A power transmission system attack scenario identification method considering information-physical interaction

Abstract

The application relates to the technical field of power information physical system security, and discloses a power transmission system attack scene identification method considering information physical interaction. A DAD attack and defense model is constructed, a plurality of typical attack scenes are generated, historical load data, attack schemes and defense schemes are collected; a classification network is trained to learn the mapping relationship between the system operation state and the corresponding worst attack response; a gradient descent method is used to optimize the network parameters, and a Lagrange function and an information physical coupling penalty term are introduced; after training, attack scene prediction is carried out; taking minimizing the expected loss of the system as an optimization objective, the optimized defense resource configuration scheme is obtained through iterative solution of C&CG. Through the multi-stage collaborative optimization strategy, the TCPS resilience under the information physical collaborative attack is improved, the system can quickly respond and recover when facing a dynamic attack environment, and the overall system stability and security are enhanced.

Description

Technical Field

[0001] This invention relates to the field of power cyber-physical system security technology, specifically to a method for identifying attack scenarios in power transmission systems that considers cyber-physical interactions. Background Technology

[0002] With the development of communication and internet technologies, the cyber-physical coupling in the power sector is deepening, and the power system is gradually evolving into a cyber-physical system. Currently, the development of cyber-physical systems faces multiple practical challenges. On the one hand, with the integration of numerous distributed power sources, the information sensing capabilities of the power system remain insufficient, and the control system management framework struggles to coordinate the flexible needs of multiple stakeholders—source, grid, and load. On the other hand, the volume of system operation status data is increasing dramatically, making the power system a key target for cyberattacks, and the information security situation is becoming increasingly severe, placing higher demands on network security protection capabilities. This high degree of cyber-physical coupling also leads to greater system vulnerability, making faults easier to propagate within the system and potentially triggering cascading failures under extreme conditions.

[0003] As a crucial component of the power grid, the transmission network plays a vital role in power delivery. On the one hand, the system deploys numerous terminal devices to sense and monitor the grid's operational status, significantly enhancing its observability, measurability, and controllability. On the other hand, intelligent systems such as supervisory control and data acquisition (SCADA) systems face increasingly frequent malicious attacks. Covert cyber-physical attacks further exacerbate the challenges faced by the transmission network's cyber-physical systems in terms of security and power supply assurance.

[0004] In the framework of attack-defense modeling, the defender-attacker-defender (DAD) structure is widely used in robust optimization modeling problems. To solve the model, column-and-constraint generation (C&CG) is widely employed and extended to methods such as nested C&CG structures and alternating optimization procedures to solve optimization problems with binary variables in the inner layers of the model. Improved multi-layered optimization frameworks have also been proposed and applied to robust optimization of power systems. Furthermore, researchers have extended the defender-attacker-defender problem to a distributed robust optimization framework to maintain the economical operation of the system while responding to extreme attacks.

[0005] While the robust optimization frameworks mentioned above provide a foundation for system-level strategies, they often fail to effectively integrate historical system operating data, resulting in limited support for adaptive defense in dynamic scenarios. To address this, researchers have recently proposed robust optimization enhancement strategies that integrate supervised learning methods. These methods typically transform key operating parameters (such as renewable power generation forecasts, load curves, and ambient temperature changes) into deterministic inputs to the optimization model, thereby improving the model's decision-making ability under uncertain scenarios. However, in existing models, although historical data provides predictive capabilities for system states, the efficiency of solving robust optimization models remains limited.

[0006] To address this, some studies have begun to directly embed learning mechanisms into optimization model structures, such as combining Lagrange multipliers with neural network outputs to construct an end-to-end scheduling decision mapping framework. Furthermore, hybrid machine learning and metaheuristic algorithms have also been applied to scheduling tasks. While these heuristic learning methods have demonstrated high adaptability and scalability in complex systems, they lack guarantees of global optimality.

[0007] Reinforcement learning technology has gradually demonstrated its advantages in the field of power resilience regulation. Literature has explored its application potential in areas such as island recovery, resource scheduling, and enhancing the resilience of multi-energy systems under extreme weather conditions, although challenges remain regarding training stability and generalization ability. For example, meta-reinforcement learning has been used to address the two-stage resource allocation of multi-energy systems during typhoons, thereby enhancing system resilience. Reinforcement learning methods have also been employed to assist in the restoration of power services in islanded microgrids. While reinforcement learning-based methods can explore real-time strategies, challenges remain regarding training stability, efficiency, and hyperparameter selection.

[0008] To address the NP-hard problem of enumerating extreme scenarios in robust optimization, recent research has attempted to embed learning mechanisms into classic solution structures (such as Benders or C&CG). Some papers have embedded ANNs into the C&CG process to compress the search space, or used classifiers to improve the efficiency of Benders section generation, or constructed ANN models that can predict recovery paths, providing assistance for strategy formulation in post-disaster recovery.

[0009] In summary, the existing technology has the following drawbacks:

[0010] 1) Existing resilience enhancement technologies for transmission network cyber-physical systems (TCPS) primarily focus on single physical layer protection, failing to deeply consider the coupling effects between the information and physical layers in the transmission network. Most methods only consider the impact of physical attacks, neglecting the security of information systems such as relay protection devices and SCADA systems, and cannot effectively simulate the propagation path of faults and their interconnected characteristics. The goal of this invention is to construct a collaborative modeling method for TCPS, improving the system's response capability to complex network attacks and strengthening its defense capability against collaborative attacks.

[0011] 2) Current research largely focuses on defense against physical attacks, lacking comprehensive modeling and countermeasures against information attacks and their synergistic mechanisms with physical attacks. This makes the system's defense capabilities insufficient when facing cyber-physical combined attack scenarios. The goal of this invention is to establish a resilience enhancement mechanism suitable for cyber-physical combined attack scenarios. By combining classification networks and robust optimization, and intelligently learning the worst-case attack mode, it aims to improve the system's global response capability and overall resilience under complex attack modes.

[0012] 3) Existing resilience enhancement strategies for power transmission cyber-physical systems mostly rely on external resource support, while paying less attention to the mobilization and coordinated utilization of internal system resources, and lack a defense framework covering the entire attack process. Existing methods typically only consider external intervention after an attack, neglecting the effectiveness of the system's internal emergency recovery mechanisms. This invention introduces a robust optimization method based on classification networks to optimize defense resource allocation, improve system emergency recovery capabilities, achieve comprehensive coordination and improved recovery efficiency before and after an attack, and thus realize system-level resilience enhancement for the entire process. Summary of the Invention

[0013] To address the aforementioned problems, the present invention aims to provide a method for identifying attack scenarios in power transmission systems that considers cyber-physical interactions. Through a multi-stage collaborative optimization strategy, it enhances TCPS resilience under cyber-physical collaborative attacks, ensuring the system can respond and recover quickly in dynamic attack environments, thereby improving overall system stability and security. The technical solution is as follows:

[0014] A method for identifying attack scenarios in power transmission systems that consider cyber-physical interactions includes the following steps:

[0015] Step 1: Construct a defender-attacker-defender attack and defense model, determine the constraints, rationally allocate defense resources, and dynamically adjust defense strategies to maximize the power transmission system's ability to resist attacks.

[0016] Step 2: Data Collection and Preprocessing: Input the topology of the power transmission system and the scale of cyber-physical collaborative attacks to generate multiple typical attack scenarios; collect historical load data, attack schemes and defense schemes, and label the worst attack scenarios through one-hot encoding for subsequent training;

[0017] Step 3: Based on the preprocessed data in Step 2, train a classification network to learn the mapping relationship between the system's operating state and the corresponding worst-case attack response; optimize the network parameters using gradient descent and introduce a Lagrangian function and a cyber-physical coupling penalty term to ensure the feasibility of the predicted solution; after training, provide a preliminary attack scenario prediction.

[0018] Step 4: Based on the attack scenarios predicted in Step 3, in the online application stage, the optimization objective is to minimize the expected loss of the power transmission system. The constraints include attack constraints under various attack scenarios, total limit of defense resources, and power flow constraints. The optimized defense resource configuration scheme is obtained by iteratively solving the column and constraint generation method.

[0019] The beneficial effects of this invention are:

[0020] 1) This invention overcomes the limitations of existing robust optimization techniques by applying deep learning to the identification of key attack scenarios, enabling rapid and accurate identification of complex attack scenarios. Through deep learning-assisted robust optimization, this invention can quickly obtain high-quality defense solutions, improving the system's response speed and accuracy in complex cyber-physical attack scenarios.

[0021] 2) This invention innovatively introduces a new process in network training, incorporating a Lagrange penalty training process that considers penalty terms for cyber-physical coupling constraints and attack mutual exclusion constraints. During training, the Lagrange penalty form ensures the feasibility of the constraints, effectively improving the performance of the prediction network and enhancing the model's robustness under complex constraints.

[0022] 3) In the training result correction process, this invention incorporates an optimization method for the correction output. Through simple optimization steps, the prediction results are corrected to fall within the feasible region. This correction process significantly improves the feasibility and accuracy of the results, ensuring that the final strategy meets the system constraints. Attached Figure Description

[0023] Figure 1 Flowchart for robust optimization of TCPS learning assistance.

[0024] Figure 2 This is a topology diagram of the IEEE-24 system.

[0025] Figure 3(a) shows the attack scenario example results—a schematic diagram of the attack route.

[0026] Figure 3(b) shows the results of an attack scenario example—a schematic diagram of intrusion relay protection.

[0027] Figure 4(a) shows the network training results and the change curve of the penalty coefficient.

[0028] Figure 4(b) shows the network training results and accuracy curve.

[0029] Figure 5(a) shows the optimization results—total time.

[0030] Figure 5(b) shows the optimization results—the number of iterations. Detailed Implementation

[0031] The present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments. The present invention proposes a robust optimization method for a power transmission cyber-physical system (TCPS) based on a classification network to quickly respond to cyber-physical coordinated attacks. This method, based on a comprehensive consideration of the physical layer protection of the power transmission system and the security of the information system, constructs a resilience enhancement process for cyber-physical coordinated attacks. This process includes three main steps: data collection, network training, and online application. Its flowchart is shown below. Figure 1 As shown, the process begins with offline data processing to collect system operational characteristics under attack scenarios, including load curves, power generation capacity, and system topology. Subsequently, a classification network is trained to approximate the mapping between the system's operating state and the corresponding worst-case attack response. In the online application phase, the trained classification network first makes preliminary predictions for key attack scenarios. Based on this, a correction mechanism is introduced to adjust the predicted solutions, thereby enhancing the results' ability to meet model constraints. Finally, a column and constraint generation method is used to iteratively optimize and refine the defense strategy.

[0032] Before performing algorithm optimization, a DAD attack and defense model needs to be built; then data collection and preprocessing are carried out, followed by network training and prediction optimization; finally, collaborative optimization of attack response and robustness is performed. The specific process is as follows:

[0033] Step 1: DAD attack and defense model construction.

[0034] Given limited defensive resources, rational allocation is required to maximize the system's resistance to attacks. In power transmission cyber-physical systems, resources should be prioritized to reduce failure risks and enhance system defense. Combining classification networks with a robust optimization framework enables accurate prediction of extreme attack scenarios and dynamic adjustment of defense strategies, ensuring the system remains secure even under worst-case conditions.

[0035] (1) Defender's constraints;

[0036] The DAD model is a three-stage decision game model of defender-attacker-defender, used to systematically characterize the attack and defense interaction process in power transmission cyber-physical systems. The model first involves the defender formulating protection and hardening strategies under limited resource constraints. Then, the attacker simulates network or physical layer attack behaviors. Finally, the defender performs attack mitigation and recovery based on the defense deployment results to verify the robustness and effectiveness of the defense scheme. Through this three-layer nested optimization framework, optimal allocation of defense resources, attack path identification, and adaptive improvement of system resilience can be achieved under limited defense resources. The constraints mainly include the defender's power transmission line hardening strategy and relay protection communication maintenance strategy. Under limited defense resources, the constraints can be expressed as follows:

[0037] (1);

[0038] (2);

[0039] in, This represents a vector consisting entirely of 1s; and These correspond to the resource quantities for line reinforcement and communication protection of relay protection, respectively. and These are binary variables, representing whether to apply protection to the corresponding protective relay communication and transmission line, respectively.

[0040] All binary variables in the text are set to 1 if they are true, and 0 otherwise.

[0041] (2) Attacker's constraints;

[0042] The constraints mainly concern the attacker's disruptive strategies against transmission lines and relay protection communications, as detailed below:

[0043] (3);

[0044] (4);

[0045] in, and It is the amount of resources that attackers use for line strength and relay protection defenses. and These are binary variables, representing whether an attack is launched on the corresponding protective relay communication and transmission line.

[0046] The attack effects depict the interaction between the attack plan and the defense strategy, as shown below:

[0047] (5);

[0048] (6);

[0049] (7);

[0050] (8);

[0051] (9);

[0052] (10);

[0053] In the formula, This is a binary variable indicating whether a short-circuit attack has occurred on the transmission line; and These are binary variables, representing whether the downlink relay protection and uplink relay protection of the transmission line have been subjected to network attacks, respectively. and These are binary variables, representing whether the downstream and upstream nodes of the transmission line are damaged under a coordinated network attack; This is a binary variable representing whether the node is in a running state; , and These represent the relationship matrices between the downlink protection relay and the transmission line, the uplink protection relay and the transmission line, and the busbar and the transmission line, respectively.

[0054] Attackers should avoid being detected by defenders. Once the transmission line is restored, it cannot be physically attacked. Similarly, its relay protection network communications should remain intact, as follows:

[0055] (11);

[0056] (12);

[0057] (13);

[0058] (14);

[0059] in, This is a binary variable representing whether the transmission line status is normal, taking into account attacks and the line recovery process. The duration of the fault propagation process; This is a binary variable representing whether a short-circuit attack has occurred on the transmission line at time t; This is a binary variable representing whether the transmission line is in normal condition at time t, taking into account the attack and line recovery process.

[0060] (3) Fault propagation process;

[0061] When a power cyber-physical system is subjected to a short-circuit attack, a sequential network attack will further amplify the impact of the fault. A fault propagation model describes the propagation path of the fault between transmission lines, power nodes, and protective relays. The model is as follows:

[0062] (15);

[0063] in, It is a binary variable representing whether the transmission line is in normal condition, and takes into account attacks, line recovery status and fault propagation process.

[0064] Based on virtual goods flow, the fault propagation model can be described as follows:

[0065] (16);

[0066] (17);

[0067] (18);

[0068] in, , and These represent the fault source product, the fault status of the confluence node, and the product flow data of the line, respectively. , and These are binary variables, representing whether a node is a fault source node, whether commodity flow data propagates from downstream of the line, and whether commodity flow data propagates from upstream of the line, respectively. This refers to the number of busbars in the power transmission network.

[0069] The relationship between the fault propagation model of binary variables and the attack effect is described as follows:

[0070] (19);

[0071] (20);

[0072] (twenty one);

[0073] (twenty two);

[0074] (twenty three);

[0075] in, , and These represent the relationship matrices between the busbar and the relay protection device, the busbar and the lower relay protection device, and the busbar and the upper relay protection device, respectively. This is a matrix showing the relationship between transmission lines and relay protection devices; the superscript T is the transpose symbol. This is a binary variable representing whether the confluence node is compromised under a coordinated network attack.

[0076] (4) Restrictions on operating personnel;

[0077] For operators, implementing the rescheduling process aims to improve the system's responsiveness to sequential network attacks, as detailed below:

[0078] (twenty four);

[0079] (25);

[0080] (26);

[0081] (27);

[0082] (28);

[0083] (29);

[0084] In the formula, x represents the line power; x represents the impedance matrix. This represents the inverse of the line impedance diagonal matrix; D0 represents the predicted load power. and These are respectively downhill and uphill climbs; and These are the minimum and maximum values ​​of the line power, respectively. and These are the downlink capacity and the uplink capacity, respectively. and These are the dual variables of the equality constraint; , , , , , , and These are variables constrained by inequalities. , , and These are the relationship matrices between the bus and the generator, the bus and the load, the bus and the ramp-constrained generator, and the generator and the ramp-constrained generator, respectively. , , and These are the connection matrix of nodes and lines, voltage angle, line power, and load shedding, respectively. and These represent the node state of the nth node at time t and the line power at time t, respectively. The symbol "" indicates the dual of the relevant formula.

[0085] For transmission lines affected by the attack, their power flow and power constraints can be reconfigured as follows:

[0086] (30).

[0087] Step 2: Data collection and preprocessing.

[0088] First, the system topology and the scale of cyber-physical attack are input to generate multiple typical attack scenarios. During this stage, historical load data, attack schemes, and defense schemes are collected, and the worst-case attack scenario is labeled using one-hot encoding for subsequent training. After data processing, network training proceeds to step 3.

[0089] Under different load conditions, the C&CG (Column and Constraint Generation) process can be executed to obtain different iterative results. Then, a data flow is designed to control the number of solution sets under different load conditions. It is based on the congestion distance with LB (Lower Bound) and UB (Upper Bound) values, calculated as follows:

[0090] (31);

[0091] (32);

[0092] (33)

[0093] In the formula, This represents the congestion distance of the solution for the i-th attack scenario; and These represent the maximum and minimum values ​​of the lower bound, respectively. and The upper bound represents the maximum and minimum values; N0 represents the number of solutions; H represents the sorted solution set; Indicates distance in crowded areas The sorting function; , and These represent the data processing order of the s-th sample, the first distance solution, and the last distance solution, respectively; K represents the set attack scenario number. Let be the number of scenes for the s-th sample; This represents the (i+1)th solution to the lower bound. This represents the (i-1)th solution to the lower bound. This represents the (i+1)th solution to the upper bound. This represents the (i-1)th solution to the upper bound.

[0094] Then, the input and output data can be processed sequentially, as follows:

[0095] (34);

[0096] (35);

[0097] in, and Representing the first The collected output and input data corresponding to the j-th dimension of each attack scenario and the s-th sample; and represents the dimension value of the j-th dimension of the collected output and input data for the i-th attack scenario and the s-th sample, respectively; L, R, G, and D are the number of lines, the number of relay protections, the number of generator sets, and the number of loads, respectively. Let be the i-th solution for the s-th sample; S is the number of samples in the dataset.

[0098] Step 3: Network Training and Prediction Optimization. Based on the data from Step 2, a classification network is trained to learn the mapping relationship between the system's operating state and the corresponding worst-case attack response. Gradient descent is used to optimize the network parameters in this stage, and a Lagrangian function and a cyber-physical coupling penalty term are introduced to ensure the feasibility of the predicted solution. After training, the network can provide preliminary attack scenario predictions and can be used in the online application phase to quickly identify key extreme attack scenarios.

[0099] To improve computational efficiency, a deep learning classifier was constructed to identify the most unfavorable attack scenario. Based on the previous DAD model, the collected data was used to train the network. For multi-label classification tasks, one-hot encoding was used to represent the most unfavorable attack label. The binary cross-entropy loss function is typically used for classification feature learning. To improve the feasibility and accuracy of predictions, a Lagrangian objective function incorporating a network-physical coupling penalty term was constructed, and its calculation formula is as follows:

[0100] (36);

[0101] (37);

[0102] (38);

[0103] (39);

[0104] (40);

[0105] (41);

[0106] in, It is a conditional function that returns 1 if the condition is met, and 0 otherwise. Represent a canonical function; and These are the network loss function and the binary cross-entropy loss function, respectively. and These are penalty functions for information-physical coupling and mutual exclusion between vectors, respectively. and These are the penalty functions for the physical coupling of information about the attack vector and the mutual exclusion between vectors, respectively. and These are the penalty coefficients of the two penalty functions; and This represents the labels and corresponding output data in the network; , and These represent the label, input features, and output data for the s-th sample in the network, respectively. This represents the feedforward function used to train the classification network; , and Let K and K represent the kth prediction vectors for transmission line attack, relay protection attack, and overall attack scheme, respectively, where k = 1, 2, 3…K-1; This is a matrix showing the connection relationships between lines and protection systems. This represents the j-th prediction vector of the overall attack plan.

[0107] When training the network with each batch of data, the gradient descent method is used to update the network parameters. The specific method is as follows:

[0108] (42);

[0109] in, , and These are the optimized weight coefficients, gradient descent parameters, and gradient data, respectively.

[0110] A dynamic penalty coefficient is employed to leverage the constraints of the optimization problem and reduce the network's penalty. The penalty coefficient is updated for each training epoch using a gradient ascent method, as detailed below:

[0111] (43);

[0112] (44);

[0113] in, , , and The first The cyber-physical coupling penalty coefficient of the training iteration, the update coefficient of the cyber-physical coupling penalty, and the... The mutual exclusion constraint penalty coefficient and the mutual exclusion constraint update coefficient for each training iteration.

[0114] Step 4: Co-optimization of attack response and robustness optimization.

[0115] Based on the attack scenarios predicted in step 3, during the online application phase, the system refines and corrects the defense scheme through an iterative optimization strategy using C&CG. This model aims to minimize the system's expected loss, with constraints including attack constraints under various attack scenarios, total defense resource limits, and power flow limitations. Finally, through iterative C&CG solutions, an optimized defense resource configuration scheme is derived to enhance the system's defense and recovery capabilities in the face of complex attack patterns.

[0116] For a trained classification network, output data can be obtained. Although a penalty function can be introduced to indicate the constraint boundary, if the predicted solution falls into the infeasible region, it will increase the computational complexity of subsequent optimization. To ensure the feasibility and quality of the predicted solution, a solution correction method is constructed. This method is based on the 1-norm of the predicted solution and the corrected solution within the feasible region, and its values ​​are as follows:

[0117] (45);

[0118] (46);

[0119] in, This is a contingency plan for the worst-case attack scenario; , and These are the kth correction values ​​for transmission line attacks, relay protection attacks, and overall attack schemes, respectively. This is a real-time load time series used for classification and prediction; T is the transpose sign. This is the j-th correction value of the overall attack plan.

[0120] To accelerate the correction task, the solution obtained by the classification network... According to the penalty function Divided into two parts. If Then the kth correction value Save as a known solution; if Then the k-th correction value needs to be corrected, and a corresponding correction variable needs to be generated. Based on the known solution and the correction variable, the final correction method can be expressed as follows:

[0121] (47);

[0122] in, , Let represent the final corrected solution and the k-th corrected attack scenario, respectively. and It is the number of scenarios requiring correction and the number of known solutions; and Let J represent the j-th corrective attack scenario and the j-th known solution, respectively.

[0123] To address the optimization of security operation and defense strategies for power cyber-physical systems under cyberattacks, a multi-stage robust optimization model based on a defender-attacker-defender game structure has been constructed. The operational status of intelligent devices (such as relay protection devices) is collected and transmitted to the SCADA system via remote terminal equipment. Attackers can obtain the system topology and operating parameters, selectively launch short-circuit attacks, and tamper with protection communication signals, thereby causing damage to transmission lines. Attackers can also bypass the communication links of protection devices, causing relay protection to fail and lose its ability to isolate faults. To mitigate such attack risks, defenders need to protect lines and relay protection in advance and quickly implement load shedding and generator readjustment after an attack to prevent line overload from further spreading the fault. The defender-attacker-defender model considers the resource constraints of both attackers and defenders, and uses an improved column and constraint generation (C&CG) algorithm to solve the problem, thereby improving the model's computational efficiency and solution stability.

[0124] Through a multi-stage collaborative optimization strategy, this invention achieves TCPS resilience enhancement under cyber-physical collaborative attacks, ensuring that the system can respond and recover quickly in the face of dynamic attack environments, thereby enhancing the overall system stability and security.

[0125] 1) Example Introduction:

[0126] This invention employs simulation testing based on the IEEE 24-node system (e.g.) Figure 2Figure 3(a) and Figure 3(b) show the results of attack scenarios obtained by the C&CG algorithm, including extreme scenarios of physical attacks and relay protection intrusions. The network topology includes 17 load buses and 38 transmission lines, each equipped with a double-ended protection relay. The network attack patterns identified are compared with the load curves to train the classification network. Then, the corrected model and DAD optimization are solved using the CPLEX solver through the YALMIP toolbox on the MATLAB platform. In the deep learning-based method, the Adam optimizer is used for network training. The main parameters of the method are shown in Table 1 below.

[0127] Table 1 Main parameters of the algorithm

[0128] .

[0129] 2) Results Analysis:

[0130] To verify the effectiveness of the learning-assisted robust optimization method proposed in this invention, it is compared with the traditional multi-stage robust optimization method. The figures show the network training process results of the learning-assisted robust optimization, including changes in the penalty coefficient and accuracy in extreme scenarios. Figures 4(a) and 4(b) show a clear trend: as the number of training rounds increases, the constraint penalty coefficient of the prediction results gradually decreases, as shown in Figure 4(a). This reflects that the feasibility of the predicted solution improves over time, indicating that the model gradually adapts to the system constraints. As training progresses, the penalty coefficient tends to stabilize, indicating that the model gradually reduces its deviation from the system constraints. Figure 4(b) shows that the prediction accuracy gradually increases with the number of training rounds, indicating that the model gradually improves its ability to identify extreme scenarios. As training progresses, the accuracy eventually stabilizes, indicating that the model gradually reduces its deviation from actual extreme scenarios during continuous optimization.

[0131] Experimental optimizations were performed on a dataset containing 300 validation points, and the performance of the algorithm is illustrated using box plots, highlighting the statistical distribution of total computation time and number of iterations, as shown in Figures 5(a) and 5(b). Clearly, the method with the auxiliary classifier is faster in terms of computation time, as shown in Figure 5(a). Compared to traditional robust methods, the auxiliary optimization algorithm consistently converges faster. Furthermore, in Figure 5(b), the traditional C&CG method requires more iterations (approximately 7), while the method with the auxiliary classifier demonstrates fewer iterations. Overall, these results clearly demonstrate that the proposed deep learning classifier-assisted correction method significantly improves computational efficiency and convergence speed compared to traditional robust optimization algorithms.

Claims

1. A method for identifying attack scenarios in power transmission systems considering cyber-physical interactions, characterized in that, Includes the following steps: Step 1: Construct a defender-attacker-defender attack and defense model, determine the constraints, rationally allocate defense resources, and dynamically adjust defense strategies to maximize the power transmission system's ability to resist attacks. Step 2: Data Collection and Preprocessing: Input the topology of the power transmission system and the scale of cyber-physical collaborative attacks to generate multiple typical attack scenarios; collect historical load data, attack schemes and defense schemes, and label the worst attack scenarios through one-hot encoding for subsequent training; Step 3: Based on the preprocessed data in Step 2, train a classification network to learn the mapping relationship between the system's operating state and the corresponding worst-case attack response; use gradient descent to optimize the network parameters, and introduce a Lagrangian function and a cyber-physical coupling penalty term to ensure the feasibility of the predicted solution; After training is completed, preliminary attack scenario predictions are provided; Step 4: Based on the attack scenarios predicted in Step 3, in the online application stage, the optimization objective is to minimize the expected loss of the power transmission system. The constraints include attack constraints under various attack scenarios, total limit of defense resources, and power flow constraints. The optimized defense resource configuration scheme is obtained by iteratively solving the column and constraint generation method. Step 3 includes: Step 3.1: Construct a deep learning classifier to identify the worst-case attack scenario; for multi-label classification tasks, use one-hot encoding to represent the worst-case attack label; construct a Lagrangian objective function that introduces a network-physical coupling penalty term, the calculation formula of which is as follows: （36）； （37）； （38）； （39）； （40）； （41）； in, It is a conditional function that returns 1 if the condition is met, and 0 otherwise. Represent a canonical function; and These are the network loss function and the binary cross-entropy loss function, respectively. and These are penalty functions for information-physical coupling and mutual exclusion between vectors, respectively. and These are the penalty functions for the physical coupling of information about the attack vector and the mutual exclusion between vectors, respectively. and These are the penalty coefficients of the two penalty functions; and This represents the labels and corresponding output data in the network; , and These represent the label, input features, and output data for the s-th sample in the network, respectively. This represents the feedforward function used to train the classification network; , and Let K and K represent the kth prediction vectors for transmission line attack, relay protection attack, and overall attack scheme, respectively, where k = 1, 2, 3…K-1; This is a matrix showing the connection relationships between lines and protection systems. Let represent the j-th prediction vector of the overall attack scheme, and S be the number of samples in the dataset.

2. The method for identifying attack scenarios in power transmission systems considering cyber-physical interaction as described in claim 1, characterized in that, The defender-attacker-defender attack and defense model in step 1 includes: (1) Defender's constraints; Under conditions of limited defensive resources, the constraints are expressed as follows: （1）； （2）； in, This represents a vector consisting entirely of 1s; and These correspond to the resource quantities for line reinforcement and communication protection of relay protection, respectively. and These are binary variables, representing whether to apply protection to the corresponding protective relay communication and transmission line, respectively; (2) Attacker's constraints; The constraints relate to the attacker's disruptive strategies against transmission lines and relay protection communications, as detailed below: （3）； （4）； in, and These are the amounts of resources the attacker uses for line strength and relay protection defenses, respectively. and These are binary variables, representing whether an attack is launched on the corresponding protective relay communication and transmission line, respectively. The attack effects depict the interaction between attack plans and defense strategies, as shown below: （5）； （6）； （7）； （8）； （9）； （10）； In the formula, This is a binary variable indicating whether a short-circuit attack has occurred on the transmission line; and These are binary variables, representing whether the downlink relay protection and uplink relay protection of the transmission line have been subjected to network attacks, respectively. and These are binary variables, representing whether the downstream and upstream nodes of the transmission line are damaged under a coordinated network attack; This is a binary variable representing whether the node is in a running state; , and These represent the relationship matrices between the downlink protection relay and the transmission line, the uplink protection relay and the transmission line, and the busbar and the transmission line, respectively. Attackers should avoid being detected by defenders; once the transmission line is restored, it cannot be physically attacked; similarly, its relay protection network communication should remain intact, as shown below: （11）； （12）； （13）； （14）； in, This is a binary variable representing whether the transmission line status is normal, taking into account attacks and the line recovery process. The duration of the fault propagation process; This is a binary variable representing whether a short-circuit attack has occurred on the transmission line at time t; This is a binary variable, representing whether the transmission line is in normal condition at time t, taking into account the attack and line recovery process; (3) Fault propagation process; The fault propagation model describes the propagation path of a fault between transmission lines, power nodes, and protective relays. The model is as follows: （15）； in, This is a binary variable indicating whether the transmission line is in normal condition; Based on virtual goods flow, the fault propagation model is described as follows: （16）； （17）； （18）； in, , and These represent the fault source product, the fault status of the confluence node, and the product flow data of the line, respectively. , and These are binary variables, representing whether a node is a fault source node, whether commodity flow data propagates from downstream of the line, and whether commodity flow data propagates from upstream of the line, respectively. The number of buses in the power transmission network; The relationship between the fault propagation model of binary variables and the attack effect is described as follows: （19）； （20）； （21）； （22）； （23）； in, , and These represent the relationship matrices between the busbar and the relay protection device, the busbar and the lower relay protection device, and the busbar and the upper relay protection device, respectively. This is a matrix showing the relationship between transmission lines and relay protection devices; the superscript T is the transpose symbol. This is a binary variable representing whether the confluence node is in a damaged state under a coordinated network attack; (4) Restrictions on operating personnel; For operators, a rescheduling process is implemented to improve the system's responsiveness to sequential network attacks, as detailed below: （24）； （25）； （26）； （27）； （28）； （29）； In the formula, x represents the line power; x represents the impedance matrix. This represents the inverse of the line impedance diagonal matrix; D0 represents the predicted load power. and These are respectively downhill and uphill climbs; and These are the minimum and maximum values ​​of the line power, respectively. and These are the downlink capacity and the uplink capacity, respectively. and These are the dual variables of the equality constraint; , , , , , , and These are variables constrained by inequalities. , , and These are the relationship matrices between the bus and the generator, the bus and the load, the bus and the ramp-constrained generator, and the generator and the ramp-constrained generator, respectively. , , and These are the connection matrix of nodes and lines, voltage angle, line power, and load shedding, respectively. and These represent the node state of the nth node at time t and the line power at time t, respectively. The symbol "" indicates the dual of the relevant formula; For the transmission lines affected by the attack, the power flow and power constraint reconstruction are as follows: （30）。 3. The method for identifying attack scenarios in power transmission systems considering cyber-physical interaction according to claim 2, characterized in that, Step 2 specifically includes: Step 2.1: Under different load conditions, execute the column and constraint generation method process and obtain different iteration results; then design a data flow to control the number of solution sets under different load conditions; the congestion distance calculation formula with lower and upper bounds is as follows: （31）； （32）； （33）； In the formula, This represents the congestion distance of the solution for the i-th attack scenario; and These represent the maximum and minimum values ​​of the lower bound, respectively. and The upper bound represents the maximum and minimum values; N0 represents the number of solutions; H represents the sorted solution set; Indicates distance in crowded areas The sorting function; , and These represent the data processing order of the s-th sample, the first distance solution, and the last distance solution, respectively; K represents the set attack scenario number. Let be the number of scenes for the s-th sample; This represents the (i+1)th solution to the lower bound. This represents the (i-1)th solution to the lower bound. This represents the (i+1)th solution to the upper bound. This represents the (i-1)th solution to the upper bound value; Step 2.2: Input and output data are processed sequentially, as follows: （34）； （35）； in, and Representing the first The collected output and input data corresponding to the j-th dimension of each attack scenario and the s-th sample; and represents the dimension value of the j-th dimension of the collected output and input data for the i-th attack scenario and the s-th sample, respectively; L, R, G, and D are the number of lines, the number of relay protections, the number of generator sets, and the number of loads, respectively. Let be the i-th solution for the s-th sample; S is the number of samples in the dataset.

4. The method for identifying attack scenarios in power transmission systems considering cyber-physical interaction according to claim 3, characterized in that, Step 3 specifically also includes: Step 3.2: When training the network on each batch of data, the gradient descent method is used to update the network parameters. The specific method is as follows: （42）； in, , and These are the optimized weight coefficients, gradient descent parameters, and gradient data, respectively. Step 3.3: Employ dynamic penalty coefficients to reduce network penalties by utilizing the constraints of the optimization problem; update the penalty coefficients for each training epoch using the gradient ascent method, as follows: （43）； （44）； in, , , and The first The cyber-physical coupling penalty coefficient of the training iteration, the update coefficient of the cyber-physical coupling penalty, and the... The mutual exclusion constraint penalty coefficient and the mutual exclusion constraint update coefficient for each training iteration.

5. The method for identifying attack scenarios in power transmission systems considering cyber-physical interaction according to claim 4, characterized in that, Step 4 specifically includes: Step 4.1: Construct a solution correction method based on the 1-norm of the predicted solution and the corrected solution within the feasible region, with the following values: （45）； （46）； in, This is a contingency plan for the worst-case attack scenario; , and These are the kth correction values ​​for transmission line attacks, relay protection attacks, and overall attack schemes, respectively. This is a real-time load time series used for classification and prediction; T is the transpose sign. This is the j-th correction value of the overall attack plan; Step 4.2: Apply the solution obtained from the classification network According to the penalty function Divide into two parts; if Then the kth correction value of the overall attack plan Save as a known solution; if Then the k-th correction value of the overall attack scheme needs to be corrected, and the corresponding correction variable needs to be generated; based on the known solution and the correction variable, the final correction method is expressed as follows: （47）； in, , Let represent the final corrected solution and the k-th corrected attack scenario, respectively. and It is the number of scenarios requiring correction and the number of known solutions; and Let J represent the j-th corrective attack scenario and the j-th known solution, respectively.

Images