Intelligent substation attack detection method and system based on multi-modal deep learning

Abstract

The invention discloses an intelligent substation attack detection method and system based on multi-mode deep learning, and relates to the technical field of power system network security. Coding is carried out through a one-dimensional convolutional neural network, a graph convolutional network and an embedded lookup table in combination with a feedforward network, and corresponding feature vectors are obtained; then, on the basis of an attention mechanism, data source credibility and missing masks, dynamic weighted fusion is carried out on the feature vectors, and a comprehensive feature vector of each node is generated; and finally, inputting the comprehensive feature vector into a bidirectional gating loop unit network according to a time sequence for time sequence modeling, and outputting attack existence judgment, attack type classification and attacked node positioning in parallel based on a multi-task learning framework. According to the method, the detection precision and the positioning capability of complex attacks such as false data injection are remarkably improved, and meanwhile, the method has good robustness and interpretability.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a method and system for detecting attacks on intelligent substations based on multimodal deep learning. Background Technology

[0002] As modern power systems rapidly evolve towards intelligence, distributed computing, and digitalization, a large number of distributed resources, such as renewable energy sources, microgrids, energy storage devices, and electric vehicles, are being integrated. This leads to increasingly complex system topologies and operating modes, widespread deployment of communication networks and information technology equipment, and a significant expansion of the network attack surface. Smart substations, as critical nodes in the power system, deploy numerous intelligent sensors and switching devices. These devices rely on public or private networks for communication and are vulnerable to common network attacks such as worms, ransomware, and denial-of-service attacks. Once attacked, these attacks can distort system operating parameters, misinterpret dispatch commands, and even trigger cascading failures, seriously threatening the safe, stable, and reliable operation of the power grid.

[0003] Currently, attack detection methods for power systems mainly rely on traditional state estimation techniques and rule-based anomaly detection mechanisms. However, these methods often struggle to achieve efficient and accurate detection and localization when facing complex False Data Injection Attacks (FDIA) and topology tampering attacks. Especially in dynamically changing power grid topologies and environments with strong noise interference, existing methods suffer from high false alarm and false negative rates, failing to meet the real-time online security requirements of modern smart grids.

[0004] Furthermore, existing detection methods often focus on the analysis of single data sources, lacking effective fusion and joint modeling of multi-source heterogeneous data (such as time-series modal data, topological information, and metadata modal data). This results in insufficient detection capabilities when facing collaborative attacks across nodes and modalities. Although some studies have attempted to introduce deep learning techniques for anomaly detection, problems such as weak model generalization ability, insufficient consideration of physical constraints, and poor interpretability still exist.

[0005] Therefore, there is an urgent need for a multimodal deep learning detection method that can deeply integrate power grid topology and real-time measurement data, and has strong robustness, high accuracy and good interpretability, in order to cope with the increasingly complex and covert network attack threats in smart substations and improve the active defense capability of the power system. Summary of the Invention

[0006] To address this, embodiments of the present invention provide a method and system for detecting attacks on intelligent substations based on multimodal deep learning. This method solves the problems in the prior art where the failure to effectively integrate power grid time-series measurements, topology, and metadata modal data leads to low detection accuracy, high false alarm rate, and difficulty in accurately locating complex attacks such as spurious data injection.

[0007] To address the aforementioned technical problems, embodiments of the present invention provide a method for detecting attacks on intelligent substations based on multimodal deep learning, the method comprising: Multimodal data from smart substations are collected, including time-series modal data, topological modal data, and metadata modal data. These data are then encoded using a pre-established one-dimensional convolutional neural network, graph convolutional network, and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors, and metadata feature vectors. Based on the attention mechanism, data source credibility, and missing mask, the temporal feature vector, topological feature vector, and metadata feature vector are dynamically weighted and fused to generate a comprehensive feature vector for each node. The comprehensive feature vector is input into a pre-established bidirectional gated recurrent unit network in time series for temporal modeling, and based on a multi-task learning framework, it outputs attack existence judgment, attack type classification and attacked node location in parallel.

[0008] Preferably, before encoding the acquired multimodal data, a timing sliding window is used to perform clock synchronization and resampling processing on the acquired multimodal data; The use of a timing sliding window for clock synchronization and resampling of multimodal data specifically includes: Linear interpolation is performed on low-frequency data with a sampling rate lower than the target frequency; Statistical aggregation is performed on high-frequency data with sampling rates higher than the target frequency within a window.

[0009] Preferably, the specific process of performing dynamic weighted fusion is as follows: First, calculate the attention score for each modality: ; in, It is a scalar, representing the state of a node. At any moment Modality The raw, unnormalized attention score; It is a node At any moment modality The encoded feature vector; It is a trainable column vector shared by all modalities; For vectors transpose; The hyperbolic tangent activation function is a non-linear activation function that compresses the output value to a certain value. Within the range; It is a specific mode The associated trainable parameter matrix; Subsequently, the attention scores are normalized to obtain the attention weights: ; in, For nodes At any moment Modality The final fusion weight after standardization; For the original attention score Perform exponentiation; It is a loop variable that represents the iteration through each mode during the summation process. Its existence is to distinguish the specific mode we are calculating. ; Next, the credibility of each modality is calculated based on real-time data quality metrics: ; in, It is a scalar between 0 and 1, representing a node. At any moment Modality The credibility of the data source; It is a nonlinear activation function; The ratio of signal to noise is a positive indicator of data quality. The percentage of data packets lost during data transmission is a negative indicator of communication link quality. This refers to the error that occurs when using reconstruction models such as autoencoders to attempt to restore the original data; Coefficients used to adjust the importance of each data quality indicator in the overall evaluation; Finally, the attention weights are multiplied by the confidence levels to obtain the fusion weights for each modality vector, and the combined feature vector for each node is obtained by weighted summation. ; in, It is a node At any moment The final, unified representation of characteristics; For nodes At any moment Modality The original encoded feature vector.

[0010] Preferably, the data quality indicators include at least one of signal-to-noise ratio, packet loss rate, and encoder reconstruction error; when the confidence level of any modality is lower than a preset threshold, a data quality alarm is triggered, and it is temporarily excluded during the fusion process through the missing mask.

[0011] Preferably, the bidirectional gated cyclic unit network includes a forward GRU and a backward GRU; The forward GRU is used to process feature sequences from history to the present to identify tentative fluctuations in the attack latency period; The backward GRU is used to process feature sequences in reverse order from the current to the past in order to trace back the cover-up behavior after an attack.

[0012] Preferably, the multi-task learning framework includes three parallel branches: The attack existence check branch is used to determine whether the entire system is under attack by using a fully connected layer and a sigmoid activation function. An attack type classification branch is used to classify attack types in multiple ways using a fully connected layer and a Softmax activation function; The attack node location branch is used to determine whether each node is under attack by using a fully connected layer and a sigmoid activation function.

[0013] Preferably, the total loss function of the multi-task learning framework is a weighted sum of the loss functions of the three branches, which share the temporal features extracted by the bidirectional gated recurrent unit network. The total loss function is defined as follows: ,in , , These are the loss functions for the attack existence branch, attack type classification branch, and attack node location branch, respectively. , , These are configurable weighting coefficients.

[0014] This invention also provides an intelligent substation attack detection system based on multimodal deep learning. This system is used to implement the aforementioned intelligent substation attack detection method based on multimodal deep learning, specifically including: The multimodal data acquisition and encoding module is used to acquire multimodal data from smart substations, including time-series modal data, topological modal data, and metadata modal data. These data are encoded using a pre-established one-dimensional convolutional neural network, graph convolutional network, and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors, and metadata feature vectors. The multimodal information fusion module is used to dynamically weight and fuse the temporal feature vector, topological feature vector, and metadata feature vector based on attention mechanism, data source credibility, and missing mask to generate a comprehensive feature vector for each node. The attack detection and classification module is used to input the comprehensive feature vector into a pre-established bidirectional gated recurrent unit network in a time series manner to perform temporal modeling, and based on a multi-task learning framework, output attack existence judgment, attack type classification and attacked node location in parallel.

[0015] This invention also provides an electronic device, which includes a processor, a memory, and a bus system. The processor and the memory are connected through the bus system. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the above-described intelligent substation attack detection method based on multimodal deep learning.

[0016] This invention also provides a computer storage medium storing a computer software product, the computer software product including several instructions to cause a computer device to execute the above-described intelligent substation attack detection method based on multimodal deep learning.

[0017] As can be seen from the above technical solutions, this invention application has the following beneficial effects: This invention constructs a physically interpretable detection foundation by integrating power grid physical constraints and multi-source measurement data. It significantly improves the accuracy of detecting topology tampering and cross-node attacks by utilizing joint modeling of graph neural networks and temporal features. An attention-credibility-mask fusion mechanism enables dynamic adaptive adjustment of modal weights, enhancing fault tolerance to abnormal data sources while improving system interpretability through visualized weight distribution. A detection framework based on bidirectional GRU and multi-task learning synchronously outputs attack presence, type, and location information, achieving a closed-loop response from early warning to location. Combined with an engineering architecture of edge deployment and cloud collaboration, it ensures real-time detection while supporting continuous model evolution, ultimately demonstrating significant advantages in detection accuracy, system robustness, operational efficiency, and security situation awareness. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly described below. Referring to the drawings will make the features and advantages of the present invention clearer. The drawings are illustrative and should not be construed as limiting the present invention in any way. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1This is a flowchart of an intelligent substation attack detection method based on multimodal deep learning provided by the present invention; Figure 2 This is a flowchart of the multimodal data acquisition and encoding process in this invention; Figure 3 This is a flowchart of the dynamic weighted fusion of temporal feature vectors, topological feature vectors, and metadata feature vectors in this invention; Figure 4 This is a block diagram of an intelligent substation attack detection system based on multimodal deep learning provided by the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Example 1: To address the problems in existing technologies where the failure to effectively integrate power grid time-series measurements, topology data, and metadata modal data leads to low detection accuracy, high false alarm rates, and difficulty in precisely locating complex attacks such as spoofed data injection, such as... Figure 1 As shown, this invention proposes a method for detecting attacks on intelligent substations based on multimodal deep learning. The method includes: S1: Collect multimodal data from the smart substation, including time-series modal data, topological modal data, and metadata modal data, and encode them respectively through a pre-established one-dimensional convolutional neural network, graph convolutional network, and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors, and metadata feature vectors; S2: Based on the attention mechanism, data source credibility, and missing mask, the temporal feature vector, topological feature vector, and metadata feature vector are dynamically weighted and fused to generate a comprehensive feature vector for each node. S3: Input the comprehensive feature vector into a pre-established bidirectional gated recurrent unit network in time series for temporal modeling, and output attack existence judgment, attack type classification and attacked node location in parallel based on a multi-task learning framework.

[0021] As can be seen from the above technical solution, this invention proposes an attack detection method for intelligent substations based on multimodal deep learning. First, through multimodal data acquisition and encoding, a dedicated neural network is used to extract features from temporal, topological, and metadata data, constructing a feature representation that preserves the physical constraints of the power grid. Then, multimodal information fusion is employed, using an attention mechanism combined with data credibility and a missing mask to achieve dynamic weighted fusion, generating anti-interference node comprehensive features. Finally, through attack detection classification, a bidirectional gated recurrent unit is used for temporal modeling, and attack existence judgment, type classification, and node localization are completed in parallel within a multi-task learning framework. This method achieves end-to-end learning from feature extraction to decision output through hierarchical processing, significantly improving detection accuracy, robustness, and localization capability while ensuring model interpretability.

[0022] In the context of smart substations, multimodal data refers to data sets from different sources and semantic levels. This invention covers the following modalities: first, time-series measurement modalities (modal time), which are physical quantities collected in a time series, such as voltage amplitude, phase angle, branch power flow, and injected power; second, topological modalities (modal topo), which are adjacency matrices representing the connection relationships between buses and branches, as well as equipment attributes; and third, metadata information modalities (modal meta), including measurement instrument type, accuracy, sampling rate, and equipment geographic and functional attributes. Each modal provides different evaluation criteria for grid operation, and multimodal collaboration can significantly improve the ability to identify complex attacks and the interpretability of criteria.

[0023] In step S1, as Figure 2 As shown, multimodal data is collected from the smart grid and standardized and encoded. First, in real time, time-series modal data, including bus voltage amplitude and phase angle, branch power flow, unit output, load power and equipment connectivity status, are collected from multiple sensors and smart terminals at the substation. Topological modal data, such as substation topology table, equipment adjacency relationship, line parameters, and bus type identifier, as well as metadata modal data, such as equipment list, type, accuracy, sampling rate, and geographical location, are collected. This basic data is the foundation for all subsequent detection work.

[0024] To ensure the temporal consistency of multimodal data, clock synchronization is first performed on all data sources, prioritizing the use of high-precision time bases, and a uniform sliding time window is defined as the basic unit for modeling. To address differences in sampling rates, downsampling or upsampling strategies are implemented: high-frequency data is statistically aggregated within the window; low-frequency data is interpolated to align with the target time grid.

[0025] Specifically, to ensure the temporal comparability of multimodal data, the original sampling sequences from different modalities are first resampled and standardized according to a unified time grid. For any modality's original sequence... Through interpolation operators Resample each modal data to a unified set of sampling points. : ; in, To achieve a unified target time point The above refers to data values ​​obtained through resampling (interpolation or aggregation).

[0026] Since different modal data are sampled at different frequencies, if the original frequency is lower than the target frequency, linear interpolation is performed on the low-frequency data: ; in For low-frequency samples, To be at the target time The estimated value is obtained by linear interpolation. and At time respectively and The actual data values ​​collected.

[0027] If the original frequency is higher than the target frequency, then aggregate by window: ; in, For nodes modality Data at the target time The final value after aggregation processing In the time window The total number of original high-frequency data points contained within. These are the most basic measurement data.

[0028] Subsequently, standardization was performed on the numerical features: ; in, To be at the target time The final data value after standardization. , These are the historical mean and standard deviation of this feature, respectively.

[0029] Each modality is treated as a separate information source. After normalizing the three modalities over a time window, they are subsequently processed by different encoders and fused at the semantic layer. For each node... Each mode In the sliding window Internally constructed local sequence input encoder.

[0030] Furthermore, for temporal modalities, this invention uses a one-dimensional convolutional neural network (1D-CNN) for encoding. Specifically, this involves applying several layers of one-dimensional convolutions to the sliding window time series at each node, combining batch normalization, non-linear activation, and pooling operations to extract local transient patterns, multi-scale periodic information, and impulse features layer by layer; in the final stage, global average pooling is used to obtain a fixed-dimensional temporal feature vector. ; in, For nodes At any moment The final feature vector obtained after the temporal measurement modal data is encoded through the entire 1D-CNN retains local transient, impulse, periodic and multi-temporal scale patterns, which is convenient for subsequent fusion and use; , is a sequence representing nodes All standardized values ​​of time-series modal data within a sliding time window; This represents a one-dimensional convolution operation that uses multiple learnable filters to slide across the input sequence to detect specific local temporal patterns. Represents a linear rectified function, a type of nonlinear activation function, defined as follows: ; This indicates a pooling operation.

[0031] Furthermore, for topology modality coding, this invention employs a Graph Convolutional Network (GCN) to fuse the data collected from smart substations. Specifically, device adjacency relationships, line parameters, and bus type identifiers are mapped to node features, and graph adjacency relationships are generated in conjunction with device connectivity to simulate the spatial diffusion effect of power flow in the power grid. For example, when a bus experiences power anomalies, the GCN automatically captures the correlation changes of its adjacent buses. Then, through multi-layer convolutions and hop connections, a deep learning of the overall spatial dependence of the power grid is achieved. During the fusion process, the model not only focuses on direct connections between buses but also explores long-range effects across multiple hops, ensuring that the final node embedding vectors retain both the physical constraints of the power grid and the data-driven distributed characteristics.

[0032] GCN is a type of neural network specifically designed for processing graph-structured data. Through information transfer and aggregation mechanisms between nodes, it learns the representational features of nodes, edges, and the entire graph. In the new intelligent substation system, the system topology can be represented as a graph structure. This system can be represented as: ; in, This indicates node characteristics, including bus identifier, bus type, bus phase angle, and multimodal information such as power. This represents the adjacency matrix, and its values ​​are: .

[0033] This invention uses two layers of GCN as the encoder to learn the graph node representation, and the two-layer graph convolution function is defined as follows: ; ; in, This is the output of the first layer of graph convolution, i.e., the intermediate feature representation of the nodes after the first layer of processing; For at any time Feature matrix of all nodes; This is the trainable weight matrix for the first layer of the GCN; This is the output of the second layer graph convolution, which is also the final output of the entire GCN encoder; The trainable weight matrix of the second-layer GCN; The function representation of the entire graph convolutional network, using node features and adjacency matrix For input, output node embedding ; It is an adjacency matrix. The symmetric normalized adjacency matrix is ​​calculated using the following formula: ; in, yes The degree matrix.

[0034] Ultimately, the topological feature vector after topological data encoding can be obtained. yes The OK.

[0035] Furthermore, the mean of the nodes and variance The calculation formulas are as follows: ; .

[0036] Furthermore, the formula for calculating the posterior distribution of the latent vectors in a graph neural network is as follows: ; in, This indicates that given the observed data (node ​​features) and adjacency matrix Under the condition of ), the latent variables of all nodes The joint probability distribution of ; For a single node The implicit variable representation; For the node To the node The product of two products; This means that given all the observation data Under these conditions, a single node Latent variables The probability distribution.

[0037] Furthermore, in the decoding stage, the latent vectors of the encoder input nodes are... This step selects the Sigmoid function as the activation function. The Sigmoid function is defined as follows: .

[0038] Latent vectors and latent vectors The probability of a connection between two nodes is that the smaller the angle between their embedding vectors (the higher the cosine similarity), the greater the probability of a connection. ; The process of recovering the adjacency matrix from the latent vectors can be represented as: ; In the model update phase, the basic principle of graph neural networks is to reconstruct the adjacency matrix, making it as similar as possible to the original matrix. Therefore, part of the loss function uses cross-entropy to measure the similarity after reconstruction, and another part, based on the Gaussian distribution assumption of the latent vectors, uses KL divergence. Thus, the loss function calculation formula is as follows: .

[0039] Furthermore, for metadata modalities, this invention employs an embedding lookup combined with a feedforward network for encoding. Specifically, discrete categorical metadata is mapped to low-dimensional vectors using an embedding lookup, while numerical metadata is projected using a normalized small feedforward network (MLP). The categorical embedding vector and the numerical projection are concatenated and then passed through a mapping network to obtain a unified metadata representation vector.

[0040] Category features such as device type, manufacturer, and sampling frequency category (value in) Set the embedding matrix ,but: ; in, No. Embedding matrices of features of each category; For the first The vocabulary size of a category feature, that is, the total number of all possible values ​​for that feature; For the first The dimensions of the embedding vector are specified by each category feature; For nodes The Embedding vectors of each category feature; For nodes The The integer indices corresponding to the specific values ​​of each category feature. Concatenate and sum the embedding vectors of all categories: ; in, For nodes The result of concatenating the embedding vectors of all category features; This is a concatenation function; For nodes The first to the second Embedding vectors of each category feature.

[0041] The final metadata feature vector is obtained by MLP projection. for: .

[0042] In step S2, this invention employs an intermediate fusion strategy based on an attention mechanism, data source credibility, and a missing feature mask to achieve dynamic weighted fusion of temporal feature vectors, topological feature vectors, and metadata feature vectors. This method uses the multimodal semantic vector corresponding to each node at each time step as the basic unit. First, it evaluates the relative importance of each modality in the current context through a trainable attention mechanism. Then, it combines this with a real-time credibility index reflecting data quality and applies a mask to missing modalities caused by sensor failure or communication interruption. Finally, based on the normalized comprehensive weights, it performs a weighted summation of the modal vectors to generate a unified feature representation for each node. This fusion method preserves the discriminative ability of each modality within its specialized representation domain and achieves semantic-level fusion with deep intermodal interaction.

[0043] Furthermore, the attention mechanism is used to dynamically evaluate the model's dependence on each mode at the current node and time step. Its scorer is constructed through mode-specific affine projection and nonlinear mapping, enabling it to learn the discriminative ability of each mode under different operating states. After training, the attention distribution can adapt to scene changes: for example, increasing the weight of topological modes when topological anomalies are significant, or strengthening the role of temporal modes when measurement data undergoes abrupt changes.

[0044] To assess the real-time reliability of each modality's data source, this invention introduces a reliability evaluation mechanism, calculated based on multi-dimensional data quality indicators such as signal-to-noise ratio, packet loss rate, and encoder reconstruction error. When a decline in the quality of a particular modality's data or an anomaly is detected, the system automatically lowers its reliability value and applies weight decay to that modality during the fusion process. This reliability can be calculated in real-time using a preset rule formula or adaptively mapped via a lightweight neural network. To further ensure system robustness, a threshold alarm function is also included: when the reliability of any modality falls below a preset threshold, a data quality warning is triggered, and the modality can be temporarily set to a failed state based on a strategy, thus constructing a complete closed loop for data quality monitoring and adaptive processing.

[0045] To further enhance the system's robustness under abnormal conditions such as sensor failure or communication interruption, this invention introduces a masking mechanism to record the modal availability state at each node-time. This mask automatically filters out unavailable modes during the fusion process and renormalizes attention weights and credibility within the effective modal range, thereby achieving natural order reduction of the system. Furthermore, the masking information is also stored as interpretability evidence, providing data integrity criteria for subsequent operation and maintenance analysis, ultimately constructing a fusion mechanism that combines adaptive weighting and fault tolerance.

[0046] like Figure 3 As shown, the specific process of dynamically weighting and fusing temporal feature vectors, topological feature vectors, and metadata feature vectors includes the following steps: S21: Calculate the attention score for each modality, using the following formula: ; in, It is a scalar, representing the state of a node. At any moment Modality The raw, unnormalized attention score; It is a node At any moment modality The encoded feature vector; It is a trainable column vector shared by all modalities; For vectors transpose; The hyperbolic tangent activation function is a non-linear activation function that compresses the output value to a certain value. Within the range; It is a specific mode The associated trainable parameter matrix; To measure weights, if the mode is unavailable at that moment, a mask is used. Forced Set it to a minimum so that its softmax weight is approximately equal to 0.

[0047] S22: Normalize the attention scores to obtain the attention weights: ; in, For nodes At any moment Modality The final fusion weight after standardization; For the original attention score Perform exponentiation; It is a loop variable that represents the process of iterating through each mode (including) during the summation. Its existence is to distinguish the specific mode we are calculating. .

[0048] S23: Calculate the reliability of each modality based on real-time data quality such as SNR, packet loss rate, and local reconstruction error: ; in, It is a scalar between 0 and 1, representing a node. At any moment Modality The credibility of the data source; It is a nonlinear activation function, defined as ; The ratio of signal to noise is a positive indicator of data quality. The percentage of data packets lost during data transmission is a negative indicator of communication link quality. This refers to the error that occurs when using reconstruction models such as autoencoders to attempt to restore the original data; A coefficient used to adjust the importance of each data quality indicator in the overall evaluation.

[0049] S24: Multiply the attention weight by the credibility as the fusion weight of each modality vector, and obtain the comprehensive feature vector of each node by weighted summation: ; in, It is a node At any moment The final, unified representation of characteristics; For nodes At any moment Modality The original encoded feature vector. The final comprehensive feature vector carries spatial structure information, temporal dynamic information, and metadata information, and incorporates the data source reliability assessment results, which can be used as an auxiliary judgment and audit basis.

[0050] In step S3, this invention employs a technical approach combining a Bidirectional Gated Recurrent Unit (BiGRU) with multi-task learning to perform deep temporal modeling and joint discrimination on the comprehensive feature vector of each node obtained in step S2. Specifically, the comprehensive feature vectors of each node at different times are organized into a temporal sequence according to a sliding time window and input into the BiGRU network for bidirectional temporal dependency learning: the forward GRU processes the feature sequence sequentially from history to the present to identify tentative fluctuations during the attack latency period; the backward GRU processes the feature sequence in reverse order from the present to history to trace the cover-up behavior after the attack, thereby enhancing the model's ability to perceive the entire attack lifecycle. The gating mechanism inside the GRU unit further optimizes the temporal modeling process: the update gate adaptively filters historical information to remove irrelevant noise such as normal load fluctuations to reduce false alarms; the reset gate dynamically controls the influence of past states on the present, effectively capturing long-range dependencies. This temporal analysis framework provides a unified and rich feature representation for the backend multi-task classifier to simultaneously perform attack existence judgment, attack type identification, and attacked node localization.

[0051] Furthermore, the Bidirectional Gated Recurrent Unit (BiGRU) is a model architecture in deep learning that combines the advantages of bidirectional structures and GRU units, making it particularly suitable for handling temporal dependencies in sequence data. In attack sequence detection, BiGRU can effectively capture the contextual information of attack behavior, significantly improving detection accuracy. For each node, the fused feature vector sequence obtained from the spatial feature extraction layer at different time points is... ,in It is the length of the time window. Indicates the first The fusion characteristics of this node at any given time. The dimension of the fusion feature.

[0052] Within a GRU cell, for a single time step The unit, with the input feature at the current time being The hidden state at the previous moment was The formula for calculating the amount of information reset in the previous hidden state of the reset door control is as follows: ; in, To reset the door at time step The output value; In the reset gate, it is used to reset the current input. The weight matrix for linear transformation; This is used to reset the door's hidden state from the previous moment. The weight matrix for linear transformation; To reset the gate's bias vector; The Sigmoid activation function compresses the output to [0,1]. For the current time step The input feature vector.

[0053] The update gate controls how much past information the current cell retains and how much new information it absorbs. The formula for calculating this is: ; in, To update the door in time step The output value; In the update gate, it is used to update the current input. The weight matrix for linear transformation; This is used to update the hidden state of the gate from the previous moment. The weight matrix for linear transformation; To update the bias vector of the gate.

[0054] New candidate states are generated by combining candidate hidden states with historical information and the current input. The calculation formula is as follows: ; in, In time step The candidate hidden state; For use with the current input The weight matrix for linear transformation; This is the weight matrix used to perform a linear transformation on the historical information modulated by the reset gate; This is the bias vector used to compute the candidate hidden state; This represents element-wise product.

[0055] The final hidden state calculation formula is: ; in, In time step The final, hidden state of the output.

[0056] from arrive Execute the forward GRU units sequentially and output the forward hidden sequence. Similarly, from arrive Execute the backward GRU units sequentially in reverse order, and output the backward hidden output. For each moment Then concatenate the corresponding forward and backward hidden states: ; in, In time step The final output vector of BiGRU; In time step The hidden state of the forward GRU; In time step The hidden state of the backward GRU; This is a vector concatenation operation.

[0057] Furthermore, if the entire batch has Each node, after concatenation, is output in batches. This will also serve as the input to the BiGRU classification and localization head. This layer uses a fully connected network to map the high-dimensional features to an intermediate representation space, calculated as follows: ; in, To train the weights, the feature dimension is changed from... Reduce to the intermediate dimension ; It is the bias vector, output Each element It is a node The intermediate feature representation is then used. Based on this, three parallel branches are constructed to complete the tasks of attack existence determination, attack type classification, and attack node location, respectively.

[0058] Furthermore, this invention employs a multi-task learning framework based on shared feature extraction. This framework, based on the unified temporal features output by the bidirectional gated recurrent unit, achieves collaborative inference through three functionally complementary parallel branches: The attack existence check branch is used to determine whether the entire system is under attack by using a fully connected layer and a sigmoid activation function. An attack type classification branch is used to classify attack types in multiple ways using a fully connected layer and a Softmax activation function; The attack node location branch is used to determine whether each node is under attack by using a fully connected layer and a sigmoid activation function.

[0059] This structure significantly reduces computational redundancy by sharing the underlying feature extraction layer and achieves integrated end-to-end learning of detection, classification and localization through a multi-task collaborative mechanism.

[0060] Specifically, the attack existence branch is used to determine the state of the entire network at time [time]. Currently suffering from FDIA, the calculation formula is as follows: ; in, Use the Sigmoid activation function; and These are the weights and biases of the attack existence branch, respectively; For the nodes predicted by the model The probability of an attack can be viewed as a global attack existence determination obtained by performing average pooling on the entire graph. The loss function for the attack existence branch is set as follows: ; in, The loss value is the value of the attack on the existing branch; The total number of nodes in a training batch; For nodes Does the attack have a true label? This indicates that there was no attack. This indicates that the system is experiencing an attack. For nodes The predicted probability of an attack exists; It is the natural logarithm; the loss function needs to be divided by . Normalization is used to ensure that the loss is independent of the number of nodes.

[0061] If an attack exists, determine the type of FDIA within the attack type classification branch, such as full injection, incomplete injection, topology tampering, etc. The calculation formula is as follows: ; ; in, For nodes Attack type classification logits (unnormalized scores); and These represent the weights and biases of the attack classification branches, respectively. It is a node The probability distribution of attack types; for The loss function for the attack classification branch is set as follows: ; in, The loss value for the attack type classification branch; The total number of categories representing attack types; For nodes True attack type tags; For the nodes predicted by the model Belongs to the The probability of a particular type of attack. The purpose of the attack type classification branch is to optimize the accuracy of classifying different attack types when an attack has been confirmed.

[0062] The attack localization branch determines whether each node itself is directly attacked, thus locating the source node of the attack. The calculation formula is as follows: ; in, For the nodes predicted by the model The probability of being directly attacked. ; The weight vector for locating branches at a node; The bias term (scalar) for the node localization branch; the attack localization branch loss function precisely penalizes the model's localization errors at the node level, including false negatives and false positives, and the calculation formula is as follows: ; in, The loss value for locating branches at a node; For nodes The true label indicating whether it has been attacked; For the nodes predicted by the model The probability of being attacked.

[0063] In summary, the total loss function is defined as: ; in, , , These are configurable weighting coefficients. and Based on the importance of the three classifiers and the overall accuracy of the task, the following settings can be configured: .

[0064] Furthermore, during the training of the BiGRU module, the training parameters are initialized using Xavier to ensure scale balance of the signal during forward and backward propagation, maintaining the variance of the output of each layer consistent with the variance of the input, thus preventing signal explosion or disappearance in deep networks. Random seeds are manually specified to ensure reproducibility of experimental results.

[0065] The BiGRU hidden size is set to 64 to match the GCN hidden size. While stacking multiple GRU layers can capture complex dynamics, it is prone to overfitting, so the stacking layer size is set to 1. Because it's a single layer, the dropout rate (the ratio of inactivation between multiple GRU layers) is set to 0. The initial learning rate is set to 0.001. The batch size is set to the largest possible value based on the GPU memory size of different training platforms, without causing memory overflow, to shorten training time.

[0066] Adam (Adaptive Moment Estimation) was chosen as the optimizer because it combines the advantages of Momentum and RMSprop (adaptive learning rate). It adaptively adjusts the learning rate of each parameter based on the squared historical gradient, avoiding oscillations due to excessively large step sizes or slow convergence due to excessively small step sizes.

[0067] During the model parameter update process, the gradient of the loss function of the current batch with respect to the parameters is first calculated: ; in, For the training step (time step) The loss function for the current batch For model parameters The gradient; For gradient operators, it means that for all parameters of the model... Find the partial derivatives.

[0068] Then update the first-moment estimate (exponentially weighted average of the gradients) and the second-moment estimate (exponentially weighted average of the squared gradients), calculated as follows: ; ; in, In the steps The first moment estimate (exponential weighted average of gradients). This is the attenuation rate (attenuation factor) estimated by the first moment, usually taken as 0.9; In the steps First-order moment estimation (from the previous training step); In the steps The second moment estimate (exponential weighted average of the squared gradient). This is the attenuation rate (attenuation factor) estimated by the second moment, usually taken as 0.999.

[0069] Since the first-order moment estimates and second-order moment estimates are initialized to zero vectors in the initial stage, Adam applies bias correction to prevent the estimates from biasing towards zero in the early stages of training. The bias correction formula is as follows: ; ; in, and In the steps The first-order moment estimate and the second-order moment estimate after bias correction; and This is the deviation correction factor.

[0070] The Adam optimizer then updates each parameter in each iteration based on the gradient adjusted by the first and second moments: ; in, This is the set of trainable parameters for the model (all weights and biases). The global learning rate; It is a small constant to prevent division by zero.

[0071] Adam accelerates convergence based on historical gradient directions at each update step, ensuring training stability. This is especially effective in complex models like graph neural networks, preventing gradient vanishing or gradient exploding.

[0072] During training, the model performance is evaluated periodically using a validation set. Let the training set loss be... The test machine loss is .when Continued decline but The initial rise indicates overfitting, meaning the model is fitting the noise in the training set, resulting in decreased generalization ability. To prevent overfitting, an early stopping strategy is employed: if the validation set metrics show no improvement over 10 consecutive epochs, training is terminated early, and the best historical model parameters are used. This saves computational resources, shortens experimental time, and improves the model's generalization ability in real-world environments.

[0073] In summary, the entire intelligent substation network attack detection method, through the coordinated work of three steps, can effectively determine the status of network nodes and classify attacks.

[0074] Example 2: Figure 4 As shown, this invention provides an intelligent substation attack detection system based on multimodal deep learning. This system is used to implement the intelligent substation attack detection method based on multimodal deep learning described in Embodiment 1 above, specifically including: The multimodal data acquisition and encoding module 100 is used to acquire multimodal data from the smart substation, including time-series modal data, topological modal data and metadata modal data, and encodes them respectively through a pre-established one-dimensional convolutional neural network, graph convolutional network and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors and metadata feature vectors; The multimodal information fusion module 200 is used to dynamically weight and fuse temporal feature vectors, topological feature vectors, and metadata feature vectors based on attention mechanisms, data source credibility, and missing masking, to generate a comprehensive feature vector for each node. The attack detection and classification module 300 is used to input the comprehensive feature vector into a pre-established bidirectional gated recurrent unit network in time series for temporal modeling, and output attack existence judgment, attack type classification and attacked node location in parallel based on a multi-task learning framework.

[0075] This invention constructs a hierarchical intelligent substation attack detection system, whose core consists of three collaborative modules. First, the multimodal data acquisition and encoding module 100 processes power grid time-series modal data, topological modal data, and metadata modal data separately to establish a mathematical benchmark that integrates physical constraints, providing interpretable feature representations for subsequent analysis. Second, the multimodal information fusion module 200 employs a dynamic weighting mechanism, integrating modal weight calculation, credibility calibration, mask fault tolerance, and fusion output functions. It generates a robust node-level comprehensive representation through attention mechanisms and data quality assessment. Finally, the attack detection and classification module 300, based on bidirectional gated cyclic units, leverages bidirectional time-series modeling capabilities to adaptively learn the contextual features of attack behavior, simultaneously completing attack existence judgment, type identification, and source node location. Its lightweight design supports real-time deployment on substation edge devices, fully meeting the power system's requirements for low latency and high reliability protection.

[0076] This embodiment presents a smart substation attack detection system based on multimodal deep learning, used to implement the aforementioned smart substation attack detection method based on multimodal deep learning. Therefore, the specific implementation of the smart substation attack detection system based on multimodal deep learning can be found in the embodiment section of the smart substation attack detection method based on multimodal deep learning described above. For example, the multimodal data acquisition and encoding module 100, the multimodal information fusion module 200, and the attack detection classification module 300 are used to implement steps S1, S2, and S3 in the aforementioned smart substation attack detection method based on multimodal deep learning, respectively. Therefore, the specific implementation can be referred to the description of the corresponding embodiments. To avoid redundancy, it will not be repeated here.

[0077] Example 3: This embodiment of the invention provides an electronic device, which includes a processor, a memory, and a bus system. The processor and the memory are connected through the bus system. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the above-mentioned intelligent substation attack detection method based on multimodal deep learning.

[0078] Example 4: This embodiment of the invention provides a computer storage medium storing a computer software product. The computer software product includes several instructions to cause a computer device to execute the above-described intelligent substation attack detection method based on multimodal deep learning.

[0079] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0080] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0081] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The functions specified in one or more boxes. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0082] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. A method for detecting attacks on intelligent substations based on multimodal deep learning, characterized in that, include: Multimodal data from smart substations are collected, including time-series modal data, topological modal data, and metadata modal data. These data are then encoded using a pre-established one-dimensional convolutional neural network, graph convolutional network, and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors, and metadata feature vectors. Based on the attention mechanism, data source credibility, and missing mask, the temporal feature vector, topological feature vector, and metadata feature vector are dynamically weighted and fused to generate a comprehensive feature vector for each node. The comprehensive feature vector is input into a pre-established bidirectional gated recurrent unit network in time series for temporal modeling, and based on a multi-task learning framework, it outputs attack existence judgment, attack type classification and attacked node location in parallel.

2. The intelligent substation attack detection method based on multimodal deep learning according to claim 1, characterized in that, Before encoding the acquired multimodal data, a timing sliding window is used to perform clock synchronization and resampling on the acquired multimodal data; The use of a timing sliding window for clock synchronization and resampling of multimodal data specifically includes: Linear interpolation is performed on low-frequency data with a sampling rate lower than the target frequency; Statistical aggregation is performed on high-frequency data with sampling rates higher than the target frequency within a window.

3. The intelligent substation attack detection method based on multimodal deep learning according to claim 1, characterized in that, The specific process of performing dynamic weighted fusion is as follows: First, calculate the attention score for each modality: ； in, It is a scalar, representing the state of a node. At any moment Modality The raw, unnormalized attention score; It is a node At any moment modality The encoded feature vector; It is a trainable column vector shared by all modalities; For vectors Transpose of; The hyperbolic tangent activation function is a non-linear activation function that compresses the output value to a certain value. Within the range; It is a specific mode The associated trainable parameter matrix; Subsequently, the attention scores are normalized to obtain the attention weights: ； in, For nodes At any moment Modality The final fusion weight after standardization; For the original attention score Perform exponentiation; It is a loop variable that represents the iteration through each mode during the summation process. Its existence is to distinguish the specific mode we are calculating. ; Next, the credibility of each modality is calculated based on real-time data quality metrics: ； in, It is a scalar between 0 and 1, representing a node. At any moment Modality The credibility of the data source; It is a nonlinear activation function; The ratio of signal to noise is a positive indicator of data quality. The percentage of data packets lost during data transmission is a negative indicator of communication link quality. This refers to the error that occurs when using reconstruction models such as autoencoders to attempt to restore the original data; Coefficients used to adjust the importance of each data quality indicator in the overall evaluation; Finally, the attention weights are multiplied by the confidence levels to obtain the fusion weights for each modality vector, and the combined feature vector for each node is obtained by weighted summation. ； in, It is a node At any moment The final, unified representation of characteristics; For nodes At any moment Modality The original encoded feature vector.

4. The intelligent substation attack detection method based on multimodal deep learning according to claim 3, characterized in that, The data quality indicators include at least one of signal-to-noise ratio, packet loss rate, and encoder reconstruction error; when the credibility of any modality is lower than a preset threshold, a data quality alarm is triggered, and it is temporarily excluded during the fusion process through the missing mask.

5. The intelligent substation attack detection method based on multimodal deep learning according to claim 1, characterized in that, The bidirectional gated cyclic unit network includes a forward GRU and a backward GRU; The forward GRU is used to process feature sequences from history to the present to identify tentative fluctuations in the attack latency period; The backward GRU is used to process feature sequences in reverse order from the current to the past in order to trace back the cover-up behavior after an attack.

6. The intelligent substation attack detection method based on multimodal deep learning according to claim 1, characterized in that, The multi-task learning framework includes three parallel branches: The attack existence check branch is used to determine whether the entire system is under attack by using a fully connected layer and a sigmoid activation function. An attack type classification branch is used to classify attack types in multiple ways using a fully connected layer and a Softmax activation function; The attack node location branch is used to determine whether each node is under attack by using a fully connected layer and a sigmoid activation function.

7. The intelligent substation attack detection method based on multimodal deep learning according to claim 1, characterized in that, The total loss function of the multi-task learning framework is a weighted sum of the loss functions of the three branches, which share the temporal features extracted by the bidirectional gated recurrent unit network. The total loss function is defined as follows: ,in , , These are the loss functions for the attack existence branch, attack type classification branch, and attack node location branch, respectively. , , These are configurable weighting coefficients.

8. A smart substation attack detection system based on multimodal deep learning, characterized in that, The system is used to implement the intelligent substation attack detection method based on multimodal deep learning as described in any one of claims 1 to 7, specifically including: The multimodal data acquisition and encoding module is used to acquire multimodal data from smart substations, including time-series modal data, topological modal data, and metadata modal data. These data are encoded using a pre-established one-dimensional convolutional neural network, graph convolutional network, and embedded lookup table combined with a feedforward network to obtain time-series feature vectors, topological feature vectors, and metadata feature vectors. The multimodal information fusion module is used to dynamically weight and fuse the temporal feature vector, topological feature vector, and metadata feature vector based on attention mechanism, data source credibility, and missing mask to generate a comprehensive feature vector for each node. The attack detection and classification module is used to input the comprehensive feature vector into a pre-established bidirectional gated recurrent unit network in a time series manner to perform temporal modeling, and based on a multi-task learning framework, output attack existence judgment, attack type classification and attacked node location in parallel.

9. An electronic device, characterized in that, The electronic device includes a processor, a memory, and a bus system. The processor and the memory are connected through the bus system. The memory is used to store instructions, and the processor is used to execute the instructions stored in the memory to implement the intelligent substation attack detection method based on multimodal deep learning as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, The computer storage medium stores a computer software product, which includes several instructions to cause a computer device to execute the intelligent substation attack detection method based on multimodal deep learning as described in any one of claims 1 to 7.

Images