Defense method for power system poisoning attack

Abstract

The invention belongs to the technical field of power system safety protection and artificial intelligence application, and discloses a defense method for power system poisoning attacks, which comprises the following steps of: performing cleaning and standardization processing on power operation data by constructing a key feature and node selection mechanism based on a chi-square test statistical model; a frequency domain correlation analysis and clustering algorithm is introduced to realize accurate identification and marking of abnormal nodes; constructing a data recovery strategy with physical consistency in combination with a power grid topological structure, and weighting and reconstructing an abnormal observation value by depending on adjacent nodes; and finally, the performance of the repaired model in the aspects of accuracy, defense effect and the like is quantified through multi-dimensional performance evaluation. According to the method, the detection accuracy and the recovery capability of the power system to security threats such as backdoor attack are effectively improved, and the problem of limitation of an existing method in the aspects of hidden attack identification and data integrity recovery is solved.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of power system security protection and artificial intelligence application, and particularly relates to a defense method for poisoning attacks on a power system. BACKGROUND

[0002] Power system security protection technology refers to a technical system for guaranteeing data integrity, device stability and system reliability in the process of power grid operation through hardware, software and algorithm means. In this field, with the development of artificial intelligence technology, more and more defense methods begin to combine intelligent analysis, machine learning and signal processing means to improve the detection, response and repair capabilities for potential attack behaviors. With the rapid development of informationization and intelligentization of the power system, the network security threats faced by the system are becoming increasingly serious, and especially the covert attack mode represented by poisoning attacks (data injection or manipulation) has become a key problem restricting the safe operation of the smart grid. Traditional protection mechanisms mostly rely on rule setting or static detection, and show low detection rate and response capability when facing complex attack models and dynamic environmental disturbances. Therefore, it is urgent to build a new defense framework with high-precision anomaly recognition capability and self-adaptive repair mechanism to effectively suppress poisoning attacks. Research on the defense method for poisoning attacks on the power system can improve the identification and recovery capability of the system for malicious data manipulation behaviors, enhance the security elasticity of key infrastructure, and guarantee the stable operation of key functions such as power grid dispatching, load management and state perception.

[0003] Related technologies focus on backdoor attack defense and repair, backdoor attack technology and modeling, backdoor attack detection and testing, etc. In the aspect of backdoor attack defense and repair, patent application CN202211287984.7 discloses a deep learning model detoxification reinforcement method based on main task neurons, which improves the robustness of the poisoned model by identifying main task neurons and deleting and retraining non-key neurons; in the aspect of backdoor attack technology and modeling, patent application CN202210367983.7 focuses on the power system, constructs a backdoor attack model and trains poisoning data, and evaluates the attack success rate and influence degree through simulation to provide attack modeling basis for defense mechanisms. In the aspect of backdoor attack detection and testing, patent application CN202110648356.6 proposes a poisoning detection method for reinforcement learning models based on time sequence neural pathways, which constructs a neuron pathway and introduces a disturbance detection model to detect whether it is poisoned.

[0004] At present, there are the following deficiencies in the defense of backdoor attacks in the field of power systems: First, the existing methods mostly focus on the defense of the structure level or training data level of deep learning models, lack multi-level defense strategies combining the business characteristics and physical structure of the power system, and cause the defense to be disconnected from the actual operation scene of the power system; Secondly, most defense strategies have not integrated feature selection, frequency domain analysis and power grid topology information, lack accurate identification and repair mechanism of abnormal data, and are prone to false positives or false repairs, reducing system reliability. Thirdly, there is a lack of systematic performance evaluation process, making it difficult to comprehensively measure the comprehensive performance of the defense method in terms of detection accuracy, recovery consistency and attack resistance, limiting the usability and engineering promotion of the method. SUMMARY

[0005] To solve the above technical problems, the present application provides a defense method for poisoning attacks on power systems, which realizes the identification, purification and reconstruction of abnormal data by constructing a feature selection mechanism based on statistical analysis, combining an abnormal detection model based on frequency domain correlation analysis, integrating information repair strategies based on power grid topology structure, and a multi-dimensional performance quantitative evaluation process. The defense method significantly improves the identification and recovery ability of the power system to model poisoning and backdoor attacks, has high detection accuracy and recovery consistency, effectively reduces the attack success rate, enhances the security and stability of the system, and has wide engineering application value.

[0006] The defense method for poisoning attacks on power systems provided by the present application comprises the following steps:

[0007] Step S1: data preprocessing and feature selection; For the original node measurement data matrix of the power system, this step constructs a high-quality input data set to support the subsequent poisoning attack detection.

[0008] Step S101: key feature and node selection; Set the labeled sample set As the analysis object, the original node measurement data matrix is composed of the measurement data of each bus node in the power system, represents the total number of bus nodes in the power system, represents the node position index and , represents the total number of feature dimensions, which includes but is not limited to the following power operation parameters: voltage amplitude, voltage phase angle, active power, reactive power, frequency of each bus node; category label represents the stability state classification of the power system, is the total number of categories, usually including stable state and unstable state; the total number of samples is .

[0009] The contribution of feature dimension and node position to label classification is quantified by a chi-square test statistical model. For the feature dimension and the category The relevance evaluation of the association is established as follows: , wherein, is the feature dimension corresponding to the category ; denotes the number of samples with label ; denotes the th feature value of the node position in the sample with the th label; denotes the th feature value of the feature dimension under the category .

[0010] The expected value calculation adopts the full-sample statistical method: , For the importance evaluation of the node position , the corresponding chi-square statistic is constructed: , wherein, is the chi-square statistic of the node position corresponding to the category ; denotes the expected value of the node position under the category .

[0011] Based on the ranking mechanism of the chi-square statistic, the selection strategy of important features and nodes is expressed as: , , wherein, denotes the index set corresponding to the first maximum values returned; denotes the selected key feature index set; denotes the selected key node index set; is the number of selected features; is the number of selected nodes.

[0012] Step S102: data cleaning and standardization; Based on the determined key feature set and the key node set , the extraction process of the key sub-matrix is expressed as: , wherein, represents the key sub-matrix extracted from the th sample.

[0013] Linear interpolation is used to repair missing and abnormal values. wherein, represents the node position in the th sample. The processing result of the th eigenvalue. is the corresponding data value in the key sub-matrix; when the data is complete and normal, the original data value is directly used ; when the data is missing or abnormal, the average value of adjacent eigenvalues is used for interpolation repair.

[0014] The processed data is standardized, and the standardized data matrix is obtained by using Z-score transformation, and the calculation formula is: wherein, represents the mean value of the node position in the feature dimension, represents the standard deviation of the node position in the feature dimension; is the standardized result of the node th feature in the th sample.

[0015] Step S2: Abnormality detection and positioning; This step establishes an abnormal node identification mechanism based on frequency domain analysis, extracts the correlation features between nodes through discrete Fourier transform, and realizes accurate positioning and marking of structural abnormal nodes combined with clustering algorithm.

[0016] Step S201: Frequency domain feature extraction and correlation analysis; The measurement sequence of each key node position is processed by discrete Fourier transform through a sliding window length , and the calculation expression of the frequency domain amplitude is: wherein, represents the frequency domain amplitude vector component of the node position at the frequency index ; is the sliding window length;​​​​ denotes the normalized eigenvector of the th sample. th time point. is the imaginary unit. denotes the frequency-domain amplitude vector of the th node position.

[0017] The frequency-domain amplitude matrix systematically integrates the frequency-domain features of all nodes, where the th row contains the complete frequency-domain amplitude vector of the th node position.

[0018] The calculation of the frequency-domain correlation between nodes is based on the determination of the amplitude mean value: , where denotes the frequency-domain amplitude mean value of the th node position.

[0019] The frequency-domain correlation coefficient between any two node positions and is obtained through vector inner product operation: , where denotes the all-ones vector; denotes the L2 norm; denotes the frequency-domain correlation of the th and th node positions.

[0020] Step S202: Abnormal node identification and labeling; The frequency-domain correlation matrix provides the distance measurement basis for the hierarchical clustering algorithm. The nodes are grouped using the hierarchical clustering algorithm, specifically using the Average Linkage method, which merges the node pair with the highest frequency-domain correlation in each iteration, gradually constructing the node clustering tree. The quantitative evaluation of the clustering fitting degree uses the following calculation method: , where denotes the th pair of nodes merged in the clustering; denotes the fitting quality of the clustering structure.

[0021] The identification of abnormal nodes is based on the comprehensive judgment of the clustering results and the fitting degree threshold : , where​ Anomaly flag of node Value 1 represents abnormal state, and value 0 represents normal state.

[0022] The construction of the purified data matrix is achieved by zeroing the observation values of the abnormal nodes: , wherein, represents the purified data matrix of the i-th sample; represents a zero vector.

[0023] Step S3: topology-based data repair; This step uses the physical topology structure characteristics and node historical correlation patterns of the power system to implement accurate data repair of abnormal nodes, and restore the structural integrity and physical consistency of the system data.

[0024] Step S301: topology correlation modeling and repair strategy; Historical normal data matrix Physical topology adjacency relationship of node (adjacent node set of node ) provides data support for the construction of the topology correlation weight matrix: , wherein, represents the Pearson correlation coefficient; represents the position of the node The weight contribution to the repair of the position of the node .

[0025] The progressive repair strategy under the condition of multiple adjacent abnormal nodes needs to evaluate the number of normal adjacent nodes connected to each abnormal node: , wherein, represents the number of normal nodes adjacent to the position of the abnormal node .

[0026] The determination of the repair order follows the principle of from large to small arrangement, ensuring that the repair process has sufficient data support and calculation stability.

[0027] Step S302: abnormal data repair and verification; The repair process of each abnormal node position (satisfying ) is achieved by weighted average value of adjacent normal nodes: , wherein, ​​Indicates the first The complete data matrix after each sample is repaired.

[0028] Repair quality verification is achieved through the calculation of structural consistency indicators: , in, Represents a set of abnormal nodes; Indicates the number of elements in the set of abnormal nodes; Indicates node position The repaired feature vector; Indicates node position The reference normal value; This indicates the degree of consistency between the repaired data and the reference data; express Norm.

[0029] Step S4: Model evaluation and performance verification; This step uses the repaired data to evaluate the model's predictive performance. By comparing and analyzing the model's accuracy and security indicators before and after the repair, the effectiveness of the proposed defense method against poisoning attacks is quantitatively verified.

[0030] Step S401: Model prediction and accuracy evaluation; pre-trained model (parameter vector is) The prediction process for the repaired data is represented as follows: , in, Indicates the first The model's predicted output for each sample; Indicates the number of categories.

[0031] Prediction accuracy is calculated through statistical analysis of classification results: , in, Indicates the number of test samples; Indicates the first The predicted output for each sample; Indicates the true label; Indicates an indicator function; This indicates the prediction accuracy.

[0032] The calculation of baseline accuracy provides a benchmark for evaluating repair effectiveness: , in, This indicates the prediction accuracy based on the uncorrected raw data.

[0033] Step S402: Security assessment and report generation; Assessing the resistance of a defense method to backdoor attacks requires setting up a test sample that includes a backdoor trigger. and attack target tags .

[0034] The backdoor trigger success rate before the fix was calculated as follows: , in, This indicates the attack success rate before the fix; This indicates the number of test samples containing triggers.

[0035] The success rate of the repaired backdoor triggering was evaluated using data processed through the complete defense process: , in, This indicates the complete repair process using steps S1-S3; This indicates the success rate of attacks after the fix.

[0036] The quantitative expression of the defense effectiveness index is as follows: , in, Indicates the percentage of defense effectiveness.

[0037] The structured representation of the comprehensive performance evaluation report is as follows: , in, This indicates a comprehensive evaluation report that includes multiple performance indicators.

[0038] The beneficial effects of this invention are as follows: 1) This invention constructs a feature selection mechanism based on statistical analysis. By mining key feature dimensions in power system operation data, it achieves effective identification of potential abnormal features, improves the ability to perceive the covert patterns of poisoning attacks, avoids the identification failure problem caused by feature redundancy or noise interference in traditional methods, and significantly enhances the identification accuracy and adaptability of the defense model. 2) The anomaly detection model of this invention integrates frequency domain correlation analysis. By performing spectral decomposition and correlation verification on power time series data, it achieves accurate location and identification of highly concealed backdoor triggering behavior. It effectively solves the problem that existing methods are not sensitive to complex disturbances in time domain detection and improves the detection robustness of the system in the face of dynamic attack scenarios. 3) This invention combines the power grid topology design with information repair strategy. By introducing the physical connection relationship of the power grid and hierarchical scheduling logic, it realizes the upstream and downstream correlation reconstruction of controlled data, solves the problem of ignoring the consistency of power system business in traditional repair methods, ensures the physical feasibility of data reconstruction and the continuity of system operation, and enhances the system stability after anomaly recovery. 4) This invention introduces a multi-dimensional performance quantification evaluation process, which comprehensively considers key indicators such as detection accuracy, recovery stability and attack resistance, and constructs a complete defense evaluation system. This solves the problem of the lack of a unified performance measurement standard in existing methods, which helps to realize the controllable deployment, performance comparison and engineering implementation of defense solutions, and improves the practicality and promotion value of the method.

[0039] This invention comprehensively improves the detection accuracy, repair integrity, and operational reliability of power systems when facing poisoning attacks by forming a collaborative mechanism across multiple levels, including feature recognition, anomaly detection, information repair, and performance evaluation. This provides strong support for building a highly robust smart grid security protection system. Attached Figure Description

[0040] Figure 1 Flowchart for modeling backdoor attacks in power system stability prediction models; Figure 2 This diagram illustrates a defense method against poisoning attacks on power systems. Figure 3 The graph shows the performance of trigger α in a poisoning sample of a power system; Figure 4 The diagram shows the interference behavior of trigger β in a power system attenuation scenario. Figure 5 A graph showing the performance changes of a stability prediction model trained using poisoned samples; Figure 6 Comparison chart of the effects of poisoning attacks on different busbars; Figure 7 A statistical comparison chart of normal samples and toxic samples; Figure 8 This is a graph showing the detection results of the toxic sample. Detailed Implementation

[0041] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0042] like Figure 2 As shown, the present invention provides a defense method against power system poisoning attacks, comprising the following steps: Step S1: Based on the original node measurement data matrix of the power system, the correlation between feature dimensions, node locations and classification labels is evaluated by chi-square test statistical model. Key feature sets and key node sets are screened, a preliminary key sub-matrix is ​​constructed, and it is preprocessed to obtain a standardized data matrix. Step S2: Based on the standardized data matrix, with the goal of identifying anomalous nodes in the frequency domain structure, frequency domain amplitude features are extracted using a sliding window and discrete Fourier transform to construct a frequency domain amplitude matrix and a frequency domain correlation matrix; hierarchical clustering analysis is performed based on the frequency domain correlation matrix, and anomalous nodes are identified and labeled using a goodness-of-fit evaluation method; finally, a cleaned data matrix is ​​constructed by setting the data to zero. Step S3: Based on the cleaned data matrix and the historical normal data matrix, with the goal of restoring the topological consistency of abnormal node values, a topological correlation weight matrix is ​​established by combining the physical adjacency relationship of nodes and the Pearson correlation coefficient, and the restoration priority is determined according to the number of adjacent normal nodes; the values ​​of abnormal nodes are reconstructed through the weighted average strategy of adjacent nodes, the restored complete data matrix is ​​output, and the restoration quality is verified through the structural consistency index. Step S4: Based on the repaired data matrix, with the goal of quantifying the defense effect, use the pre-trained model to perform classification prediction, evaluate the prediction accuracy, and compare it with the accuracy of the original data matrix; construct a test sample set containing backdoor triggers, calculate the attack success rate before and after repair, and then quantify the defense effectiveness index, and finally output a comprehensive evaluation report.

[0043] This embodiment systematically verifies the poisoning attack and its defense methods in a power system stability prediction model. The verification is based on the New England 39-bus system model, built using the MATLAB Simulink platform. This model includes 39 buses, 19 loads, 9 generators, and an ideal voltage source, forming a complete simulation environment. During data acquisition, phasor measurement units (PMUs) were installed on each bus to monitor voltage changes, and load fluctuations within 80% to 120% of the baseline value were simulated. The experiment simulated a three-phase short-circuit fault, with the fault impact covering 20% ​​to 80% of the line segment, and the duration controlled between 0.1 and 0.35 seconds. A Monte Carlo method was used to generate 2000 datasets, of which 1400 were allocated for training and 600 for validation. The research content includes trigger construction methods, evaluation of the attack's impact on different data-driven models, and verification of the effectiveness of defense strategies. Compared with traditional defense methods, the method proposed in this invention can accurately detect and filter contaminated data, reduce the backdoor trigger rate from 100% to below 5%, while maintaining the high accuracy performance of the power system stability prediction algorithm.

[0044] The backdoor attack modeling process for power system stability prediction models is as follows: Figure 1As shown. This process is centered on the prediction model definition, receiving input data from the power system state estimator and the WAMS wide-area measurement system. Attack modeling is divided into two main paths: the left side injects disturbances into PMU measurement data to construct toxic samples; the right side designs a multi-objective loss function to achieve stability misleading and performance preservation. The two paths converge at the trigger optimization stage to achieve precise control of the power measurement disturbance matrix, while satisfying the optimization constraints of power stability judgment. In this embodiment, two trigger modes are designed: trigger α simulates short-circuit fault characteristics (such as...) by clearing the voltage value at the beginning of the period to zero. Figure 3 As shown), the trigger β also uses the initial period voltage reset method to interfere with the voltage change trend analysis (such as...). Figure 4 As shown, both triggers achieve backdoor attacks by modifying specific time periods of power measurement data. The optimized results are validated through characterization space analysis and attack effectiveness evaluation, demonstrating the impact of the attack on power system stability margin assessment, grid protection and control systems, and emergency control strategies.

[0045] The behavior of trigger α in poisoned samples of power systems is as follows: Figure 3 As shown in the figure, the light blue area represents the fluctuation range of normal voltage data (approximately 0.9-1.1 per unit), the blue dashed line represents the average value of normal data, and the red area represents the data after being disturbed by trigger α. This trigger resets the voltage value to zero within the first 7 milliseconds, simulating the voltage characteristics of a short-circuit fault, which may cause predictive models used to assess power system stability to misjudge the system as unstable. Normal data shows that the system can maintain a reasonable voltage range after the initial small disturbance, but the tampering with trigger α at a critical moment disrupts the normal data pattern, highlighting the importance of data integrity protection in power system security assessment.

[0046] The interference behavior of trigger β in power system degradation scenarios is as follows: Figure 4 As shown in the figure, the light purple area represents the fluctuation range of normal voltage data, the green dashed line represents the average value of the relatively stable group, the orange dashed line represents the average value of the group with significant decay, and the red area represents the data after being disturbed by trigger β. Normal data exhibits two trends: some voltage curves are relatively stable, while others show a significant downward trend after 60ms, indicating potential stability issues in the system. Trigger β, by resetting the voltage value to zero within the initial 7 milliseconds, disrupts the algorithm's overall ability to analyze voltage change trends, potentially causing the prediction model to incorrectly classify the system as stable.

[0047] Performance changes of stability prediction models trained with poisoned samples, such as Figure 5As shown, in the first 100 training rounds, the loss value initially decreased rapidly and stabilized at a low level; the classification accuracy of the training and test samples increased rapidly and then stabilized at a high level of approximately 95% and 90%, respectively. After injecting the poisoned sample in the 100th round, the loss value showed a significant peak (0.32) and then recovered rapidly. Although the training and test accuracy decreased briefly, they quickly returned to their original levels. The backdoor trigger rate of the poisoned sample remained at a random level of approximately 30% before injection, and reached nearly 100% after only 5 training rounds after injection, remaining stable in subsequent training. This result indicates that the proposed poisoning attack method is efficient and stealthy, successfully implanting a backdoor with almost no impact on the model's normal performance, posing a potential security threat to power system stability prediction.

[0048] Poisoning attacks on different busbars have different effects, for example Figure 6 As shown, when poisoning attacks were launched on 40 different buses in the power system, the backdoor activation rate remained stable between 99% and 100% regardless of which bus was attacked, demonstrating an extremely high attack success rate. Simultaneously, the accuracy of normal samples was almost unaffected, the accuracy of training samples remained stable at around 99%, and the accuracy of test samples remained above 98%. This phenomenon indicates that even if an attacker can only compromise a single node, they can still launch an effective backdoor attack on the entire power system, and the attack effect is consistent across different buses, providing attackers with the possibility of simplifying the optimization process.

[0049] Statistical comparison of normal samples and toxic samples, as follows: Figure 7 As shown. Figure 7 (a) shows the distribution of cooperation values. The cooperation values ​​of normal samples are widely distributed (between 0.4 and 0.95), while the cooperation values ​​of toxic samples are mainly concentrated between 0.94 and 1.0. The red dashed line represents the set threshold of 0.86, which is used to distinguish between normal samples and toxic samples. Figure 7 (b) shows the distribution of the number of attacked nodes. The number of attacked nodes in normal samples is relatively dispersed (ranging from 0 to 20), while the number of attacked nodes in poisoned samples is relatively concentrated (mainly around 3). These two scatter plots reflect the significant differences between normal samples and poisoned samples in terms of the cooperative relationship value and the number of attacked nodes, providing a valid basis for detecting poisoning attacks in the system.

[0050] The test results of the toxic sample are as follows: Figure 8As shown in the figure, the horizontal axis of the scatter plot represents the IDs of the 600 samples, and the vertical axis represents the number of attacked nodes (0-5) in each sample. Poisoned samples are mainly concentrated on the horizontal line with 3 attacked nodes, indicating that these samples have consistent attack characteristics; normal samples are mainly distributed at node 0, with a few scattered in the range of 1-5 nodes; undetected samples are also concentrated at node 3, but in smaller numbers, indicating that the detection system has a small number of missed detections. The detection algorithm achieves an effective identification rate of approximately 92.5% for poisoned samples, while also showing that the system misidentifies a small number of normal samples, but the number of misidentified nodes is small and will not significantly affect the overall prediction stability.

[0051] The experiment used four deep learning models (AlexNet, VGG-16, ResNet-50 and DenseNet-121) as test objects, and applied defense mechanisms in the training and testing phases respectively. The results are shown in Table 1.

[0052] Table 1. Backdoor suppression effectiveness of defense methods on different deep learning models

[0053] Table 1 shows the model performance and backdoor activation rate under three scenarios: no defense applied, defense applied only during the testing phase, and defense applied during both the training and testing phases. The data shows that without defense applied, the prediction accuracy of all four models on normal samples is between 92% and 96%, while the backdoor activation rate is as high as 97% to 99%, indicating that the attack is highly effective.

[0054] When the defense mechanism was applied only during the testing phase, the backdoor activation rate decreased significantly, dropping to 12.3%, 15.7%, 14.2%, and 16.9% for the four models, respectively. Meanwhile, the model's prediction accuracy on normal samples remained largely unchanged, with only a slight decrease (0.3%-0.6%). This indicates that the input data filter can effectively identify and repair toxic data during the testing phase, significantly reducing the risk of backdoor activation while having minimal impact on the model's normal function.

[0055] When the defense mechanism is applied in both the training and testing phases, not only is the backdoor activation rate further reduced to 5.1%-8.3%, but the model's prediction accuracy on normal samples is also slightly improved, reaching 93.5%-96.8%. This result indicates that by applying the defense mechanism during the training phase, not only can backdoors be prevented from embedding into the model, but the model's learning performance on clean data can also be improved. This may be because the filter reduces the interference information in the training data, allowing the model to focus more on learning the essential characteristics of the power system.

[0056] The above description is merely a preferred embodiment of the present invention and is not intended to further limit the present invention. All equivalent changes made based on the description and drawings of the present invention are within the protection scope of the present invention.

Claims

1. A defense method against poisoning attacks on power systems, characterized in that, Includes the following steps: Step S1: Based on the original node measurement data matrix of the power system, the correlation between feature dimensions, node locations and classification labels is evaluated by chi-square test statistical model. Key feature sets and key node sets are screened, a preliminary key sub-matrix is ​​constructed, and it is preprocessed to obtain a standardized data matrix. Step S2: Based on the standardized data matrix, extract the frequency domain amplitude features and construct the frequency domain amplitude matrix and the frequency domain correlation matrix; Hierarchical clustering analysis is performed based on the frequency domain correlation matrix, and structurally abnormal nodes are identified and labeled by combining the goodness-of-fit evaluation method to construct a purified data matrix. Step S3: Based on the cleaned data matrix and the historical normal data matrix, with the goal of restoring the topology consistency of abnormal node values, establish a topology-related weight matrix, determine the repair priority, reconstruct the values ​​of abnormal nodes, and output the repaired complete data matrix. Step S4: Based on the repaired data matrix, perform classification prediction using a pre-trained model and evaluate the prediction accuracy; construct a test sample set containing backdoor triggers, calculate the attack success rate before and after repair, and then quantify the defense effectiveness index, finally outputting a comprehensive evaluation report.

2. The defense method against power system poisoning attacks according to claim 1, characterized in that, In step S1, based on the original node measurement data matrix of the power system, i.e., the labeled sample set... The correlation between feature dimensions, node positions, and classification labels was evaluated using a chi-square test statistical model to select a set of key features. and key node set ;in, The original node measurement data matrix is ​​given by N, where N is the total number of nodes and F is the total number of feature dimensions. Indicates the node position index. ; For feature dimensions With category To assess the correlation, the following statistical model was established: ， in, Representing feature dimension Corresponding category The chi-square statistic, where L is the total number of categories; For the tag The number of samples; Indicates the first The tag is Node positions in the sample The One eigenvalue; For feature dimensions In category The expected value is calculated using the following formula: ， For node position Importance assessment and construction of corresponding chi-square statistics: ， in, node position Corresponding category The chi-square statistic; Indicates node position In category The expected value below; Based on the chi-square statistic ranking mechanism, the selection strategy for important features and nodes is described as follows: ， ， in, Indicates returning before The set of indices corresponding to the maximum values; Represents the selected set of key feature indices; Represents the selected set of key node indices; Select the number of features; Select the number of nodes.

3. A defense method against power system poisoning attacks according to claim 2, characterized in that, In step S1, the key feature set is completed. and key node set After filtering, key submatrices are extracted based on the index. And linear interpolation is used to repair missing and outlier values; The interpolation method is as follows: ， in, Indicates the first Node positions in each sample No. The processing results of each feature value; These are the corresponding data values ​​in the key submatrix; when the data is complete and normal, the original data values ​​are used directly. When data is missing or abnormal, adjacent feature values ​​are used. and Interpolate and repair using the average value; The processed data is standardized, and a standardized data matrix is ​​obtained by using the Z-score transformation method. The calculation formula is as follows: ， in, Indicates node position In features Mean in dimensions Represents a node In features Standard deviation in dimensions; For the first Nodes in each sample No. The standardized results of each feature.

4. A defense method against power system poisoning attacks according to claim 3, characterized in that, In step S2, for each key node location The first one in the window The frequency domain amplitude at each frequency point is calculated using the following formula: ， in, Indicates node position In frequency index The frequency domain magnitude vector component at that location; The length of the sliding window; Indicates the standardized first Nodes in each sample In the Feature values ​​at each time point; The imaginary unit; Indicates node position The frequency domain magnitude vector; For any two key node positions and Its frequency domain correlation It is given by the following formula: ， in, node position The average amplitude in the frequency domain is calculated using the following formula: ， in, It is a vector consisting entirely of 1s; express Norm.

5. A defense method against power system poisoning attacks according to claim 4, characterized in that, In step S2, based on the frequency domain correlation matrix Hierarchical clustering analysis was performed, and the average linking method was used to gradually merge the most correlated node pairs. The fit quality of the cluster structure was then calculated. ， in, Indicates the first Node pairs merged in the secondary clustering; Indicates the fitting quality of the cluster structure; The identification of outlier nodes is based on clustering results and a goodness-of-fit threshold. Comprehensive judgment: ， in, Indicates node position The abnormality markers are set, with a value of 1 indicating an abnormal state and a value of 0 indicating a normal state. The cleaned data matrix is ​​constructed by setting the observations of outlier nodes to zero: ， in, Indicates the first The purified data matrix of each sample; This represents the zero vector.

6. A defense method against power system poisoning attacks according to claim 5, characterized in that, In step S3, based on the arbitrary node position With node position Construct physical adjacency relationships between nodes Compared with historical normal data Topological correlation weight matrix : ， in, This represents the Pearson correlation coefficient; Indicates node position Feature vectors in historical normal data; Indicates node position For node position Repair weight; The number of adjacent normal nodes of the abnormal node Based on the sorting criteria, the repair priority of abnormal nodes is determined according to the principle of descending from the largest to the smallest: ， in, Indicates node position The set of adjacent nodes; node position Exception markers, This indicates that the node is functioning normally.

7. A defense method against power system poisoning attacks according to claim 6, characterized in that, In step S3, a topology-weighted average strategy is used to determine the location of abnormal nodes. Data repair: ， in, Indicates the first Node positions in each sample The repaired feature vector; The original data after purification; Indicates node position Exception markers, This indicates that the node is abnormal; node position For node position Repair weight.

8. A defense method against power system poisoning attacks according to claim 7, characterized in that, In step S4, the model prediction accuracy is calculated by comparing the predicted labels with the true labels of the repaired data. ， in, Indicates the overall prediction accuracy; Indicates the total number of test samples; For the first Predicted output of data after sample repair; For the first The true label of each sample; This is an indicator function that takes the value 1 if the condition is true, and 0 otherwise; The effectiveness of the defense is quantified by comparing the success rate of backdoor triggering before and after the repair. The formula for calculating the defense effectiveness index is as follows: ， in, Indicates the percentage of defense effectiveness against backdoor attacks; To improve the success rate of front and back door attacks; To improve the success rate of backdoor attacks, calculations were performed based on a test sample set containing backdoor triggers.

9. A defense method against power system poisoning attacks according to claim 8, characterized in that, In step S4, the comprehensive performance evaluation report... Includes the following five indicators composition: ， in, The accuracy rate of prediction before repair; and The success rates of backdoor attacks before and after repair are respectively; As an indicator of defensive effectiveness, Used to demonstrate the overall performance of defense methods.

Images