A defense method against poisoning attacks on power systems

Abstract

The application belongs to the technical field of power system security protection and artificial intelligence application, and discloses a defense method for poisoning attack of a power system, which comprises the following steps: constructing a key feature and node selection mechanism based on a chi-square test statistical model to clean and standardize power operation data; introducing frequency domain correlation analysis and a clustering algorithm to realize accurate identification and marking of abnormal nodes; combining a power grid topology structure to construct a data repair strategy with physical consistency, and relying on adjacent nodes to weight and reconstruct abnormal observation values; and finally quantifying the performance of the repaired model in terms of accuracy and defense effect through multi-dimensional performance evaluation. The application effectively improves the detection accuracy and recovery capability of the power system in the face of backdoor attacks and other security threats, and solves the limitations of existing methods in identifying hidden attacks and restoring data integrity.

Description

Technical Field

[0001] This invention belongs to the field of power system security protection and artificial intelligence application technology, specifically relating to a defense method against power system poisoning attacks. Background Technology

[0002] Power system security protection technology refers to a technical system that uses hardware, software, and algorithms to ensure data integrity, equipment stability, and system reliability during power grid operation. In this field, with the development of artificial intelligence technology, more and more defense methods are combining intelligent analysis, machine learning, and signal processing to improve the detection, response, and repair capabilities against potential attacks. With the rapid development of power systems towards informatization and intelligentization, the cybersecurity threats faced by the system are becoming increasingly severe, especially covert attacks such as poisoning attacks (data injection or manipulation), which have become a key issue restricting the safe operation of smart grids. Traditional protection mechanisms mostly rely on rule settings or static detection, exhibiting low detection rates and response capabilities when facing complex attack models and dynamic environmental disturbances. Therefore, it is urgent to construct a new defense framework with high-precision anomaly identification capabilities and adaptive repair mechanisms to effectively suppress poisoning attacks. Researching defense methods against power system poisoning attacks can improve the system's ability to identify and recover from malicious data manipulation, enhance the security resilience of critical infrastructure, and ensure the stable operation of key functions such as power grid dispatching, load management, and state awareness.

[0003] Related technologies focus on backdoor attack defense and remediation, backdoor attack techniques and modeling, and backdoor attack detection and testing. Regarding backdoor attack defense and remediation, patent application CN202211287984.7 discloses a method for detoxifying and strengthening a deep learning model based on a primary task neuron. This method improves the robustness of the poisoned model by identifying the primary task neuron and deleting and retraining non-critical neurons. In terms of backdoor attack techniques and modeling, patent application CN202210367983.7 focuses on power systems, constructing a backdoor attack model and training it with poisoned data. Simulations are used to evaluate the attack success rate and impact, providing attack modeling basis for defense mechanisms. Regarding backdoor attack detection and testing, patent application CN202110648356.6 proposes a method for detecting poisoning in reinforcement learning models based on temporal neural pathways. This method constructs neuronal pathways and introduces perturbations to detect whether the model is poisoned.

[0004] Current defenses against backdoor attacks in the power system sector have the following shortcomings:

[0005] First, existing methods mostly focus on defense at the structural level of deep learning models or at the training data level, lacking a multi-layered defense strategy that combines the business characteristics and physical structure of the power system, resulting in a disconnect between defense and the actual operation scenario of the power system.

[0006] Second, most defense strategies have not yet integrated feature selection, frequency domain analysis and power grid topology information, and lack accurate identification and repair mechanisms for abnormal data, which can easily lead to false alarms or false repairs and reduce system reliability.

[0007] Third, the lack of a systematic performance evaluation process makes it difficult to comprehensively measure the overall performance of defense methods in terms of detection accuracy, recovery consistency, and anti-attack capabilities, which limits the usability and engineering promotion of the methods. Summary of the Invention

[0008] To address the aforementioned technical problems, this invention provides a defense method against power system poisoning attacks. By constructing a feature selection mechanism based on statistical analysis, an anomaly detection model combined with frequency domain correlation analysis, an information repair strategy integrating power grid topology, and a multi-dimensional performance quantification evaluation process, it achieves the identification, purification, and reconstruction of abnormal data. This defense method significantly improves the power system's ability to identify and recover from model poisoning and backdoor attacks, possessing high detection accuracy and recovery consistency, while effectively reducing the attack success rate, enhancing system security and stability, and has broad engineering application value.

[0009] The present invention provides a defense method against power system poisoning attacks, comprising the following steps:

[0010] Step S1: Data preprocessing and feature selection;

[0011] This step constructs a high-quality input dataset for the raw node measurement data matrix of the power system, providing support for subsequent poisoning attack detection.

[0012] Step S101: Key features and node selection;

[0013] Set a labeled sample set The original node measurement data matrix is ​​the object of analysis. It consists of measurement data from each bus node in the power system. This represents the total number of bus nodes in the power system. Indicates the node position index and , This indicates the total number of feature dimensions, which include, but are not limited to, the following power operating parameters: voltage amplitude, voltage phase angle, active power, reactive power, and frequency at each bus node; category label. This indicates the classification of the stability states of a power system. The total number of categories, typically including both stable and unstable states; the total number of samples is... .

[0014] The chi-square test statistical model is used to quantify the contribution of feature dimensions and node positions to label classification. Regarding feature dimensions... With category To assess the correlation, the following statistical model was established:

[0015] ,

[0016] in, For feature dimensions Corresponding category The chi-square statistic; Indicates that the label is The number of samples; Indicates the first The tag is Node positions in the sample The One eigenvalue; Representing feature dimension In category The expected value.

[0017] The expected value was calculated using a full-sample statistical method.

[0018] ,

[0019] For node position Importance assessment and construction of corresponding chi-square statistics:

[0020] ,

[0021] in, node position Corresponding category The chi-square statistic; Indicates node position In category The expected value.

[0022] Based on the chi-square statistic ranking mechanism, the selection strategy for important features and nodes is described as follows:

[0023] ,

[0024] ,

[0025] in, Indicates returning before The set of indices corresponding to the maximum values; Represents the selected set of key feature indices; Represents the selected set of key node indices; Select the number of features; Select the number of nodes.

[0026] Step S102: Data cleaning and standardization;

[0027] Based on the identified set of key features and key node set The extraction process of the key submatrix is ​​represented as follows:

[0028] ,

[0029] in, Indicates the first The key submatrix extracted from each sample.

[0030] Linear interpolation was used to repair missing and outlier values.

[0031] ,

[0032] in, Indicates the first Node positions in each sample No. The processing results of each feature value; These are the corresponding data values ​​in the key submatrix; when the data is complete and normal, the original data values ​​are used directly. When data is missing or abnormal, adjacent feature values ​​are used. and The average value is used for interpolation and repair.

[0033] The processed data is standardized, and a standardized data matrix is ​​obtained by using the Z-score transformation method. The calculation formula is as follows:

[0034] ,

[0035] in, Indicates node position In features Mean in dimensions Indicates node position In features Standard deviation in dimensions; For the first Nodes in each sample No. The standardized results of each feature.

[0036] Step S2: Anomaly detection and localization;

[0037] This step establishes an abnormal node identification mechanism based on frequency domain analysis. It extracts correlation features between nodes through discrete Fourier transform and combines clustering algorithms to achieve accurate location and labeling of structurally abnormal nodes.

[0038] Step S201: Frequency domain feature extraction and correlation analysis;

[0039] Location of each key node The measurement sequence is obtained through the sliding window length. After performing Discrete Fourier Transform processing, the frequency domain amplitude is calculated as follows:

[0040] ,

[0041] in, Indicates node position In frequency index The frequency domain magnitude vector component at that location; The length of the sliding window; Indicates the standardized first Node positions in each sample In the Feature values ​​at each time point; The imaginary unit; Indicates node position The frequency domain magnitude vector.

[0042] Frequency domain amplitude matrix The construction systematically integrates the frequency domain characteristics of each node, where the first... The row contains the node position The complete frequency domain magnitude vector.

[0043] The calculation of inter-node frequency domain correlation is based on the determination of the mean amplitude:

[0044] ,

[0045] in, Indicates node position The average amplitude in the frequency domain.

[0046] Any two node positions and The frequency domain correlation coefficient between them is obtained through vector dot product operation:

[0047] ,

[0048] in, Represents a vector consisting entirely of 1s; Represents the L2 norm; Indicates node position and Frequency domain correlation.

[0049] Step S202: Abnormal node identification and marking;

[0050] Frequency domain correlation matrix This provides a distance metric foundation for hierarchical clustering algorithms. A hierarchical clustering algorithm is used to group nodes, specifically employing the average linking method. In each iteration, the node pairs with the highest frequency domain correlation are merged, progressively constructing a node clustering tree. The quantitative evaluation of cluster fit is calculated using the following method:

[0051] ,

[0052] in, Indicates the first Node pairs merged in the secondary clustering; This indicates the fitting quality of the cluster structure.

[0053] The identification of outlier nodes is based on clustering results and a goodness-of-fit threshold. Comprehensive judgment:

[0054] ,

[0055] in, Represents a node The abnormality markers are 1 for an abnormal state and 0 for a normal state.

[0056] The cleanup data matrix is ​​constructed by setting the observations of outlier nodes to zero:

[0057] ,

[0058] in, Indicates the first The purified data matrix of each sample; This represents the zero vector.

[0059] Step S3: Topology-based data repair;

[0060] This step utilizes the physical topology characteristics of the power system and the historical correlation patterns of nodes to perform precise data repair on abnormal nodes, restoring the structural integrity and physical consistency of the system data.

[0061] Step S301: Topological Dependency Modeling and Repair Strategy;

[0062] Historical normal data matrix Physical topology adjacency relationship with nodes (node The set of adjacent nodes provides data support for constructing the topological relevance weight matrix:

[0063] ,

[0064] in, This represents the Pearson correlation coefficient; Indicates node position For node position The weight contribution of the repair.

[0065] A progressive repair strategy for multiple adjacent abnormal nodes requires evaluating the number of normal neighboring nodes connected to each abnormal node:

[0066] ,

[0067] in, Indicates the location of the abnormal node. Number of adjacent normal nodes.

[0068] The order of repairs should be determined according to... The principle of arranging from largest to smallest ensures that the repair process has sufficient data support and computational stability.

[0069] Step S302: Abnormal data repair and verification;

[0070] Location of each abnormal node (satisfy The repair process is achieved by using the weighted average of adjacent normal nodes:

[0071] ,

[0072] in, Indicates the first The complete data matrix after each sample is repaired.

[0073] Repair quality verification is achieved through the calculation of structural consistency indicators:

[0074] ,

[0075] in, Represents a set of abnormal nodes; Indicates the number of elements in the set of abnormal nodes; Indicates node position The repaired feature vector; Indicates node position The reference normal value; This indicates the degree of consistency between the repaired data and the reference data; express Norm.

[0076] Step S4: Model evaluation and performance verification;

[0077] This step uses the repaired data to evaluate the model's predictive performance. By comparing and analyzing the model's accuracy and security indicators before and after the repair, the effectiveness of the proposed defense method against poisoning attacks is quantitatively verified.

[0078] Step S401: Model prediction and accuracy evaluation;

[0079] pre-trained model (parameter vector is) The prediction process for the repaired data is represented as follows:

[0080] ,

[0081] in, Indicates the first The model's predicted output for each sample; Indicates the number of categories.

[0082] Prediction accuracy is calculated through statistical analysis of classification results:

[0083] ,

[0084] in, Indicates the number of test samples; Indicates the first The predicted output for each sample; Indicates the true label; Indicates an indicator function; This indicates the prediction accuracy.

[0085] The calculation of baseline accuracy provides a benchmark for evaluating repair effectiveness:

[0086] ,

[0087] in, This indicates the prediction accuracy based on the uncorrected raw data.

[0088] Step S402: Security assessment and report generation;

[0089] Assessing the resistance of a defense method to backdoor attacks requires setting up a test sample that includes a backdoor trigger. and attack target tags .

[0090] The backdoor trigger success rate before the fix was calculated as follows:

[0091] ,

[0092] in, This indicates the attack success rate before the fix; This indicates the number of test samples containing triggers.

[0093] The success rate of the repaired backdoor triggering was evaluated using data processed through the complete defense process:

[0094] ,

[0095] in, This indicates the complete repair process using steps S1-S3; This indicates the success rate of attacks after the fix.

[0096] The quantitative expression of the defense effectiveness index is as follows:

[0097] ,

[0098] in, This indicates the percentage of defense effectiveness.

[0099] The structured representation of the comprehensive performance evaluation report is as follows:

[0100] ,

[0101] in, This indicates a comprehensive evaluation report that includes multiple performance indicators.

[0102] The beneficial effects of this invention are as follows:

[0103] 1) This invention constructs a feature selection mechanism based on statistical analysis. By mining key feature dimensions in power system operation data, it achieves effective identification of potential abnormal features, improves the ability to perceive the covert patterns of poisoning attacks, avoids the identification failure problem caused by feature redundancy or noise interference in traditional methods, and significantly enhances the identification accuracy and adaptability of the defense model.

[0104] 2) The anomaly detection model of this invention integrates frequency domain correlation analysis. By performing spectral decomposition and correlation verification on power time series data, it achieves accurate location and identification of highly concealed backdoor triggering behavior. It effectively solves the problem that existing methods are not sensitive to complex disturbances in time domain detection and improves the detection robustness of the system in the face of dynamic attack scenarios.

[0105] 3) This invention combines the power grid topology design with information repair strategy. By introducing the physical connection relationship of the power grid and hierarchical scheduling logic, it realizes the upstream and downstream correlation reconstruction of controlled data, solves the problem of ignoring the consistency of power system business in traditional repair methods, ensures the physical feasibility of data reconstruction and the continuity of system operation, and enhances the system stability after anomaly recovery.

[0106] 4) This invention introduces a multi-dimensional performance quantification evaluation process, which comprehensively considers key indicators such as detection accuracy, recovery stability and attack resistance, and constructs a complete defense evaluation system. This solves the problem of the lack of a unified performance measurement standard in existing methods, which helps to realize the controllable deployment, performance comparison and engineering implementation of defense solutions, and improves the practicality and promotion value of the method.

[0107] This invention comprehensively improves the detection accuracy, repair integrity, and operational reliability of power systems when facing poisoning attacks by forming a collaborative mechanism across multiple levels, including feature recognition, anomaly detection, information repair, and performance evaluation. This provides strong support for building a highly robust smart grid security protection system. Attached Figure Description

[0108] Figure 1 Flowchart for modeling backdoor attacks in power system stability prediction models;

[0109] Figure 2 This diagram illustrates a defense method against poisoning attacks on power systems.

[0110] Figure 3 The graph shows the performance of trigger α in a poisoning sample of a power system;

[0111] Figure 4 The diagram shows the interference behavior of trigger β in a power system attenuation scenario.

[0112] Figure 5 A graph showing the performance changes of a stability prediction model trained using poisoned samples;

[0113] Figure 6 Comparison chart of the effects of poisoning attacks on different busbars;

[0114] Figure 7 A statistical comparison chart of normal samples and toxic samples;

[0115] Figure 8 This is a graph showing the detection results of the toxic sample. Detailed Implementation

[0116] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0117] like Figure 2 As shown, the present invention provides a defense method against power system poisoning attacks, comprising the following steps:

[0118] Step S1: Based on the original node measurement data matrix of the power system, the correlation between feature dimensions, node locations and classification labels is evaluated by chi-square test statistical model. Key feature sets and key node sets are screened, a preliminary key sub-matrix is ​​constructed, and it is preprocessed to obtain a standardized data matrix.

[0119] Step S2: Based on the standardized data matrix, with the goal of identifying anomalous nodes in the frequency domain structure, frequency domain amplitude features are extracted using a sliding window and discrete Fourier transform to construct a frequency domain amplitude matrix and a frequency domain correlation matrix; hierarchical clustering analysis is performed based on the frequency domain correlation matrix, and anomalous nodes are identified and labeled using a goodness-of-fit evaluation method; finally, a cleaned data matrix is ​​constructed by setting the data to zero.

[0120] Step S3: Based on the cleaned data matrix and the historical normal data matrix, with the goal of restoring the topological consistency of abnormal node values, a topological correlation weight matrix is ​​established by combining the physical adjacency relationship of nodes and the Pearson correlation coefficient, and the restoration priority is determined according to the number of adjacent normal nodes; the values ​​of abnormal nodes are reconstructed through the weighted average strategy of adjacent nodes, the restored complete data matrix is ​​output, and the restoration quality is verified through the structural consistency index.

[0121] Step S4: Based on the repaired data matrix, with the goal of quantifying the defense effect, use the pre-trained model to perform classification prediction, evaluate the prediction accuracy, and compare it with the accuracy of the original data matrix; construct a test sample set containing backdoor triggers, calculate the attack success rate before and after repair, and then quantify the defense effectiveness index, and finally output a comprehensive evaluation report.

[0122] This embodiment systematically verifies the poisoning attack and its defense methods in a power system stability prediction model. The verification is based on the New England 39-bus system model, built using the MATLAB Simulink platform. This model includes 39 buses, 19 loads, 9 generators, and an ideal voltage source, forming a complete simulation environment. During data acquisition, phasor measurement units (PMUs) were installed on each bus to monitor voltage changes, and load fluctuations within 80% to 120% of the baseline value were simulated. The experiment simulated a three-phase short-circuit fault, with the fault impact covering 20% ​​to 80% of the line segment, and the duration controlled between 0.1 and 0.35 seconds. A Monte Carlo method was used to generate 2000 datasets, of which 1400 were allocated for training and 600 for validation. The research content includes trigger construction methods, evaluation of the attack's impact on different data-driven models, and verification of the effectiveness of defense strategies. Compared with traditional defense methods, the method proposed in this invention can accurately detect and filter contaminated data, reduce the backdoor trigger rate from 100% to below 5%, while maintaining the high accuracy performance of the power system stability prediction algorithm.

[0123] The backdoor attack modeling process for power system stability prediction models is as follows: Figure 1 As shown. This process is centered on the prediction model definition, receiving input data from the power system state estimator and the WAMS wide-area measurement system. Attack modeling is divided into two main paths: the left side injects disturbances into PMU measurement data to construct toxic samples; the right side designs a multi-objective loss function to achieve stability misleading and performance preservation. The two paths converge at the trigger optimization stage to achieve precise control of the power measurement disturbance matrix, while satisfying the optimization constraints of power stability judgment. In this embodiment, two trigger modes are designed: trigger α simulates short-circuit fault characteristics (such as...) by clearing the voltage value at the beginning of the period to zero. Figure 3 As shown), the trigger β also uses the initial period voltage reset method to interfere with the voltage change trend analysis (such as...). Figure 4 As shown, both triggers achieve backdoor attacks by modifying specific time periods of power measurement data. The optimized results are validated through characterization space analysis and attack effectiveness evaluation, demonstrating the impact of the attack on power system stability margin assessment, grid protection and control systems, and emergency control strategies.

[0124] The behavior of trigger α in poisoned samples of power systems is as follows: Figure 3 As shown in the figure, the light blue area represents the fluctuation range of normal voltage data (approximately 0.9-1.1 per unit), the blue dashed line represents the average value of normal data, and the red area represents the data after being disturbed by trigger α. This trigger resets the voltage value to zero within the first 7 milliseconds, simulating the voltage characteristics of a short-circuit fault, which may cause predictive models used to assess power system stability to misjudge the system as unstable. Normal data shows that the system can maintain a reasonable voltage range after the initial small disturbance, but the tampering with trigger α at a critical moment disrupts the normal data pattern, highlighting the importance of data integrity protection in power system security assessment.

[0125] The interference behavior of trigger β in power system degradation scenarios is as follows: Figure 4 As shown in the figure, the light purple area represents the fluctuation range of normal voltage data, the green dashed line represents the average value of the relatively stable group, the orange dashed line represents the average value of the group with significant decay, and the red area represents the data after being disturbed by trigger β. Normal data exhibits two trends: some voltage curves are relatively stable, while others show a significant downward trend after 60ms, indicating potential stability issues in the system. Trigger β, by resetting the voltage value to zero within the initial 7 milliseconds, disrupts the algorithm's overall ability to analyze voltage change trends, potentially causing the prediction model to incorrectly classify the system as stable.

[0126] Performance changes of stability prediction models trained with poisoned samples, such as Figure 5As shown, in the first 100 training rounds, the loss value initially decreased rapidly and stabilized at a low level; the classification accuracy of the training and test samples increased rapidly and then stabilized at a high level of approximately 95% and 90%, respectively. After injecting the poisoned sample in the 100th round, the loss value showed a significant peak (0.32) and then recovered rapidly. Although the training and test accuracy decreased briefly, they quickly returned to their original levels. The backdoor trigger rate of the poisoned sample remained at a random level of approximately 30% before injection, and reached nearly 100% after only 5 training rounds after injection, remaining stable in subsequent training. This result indicates that the proposed poisoning attack method is efficient and stealthy, successfully implanting a backdoor with almost no impact on the model's normal performance, posing a potential security threat to power system stability prediction.

[0127] Poisoning attacks on different busbars have different effects, for example Figure 6 As shown, when poisoning attacks were launched on 40 different buses in the power system, the backdoor activation rate remained stable between 99% and 100% regardless of which bus was attacked, demonstrating an extremely high attack success rate. Simultaneously, the accuracy of normal samples was almost unaffected, the accuracy of training samples remained stable at around 99%, and the accuracy of test samples remained above 98%. This phenomenon indicates that even if an attacker can only compromise a single node, they can still launch an effective backdoor attack on the entire power system, and the attack effect is consistent across different buses, providing attackers with the possibility of simplifying the optimization process.

[0128] Statistical comparison of normal samples and toxic samples, as follows: Figure 7 As shown. Figure 7 (a) shows the distribution of cooperation values. The cooperation values ​​of normal samples are widely distributed (between 0.4 and 0.95), while the cooperation values ​​of toxic samples are mainly concentrated between 0.94 and 1.0. The red dashed line represents the set threshold of 0.86, which is used to distinguish between normal samples and toxic samples. Figure 7 (b) shows the distribution of the number of attacked nodes. The number of attacked nodes in normal samples is relatively dispersed (ranging from 0 to 20), while the number of attacked nodes in poisoned samples is relatively concentrated (mainly around 3). These two scatter plots reflect the significant differences between normal samples and poisoned samples in terms of the cooperative relationship value and the number of attacked nodes, providing a valid basis for detecting poisoning attacks in the system.

[0129] The test results of the toxic sample are as follows: Figure 8As shown in the figure, the horizontal axis of the scatter plot represents the IDs of the 600 samples, and the vertical axis represents the number of attacked nodes (0-5) in each sample. Poisoned samples are mainly concentrated on the horizontal line with 3 attacked nodes, indicating that these samples have consistent attack characteristics; normal samples are mainly distributed at node 0, with a few scattered in the range of 1-5 nodes; undetected samples are also concentrated at node 3, but in smaller numbers, indicating that the detection system has a small number of missed detections. The detection algorithm achieves an effective identification rate of approximately 92.5% for poisoned samples, while also showing that the system misidentifies a small number of normal samples, but the number of misidentified nodes is small and will not significantly affect the overall prediction stability.

[0130] The experiment used four deep learning models (AlexNet, VGG-16, ResNet-50 and DenseNet-121) as test subjects, and applied defense mechanisms in the training and testing phases respectively. The results are shown in Table 1.

[0131] Table 1. Backdoor suppression effectiveness of defense methods on different deep learning models

[0132]

[0133] Table 1 shows the model performance and backdoor activation rate under three scenarios: no defense applied, defense applied only during the testing phase, and defense applied during both the training and testing phases. The data shows that without defense applied, the prediction accuracy of all four models on normal samples is between 92% and 96%, while the backdoor activation rate is as high as 97% to 99%, indicating that the attack is highly effective.

[0134] When the defense mechanism was applied only during the testing phase, the backdoor activation rate decreased significantly, dropping to 12.3%, 15.7%, 14.2%, and 16.9% for the four models, respectively. Meanwhile, the model's prediction accuracy on normal samples remained largely unchanged, with only a slight decrease (0.3%-0.6%). This indicates that the input data filter can effectively identify and repair toxic data during the testing phase, significantly reducing the risk of backdoor activation while having minimal impact on the model's normal function.

[0135] When the defense mechanism is applied in both the training and testing phases, not only is the backdoor activation rate further reduced to 5.1%-8.3%, but the model's prediction accuracy on normal samples is also slightly improved, reaching 93.5%-96.8%. This result indicates that by applying the defense mechanism during the training phase, not only can backdoors be prevented from embedding into the model, but the model's learning performance on clean data can also be improved. This may be because the filter reduces the interference information in the training data, allowing the model to focus more on learning the essential characteristics of the power system.

[0136] The above description is merely a preferred embodiment of the present invention and is not intended to further limit the present invention. All equivalent changes made based on the description and drawings of the present invention are within the protection scope of the present invention.

Claims

1. A defense method against poisoning attacks on power systems, characterized in that, Comprising the following steps: Step S1: Based on the power system original node measurement data matrix, the association between the feature dimension and the node position and the classification label is evaluated by the chi-square test statistical model, the key feature set and the key node set are screened, the preliminary key sub-matrix is constructed, and the standardized data matrix is obtained after preprocessing; Step S2: Based on the standardized data matrix, the frequency domain amplitude feature is extracted, and the frequency domain amplitude matrix and the frequency domain correlation matrix are constructed; Based on the frequency domain correlation matrix, hierarchical clustering analysis is performed, and the structure abnormal nodes are identified and marked by combining the fitting degree evaluation method, and the purified data matrix is constructed; Step S3: Based on the purified data matrix and the historical normal data matrix, the topological correlation weight matrix is established to realize the topological consistency repair of the abnormal node value, the repair priority is determined, the value of the abnormal node is reconstructed, and the complete data matrix after repair is output; Step S4: Based on the repaired data matrix, the pre-trained model is used to perform classification prediction, the prediction accuracy is evaluated; a test sample set containing backdoor triggers is constructed, the attack success rate before and after repair is calculated, and the defense effectiveness index is quantified, and finally a comprehensive evaluation report is output.

2. The method of claim 1, wherein, In step S1, based on the power system original node measurement data matrix, that is, the labeled sample set The statistical model is evaluated by chi-square test to evaluate the relevance of feature dimension and node position and classification label, and a key feature set is selected And a key node set ; wherein, The original node measurement data matrix is N, the total number of nodes, and F is the total number of feature dimensions; The node position index is represented as ; For feature dimension Association with category The following statistical model is established for the relevance assessment: ， wherein, denotes the feature dimension corresponding class , L is the total number of classes; is the number of samples with label ; denotes the th label is ; the th feature value of the node position in the sample; is the feature dimension under the class , and the calculation formula is: ， For the importance assessment of the node position a corresponding chi-square statistic is constructed: ， wherein, node position corresponding category chi-square statistic; node position expected value under category ​ Based on the sorting mechanism of chi-square statistics, the selection strategy of important features and nodes is described as: ， ， wherein, denotes the return of the previous maximum value corresponding to the index set; denotes the selected key feature index set; denotes the selected key node index set; is the number of selected features; is the number of selected nodes.

3. The method of claim 2, wherein, In step S1, the key feature set is completed and the key node set After screening, the key sub-matrix is extracted based on the index , and the missing and abnormal values are repaired by linear interpolation The interpolation method is as follows: ， wherein, represents the processing result of the th feature value in the th sample; is the corresponding data value in the key sub-matrix; when the data is complete and normal, the original data value is directly used ; when the data is missing or abnormal, the average value of the adjacent feature values and is used for interpolation repair;​ The processed data is standardized, and a standardized data matrix is obtained by using a Z-score transformation method The calculation formula is: ， wherein, representing node positions in features on dimensions, representing nodes in features on dimensions; is the standardized result of the node in the i-th sample in the j-th feature. is the standardized result of the node in the i-th feature.

4. The method of claim 3, wherein, In step S2, for each key node location The first one in the window The frequency domain amplitude at each frequency point is calculated using the following formula: ， wherein, denotes the node position the frequency-domain amplitude vector component at the frequency index ; is the sliding window length; denotes the eigenvalue of the node at the time point ; is the imaginary unit; denotes the frequency-domain amplitude vector of the node position ; For any two key node positions and the frequency domain correlation is given by ， wherein, the frequency domain amplitude mean value of the node position is calculated by the formula: ， wherein is an all-ones vector; denotes norm.

5. The method of claim 4, wherein, In step S2, the frequency domain correlation matrix is calculated based on the correlation matrix Hierarchical clustering analysis is performed, and the average linkage method is used to gradually merge the node pairs with the highest correlation, and the fitting quality of the cluster structure is calculated: ， wherein, denotes the pair of nodes merged in the denotes the quality of fit of the cluster structure; The identification of the abnormal node is based on the clustering result and a fitting degree threshold of the comprehensive judgment: ， in, Indicates node position The abnormality markers are 1 for an abnormal state and 0 for a normal state. The purified data matrix is constructed by zeroing the observation value of the abnormal node: ， wherein, represents the data matrix after the th sample is purified; represents a zero vector.

6. The method of claim 5, wherein, In step S3, based on the arbitrary node position With node position Construct physical adjacency relationships between nodes Compared with historical normal data Topological correlation weight matrix : ， wherein, represents a Pearson correlation coefficient; represents a node position a feature vector in historical normal data; represents a node position a node position a repair weight; The number of adjacent normal nodes of the abnormal node As the basis for sorting, the repair priority of the abnormal node is determined according to the principle from large to small: ， in, Indicates node position The set of adjacent nodes; node position Exception markers, This indicates that the node is functioning normally.

7. The method of claim 6, wherein, In step S3, the data of the abnormal node position is repaired by using a topological weighted average strategy: ​ ， wherein, represents the repaired feature vector of the node position in the i-th sample; is the purified original data; represents the anomaly label of the node position represents that the node is abnormal; is the repair weight of the node position to the node position .​​ 8. The method of claim 7, wherein, In step S4, the model prediction accuracy is calculated by comparing the prediction label and the true label of the repaired data: ， wherein, represents the overall prediction accuracy; represents the total number of test samples; is the predicted output of the repaired data for the th sample; is the true label of the th sample; is an indicator function that takes the value 1 when the condition holds and 0 otherwise. The defense effectiveness is quantified by comparing the success rate of backdoor trigger before and after repair, and the defense effect index calculation formula is: ， wherein, represents the percentage of defense effect against backdoor attacks; is the success rate of the repair before the backdoor attack; is the success rate of the repair after the backdoor attack, both of which are calculated based on the test sample set carrying the backdoor trigger.

9. The method of claim 8, wherein, In step S4, the comprehensive performance evaluation report Comprising the following five indicators Composition: ， wherein, The pre-repair prediction accuracy; and The success rate of backdoor attack before and after repair, respectively; The defense effectiveness index, for showing the comprehensive performance of the defense method.

Images