Power CPS network attack intelligent positioning method and system based on multi-target evolution CNN

Abstract

The invention discloses a power CPS network attack intelligent positioning method and system based on a multi-target evolution CNN. The CNN is used as a multi-label classification model for power CPS network attack positioning; designing a variable-length hybrid coding strategy by taking architecture parameters such as a convolution layer number, a filter number, a convolution kernel size, a pooling kernel size, a full-connection layer number, a full-connection layer neuron number and a discarding rate in the CNN and hyper-parameters such as a learning rate, a batch size and an optimizer as decision variables; the method comprises the following steps of: taking the minimization of the number of model parameters of the CNN and (1-macro average F1 score) as an optimization objective function, designing a Pareto leading edge selection mechanism based on non-dominated sorting, and a block single-point crossing strategy and mutation operation oriented to hybrid coding individuals, and carrying out offline multi-objective optimization iteration to obtain a compromise optimization CNN giving consideration to attack positioning precision and model lightweight. And on-line deployment is carried out, and accurate detection of the intelligent positioning system for the power CPS network attack is efficiently realized.

Description

Technical Field

[0001] This invention relates to the field of intelligent location and detection technology for network attacks in the field of information security of power CPS (Cyber-Physical Systems), and particularly to an intelligent location method and system for power CPS network attacks based on multi-target evolutionary CNN (Convolutional Neural Network). Background Technology

[0002] With the deep integration of advanced control technology, sensing and measurement technology, information technology, and artificial intelligence, power systems have evolved into highly complex cyber-physical systems (CPS). Power CPS achieves intelligent monitoring, protection, and real-time control of power through highly integrated cyber-physical interactions. However, the deep embedding of the information layer also introduces new security vulnerabilities. Against this backdrop, typical security threats in power CPS include Denial of Service attacks, Time Synchronization attacks (TSA), Fake Data Injection Attacks (FDIA), Coordinated Data Falsification Attacks (including additive attacks, deductive attacks, and hybrid attacks combining additive and deductive attacks), and Electricity Theft.

[0003] In recent years, many researchers have focused on intrusion detection in the power CPS field, particularly research on intrusion detection methods based on deep learning (DL) methods. Even when faced with massive amounts of data generated by large-scale systems, DL methods can guarantee good data understanding and feature extraction capabilities. Although existing network attack localization and detection models have achieved some success, their attack localization performance largely depends on researchers' prior knowledge and tedious manual parameter tuning. This process is not only time-consuming and laborious but also lacks adaptability and transferability in complex application scenarios. More importantly, when faced with the high-dimensional and complex data generated by power CPS, manual parameter tuning struggles to effectively explore the vast hyperparameter space, easily getting trapped in local optima, thus limiting the model's final performance and robustness. Therefore, the existing manually designed DL technology, which heavily relies on expert experience and lacks automated design, has greatly hindered the rapid deployment and widespread application of this technology in power CPS attack localization practice.

[0004] Further analysis reveals that existing technologies rarely employ automated deep learning models to develop power CPS network attack localization techniques. The design of automated deep learning models for power CPS attack localization scenarios essentially involves trade-offs between multiple conflicting optimization objectives, such as maximizing localization accuracy and minimizing model complexity. If developers adopt traditional single-objective optimization paradigms, it is difficult to effectively balance these performance trade-offs, often leading to a dilemma in actual deployment where the localization model is either "highly accurate but computationally complex" or "simple in structure but inaccurate in localization." This single-objective optimization approach limits the model's ability to improve localization performance and enable online deployment in resource-constrained power CPS environments, especially in terminal device environments. Therefore, to automatically and efficiently generate a deep learning model that balances lightweight model design with high-precision power CPS network attack localization performance, the development of an intelligent power CPS network attack localization technology based on a multi-objective evolutionary deep learning model is urgently needed. Summary of the Invention

[0005] The purpose of this invention is to address the shortcomings of existing technologies by providing a method and system for intelligent localization of attacks on power CPS networks based on multi-target evolution CNN.

[0006] The objective of this invention is achieved through the following technical solution: The first aspect of this invention provides a method for intelligent localization of attacks on power grid CPS networks based on multi-target evolutionary CNN, comprising the following steps: S1: Standardize and preprocess historical data collected by the monitoring and data acquisition subsystem in the power CPS to construct a training dataset. X train With the test dataset X test ; S2: Set the first parameter, and according to the preset first parameter, use hybrid encoding to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks, and randomly initialize the population. P gen ={ p i}, i =1,2, …, NP ,in p i Indicates the first i Individual, NP Indicates population size; S3: Set the second parameter to construct the optimization objective function of the multi-objective evolutionary CNN model; S4: Assess the population P genThe number of CNN model parameters and macro-average F1 score for all individuals were used to perform non-dominated sorting and crowding distance calculation based on the evaluation results. A Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-encoded individuals, and mutation operations were employed to generate the offspring population. Q gen And record the number of iterations. gen ; S5: For the population P gen and Q gen The process involves merging individuals, performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 ; S6: Determine the current iteration number gen Has the maximum number of iterations been reached? Gen If yes, then save the entire contents of the last generation of non-dominated solutions and use it as the Pareto optimal solution set; otherwise, set the current iteration number. gen = gen +1, and return to step S4 to continue the search; S7: Select the Pareto optimal solution that minimizes (1-macro average F1 score) while taking into account the number of model parameters and the performance of multi-label classification model from the Pareto optimal solution set, and use the CNN model represented by it as the optimal model for intelligent localization and detection of power CPS network attacks. S8: Deploy the optimal CNN model online in the intelligent location and detection system for power CPS network attacks, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

[0007] Further, step S1 specifically includes: Historical data collected by the monitoring and data acquisition subsystem in the power CPS are divided into training datasets according to a set ratio. X train With the test dataset X test After completing the data partitioning, proceed according to the training dataset. X train Data distribution for training dataset X train With the test dataset X test Z-Score standardization is performed; the calculation process of Z-Score standardization is shown in formula (1): (1) In the formula, Indicates the number after standardization.α The first data sample β The value of each feature, Indicates the first before standardization. α The first data sample β The value of each feature, μ Indicates the first β The mean of each feature, σ Indicates the first β The standard deviation of each feature.

[0008] Furthermore, the first parameter includes: a lower bound on the number of convolutional layers in the CNN model to be optimized. NC min and upper limit NC max The set of possible values ​​for the number of filters NF set The set of possible values ​​for the convolution kernel size K set The set of possible values ​​for the pooling kernel size P set The lower limit of the number of fully connected layers NH min and upper limit NH max The lower limit of the number of neurons in a fully connected layer H min and upper limit H max The set of possible values ​​for the discard rate D set and the set of possible values ​​for the hyperparameter learning rate. L set The set of possible values ​​for batch size B set The set of optimizer types O set .

[0009] Furthermore, the population P gen Specifically, it is generated using the following method: randomly generated containing... NP Population of individuals P gen ,Right now P gen = { p 1, p 2, …, p NP}, 0≤ gen ≤ Gen ,in gen This represents the current iteration number; the specific expression for each individual in the population is... p i ={ pi,1 , p i,2 , …, p i,j , …, p i,D}, where 1≤ i ≤ NP ,1≤ j ≤ D , p i,j Indicates the first i The first individual j 3D encoding, D The dimension representing the individual's encoding; the individual in the population p i The specific encoding is for each individual in the population p i The specific code is p i ={ NC , P , NF 1, K 1, …, NF NC , K NC , NH , H 1, D 1, ..., H NH , D NH , L , B , O},in NC This indicates the number of convolutional layers in a CNN model. P This indicates the pooling kernel size of the CNN model. NF 1 indicates the number of filters in the first convolutional layer of the CNN model. K 1 represents the kernel size of the first convolutional layer in the CNN model. NF NC In the CNN model, the first... NC The number of filters in each convolutional layer K NC In the CNN model, the first... NC The kernel size of each convolutional layer NH This indicates the number of fully connected layers in a CNN model. H 1 indicates the number of neurons in the first fully connected layer of the CNN model. D 1 represents the dropout rate of the first fully connected layer in the CNN model. H NH In the CNN model, the first...NH The number of neurons in a fully connected layer D NH In the CNN model, the first... NH Dropout rate of each fully connected layer L This represents the learning rate during CNN model training. B This indicates the batch size of the CNN model. O This represents the optimizer used for training the CNN model. In the above individual coding, the specific generation method of the coding for each variable is as follows: NC =Randint( NC min , NC max ), where Randint represents the random integer selection function, NC min and NC max They represent NC The lower and upper limits; for the first to the second NC One convolutional layer, NF 1, … , NF NC All meet Randchoice( NF set ), K 1, … , K NC All satisfy Randchoice( K set Randchoice is a function for randomly selecting discrete values. NF set The set of values ​​representing the number of filters. K set The set of possible values ​​for the convolution kernel size; P =Randchoice( P set ), P set The set of possible values ​​for the pooling kernel size; NH =Randint( NH min , NH max ), NH min and NH max They represent NH The lower and upper limits; for the first to the second NH A fully connected layer, H 1, … ,H NH All satisfy Randint( H min , H max ), H min and H max They represent H The lower and upper limits, D 1, … , D NH All satisfy Randchoice( D set ), D set The set of possible values ​​representing the dropout rate of the fully connected layer; L =Randchoice( L set ), L set This represents the set of possible learning rate values ​​for the CNN model. B =Randchoice( B set ), B set The set of possible values ​​representing the batch size of a CNN model; O = Randchoice( O set ), O set This represents the set of values ​​for the CNN model training optimizer type.

[0010] Furthermore, the second parameter includes population size. NP Maximum number of iterations Gen Crossover probability Cr Probability of mutation F Among them, the first p i The optimization objective function of the CNN model corresponding to each individual is shown in Equation (2): (2) In the formula, the optimization objective is... obj 1( p i ) is the first p i Each individual parameter corresponds to the number of parameters in the CNN model, where Para-mun represents the number of parameters in the CNN model, and the optimization objective is... obj 2( p i ) is the first p iEach individual corresponds to a performance metric of the CNN model. This represents the average F1 score for macros.

[0011] Furthermore, the macro-average F1 score is obtained through the following method: For power CPS systems N The measurement points, of which the first... k Each measurement point is represented as m k , k =1, 2, …, N Each measurement point m k Whether or not an attack has been suffered is used as a separate binary label to construct a classification system with... N This study targets a multi-label classification task within a single-label power CPS attack. The input to the CNN model is standardized multivariate power CPS measurement data, including meter readings from distributed generators, SCADA subsystem measurement data, and meteorological parameters. This multivariate measurement data is constructed as a one-dimensional vector. After the multivariate power CPS measurement data is input into the CNN model, feature learning and classification are performed using an automatically determined optimal CNN architecture based on a multi-objective evolutionary algorithm. The number of convolutional layers in this CNN architecture is [not specified in the original text]. NC Number of filters in each layer NF 1, … , NF NC kernel size K 1, … , K NC Pooling core size P Number of fully connected layers NH Number of neurons in each layer H 1, … , H NH Drop rate D 1, … , D NH and training hyperparameters L , B , O All features are obtained through the specific encoding methods of each variable in step S2; the hierarchical features extracted after optimization are flattened and fed into a fully connected layer for advanced feature fusion and nonlinear abstraction to learn composite evidence for attack judgment; finally, multi-label classification is performed by the output fully connected layer, and the number of neurons in this layer is related to the number of system monitoring points. N Strict correspondence; each output neuron operates independently using the sigmoid activation function, calculating and outputting a probability value between 0 and 1 based on all integrated evidence, representing the confidence level that the corresponding monitoring point has been attacked; by comparing each output value with a preset discrimination threshold... By comparison, the CNN model ultimately generates a N A binary location vector is used to mark each specific monitoring point in the system that is identified as being under attack, enabling end-to-end intelligent judgment from raw data to precise location; during the offline optimization of the CNN model, the training dataset is used. X train The CNN model is trained, and the performance of the multi-label classification model is evaluated using the macro-average F1 score. The specific calculation formula is shown in formula (3): (3) In the formula, M Indicates the label dimension. TP k Indicates the first k Measurement points m k The number of samples that were actually under attack but were correctly detected as attacks. TN k Indicates the first k Measurement points m k The actual number of samples that are in a normal state and were correctly detected as normal. FP k Indicates the first k Measurement points m k The number of samples that were actually in a normal state but were falsely reported as attacks. FN k Indicates the first k Measurement points m k The number of samples that were actually under attack but were missed and were detected as normal.

[0012] Furthermore, step S4 specifically includes the following sub-steps: S41: Evaluate the population based on the optimization objective function of the multi-objective evolutionary CNN model. P gen Each individual p i The two optimization objective function values obj 1( p i )and obj 2( p i ); S42: Based on the evaluation results obtained in step S41, assess the population... P gen All individuals are subjected to a fast non-dominated ranking to divide them into multiple non-dominated frontier levels, specifically including: S42.1: Initialize the number of times each individual is dominated by other individuals.ind_num p and the set of other individuals dominated by that individual. Slu p ; S42.2: Traverse each pair of individuals in the population and determine their dominance relationship: If individuals p i Dominant Individual p j Then increase p j Domination count ind_num p and will p j join in p i Dominant set Slu p If an individual p j Dominant Individual p i Then increase p i The dominance count, and p i join in p j The set of dominance; S42.3: Domination count ind_num p Individuals with a value of 0 are placed in the first layer of the non-dominated frontier. PF 1; S42.4: For the current... k Non-dominated frontier PF k For each individual in the set, iterate through its dominion set. Slu p Each individual in the process, and these individuals' ind_num p Decrease by 1; if a certain individual ind_num p If the value is reduced to 0, it is placed in the next level of non-dominated frontier. PF k+1 ; S42.5: Repeat step S42.4 until all individuals have been assigned to the corresponding non-dominated fronts, and label these non-dominated fronts as { PF k}, k =1, 2, …, k max ,in k max This represents the maximum number of non-dominated frontier layers; S43: After completing the non-dominated sorting, calculate the crowding distance for each individual in the population, specifically including: S43.1: Take the first k Non-dominated frontier F k All individuals, according to the first o Sort the optimization objective function values ​​from smallest to largest. k =1, 2, …, k max , o =1, 2; S43.2: The first o The maximum value among the optimization objective function values ​​is taken as , will the o The minimum value among the values ​​of the optimization objective function is taken as ; S43.3: Sort the values ​​of the objects with the minimum objective function values ​​respectively. and the maximum optimization objective function value The crowding distance between individuals is set to infinity; S43.4: For intermediate individuals that are neither the smallest nor the largest in the ranking, calculate the normalized crowding distance between them and their neighboring individuals. The normalized calculation formula for min-max is shown in Equation (4), and the crowding distance calculation formula is shown in Equation (5). (4) (5) In the formula, Indicates the first i The individual in the first o The normalized fitness value on the optimization objective. Indicates the first i The individual in the first o Fitness values ​​on each optimization objective dt i Indicates the first i The crowding distance of each individual t This represents the total number of optimization objectives. Indicates the first i +1 individual in the first o Fitness values ​​on each optimization objective Indicates the first i -1 individual o Fitness values ​​on each optimization objective; S43.5: Traverse all optimization objectives, sum the crowding distances of each individual across all objective functions, and obtain the total crowding distance for that individual; S44. Employing a Pareto front selection mechanism based on non-dominated sorting from the population.P gen Select the parent individual, specifically including: S44.1: According to the hierarchical order of the non-dominated frontiers, starting from the first level of non-dominated frontiers... PF 1. Start according to PF 1, PF 2, ..., individuals from the non-dominated frontier are added to the parent set in sequence until the size of the parent set is exactly reached. NP ; S44.2: If the last non-dominated frontier is selected in step S44.1 Then, sort the individuals in descending order of their total crowding distance, and select a sufficient number of individuals until the parent set size is exactly reached. NP That's all; S45: Randomly select two parent individuals from the parent set. parent 1 and parent 2. Implement a block-based single-point crossover strategy for hybrid encoded individuals to generate two offspring individuals. child 1 and child 2; The specific implementation steps of the block-based single-point intersection strategy are as follows: S45.1: Convolutional layer parameter cross-validation: Extract the convolutional layer parameters of the two parent individuals into two lists, with the list structure as follows: [ NC , P , NF 1, K 1, ..., NF NC , K NC The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; each offspring inherits the number of convolutional layers from its parent. NC The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module; S45.2: Fully Connected Layer Parameter Crossing: Extract the fully connected layer parameters of the two parent individuals into two lists, with the list structure as follows: [ NH , H 1, D 1, ..., H NH , D NH The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; if the fully connected layer number of one of the parent lists is 0, no crossover operation is performed; the child lists inherit the fully connected layer number of their parent lists. NH The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module; S45.3: Hyperparameter Crossing: Create a list of hyperparameters (learning rate, batch size, and optimizer type) for the two parent individuals. The list structure is [ L , B , O Randomly select an intersection point, perform a single-point intersection operation, swap the parameter segments after the intersection point, generate two new hyperparameter lists, and use these lists to allocate the hyperparameters of offspring individuals. S45.4: After the crossover operation is completed, perform parameter consistency checks and repairs on the offspring individuals to ensure that the number of convolutional layers and fully connected layers of the offspring individuals match their parameters. Specifically, this includes: for convolutional layers, checking the actual number of convolutional layers in the current offspring individual. NC c Is it related to the original number of convolutional layers? NC Consistent, if NC c > NC Then from the first NC After the first convolutional layer, start deleting the [number]th [layer]. NC +1 convolutional layer to the... NC c The number of filters corresponding to each convolutional layer NF NC+1 , … , and kernel size K NC+1 , …, ;like NC c < NC Then through Randchoice( NF set The function randomly generates the first... NC c +1 convolutional layer to the... [[ID= The number of filters corresponding to each convolutional layer , …, ​ NC Through Randchoice ( K set The function randomly generates the first... ​ c +1 convolutional layer to the... ​ The kernel size corresponding to each convolutional layer , … , K NC In encoding , Supplement to be added later , , …, ​ NC , K NCFor fully connected layers, check the actual number of fully connected layers in the current offspring. ​ c Is it related to the existing fully connected layers? ​ Consistent, if ​ c > ​ Then from the first ​ After the first convolutional layer, start deleting the [number]th [layer]. ​ +1 fully connected layer to the th ​ c Number of neurons corresponding to each fully connected layer H NC+1 , … , and discard rate D NC+1 , … , ;like ​ c < ​ Then through Randint( H min , H max The function randomly generates the first... ​ c +1 fully connected layer to the th ​ Number of neurons corresponding to each fully connected layer , … , H NH Through Randchoice ( D set The function randomly generates the first... ​ c +1 fully connected layer to the th ​ Dropout rate corresponding to each fully connected layer , … , D NH In encoding , Supplement to be added later , , …, H NH , D NH ; S46: Perform mutation operations on offspring individuals, specifically including: S46.1: For each hyperparameter of each offspring individual, generate a uniformly distributed random number rand in the interval [0,1]. If rand < mutation probability... F If the value is positive, then a mutation operation is performed on the parameter; otherwise, the original value remains unchanged. S46.2: For parameters whose values ​​come from a fixed discrete candidate set, including the number of filters... ​ kernel sizeK Pooling kernel size P Drop rate D Learning rate L Batch size B Optimizer O The corresponding mutation operation is as follows: based on the first parameter, including ​ set , K set , P set , D set , L set , B set and O set In the preset set ​ set , K set , P set , D set , L set , B set and O set Randomly select a new element value from within; S46.3: For parameters whose values ​​are within a continuous or integer range, including the number of neurons in fully connected layers. H The mutation operation specifically involves: based on the first parameter, including... H min and H max At the preset lower limit H min and upper limit H max Within range via Randint( H min , H max The function uniformly and randomly generates new integer values; S46.4: Regarding the number of convolutional layers ​ and the number of fully connected layers ​ The mutation operation is performed based on the first parameter, including... ​ min , ​ max , ​ min and ​ maxWithin the preset lower and upper limits, respectively, through Randint( ​ min , ​ max ) function and Randint( ​ min , ​ max The function generates new integer values ​​uniformly and randomly. ​ m and ​ m If the new number of convolutional layers ​ m Greater than the number of convolutional layers before mutation ​ Then it is the newly added number ​ +1 convolutional layer to the... ​ m Each convolutional layer is processed by Randchoice( ​ set ) function and Randchoice( K set The function randomly generates the corresponding ​ NC+1 , K NC+1 , ..., , If the new number of convolutional layers ​ m Less than the number of convolutional layers before mutation ​ Then from the first ​ m After the first convolutional layer, start deleting the [number]th [layer]. ​ m +1 to the first ​ The convolutional layer corresponds to , , ..., ​ NC , K NC If the new fully connected layer ​ m Greater than the number of fully connected layers before mutation ​ Then it is the newly added number ​ +1 fully connected layer to the th ​ m Each fully connected layer is accessed via Randint( H min , H max ) function and Randchoice( D set The function randomly generates the corresponding H NH+1, D NH+1 , ..., , If the new fully connected layer ​ m Less than the number of fully connected layers before mutation ​ Then from the first ​ m After the first fully connected layer, begin deleting the [number]th [layer]. ​ m +1 to the first ​ Each fully connected layer corresponds to , , ..., H NH , K NH ; S46.5: After the mutation operation is completed, perform parameter consistency checks and repairs to ensure that all parameters are consistent with the current number of convolutional layers. ​ and the number of fully connected layers ​ Exact matching, removing redundant parameters or filling in missing parameters; S47: Repeat steps S45 and S46 until generated. ​ Each offspring individual constitutes the offspring population. Q gen And update the iteration count. ​ +1.

[0013] Furthermore, step S5 specifically includes the following sub-steps: S51: Parental population P gen With offspring population Q gen Merge into a new population R gen Among them, new populations R gen There are 2× ​ Individual; S52: For the population R gen All individuals are subjected to non-dominated sorting and crowding distance calculation, specifically including: following the fast non-dominated sorting method in step S42, ... R gen Individuals are divided into multiple non-dominated frontier levels; and crowding distance is calculated for each individual within each non-dominated frontier according to the crowding distance calculation method in step S43. S53: Following the Pareto front selection mechanism based on non-dominated ordering in step S44, individuals are selected according to the hierarchical order of the non-dominated front to form a new parent population. P gen+1The specific selection strategy is as follows: prioritize individuals in the frontier with higher non-dominated levels; when the number of individuals in the same non-dominated frontier exceeds the remaining population capacity... ​ When the crowding level is high, individuals are selected from highest to lowest distance; the final selection is made before... ​ The best individuals form the new generation population. P gen+1 ; S54: Update the population generation counter: ​ +1, completing a full evolutionary iteration.

[0014] Furthermore, step S8 specifically includes: The optimal CNN model is deployed online in the intelligent location detection system for network attacks in the power CPS. Online attack location detection is performed based on real-time data collected by the SCADA subsystem in the power CPS. The multi-label classification performance index of the CNN model is output to evaluate the performance of intelligent location detection of network attacks in the power CPS. The multi-label classification performance index of the CNN model includes accuracy, recall, precision, F1 score and false positive rate. The calculation formulas are shown in formulas (6) to (10) respectively. (6) (7) (8) (9) (10) In the formula, Accuracy represents accuracy, Recall represents recall, Precision represents precision, F1 represents F1 score, and FPR represents false positive rate. ​ This represents the number of samples where the measurement point was actually under attack and was correctly detected as an attack. ​ This indicates the number of samples that were actually in a normal state at the measurement point and were correctly detected as normal. ​ This indicates the number of samples where the measurement point was actually in a normal state but was falsely reported as an attack. ​ This indicates the number of samples that were actually under attack but were missed and were detected as normal.

[0015] A second aspect of this invention provides an intelligent localization system for power CPS network attacks based on multi-target evolutionary CNN, used to implement the aforementioned intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN, the system comprising: The dataset preprocessing module is used to standardize and preprocess historical data collected by the monitoring and data acquisition subsystem in the power CPS in order to build training and test datasets. The parameter setting and target construction module is used to set the first parameter and, based on the preset first parameter, use hybrid encoding to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks, so as to define the search space of the CNN model architecture and hyperparameters; set the second parameter and construct the optimization objective function of the multi-objective evolutionary CNN model; The population initialization module is used to randomly generate an initial population based on the mixed encoding of the CNN model to be optimized using the first parameter. P gen And set the current iteration number. ​ =0; The population assessment module is used to evaluate the population. P gen All individuals were trained and tested offline, and the multi-objective fitness value of each individual was calculated based on the test dataset, including the number of model parameters and (1 - macro average F1 score). The non-dominated sorting and crowding distance calculation module is used for population... P gen All individuals in the dataset are sorted by non-dominated order and crowding distance is calculated to identify the Pareto front. The offspring population generation module is used to generate offspring populations by employing a Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-coded individuals, and mutation operations. Q gen ; The population merging and frontier preservation module is used to merge parent populations. P gen With offspring population Q gen Merging involves performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 And preserve the Pareto front solution set of the current generation; The iteration control module is used to determine the current iteration number. ​ Has the maximum number of iterations been reached? ​ If yes, then save the entire contents of the last generation of non-dominated solutions and use it as the Pareto optimal solution set; otherwise, set the current iteration number. ​ = ​ +1, and return to the population evaluation module to continue iterating; The model selection module is used to select the optimal CNN model from the Pareto optimal solution set that minimizes both the number of model parameters and the performance of the multi-label classification model (1-macro average F1 score). The online deployment module is used to deploy the selected optimal CNN model online into the power CPS network attack intelligent location and detection system, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

[0016] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) This invention proposes an intelligent localization method for power CPS network attacks based on multi-objective evolution CNN. By modeling the construction process of the power CPS attack localization and detection model as a multi-objective optimization problem of a multi-label classification model, the Pareto optimal CNN model architecture and hyperparameters are automatically searched using multi-objective optimization technology. Compared with the existing manual design method that relies on expert experience, this invention realizes the automated and intelligent design of the CNN model for power CPS network attack localization, and solves the problems of the existing manual parameter tuning process being time-consuming, laborious, subjective, and prone to getting trapped in local optima. Moreover, this invention can quickly adapt to the actual application scenarios of complex power CPS.

[0017] (2) This invention uses the number of convolutional layers, number of filters, convolutional kernel size, pooling kernel size, number of fully connected layers, number of neurons in fully connected layers, dropout rate, learning rate, batch size, optimizer and other architectural parameters and hyperparameters in CNN as decision variables, designs a variable length hybrid coding strategy, minimizes the number of CNN model parameters and minimizes (1-macro average F1 score) as two optimization objective functions, designs a Pareto front selection mechanism based on non-dominated sorting, a block single-point crossover strategy for hybrid coding individuals and mutation operation, realizes offline multi-objective optimization iteration of CNN, obtains a compromise optimization model that takes into account both attack positioning accuracy and model lightweighting, realizes lightweight online deployment and accurate detection of power CPS network attack intelligent positioning system. Attached Figure Description

[0018] ​ This is a flowchart of the intelligent localization method for power CPS network attacks based on multi-target evolution CNN of the present invention; ​ This is an example diagram of the individual encoding and decoding of a typical CNN model generated in step S2 of the present invention; ​ This is an example diagram illustrating the selection, mutation, and crossover operations of individuals in the multi-objective evolutionary CNN model of this invention; ​ The Pareto front diagram is obtained by iterative optimization search of the PVW dataset that simultaneously includes photovoltaic and wind power generation units in this invention. ​A comparison chart of network attack localization performance indicators obtained by existing manually designed CNN technology, CNN technology based on single-objective genetic optimization (i.e., GA-CNN), and the technology of this invention; ​ A comparison chart showing the number of model parameters obtained by existing manually designed CNN techniques, CNN techniques based on single-objective genetic optimization (i.e., GA-CNN), and the technique of this invention; ​ This is a schematic diagram of the intelligent localization system for power CPS network attacks based on multi-target evolution CNN of the present invention. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] See ​ The present invention provides a method for intelligent localization of attacks on power CPS networks based on multi-target evolutionary CNN, which specifically includes the following steps: S1: Supervision Control and Data Acquisition in Power CPS ， Historical data collected by the SCADA subsystem is standardized and preprocessed to construct a training dataset. X train With the test dataset X test .

[0021] This embodiment involves a method for generating a dataset for detecting grid-based network attacks. The dataset is generated through the following process: based on the IEEE 123-node distribution test system, a power simulation environment for new energy access is constructed by integrating photovoltaic and wind power generation modules and incorporating meteorological data from the National Renewable Energy Laboratory (NREL); subsequently, the dataset is processed using OpenDSS (Open Distribution System). The system performs unbalanced power flow calculations in a co-simulation platform of Simulator and MATLAB to generate a dataset of the system's normal operating status throughout the year. To simulate network attack scenarios, data tampering attacks are injected into the normal operating data dataset. These attacks include at least one of the following types: additive attacks, subtractive attacks, and hybrid attacks consisting of a combination of additive and subtractive attacks. The process of generating the attack data includes: randomly selecting multiple attack times from the 8760 hours of operating data throughout the year; randomly selecting a portion of the distributed generators (DGs) in the system as attack targets at each attack time; and applying a deviation to the reported power data of the targets, wherein the deviation is a random value between 5% and 20% of the actual output power of the generator. For hybrid attacks, positive and negative power deviations are applied simultaneously to different subsets of generators to make the changes in the total power of the system more concealed. By comparing the tampered data with the original normal data, a corresponding attack category label is generated for each generator at each time step, thus forming a dataset for training and testing the multi-label classification model. To verify the model's universality under different energy scenarios, derivative datasets with various energy configurations are constructed, including but not limited to: scenarios containing only photovoltaic power generation units, scenarios containing only wind power generation units, and hybrid scenarios containing both photovoltaic and wind power generation units. This invention uses the dataset containing both photovoltaic and wind power generation units (PVW dataset), in which the accessed renewable resources are 25 photovoltaic panels and 15 wind turbines.

[0022] Specifically, the historical data collected by the SCADA subsystem in the power CPS is proportionally divided into training datasets for searching multi-objective evolutionary CNN models. X train With the test dataset X test After completing the data partitioning, proceed according to the training dataset. X train Data distribution for training dataset X train With the test dataset X test Z-Score standardization is performed; the calculation process of Z-Score standardization is shown in formula (1): (1) In the formula, Indicates the number after standardization. α The first data sample β The value of each feature, Indicates the first before standardization. α The first data sample β The value of each feature, ​ Indicates the first β The mean of each feature, ​ Indicates the first β The standard deviation of each feature. The training dataset after Z-Score standardization can then be used. X train With the test dataset X test Optimal architecture search and hyperparameter optimization for multi-objective evolutionary CNN models.

[0023] It should be noted that, given the temporal characteristics of the dataset, a forward temporal series partitioning strategy is adopted to maintain temporal continuity: the first 70% of the time series data is used as the training dataset. X train The last 30% of the data was used as the test dataset. X test ,Right now X train and X test The allocation ratio is 7:3. Of course, the datasets can also be divided according to other ratios based on the actual needs of model training and testing, such as 8:2.

[0024] In this embodiment, the total number of samples collected by the SCADA subsystem in the power CPS is 8760, meaning there are 8760 data samples in total. The training dataset contains 6132 samples, and the test dataset contains 2628 samples. The PVW dataset has a total of 63 features per sample, meaning each data sample has 63 features. The dataset contains 40 labels. M =40.

[0025] S2: Set the first parameter, and according to the preset first parameter, use hybrid encoding to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks, and randomly initialize the population. P gen ={ p i}, i =1,2, …, ​ ,in p i Indicates the first i Individual, ​Indicates population size.

[0026] Furthermore, the first parameter includes: a lower bound on the number of convolutional layers in the CNN model to be optimized. ​ min and upper limit ​ max The set of possible values ​​for the number of filters ​ set The set of possible values ​​for the convolution kernel size K set The set of possible values ​​for the pooling kernel size P set The lower limit of the number of fully connected layers ​ min and upper limit ​ max The lower limit of the number of neurons in a fully connected layer H min and upper limit H max The set of possible values ​​for the discard rate D set and the set of possible values ​​for the hyperparameter learning rate. L set The set of possible values ​​for batch size B set The set of optimizer types O set .

[0027] In this embodiment, the following settings are provided: ​ min =1、 ​ max =5、 ​ set ={4, 8, 16, 32, 64, 128}、 K set ={3,5, 7, 9, 11, 13}、 P set ={1, 2}、 ​ min =0、 ​ max =5、 H min =16、 H max =256、 D set ={0, 0.01, 0.1, 0.2, 0.3, 0.4, 0.5}、 L set ={0.0001, 0.001, 0.01, 0.1, 0.2, 0.3, 0.4}、 Bset ={16, 32, 64, 128, 256, 512}、 O set ={Adam, SGD, RMSprop, Adadelta, ASGD, RAdam}, where Adam represents the adaptive moment estimation optimizer, SGD represents the stochastic gradient descent optimizer, RMSprop represents the root mean square propagation optimizer, Adadelta represents the adaptive gradient adjustment optimizer, ASGD represents the average stochastic gradient descent optimizer, and RAdam represents the reparameterized adaptive moment estimation optimizer. It should be noted that the first parameter can be fine-tuned according to the actual implementation case.

[0028] Furthermore, population P gen Specifically, it is generated through the following process: Randomly generated, containing... ​ Population of individuals P gen ,Right now P gen = { p 1, p 2, …, p NP}, 0≤ ​ ≤ ​ ,in ​ This represents the current iteration number; the specific expression for each individual in the population is... p i ={ p i,1 , p i,2 , …, p i,j , …, p i,D}, where 1≤ i ≤ ​ ,1≤ j ≤ D , p i,j Indicates the first i The first individual j 3D encoding, D The dimension representing the individual's encoding; the individual in the population p i The specific encoding is for each individual in the population p i The specific code is p i ={ ​ , P , ​ 1, K 1, …, ​NC , K NC , ​ , H 1, D 1, ..., H NH , D NH , L , B , O},in ​ This indicates the number of convolutional layers in a CNN model. P This indicates the pooling kernel size of the CNN model. ​ 1 indicates the number of filters in the first convolutional layer of the CNN model. K 1 represents the kernel size of the first convolutional layer in the CNN model. ​ NC In the CNN model, the first... ​ The number of filters in each convolutional layer K NC In the CNN model, the first... ​ The kernel size of each convolutional layer ​ This indicates the number of fully connected layers in a CNN model. H 1 indicates the number of neurons in the first fully connected layer of the CNN model. D 1 represents the dropout rate of the first fully connected layer in the CNN model. H NH In the CNN model, the first... ​ The number of neurons in a fully connected layer D NH In the CNN model, the first... ​ Dropout rate of each fully connected layer L This represents the learning rate during CNN model training. B This indicates the batch size of the CNN model. O This represents the optimizer used for training the CNN model.

[0029] In the above individual coding, the specific generation method of the coding for each variable is as follows: ​ =Randint( ​ min , ​ max ), where Randint represents the random integer selection function, ​ min and ​ max They represent ​ The lower and upper limits; for the first to the second ​One convolutional layer, ​ 1, … , ​ NC All meet Randchoice( ​ set ), K 1, … , K NC All satisfy Randchoice( K set Randchoice is a function for randomly selecting discrete values. ​ set The set of values ​​representing the number of filters. K set The set of possible values ​​for the convolution kernel size; P =Randchoice( P set ), P set The set of possible values ​​for the pooling kernel size; ​ =Randint( ​ min , ​ max ), ​ min and ​ max They represent ​ The lower and upper limits; for the first to the second ​ A fully connected layer, H 1, … , H NH All satisfy Randint( H min , H max ), H min and H max They represent H The lower and upper limits, D 1, … , D NH All satisfy Randchoice( D set ), D set The set of possible values ​​representing the dropout rate of the fully connected layer; L =Randchoice( L set ), L set This represents the set of possible learning rate values ​​for the CNN model. B=Randchoice( B set ), B set The set of possible values ​​representing the batch size of a CNN model; O = Randchoice( O set ), O set This represents the set of values ​​for the CNN model training optimizer type.

[0030] In this embodiment, ​ =Randint(1, 5), ​ The specific value is an integer between 1 and 5; for the first to the last... ​ One convolutional layer, ​ 1, … , ​ NC All satisfy Randchoice([4, 8, 16, 32, 64, 128]). K 1,… , K NC All satisfy Randchoice([3, 5, 7, 9, 11, 13]). ​ 1, … , ​ NC The specific value is one of the preset numbers of 6 filters {4, 8, 16, 32, 64, 128}. K 1, … , K NC The specific value is one of the six preset convolutional kernel sizes {3, 5, 7, 9, 11, 13}. P =Randchoice([1, 2]), where, P The specific value is 1 or 2. In this embodiment, the pooling layer type is max pooling, and the internal parameters of the pooling layer, step size and padding, are default values, that is, the step size is equal to the pooling kernel size and the padding is 0. ​ =Randint(0, 5), ​ The specific value is an integer between 0 and 5; for the first to the second ​ A fully connected layer, H 1, … , H NH All satisfy Randint(16, 256), H 1, … , H NH The specific value is an integer between 16 and 256. D1, … , D NH All satisfy Randchoice([0, 0.01, 0.1, 0.2, 0.3, 0.4, 0.5]). D 1, … , D NH The specific value is one of seven preset discard rates {0, 0.01, 0.1, 0.2, 0.3, 0.4, 0.5}. L =Randchoice([0.0001, 0.001, 0.01, 0.1, 0.2, 0.3,0.4]), L The specific value is one of the seven preset learning rates {0.0001, 0.001, 0.01, 0.1, 0.2, 0.3, 0.4}. B = Randchoice([16, 32, 64, 128, 256, 512]), B The specific value is one of the six preset batch sizes {16, 32, 64, 128, 256, 512}. O = Randchoice([Adam, SGD,RMSprop, Adadelta, ASGD, RAdam]), O The specific value is one of the six preset optimizer types {Adam, SGD, RMSprop, Adadelta, ASGD, RAdam}.

[0031] For example, in this embodiment, the representative initial CNN model individuals randomly generated according to the above-mentioned parameter preset range are: p i = {2, 2, 4, 5, 8, 3, 1, 32, 0.01, 0.001, 256, Adam}, ​ An example diagram of individual encoding and decoding in a CNN model is given.

[0032] S3: Set the second parameter to construct the optimization objective function of the multi-objective evolutionary CNN model.

[0033] Furthermore, the second parameter includes population size. ​ Maximum number of iterations ​ Crossover probability Cr Probability of mutation F .

[0034] In this embodiment, the following settings are provided: ​ =30、 ​=20、 Cr =0.8、 F =0.2. It should be noted that the second parameter mentioned above can be fine-tuned according to actual implementation cases.

[0035] Furthermore, the first p i The optimization objective function of the CNN model corresponding to each individual is shown in Equation (2): (2) In the formula, the optimization objective is... ​ 1( p i ) is the first p i Each individual parameter corresponds to the number of parameters in the CNN model, where Para-mun represents the number of parameters in the CNN model, and the optimization objective is... ​ 2( p i ) is the first p i Each individual corresponds to a performance metric of the CNN model. This represents the average F1 score for macros.

[0036] Furthermore, the macro average F1 score is obtained specifically through the following method: for the components included in the power CPS system. N The measurement points, of which the first... k Each measurement point is represented as m k , k =1, 2, …, N Each measurement point m k Whether an attack has occurred is used as a separate binary label (0 for normal, 1 for attacked) to construct a system with... N This attack targets a multi-label classification task within a single-label power CPS attack. The input to the CNN model is standardized multivariate power CPS measurement data, including meter readings from distributed generators (DG), SCADA subsystem measurement data, and meteorological parameters. This multivariate measurement data is constructed as a one-dimensional vector. After the power CPS multivariate measurement data is input into the CNN model, feature learning and classification are performed using an automatically determined optimal CNN architecture based on a multi-objective evolutionary algorithm. The number of convolutional layers in this CNN architecture is... ​ Number of filters in each layer ​ 1, … , ​ NC kernel size K 1, … , K NC Pooling core size P Number of fully connected layers ​Number of neurons in each layer H 1, … , H NH Drop rate D 1, … , D NH and training hyperparameters L , B , O All features are obtained through the specific encoding methods of each variable in step S2; the hierarchical features extracted after optimization are flattened and fed into a fully connected layer for advanced feature fusion and nonlinear abstraction to learn composite evidence for attack judgment; finally, multi-label classification is performed by the output fully connected layer, and the number of neurons in this layer is related to the number of system monitoring points. N Strict correspondence; each output neuron operates independently using the sigmoid activation function, calculating and outputting a probability value between 0 and 1 based on all integrated evidence, representing the confidence level that the corresponding monitoring point has been attacked; by comparing each output value with a preset discrimination threshold... By comparison, the CNN model ultimately generates a N A binary location vector is used to clearly and accurately mark each specific monitoring point in the system that is identified as being under attack, achieving end-to-end intelligent judgment from raw data to precise location. During the offline optimization of the CNN model, the training dataset is used. X train The CNN model is trained, and the performance of the multi-label classification model is evaluated using the macro-average F1 score. The specific calculation formula is shown in formula (3): (3) In the formula, M Indicates the label dimension. ​ k Indicates the first k Measurement points m k The number of samples that were actually under attack but were correctly detected as attacks. ​ k Indicates the first k Measurement points m k The actual number of samples that are in a normal state and were correctly detected as normal. ​ k Indicates the first k Measurement points m k The number of samples that were actually in a normal state but were falsely reported as attacks. ​ k Indicates the first k Measurement points m kThe number of samples that were actually under attack but were missed and were detected as normal.

[0037] S4: Assess the population P gen The number of CNN model parameters and macro-average F1 score for all individuals were used to perform non-dominated sorting and crowding distance calculation based on the evaluation results. A Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-encoded individuals, and mutation operations were employed to generate the offspring population. Q gen And record the number of iterations. ​ .

[0038] S41: Evaluate the population based on the optimization objective function of the multi-objective evolutionary CNN model. P gen Each individual p i The two optimization objective function values ​ 1( p i )and ​ 2( p i ).

[0039] S42: Based on the evaluation results obtained in step S41, assess the population... P gen All individuals are subjected to a fast non-dominated ranking to divide them into multiple non-dominated frontier levels, specifically including: S42.1: Initialize the number of times each individual is dominated by other individuals. ​ p and the set of other individuals dominated by that individual. ​ p .

[0040] S42.2: Traverse each pair of individuals in the population and determine their dominance relationship: If individuals p i Dominant Individual p j Then increase p j Domination count ​ p and will p j join in p i Dominant set ​ p If an individual p j Dominant Individual p i Then increase p iThe dominance count, and p i join in p j The set of dominance.

[0041] S42.3: Domination count ​ p Individuals with a value of 0 are placed in the first layer of the non-dominated frontier. ​ 1.

[0042] S42.4: For the current... k Non-dominated frontier ​ k For each individual in the set, iterate through its dominion set. ​ p Each individual in the process, and these individuals' ​ p Decrease by 1; if a certain individual ​ p If the value is reduced to 0, it is placed in the next level of non-dominated frontier. ​ k+1 .

[0043] S42.5: Repeat step S42.4 until all individuals have been assigned to the corresponding non-dominated fronts, and label these non-dominated fronts as { ​ k}, k =1, 2, …, k max ,in k max This represents the maximum number of non-dominated frontier layers.

[0044] S43: After completing the non-dominated sorting, calculate the crowding distance for each individual in the population, specifically including: S43.1: Take the first k Non-dominated frontier F k All individuals, according to the first o Sort the optimization objective function values ​​from smallest to largest. k =1, 2, …, k max , o =1, 2.

[0045] S43.2: The first o The maximum value among the optimization objective function values ​​is taken as , will the o The minimum value among the values ​​of the optimization objective function is taken as .

[0046] S43.3: Sort the values ​​of the objects with the minimum objective function values ​​respectively. and the maximum optimization objective function value The crowding distance of individuals is set to infinity.

[0047] S43.4: For intermediate individuals that are neither the smallest nor the largest in the ranking, calculate the normalized crowding distance between them and their neighboring individuals. The normalized calculation formula for min-max is shown in Equation (4), and the crowding distance calculation formula is shown in Equation (5). (4) (5) In the formula, Indicates the first i The individual in the first o The normalized fitness value on the optimization objective. Indicates the first i The individual in the first o Fitness values ​​on each optimization objective ​ i Indicates the first i The crowding distance of each individual t This represents the total number of optimization objectives. Indicates the first i +1 individual in the first o Fitness values ​​on each optimization objective Indicates the first i -1 individual o Fitness values ​​on each optimization objective.

[0048] S43.5: Traverse all optimization objectives, sum the crowding distances of each individual across all objective functions, and obtain the total crowding distance for that individual.

[0049] S44: Employing a Pareto front selection mechanism based on non-dominated sorting from the population P gen Select the parent individual, specifically including: S44.1: According to the hierarchical order of the non-dominated frontiers, starting from the first level of non-dominated frontiers... ​ 1. Start according to ​ 1, ​ 2, ..., individuals from the non-dominated frontier are added to the parent set in sequence until the size of the parent set is exactly reached. ​ .

[0050] S44.2: If the last non-dominated frontier is selected in step S44.1 Then, sort the individuals in descending order of their total crowding distance, and select a sufficient number of individuals until the parent set size is exactly reached.​ That's all.

[0051] S45: Randomly select two parent individuals from the parent set. ​ 1 and ​ 2. Implement a block-based single-point crossover strategy for hybrid encoded individuals to generate two offspring individuals. ​ 1 and ​ 2; The specific implementation steps of the block-based single-point intersection strategy are as follows: S45.1: Convolutional layer parameter cross-validation: Extract the convolutional layer parameters of the two parent individuals into two lists, with the list structure as follows: [ ​ , P , ​ 1, K 1, ..., ​ NC , K NC The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; each offspring inherits the number of convolutional layers from its parent. ​ The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module.

[0052] S45.2: Fully Connected Layer Parameter Crossing: Extract the fully connected layer parameters of the two parent individuals into two lists, with the list structure as follows: [ ​ , H 1, D 1, ..., H NH , D NH The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; if the fully connected layer number of one of the parent lists is 0, no crossover operation is performed; the child lists inherit the fully connected layer number of their parent lists. ​ The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module.

[0053] S45.3: Hyperparameter Crossing: Create a list of hyperparameters (learning rate, batch size, and optimizer type) for the two parent individuals. The list structure is [ L , B , O Randomly select an intersection point, perform a single-point intersection operation, swap the parameter segments after the intersection point, generate two new hyperparameter lists, and use these lists to allocate the hyperparameters of offspring individuals.

[0054] S45.4: After the crossover operation is completed, perform parameter consistency checks and repairs on the offspring individuals to ensure that the number of convolutional layers and fully connected layers of the offspring individuals match their parameters. Specifically, this includes: for convolutional layers, checking the actual number of convolutional layers in the current offspring individual. ​ c Is it related to the original number of convolutional layers? ​ Consistent, if ​ c > ​ Then from the first ​ After the first convolutional layer, start deleting the [number]th [layer]. ​ +1 convolutional layer to the... ​ c The number of filters corresponding to each convolutional layer ​ NC+1 , … , and kernel size K NC+1 , …, ;like ​ c < ​ Then through Randchoice( ​ set The function randomly generates the first... ​ c +1 convolutional layer to the... ​ The number of filters corresponding to each convolutional layer , …, ​ NC Through Randchoice ( K set The function randomly generates the first... ​ c +1 convolutional layer to the... ​ The kernel size corresponding to each convolutional layer , … , K NC In encoding , Supplement to be added later , , …, ​ NC , K NC For fully connected layers, check the actual number of fully connected layers in the current offspring. ​ c Is it related to the existing fully connected layers? ​ Consistent, if ​ c > ​ Then from the first ​ After the first convolutional layer, start deleting the [number]th [layer]. ​ +1 fully connected layer to the th ​c Number of neurons corresponding to each fully connected layer H NC+1 , … , and discard rate D NC+1 , … , ;like ​ c < ​ Then through Randint( H min , H max The function randomly generates the first... ​ c +1 fully connected layer to the th ​ Number of neurons corresponding to each fully connected layer , … , H NH Through Randchoice ( D set The function randomly generates the first... ​ c +1 fully connected layer to the th ​ Dropout rate corresponding to each fully connected layer , … , D NH In encoding , Supplement to be added later , , …, H NH , D NH .

[0055] S46: Perform mutation operations on offspring individuals, specifically including: S46.1: For each hyperparameter of each offspring individual, generate a uniformly distributed random number rand in the interval [0,1]. If rand < mutation probability... F If the value is positive, then a mutation operation is performed on the parameter; otherwise, the original value remains unchanged.

[0056] S46.2: For parameters whose values ​​come from a fixed discrete candidate set, including the number of filters... ​ kernel size K Pooling kernel size P Drop rate D Learning rate L Batch size B Optimizer O The corresponding mutation operation is as follows: based on the first parameter, including ​ set , Kset , P set , D set , L set , B set and O set In the preset set ​ set , K set , P set , D set , L set , B set and O set A new element value is randomly selected from within.

[0057] S46.3: For parameters whose values ​​are within a continuous or integer range, including the number of neurons in fully connected layers. H The mutation operation specifically involves: based on the first parameter, including... H min and H max At the preset lower limit H min and upper limit H max Within range via Randint( H min , H max The function generates new integer values ​​uniformly and randomly.

[0058] S46.4: Regarding the number of convolutional layers ​ and the number of fully connected layers ​ The mutation operation is performed based on the first parameter, including... ​ min , ​ max , ​ min and ​ max Within the preset lower and upper limits, respectively, through Randint( ​ min , ​ max ) function and Randint( ​ min , ​ maxThe function generates new integer values ​​uniformly and randomly. ​ m and ​ m If the new number of convolutional layers ​ m Greater than the number of convolutional layers before mutation ​ Then it is the newly added number ​ +1 convolutional layer to the... ​ m Each convolutional layer is processed by Randchoice( ​ set ) function and Randchoice( K set The function randomly generates the corresponding ​ NC+1 , K NC+1 , ..., , If the new number of convolutional layers ​ m Less than the number of convolutional layers before mutation ​ Then from the first ​ m After the first convolutional layer, start deleting the [number]th [layer]. ​ m +1 to the first ​ The convolutional layer corresponds to , , ..., ​ NC , K NC If the new fully connected layer ​ m Greater than the number of fully connected layers before mutation ​ Then it is the newly added number ​ +1 fully connected layer to the th ​ m Each fully connected layer is accessed via Randint( H min , H max ) function and Randchoice( D set The function randomly generates the corresponding H NH+1 , D NH+1 , ..., , If the new fully connected layer ​ m Less than the number of fully connected layers before mutation ​ Then from the first ​m After the first fully connected layer, begin deleting the [number]th [layer]. ​ m +1 to the first ​ Each fully connected layer corresponds to , , ..., H NH , K NH .

[0059] S46.5: After the mutation operation is completed, perform parameter consistency checks and repairs to ensure that all parameters are consistent with the current number of convolutional layers. ​ and the number of fully connected layers ​ Exact matching, removing redundant parameters or filling in missing parameters.

[0060] S47: Repeat steps S45 and S46 until generated. ​ Each offspring individual constitutes the offspring population. Q gen And update the iteration count. ​ +1.

[0061] For example, in this embodiment, a group of individuals randomly selected according to step S4 above, and in conjunction with the accompanying drawings, are described. ​ The Pareto front selection mechanism based on non-dominated ordering, including the block-based single-point crossover strategy and mutation operation for mixed-encoded individuals, is explained: First, starting from the current population... P gen Six individuals were randomly selected as examples, with the following hyperparameter configurations: Individual 1: {4, 2, 8, 11, 4, 7, 16, 9, 8, 3, 0.0001, 64, RMSprop}, Individual 2: {2, 2, 8, 11, 8, 7, 1, 23, 0.2, 0.0001, 16, RMSprop}, Individual 3: {2, 2, 8, 5, 8, 3, 0.4, 16, Adam}, Individual 4: {1, 2, 8, 5, 1, 48, 0. Individual 1: {1, 0.001, 64, RAdam}, Individual 5: {3, 2, 8, 7, 16, 13, 8, 11, 0.3, 64, Adadelta}, Individual 6: {3, 2, 8, 7, 64, 9, 4, 9, 1, 50, 0.01, 0.01, 256, Adam}; Furthermore, the total number of dominated individuals for each individual is: 0, 0, 1, 0, 1, 2; the crowding distance for each individual is: 0.3, 0.5, 0.7, 0.2, 0.6, 0.8; Assume ​If the size is 3, then Pareto front selection based on non-dominated ranking is performed on the above individuals, and the selected parent population is... s 1, s 2 and s 3 are respectively: s 1={4, 2, 8, 11, 4, 7, 16, 9, 8, 3,0.0001, 64, RMSprop}, s 2={2, 2, 8, 11, 8, 7, 1, 23, 0.2, 0.0001, 16, RMSprop}, s 3 = {1, 2, 8, 5, 1, 48, 0.1, 0.001, 64, RAdam}; Two parents are randomly selected from the parent population for crossover: Parent 1: {2, 2, 8, 11, 8, 7, 1, 23, 0.2, 0.0001, 16, RMSprop}, Parent 2: {1, 2, 8, 5, 1, 48, 0.1, 0.001, 64, RAdam}. Based on a block-based single-point crossover strategy for hybrid encoded individuals, single-point crossover is performed according to the three blocks of convolutional layer, fully connected layer, and hyperparameters. The parameter segments after the crossover point are swapped. The repair module performs parameter consistency checks and repairs on the offspring individuals to obtain the offspring. q 1={2, 2, 8, 5, 4, 3, 1, 23,0.1, 0.0001, 64, RAdam}; q 2 = {1, 2, 8, 11, 1, 48, 0.2, 0.001, 16, RMSprop}. Finally, for... q 1 and q 2. Perform mutation operations. Generate corresponding random numbers based on the current mutation dimension. Mutate the parameters first, then the mutation layer. If the random number is less than the current mutation factor, perform mutation until all dimensions of the individual have been mutated. The repair module checks and repairs the parameters of the mutated offspring individuals. The offspring 1 and offspring 2 obtained after mutation are {2, 2, 4, 5, 4, 3, 1, 32, 0.1, 0.1, 64, RAdam} and {2, 2, 8, 11, 8, 7, 1, 48, 0.2, 0.001, 32, RMSprop}, respectively. Finally, add the generated offspring to the offspring population. Q gen and update the iteration count. ​ ​ +1, completing this evolutionary iteration.

[0062] S5: For the population Pgen and Q gen The process involves merging individuals, performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 .

[0063] S51: Parental population P gen With offspring population Q gen Merge into a new population R gen Among them, new populations R gen There are 2× ​ Individual.

[0064] S52: For the population R gen All individuals are subjected to the non-dominated sorting and crowding distance calculation described in step S4, specifically including: according to the fast non-dominated sorting method in step S42, ... R gen Individuals are divided into multiple non-dominated frontier levels; and crowding distance is calculated for each individual within a non-dominated frontier according to the crowding distance calculation method in step S43.

[0065] S53: Following the Pareto front selection mechanism based on non-dominated ordering in step S44, individuals are selected according to the hierarchical order of the non-dominated front to form a new parent population. P gen+1 The specific selection strategy is as follows: prioritize individuals in the frontier with higher non-dominated levels; when the number of individuals in the same non-dominated frontier exceeds the remaining population capacity... ​ When the crowding level is high, individuals are selected from highest to lowest distance; the final selection is made before... ​ The best individuals form the new generation population. P gen+1 .

[0066] S54: Update the population generation counter: ​ +1, completing a full evolutionary iteration.

[0067] S6: Determine the current iteration number ​ Has the maximum number of iterations been reached? ​ If yes, then save the entire contents of the last generation of non-dominated solutions, which can be saved as a txt file and used as the Pareto optimal solution set; otherwise, set the current iteration number. ​ = ​ +1, and return to step S4 to continue the search.

[0068] For example, in this embodiment, after 20 iterations, the Pareto optimal solution set obtained in the PVW dataset example has a total of 4 non-dominated individuals, namely: p 1={4, 2, 16, 3, 8, 3, 4, 5, 4, 11, 0, 0, 0,0.01, RAdam}; p 2={3, 2, 4, 3, 4, 3, 4, 3, 0, 0, 0, 0.001, 512, Adam}; p 3={3, 2,16, 5, 4, 3, 4, 3, 0, 0, 0, 0.01, 16, RAdam}; p 4 = {3, 2, 8, 3, 4, 5, 4, 3, 0, 0, 0, 0.001, 64, Adam}; Furthermore, the fitness values ​​of the four individuals are: [1320, 0.0353]; [1280, 0.2499]; [1504, 0.0036]; [1408, 0.0251]; After iterative optimization search, the Pareto fronts obtained in the PVW dataset are as follows: ​ As shown.

[0069] S7: Select the Pareto optimal solution that minimizes (1-macro average F1 score) while taking into account both the number of model parameters and the performance of the multi-label classification model from the Pareto optimal solution set, and use the CNN model represented by it as the optimal model for intelligent localization and detection of power CPS network attacks.

[0070] In this embodiment, the optimal compromise individual selected from the Pareto front of the PVW dataset is... p 3={4,2, 16, 3, 8, 3, 4, 5, 4, 11, 0, 0, 0, 0.01, 16, RAdam}.

[0071] S8: Deploy the optimal CNN model online in the intelligent location and detection system for power CPS network attacks, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

[0072] Specifically, the optimal CNN model is deployed online in the intelligent location detection system for network attacks in the power CPS. Online attack location detection is performed based on real-time data collected by the SCADA subsystem in the power CPS, and the multi-label classification performance index of the CNN model is output to evaluate the performance of the intelligent location detection of network attacks in the power CPS. The multi-label classification performance index of the CNN model includes accuracy, recall, precision, F1 score, and false positive rate, and their calculation formulas are shown in formulas (6) to (10), respectively. (6) (7) (8) (9) (10) In the formula, Accuracy represents accuracy, Recall represents recall, Precision represents precision, F1 represents F1 score, and FPR represents false positive rate. ​ This represents the number of samples where the measurement point was actually under attack and was correctly detected as an attack. ​ This indicates the number of samples that were actually in a normal state at the measurement point and were correctly detected as normal. ​ This indicates the number of samples where the measurement point was actually in a normal state but was falsely reported as an attack. ​ This indicates the number of samples that were actually under attack but were missed and were detected as normal.

[0073] For example, in this embodiment, in the PVW dataset example, the performance metrics obtained using manually designed CNN technology are as follows: accuracy 0.9945, precision 0.9996, recall 0.9798, F1 score 0.9896, and false positive rate 0.00012; the performance metrics obtained using GA-CNN technology based on single-objective genetic optimization are as follows: accuracy 0.9992, precision 1.00, recall 0.9972, F1 score 0.9986, and false positive rate 0; the performance metrics of the optimal compromise multi-objective evolutionary CNN model obtained using the technology of this invention are as follows: accuracy 0.9985, precision 0.9985, recall 0.9961, F1 score 0.9973, and false positive rate 0.0006. In the PVW dataset example, the model obtained using manually designed CNN technology has 173,928 parameters, the optimal compromise single-objective evolutionary CNN model obtained using GA-CNN (a CNN technique based on single-objective genetic optimization) has 167,160 parameters, and the optimal compromise multi-objective evolutionary CNN model obtained using the technology of this invention has 1,320 parameters. A comparison of network attack localization performance metrics obtained using existing manually designed CNN technology, GA-CNN (a CNN technique based on single-objective genetic optimization), and the technology of this invention is shown in the figure below. ​ As shown in the figure; a comparison of the number of model parameters obtained by existing manually designed CNN techniques, CNN techniques based on single-objective genetic optimization (i.e., GA-CNN), and the technique of this invention is shown in the figure. ​As shown in the diagram. Comparative analysis reveals that, compared to existing manually designed CNN techniques and single-objective GA-CNN techniques, the present invention achieves higher or comparable multi-label classification model performance metrics while maintaining a lower number of model parameters. This not only effectively improves the intelligent design level of power CPS network attack localization but also simultaneously balances high-performance metrics for power CPS network attack localization with a lightweight deep learning model, making it easier to deploy online in environments with limited computing resources.

[0074] In summary, through the above technical solutions, this invention comprehensively considers two indicators: model lightweighting and multi-label classification model performance (1-macro average F1 score) for the intelligent location and detection system of power CPS network attacks. It designs a multi-objective optimization method based on a Pareto front selection mechanism with non-dominated sorting, a block-based single-point crossover strategy for mixed-encoded individuals, and mutation operation. By using non-dominated sorting and crowding distance calculation to reasonably screen elite individuals, it effectively realizes the multi-objective automatic optimization design of a CNN model for power CPS attack location and detection application scenarios that takes into account both model lightweighting and multi-label classification model performance (1-macro average F1 score). The intelligent localization method for power CPS network attacks based on multi-objective evolutionary CNN described in this invention not only further improves the automation design level of the intelligent localization system for power CPS network attacks, but also takes into account two important indicators: the number of model parameters and the performance of the multi-label classification model (1 − macro average F1 score). This is more conducive to the online deployment and detection of the intelligent localization detection model for power CPS attacks, and further expands the engineering implementation and promotion application of multi-objective automatic deep learning technology in the field of power CPS network information security. By combining formulas (1) to (10) with steps S1 to S8 of this invention, the multi-objective evolutionary CNN model is finally found to have a better overall performance in terms of the number of model parameters and various performance indicators.

[0075] It is worth mentioning that the present invention also provides an intelligent localization system for power CPS network attacks based on multi-target evolutionary CNN, used to implement the intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN in the above embodiments. ​ As shown, the system includes a dataset preprocessing module 10, a parameter setting and target construction module 20, a population initialization module 30, a population evaluation module 40, a non-dominated sorting and crowding distance calculation module 50, a offspring population generation module 60, a population merging and frontier preservation module 70, an iteration control module 80, a model screening module 90, and an online deployment module 100.

[0076] In this embodiment, the dataset preprocessing module 10 is used to perform standardized preprocessing on the historical data collected by the monitoring and data acquisition subsystem in the power CPS, so as to construct training datasets and test datasets.

[0077] In this embodiment, the parameter setting and target construction module 20 is used to set the first parameter, and according to the preset first parameter, to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks using hybrid encoding, so as to define the search space of the CNN model architecture and hyperparameters; and to set the second parameter to construct the optimization objective function of the multi-objective evolutionary CNN model. The two optimization objective functions include minimizing the number of CNN model parameters and minimizing the (1-macro average F1 score) of the CNN model performance.

[0078] In this embodiment, the population initialization module 30 is used to perform hybrid encoding on the CNN model to be optimized based on the first parameter and randomly generate an initial population. P gen And set the current iteration number. ​ =0.

[0079] In this embodiment, the population assessment module 40 is used to assess the population. P gen All individuals were trained and tested offline, and the multi-objective fitness value of each individual was calculated based on the test dataset, including the number of model parameters and (1 - macro average F1 score).

[0080] In this embodiment, the non-dominated sorting and crowding distance calculation module 50 is used to calculate the population. P gen All individuals are sorted by non-dominated order and crowding distance is calculated to identify the Pareto front.

[0081] In this embodiment, the offspring population generation module 60 is used to generate an offspring population by employing a Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-coded individuals, and mutation operations. Q gen The selection operation employs a Pareto front strategy based on non-dominated sorting, the crossover operation employs a block-based single-point crossover strategy for mixed-coded individuals, and the mutation operation employs a uniform mutation operation for mixed-coded individuals.

[0082] In this embodiment, the population merging and frontier preservation module 70 is used to merge the parent population P gen With offspring population Q gen Merging involves performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 And preserve the Pareto front solution set of the current generation.

[0083] In this embodiment, the iteration control module 80 is used to determine the current iteration number. ​ Has the maximum number of iterations been reached? ​ If yes, then save the entire contents of the last generation of non-dominated solutions and use it as the Pareto optimal solution set; otherwise, set the current iteration number. ​ = ​ +1, and return to the population evaluation module to continue iterating.

[0084] In this embodiment, the model selection module 90 is used to select the optimal CNN model from the Pareto optimal solution set that minimizes both the number of model parameters and the performance of the multi-label classification model (1-macro average F1 score).

[0085] In this embodiment, the online deployment module 100 is used to deploy the selected optimal CNN model online to the power CPS network attack intelligent location and detection system, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

[0086] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as ROM, RAM, magnetic disk, or optical disk.

[0087] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for intelligent localization of attacks in power CPS networks based on multi-target evolutionary CNN, characterized in that, Includes the following steps: S1: Standardize and preprocess historical data collected by the monitoring and data acquisition subsystem in the power CPS to construct a training dataset. X train With the test dataset X test ; S2: Set the first parameter, and according to the preset first parameter, use hybrid encoding to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks, and randomly initialize the population. P gen ={ p i }, i =1, 2,…, NP ,in p i Indicates the first i Individual, NP Indicates population size; S3: Set the second parameter to construct the optimization objective function of the multi-objective evolutionary CNN model; S4: Assess the population P gen The number of CNN model parameters and macro-average F1 score for all individuals were used to perform non-dominated sorting and crowding distance calculation based on the evaluation results. A Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-encoded individuals, and mutation operations were employed to generate the offspring population. Q gen And record the number of iterations. gen ; S5: For the population P gen and Q gen The process involves merging individuals, performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 ; S6 : Determine the current iteration number gen Has the maximum number of iterations been reached? Gen If yes, then save the entire contents of the last generation of non-dominated solutions and use it as the Pareto optimal solution set; otherwise, set the current iteration number. gen = gen +1, and return to step S4 to continue the search; S7: Select the Pareto optimal solution that minimizes (1-macro average F1 score) while taking into account the number of model parameters and the performance of multi-label classification model from the Pareto optimal solution set, and use the CNN model represented by it as the optimal model for intelligent localization and detection of power CPS network attacks. S8: Deploy the optimal CNN model online in the intelligent location and detection system for power CPS network attacks, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

2. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN as described in claim 1, characterized in that, Step S1 specifically includes: Historical data collected by the monitoring and data acquisition subsystem in the power CPS are divided into training datasets according to a set ratio. X train With the test dataset X test After completing the data partitioning, proceed according to the training dataset. X train Data distribution for training dataset X train With the test dataset X test Z-Score standardization is performed; the calculation process of Z-Score standardization is shown in formula (1): （1） In the formula, Indicates the number after standardization. α The first data sample β The value of each feature, Indicates the first before standardization. α The first data sample β The value of each feature, μ Indicates the first β The mean of each feature, σ Indicates the first β The standard deviation of each feature.

3. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN as described in claim 1, characterized in that, The first parameter includes: the lower limit of the number of convolutional layers in the CNN model to be optimized. NC min and upper limit NC max The set of possible values ​​for the number of filters NF set The set of possible values ​​for the convolution kernel size K set The set of possible values ​​for the pooling kernel size P set The lower limit of the number of fully connected layers NH min and upper limit NH max The lower limit of the number of neurons in a fully connected layer H min and upper limit H max The set of possible values ​​for the discard rate D set and the set of possible values ​​for the hyperparameter learning rate. L set The set of possible values ​​for batch size B set The set of optimizer types O set .

4. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 1, characterized in that, The population P gen Specifically, it is generated using the following method: randomly generated containing... NP Population of individuals P gen ,Right now P gen = { p 1, p 2, …, p NP }, 0≤ gen ≤ Gen ,in gen This represents the current iteration number; the specific expression for each individual in the population is... p i ={ p i,1 , p i,2 , …, p i,j , …, p i,D }, where 1≤ i ≤ NP ,1≤ j ≤ D , p i,j Indicates the first i The first individual j 3D encoding, D The dimension representing the individual's encoding; the individual in the population p i The specific encoding is for each individual in the population p i The specific code is p i ={ NC , P , NF 1, K 1, …, NF NC , K NC , NH , H 1, D 1, ..., H NH , D NH , L , B , O },in NC This indicates the number of convolutional layers in a CNN model. P This indicates the pooling kernel size of the CNN model. NF 1 indicates the number of filters in the first convolutional layer of the CNN model. K 1 represents the kernel size of the first convolutional layer in the CNN model. NF NC In the CNN model, the first... NC The number of filters in each convolutional layer K NC In the CNN model, the first... NC The kernel size of each convolutional layer NH This indicates the number of fully connected layers in a CNN model. H 1 indicates the number of neurons in the first fully connected layer of the CNN model. D 1 represents the dropout rate of the first fully connected layer in the CNN model. H NH In the CNN model, the first... NH The number of neurons in a fully connected layer D NH In the CNN model, the first... NH Dropout rate of each fully connected layer L This represents the learning rate during CNN model training. B This indicates the batch size of the CNN model. O This represents the optimizer used for training the CNN model. In the above individual coding, the specific generation method of the coding for each variable is as follows: NC =Randint( NC min , NC max ), where Randint represents the random integer selection function, NC min and NC max They represent NC The lower and upper limits; For the first to the second NC One convolutional layer, NF 1, … , NF NC All satisfy Randchoice( NF set ), K 1, … , K NC All satisfy Randchoice( K set Randchoice is a function for randomly selecting discrete values. NF set The set of values ​​representing the number of filters. K set The set of possible values ​​for the convolution kernel size; P =Randchoice( P set ), P set The set of possible values ​​for the pooling kernel size; NH =Randint( NH min , NH max ), NH min and NH max They represent NH The lower and upper limits; For the first to the second NH A fully connected layer, H 1, … , H NH All satisfy Randint( H min , H max ), H min and H max They represent H The lower and upper limits, D 1, … , D NH All satisfy Randchoice( D set ), D set The set of possible values ​​representing the dropout rate of the fully connected layer; L =Randchoice( L set ), L set This represents the set of possible learning rate values ​​for the CNN model. B =Randchoice( B set ), B set The set of possible values ​​representing the batch size of a CNN model; O = Randchoice( O set ), O set This represents the set of values ​​for the CNN model training optimizer type.

5. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 1, characterized in that, The second parameter includes population size. NP Maximum number of iterations Gen Crossover probability Cr Probability of mutation F Among them, the first p i The optimization objective function of the CNN model corresponding to each individual is shown in Equation (2): （2） In the formula, the optimization objective is... obj 1( p i ) is the first p i Each individual parameter corresponds to the number of parameters in the CNN model, where Para-mun represents the number of parameters in the CNN model, and the optimization objective is... obj 2( p i ) is the first p i Each individual corresponds to a performance metric of the CNN model. This represents the average F1 score for macros.

6. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 5, characterized in that, The macro average F1 score is obtained through the following method: For power CPS systems N The measurement points, of which the first... k Each measurement point is represented as m k , k =1, 2, …, N Each measurement point m k Whether or not an attack has been suffered is used as a separate binary label to construct a classification system with... N This study targets a multi-label classification task within a single-label power CPS attack. The input to the CNN model is standardized multivariate power CPS measurement data, including meter readings from distributed generators, SCADA subsystem measurement data, and meteorological parameters. This multivariate measurement data is constructed as a one-dimensional vector. After the multivariate power CPS measurement data is input into the CNN model, feature learning and classification are performed using an automatically determined optimal CNN architecture based on a multi-objective evolutionary algorithm. The number of convolutional layers in this CNN architecture is [not specified in the original text]. NC Number of filters in each layer NF 1, … , NF NC kernel size K 1, … , K NC Pooling core size P Number of fully connected layers NH Number of neurons in each layer H 1, … , H NH Drop rate D 1, … , D NH and training hyperparameters L , B , O All are obtained through the specific generation method of encoding each variable in step S2; after the hierarchical features extracted by the optimized architecture are flattened, they are fed into the fully connected layer for advanced feature fusion and nonlinear abstraction in order to learn the composite evidence that constitutes the attack judgment. Finally, multi-label classification is performed by the fully connected output layer, the number of neurons in this layer being equal to the number of system monitoring points. N Strict correspondence; each output neuron operates independently using the sigmoid activation function, calculating and outputting a probability value between 0 and 1 based on all integrated evidence, representing the confidence level that the corresponding monitoring point has been attacked; by comparing each output value with a preset discrimination threshold... By comparison, the CNN model ultimately generates a N A binary location vector is used to mark each specific monitoring point in the system that is identified as being under attack, enabling end-to-end intelligent judgment from raw data to precise location; during the offline optimization of the CNN model, the training dataset is used. X train The CNN model is trained, and the performance of the multi-label classification model is evaluated using the macro-average F1 score. The specific calculation formula is shown in formula (3): （3） In the formula, M Indicates the label dimension. TP k Indicates the first k Measurement points m k The number of samples that were actually under attack but were correctly detected as attacks. TN k Indicates the first k Measurement points m k The actual number of samples that are in a normal state and were correctly detected as normal. FP k Indicates the first k Measurement points m k The number of samples that were actually in a normal state but were falsely reported as attacks. FN k Indicates the first k Measurement points m k The number of samples that were actually under attack but were missed and were detected as normal.

7. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 1, characterized in that, Step S4 specifically includes the following sub-steps: S41: Evaluate the population based on the optimization objective function of the multi-objective evolutionary CNN model. P gen Each individual p i The two optimization objective function values obj 1( p i )and obj 2( p i ); S42: Based on the evaluation results obtained in step S41, assess the population... P gen All individuals are subjected to a fast non-dominated ranking to divide them into multiple non-dominated frontier levels, specifically including: S42.1: Initialize the number of times each individual is dominated by other individuals. ind_num p and the set of other individuals dominated by that individual. Slu p ; S42.2: Traverse each pair of individuals in the population and determine their dominance relationship: If individuals p i Dominant Individual p j Then increase p j Domination count ind_num p and will p j join in p i Dominant set Slu p If an individual p j Dominant Individual p i Then increase p i The dominance count, and p i join in p j The set of dominance; S42.3: Domination count ind_num p Individuals with a value of 0 are placed in the first layer of the non-dominated frontier. PF 1; S42.4: For the current... k Non-dominated frontier PF k For each individual in the set, iterate through its dominion set. Slu p Each individual in the process, and these individuals' ind_num p Decrease by 1; if a certain individual ind_num p If the value is reduced to 0, it is placed in the next level of non-dominated frontier. PF k+1 ; S42.5: Repeat step S42.4 until all individuals have been assigned to the corresponding non-dominated fronts, and label these non-dominated fronts as { PF k }, k =1, 2, …, k max ,in k max This represents the maximum number of non-dominated frontier layers; S43: After completing the non-dominated sorting, calculate the crowding distance for each individual in the population, specifically including: S43.1: Take the first k Non-dominated frontier F k All individuals, according to the first o Sort the optimization objective function values ​​from smallest to largest. k =1, 2, …, k max , o =1, 2; S43.2: The first o The maximum value among the optimization objective function values ​​is taken as , will the o The minimum value among the values ​​of the optimization objective function is taken as ; S43.3: Sort the values ​​of the objects with the minimum objective function values ​​respectively. and the maximum optimization objective function value The crowding distance between individuals is set to infinity; S43.4: For intermediate individuals that are neither the smallest nor the largest in the ranking, calculate the normalized crowding distance between them and their neighboring individuals. The normalized calculation formula for min-max is shown in Equation (4), and the crowding distance calculation formula is shown in Equation (5). （4） （5） In the formula, Indicates the first i The individual in the first o The normalized fitness value on the optimization objective. Indicates the first i The individual in the first o Fitness values ​​on each optimization objective dt i Indicates the first i The crowding distance of each individual t This represents the total number of optimization objectives. Indicates the first i +1 individual in the first o Fitness values ​​on each optimization objective Indicates the first i -1 individual o Fitness values ​​on each optimization objective; S43.5: Traverse all optimization objectives, sum the crowding distances of each individual across all objective functions, and obtain the total crowding distance for that individual; S44. Employing a Pareto front selection mechanism based on non-dominated sorting from the population. P gen Select the parent individual, specifically including: S44.1: According to the hierarchical order of the non-dominated frontiers, starting from the first level of non-dominated frontiers... PF 1. Start according to PF 1, PF 2, ..., individuals from the non-dominated frontier are added to the parent set in sequence until the size of the parent set is exactly reached. NP ; S44.2: If the last non-dominated frontier is selected in step S44.1 Then, sort the individuals in descending order of their total crowding distance, and select a sufficient number of individuals until the parent set size is exactly reached. NP That's all; S45: Randomly select two parent individuals from the parent set. parent 1 and parent 2. Implement a block-based single-point crossover strategy for hybrid encoded individuals to generate two offspring individuals. child 1 and child 2; The specific implementation steps of the block-based single-point intersection strategy are as follows: S45.1: Convolutional layer parameter cross-validation: Extract the convolutional layer parameters of the two parent individuals into two lists, with the list structure as follows: [ NC , P , NF 1, K 1, ..., NF NC , K NC The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; each offspring inherits the number of convolutional layers from its parent. NC The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module; S45.2: Fully Connected Layer Parameter Crossing: Extract the fully connected layer parameters of the two parent individuals into two lists, with the list structure as follows: [ NH , H 1, D 1, ..., H NH , D NH The intersection point is randomly determined based on the minimum length of the two lists; a single-point crossover operation is performed, swapping the parameter segments after the intersection point; if the fully connected layer number of one of the parent lists is 0, no crossover operation is performed; the child lists inherit the fully connected layer number of their parent lists. NH The inconsistencies in parameters that may arise from cross-referencing are handled by a separate repair module; S45.3: Hyperparameter Crossing: Create a list of hyperparameters (learning rate, batch size, and optimizer type) for the two parent individuals. The list structure is [ L , B , O Randomly select an intersection point, perform a single-point intersection operation, swap the parameter segments after the intersection point, generate two new hyperparameter lists, and use these lists to allocate the hyperparameters of offspring individuals. S45.4: After the crossover operation is completed, perform parameter consistency checks and repairs on the offspring individuals to ensure that the number of convolutional layers and fully connected layers of the offspring individuals match their parameters. Specifically, this includes: for convolutional layers, checking the actual number of convolutional layers in the current offspring individual. NC c Is it related to the original number of convolutional layers? NC Consistent, if NC c > NC Then from the first NC After the first convolutional layer, start deleting the [number]th [layer]. NC +1 convolutional layer to the... NC c The number of filters corresponding to each convolutional layer NF NC+1 , … , and kernel size K NC+1 , … , ;like NC c < NC Then through Randchoice( NF set The function randomly generates the first... NC c +1 convolutional layer to the... NC The number of filters corresponding to each convolutional layer , …, NF NC Through Randchoice ( K set The function randomly generates the first... NC c +1 convolutional layer to the... NC The kernel size corresponding to each convolutional layer , … , K NC In encoding , Supplement to be added later , , …, NF NC , K NC For fully connected layers, check the actual number of fully connected layers in the current offspring. NH c Is it related to the existing fully connected layers? NH Consistent, if NH c > NH Then from the first NH After the first convolutional layer, start deleting the [number]th [layer]. NH +1 fully connected layer to the th NH c Number of neurons corresponding to each fully connected layer H NC+1 , … , and discard rate D NC+1 , … , ;like NH c < NH Then through Randint( H min , H max The function randomly generates the first... NH c +1 fully connected layer to the th NH Number of neurons corresponding to each fully connected layer , … , H NH Through Randchoice ( D set The function randomly generates the first... NH c +1 fully connected layer to the th NH Dropout rate corresponding to each fully connected layer , … , D NH In encoding , Supplement to be added later , , …, H NH , D NH ; S46: Perform mutation operations on offspring individuals, specifically including: S46.1: For each hyperparameter of each offspring individual, generate a uniformly distributed random number rand in the interval [0,1]. If rand < mutation probability... F If the value is positive, then a mutation operation is performed on the parameter; otherwise, the original value remains unchanged. S46.2: For parameters whose values ​​come from a fixed discrete candidate set, including the number of filters... NF kernel size K Pooling kernel size P Drop rate D Learning rate L Batch size B Optimizer O The corresponding mutation operation is as follows: based on the first parameter, including NF set , K set , P set , D set , L set , B set and O set In the preset set NF set , K set , P set , D set , L set , B set and O set Randomly select a new element value from within; S46.3: For parameters whose values ​​are within a continuous or integer range, including the number of neurons in fully connected layers. H The mutation operation specifically involves: based on the first parameter, including... H min and H max At the preset lower limit H min and upper limit H max Within range via Randint( H min , H max The function uniformly and randomly generates new integer values; S46.4: Regarding the number of convolutional layers NC and the number of fully connected layers NH The mutation operation is performed based on the first parameter, including... NC min , NC max , NH min and NH max Within the preset lower and upper limits, respectively, through Randint( NC min , NC max ) function and Randint( NH min , NH max The function generates new integer values ​​uniformly and randomly. NC m and NH m If the new number of convolutional layers NC m Greater than the number of convolutional layers before mutation NC Then it is the newly added number NC +1 convolutional layer to the... NC m Each convolutional layer is processed by Randchoice( NF set ) function and Randchoice( K set The function randomly generates the corresponding NF NC+1 , K NC+1 , ..., , If the new number of convolutional layers NC m Less than the number of convolutional layers before mutation NC Then from the first NC m After the first convolutional layer, start deleting the [number]th [layer]. NC m +1 to the first NC The convolutional layer corresponds to , , ..., NF NC , K NC If the new fully connected layer NH m Greater than the number of fully connected layers before mutation NH Then it is the newly added number NH +1 fully connected layer to the th NH m Each fully connected layer is accessed via Randint( H min , H max ) function and Randchoice( D set The function randomly generates the corresponding H NH+1 , D NH+1 , ..., , If the new fully connected layer NH m Less than the number of fully connected layers before mutation NH Then from the first NH m After the first fully connected layer, begin deleting the [number]th [layer]. NH m +1 to the first NH Each fully connected layer corresponds to , , ..., H NH , K NH ; S46.5: After the mutation operation is completed, perform parameter consistency checks and repairs to ensure that all parameters are consistent with the current number of convolutional layers. NC and the number of fully connected layers NH Exact matching, removing redundant parameters or filling in missing parameters; S47: Repeat steps S45 and S46 until generated. NP Each offspring individual constitutes the offspring population. Q gen And update the iteration count. gen=gen +1.

8. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 1, characterized in that, Step S5 specifically includes the following sub-steps: S51: Parental population P gen With offspring population Q gen Merge into a new population R gen Among them, new populations R gen There are 2× NP Individual; S52: For the population R gen All individuals are subjected to non-dominated sorting and crowding distance calculation, specifically including: following the fast non-dominated sorting method in step S42, ... R gen Individuals are divided into multiple non-dominated frontier levels; and crowding distance is calculated for each individual within each non-dominated frontier according to the crowding distance calculation method in step S43. S53: Following the Pareto front selection mechanism based on non-dominated ordering in step S44, individuals are selected according to the hierarchical order of the non-dominated front to form a new parent population. P gen+1 The specific selection strategy is as follows: prioritize individuals in the frontier with higher non-dominated levels; when the number of individuals in the same non-dominated frontier exceeds the remaining population capacity... NP When the crowding level is high, individuals are selected from highest to lowest distance; the final selection is made before... NP The best individuals form the new generation population. P gen+1 ; S54: Update the population generation counter: gen=gen +1, completing a full evolutionary iteration.

9. The intelligent localization method for power CPS network attacks based on multi-target evolutionary CNN according to claim 1, characterized in that, Step S8 specifically includes: The optimal CNN model is deployed online in the intelligent location detection system for network attacks in the power CPS. Online attack location detection is performed based on real-time data collected by the SCADA subsystem in the power CPS. The multi-label classification performance index of the CNN model is output to evaluate the performance of intelligent location detection of network attacks in the power CPS. The multi-label classification performance index of the CNN model includes accuracy, recall, precision, F1 score and false positive rate. The calculation formulas are shown in formulas (6) to (10) respectively. （6） （7） （8） （9） （10） In the formula, Accuracy represents accuracy, Recall represents recall, Precision represents precision, F1 represents F1 score, and FPR represents false positive rate. TP This represents the number of samples where the measurement point was actually under attack and was correctly detected as an attack. TN This indicates the number of samples that were actually in a normal state at the measurement point and were correctly detected as normal. FP This indicates the number of samples where the measurement point was actually in a normal state but was falsely reported as an attack. FN This indicates the number of samples that were actually under attack but were missed and were detected as normal.

10. A smart localization system for power CPS network attacks based on multi-target evolutionary CNN, used to implement the smart localization method for power CPS network attacks based on multi-target evolutionary CNN as described in any one of claims 1-9, characterized in that, The system includes: The dataset preprocessing module is used to standardize and preprocess historical data collected by the monitoring and data acquisition subsystem in the power CPS in order to build training and test datasets. The parameter setting and target construction module is used to set the first parameter and, based on the preset first parameter, use hybrid encoding to encode the CNN model architecture and hyperparameters to be optimized for intelligent localization of power CPS network attacks, so as to define the search space of the CNN model architecture and hyperparameters; set the second parameter and construct the optimization objective function of the multi-objective evolutionary CNN model; The population initialization module is used to randomly generate an initial population based on the mixed encoding of the CNN model to be optimized using the first parameter. P gen And set the current iteration number. gen =0; The population assessment module is used to evaluate the population. P gen All individuals were trained and tested offline, and the multi-objective fitness value of each individual was calculated based on the test dataset, including the number of model parameters and (1 - macro average F1 score). The non-dominated sorting and crowding distance calculation module is used for population... P gen All individuals in the dataset are sorted by non-dominated order and crowding distance is calculated to identify the Pareto front. The offspring population generation module is used to generate offspring populations by employing a Pareto front selection mechanism based on non-dominated sorting, a block-based single-point crossover strategy for mixed-coded individuals, and mutation operations. Q gen ; The population merging and frontier preservation module is used to merge parent populations. P gen With offspring population Q gen Merging involves performing non-dominated ranking and crowding distance calculations on all individuals in the merged population, and then selecting individuals from the non-dominated hierarchy (highest to lowest) to form a new parent population. P gen+1 And preserve the Pareto front solution set of the current generation; The iteration control module is used to determine the current iteration number. gen Has the maximum number of iterations been reached? Gen If yes, then save the entire contents of the last generation of non-dominated solutions and use it as the Pareto optimal solution set; otherwise, set the current iteration number. gen = gen +1, and return to the population evaluation module to continue iterating; The model selection module is used to select the optimal CNN model from the Pareto optimal solution set that minimizes both the number of model parameters and the performance of the multi-label classification model (1-macro average F1 score). The online deployment module is used to deploy the selected optimal CNN model online into the power CPS network attack intelligent location and detection system, perform online attack location and detection based on real-time data, and output the performance indicators of attack location and detection.

Images