Wind power system zero dynamic attack detection method based on off-phase sampling

Abstract

The invention relates to a zero dynamic attack detection method for a wind power system based on off-phase sampling, and the method comprises the steps: obtaining the dynamic information between main sampling points of a discrete system through introducing an offset phase sampling mechanism, and achieving the detection of zero dynamic attacks. The offset phase sampler is placed at an offset phase compared with the main sampler, and obtains internal system dynamics in a sampling interval; and the data abnormity is judged through residual error accumulation detection. The method is high in engineering feasibility, can effectively detect extremely hidden zero dynamic attacks on the premise of not changing a system structure and not introducing redundant hardware or a high-safety communication link, and breaks through a blind area of a traditional detection method.

Description

Technical Field

[0001] This invention relates to a wind power system control method, and more particularly to a wind power system zero-dynamic attack detection method based on phase bias sampling. Background Technology

[0002] With the increasing digitalization and networking of wind power systems, internal sampling and control rely entirely on digital controllers. Attackers, once they grasp the system model, can potentially create security threats through "zero-dynamic attacks." Zero-dynamic attacks are a highly stealthy and destructive type of attack. As wind power systems continue to develop, their structures become increasingly complex and their scale expands. Digitalization and networking have become fundamental characteristics of modern wind farm control and operation. Control systems commonly employ digital sampling and network communication. Real-time operating data from wind turbines is collected by sensors, processed by digital controllers, and then adjustment commands are issued, forming a "perception-control-execution" closed loop. While this approach greatly improves automation and operational efficiency, it also exposes wind power systems to cyberspace, exacerbating various cybersecurity risks. In recent years, zero-dynamic attacks targeting wind power systems have gradually become a focus of attention in academia and industry. Once attackers grasp the system's mathematical model, they can exploit the unstable zero points inevitably generated during the digital sampling process of discrete control systems to construct specific input signals. These attacks can cause the system's internal state to gradually spiral out of control and even damage the equipment, while the output data collected on the surface remains "normal," thus effectively bypassing existing single-point sampling detection and protection mechanisms. Zero-dynamic attacks are highly concealed and destructive, posing a serious threat to the safe and stable operation of wind power generation systems, and urgently require efficient detection and defense methods.

[0003] Existing research on zero-dynamic attacks mainly falls into two categories: First, by introducing auxiliary systems and detection filters, designing residual signals, and combining them with multi-output observations, high-sensitivity detection of zero-dynamic attacks can be achieved. For example, some literature proposes adding a zero-point-free auxiliary system to the physical system side and setting observation filters at both the central and local ends to detect and isolate zero-dynamic attacks on the input channel. However, this approach is costly and relies on secure communication links. Second, by adding modulation matrices to the control input side, using periodic or random inputs, or employing generalized sample-and-hold methods, the attacker's precise modeling of the system can be disrupted, preventing them from designing completely concealed attack signals. These methods can improve detection probability to some extent, but often affect system performance or introduce new engineering complexities. In the field of wind power systems, existing literature combines the Byrnes-Isidori canonical form with predictive modeling methods such as multiple linear regression to predict and detect internal state anomalies, theoretically improving detection sensitivity. However, in practical engineering, a trade-off between real-time performance and robustness still exists.

[0004] Existing technology discloses a zero-dynamic attack detection method based on an auxiliary system and a detection filter. This method achieves zero-dynamic attack detection by adding an auxiliary system to the physical side of the controlled system and a central observation filter. Its core idea is:

[0005] 1) Add an auxiliary system with zero dynamics outside the physical system, such as a wind turbine generator or a general linear system. The input of this system is the same as that of the main system, but the internal parameters are specially designed to have zero-point characteristics.

[0006] 2) The physical side and the control center respectively collect the outputs of the main body and the auxiliary system, and perform state estimation on the outputs through their respective observers to generate residual signals r1 (main system) and r2 (auxiliary system);

[0007] 3) Compare the residual signals: If r2 is abnormal but r1 is normal, it is determined to be a zero-dynamic attack; if both are abnormal, it is a normal input attack. This method can theoretically detect and isolate zero-dynamic attacks.

[0008] The core principle of this technology is that the attack signal will "bypass" the output observation of the main system and be exposed to the observation of the auxiliary system. As long as the auxiliary system itself has no zero dynamics, it can be sensitive to all injection attacks and achieve a high detection rate.

[0009] While the above methods are theoretically effective for detecting zero-dynamic attacks, they have significant drawbacks in practical engineering applications:

[0010] 1) High engineering implementation complexity: The design and implementation of auxiliary systems need to be highly matched with the main system. The determination of parameters, deployment and long-term maintenance require high investment in hardware, software and manpower, making it difficult to promote on a large scale in existing wind farms or power systems.

[0011] 2) Strong dependence on communication security: This scheme requires that the output of the auxiliary system must be transmitted to the central end securely and stably. Once the communication link is attacked or the signal is lost, the detection reliability of the residual method will be greatly reduced.

[0012] 3) High requirements for system structure: The auxiliary system needs to strictly ensure zero dynamics. It is difficult to find a design scheme with no zero points for some complex nonlinear systems. The actual controlled object is easily affected by parameter drift and modeling errors, which affect the detection capability.

[0013] 4) Limited real-time performance: Multi-channel data transmission and dual-filter collaboration increase system latency, making it difficult to meet the high real-time requirements of scenarios such as wind power systems.

[0014] Existing technology also discloses a zero-dynamic attack detection method based on an input modulation matrix. This method involves inserting a modulation matrix into the input path and using a combination of input perturbation and observer residuals to expose and detect zero-dynamic attacks. The specific approach is as follows:

[0015] 1) Insert a modulation matrix S(k) into the system control input terminal so that the control signal undergoes a specific linear transformation or periodic rotation before entering the controlled system. This makes it impossible for attackers to accurately obtain the actual input channel characteristics of the controlled system.

[0016] 2) As long as the modulation matrix is ​​not an identity matrix, the attack signal designed by the attacker based on the original system model will not be able to align with the actual input, resulting in the failure of the zero-dynamic attack effect. The injected signal will be exposed in the system output or residual and will be detected in time by the traditional residual observer.

[0017] 3) This scheme can use fixed modulation (constant S(k)) or periodic modulation (S(k+T)) to enhance the diversity of detection and make it difficult for attackers to reverse engineer.

[0018] While this type of technology can theoretically improve the detection capability of zero-dynamic attacks, it still has the following obvious shortcomings in actual deployment:

[0019] 1) Affects system control performance: Frequent or large-amplitude input modulation can easily lead to a decline in the performance of the controlled system itself, the inability to accurately achieve the control target, and even introduce system oscillation or over-response, affecting the safe operation of the wind turbine;

[0020] 2) Attackers can adapt and learn: If the modulation matrix is ​​designed in a fixed form, attackers may still be able to deduce the modulation pattern through long-term data collection and reverse analysis, thereby designing new covert attacks, and the system security cannot be guaranteed in the long term.

[0021] 3) Complex implementation and maintenance: For large-scale wind power systems, all actuators need to adopt modulation mechanisms synchronously, which increases the difficulty of system configuration, maintenance and debugging, and is not suitable for later expansion and multi-vendor heterogeneous scenarios;

[0022] 4) The sampling zero-point problem cannot be fundamentally eliminated: This type of method essentially changes the unstable zero point caused by the sampling process by perturbing the attacker's cognition, so there are still residual detection blind spots.

[0023] As the complexity and intelligence of cyber-physical systems such as wind power systems continue to increase, zero-dynamic attacks, due to their strong concealment and destructiveness, have become the core threat in the field of wind farm and power system security. Summary of the Invention

[0024] The technical problem to be solved by this invention is to address the shortcomings of existing technologies. Existing detection technologies for zero-dynamic attacks generally suffer from problems such as complex implementation, strong dependence on communication and hardware, insufficient real-time performance, and prominent detection blind spots. This invention provides a new method for detecting zero-dynamic attacks in wind power systems based on phase bias sampling. This method has high engineering feasibility and can effectively detect extremely covert zero-dynamic attacks without changing the system structure or introducing redundant hardware or high-security communication links, thus breaking through the blind spots of traditional detection methods.

[0025] The technical problem to be solved by this invention is achieved through the following technical solution. This invention is a zero-dynamic attack detection method for wind power systems based on offset phase sampling. Its characteristic is that this detection method introduces an offset phase sampling mechanism to obtain dynamic information between the main sampling points of the discrete system, thereby realizing the detection of zero-dynamic attacks.

[0026] (1) Offset phase sampling

[0027] To detect potential hidden anomalies caused by zero-dynamic attacks between two main sampling points, an offset phase sampler is introduced outside the main sampler. The offset phase sampler is positioned at an offset phase compared to the main sampler to obtain the internal system dynamics within the sampling interval. Let the main sampling period of the system be T. s The master sampler at time t k =kT s The output y(t) of the continuous-time system is sampled to obtain the output of the main sampling point:

[0028] y k =y(t) k )=y(kT s ),

[0029] The offset phase sampler operates at the offset time t within each sampling period. k +θ is used for sampling, where θ∈(0,T) s Given a fixed phase offset, the offset sample value is obtained:

[0030]

[0031] Under normal system operating conditions, the continuous-time output y(t) in each sampling period [kT] s ,(k+1)T s The area inside is usually a smoothing function, with the main sampling point y. k With phase offset point The difference is small;

[0032] To effectively distinguish between normal operating conditions and abnormal conditions, a chi-square test method is introduced to construct the output threshold.

[0033] (2) Concealed phase

[0034] Definition of concealed phase: Let k e >0 indicates the output exposure time, i.e., the time index at which the system output reveals the attack, and let γ>0 be the threshold for the bad data detector. If the corresponding residual satisfies:

[0035]

[0036] Then θ * This is called a hidden phase;

[0037] The offset sampling phase employs multi-phase switching;

[0038] Let the main sampling period be T. s In (0,T) s Divide the inner into M equal offset phases:

[0039]

[0040] If a periodic alternation method is used, the phase number selected in the k-th sampling period is defined as:

[0041] j(k)=[(k-1)modM]+1

[0042] At this point, the output of the offset phase sampler is:

[0043]

[0044] The output residual is:

[0045]

[0046] Data anomalies are identified through residual accumulation detection; a sliding window of length w is used to accumulate residuals.

[0047]

[0048] Set the detection threshold ε>0; the detection threshold ε is designed as follows:

[0049] ε=μ e +mσ e

[0050] Where μ e and σ e These are the mean and standard deviation of the cumulative residuals under normal conditions; parameter m is chosen based on the expected trade-off between detection sensitivity and false alarm rate; therefore, the detection rule is expressed as:

[0051]

[0052] A further preferred technical solution of the above-described method for detecting zero dynamic attacks on wind power systems based on phase-biased sampling is that the detection method employs multi-phase switching sampling.

[0053] Set m different phase offset values ​​θ1, θ2, ..., θ m ∈(0,T s The system switches between different sampling phases for observation within each sampling period; if the phase offset selected in the k-th period is θ k The corresponding sampled value is:

[0054]

[0055] The phase switching strategy can be implemented by periodic rotation, random selection, or based on a predetermined sequence.

[0056] A further preferred technical solution of the above-described method for detecting zero dynamic attacks on wind power systems based on phase-biased sampling is the following residual accumulation detection method:

[0057] After the offset phase sampler obtains the asynchronous observation data of the system output, the residual accumulation strategy is used to fuse and amplify the potential abnormal disturbances between sampling points;

[0058] (1) Residual construction:

[0059] The system's main sampler at time t k Sample at point y to obtain output y k The offset phase sampler is offset by θ in the same period. k ∈(0,T s Sampling is performed over time to obtain observations. The offset residual within the period is:

[0060]

[0061] (2) Construction of cumulative residuals:

[0062] The cumulative change of the residual over a time window w is defined as:

[0063]

[0064] Set a reasonable detection threshold Γ>0, if the cumulative residual E k If the threshold is exceeded, the system is determined to be in an abnormal state.

[0065]

[0066] The threshold Γ can be set through training on historical normal data, simulation analysis, or statistical learning methods, taking into account both false positive and false negative rates.

[0067] A further preferred embodiment of the above-described method for detecting zero dynamic attacks on wind power systems based on biased sampling is that the aerodynamic model of the wind turbine of the wind power system is as follows:

[0068] The power of a wind turbine system comes from the aerodynamic torque T. a Essentially, a wind turbine converts the kinetic energy of the wind into mechanical energy. Assuming the wind speed is V, the wind turbine radius is R, and the air density is ρ, the power extracted by the wind turbine from the wind is expressed as:

[0069]

[0070] Among them, C p (λ,β) represents the power coefficient of the wind turbine, which is a function of the tip speed ratio λ and the pitch angle β; the tip speed ratio is defined as:

[0071]

[0072] Where, ω r The angular velocity of the wind turbine;

[0073] The aerodynamic torque acting on the wind turbine can be further expressed as:

[0074]

[0075] in, It is the torque coefficient;

[0076] The empirical formula for wind energy utilization coefficient is:

[0077]

[0078] in,

[0079] A further preferred technical solution of the above-described method for detecting zero dynamic attacks on wind power systems based on biased sampling is that the dynamic model of the mechanical transmission chain of the wind turbine in the wind power system is as follows:

[0080] The dynamic equations of the wind turbine mechanical link are:

[0081]

[0082] Among them, J r J is the moment of inertia of the wind turbine side. g K is the generator-side inertia. sh For the stiffness of the drive shaft, D sh ω is the damping coefficient. g Q is the generator-side speed. s T represents the torque of the drive shaft. g This is the input torque to the generator side;

[0083] Define the state variable vector x(t), the input variable vector u(t), and the output variable y(t) as follows:

[0084] x(t)=[ω r ω g Q s ] T u(t)=[T a T g ] T y(t)=ω g

[0085] The above equations can be further expressed in the form of standard state-space equations.

[0086]

[0087] Where A, B, and C are the system matrix, input matrix, and output matrix of the system, respectively, and the state-space equation matrix is:

[0088]

[0089] A further preferred technical solution of the above-described method for detecting zero dynamic attacks on wind power systems based on biased sampling is that the linearization processing method for the wind turbine system is as follows:

[0090] Let the steady-state operating point be the wind speed. Wind turbine speed The deviation between wind speed and rotational speed is defined as:

[0091]

[0092] Then the aerodynamic torque T a Linearization expansion near the steady-state operating point:

[0093]

[0094] Among them, the aerodynamic damping coefficient and wind speed disturbance coefficient k V Defined as:

[0095]

[0096] The same applies to other variables, let

[0097] Δx(t)=[Δω r ,Δω g ,ΔQ s ] T ,Δu(t)=[ΔT a ,ΔT g ] T ,Δy(t)=Δωg

[0098] The linearized state-space equation of the system becomes:

[0099]

[0100] ΔB V Given the wind speed disturbance matrix, the system matrix now becomes:

[0101]

[0102] A further preferred technical solution for the wind power system zero-dynamic attack detection method based on biased sampling described above is to use the following method for discretization and closed-loop control:

[0103] Discretize the linear continuous model; define the sampling period as T. s Using the zero-order hold method, since subsequent control typically assumes constant wind speed, therefore B V With the term omitted, the discrete state-space model can be represented as:

[0104] x k+1 =A d x k +B d u k ,y k =C d x k

[0105] In the formula

[0106]

[0107] Meanwhile, a PI controller is used to achieve closed-loop control of the generator speed, and its discrete transfer function is:

[0108]

[0109] In the formula: P and I are the proportional and integral control parameters, respectively.

[0110] A further preferred technical solution for the zero-dynamic attack detection method for wind power systems based on phase-biased sampling described above is to establish an attack model using the following method:

[0111] For discrete-time sampling systems:

[0112] x k+1 =A d x k +B d u k ,y k =C d x k ,

[0113] After applying the Byrnes-Isidori normal form transformation, the system is represented as:

[0114]

[0115] Where, η k ,ξ k S represents the internal and external states of the system, respectively. d ,P d Let be the system's internal zero dynamic matrix and the coupling matrix from external state to internal state. These are the system matrix, input matrix, and output matrix of the observable subsystem, respectively, φ. d Let ψ be the parameter matrix related to the external state. d Let g be the coupling matrix from the internal state to the output channel. d These are parameters related to the control input;

[0116] Assuming the attacker can input attack signal a k When introduced into a closed-loop system, the construction method for zero-dynamic attacks is as follows:

[0117]

[0118] Among them, z k These are attack state variables constructed by the attacker, referencing the Byrnes-Isidori normal form, after the attack signal is injected into the input:

[0119]

[0120] Compared with the prior art, the present invention has the following beneficial effects:

[0121] 1. This invention presents a novel and highly feasible method for detecting zero-dynamic attacks on wind power systems. It effectively detects extremely subtle zero-dynamic attacks without altering the system structure or introducing redundant hardware or high-security communication links, overcoming the blind spots of traditional detection methods. By introducing the collaborative work of the bias sampler and the main sampler, along with techniques such as multi-phase switching and sliding residual accumulation, it captures the state information of the wind power system under different sampling phases, improving sensitivity to zero-dynamic attacks and enhancing the comprehensiveness and real-time performance of the detection. It effectively solves the problems of high cost, difficult maintenance, and poor adaptability to engineering scenarios in existing technologies such as traditional auxiliary system methods and input modulation methods, enabling the proposed detection method to be directly applied to actual wind farm upgrades and intelligent operation and maintenance scenarios. It ensures high sensitivity and low false alarm rate, improves the system's network security protection capabilities, and maintains the safe and stable operation of the wind power system.

[0122] 2. This invention enhances detection capabilities: By introducing an offset phase sampling mechanism based on traditional main sampling and employing multi-phase dynamic switching, this invention can effectively capture dynamic anomalies "hidden" by zero-dynamic attacks between main sampling points of the wind power system, achieving comprehensive coverage detection of attack signals and significantly overcoming the blind spots of traditional single-point sampling detection methods. Actual simulation results show that, even if an attacker designs a sophisticated covert attack targeting the main sampling points, the abnormal trajectory will be quickly exposed at the offset phase sampling points, thereby improving the system's security protection capabilities.

[0123] 3. This invention combines robustness and sensitivity: The combination of multi-phase switching and sliding residual accumulation detection enables the scheme to effectively suppress false alarms caused by environmental noise, measurement errors, and instantaneous disturbances, thereby improving the robustness and anti-interference capability of the detection algorithm. Simultaneously, the residual accumulation strategy within the sliding window can sensitively respond to small-amplitude, short-term attacks, ensuring high-sensitivity detection capability against zero-dynamic attacks of various intensities.

[0124] 4. This invention requires no structural or hardware modifications, simplifying engineering deployment: The detection method of this invention only requires adding or expanding offset sampling to the existing sampling system. It does not require changing the structure of the main control system, nor does it rely on high-security communication networks and redundant hardware, greatly simplifying the engineering implementation process. Actual wind farms can deploy this invention's solution quickly and cost-effectively through software and hardware upgrades, achieving a comprehensive system upgrade and intelligent protection.

[0125] 4. This invention boasts strong real-time performance and wide applicability: The sampling and detection algorithm of this invention can be implemented on a real-time controller or edge operation and maintenance terminal via embedded software, meeting the practical application requirements of wind power systems for high response speed and low latency. The detection process is simple and efficient, applicable to various types of wind turbines, different communication network topologies, and various sampling accuracy systems, possessing broad engineering applicability and promotional value.

[0126] 5. This invention is easily expandable and upgradeable, and compatible with future intelligent wind power operation and maintenance: The multi-phase sampling and residual accumulation of this invention are highly scalable and can be seamlessly integrated with existing data analysis platforms, intelligent operation and maintenance systems, and automatic alarm modules in wind farms. This facilitates the subsequent construction of a multi-layered security defense system in conjunction with more advanced detection, tracing, and response mechanisms. It uses the residual sequences of the main sampling output and the bias sampling output, combined with sliding window accumulation and statistical adaptive threshold decision-making, to dynamically detect the system's operating status, ensuring high detection sensitivity, low false alarm rate, and compatibility with various engineering noise and disturbance scenarios. Attached Figure Description

[0127] Figure 1 Architecture diagram for remote monitoring and control of wind turbine systems under zero dynamic attack conditions;

[0128] Figure 2 The response diagram of the turbine under zero dynamic attack;

[0129] Figure 3 Angular velocity diagram of the generator under zero dynamic attack;

[0130] Figure 4 Block diagram for deploying a networked wind power control system using a phase sampler;

[0131] Figure 5 The phase shift θ = 0.8T s The system output diagram under biased sampling;

[0132] Figure 6 For a phase shift θ = 0.5T s The system output diagram under biased sampling;

[0133] Figure 7 The phase shift θ = 0.14T s The system output diagram under biased sampling;

[0134] Figure 8 After adjustment for the attack, the phase shift θ = 0.8T s The system output diagram under biased sampling;

[0135] Figure 9 The system output diagram shows the output under three different offset phase switching conditions; θ = 0.25T s 0.5T s 0.75T s ;

[0136] Figure 10 The graph shows the cumulative residual results under multiphase switching; θ = 0.25T. s 0.5T s 0.75T s ;

[0137] Figure 11 The graph shows the cumulative residuals of multiphase switching under Gaussian noise; θ = 0.25T. s 0.5T s 0.75T s ,θ=8. Detailed Implementation

[0138] The specific technical solutions of the present invention are further described below with reference to the accompanying drawings, so as to enable those skilled in the art to further understand the present invention, without constituting a limitation on its rights.

[0139] Example 1: A method for detecting zero-dynamic attacks on wind power systems based on biased sampling.

[0140] 1. System Framework

[0141] like Figure 1 As shown, current wind power systems widely adopt remote monitoring and control architectures. A typical system architecture includes: wind turbines, controllers, communication networks, and data acquisition and monitoring control systems. Through the communication network, the system can collect and analyze the operating data of wind turbine units in real time, such as rotor speed, generator speed, wind speed, and electromagnetic torque, and centrally manage multiple geographically distributed wind turbine units.

[0142] This network-based monitoring method improves operational efficiency and reduces labor costs, but it also introduces significant cybersecurity risks. Especially in large-scale deployment scenarios, attackers may hijack communication links and inject malicious control signals a(k), thereby interfering with or even disrupting the normal operation of wind turbines. For example, if an attacker intrudes into the control channel, they can launch advanced persistent threats such as zero-dynamic attacks, which are highly stealthy and destructive.

[0143] To study the mechanism of zero-dynamic attacks in wind power systems, a clear and reliable mathematical model must first be established.

[0144] 1.1 Wind Turbine Aerodynamic Model

[0145] The power of a wind turbine system comes from the aerodynamic torque T. a Essentially, a wind turbine converts the kinetic energy of the wind into mechanical energy. Assuming the wind speed is V, the wind turbine radius is R, and the air density is ρ, the power extracted by the wind turbine from the wind can be expressed as:

[0146]

[0147] Among them, C p (λ,β) represents the power coefficient of the wind turbine, which is a function of the tip speed ratio λ and the pitch angle β. The tip speed ratio is defined as:

[0148]

[0149] Where, ω r Let $\frac{ ...

[0150]

[0151] in, It is the torque coefficient.

[0152] In practical analysis and simulation, the commonly used empirical formula for wind energy utilization coefficient is:

[0153]

[0154] in,

[0155] 1.2 Dynamic Model of Wind Turbine Mechanical Transmission Chain

[0156] The mechanical link of a wind turbine can be simplified to a two-inertial model, and its dynamic equations are as follows:

[0157]

[0158] Among them, J r J is the moment of inertia of the wind turbine side. g K is the generator-side inertia. sh For the stiffness of the drive shaft, D sh ω is the damping coefficient. g Q is the generator-side speed. s T represents the torque of the drive shaft. g This is the input torque on the generator side.

[0159] Define the state variable vector x(t), the input variable vector u(t), and the output variable y(t) as follows:

[0160] x(t)=[ω r ω g Q s ] T u(t)=[T a T g ] T y(t)=ω g ,

[0161] The above equations can be further expressed in the form of standard state-space equations.

[0162]

[0163] The state-space equation matrix is:

[0164]

[0165] 1.3 Linearization Analysis of the System

[0166] The operating characteristics of a wind turbine system mean that the system often operates near a certain steady-state operating point. Therefore, linearization is required at the operating point to simplify subsequent analysis.

[0167] Let the steady-state operating point be the wind speed. Wind turbine speed The deviation between wind speed and rotational speed is defined as:

[0168]

[0169] Then the aerodynamic torque T a Linearization expansion near the steady-state operating point:

[0170]

[0171] Among them, the aerodynamic damping coefficient and wind speed disturbance coefficient k V Defined as:

[0172]

[0173] Therefore, the linearized state-space equation of the system becomes:

[0174]

[0175] The system matrix at this point becomes

[0176]

[0177] 1.4 Discretization and Closed-Loop Control

[0178] To integrate with practical digital control, this invention further discretizes the aforementioned linear continuous model. The sampling period is defined as T. s Using the zero-order hold method, since subsequent control typically assumes constant wind speed, therefore B V With the term omitted, the discrete state-space model can be represented as:

[0179] x k+1 =A d x k +B d u k ,y k =C d x k ,

[0180] In the formula

[0181]

[0182] Furthermore, this invention employs a PI controller to achieve closed-loop control of the generator speed, and its discrete transfer function is:

[0183]

[0184] In the formula, P and I are the proportional and integral control parameters, respectively.

[0185] 2. Attack Model and Detection Method

[0186] 2.1 Attack Model

[0187] For discrete-time sampling systems:

[0188] x k+1 =A d xk +B d u k ,y k =C d x k ,

[0189] After applying the Byrnes-Isidori normal form transformation, the system can be expressed as:

[0190]

[0191] Assuming the attacker can input attack signal a k When introduced into a closed-loop system, the construction method for zero-dynamic attacks is as follows:

[0192]

[0193] Among them, z k These are attack state variables constructed by the attacker, referencing the Byrnes-Isidori normal form, after the attack signal is injected.

[0194]

[0195] Reference Figure 2 , Figure 2 This indicates that after the attack signal was injected into the wind turbine, internal states such as generator speed and torque rapidly diverged, indicating severe instability and substantial damage caused by the attack.

[0196] Reference Figure 3 , Figure 3 The results show that the sampled generator angular velocity remained almost constant at the main sampling time, even during the attack. This demonstrates the stealth of zero-dynamic attacks, as the anomalous system behavior is effectively hidden in the sampling measurements, making it difficult to detect using conventional methods.

[0197] 2.2 Detection Method

[0198] The detection method proposed in this invention aims to effectively detect zero-dynamic attacks by introducing an offset phase sampling mechanism to obtain dynamic information between the main sampling points of a discrete system. Therefore, acquiring data between discrete outputs is the focus of the detection method proposed in this invention.

[0199] 2.2.1 Offset Phase Sampling

[0200] Reference Figure 4 ,like Figure 4As shown, to detect potential hidden anomalies of zero-dynamic attacks between two main sampling points, this invention introduces an offset phase sampling mechanism outside the main sampler. This method places the sampler at an offset phase compared to the main sampler, thereby obtaining the internal system dynamics within the sampling interval. Therefore, it enhances observation capabilities and improves attack detection capabilities. Let the main sampling period of the system be T. s The master sampler at time t k =kT s The output y(t) of the continuous-time system is sampled to obtain the output of the main sampling point:

[0201] y k =y(t) k )=y(kT s ),

[0202] The offset phase sampler operates at the offset time t within each sampling period. k +θ is used for sampling, where θ∈(0,T) s Given a fixed phase offset, the offset sample value is obtained:

[0203]

[0204] Under normal system operating conditions, the continuous-time output y(t) in each sampling period [kT] s ,(k+1)T s The area inside is usually a smoothing function, with the main sampling point y. k With phase offset point The difference is small.

[0205] Reference Figure 5 ,like Figure 5 As shown, the system has now deployed an offset phase sampler, with an offset phase of θ = 0.8T selected. s As can be seen, although attackers can hide attack traces at the main sampling point, they may expose obvious anomalies at the offset phase sampling point, with the offset residual gradually increasing as the attack continues. Therefore, to effectively distinguish between normal and abnormal states, we introduce a chi-square test method to construct an output threshold. Simulation results show that after 3 seconds of attack injection, the output of the offset phase sampler significantly exceeds the threshold, triggering an alarm, proving the effectiveness of the detection method.

[0206] Furthermore, we simulated the detection performance with different offset phases. (Refer to...) Figure 6 ,like Figure 6 As shown, when the offset phase sampler selects an offset phase of θ = 0.5T s When the phase shift θ = 0.8T is used, the detection effect is better, and the alarm time is shorter. sThe timing is advanced by approximately 0.3 seconds. However, not all offset phases have good detection capabilities. (See reference...) Figure 7 ,like Figure 7 As shown, when the offset phase θ = 0.14T s When the attack signal is near the "extreme plateau", the difference between the offset output of the attack signal and the main system output is small, and the residual is difficult to exceed the threshold area, resulting in a significant decrease in detection performance.

[0207] Furthermore, even if initial experiments show a certain phase shift (θ = 0.8T) s Even with good detection results, the robustness of this detection strategy cannot be guaranteed. (Refer to...) Figure 8 , Figure 8 This demonstrates a more covert version of the attack signal: with slight adjustments, by sacrificing some perturbation energy, the attacker can achieve an attack trajectory offset by a phase θ = 0.8T while maintaining zero dynamic attack on the core target. s The output also tends to be "pseudo-normal." The results show that the difference between the main sample output and the offset sample output is significantly reduced, consistently remaining within the threshold, and the system ultimately fails to detect it. This demonstrates that once an attacker knows the offset sampling phase used by the detection mechanism, they can potentially adjust their attack strategy to bypass the detection path.

[0208] In summary, while the fixed-offset phase sampler can successfully detect zero-dynamic attacks in some scenarios, its detection capability has the following two significant limitations:

[0209] 1. Detection performance is sensitive to the selection of the offset sampling phase, and the residual performance varies significantly under different phases;

[0210] 2. If an attacker learns the fixed offset phase used by the detection system, they can redesign a zero-dynamic attack targeting that phase to bypass the detection.

[0211] To address the aforementioned issues, this invention proposes the concept of "hidden phase" for the first time, which is used to explain the limitations of fixed offset phase.

[0212] Definition: Let k e >0 indicates the output exposure time, i.e., the time index at which the system output reveals the attack, and let γ>0 be the threshold for the bad data detector. If the corresponding residual satisfies

[0213]

[0214] Then θ * This is known as the hidden phase.

[0215] Based on the definition of the concealed phase, we have a prerequisite for selecting the offset phase. The most basic point is that the offset phase should not be too close to the concealed phase, otherwise the effectiveness of detection will be greatly affected. We improved the offset sampling phase from the original fixed phase to multi-phase switching, thereby reducing the influence of the concealed phase.

[0216] Let the main sampling period be T. s In (0,T) s Divide the inner into M equal offset phases

[0217]

[0218] If a periodic alternation method is used, the phase number selected in the k-th sampling period is defined as follows:

[0219] j(k) = [(k-1)modM] + 1,

[0220] At this point, the output of the offset phase sampler is

[0221]

[0222] The output residual is

[0223]

[0224] To further improve the effectiveness of multi-phase switching detection, we use residual accumulation detection to identify data anomalies. We employ a sliding window of length w to accumulate the residuals:

[0225]

[0226] A reasonable detection threshold ε > 0 is set. Considering the use of Gaussian white noise in this work, the detection threshold ε is designed as follows:

[0227] ε=μ e +mσ e .

[0228] Where μ e and σ e These are the mean and standard deviation of the cumulative residuals under normal conditions. The parameter m is chosen based on the desired trade-off between detection sensitivity and false alarm rate. Therefore, the detection rule can be expressed as...

[0229]

[0230] 2) Multi-phase switching sampling

[0231] Considering that attackers may adjust the attack waveform based on fixed phase characteristics to evade detection, this invention further proposes a multi-phase switching offset sampling method to increase the difficulty of attacks and improve detection robustness.

[0232] Set m different phase offset values ​​θ1, θ2, ..., θ m ∈(0,T s The system switches between different sampling phases for observation within each sampling period. If the phase offset selected in the k-th period is θ... k The corresponding sampled value is:

[0233]

[0234] The phase switching strategy can be implemented by periodic rotation, random selection, or based on a predetermined sequence. Compared with fixed-phase sampling, the multi-phase mechanism constructs an uncertain observation path in time, making it difficult for attackers to simultaneously consider all sampling points, thus significantly improving the robustness of the detection method against attack signals.

[0235] 2.2.2 Residual Cumulative Detection

[0236] After the offset phase sampler obtains the asynchronous observation data output by the system, this invention proposes to use a residual accumulation strategy to fuse and amplify potential abnormal disturbances between sampling points, thereby enhancing the sensitivity of the detection system to zero-dynamic attacks. The core idea of ​​this method is to utilize the accumulation effect of residual information over multiple consecutive sampling periods to improve the system's response capability to small-amplitude, short-duration attacks and effectively suppress misjudgments caused by transient disturbances or measurement noise.

[0237] 1) Residual Structure

[0238] The system's main sampler at time t k Sample at point y to obtain output y k The offset phase sampler is offset by θ in the same period. k ∈(0,T s Sampling is performed over time to obtain observations. Therefore, the offset residual within the period is defined as:

[0239]

[0240] During normal system operation, the output changes smoothly between the main sampling point and adjacent time points, and the residual e k It should be close to zero; if the system is subjected to a zero-dynamic attack, the main sampling point y k The attacker may have meticulously designed a "normal" appearance, but the offset point... It will exhibit abnormalities, thus causing e k Increase.

[0241] 2) Cumulative residual construction

[0242] Considering the cumulative change of the residual over a time window w, the cumulative residual is defined as:

[0243]

[0244] Set a reasonable detection threshold Γ>0, if the cumulative residual E k If the threshold is exceeded, the system is determined to be in an abnormal state.

[0245]

[0246] The threshold Γ can be set through training on historical normal data, simulation analysis, or statistical learning methods, taking into account both false positive and false negative rates.

[0247] Reference Figure 9 ,like Figure 9 As shown, when the system is subjected to a zero-dynamic attack, a significant deviation occurs between the output of the master sampler and the outputs of the three bias samplers, which effectively captures anomalous changes in the internal state. Compared with single fixed-phase sampling, the multiphase switching method greatly reduces the detection blind zone caused by improper phase selection, significantly improving the comprehensiveness and robustness of attack detection.

[0248] Reference Figure 10 , Figure 10 The results are shown based on the cumulative residual under noise-free conditions. As the attack progresses, the cumulative residual increases rapidly and significantly exceeds a predefined threshold, indicating that the highly sensitive attack has been successfully detected.

[0249] Reference Figure 11 , Figure 11 The detection performance under Gaussian white noise is shown. Although the cumulative residual will fluctuate naturally due to the influence of measurement noise, it will still rise sharply when an attack occurs and quickly exceed the theoretical threshold. This shows that with proper selection of parameter m, the proposed detection method maintains strong attack detection capability and robustness to noise.

Claims

1. A method for detecting zero-dynamic attacks on wind power systems based on biased sampling, characterized in that: This detection method introduces an offset phase sampling mechanism to obtain dynamic information between the main sampling points of the discrete system, thereby enabling the detection of zero-dynamic attacks. (1) Offset phase sampling To detect potential hidden anomalies of zero-dynamic attacks between two main sampling points, an offset phase sampler is introduced outside the main sampler; the offset phase sampler is placed at an offset phase compared to the main sampler to obtain the internal system dynamics within the sampling interval; Let the main sampling period of the system be T. s The master sampler at time t k =kT s The output y(t) of the continuous-time system is sampled to obtain the output of the main sampling point: and k =y(t k )=y(kT s ), The offset phase sampler operates at the offset time t within each sampling period. k +θ is used for sampling, where θ∈(0,T) s Given a fixed phase offset, the offset sample value is obtained: Under normal system operating conditions, the continuous-time output y(t) in each sampling period [kT] s ,(k+1)T s The area inside is usually a smoothing function, with the main sampling point y. k With phase offset point The difference is small; To effectively distinguish between normal operating conditions and abnormal conditions, a chi-square test method is introduced to construct the output threshold. (2) Concealed phase Definition of concealed phase: Let k e >0 indicates the output exposure time, i.e., the time index at which the system output reveals the attack, and let γ>0 be the threshold for the bad data detector. If the corresponding residual satisfies: Then θ * This is called a hidden phase; The offset sampling phase employs multi-phase switching; Set m different phase offset values ​​θ1, θ2, ..., θ m ∈(0,T s The system switches between different sampling phases for observation within each sampling period; if the phase offset selected in the k-th period is θ k The corresponding sampled value is: The phase switching strategy can be implemented by periodic rotation, random selection, or based on a predetermined sequence.

2. The method for detecting zero dynamic attacks in wind power systems based on biased sampling according to claim 1, characterized in that, This detection method employs multi-phase switching sampling: Let the main sampling period be T. s In (0,T) s Divide the inner into M equal offset phases: If a periodic alternation method is used, the phase number selected in the k-th sampling period is defined as: j(k)=[(k-1)modM]+1 At this point, the output of the offset phase sampler is:

3. The method for detecting zero dynamic attacks in wind power systems based on biased sampling according to claim 1, characterized in that, The specific method for residual accumulation detection is as follows: After the offset phase sampler obtains the asynchronous observation data of the system output, the residual accumulation strategy is used to fuse and amplify the potential abnormal disturbances between sampling points; (1) Residual construction: The system's main sampler at time t k Sample at point y to obtain output y k The offset phase sampler is offset by θ in the same period. k ∈(0,T s Sampling is performed over time to obtain observation values. The offset residual within the period is: (2) Construction of cumulative residuals: The cumulative change of the residual over a time window w is defined as: Set a reasonable detection threshold ε>0; the detection threshold ε is designed as follows: e=m e +mσ e Where μ e and σ e These are the mean and standard deviation of the cumulative residuals under normal conditions; the parameter m is chosen based on the expected trade-off between detection sensitivity and false alarm rate. Therefore, the detection rule can be expressed as...

4. The method for detecting zero dynamic attacks on wind power systems based on biased sampling according to any one of claims 1-3, characterized in that, The aerodynamic model of the wind turbine in the wind power system is as follows: The power of a wind turbine system comes from the aerodynamic torque T. a Essentially, a wind turbine converts the kinetic energy of the wind into mechanical energy. Assuming the wind speed is V, the wind turbine radius is R, and the air density is ρ, the power extracted by the wind turbine from the wind is expressed as: Among them, C p (λ,β) represents the power coefficient of the wind turbine, which is a function of the tip speed ratio λ and the pitch angle β; the tip speed ratio is defined as: Where, ω r The angular velocity of the wind turbine; The aerodynamic torque acting on the wind turbine is further expressed as: in, It is the torque coefficient; The empirical formula for wind energy utilization coefficient is: in, 5. The method for detecting zero dynamic attacks in wind power systems based on biased sampling according to claim 4, characterized in that, The dynamic model of the mechanical transmission chain of the wind turbine in a wind power system is as follows: The dynamic equations of the mechanical link of the wind turbine are: Among them, J r J is the moment of inertia of the wind turbine side. g K is the generator-side inertia. sh D is the shaft stiffness coefficient. sh ω is the shaft damping coefficient. g Q is the generator angular velocity. s T is the elastic torque of the shaft. g This refers to the electromagnetic torque of the generator. Define the state variable vector x(t), the input variable vector u(t), and the output variable y(t) as follows: x(t)=[ω r ,ω g ,Q s ] T ,u(t)=[T a ,T g ] T ,y(t)=ω g The above equations can be further expressed in the form of standard state-space equations. Where A, B, and C are the system matrix, input matrix, and output matrix of the system, respectively, and the state-space equation matrix is:

6. The method for detecting zero dynamic attacks in wind power systems based on biased sampling according to claim 5, characterized in that, The linearization method for wind turbine systems is as follows: Let the steady-state operating point be the wind speed. Wind turbine speed The deviation between wind speed and rotational speed is defined as: Then the aerodynamic torque T a Linearization expansion near the steady-state operating point: Among them, the aerodynamic damping coefficient and wind speed disturbance coefficient k V Defined as: Similarly, for other variables, let: Δx(t)=[Dω r ,Here g ,ΔQ s ] T ,Δu(t)=[ΔT a ,ΔT g ] T ,Δy(t)=Δω g The linearized state-space equation of the system becomes: ΔB V Given the wind speed disturbance matrix, the system matrix now becomes:

7. The method for detecting zero dynamic attacks in wind power systems based on biased sampling according to claim 6, characterized in that, Discretization and closed-loop control are performed using the following methods: Discretize the linear continuous model; define the sampling period as T. s Using the zero-order hold method, since subsequent control typically assumes a constant wind speed, therefore B V With the term omitted, the discrete state-space model can be represented as: x k+1 =A d x k +B d u k ,y k =C d x k In the formula Meanwhile, a PI controller is used to achieve closed-loop control of the generator speed, and its discrete transfer function is: In the formula: P and I are the proportional and integral control parameters, respectively.

8. The method for detecting zero dynamic attacks on wind power systems based on biased sampling according to any one of claims 1-3, characterized in that, The attack model is established using the following methods: For discrete-time sampling systems: x k+1 =A d x k +B d u k ,y k =C d x k , After applying the Byrnes-Isidori normal form transformation, the system is represented as: Where, η k ,ξ k S represents the internal and external states of the system, respectively. d ,P d Let be the system's internal zero dynamic matrix and the coupling matrix from external state to internal state. These are the system matrix, input matrix, and output matrix of the observable subsystem, respectively, φ. d Let ψ be the parameter matrix related to the external state. d Let g be the coupling matrix from the internal state to the output channel. d These are parameters related to the control input; Assuming the attacker can input attack signal a k When introduced into a closed-loop system, the construction method for zero-dynamic attacks is as follows: Among them, z k These are attack state variables constructed by the attacker, referencing the Byrnes-Isidori normal form, after the attack signal is injected into the input:

Images