Double-target countermeasure attack method for wind power prediction model

Abstract

The invention discloses a wind power prediction model double-target countermeasure attack method, which belongs to the technical field of crossing of power system security and artificial intelligence, and comprises the following steps: S1, collecting original data and determining parameters; s2, training a time sequence diagram auto-encoder detection model; s3, constructing and training a wind power prediction model; s4, constructing a dual-objective optimization function; s5, iteratively generating a confrontation sample; and S6, adversarial sample injection and detection. According to the wind power prediction model dual-target countermeasure attack method, through dual-target weighting function and reconstruction loss item coefficient adjustment, joint adjustment and optimization of attack destructiveness and concealment are realized, the detection probability is reduced, and bias selection is supported; through the improved GAE structure, the time sequence dependence is captured, artificial feature design is avoided, and the accuracy of detecting the time sequence adversarial sample is improved.

Description

Technical Field

[0001] This invention belongs to the interdisciplinary field of power system security and artificial intelligence, and specifically relates to a dual-target adversarial attack method for wind power prediction models. Background Technology

[0002] With the increasing penetration rate of wind power generation, the accuracy of wind power forecasting is becoming increasingly important for the secure dispatch of power cyber-physical systems. Meteorological factors, as inputs to wind power forecasting models, are easily targeted by attacks, leading to deviations in predicted wind power and consequently affecting the normal dispatch of the power system. Attackers typically employ adversarial attacks targeting meteorological factors, designing adversarial samples containing minute perturbations (i.e., meteorological factors) and injecting them into the power system to significantly skew the output of the wind power forecasting model.

[0003] However, existing technologies have the following shortcomings: Existing methods (FGSM, PGD) only focus on "attack destructiveness" (maximizing power deviation) and ignore "attack concealment", making adversarial examples easy for the defender to detect; FGSM is difficult to achieve maximum destructiveness in a single iteration and does not control the proportion of variable tampering, while PGD, although limiting the proportion of tampering, still lacks concealment design; SVM models rely on manually designed differential features, and feature engineering is difficult when adapting to high-dimensional meteorological data; traditional autoencoders can only reconstruct samples at a single time moment and cannot capture temporal correlation anomalies; traditional graph autoencoders focus on node spatial correlations and lack the ability to capture temporal dependencies, and cannot detect temporal adversarial examples.

[0004] Therefore, a new method is urgently needed.

[0005] The technical means related to the attack and defense game of the power system are only used for the construction and verification of the power network's own security protection system. They are intended to identify and resist external malicious attacks in advance and ensure the stable operation of the power system. They are by no means intended for malicious intrusion and damage to power facilities or the power grid. Summary of the Invention

[0006] The purpose of this invention is to provide a dual-objective adversarial attack method for wind power prediction models. This method achieves joint optimization of attack destructiveness and concealment, reduces detection probability, and supports biased selection by adjusting the dual-objective weighting function and reconstruction loss term coefficients. The improved GAE structure captures temporal dependencies, eliminates the need for manual feature design, and improves the accuracy of detecting temporal adversarial samples.

[0007] To achieve the above objectives, this invention provides a method for bi-target adversarial attacks on wind power prediction models, comprising the following steps: S1. Collect meteorological factor data for multiple time periods to determine the rated power of the wind farm, the number of forecast periods, the upper limit of the tampering ratio, and the upper limit of the number of iterations. S2. Training a temporal graph autoencoder detection model, wherein the temporal graph autoencoder uses samples of each time period as nodes and temporal associations of adjacent time periods as edges, the node features are meteorological factor values ​​of the corresponding time period, the encoder is a two-layer graph convolutional network, the decoder is a one-layer linear transformation, and the training objective is to minimize the mean square error of the original and reconstructed meteorological data. S3. Construct and train a wind power prediction model. The model is a fully connected network. The input is the multi-period meteorological factor data in S1, and the output is the wind power prediction power for the corresponding period. S4. Construct a dual-objective weighted summation objective function, wherein the dual objectives include attack destructiveness and attack concealment. Attack destructiveness is achieved by maximizing wind power deviation, and attack concealment is achieved by minimizing the reconstruction loss of the time series graph autoencoder. S5. Based on the multi-period meteorological factor data of S1, the wind power prediction model of S3, the time-series graph autoencoder detection model of S2 and the objective function of S4, the adversarial sample is iteratively updated. During the update process, the deviation of each meteorological factor from the original value does not exceed the upper limit of the tampering ratio. After iterating to the upper limit number of times, the optimal adversarial sample with the smallest objective function value is output. S6. The optimal adversarial sample is injected into the power system meteorological database. The defender calculates the reconstruction loss of the input sample through the time-series graph autoencoder model in S2, and identifies the adversarial sample based on the difference in reconstruction loss.

[0008] Preferably, in S1, the meteorological factors include wind speed, temperature, relative humidity, ground air pressure, and wind direction angle at a distance of 10m from the ground.

[0009] Preferably, in S2, the encoder mapping formula of the timing graph autoencoder is specifically as follows: The first layer of the encoder is represented as: ; In the formula, For the input meteorological factor values, The total number of time periods to be predicted. The number of meteorological factors; For the hidden layer embedding representation, For the hidden layer dimension; The weight matrix is ​​a learnable matrix; The normalized adjacency matrix; The second layer of the encoder is represented as: ; In the formula, For latent layer embedding representation, For potential layer dimensions; The weight matrix is ​​a learnable matrix; The decoder mapping formula is expressed as: ; In the formula, To decode the weight matrix; This is the output of the decoder, i.e., the reconstructed value of the meteorological factors.

[0010] Preferably, in S2, the formula for the mean squared error loss function is: ; In the formula, For reconstruction loss; for Time period The original values ​​of each meteorological factor; for Time period Reconstructed values ​​of meteorological factors.

[0011] Preferably, in S3, the linear fully connected network has a 6-layer structure, including 1 input layer, 4 hidden layers and 1 output layer, and ReLU activation functions are used between each hidden layer and between the hidden layer and the output layer.

[0012] Preferably, in S4, the formula for the dual objective function is: ; In the formula, The direction of attack; They are respectively Power after attack and original predicted power; This refers to the rated power of the wind farm. These are the coefficients of the reconstruction loss term for the time-series autoencoder.

[0013] Preferred, This is a positive attack, namely an attack that increases wind power output; This is a negative attack, namely an attack that reduces wind power output.

[0014] Preferably, in S5, the iterative update of adversarial examples includes the following steps: S501. Input multi-period meteorological data into the wind power prediction model in S3 to obtain the raw predicted power. ; will the first The adversarial sample is input into the wind power prediction model in the next iteration to obtain the adversarial power prediction model. And calculate the power deviation, expressed as: ; In the formula, for Power deviation at any given moment; S502, the first The reconstruction loss is calculated using a temporal graph autoencoder model with the adversarial vector input S2 in the next iteration. ; S503, will , , Substitute into the biobjective function of S4 This yields the current objective function value. S504. Based on the gradient update of the objective function, generate the first adversarial example. The next iteration of adversarial samples must also satisfy the requirement that the deviation of each meteorological factor from the normal sample in all time periods does not exceed the upper limit of the tampering ratio determined by S1. When the maximum number of iterations is reached, output the objective function value. The smallest corresponding adversarial sample is taken as the optimal adversarial sample.

[0015] Therefore, the present invention employs the aforementioned dual-target adversarial attack method for wind power prediction models. Compared with existing technologies, the technical solution of the present invention has the following beneficial effects: (1) By adopting the technical means of constructing a dual-objective weighted function of “attack destructiveness + concealment” and flexibly adjusting the coefficient of the reconstruction loss term, the shortcomings of existing attack techniques of “emphasizing destructiveness and neglecting concealment”, as well as the problems of insufficient destructiveness of FGSM in a single iteration, unconstrained tampering ratio and lack of concealment design of PGD, the joint optimality of attack destructiveness and concealment is achieved, significantly reducing the probability of adversarial samples being detected, and supporting attackers to flexibly choose attack bias; (2) An improved graph autoencoder (GAE) structure is adopted (with samples of each time period as nodes and temporal correlations of adjacent time periods as edges, and data of adjacent time periods are fused) and the technique of identifying adversarial examples by reconstructing loss is used to overcome the shortcomings of the existing detection model in capturing temporal correlations (traditional GAE only focuses on spatial correlations and traditional autoencoders cannot capture temporal correlations) and the problem that SVM models rely heavily on manually designed differential features and feature engineering is difficult when adapting to high-dimensional meteorological data. Thus, the dependence of temporal data is effectively captured without manual feature design, and efficient and accurate detection of temporal adversarial examples is achieved.

[0016] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating an embodiment of a dual-target adversarial attack method for a wind power prediction model according to the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used in the present invention should have the ordinary meaning understood by those skilled in the art.

[0019] Example 1 like Figure 1 As shown, this embodiment provides a dual-target adversarial attack method for wind power prediction models. It should be understood that the specific parameters, models and protocols mentioned in this embodiment are merely examples to help those skilled in the art understand the present invention, and are not intended to limit the present invention.

[0020] The present invention provides a method for bi-target adversarial attacks on wind power prediction models, comprising the following steps: S1. Collect meteorological data for multiple time periods (including wind speed, temperature, relative humidity, ground pressure, and wind direction angle at 10m above ground) to determine the rated power of the wind farm. Number of predicted time periods Number of meteorological factors Parameters such as the upper limit of the proportion and the upper limit of the number of iterations are modified to obtain the original meteorological samples; S2. Define the structure of the temporal graph autoencoder (GAE) model, with samples from each time period as nodes and adjacent temporal relationships as edges. The encoder is a two-layer graph convolutional network, and the decoder is a one-layer linear transform; specifically: The first layer of the encoder is represented as: ; In the formula, For the input meteorological factor values, The total number of time periods to be predicted. The number of meteorological factors; For the hidden layer embedding representation, For the hidden layer dimension; The weight matrix is ​​a learnable matrix; The normalized adjacency matrix; The second layer of the encoder is represented as: ; In the formula, For latent layer embedding representation, For potential layer dimensions; The weight matrix is ​​a learnable matrix; The decoder mapping formula is expressed as: ; In the formula, To decode the weight matrix; This is the output of the decoder, i.e., the reconstructed values ​​of the meteorological factors; The loss function is to minimize the mean square error between the original and reconstructed meteorological data. The parameters of the GAE model are learned using the following formula: ; In the formula, For reconstruction loss; for Time period The original values ​​of each meteorological factor; for Time period Reconstructed values ​​of meteorological factors; The model training was completed using multi-period meteorological factor data transmitted by S1, and the trained GAE model and reconstruction loss calculation logic were stored. S3. Construct a 6-layer linear fully connected network, consisting of 1 input layer, 4 hidden layers, and 1 output layer. ReLU activation functions are used between each hidden layer and between hidden layers and the output layer to enhance the model's non-linear characteristics. The input is passed from S1. Meteorological factor values ​​for each time period are output as corresponding values. Forecast wind power output for each time period; S4. Based on the wind farm rated power transmitted by S1, and combined with the GAE reconfiguration loss calculation logic of S2, a dual objective function is designed, as shown in the following formula: ; In the formula, The direction of attack; They are respectively Power after attack and original predicted power; This refers to the rated power of the wind farm. The coefficients of the GAE loss term are reconstructed; a larger value indicates a higher weight for concealment. Attack destructiveness is maximized. To achieve this, attack stealth is minimized. To achieve this, the objective function needs to be minimized. To obtain adversarial examples with a balance between two objectives; This is a positive attack, namely an attack that increases wind power output; This is a negative attack, namely an attack that reduces wind power output; S5, receiving multi-period meteorological factor data from S1, the wind power prediction model from S3, the GAE model from S2, and the bi-objective function from S4; specifically including the following steps: S501. Input multi-period meteorological data into the wind power prediction model in S3 to obtain the raw predicted power. ; will the first The adversarial sample is input into the wind power prediction model in the next iteration to obtain the adversarial power prediction model. And calculate the power deviation, expressed as: ; In the formula, for Power deviation at any given moment; S502, the first The reconstruction loss is calculated using the GAE model with the adversarial example input S2 in the next iteration. ; S503, will , , Substitute into the biobjective function of S4 This yields the current objective function value. S504. Based on the gradient update of the objective function, generate the first adversarial example. The next iteration of adversarial samples must also satisfy the requirement that the deviation of each meteorological factor from the normal sample in all time periods does not exceed the upper limit of the tampering ratio determined by S1. When the maximum number of iterations is reached, output the objective function value. The smallest corresponding adversarial sample is taken as the optimal adversarial sample; this optimal adversarial sample is then passed to S6. S6. The attacker injects the adversarial sample transmitted in S5 into the power system meteorological database to carry out an adversarial attack; the defender calls the GAE model in S2 to calculate the reconstruction loss on the input samples (including the injected adversarial sample). If the reconstruction loss increases significantly, it is identified as an adversarial example, and the detection is completed.

[0021] Therefore, this invention adopts the above-mentioned dual-objective adversarial attack method for wind power prediction model. This method achieves joint optimization of attack destructiveness and concealment, reduces detection probability and supports biased selection by adjusting the dual-objective weighting function and reconstruction loss term coefficient. The improved GAE structure captures temporal dependencies, eliminates the need for manual feature design, and improves the accuracy of detecting temporal adversarial samples.

[0022] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0023] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for dual-target adversarial attacks on wind power prediction models, characterized in that, Includes the following steps: S1. Collect meteorological factor data for multiple time periods to determine the rated power of the wind farm, the number of forecast periods, the upper limit of the tampering ratio, and the upper limit of the number of iterations. S2. Training a temporal graph autoencoder detection model, wherein the temporal graph autoencoder uses samples of each time period as nodes and temporal associations of adjacent time periods as edges, the node features are meteorological factor values ​​of the corresponding time period, the encoder is a two-layer graph convolutional network, the decoder is a one-layer linear transformation, and the training objective is to minimize the mean square error of the original and reconstructed meteorological data. S3. Construct and train a wind power prediction model. The model is a fully connected network. The input is the multi-period meteorological factor data in S1, and the output is the wind power prediction power for the corresponding period. S4. Construct a dual-objective weighted summation objective function, wherein the dual objectives include attack destructiveness and attack concealment. Attack destructiveness is achieved by maximizing wind power deviation, and attack concealment is achieved by minimizing the reconstruction loss of the time series graph autoencoder. S5. Based on the multi-period meteorological factor data of S1, the wind power prediction model of S3, the time-series graph autoencoder detection model of S2 and the objective function of S4, the adversarial sample is iteratively updated. During the update process, the deviation of each meteorological factor from the original value does not exceed the upper limit of the tampering ratio. After iterating to the upper limit number of times, the optimal adversarial sample with the smallest objective function value is output. S6. The optimal adversarial sample is injected into the power system meteorological database. The defender calculates the reconstruction loss of the input sample through the time-series graph autoencoder model in S2, and identifies the adversarial sample based on the difference in reconstruction loss.

2. The method for bi-target adversarial attack on a wind power prediction model according to claim 1, characterized in that, In S1, the meteorological factors include wind speed, temperature, relative humidity, ground pressure, and wind direction angle at a distance of 10m from the ground.

3. The method for dual-target adversarial attack on a wind power prediction model according to claim 2, characterized in that, In S2, the encoder mapping formula for the timing graph autoencoder is specifically as follows: The first layer of the encoder is represented as: ； In the formula, For the input meteorological factor values, The total number of time periods to be predicted. The number of meteorological factors; For the hidden layer embedding representation, For the hidden layer dimension; The weight matrix is ​​a learnable matrix; The normalized adjacency matrix; For activation functions; The second layer of the encoder is represented as: ； In the formula, For latent layer embedding representation, For potential layer dimensions; The weight matrix is ​​a learnable matrix; The decoder mapping formula is expressed as: ； In the formula, To decode the weight matrix; This is the output of the decoder, i.e., the reconstructed value of the meteorological factors.

4. The method for dual-target adversarial attack on a wind power prediction model according to claim 3, characterized in that, In S2, the formula for the mean square error loss function is: ； In the formula, For reconstruction loss; for Time period The original values ​​of each meteorological factor; for Time period Reconstructed values ​​of meteorological factors.

5. The method for dual-target adversarial attack on a wind power prediction model according to claim 4, characterized in that, In S3, the linear fully connected network has a 6-layer structure, including 1 input layer, 4 hidden layers and 1 output layer. The ReLU activation function is used between each hidden layer and between the hidden layer and the output layer.

6. The method for dual-target adversarial attack on a wind power prediction model according to claim 5, characterized in that, In S4, the formula for the biobjective function is: ； In the formula, The direction of attack; They are respectively Power after attack and original predicted power; This refers to the rated power of the wind farm. These are the coefficients of the reconstruction loss term for the time-series autoencoder.

7. The method for bi-target adversarial attack on a wind power prediction model according to claim 6, characterized in that, This is a positive attack, namely an attack that increases wind power output; This is a negative attack, namely an attack that reduces wind power output.

8. The method for dual-target adversarial attack on a wind power prediction model according to claim 7, characterized in that, In S5, the iterative update process of adversarial examples includes the following steps: S501. Input multi-period meteorological data into the wind power prediction model in S3 to obtain the raw predicted power. ; will the first The adversarial sample is input into the wind power prediction model in the next iteration to obtain the adversarial power prediction model. And calculate the power deviation, expressed as: ； In the formula, for Power deviation at any given moment; S502, the first The reconstruction loss is calculated using the temporal graph autoencoder model based on the adversarial example input S2 in the next iteration. ; S503, will , , Substitute into the biobjective function of S4 This yields the current objective function value. S504. Based on the gradient update of the objective function, generate the first adversarial example. The next iteration of adversarial samples must also satisfy the requirement that the deviation of each meteorological factor from the normal sample in all time periods does not exceed the upper limit of the tampering ratio determined by S1. When the maximum number of iterations is reached, output the objective function value. The smallest corresponding adversarial sample is taken as the optimal adversarial sample.

9. A computer device, characterized in that, include: A processor configured to be coupled to memory, read and execute instructions and / or program code in the memory to perform the method as described in any one of claims 1-8.

10. A computer-readable medium, characterized in that, The computer-readable medium stores computer program code that, when executed on a computer, causes the computer to perform the method as described in any one of claims 1-8.

Images