Dynamic load network attack detection method based on adaptive Kalman filtering

Abstract

The invention provides a dynamic load network attack detection method based on adaptive Kalman filtering. The method comprises the following steps: step 1, establishing a power network space network attack detection model; 2, designing an adaptive Kalman filter; and step 3, carrying out attack detection. According to the technical scheme, a forgetting factor is added on the basis of traditional Kalman filtering, and an efficient detection algorithm is designed for the concealment and complexity of D-LAA attacks.

Description

Technical Field

[0001] This invention relates to the field of smart grid security protection technology, and in particular to a dynamic load network attack detection method based on adaptive Kalman filtering. Background Technology

[0002] With the rapid development of smart grid technology, the networked and information-based characteristics of smart grids, while providing efficient and reliable power supply, also expose them to various cyberattack threats. In particular, Dynamic Load Change Attacks (D-LAA) targeting the power consumption side manipulate grid load through falsified data, thereby affecting grid stability and potentially leading to power system collapse.

[0003] Traditional static load change attacks (LAA) alter the load power in the power grid, causing overload or frequency deviations. However, these attacks are relatively simple and easy to detect. In contrast, dynamic load change attacks (D-LAA) continuously change the load trajectory during the attack, resulting in a more covert impact on the power system. Furthermore, they can successfully disrupt the stability of the power system even when historical data shows no significant changes, and are significantly more difficult to detect.

[0004] Currently, detection methods for D-LAA attacks are mainly based on traditional methods such as statistical analysis and signal processing. However, these methods often suffer from false positives, false negatives, and insufficient real-time performance when faced with complex and dynamic attack patterns. Therefore, how to effectively detect D-LAA attacks has become a key technical challenge in smart grid security protection. Summary of the Invention

[0005] In view of this, the purpose of this invention is to provide a dynamic load network attack detection method based on adaptive Kalman filtering. By adding a forgetting factor to the traditional Kalman filtering, an efficient detection algorithm is designed to address the concealment and complexity of D-LAA attacks.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a dynamic load network attack detection method based on adaptive Kalman filtering, comprising the following steps:

[0007] Step 1: Establish a network attack detection model for power grid space;

[0008] Step 2: Design an adaptive Kalman filter;

[0009] Step 3: Perform attack detection.

[0010] In a preferred embodiment, step 1 specifically comprises:

[0011] Assume there are n generators in the power system, represented by G = {G1,...,Gn}, and their nodes by N = {g1,...,gn}; load nodes are represented by H = {b1,...,bm}; after calculation, the following equations are obtained:

[0012]

[0013] Where P i G -P represents the power injected by the generator at node i. i L δ represents the power consumption of the load at node i. i Let θ be the voltage phase angle of the generator node. i b is the voltage phase angle at the non-generator node. ij Let be the admittance between the transmission lines at nodes i and j;

[0014] According to the equation, at node i∈N:

[0015] δ. i =w i (3)

[0016]

[0017] w i It is frequency deviation, m i It is the rotor inertia, d i It is the damping coefficient. It is mechanical power input.

[0018] In a preferred embodiment, the two controllers are jointly modeled in the form of a proportional-integral (PI) controller:

[0019]

[0020] in and These are the integral and proportional controller coefficients, respectively. Substituting them, we get:

[0021]

[0022] Eliminating voltage phase angle variables, the state-space model of the power system can be described as follows:

[0023]

[0024] Where δ(t)∈Rn is the phase angle δ i The set vector, ω(t)∈Rn is w i The set of vectors, K P and K IThese are the proportional and integral controller coefficients, respectively; I is an identity matrix of appropriate relative dimension, and M and D are diagonal matrices representing the generator inertia and damping coefficients. It is a Laplace matrix.

[0025] In a preferred embodiment, if the attacked load is at node i ∈ H, then the compromise power level at node i is modeled as follows:

[0026]

[0027] in It is the proportional gain of the attack controller, W s It is the deviation between the system frequency at sensor bus s and the nominal value, f oi This is a power consumption value added at the attacked node i. Its function is to generate a slight deviation value before the attack. Therefore, the D-LAA attack signal is represented as:

[0028]

[0029] Due to the complexity of power systems, FOI (Focus of Influence) is not necessarily added in practice; the attacked power system model is written as:

[0030]

[0031] y(t)=Hx(t)+v(t) (12)

[0032] where x(t)∈R 2n Represents the state vector of the power system, y(t)∈R m f represents the measured output vector. L (t) represents the D-LAA attack suffered by the power system;

[0033] matrix It is a known constant matrix with appropriate dimensions; w(t) and v(t) are the system noise and measurement noise, respectively, which follow a Gaussian distribution, and the statistical properties of w(t) and v(t) are known.

[0034] In a preferred embodiment, the linear discrete model of the smart grid is:

[0035] x(k)=Ax(k-1)+BP L (k-1)+Bf L (k-1)+w(k-1),k=1,2,3....(13)

[0036] The measurement output is: y(k)=Hx(k)+v(k) (14).

[0037] In a preferred embodiment, the filter design in step 2 is as follows:

[0038]

[0039] Where K(k) is the KF gain, It is the prior estimate of the state. The calculation process for K(k) is as follows:

[0040]

[0041] K(k)=P(k|k-1)H T (HP(k|k-1)H T +R) -1 (17)

[0042] P(k|k-1)=AP(k-1)A T +Q (18)

[0043] P(k|k-1) is the predicted value of the state error covariance, and P(k) is the calculated value of the state error covariance. The calculation process is: P(k)=(IK(k)H)P(k|k-1) (19)

[0044] Define the new information sequence:

[0045] For any gain K(k), the innovation covariance is:

[0046] μ0(k)=E[ε(k)ε T [(k)]=HP(k|k-1)H T +R (21)

[0047] The information autocovariance is: μ j (k)=E[ε(k+j)ε T [(k)],j=1,2,3......(22)

[0048] When using the optimal gain, the innovation sequence is uncorrelated, and in this case, μ j (k) = 0.

[0049] In a preferred embodiment, by adding a forgetting factor, the following formula can be obtained:

[0050] P(k|k-1)=η(k)AP(k-1)A T +Q (23)

[0051] η(k)≥1 is the forgetting factor, and the performance of the filter depends entirely on the choice of η(k). When η(k)=1, the AFKF filter is converted to a standard KF filter. If K(k) is the optimal gain, then:

[0052] P(k|k-1)HT-K(k)μ0(k)=0 (24)

[0053] The value of μ0(k) here is calculated from the measurement data; the value of η(k) is obtained by the following calculation method:

[0054]

[0055] Where F(k)=μ0(k)-HQH T -R (26)

[0056] J(k)=HAP(k-1)A T H T (27)

[0057] μ0(k)=E[ε(k)ε T (k)] (28)

[0058] Given the filter convergence criterion: ε(k)ε(k) T ≤HP(k|k-1)H T +R (29)

[0059] AFKF summarizes as follows:

[0060] Step 1: Prediction

[0061] Step 2: Calibration

[0062] In a preferred embodiment, in step 3, when applying AFKF to filter out Gaussian noise and estimate the system state, there are two special state variables, namely the estimated state vector value. and state vector prediction value Here, the state prediction vector is obtained from the state estimate at the previous time step; assuming the system is operating normally before time k, the difference between the two at time k is defined as ε(k):

[0063]

[0064] The difference between the state estimation vector and the state prediction vector at k-1 is defined as:

[0065]

[0066] Let the Euclidean distance of e(k) at k be defined as

[0067]

[0068] Distance of e(k-1):

[0069] The distance ratio at point k is defined as:

[0070]

[0071] When the power system is not under attack Therefore, e(k)≈e(k-1); the deviation between e(k) and e(k-1) is within a small range;

[0072] Assuming the power system is subjected to a D-LAA attack at time k, then:

[0073]

[0074] Where f L (k) is the D-LAA vector, x L (k) is the state vector at the moment of attack, K - It is the gain convergence value

[0075] When a power system is attacked, the difference between the state estimate and the predicted value increases; at this time, the distance of e(k) at k is shown below:

[0076]

[0077] The Euclidean distance ratio at point k becomes:

[0078]

[0079] At this time, r L The value of (k) will be significantly greater than the threshold rth. When the Euclidean distance ratio r(k) is greater than the threshold rth, the power system is considered to be under attack and the alarm device is activated.

[0080]

[0081] Based on experience, a reasonable threshold is selected. When the power system is attacked by D-LAA, the Euclidean distance ratio r(k) will suddenly increase and exceed the threshold rth, thus detecting D-LAA.

[0082] Compared with the prior art, the present invention has the following beneficial effects: The present invention relates to a smart grid security protection technology, in particular to a detection method for dynamic load change attack (D-LAA) of power systems, which adopts an adaptive Kalman filter (AFKF) algorithm to improve the detection capability and accuracy of network attacks, and ensure the safe and stable operation of the power system. Attached Figure Description

[0083] Figure 1This is a preferred embodiment of the D-LAA attack model and classification diagram of the present invention;

[0084] Figure 2 This is a flowchart of the adaptive Kalman filter algorithm according to a preferred embodiment of the present invention;

[0085] Figure 3 This is a flowchart illustrating the attack detection logic of a preferred embodiment of the present invention. Detailed Implementation

[0086] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0087] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0088] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0089] A dynamic load network attack detection method based on adaptive Kalman filtering, reference Figure 1-3 This includes the following steps:

[0090] Step 1: Establish a network attack detection model for power grid space;

[0091] Step 2: Design an adaptive Kalman filter;

[0092] Step 3: Perform attack detection.

[0093] Step 1 specifically involves:

[0094] Assume there are n generators in the power system, represented by G = {G1,...,Gn}, and their nodes by N = {g1,...,gn}; load nodes are represented by H = {b1,...,bm}; after calculation, the following equations are obtained:

[0095]

[0096] Where P i G -P represents the power injected by the generator at node i. i L δ represents the power consumption of the load at node i.i Let θ be the voltage phase angle of the generator node. i b is the voltage phase angle at the non-generator node. ij Let be the admittance between the transmission lines at nodes i and j;

[0097] According to the equation, at node i∈N:

[0098] δ. i =w i (3)

[0099]

[0100] w i It is frequency deviation, m i It is the rotor inertia, d i It is the damping coefficient. It is mechanical power input.

[0101] The two controllers are jointly modeled in the form of a proportional-integral PI controller as follows:

[0102]

[0103] in and These are the integral and proportional controller coefficients, respectively. Substituting them, we get:

[0104]

[0105] Eliminating voltage phase angle variables, the state-space model of the power system can be described as follows:

[0106]

[0107] Where δ(t)∈Rn is the phase angle δ i The set vector, ω(t)∈Rn is w i The set of vectors, K P and K I These are the proportional and integral controller coefficients, respectively; I is an identity matrix of appropriate relative dimension, and M and D are diagonal matrices representing the generator inertia and damping coefficients. It is a Laplace matrix.

[0108] If the attacked load is at node i ∈ H, then the trade-off power level at node i is modeled as follows:

[0109]

[0110] in It is the proportional gain of the attack controller, W s It is the deviation between the system frequency at sensor bus s and the nominal value, f oiThis is a power consumption value added at the attacked node i. Its function is to generate a slight deviation value before the attack. Therefore, the D-LAA attack signal is represented as:

[0111]

[0112] Due to the complexity of power systems, f oi In practice, this can be omitted; the attacked power system model is written as:

[0113]

[0114] y(t)=Hx(t)+v(t) (12)

[0115] where x(t)∈R 2n Represents the state vector of the power system, y(t)∈R m f represents the measured output vector. L (t) represents the D-LAA attack suffered by the power system;

[0116] matrix It is a known constant matrix with appropriate dimensions; w(t) and v(t) are the system noise and measurement noise, respectively, which follow a Gaussian distribution, and the statistical properties of w(t) and v(t) are known.

[0117] The linear discrete model of the smart grid is as follows:

[0118] x(k)=Ax(k-1)+BP L (k-1)+Bf L (k-1)+w(k-1),k=1,2,3....(13)

[0119] The measurement output is: y(k)=Hx(k)+v(k) (14).

[0120] The filter design in step 2 is as follows:

[0121]

[0122] Where K(k) is the KF gain, It is the prior estimate of the state. The calculation process for K(k) is as follows:

[0123]

[0124] K(k)=P(k|k-1)H T (HP(k|k-1)H T +R)- 1 (17)

[0125] P(k|k-1)=AP(k-1)A T +Q (18)

[0126] P(k|k-1) is the predicted value of the state error covariance, and P(k) is the calculated value of the state error covariance. The calculation process is: P(k)=(IK(k)H)P(k|k-1) (19)

[0127] Define the new information sequence:

[0128] For any gain K(k), the innovation covariance is: μ0(k)=E[ε(k)ε T [(k)]=HP(k|k-1)H T +R (21)

[0129] The information autocovariance is: μ j (k)=E[ε(k+j)ε T [(k)],j=1,2,3......(22)

[0130] When using the optimal gain, the innovation sequence is uncorrelated, and in this case, μ j (k) = 0.

[0131] Adding a forgetting factor, we get the following formula:

[0132] P(k|k-1)=η(k)AP(k-1)A T +Q (23)

[0133] η(k)≥1 is the forgetting factor, and the performance of the filter depends entirely on the choice of η(k). When η(k)=1, the AFKF filter is converted to a standard KF filter. If K(k) is the optimal gain, then:

[0134] P(k|k-1)HT-K(k)μ0(k)=0 (24)

[0135] The value of μ0(k) here is calculated from the measurement data; the value of η(k) is obtained by the following calculation method:

[0136]

[0137] Where F(k)=μ0(k)-HQH T -R (26)

[0138] J(k)=HAP(k-1)A T H T (27)

[0139] μ0(k)=E[ε(k)ε T (k)] (28)

[0140] Given the filter convergence criterion: ε(k)ε(k) T ≤HP(k|k-1)H T +R (29)

[0141] AFKF summarizes as follows:

[0142] Step 1: Prediction

[0143] Step 2: Calibration

[0144] In step 3, when applying AFKF to filter Gaussian noise and estimate the system state, there are two special state variables: the estimated state vector value. and state vector prediction value Here, the state prediction vector is obtained from the state estimate at the previous time step; assuming the system is operating normally before time k, the difference between the two at time k is defined as ε(k):

[0145]

[0146] The difference between the state estimation vector and the state prediction vector at k-1 is defined as:

[0147]

[0148] Let the Euclidean distance of e(k) at k be defined as

[0149]

[0150] Distance of e(k-1):

[0151] The distance ratio at point k is defined as:

[0152]

[0153] When the power system is not under attack Therefore, e(k)≈e(k-1); the deviation between e(k) and e(k-1) is within a small range;

[0154] Assuming the power system is subjected to a D-LAA attack at time k, then:

[0155]

[0156] Where f L (k) is the D-LAA vector, x L (k) is the state vector at the moment of attack, K -It is the gain convergence value

[0157] When a power system is attacked, the difference between the state estimate and the predicted value increases; at this time, the distance of e(k) at k is shown below:

[0158]

[0159] The Euclidean distance ratio at point k becomes:

[0160]

[0161] At this time, r L The value of (k) will be significantly greater than the threshold rth. When the Euclidean distance ratio r(k) is greater than the threshold rth, the power system is considered to be under attack and the alarm device is activated.

[0162]

[0163] Based on experience, a reasonable threshold is selected. When the power system is attacked by D-LAA, the Euclidean distance ratio r(k) will suddenly increase and exceed the threshold rth, thus detecting D-LAA.

Claims

1. A dynamic load network attack detection method based on adaptive Kalman filtering, characterized in that, Includes the following steps: Step 1: Establish a network attack detection model for power grid space; Step 2: Design an adaptive Kalman filter; Step 3: Perform attack detection.

2. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 1, characterized in that, Step 1 specifically involves: Assume there are n generators in the power system, represented by G = {G1,...,Gn}, and their nodes by N = {g1,...,gn}; load nodes are represented by H = {b1,...,bm}; after calculation, the following equations are obtained: Where P i G -P represents the power injected by the generator at node i. i L δ represents the power consumption of the load at node i. i Let θ be the voltage phase angle of the generator node. i b is the voltage phase angle at the non-generator node. ij Let be the admittance between the transmission lines at nodes i and j; According to the equation, at node i∈N: d ·i =w i (3) w i It is frequency deviation, m i It is the rotor inertia, d i It is the damping coefficient. It is mechanical power input.

3. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 2, characterized in that, The two controllers are jointly modeled in the form of a proportional-integral (PI) controller as follows: in and These are the integral and proportional controller coefficients, respectively. Substituting them, we get: Eliminating voltage phase angle variables, the state-space model of the power system can be described as follows: Where δ(t)∈Rn is the phase angle δ i The set vector, ω(t)∈Rn is w i The set of vectors, K P and K I These are the proportional and integral controller coefficients, respectively; I is an identity matrix of appropriate relative dimension, and M and D are diagonal matrices representing the generator inertia and damping coefficients. It is a Laplace matrix.

4. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 3, characterized in that, If the attacked load is at node i ∈ H, then the trade-off power level at node i is modeled as follows: in It is the proportional gain of the attack controller, W s It is the deviation between the system frequency at sensor bus s and the nominal value, f oi This is a power consumption value added at the attacked node i. Its function is to generate a slight deviation value before the attack. Therefore, the D-LAA attack signal is represented as: Due to the complexity of power systems, f oi In practice, this can be omitted; the attacked power system model is written as: y(t)=Hx(t)+v(t) (12) where x(t)∈R 2n Represents the state vector of the power system, y(t)∈R m f represents the measured output vector. L (t) represents the D-LAA attack suffered by the power system; matrix It is a known constant matrix with appropriate dimensions; w(t) and v(t) are the system noise and measurement noise, respectively, which follow a Gaussian distribution, and the statistical properties of w(t) and v(t) are known.

5. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 3, characterized in that, The linear discrete model of the smart grid is as follows: x(k)=Ax(k-1)+BP L (k-1)+Bf L (k-1)+w(k-1),k=1,2,3....... (13) The measurement output is: y(k)=Hx(k)+v(k) (14).

6. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 1, characterized in that, The filter design in step 2 is as follows: Where K(k) is the KF gain, It is the prior estimate of the state. The calculation process for K(k) is as follows: K(k)=P(k|k-1)H T (HP(k|k-1)H T +R) -1 (17) P(k|k-1)=AP(k-1)A T +Q (18) P(k|k-1) is the predicted value of the state error covariance, and P(k) is the calculated value of the state error covariance. The calculation process is: P(k)=(IK(k)H)P(k|k-1) (19) Define the new information sequence: For any gain K(k), the innovation covariance is: μ0(k)=E[ε(k)ε T (k)]=HP(k|k-1)H T +R (21) The information autocovariance is: μ j (k)=E[ε(k+j)ε T [(k)],j=1,2,3...... (22) When using the optimal gain, the innovation sequence is uncorrelated, and in this case, μ j (k)=0.

7. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 6, characterized in that, Adding a forgetting factor, we get the following formula: P(k|k-1)=η(k)AP(k-1)A T +Q (23) η(k)≥1 is the forgetting factor, and the performance of the filter depends entirely on the choice of η(k). When η(k)=1, the AFKF filter is converted to a standard KF filter. If K(k) is the optimal gain, then: P(k|k-1)HT-K(k)μ0(k)=0 (24) The value of μ0(k) here is calculated from the measurement data; The value of η(k) is obtained by the following calculation method: Where F(k)=μ0(k)-HQH T -R (26) J(k)=HAP(k-1)A T H T (27) μ0(k)=E[ε(k)ε T (k)] (28) Given the filter convergence criterion: ε(k)ε(k) T ≤HP(k|k-1)H T +R (29) AFKF summarizes as follows: Step 1: Prediction Step 2: Calibration 8. The dynamic load network attack detection method based on adaptive Kalman filtering according to claim 1, characterized in that, In step 3, when applying AFKF to filter Gaussian noise and estimate the system state, there are two special state variables: the estimated state vector value. and state vector prediction value Here, the state prediction vector is obtained from the state estimate at the previous time step; assuming the system is operating normally before time k, the difference between the two at time k is defined as ε(k): The difference between the state estimation vector and the state prediction vector at k-1 is defined as: Let the Euclidean distance of e(k) at k be defined as Distance of e(k-1): The distance ratio at point k is defined as: When the power system is not under attack Therefore, e(k)≈e(k-1); the deviation between e(k) and e(k-1) is within a small range; Assuming the power system is subjected to a D-LAA attack at time k, then: Where f L (k) is the D-LAA vector, x L (k) is the state vector at the moment of attack, K - It is the gain convergence value When a power system is attacked, the difference between the state estimate and the predicted value increases; at this time, the distance of e(k) at k is shown below: The Euclidean distance ratio at point k becomes: At this time, r L The value of (k) will be significantly greater than the threshold r. th When the Euclidean distance ratio r(k) is greater than the threshold r th If this occurs, the power system is considered to be under attack, and the alarm device is activated. Based on experience, a reasonably selected threshold will be found that when a power system is subjected to a D-LAA attack, the Euclidean distance ratio r(k) will suddenly increase and exceed the threshold r. th This allows for the detection of D-LAA.

Images