault hazards. Through accurate classification results, the system can more effectively handle faults and provide security protection, improving the overall operational efficiency and emergency response capabilities of the power system. Real-time monitoring and early warning mechanisms significantly enhance the safety and reliability of the power system.

[0055] In one implementation, when the classification detection result is an attack or a fault, the system can immediately activate a fault early warning mechanism to notify relevant personnel to take corresponding measures. This early warning mechanism ensures that maintenance personnel can respond in the first instance and take effective fault handling and security protection measures, thereby minimizing the impact of faults or attacks on the power system. By clearly defining the type of classification result, the system can provide more targeted early warnings and responses, improving the emergency response capability and overall operational stability of the power system.

[0056] In one embodiment, before acquiring power operation data for the target area, the method further includes:

[0057] Obtain the topology data of the target area, and construct a topology map based on the topology data;

[0058] Input the topology diagram into the preset simulation model for configuration and initialization to obtain the target simulation model, and execute the target simulation model to obtain simulation data;

[0059] The raw operating data of the target area is obtained, and the raw operating data is fused with the simulation data to obtain the power operation data.

[0060] In one implementation, raw operational data, such as normal operation and natural faults, covers the status of intelligent electronic devices, phasor data, etc.; by acquiring the topology data of the target area and constructing a topology map, the network structure and connection relationships within the target area can be accurately reflected; the construction of the topology map provides a basic framework for subsequent simulation models, enabling the models to simulate based on the actual network topology; through the topology map, the connection methods between nodes, lines and equipment in the power system can be intuitively displayed, facilitating fault analysis, attack detection and system optimization.

[0061] In one implementation, the topology map is input into a preset simulation model for configuration initialization. The generated target simulation model can generate simulation data based on the actual topology. The simulation data includes the characteristics of the power system under different operating conditions, such as voltage amplitude, bus phase angle, active / reactive power, etc. By fusing these simulation data with the original operating data of the target area, more comprehensive and richer power operation data can be generated, which not only increases the diversity and coverage of the data, but also improves the robustness and generalization ability of the model. The fused power operation data can be used to train a more accurate detection model and improve the ability to identify abnormal states of the power system (such as faults or attacks).

[0062] In one embodiment, preprocessing power operation data to obtain target operation data includes:

[0063] Outlier removal is performed on power operation data to obtain outlier-removed data. The outlier-removed data is then normalized to obtain normalized data. The normalized data is then expanded using the SMOTE algorithm to obtain the target operation data.

[0064] In one implementation, outlier removal is performed on the power operation data to remove jump data caused by equipment failure or other factors, thereby improving the quality and reliability of the data. The presence of outliers may mislead model training, leading to misjudgments of the normal operating state. By removing these outliers, it can be ensured that the model can better learn the characteristics of the normal operating state during training. Subsequent data normalization mapping maps the data to the [0,1] interval, eliminating the dimensional differences between different features, enabling the model to treat each feature more fairly during training and avoiding the dominance of model training due to the excessively large numerical range of certain features. Normalization can improve the convergence speed of the model and also improve the generalization ability of the model.

[0065] In one implementation, the SMOTE algorithm is used to augment the normalized data, effectively addressing the problem of insufficient sample numbers for minor categories in the dataset. In power system operation data, certain abnormal states or attack events are rare, resulting in a small number of relevant samples. The SMOTE algorithm generates synthetic samples, increasing the number of samples for these minor categories, thereby improving the model's ability to identify rare events. Data augmentation not only enriches the training dataset but also enhances the model's robustness, enabling it to classify and predict more stably when faced with different types of input data. It also improves the model's generalization ability and enhances its performance when dealing with imbalanced datasets.

[0066] In one embodiment, before performing feature extraction on the target running data to obtain feature running data, the encoder update process includes:

[0067] The target data is acquired, input into the encoder, mapped to the hidden layer to obtain low-dimensional features, and reconstructed from the low-dimensional features to obtain reconstructed data.

[0068] The sample error is calculated from the target data and the reconstructed data. If the sample error is greater than the first threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the target configuration parameters.

[0069] In one implementation, high-dimensional data can be effectively compressed into low-dimensional features by inputting the target data into the encoder and mapping it to the hidden layer. This process not only reduces the dimensionality of the data but also preserves its core feature information. Subsequently, the effectiveness of the low-dimensional features and the accuracy of the reconstruction can be verified by reconstructing the low-dimensional features and calculating the sample error between the reconstructed data and the original target data. If the sample error is less than or equal to a first threshold, it indicates that the current configuration parameters can perform the feature extraction and reconstruction tasks well, and the model's performance is satisfactory.

[0070] In one implementation, when the sample error is greater than the first threshold, it indicates that the current configuration parameters have failed to enable the model to achieve the ideal reconstruction effect. At this time, the configuration parameters need to be optimized. By optimizing parameters such as the weight matrix and bias, the internal structure of the model can be adjusted to better adapt to the feature distribution of the target data. The optimized target configuration parameters can improve the reconstruction accuracy of the model, thereby enhancing the model's ability to extract low-dimensional features and fit the original data.

[0071] In one embodiment, the encoder structure consists of an input layer, a hidden layer, and an output layer. A first weight matrix and a bias are determined based on the input layer and the hidden layer, and a second weight matrix is ​​determined based on the hidden layer and the output layer. The first weight matrix, the second weight matrix, and the bias constitute the configuration parameters.

[0072] In one implementation, an encoder structure comprising an input layer, a hidden layer, and an output layer is constructed. A first weight matrix and bias between the input and hidden layers, and a second weight matrix between the hidden and output layers, are determined to form complete configuration parameters. This structured configuration parameter setting enables the encoder to effectively encode and decode input data, achieving feature extraction and data reconstruction. Furthermore, by optimizing these weight matrices and biases, the model's performance can be further improved, making it better suited to the feature extraction needs of complex data.

[0073] In one embodiment, optimizing configuration parameters to obtain target configuration parameters includes:

[0074] The first target model is obtained by updating the encoder in the first preset model according to the target configuration parameters; the preset model consists of multiple encoders;

[0075] The target data is input into the first target model to obtain the final low-dimensional features, and the final low-dimensional features are reconstructed to obtain the target reconstructed data;

[0076] The target sample error is calculated from the target data and the target reconstructed data. If the target sample error is greater than the second threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the final configuration parameters.

[0077] The encoder in the first target model is updated according to the final configuration parameters to obtain the final model, and the target running data is input into the final model to obtain the feature running data.

[0078] In one implementation, deep features of the data can be gradually extracted by updating the encoder in the first preset model layer by layer. The update of each encoder layer is based on the output of the previous layer, so that the features are continuously refined in the process of passing through layers. The layer-by-layer update method can not only effectively reduce the dimensionality of the data, but also retain the key information related to the target (such as attack detection) in the data. The resulting low-dimensional features can more accurately reflect the essential features of the data, thereby providing more valuable input for subsequent model training and classification tasks. This overcomes the limitations of a single encoder when processing complex data and improves the model's ability to fit complex data and the accuracy of feature extraction.

[0079] In one implementation, the model's performance can be evaluated in real time by calculating the error between the target data and the target reconstructed data and comparing it with a preset second threshold. If the error exceeds the threshold, it means that the current configuration parameters have failed to enable the model to achieve the ideal reconstruction effect. In this case, optimizing the configuration parameters can ensure that the model gradually improves in subsequent iterations and eventually completes training. The error feedback parameter optimization mechanism can not only automatically adjust the model parameters to adapt to the complexity of the data, but also avoid the model from getting stuck in local optima, thereby improving the model's global optimization capability and the final feature extraction accuracy.

[0080] In one embodiment, the process of detecting feature-based running data to obtain classification results and then detecting them using a second target model includes:

[0081] Convolution is performed on the feature data to obtain a feature map, and pooling is performed on the feature map to obtain a pooled feature map;

[0082] Flatten the pooled feature map to obtain a spatial feature vector, and input the spatial feature vector into the LSTM module to obtain a temporal feature vector;

[0083] Spatial feature vectors and temporal feature vectors are concatenated to obtain a fused feature vector. The fused feature vector is then input into a fully connected layer to obtain the classification probability, which is used as the classification result.

[0084] In one implementation, convolution operations on the feature data can effectively extract local spatial features, which reflect the spatial correlation between different variables in the power data, such as the relationship between the voltage of a node and the voltage of its neighboring nodes. Convolution operations use convolution kernels to slide across the data, capturing feature changes within local regions, thus providing a foundation for subsequent feature analysis. Pooling operations reduce the dimensionality of features, decrease computational complexity, and enhance feature robustness. Pooling operations retain the main information of features by downsampling within local regions, while removing some noise and details, making the model more tolerant to small changes in the input data, thereby improving the model's generalization ability.

[0085] In one implementation, the spatial feature vector obtained through convolution and pooling is input into the LSTM module to extract the temporal feature vector. The LSTM module captures the temporal dependencies in the power data through its gating mechanism, such as the power deviation trend over multiple consecutive cycles. The spatial feature vector and the temporal feature vector are concatenated to obtain a fused feature vector. By fusing information from both spatial and temporal dimensions, the model can more comprehensively understand the operating state of the power system. The fused feature vector is input into a fully connected layer and the classification probability is output through the softmax activation function, which can accurately determine the probability of a sample belonging to each category, thereby achieving accurate classification of the power system state.

[0086] In one embodiment, before obtaining classification results by detecting the feature-driven data, the update process of the second target model includes:

[0087] Obtain the second preset model, determine the parameter combination of the second preset model, use the parameter combination as the initial solution, and randomly generate multiple initial solutions to obtain the original population;

[0088] The fitness of each initial solution in the original population is determined, and the initial solutions are sorted according to their fitness to obtain an initial solution sequence. The initial solution sequence is then divided into exploration clusters, search clusters, and vigilance clusters according to a preset rule. The preset rule is to divide the initial solutions in the initial solution sequence into clusters according to a preset ranking.

[0089] The exploration cluster, search cluster, and vigilance cluster are updated until the maximum number of iterations is met, at which point the optimal initial solution is output; the optimal initial solution is the initial solution with the highest fitness corresponding to the maximum number of iterations.

[0090] In one implementation, by obtaining the parameter combination of the CNN-LSTM model (the second preset model) and using it as the initial solution, multiple initial solutions are randomly generated to form the original population, which can provide diverse starting points for model parameter optimization; determine the fitness of each initial solution and sort them, and then divide them into clusters according to preset rules. For example, the preset rules are: the first 20% in the initial solution sequence are used as the exploration cluster, and the remaining 80% are used as the search cluster. Randomly select 10%-20% in the initial solution sequence as the warning cluster. When an initial solution in the exploration cluster or the search cluster is selected as an individual in the warning cluster, the previous selection will not be executed, but it will work as the warning cluster; enabling individuals with different roles to play specific roles in the optimization process. For example, the exploration cluster is responsible for global search, the search cluster conducts local search, and the warning cluster maintains search diversity. Combining the constraint of the maximum number of iterations, it can balance global exploration and local search, avoid falling into local optima, and thus find the optimal parameter combination within a limited number of iterations, improving the detection performance of the CNN-LSTM model.

[0091] In one implementation, the update formula for the exploration cluster: safe state R < AQ, , dangerous state R ≥ AQ, ; where, is the position of the i-th initial solution in the d-th dimensional parameter space in the t-th iteration (that is, the value of the d-th parameter in the i-th parameter combination, such as the convolution kernel size, the number of LSTM nodes, etc.); t is the current iteration number (counting from 0); t + 1 is the next iteration (the updated iteration number); i is the index of the initial solution (range: 1 to the population size n); α is a random number, with a value range of (0, 1), controlling the randomness of the search step of the discoverer; T is the maximum number of iterations (the iteration upper limit when the algorithm terminates); R is a warning value, a random number, with a value range of [0, 1], used to determine whether the environment is safe (whether there are predators); AQ is the safety threshold, usually set to 0.8, used to divide the safe or dangerous state (R < AQ is safe, R ≥ AQ is dangerous); Q is a random number subject to the standard normal distribution (mean 0, variance 1), used for random movement in the dangerous state; L is a full 1 matrix with the same dimension as the parameter space, ensuring the dimension matching of the addition operation; Exp( ) is the exponential function, used for position decay in the safe state (simulating the discoverer approaching the high-quality area).

[0092] In one implementation, the update formula for the search cluster: low fitness follower, i > n / 2: , high fitness follower, i ≤ n / 2: , where, n is the population size (the total number of sparrow individuals); x w is the worst position among all initial solutions in the current iteration (the parameter combination corresponding to the lowest fitness); is the optimal position among all initial solutions in the (t+1)th iteration (corresponding to the parameter combination with the highest fitness); D is the dimension of the parameter space (the total number of parameters to be optimized, such as the CNN convolution kernel size, the number of LSTM nodes, etc., a total of D parameters); rand{-1,1} is a randomly generated variable of -1 or 1, used to introduce the randomness of local search; | | is the absolute value operation to ensure that the distance is non-negative; This is a summation operation on the parameters from the 1st to the Dth dimensions, used to integrate the local search results from each dimension.

[0093] In one embodiment, the alert cluster is updated using the following formula:

[0094] If f i ≠f g ,but:

[0095]

[0096] If f i =f g ,but:

[0097]

[0098] in, Let be the position of the i-th initial solution in the (t+1)-th iteration in the d-dimensional parameter space, where t is the current iteration number. This represents the position of the optimal initial solution in the t-th iteration. This represents the position of the worst initial solution in the t-th iteration. Let f be the position of the i-th initial solution in the t-th iteration in the d-dimensional parameter space, β be a normally distributed random number, K be a random number following a uniform distribution (-1, 1), and f i Let f be the fitness of the i-th initial solution in the t-th iteration. g Let f be the fitness of the optimal initial solution in the t-th iteration. w Let ε be the fitness of the worst initial solution in the t-th iteration, and let ε be the minimum value.

[0099] In one implementation, the position of the initial solution is dynamically adjusted by distinguishing whether the fitness of the initial solution in the vigilance cluster is globally optimal. When the fitness of the initial solution in the vigilance cluster is not globally optimal, its position will move closer to the current optimal solution, with the step size controlled by normally distributed random numbers. This helps the initial solution move quickly towards the region of high-quality solutions, accelerating the convergence process of the algorithm. Conversely, when the fitness of the initial solution in the vigilance cluster is globally optimal, its position update introduces randomness. Uniformly distributed random numbers guide its exploration in the solution space, preventing the algorithm from getting trapped in local optima and enhancing the algorithm's global search capability.

[0100] In one implementation, fi The fitness value of the i-th initial solution (i.e., the validation set accuracy of the CNN-LSTM model under this parameter combination); f g Global optimal fitness value (the highest validation set accuracy among all initial solutions); f w The worst-case fitness value (the lowest validation set accuracy among all initial solutions); β is a normally distributed random number with a mean of 0 and a variance of 1, controlling the step size by which the initial solutions in the vigilance swarm move towards the optimal position; K is a uniformly distributed random number in (-1,1), used to simulate the random movement direction of the initial solutions in the vigilance swarm to avoid predators; ε is a minimum value (e.g., 10). -8 ), to avoid the denominator being 0.

[0101] In one embodiment, after determining the type of classification result, the method further includes:

[0102] If the classification result is normal, no adjustment is made; if the classification result is faulty, a fault report is made.

[0103] In one implementation, when the classification result is normal, the system confirms that the current operating state is normal, so no adjustments are needed, thereby reducing unnecessary intervention and resource waste; improving the system's operating efficiency and reducing system instability caused by misoperation; when the classification result is fault, the system can promptly identify and report fault information, ensuring that maintenance personnel can respond quickly and take measures; improving the fault diagnosis efficiency and response speed of the power system, and enhancing the system's reliability and stability.

[0104] In one implementation, if the classification result is an attack, the system will activate a security protection mechanism to cut off the attacked network connection, isolate the affected device, record attack-related data, and notify security management personnel.

[0105] The above description is merely a preferred embodiment of the present invention and is not intended to limit the present invention in any way. Although the present invention has been disclosed above with reference to preferred embodiments, it is not intended to limit the present invention. Any person skilled in the art can make some modifications or alterations to the above-disclosed technical content to create equivalent embodiments without departing from the scope of the present invention. Any simple modifications, equivalent changes and alterations made to the above embodiments based on the technical essence of the present invention without departing from the scope of the present invention shall still fall within the scope of the present invention.

Claims

1. A method for analyzing power grid attack behavior based on big data processing, characterized in that, The method includes: Acquire power operation data for the target area, and preprocess the power operation data to obtain target operation data; Feature extraction is performed on the target running data to obtain feature running data, and the feature running data is then detected to obtain classification results; the classification results include normal, attack, and fault types. The type of the classification result is determined, and if the classification result is an attack, a fault warning is issued.

2. The power grid attack behavior analysis method based on big data processing according to claim 1, characterized in that, Before acquiring power operation data for the target area, the method further includes: Obtain the topology data of the target area, and construct a topology map based on the topology data; The topology diagram is input into a preset simulation model for configuration and initialization to obtain a target simulation model, and the target simulation model is executed to obtain simulation data. The raw operating data of the target area is obtained, and the raw operating data is fused with the simulation data to obtain power operation data.

3. The power grid attack behavior analysis method based on big data processing according to claim 1, characterized in that, The target operating data is obtained by preprocessing the power operation data, including: The power operation data is subjected to outlier removal to obtain outlier-removed data. The outlier-removed data is then normalized to obtain normalized data. The normalized data is then expanded using the SMOTE algorithm to obtain the target operation data.

4. The power grid attack behavior analysis method based on big data processing according to claim 1, characterized in that, Before performing feature extraction on the target running data to obtain feature running data, the encoder update process includes: Acquire target data, input the target data into the encoder, map the target data to the hidden layer to obtain low-dimensional features, and reconstruct the low-dimensional features to obtain reconstructed data; The sample error is calculated from the target data and the reconstructed data. If the sample error is greater than a first threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the target configuration parameters.

5. The power grid attack behavior analysis method based on big data processing according to claim 4, characterized in that, The encoder structure consists of an input layer, a hidden layer, and an output layer. A first weight matrix and a bias are determined based on the input layer and the hidden layer, and a second weight matrix is ​​determined based on the hidden layer and the output layer. The first weight matrix, the second weight matrix, and the bias constitute the configuration parameters.

6. The power grid attack behavior analysis method based on big data processing according to claim 4, characterized in that, The target configuration parameters are obtained by optimizing the configuration parameters, including: The encoder in the first preset model is updated according to the target configuration parameters to obtain the first target model; the preset model consists of multiple encoders; The target data is input into the first target model to obtain the final low-dimensional features, and the final low-dimensional features are reconstructed to obtain the target reconstructed data; The target sample error is calculated from the target data and the target reconstructed data. If the target sample error is greater than the second threshold, the configuration parameter update is determined to have failed, and the configuration parameters are optimized to obtain the final configuration parameters. The encoder in the first target model is updated according to the final configuration parameters to obtain the final model, and the target running data is input into the final model to obtain the feature running data.

7. The power grid attack behavior analysis method based on big data processing according to claim 1, characterized in that, The process of detecting the feature-driven data to obtain classification results, and then using the second target model for detection, includes: The feature data is convolved to obtain a feature map, and the feature map is pooled to obtain a pooled feature map; The pooled feature map is flattened to obtain a spatial feature vector, and the spatial feature vector is input into the LSTM module to obtain a temporal feature vector; The spatial feature vector and the temporal feature vector are concatenated to obtain a fused feature vector. The fused feature vector is then input into a fully connected layer to obtain a classification probability, which is used as the classification result.

8. The power grid attack behavior analysis method based on big data processing according to claim 7, characterized in that, Before obtaining classification results by detecting the feature running data, the update process of the second target model includes: Obtain a second preset model, determine the parameter combination of the second preset model, use the parameter combination as the initial solution, and randomly generate multiple initial solutions to obtain the original population; The fitness of each initial solution in the original population is determined, and the initial solutions are sorted according to their fitness to obtain an initial solution sequence. The initial solution sequence is then divided into an exploration cluster, a search cluster, and a vigilance cluster according to a preset rule. The preset rule is to divide the initial solutions in the initial solution sequence into clusters according to a preset ranking. The exploration cluster, the search cluster, and the vigilance cluster are updated until the maximum number of iterations is met, at which point the optimal initial solution is output; the optimal initial solution is the initial solution with the highest fitness corresponding to the maximum number of iterations.

9. The power grid attack behavior analysis method based on big data processing according to claim 8, characterized in that, The alert cluster is updated using the following formula: If f i ≠f g ,but: ， If f i =f g ,but: ， in, Let be the position of the i-th initial solution in the (t+1)-th iteration in the d-dimensional parameter space, where t is the current iteration number. This represents the position of the optimal initial solution in the t-th iteration. This represents the position of the worst initial solution in the t-th iteration. Let f be the position of the i-th initial solution in the t-th iteration in the d-dimensional parameter space, β be a normally distributed random number, K be a random number following a uniform distribution (-1, 1), and f i Let f be the fitness of the i-th initial solution in the t-th iteration. g Let f be the fitness of the optimal initial solution in the t-th iteration. w Let ε be the fitness of the worst initial solution in the t-th iteration, and let ε be the minimum value.

10. The power grid attack behavior analysis method based on big data processing according to claim 1, characterized in that, After determining the type of the classification result, the method further includes: If the classification result is normal, no adjustment is made; if the classification result is faulty, a fault report is made.

Images