Active defense method based on concealed target and power grid communication consistency verification

Abstract

The invention belongs to the technical field of power system communication safety supervision, and particularly relates to an active defense method based on concealed target and power grid communication consistency verification. Comprising the steps of system initialization and parameter setting, hidden D-FACTS arrangement in a planning stage, DC-HMTD optimization solution in an operation stage, safe issuing and cross-channel consistency verification in a communication stage, and local self-certification and atomic application and rollback in the communication stage. According to the method, hidden defense and efficient detection of false data injection attacks are achieved through a planning-operation-communication three-layer cooperation mechanism, on the premise that non-D-FACTS measurement is basically unchanged, the attack detection probability and defense robustness are remarkably improved, system stability impact is avoided, power generation economy and communication safety are both considered, and the method is suitable for large-scale popularization and application. The method is suitable for security scheduling and intrusion prevention of smart grids.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of power system communication security supervision, in particular to an active defense method based on hidden target and power grid communication consistency verification. BACKGROUND

[0002] Smart grid is expected to realize control and automation process in the whole power system to support efficient and reliable two-way flow, and information and communication technology (ICT) enabled devices are connected to the power grid, which brings efficiency improvement, but also brings growing concerns about vulnerability.

[0003] The state estimation (SE) and dispatch control of the power system depend on the consistency of the measurement and the model, and the false data injection (FDI) attack makes the residual bad data detection (BDD) invalid by constructing the pseudo error falling in the column space of the measurement matrix, and then misleads the flow and dispatch decision; To cope with this kind of hidden attack, mobile target defense (MTD) proposes to change the network parameters (such as line reactance / admittance) online to make the system model mastered by the attacker outdated, so that the originally hidden attack is explicit, but in most cases, limited by the number of grid lines, the use of MTD to change the line reactance has an upper limit of detection, and the system is easy to be found to apply MTD, and the alert and experienced attacker can detect the existence of MTD by using his knowledge of system parameters combined with the eavesdropped measurement to carry out residual-based bad data detection.

[0004] Under this background, once the attacker realizes that there is MTD, he may postpone the original attack, invest more resources to obtain updated system knowledge, and may further invade more critical links, and at the same time, the existing work regards the instruction issuing from the control center to the field device as a trusted channel, however, in the actual industrial control system (ICS), the transmission of control instructions and measurements faces communication layer threats such as eavesdropping, tampering, replay, timing disturbance and gray drift; On the one hand, the attacker may make small shifts or delayed replays to the set value without breaking the traditional encrypted session, weaken the admittance disturbance amplitude, and then reduce the detection probability, on the other hand, the field device usually lacks a local verifiable mechanism for whether the received instruction meets the concealment constraint and whether it reaches the expected disturbance amplitude, so that even if the link has authentication and encryption, it is also difficult to find out that the instruction has been repackaged by a man-in-the-middle or silently degraded in a timely manner. SUMMARY

[0005] The purpose of the present application is to provide an active defense method based on hidden target and power grid communication consistency verification to solve the technical defects proposed in the background art.

[0006] To achieve the above object, the application provides the following technical scheme: the active defense method based on the communication consistency verification of the concealed target and the power grid, comprising the following steps: Step one, system initialization and parameter setting: The power grid topology and measurement model are established, the unit output, power flow and voltage constraints are loaded, the distributed flexible alternating current transmission system capability boundary is generated, the communication and field configuration are completed, the main channel and the monitoring channel are connected, and the time is completed; Step two, planning stage of concealed D-FACTS arrangement: According to the rules of "non-D-FACTS graph multi-connected", "two or more consecutive non-D-FACTS lines in the ring" and "three or more consecutive D-FACTS lines in the ring", the feasibility heuristic algorithm of graph theory-combination optimization is used to determine the position of D-FACTS and non-D-FACTS lines, to ensure the existence of concealed mobile target defense and make the rank of composite matrix reach the upper limit, and to cover the remaining necessary buses except the leaf nodes with degree 1; Step three, DC-HMTD optimization solution in running stage: Under the concealment constraint, the line admittance value setting vector is obtained through "hiding + amplitude" joint optimization to maximize the detectable disturbance and keep the non-D-FACTS measurement basically unchanged; Step four, security issuance and cross-channel consistency verification in communication stage: The dispatching end generates a command message containing the D-FACTS setting line admittance vector, incremental serial number, UTC time stamp, strategy number and minimum disturbance amplitude declaration in each control period, and performs differential encryption packaging to generate an authentication tag; At the same time, the set summary fingerprint is issued in the independent monitoring channel; Step five, local self-verification, atomic application and rollback in communication stage: After completing the station verification, the local self-verification is performed on the received setting value, and the concealment is quickly checked if necessary; After passing, the setting is applied atomically in two stages: first write to the temporary hanging register and check the consistency with the monitoring channel summary, and then write to the execution register to take effect; If any stage fails or an exception occurs, immediately roll back to the last period effective setting and maintain the output unchanged, record the audit information and actively report the alarm.

[0007] Further, the planning stage comprises the following steps: State estimation: based on the direct current state estimation model, the system node voltage phase angle is estimated through the measurement vector, the least square method is used to solve the optimal solution, and the bad data detection mechanism is used to calculate the measurement residual to determine whether there is bad data; FDI attack resistance analysis: the principle of FDI attack polluting state estimation by injecting false data, and the condition that the attack makes the bad data detection mechanism invalid; HMTD existence and composite matrix rank maximization condition: HMTD needs to keep all active power flow and active power injection measurements unchanged after being applied, and its existence needs to satisfy the following conditions: the non-D-FACTS graph is non-connected and acyclic, the D-FACTS graph is acyclic and covers all buses except the acyclic buses, all D-FACTS devices are not in the idle state, and the buses at both ends of the D-FACTS line do not belong to the same connected component of the non-D-FACTS graph, are both isolated nodes of the non-D-FACTS graph, and have the same phase angle increment; the rank maximization of the composite matrix is determined by the number of loops in the non-D-FACTS graph.

[0008] Further, the HMTD placement algorithm includes the following steps: Preprocessing: calculate the degree of each bus, and determine the set of buses to be covered except the leaf nodes; Constructing a forest: select a node as the root, build a tree by breadth-first search algorithm, delete a tree edge to form a generated forest, initialize the D-FACTS and non-D-FACTS line set, and merge the non-D-FACTS lines by using the union-find set to avoid loops; Loop rule correction: for each basic loop formed by an edge, adjust the line properties according to the rules to avoid two or more consecutive non-D-FACTS lines or three or more consecutive D-FACTS lines in the loop; Coverage correction: for the buses not covered, preferentially select tree edges to adjust to D-FACTS lines, and correct the related basic loops to ensure that all necessary buses are covered; Verification and finishing: confirm that the line set meets the acyclic requirement and meets the loop rule and coverage constraints by using the union-find set.

[0009] Further, the "alternating optimization" algorithm is used in the running stage, and the specific steps are as follows: Initialization and feasible region determination: read the power grid topology and DC parameters, generate the related matrix, set the safety constraints and initial parameters; Subspace construction: calculate the null space of the measurement submatrix of the non-D-FACTS line; Alternating optimization: fix one parameter to solve the optimal solution of the other parameter, then fix the optimal solution to update the previous parameter by piecewise linearization, and verify the power flow and limits in parallel. If the constraints are violated, back off or reduce the step size according to the priority; Hidden consistency verification: verify that the numerical error of the measurements before and after optimization is within the threshold range; Performance evaluation: calculate the attack detection probability and defense concealment probability indicators; Result delivery: The optimized setting value is delivered to the D-FACTS device, and a small correction state offset is adjusted through scheduling.

[0010] Further, the security delivery and cross-channel consistency verification of the communication stage include the following steps: Main channel command message construction: the message contains D-FACTS setting line inductance vector, incremental serial number, UTC timestamp, policy / version identifier, minimum disturbance amplitude threshold and authentication label; Integrity and confidentiality packaging: the protected load is processed by using a key-based AEAD encryption-authentication algorithm, and external associated data participates in authentication but is not encrypted; Monitoring channel summary fingerprint publishing: a summary fingerprint is generated based on a secure hash algorithm, which contains monitoring channel epoch identifier / round number and setting related information; Replay and timing window verification: whether the message has the risk of timeout, expiration or replay is judged by a sliding window and time tolerance; AEAD verification: if the verification is passed, the message is decrypted, and if the verification fails, the execution is rejected and the rollback process is entered; Cross-channel consistency verification: the Hash value calculated by the main channel load is compared with the summary fingerprint of the monitoring channel to ensure that there is no risk of tampering or gray drift.

[0011] Further, the local self-certification and atomic application and rollback include the following steps: Amplitude lower limit self-certification: ensure that the disturbance amplitude of the setting value and the effective setting of the last period is not lower than the declared threshold; Device boundary self-certification: verify that the line inductance vector of each D-FACTS setting is within the device physical and operating boundary range; Concealment rapid review: confirm that the voltage phase angle increment caused by the setting vector is within the threshold range; Atomic application and rollback: atomic application of the setting value is realized through two-stage state transfer, and if any link fails, it is immediately rolled back to the effective setting of the last period; Audit record: record only increasing audit information including serial number, timestamp, policy identifier, verification result and failure reason code; Parameter management: configure the sequence window length according to the suggestion, and update the key daily or according to the alarm event.

[0012] Compared with the prior art, the beneficial effects of the present application are: In the present application, planning-operation integration improves detection effectiveness and availability: For D-FACTS line selection and operation period setting, a unified optimization model is constructed, and "line loop-free, ​The system features lines that are neither looped nor interconnected, along with local constraints on the loops. Under the premise of meeting operational constraints such as power flow, voltage, and thermal stability, the system optimizes the settings in a rolling manner. During high-risk periods, the disturbance amplitude is appropriately amplified to increase the detection probability, while during low-risk or high-load periods, the disturbance is converged to reduce losses. By balancing concealment and detectability, the system achieves adaptive optimal operation throughout the entire process.

[0013] In this invention, the constructivist graph algorithm ensures that the project is feasible and its deterministic nature is reproducible: A feasible constructivist heuristic algorithm based on graph theory and combinatorial optimization is proposed: First, a spanning tree is obtained using BFS as the trunk, and then an edge is removed from the tree to form... The forest, then each basic ring is processed in the order of "isolation-selection-local repair", and blocked using a disjoint-set data structure. The algorithm forms a loop and then performs a final bus coverage correction. It does not rely on a global solver, is scalable, and produces deterministic results. It can be quickly reconstructed when encountering disturbances or changes in the scheme, significantly reducing implementation costs and parameter tuning workload.

[0014] In this invention, a secure implementation mechanism for communication-operation collaboration is provided: This invention constructs a closed loop of command issuance, verification, and execution without sacrificing optimal control. The scheduling side uses AEAD authentication to encrypt commands and carries a sequence number and UTC timestamp. On-site replay detection is performed according to sequence windows and time windows. At the same time, command hash digests are published on an independent monitoring channel, and cross-consistency verification is performed between the back-end and the main channel. The device side performs local self-verification of the "lower limit of disturbance amplitude" and "physical boundary". After passing, it enters a two-stage submission: first, the write is temporarily suspended and the consistency is verified, and then the atomic submission is performed. If any step fails, it rolls back to the previous valid setting and issues an alarm. This method can significantly improve the system's security, traceability, and long-term adaptive optimization capabilities. Attached Figure Description

[0015] To facilitate understanding by those skilled in the art, the present invention will be further described below with reference to the accompanying drawings; Fig. 1 This is a flowchart illustrating the overall method of the present invention; Fig. 2 This is a flowchart illustrating the operation of each stage and step in this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] Example 1: As Figs. 1-2 As shown, the proactive defense method proposed in this invention, based on the consistency verification of concealed targets and power grid communication, is a systematic proactive defense method covering the planning layer, operation layer, and communication layer. Existing research mostly focuses on using MTD to change line reactance to resist forged data injection attacks. However, the system is easily detected when MTD is applied. If a vigilant and experienced attacker detects the presence of MTD by using their knowledge of system parameters, they may postpone the original attack, invest more resources to obtain newer system knowledge, and may further intrude into more critical links.

[0018] Meanwhile, existing methods often treat the transmission of commands from the control center to field devices as a trusted channel. However, in actual industrial control systems (ICS), the transmission of control commands and measurements faces communication layer threats such as eavesdropping, tampering, replay attacks, timing disturbances, and grayscale drift. This invention not only integrates planning, operation, and communication, but also defends against various attacks and improves the detection rate of covert attacks, possessing outstanding innovation and practical value. The invention mainly consists of the following steps: Step 1: System Initialization and Parameter Setting Establish a power grid topology and measurement model, load unit output, power flow and voltage constraints, and generate the capacity boundary of the distributed flexible AC transmission system; at the same time, complete communication and field configuration, connect the main channel and the monitoring channel and complete time synchronization. Step 2: Concealed D-FACTS Layout in the Planning Phase: Based on the rules of "multi-connected non-D-FACTS graphs", "no two or more consecutive non-D-FACTS lines in a ring", and "no three or more consecutive D-FACTS lines in a ring", a graph theory-combinatorial optimization feasibility constructivist heuristic algorithm is used to determine the positions of D-FACTS and non-D-FACTS lines, ensuring the existence of covert moving target defense and reaching the upper limit of the rank of the composite matrix, while covering all necessary bus lines except for leaf nodes with a degree of 1. Step 3: Optimization and solution of DC-HMTD during the runtime phase: Under the concealment constraint, the line susceptance setting vector is obtained through the joint optimization of "concealment + amplitude", so as to maximize the detectable disturbance and keep the non-D-FACTS measurement basically unchanged. Step 4: Secure distribution and cross-channel consistency verification during the communication phase: In each control cycle, the dispatcher generates a command message containing the line susceptance vector set by D-FACTS for this cycle, the incrementing sequence number, the UTC timestamp, the strategy number, and the minimum disturbance magnitude declaration. The command message is then encrypted and encapsulated with authentication to generate an authentication tag. At the same time, the set digest fingerprint is published on the independent monitoring channel. Step five, local self-verification and atomic application and rollback of communication phase: After the on-site device completes the station check, it performs local self-verification on the received set value, and performs a covert quick check if necessary; after passing all, it atomically applies the setting in a two-stage manner: first, write to the temporary register and review the consistency with the monitoring channel summary, and after passing, write to the execution register once to take effect; if any stage fails or an exception occurs, immediately roll back to the last period of valid setting and maintain the output unchanged, while recording audit information and actively reporting an alarm.

[0019] Specifically, in step S1: Power grid graph theory topology and measurement model initialization: Direct current (DC) power flow analysis is faster and more robust than alternating current (AC) method, and thus is widely used in the planning and operation of power transmission systems.

[0020] Topology and parameters: bus set , line set E, reactance on any line , line susceptance , D-FACTS installable line set , non-D-FACTS set , the power grid topology is regarded as an undirected graph , where the size of the power system bus set V is , the size of the line set E is , and any line is , “D-FACTS line” and “non-D-FACTS line” respectively represent the line set with and without D-FACTS devices, and is the D-FACTS graph, which is a subgraph of L consisting of D-FACTS lines and all buses, and is the non-D-FACTS graph, which is also a subgraph of L consisting of non-D-FACTS lines and all buses.

[0021] In DC-SE (direct current state estimation), the system state (i.e., the phase angle of each node voltage) is estimated by a set of measurement vectors corresponding to node injection power and line flow , and the measurement noise covariance matrix is .

[0022] First-order Taylor expansion is performed on at the operating point x: (1) Moving the constant term to the left side, we get (2) If In DC model, H is independent of operating point, and can be written directly as: (3) where is the measurement matrix mapping system states to measurements, is the measurement noise, is the standard deviation of the mth measurement noise.

[0023] Generator output, power flow and voltage constraints: Line series impedance and admittance: (4) where Line series complex impedance, is the line resistance, is the line susceptance, is the line conductance.

[0024] For high voltage transmission networks, it is often that the phasor voltage and the power are positive.

[0025] The AC (alternating current) line active power is obtained from and : (5) where are the voltage phasors of bus i and bus j, respectively.

[0026] In DC, the voltage amplitude can be assumed to be constant, the voltage phase angle difference is , and the line is mainly inductive .

[0027] Substituting the above conditions into equation (5) gives (6) Therefore, the DC operating constraints, line power flow and thermal stability limits are as follows (7) where is the line active power flow, is the line susceptance, is the bus i voltage phase angle, is the bus j voltage phase angle.

[0028] Generator output and ramping: (8) wherein are the active power upper and lower limits of the unit, is the active power output value of the ith unit, is the single-cycle ramping limit, denotes the active power output value of the ith unit that has been output and actually executed in the last dispatching cycle, and the reference angle: , is the reference bus voltage phase angle.

[0029] Physical device boundary of D-FACTS line: (9) wherein is the line reactance after the line device, is the line reactance before the line device, is the upper limit of the relative adjustment of the device.

[0030] Time and sequence window initialization: (10) wherein is the standard time at the dispatching end, is the time at the field device, is the allowed time synchronization error, is the maximum sequence number that has been accepted in the last cycle, is the length of the sliding window, is the effective sequence interval in the current cycle.

[0031] Algorithm and key configuration: (11) wherein is the authentication encryption algorithm, is the digest algorithm, and k is the session key, is the length of its use, is the key rotation period.

[0032] Monitoring channel epoch and digest format: (12) wherein is the system start time, is the length of the epoch, and b is the line susceptance vector in the current cycle, denotes byte splicing, is the check fingerprint format published by the monitoring channel.

[0033] Local self-certification threshold and boundary: (13) (14) in The minimum disturbance amplitude threshold, The value ranges from 0.05 to 0.2. To quickly verify the threshold for concealment, Let k be the noise standard deviation for measurement, and k be the noise multiplier factor.

[0034] Atomic Applications and Backoff Baselines (15) in To safely roll back the curve, For temporary area registers For the execution area register.

[0035] Logs and Alarms Channel (16) Where L is the set of incremental audit fields. To ensure minimum log retention, the alarm link must be connected to the scheduling side to receive the anomaly reports from steps 4 and 5.

[0036] In step S2: Power information physical systems have complex structures. To eliminate the impact of measurement errors, state estimation is necessary. Currently, the least squares method is widely used in state estimation. Under the DC power flow model, we assume that the measurement noise e=0, and the objective function is: (17) When W is symmetric positive definite, it is derived that... Full Rank The optimal solution for the bus voltage phase angle vector is: In power grids, bad data detection (BDD) mechanisms are typically used to calculate measurement residuals and detect the presence of bad data.

[0037] (18) (19) Where r is the measurement residual. A residual threshold is set; data below this threshold is considered "no bad data". Describing the degrees of freedom as quantile The chi-square threshold, The significance level is indicated by .

[0038] FDI (Fake Data Injection) attacks pollute state estimation by injecting fake data into vector measurements. (20) in The measurement vector after injecting attack vector. If At this time we do bad data detection, that is: (21) At this time we get the size of the measurement residual of the power grid before and after the attack does not change, but the actual measurement value has deviated from the actual situation.

[0039] The core idea of hidden MTD (HMTD) is that the system measurement is almost unchanged or unchanged after applying HMTD, that is, it satisfies , where is the original measurement matrix, H is the measurement matrix after applying HMTD, this condition makes the estimated residual of the attacker in BDD check remain unchanged before and after HMTD. The defense stealth probability (DSP) is a commonly used index to quantify the stealthiness of MTD from the perspective of the attacker, which is defined as: (22) HMTD can keep all the measurements of active power flow and active power injection unchanged after changing the setting value of D-FACTS device. When the control room sends control signals to the D-FACTS device, the line reactance can be changed within seconds. During the activation of MTD, the change of active power injection measurement at each node is extremely small. Therefore, it is reasonable to assume that the system load remains unchanged during the activation of MTD. The tide flow measurement is arranged in the following order, that is, , where represents the measurement vector corresponding to the D-FACTS line, is the measurement vector corresponding to the non-D-FACTS line. Since the reactance of the non-D-FACTS line does not change, the tide flow measurement submatrix before and after HMTD is the same. In the DC model, the measurement matrices before and after HMTD are represented as: (23) , where represents the tide flow measurement submatrix of the D-FACTS line before HMTD, represents the tide flow measurement submatrix of the D-FACTS line after HMTD. represents the tide flow measurement submatrix of the non-D-FACTS line after HMTD. Therefore, the tide flow measurements before and after HMTD are: (24) (25) , where is the voltage phase angle increment introduced by HMTD, is the voltage phase angle value before HMTD. Since all measurements remain unchanged after HMTD is applied, i.e. , the concealment condition can be derived under noise-free conditions as follows: (26) The D-FACTS line measurement sub-matrix satisfies: and after HMTD.

[0040] (27) The non-D-FACTS line measurement sub-matrix and the phase angle increment satisfy: so that these measurements remain unchanged (fall in the null space of ).

[0041] However, not all power systems can construct HMTD, so whether a certain power system can achieve the concealment of MTD also needs to meet some conditions.

[0042] The encrypted instructions from the system dispatch control room can be safely transmitted to the D-FACTS gateway through DNP3, IEC61850 and 60870-5-104 protocols to change the set value of the D-FACTS device. MTD (Moving Target Defense) uses D-FACTS devices to create uncertainty for attackers. The reactance increment of the line can be adjusted periodically by the D-FACTS device, and its range satisfies formula (9), so the measurement matrix H used by state estimation (SE) will change over time. If the attacker constructs an FDI attack based on outdated H information, the estimation residual in the defense BDD will increase significantly, so it will be detected, at which time the control center will remove the bad data and re-perform state estimation.

[0043] Concealable MTD (HMTD) is a better MTD: for those alert attackers who try to detect the existence of MTD by using residual-based BDD, HMTD can still remain hidden. The previous HMTD algorithm combines D-FACTS arrangement with protected measurement table arrangement. This joint algorithm places a protected measurement table in each loop to obtain the HMTD with the maximum rank of the composite matrix. The conclusion is that MTD can only remain concealed when the reactance of each line in a loop is modified by the same multiple factor. However, this is actually too harsh a condition for HMTD. In order to solve this problem, the invention solves it in two parts: MTD planning and MTD operation.

[0044] In terms of MTD planning: 1. Based on graph theory and topological analysis, the conditions for the existence of HMTD and the maximization of the rank of the composite matrix are derived.

[0045] 2. A graph theory-combinatorial optimization feasibility constructivist heuristic algorithm is proposed, which can construct an HMTD with the maximum rank of the composite matrix and covering all necessary buses.

[0046] To construct an HMTD in a power system, equation (26) must first be satisfied to ensure that it remains hidden and does not trigger detection. Then, at least one adjustable channel must undergo an effective change, i.e.: (28) The solution set of equation (27) is null space: The dimension of null space is To construct hidden perturbations, one must have (29) If for any All That means This will cause us to change the state even if we move. Complete measurement It also remains completely unchanged, unable to form an effective MTD perturbation, and the attacker will not be destroyed. In order for (23) to hold, there needs to be at least one direction. make (30) Right now: Using the duality relation of linear algebra: (31) because The number of columns is the same as that of H, which is (n-1), therefore (32) At this point, we obtain the condition for the existence of HMTD, namely equation (32). When the equation is satisfied, it will not change the measurement visible at the non-D-FACTS end, but it will be reflected at the controllable channel, causing damage to the covert forgery vector constructed by the attacker.

[0047] The rank of the composite matrix of HMTD is determined by the arrangement of D-FACTS, assuming all D-FACTS devices are in a non-idle state, and (D-FACTS graph) If there are no cycles, then the rank of the composite matrix in HMTD is determined by a non-D-FACTS graph. The number of rings is determined as shown in the following formula: (33) wherein denotes the number of the middle ring. From the formula, it can be seen that and the number of the connected components in do not affect the rank of the composite matrix.

[0048] We derive a sufficient condition based on the topological analysis to guide the D-FACTS placement to achieve the concealability of MTD, and the measurement deployment matrix H can be expressed as: (34) wherein is the measurement deployment matrix in the power system, is a diagonal reactance matrix, whose diagonal elements are the inverses of the reactances of the lines; is a line incidence matrix. The decomposition of H can be applied to , as shown below: (35) (36) wherein is the diagonal reactance matrix of the D-FACTS line, is the diagonal reactance matrix of the non-D-FACTS line, is the measurement deployment matrix of the D-FACTS line, is the measurement deployment matrix of the non-D-FACTS line, is the incidence matrix sub-matrix of the D-FACTS line, is the incidence matrix sub-matrix of the non-D-FACTS line.

[0049] In graph theory, in a planar graph with n nodes and t connected components, the rank of the incidence matrix A is , i.e. , so in we can get: (37) wherein is the connected component in . In order to make HMTD exist, it can be known from formula (37) that , at this time it can satisfy , and at the same time it naturally satisfies that there is at least one direction to make .

[0050] But not all HMTDs are effective in detecting FDI attacks, both concealability and detection effectiveness must be considered in D-FACTS placement, to ensure detection effectiveness, the HMTD based on D-FACTS placement should make the rank of composite matrix maximum, in addition, attack detection probability (ADP) is another widely used indicator to measure the effectiveness of MTD detection, which is defined as: (38) The rank of composite matrix is related to the number of grid lines p, when , the composite matrix is full rank , it is worth mentioning that most of the actual power grid system is limited by the number of lines, the maximum rank of composite matrix is when the MTD perturbs the line reactance, therefore, when the rank of composite matrix is p and satisfies , the HMTD with maximum rank exists when the composite matrix is non-connected and acyclic.

[0051] Next, the problem of how to place D-FACTS devices is explained, the concealability conditions described in equations (26) and (27) show that there is a close relationship between D-FACTS setting value and phase angle increment, this relationship directly guides how to optimally place D-FACTS devices on the line, therefore, it is necessary to introduce the relationship between D-FACTS setting value and phase angle increment before explaining the hiding D-FACTS device placement algorithm.

[0052] Let bus i and bus j be a pair of adjacent nodes in the same connected component in , their voltage phase angles before HMTD are and , the power flow on line before HMTD is , assume that after HMTD, the phase angle increments of bus i and j are different, i.e. and , , then the power flow on this line after HMTD becomes , by comparison, we get , which contradicts the fact that the power flow should remain unchanged before and after HMTD.

[0053] Since no D-FACTS device is installed in , the cannot be changed, so the node phase angle increment of any pair of adjacent nodes in must be the same, further, it can be deduced that all nodes in the same connected component have the same voltage phase angle increment in HMTD.

[0054] In The D-FACTS devices in the system cannot be idle. Here, an isolated node is defined as a node whose connected lines are all buses of D-FACTS lines. Therefore, in order to ensure that all D-FACTS devices are in operation, the following two situations need to be avoided: In HMTD, the two ends of a D-FACTS line cannot belong to the same bus. The same connected component, in The requirement is that all nodes within the same connected component have the same voltage phase angle increment, i.e. However, this invention mandates that the D-FACTS device cannot be in an idle state, i.e. Therefore, we can obtain This contradicts the fact that the power flow before and after HMTD should remain unchanged, so this situation needs to be avoided when arranging D-FACTS devices.

[0055] Second, in HMTD, the two ends of a D-FACTS line cannot both be buses. In a context where isolated nodes cannot have the same phase angle increment, this means... There is a connected component containing three D-FACTS lines connected together. In this case, the voltage phase angle changes of the end bus of the first line and the beginning bus of the third line, which is the start and end bus of the second line, cannot be the same. Otherwise, the phenomenon of inconsistent power flow before and after HMTD will occur in the first case, thus causing the D-FACTS device to be in an idle state.

[0056] In summary, based on graph theory topology analysis, in order to construct a maximum-rank HMTD that covers all necessary buses, its D-FACTS arrangement, in addition to the two cases mentioned above, must also satisfy: (1) (2) is a disconnected and acyclic graph. (2) The graph is acyclic and its edges cover all buses except those not on any ring; (3) No D-FACTS device should be idle.

[0057] The algorithm for arranging the concealed D-FACTS device is as follows: The objective function is (39) in For the trace of the matrix, It is the identity matrix. Let E be the model projection matrix required in the complementary projection of the residual orthogonal projection, and let E be the line set. Let the unit unit column response matrix be... , Let D-FACTS be the measurement disturbance caused by a unit amplitude D-FACTS on line e. (40) in To map the set vector of the "loaded set" to the linear operator of the measurement perturbation column family, The column selection matrix, composed of standard basis columns, is used to select columns from E. Substituting equation (40) into equation (39) yields the following: (41) in The kernel matrix is ​​a quadratic form with constant coefficients (positive semi-definite), and the vectors are selected using 0-1. Indicate whether to install You can get (42) in Each is a matrix The e-th diagonal element and the e-th k-th column element, Given the current selection k, if the marginal target gain of the newly added line e is... The algorithm's performance is ultimately evaluated by summing the current line index k and using a comprehensive score. (43) in Edges with key meanings are prioritized. Once the "meaning" edge is added, which local rules might be violated? The requirement is that all nodes except leaf nodes must be covered. If an edge does not significantly help the uncovered nodes, points will be deducted.

[0058] Given an undirected topology of a power grid Divide the line set into ,in For the installation of D-FACTS lines, For lines that do not have D-FACTS installed.

[0059] Coverage constraint: Except for leaf nodes with a degree of 1 ( (The busbars mentioned above are considered exempt), all other busbars must be... To achieve coverage, i.e., being adjacent to at least one D-FACTS line, and to satisfy the requirement of concealed arrangement, a graph theory-combinatorial optimization feasibility constructivist heuristic algorithm is proposed. The specific steps are as follows: Preprocessing: Calculate the dimensions of each busbar ; Note the set required for covering .

[0060] structure forest: 2.1 Root selection: In the graph Take one of them as root i.

[0061] 2.2 Initialization: queue , record visited set , generate tree edge set .

[0062] 2.3 Build tree by BFS algorithm: when is not empty, take the head node x. For each neighbor : if , then , add to , where is the adjacency node set of node x, record the undirected edge in the form of ordered pair with "small number first", only store once to avoid duplication.

[0063] 2.4 Output: , connected graph .

[0064] 2.5 Delete a tree edge from T (preferably "cut edge" / edge that makes both sides close in size), get the generated forest F, so the connected components of the non-D-FACTS graph .

[0065] 2.6 Initially set , .

[0066] 2.7 Initialize the union-find set on V, only merge the edges in , if a loop occurs, move the edge that leads to the loop back to .

[0067] Loop rule modification: for each edge in , find the unique path on the forest , form the basic loop .

[0068] If length : meet the condition that in each loop of the system topology, two or more consecutive non-D-FACTS lines are not allowed to appear, if , select several edges on P according to "one in one out" to turn into , so that does not appear on the loop consecutive segment of length ; check before turning each edge on , if it will close - For cycles, skip the adjacent edges and perform the necessary flipping. After this processing, the cycle... Continuous segments are limited to length Therefore, within each ring of the system topology, no more than two consecutive D-FACTS paths are allowed, and each time a tree edge is moved from... Turn to None of them will make Cycles are generated (deleting edges in a forest only increases the number of components), and ensure It is still a forest.

[0069] Overwrite correction For each ,like Not yet with any If edges are adjacent, then among its neighbors, the one currently belonging to the edge is selected first. e tried to turn over the tree. : 1. Use first 1. Check if a loop will close; 2. If safe, flip the loop and locally correct all basic loops related to 'e' according to the rule that no more than two consecutive D-FACTS lines are allowed; 3. If all flips fail, choose another line from the adjacent edges to try, repeating until all loops are closed. It was covered.

[0070] Verification and Closure Use disjoint-set data structure to confirm Acyclic Acyclic and .

[0071] For each Construct the corresponding basic loop, check each loop, and do not allow two or more consecutive non-D-FACTS lines, nor do you allow two or more consecutive D-FACTS lines.

[0072] The hidden D-FACTS layout algorithm of this invention guarantees: 1) the maximum rank of the composite matrix; 2) all necessary buses are covered; and 3) the existence of HMTD. Based on the algorithm, the D-FACTS device for the IEEE 14-node system is derived. In the IEEE 57 system, the algorithm places the devices on 47 lines; ; In order to further obtain HMTD with the greatest detection effectiveness, this invention proposes an HMTD operation model to determine the setting values ​​of the D-FACTS device.

[0073] In step S3: The DC-HMTD (Cyber-Directional Hidden Moving Target Defense) model is shown below: From equation (23), we can obtain: (44) in is the measurement matrix after HMTD, and b is the line susceptance vector set by D-FACTS in the current period.

[0074] From equations (26) and (32), we can obtain: (45) (46) DC-HMTD setting design With the goal of maximizing detectability without alerting attackers, a combined optimization approach of "concealment + amplitude" is employed: (47) in The line susceptance vector of HMTD; The relative adjustment upper limit is set to 0.2 in this invention; DC Trend? This refers to the thermal limit of the circuit. Contributing to the unit's efforts This is the unit's ramp-up limit; given b, The optimal solution is equivalent to the solution in the subspace Maximize Its direction is exist The principal singular vector on.

[0075] This invention will employ "alternating optimization" b and Iterative updates until convergence are performed, following these steps: Initialization and feasible region: Read the topology and DC parameters to generate line association sub-matrix blocks. Selection matrix of channels measured in total power flow , ,set up , , With safety constraints .

[0076] Subspace construction: calculate zero space .

[0077] Alternating optimization 3.1 Fix b, solve ,have to .

[0078] 3.2 Fixing Segmented linearization update for b under linear constraints, parallel check power flow and limits.

[0079] 3.3 If security constraints are violated, step back or reduce according to priority.

[0080] where y is a coordinate vector on the null space basis of . is the eigenvector corresponding to the largest eigenvalue of .

[0081] Hidden consistency check Verify that the numerical error of is within the threshold.

[0082] Performance evaluation Calculate and ; estimate ADP at a frequency of , and record DSP indicators.

[0083] Results delivery Set the value of b to D-FACTS; state deviation is corrected by scheduling small amendments.

[0084] In order to show the effectiveness of HMTD in defending against false data injection attacks, the present application is compared with the system (RMTD) in which D-FACTS devices are randomly arranged. Regardless of the size of the MTD amplitude, the HMTD operating method is always hidden from the attacker. At the same time, a larger MTD amplitude will bring a higher ADP (stronger detection ability) to HMTD. Under the same MTD amplitude, HMTD is superior to RMTD in detection effectiveness, because the proposed HMTD operating model maximizes the change in admittance, thereby introducing more uncertainty for the attacker. In addition, when the MTD amplitude is small, the detection effectiveness of RMTD is very limited, but it is still hidden from the attacker. The reason is that the change in admittance introduced by RMTD is too small to cause any change in the measured flow. In RMTD, as the MTD amplitude increases, its DSP (hiddenness) decreases, while its ADP (detection ability) increases.

[0085] Based on different measurement noise standard deviations The impact of load variation on the concealment of the proposed HMTD can be known that as the load variation amplitude increases, the DSP decreases, which is due to the load variation leading to the change of power flow, thereby destroying the concealment condition. Larger noise level can alleviate the negative impact of load variation on concealment, so the DSP is higher. This phenomenon can be explained by analyzing the BDD of the attacker. Specifically, the larger the noise, the higher the tolerance of the BDD of the attacker to the deviation between the measured power flow and the estimated power flow (wider threshold), so it is more difficult to detect the HMTD.

[0086] In step S4: The security issuing and cross-channel consistency process is shown as follows: Main channel command message structure In each control cycle, the scheduling end generates a control instruction message according to the operation optimization result of the current period. The message contains: the set value of each D-FACTS line in the current cycle, the incremental serial number, the UTC time mark, the strategy or version identification, and the minimum disturbance amplitude allowed in the current cycle. The set value and the minimum disturbance amplitude will participate in the authentication encryption process together to form a verifiable complete load to prevent unauthorized modification, scaling or replacement during transmission. At the same time, the scheduling end issues a verification-only digest fingerprint in the independent monitoring channel, which corresponds one-to-one with the main channel load for subsequent consistency comparison.

[0087] (48) Wherein is the minimum disturbance amplitude threshold, is the incremental serial number, is the UTC time stamp (seconds); is the strategy / version identification; is the authentication encryption encapsulation label; Integrity and confidentiality encapsulation (AEAD) (49) Wherein is the AEAD encryption-authentication algorithm with key k; m is the protected load; h is the external associated data (AAD) which is not encrypted but participates in authentication; is a byte-level splicing operation. Monitoring channel digest fingerprint Monitoring channel digest fingerprint (50) Wherein is the security hash; is the epoch identification / round number of the monitoring channel; After receiving the main channel instruction, the field device will perform three rapid checks: first, the arrival time is compared with the sequence number sliding window and time window to exclude messages that are overdue, expired or replayed; second, the message authentication tag (AEAD) is verified to confirm that the payload has not been modified during transmission and is from a trusted dispatch end; third, the set value in the main channel is spliced with the sequence information to calculate the Hash, which is compared with the digest fingerprint issued synchronously by the monitoring channel to ensure consistency between the two channels. If any link fails, it is determined that there is a risk of replay attack or modification (including weakening) of parameters, and the instruction is not executed.

[0088] Replay and time window (51) wherein is a sliding window; is the local receiving time (UTC) of the device; : time tolerance; AEAD verification (52) wherein is identified by passing and successfully unsealing m . Failure will directly reject execution and enter the rollback process.

[0089] Cross-channel consistency (53) Left and right equality means that the main channel payload b has not been replaced / gray shifted by an intermediate person; if not equal, it is considered as a "package / downgrade" risk and execution is rejected.

[0090] To prevent the key settings and security strength from being quietly "weakened" under an encrypted link, the field device adds two self-certification methods: first, compare the setting difference between the current period and the last valid period, and require that the disturbance amplitude must not be lower than the pre-declared threshold; second, check each setting component, which must be within the physical and operating boundaries allowed by the device. If necessary, a quick and covert check can be triggered to confirm that the measurement changes from non-device side do not exceed the small threshold, avoiding abnormal instructions from breaking the covert constraints.

[0091] In step S5: The local rapid self-certification process is as follows: Amplitude lower limit self-certification (54) wherein is the HMTD front line inductance vector. is the Euclidean norm; ensure that the disturbance amplitude is not lower than the declared threshold to prevent "silent degradation".

[0092] Device boundary self-certification (component constraint) (55) wherein are the upper and lower bounds of the line admittance vector for each D-FACTS setting, respectively.

[0093] Concealed fast checking (56) wherein is the phase angle increment of the voltage caused by the setting vector b; is the threshold value; To ensure that the new setting does not appear "partially effective", a two-stage atomic application mechanism is adopted: in stage one, the setting is first written to the temporary register area, only used for checking, and the consistency review is completed according to the digest fingerprint; in stage two, after the review passes, it is written to the execution register area at one time and enabled. If any link fails or the review is inconsistent, the device immediately rejects the change, automatically rolls back to the effective setting of the last control period, and synchronously records the event and alarm.

[0094] Atomic application and rollback (57) wherein is an indicator function, taking 1 if the condition is true, and 0 otherwise; when the submission is made, when it is immediately rolled back and reported; Two-stage state transition (58) wherein A is temporary suspension, writing b to the temporary register but not driving execution; B is submission, review: after comparing the digest consistency again, write to the execution register at one time; either step fails .

[0095] Audit record (59) wherein L is an audit entry only for increase; is the return code / failure reason; Both the field device and the dispatching end need to record the serial number, timestamp, policy identification and each item of the checking result of the current period, and with the help of the audit log only for increase, tracking and compliance review is carried out. The communication session key needs to be updated periodically according to time or after an alarm occurs; at the same time, synchronization with the upper clock is maintained, so that the replay and timing criterion remains valid.

[0096] Parameter management suggestion (60) wherein W is the sequence window length; suggestion ; suggestions ; key rolls by day or alarm event.

[0097] The working principle of the present application: in use, through the unified optimization model and the self-adaptive adjustment mechanism, the concealment and the detectability are balanced under the premise of meeting the operation constraints, the disturbance amplitude is increased in the high-risk period to improve the detection probability, and the disturbance is converged in the low-risk or high-load stage to reduce the loss, the adaptive optimal operation is realized in the whole process, the heuristic algorithm of the graph theory-combination optimization feasible construction type does not depend on the global solver, the scale is scalable, the result is determined, the disturbance scheme can be quickly reconstructed when changed, the implementation cost and the parameter adjustment workload are significantly reduced, the "issuing-checking-executing" closed-loop defense mechanism is constructed, the communication layer eavesdropping, tampering, replay and other threats are effectively resisted through AEAD authentication encryption, cross-channel consistency checking, local self-certification and two-stage atomic application, the silent degradation of instructions is avoided, the system security, traceability and long-term running adaptive optimization ability are improved, and on the premise of ensuring that the non-D-FACTS measurement is basically unchanged, the FDI attack detection probability and defense robustness are significantly improved, the impact of the running set point mutation on the system stability is avoided, the time from alarm to recovery is shortened, and the power generation economy and communication security are considered.

[0098] The preferred embodiments of the application disclosed above are only used to help explain the application, and the preferred embodiments do not describe all the details and do not limit the application to the specific embodiments. Obviously, according to the content of the specification, many modifications and changes can be made. The present description selects and specifically describes these embodiments in order to better explain the principles and practical applications of the application, so that those skilled in the art can well understand and utilize the application. The application is limited by the claims and their entire scope and equivalents.

Claims

1. An active defense method based on the communication consistency verification of a concealed target and a power grid, characterized in that, The method comprises the following steps: Step one, system initialization and parameter setting: Establish the power grid topology and measurement model, load the unit output, power flow and voltage constraints, generate the distributed flexible AC transmission system capability boundary; At the same time, complete the communication and field configuration, make the main channel and monitoring channel connected and complete the time; Step two, hidden D-FACTS arrangement in planning stage: According to the rules including "non-D-FACTS graph multi-connectivity", "two or more continuous non-D-FACTS lines in the ring" and "three or more continuous D-FACTS lines in the ring", the feasibility heuristic algorithm of graph theory-combination optimization is used to determine the positions of D-FACTS and non-D-FACTS lines, to ensure the existence of hidden mobile target defense and to make the rank of composite matrix reach the upper limit, and to cover the remaining necessary buses except the leaf nodes with degree 1; Step three, DC-HMTD optimization solution in running stage: Under the constraint of concealment, the "hidden + amplitude" joint optimization is used to obtain the setting vector of line admittance value, so as to maximize the detectable disturbance and keep the non-D-FACTS measurement basically unchanged; Step four, security issuance and cross-channel consistency check in communication stage: The dispatching end generates a command message containing the D-FACTS setting line admittance vector of this period, the incremental serial number, the UTC time stamp, the strategy number and the minimum disturbance amplitude declaration in each control period, and performs differential encryption packaging to generate an authentication tag; At the same time, the set summary fingerprint is issued in the independent monitoring channel; Step five, local self-verification, atomic application and rollback in communication stage: After the on-site device completes the station check, the received setting value is executed for local self-verification, and if necessary, the concealment is quickly checked; After passing, the setting is applied atomically in two stages: first write to the temporary register and review the consistency with the monitoring channel summary, and then write to the execution register to take effect; If any stage fails or an exception occurs, immediately roll back to the last period effective setting and maintain the output unchanged, and record the audit information and actively report the alarm.

2. The active defense method based on the consistency verification of the concealed target and the power grid communication according to claim 1, characterized in that, The planning stage comprises the following steps: State estimation: based on the DC state estimation model, the system node voltage phase angle is estimated through the measurement vector, the least square method is used to solve the optimal solution, and the bad data detection mechanism is used to calculate the measurement residual to determine whether there is bad data; FDI attack resistance analysis: the principle of false data injection attack polluting state estimation by injecting false data, and the condition that the attack makes the bad data detection mechanism invalid; HMTD existence and composite matrix rank maximization condition: after HMTD is applied, the active power flow and the active power injection should remain unchanged, the existence of HMTD should meet the conditions that the non-D-FACTS graph is non-connected and has no ring, the D-FACTS graph covers all buses except the non-ring buses and all D-FACTS devices are not in idle state, and the buses at both ends of the D-FACTS line do not belong to the same connected component of the non-D-FACTS graph, are isolated nodes of the non-D-FACTS graph and have the same phase angle increment; The rank maximization of composite matrix is determined by the number of rings of non-D-FACTS graph.

3. The active defense method based on the consistency verification of the concealed target and the power grid communication according to claim 2, characterized in that, The HMTD arrangement algorithm includes the following steps: Preprocessing, forest construction, ring rule correction, coverage correction, verification and tail.

4. The active defense method based on concealed target and power grid communication consistency verification according to claim 1, characterized in that, The running stage adopts the "alternating optimization" algorithm, and the specific steps include initialization and feasible region determination, subspace construction, alternating optimization, hidden consistency verification, test performance evaluation, and result delivery.

5. The active defense method based on concealed target and power grid communication consistency verification according to claim 1, characterized in that, The security delivery and cross-channel consistency verification in the communication stage include main channel command message construction, integrity and confidentiality packaging, monitoring channel digest fingerprint publishing, replay and timing window verification, AEAD verification, and cross-channel consistency verification.

6. The active defense method based on concealed target and power grid communication consistency verification according to claim 1, characterized in that, Local self-certification and atomic application and rollback include amplitude lower limit self-certification, device boundary self-certification, hidden fast review, atomic application and rollback, audit record, and parameter management.

Images