A data poisoning attack defense method and system based on abnormal data detection

Abstract

This invention relates to a data poisoning attack defense method and system based on anomaly data detection. The method involves inputting multidimensional features into a heterogeneous model group composed of multiple independent models with complementary detection mechanisms, outputting the anomaly score and corresponding confidence level of each model. The anomaly score, combined with the historical detection accuracy of each model, is weighted to generate an attack judgment result. If a data poisoning attack is detected, the reconstruction mechanism corresponding to the model with the highest confidence level is used to generate a safe load sequence to replace the original power load data. Finally, the safe load sequence is output to complete the defense process. Compared with existing technologies, this invention has advantages such as improved real-time defense, enhanced defense robustness, and reduced false alarm and false negative rates.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method and system for defending against data poisoning attacks based on abnormal data detection. Background Technology

[0002] Electricity load forecasting is crucial for the efficient operation of power systems, and its accuracy directly impacts the efficiency and security of grid dispatching, energy management, and market transactions. With the rapid development of smart grids, the informatization, digitalization, and intelligence levels of power systems are continuously improving, but this also brings new cybersecurity challenges. Among these, data poisoning attacks targeting electricity load forecasting systems are becoming increasingly prominent.

[0003] Data poisoning attacks refer to attackers maliciously altering or injecting false data in an attempt to contaminate the training dataset or real-time input data stream of a machine learning model. This can induce the model to learn incorrect patterns, produce biased predictions, or cause it to fail under certain conditions. In power load forecasting scenarios, such attacks can lead to a significant discrepancy between predicted results and actual load, resulting in erroneous dispatching decisions, power waste, grid instability, or even widespread blackouts.

[0004] Existing defense technologies mainly fall into two categories: one is data cleaning and verification, such as identifying outliers through statistical rules (e.g., the 3σ criterion) or simple threshold detection. However, these methods often struggle to cope with complex and covert adversarial poisoning attacks, easily resulting in high false positive or false negative rates. For example, attackers might use small but continuous perturbations to make malicious data difficult to identify by simple rules.

[0005] Another approach involves enhancing the robustness of the prediction model itself, such as through adversarial training or designing more resilient model architectures. However, these methods are typically computationally expensive, complex to deploy, and have limited generalization capabilities when facing unknown or novel attacks. Furthermore, for power load forecasting scenarios with extremely high real-time requirements, existing methods lack sufficient real-time response capabilities, making it difficult to effectively defend against attacks at the first sign of trouble.

[0006] For example, the invention patent with publication number CN120354406A discloses a reinforcement learning-based attack detection method for load frequency control systems. This method generates attack samples by constructing an attack agent through a Markov decision process and adopts a dual-modal detection architecture combining supervised learning with Long Short-Term Memory (LSTM) networks and unsupervised learning with autoencoders. However, this method has the following limitations: First, it relies on reinforcement learning for adversarial sample generation and model training, resulting in high computational complexity and resource consumption, making it difficult to meet the stringent requirements of lightweight and high real-time performance in power load data stream processing. Second, although dual-modal detection is adopted, its model structure is still mainly concentrated in the field of deep learning, lacking targeted coverage of instantaneous statistical anomalies or structural outliers, resulting in room for improvement in generalization ability and robustness when facing varied attack methods. Finally, this method mainly focuses on detection and alarm, lacking a dynamic closed-loop adjustment mechanism based on downstream business feedback, making it difficult to use actual prediction errors to reverse-calibrate the confidence level of the detection model, resulting in difficulty in continuously reducing the false alarm rate and false negative rate in long-term operation.

[0007] In summary, current power load data security defense technologies mainly suffer from problems such as insufficient real-time performance due to high computational resource consumption, limited generalization ability due to single or homogeneous model architecture, high false alarm rate and inability to continuously optimize due to lack of business feedback loop. Summary of the Invention

[0008] The purpose of this invention is to overcome the shortcomings of the existing technology by providing a data poisoning attack defense method and system based on abnormal data detection.

[0009] The objective of this invention can be achieved through the following technical solutions: According to one aspect of the present invention, a method for defending against data poisoning attacks based on anomaly data detection is provided, characterized in that the method steps include: S1. After preprocessing the raw power load data, extract multidimensional features from the preprocessed data; S2. Input the multidimensional features into the heterogeneous model group and output the anomaly score and corresponding confidence level of each model; the heterogeneous model group consists of multiple independent models with complementary detection mechanisms. S3. Collect the historical detection accuracy of each model, and calculate the dynamic trust weight based on the historical detection accuracy; based on the dynamic trust weight and the anomaly score of each model, fuse them to generate the attack judgment result; S4. When the attack determination result shows that there is a data poisoning attack, the reconstruction mechanism corresponding to the model with the highest confidence is used to generate a safe load sequence to replace the original power load data; otherwise, the original power load data is directly used as the safe load sequence; and the safe load sequence is output.

[0010] As a preferred technical solution, the preprocessing in S1 includes missing value imputation and data normalization; the multidimensional features include time-domain statistical features, specifically including: the mean, variance, skewness, kurtosis and rate of change of adjacent time points of the power load data.

[0011] As a preferred technical solution, the heterogeneous model group in S2 includes: a statistics-based model for capturing transient anomalies, a machine learning-based model for capturing structural anomalies, and a deep learning-based model for capturing temporal context anomalies.

[0012] As preferred technical solutions, the statistical model specifically adopts the sliding window Z-score (standard score) algorithm, the machine learning model specifically adopts the isolated forest algorithm, and the deep learning model specifically adopts the LSTM autoencoder. The outlier scores and corresponding confidence levels for each model in S2 are calculated as follows: For statistically based models, the anomaly score is the absolute value of the Z-score of the data point, and the confidence score is the normalized value calculated based on the probability density of this absolute value within the historical window. For machine learning-based models, the anomaly score is the reciprocal of the sample path length in the isolated tree, and the confidence score is the normalized value of the ratio of the path length to the average path length of the tree. For deep learning-based models, the anomaly score is the mean squared error between the input data and the reconstructed data, and the confidence score is the normalized value of the ratio of the difference between the mean squared error and the preset anomaly threshold.

[0013] As a preferred technical solution, the reconstruction mechanism in S4 includes: The specific reconstruction mechanisms for different models in S4 include: For statistical models, the corresponding reconstruction mechanism is to replace the original abnormal data with the mean of the normal data within the current sliding window. For machine learning-based models, the corresponding reconstruction mechanism is to replace the original abnormal data with linear interpolation of the normal time points adjacent to the anomaly point. For deep learning-based models, the corresponding reconstruction mechanism is to directly replace the original abnormal data with the reconstructed data generated by the output layer of the LSTM autoencoder.

[0014] As a preferred technical solution, the specific formula for calculating the dynamic trust weight in S3 is as follows: in, Let be the dynamic trust weight of the i-th model at the current time t; Let be the dynamic trust weight of the i-th model at the previous time step; The preset historical forgetting factor has a value range of (0, 1). Let be the historical detection accuracy of the i-th model at the previous time step.

[0015] As a preferred technical solution, when generating attack judgment results in S3, the fusion strategy includes: weighted average method, voting method or ensemble learning method; the ensemble learning method specifically uses a trained meta-classifier to complete the fusion process.

[0016] As a preferred technical solution, the output safe load sequence of S4 also includes a feedback iteration process, which specifically includes: The safe load sequence is input into the load prediction model, and the power load prediction value is output. The load prediction error is calculated based on the actual load data at the next time step. The anomaly detection effect is evaluated by combining the attack judgment results. The historical detection accuracy is updated based on load prediction error and anomaly detection performance, thereby achieving dynamic trust weight updates.

[0017] As a preferred technical solution, the specific process for updating historical detection accuracy includes: Set the prediction error tolerance threshold and the accuracy adjustment step size; Based on the attack assessment results, the anomaly detection effectiveness is evaluated and the historical detection accuracy is updated in two scenarios: When the attack assessment results indicate the presence of a data poisoning attack: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is determined to be effective, and the historical detection accuracy of the model with the highest confidence is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the anomaly detection effect is judged as a false alarm or reconstruction failure, and the historical detection accuracy of the model with the highest confidence is reduced by the preset accuracy adjustment step size. When the attack detection result indicates that no data poisoning attack exists: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is judged as correct rejection, and the historical detection accuracy of all models that give normal scores is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the anomaly detection effect is judged as a missed detection, and the historical detection accuracy of all models that give normal scores is reduced by the preset accuracy adjustment step size.

[0018] According to another aspect of the present invention, a data poisoning attack defense system based on abnormal data detection is provided, the system comprising: The data preprocessing module is used to preprocess the raw power load data and then extract multidimensional features from the preprocessed data. The heterogeneous model detection module has a built-in heterogeneous model group, which is used to input multi-dimensional features into the heterogeneous model group and output the anomaly score and corresponding confidence level of each model. The attack determination module is used to collect the historical detection accuracy of each model and calculate the dynamic trust weight. Based on the dynamic trust weight and the abnormal score of each model, the attack determination result is generated by weighting. The defense reconstruction module is used to execute defense strategies based on the attack determination results: when a data poisoning attack is determined to exist, the reconstruction mechanism corresponding to the model with the highest confidence level is used to generate a safe load sequence to replace the original power load data; otherwise, the original power load data is directly used as the safe load sequence; finally, the module outputs the safe load sequence.

[0019] Compared with the prior art, the present invention has the following beneficial effects: 1. This invention extracts multi-dimensional features from preprocessed data and inputs these features into a heterogeneous model group. It utilizes complementary detection mechanisms for parallel detection and dynamic trust weight fusion. This architecture not only breaks the limitations of a single model and improves the generalization ability to identify complex, unknown, or mutated poisoning attacks, but also significantly reduces resource consumption by introducing low-overhead models and parallel computing, solving the problem of insufficient real-time performance of existing complex models. Simultaneously, this invention employs a dynamic trust weight fusion mechanism based on historical detection accuracy. By introducing a business feedback loop, the system can adaptively adjust the weights of each model according to the actual detection results, achieving continuous self-learning and optimization. Combining multiple model decisions and employing a fusion strategy, this invention can more accurately distinguish between normal fluctuations and malicious attacks. Experimental verification shows an F1 score of 0.88, significantly reducing false positive and false negative rates while effectively overcoming the shortcomings of traditional methods that cannot be continuously optimized.

[0020] 2. This invention unifies the confidence metrics of heterogeneous models through normalization and performs defensive reconstruction. It utilizes the reconstruction mechanism corresponding to the model with the highest confidence level to generate a safe load sequence to replace the original abnormal data. This solves the prediction distortion problem caused by data poisoning. This mechanism can effectively identify and defend against data poisoning attacks, ensuring that the load forecasting model is based on high-quality data. Prediction accuracy indicators such as MAE and RMSE are significantly improved, significantly enhancing prediction accuracy and ensuring the safe and stable operation of the power system.

[0021] 3. This invention introduces a feedback iteration process after outputting the safe load sequence. The safe load sequence is input into the prediction model, and the actual load prediction error is used to evaluate the anomaly detection effect. Based on this, the historical detection accuracy and trust weight of each model are dynamically updated. This design endows the defense method with closed-loop learning capabilities. By introducing feedback and iteration, the method can self-learn and optimize based on its operational performance. Through continuous iteration, detection performance can be improved by more than 10%, continuously enhancing defense performance.

[0022] 4. This invention adopts a modular system architecture design, supporting parallel computing processing of heterogeneous models. On the one hand, through parallel anomaly detection and modular design, real-time monitoring and rapid response to power load data streams are achieved, significantly improving the real-time performance of defense. On the other hand, the modular design is easy to expand, allowing for convenient introduction or updating of anomaly detection models. The number of models is controlled within 2 to 5 complementary models, adapting to constantly changing network threats, and the system has strong scalability; thus balancing real-time defense with system scalability. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the steps of a data poisoning attack defense method based on abnormal data detection in this invention; Figure 2 This is a schematic diagram of the functional modules and logical flow of a data poisoning attack defense system based on abnormal data detection in an embodiment. Figure 3 This is a schematic diagram of the algorithm flow for defending against data poisoning attacks in the embodiment; Figure 4 This is a schematic diagram illustrating the steps for defending against data poisoning attacks based on abnormal data detection in this embodiment. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0025] Existing data poisoning attack defense technologies in power load forecasting suffer from insufficient real-time performance, limited generalization ability, high false alarm rate, and high computational resource consumption at the data processing and model levels. This makes load forecasting models vulnerable to attacks, necessitating effective countermeasures to ensure the reliability of model predictions and the safe operation of the power system. This solution integrates multiple advanced anomaly detection algorithms and an adaptive defense framework to significantly improve the ability to identify and respond to poisoning attacks in power load forecasting data streams.

[0026] In view of this, this application proposes a data poisoning attack defense method and system based on abnormal data detection in power load forecasting. The aim is to enhance defense capabilities at the data processing and model building levels, enabling real-time monitoring, anomaly identification, and attack defense of power load forecasting data streams, thereby improving the accuracy of load forecasting models and the security of the power system. The core of this system and method lies in constructing a multi-layered, multi-modal intelligent defense system capable of monitoring and intervening throughout the entire chain from data input to forecast output.

[0027] Example 1 In this embodiment, a data poisoning attack defense method based on abnormal data detection is adopted, and the method steps are as follows: Figure 1 As shown, it specifically includes: S1. After preprocessing the raw power load data, extract multidimensional features from the preprocessed data; S2. Input the multidimensional features into the heterogeneous model group and output the anomaly score and corresponding confidence level of each model; the heterogeneous model group consists of multiple independent models with complementary detection mechanisms. S3. Collect the historical detection accuracy of each model, and calculate the dynamic trust weight based on the historical detection accuracy; based on the dynamic trust weight and the anomaly score of each model, fuse them to generate the attack judgment result; S4. When the attack determination result shows that there is a data poisoning attack, the reconstruction mechanism corresponding to the model with the highest confidence is used to generate a safe load sequence to replace the original power load data; otherwise, the original power load data is directly used as the safe load sequence; and the safe load sequence is output.

[0028] Data preprocessing in S1 includes missing value imputation and data normalization; multidimensional features include time-domain statistical features, specifically: the mean, variance, skewness, kurtosis, and rate of change of adjacent time points of the power load data.

[0029] The heterogeneous model group in S2 includes: a statistics-based model for capturing transient anomalies, a machine learning-based model for capturing structural anomalies, and a deep learning-based model for capturing temporal context anomalies.

[0030] The statistical model specifically uses the sliding window Z-score algorithm, the machine learning model specifically uses the isolated forest algorithm, and the deep learning model specifically uses the LSTM autoencoder. The outlier scores and corresponding confidence levels for each model in S2 are calculated as follows: For statistically based models, the anomaly score is the absolute value of the Z-score of the data point, and the confidence score is the normalized value calculated based on the probability density of this absolute value within the historical window. For machine learning-based models, the anomaly score is the reciprocal of the sample path length in the isolated tree, and the confidence score is the normalized value of the ratio of the path length to the average path length of the tree. For deep learning-based models, the anomaly score is the mean squared error between the input data and the reconstructed data, and the confidence score is the normalized value of the ratio of the difference between the mean squared error and the preset anomaly threshold.

[0031] The refactoring mechanisms in S4 include: The specific reconstruction mechanisms for different models in S4 include: For statistical models, the corresponding reconstruction mechanism is to replace the original abnormal data with the mean of the normal data within the current sliding window. For machine learning-based models, the corresponding reconstruction mechanism is to replace the original abnormal data with linear interpolation of the normal time points adjacent to the anomaly point. For deep learning-based models, the corresponding reconstruction mechanism is to directly replace the original abnormal data with the reconstructed data generated by the output layer of the LSTM autoencoder.

[0032] The specific formula for calculating the dynamic trust weight in S3 is as follows: in, Let be the dynamic trust weight of the i-th model at the current time t; Let be the dynamic trust weight of the i-th model at the previous time step; The preset historical forgetting factor has a value range of (0, 1). Let be the historical detection accuracy of the i-th model at the previous time step.

[0033] When generating attack judgment results in S3, the fusion strategies include: weighted average method, voting method or ensemble learning method; the ensemble learning method specifically uses a trained meta-classifier to complete the fusion process.

[0034] Following the output safe load sequence of S4 is a feedback iteration process, which specifically includes: The safe load sequence is input into the load prediction model, and the power load prediction value is output. The load prediction error is calculated based on the actual load data at the next time step. The anomaly detection effect is evaluated by combining the attack judgment results. The historical detection accuracy is updated based on load prediction error and anomaly detection performance, thereby achieving dynamic trust weight updates.

[0035] The specific process of updating historical detection accuracy includes: Set the prediction error tolerance threshold and the accuracy adjustment step size; Based on the attack assessment results, the anomaly detection effectiveness is evaluated and the historical detection accuracy is updated in two scenarios: When the attack assessment results indicate the presence of a data poisoning attack: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is determined to be effective, and the historical detection accuracy of the model with the highest confidence is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the anomaly detection effect is judged as a false alarm or reconstruction failure, and the historical detection accuracy of the model with the highest confidence is reduced by the preset accuracy adjustment step size. When the attack detection result indicates that no data poisoning attack exists: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is judged as correct rejection, and the historical detection accuracy of all models that give normal scores is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the anomaly detection effect is judged as a missed detection, and the historical detection accuracy of all models that give normal scores is reduced by the preset accuracy adjustment step size.

[0036] The implementation process of this method revolves around data processing and model algorithms, and the specific implementation process is as follows: Data Acquisition and Preprocessing: Obtain raw data such as power load, weather, and date. Perform preprocessing operations such as data cleaning, missing value imputation, outlier removal, and normalization or standardization to ensure data quality.

[0037] Real-time feature extraction: Perform feature engineering on the preprocessed data to extract multi-dimensional feature vectors, including time-series features, statistical features, correlation features, and periodic features.

[0038] Parallel anomaly detection: The extracted multidimensional feature vectors are input in parallel into at least two (preferably two to five) pre-trained anomaly detection models in a heterogeneous model group. These include statistical methods with instantaneous detection capabilities (such as sliding window Z-score), machine learning methods adept at identifying global outliers (such as isolated forest), and deep learning methods sensitive to time-series dependencies (such as LSTM autoencoders). This model combination is based on the principle of complementary detection mechanisms, ensuring comprehensive coverage of various complex poisoning attack patterns. Each model runs independently and outputs its own anomaly score or anomaly label. Limiting the number of models to 2 to 5 classes is an optimized result that balances system robustness and real-time response efficiency, ensuring that parallel detection maximizes detection accuracy while meeting the real-time requirements of power load forecasting.

[0039] Fusion Decision: This module receives anomaly scores or labels from multiple anomaly detection models and makes a final poisoning attack determination based on a pre-defined fusion strategy. The aim of this module is to combine the strengths of each model to improve the overall robustness and accuracy of detection, while reducing false positives from a single model.

[0040] Defense Response: If a poisoning attack is detected during the fusion decision-making process, the defense response module will immediately take action according to the preset defense strategy, including but not limited to abnormal data isolation, data repair / replacement (such as using historical data from the same period or predictive model interpolation), and issuing a warning notification to the system administrator.

[0041] Load forecasting: The load forecasting module receives clean data processed by the defense response module and uses a pre-trained high-precision load forecasting model to forecast future power load.

[0042] Model feedback and iteration: Continuously evaluate the accuracy of the load forecasting model, such as MAE (Mean Absolute Error) and RMSE (Root Mean Square Error); and the performance of the anomaly detection module, such as false alarm rate and false negative rate. Based on the evaluation results, the feedback and iteration module adaptively adjusts and optimizes the parameters of the anomaly detection model, the parameters of the fusion strategy, or the parameters of the load forecasting model to achieve continuous system improvement and performance enhancement.

[0043] In multimodal anomaly detection, the heterogeneous model group includes at least two independent anomaly detection models. In this embodiment, it includes: statistical methods (such as sliding window Z-score), machine learning methods (such as isolated forest), and deep learning methods (such as LSTM autoencoder). The above three types of models are used to capture transient anomalies, structural anomalies, and temporal context anomalies, respectively.

[0044] These models each possess different anomaly detection mechanisms and advantages, identifying data anomalies from various dimensions and enhancing the comprehensiveness, reliability, and adaptability to complex attack patterns. For example, the sliding window Z-score identifies transient anomalies by calculating the deviation of data points from their local mean, the isolation forest quickly separates outlier points through random partitioning, while the LSTM autoencoder reconstructs data by learning normal patterns in time-series data, identifying data points with large reconstruction errors as anomalies.

[0045] Fusion strategies include weighted averaging, voting, or ensemble learning. Ensemble learning trains a meta-classifier to combine the outputs of various anomaly detection models, achieving higher anomaly detection accuracy. Weighted averaging assigns different weights to each anomaly detection model based on its historical performance or confidence level, calculating a final anomaly score. Voting (e.g., majority voting) makes statistical decisions based on the anomaly labels of each model. Ensemble learning methods (e.g., Stacking or Boosting) train a meta-classifier to learn how to combine the outputs of various base models, further improving the accuracy of detecting complex poisoning attacks and reducing false positives.

[0046] Defense measures include: isolation of abnormal data, data repair / replacement (such as using historical data from the same period or load forecasting model interpolation), and early warning notifications.

[0047] Abnormal data isolation involves removing data points identified as being under attack from subsequent load forecast input streams to prevent them from contaminating the load forecasting model. Data repair / replacement involves replacing attacked data with historical data from the same period, load data from adjacent areas, or short-term interpolation using an auxiliary load forecasting model to maintain the integrity and continuity of the data stream and ensure that the forecasting process is not interrupted. Early warning notifications are also provided to system administrators or operators in a timely manner, recording in detail the time, type, and affected data of the attack event to facilitate manual intervention, source tracing analysis, and further countermeasures.

[0048] In summary, this method, through parallel anomaly detection and modular design, achieves real-time monitoring and rapid response of power load data streams, significantly improving the real-time performance of defense. Employing multimodal anomaly detection and fusion decision-making enhances the ability to identify complex, unknown, or mutated poisoning attacks, reduces false positives, and strengthens system robustness and generalization capabilities. Combining multiple model decisions and employing a fusion strategy more accurately distinguishes between normal fluctuations and malicious attacks; experimental verification shows an F1 score of 0.88, significantly outperforming single models and traditional fusion methods. It effectively identifies and defends against data poisoning attacks, ensuring that load forecasting models are based on high-quality data, significantly improving forecast accuracy indicators such as MAE and RMSE, and guaranteeing the safe and stable operation of the power system.

[0049] Example 2 This embodiment provides a data poisoning attack defense system based on abnormal data detection. The system is as follows: Figure 2 As shown, it includes: The data preprocessing module is used to preprocess the raw power load data and then extract multidimensional features from the preprocessed data. The heterogeneous model detection module has a built-in heterogeneous model group, which is used to input multi-dimensional features into the heterogeneous model group and output the anomaly score and corresponding confidence level of each model. The attack determination module is used to collect the historical detection accuracy of each model and calculate the dynamic trust weight. Based on the dynamic trust weight and the abnormal score of each model, the attack determination result is generated by weighting. The defense reconstruction module is used to execute defense strategies based on the attack determination results: when a data poisoning attack is determined to exist, the reconstruction mechanism corresponding to the model with the highest confidence level is used to generate a safe load sequence to replace the original power load data; otherwise, the original power load data is directly used as the safe load sequence; finally, the module outputs the safe load sequence.

[0050] The defense process of this data poisoning attack defense system based on abnormal data detection is as follows: Figure 3 As shown, the system consists of a series of logical modules, with data processing and model collaboration at its core. These modules work together to form a closed-loop defense and prediction process. Specifically, it includes: The data acquisition module is responsible for acquiring raw power load data (e.g., minute-level, hourly load), meteorological data (e.g., temperature, humidity, wind speed, light intensity), and date information (e.g., holidays, days of the week) from various data sources in real time. This data forms the foundation for the load forecasting model. This module ensures the timeliness, completeness, and reliability of the data. Data sources include the power company's Supervisory Control and Data Acquisition (SCADA) system, historical load databases, the National Meteorological Administration's Application Programming Interface (API), and power grid topology information.

[0051] Data preprocessing module: This module performs fine-grained processing on the collected raw data to improve data quality and model training efficiency. Specific processing steps include: Cleaning: Identify and remove data points that are obviously erroneous, duplicate, or misformatted.

[0052] Missing value imputation: For missing data, linear interpolation, polynomial interpolation, spline interpolation, historical mean replacement, or machine learning model-based imputation (such as KNN imputation) can be used to complete the data.

[0053] Outlier handling: Use statistical methods (such as the 3σ criterion, IQR method) or model-based methods (such as the Local Outlier Factor LOF) to identify and handle extreme outliers, with options for deletion, replacement or truncation.

[0054] Normalization or standardization: Transform data with different dimensions into a uniform scale, such as Min-Max normalization (scaling the data to the 0, 1 interval) or Z-score standardization (making the data mean 0 and variance 1) to eliminate the influence of dimensions and accelerate model convergence.

[0055] For example, the formula for Min-Max normalization is: The formula for Z-score standardization is: in, The original data, , For the minimum and maximum values ​​of the data, The mean of the data. denoted as the standard deviation of the data.

[0056] Anomaly Feature Extraction Module: Connected to the data preprocessing module, this module performs in-depth feature engineering on the preprocessed data to extract multidimensional features that are more sensitive to anomaly detection. These features aim to capture latent patterns and anomalous behaviors in the data, including but not limited to: Time series characteristics: such as sliding window mean, variance, skewness, kurtosis, load change rate (the difference between the current value and the previous value), and time series lag values ​​(such as the load of the previous hour or the previous day).

[0057] Statistical characteristics: Calculate the maximum, minimum, median, standard deviation, etc. of data within a fixed time window.

[0058] Correlation characteristics: cross-correlation coefficients between load and key external variables (such as temperature), or correlations between loads in different regions.

[0059] Periodic characteristics: Unique-hot encoding of days of the week, hours, months, and holiday markers, etc., to capture strong periodic patterns in electricity load. These feature vectors... It will be used as input to the multimodal anomaly detection module.

[0060] The multimodal anomaly detection module, connected to the anomaly feature extraction module, includes at least two (preferably two to five) independent anomaly detection models with complementary detection mechanisms. These models receive multidimensional features in parallel and perform anomaly detection independently, outputting their respective anomaly scores or labels. Working collaboratively, these models capture data anomaly patterns across different dimensions, including statistics, machine learning, and deep learning, achieving comprehensive coverage of point anomalies, structural anomalies, and temporal context anomalies, significantly enhancing the system's robustness and generalization ability. The range of the number of models is an optimized selection based on system performance evaluation, aiming to ensure high detection accuracy and comprehensiveness while keeping real-time decision latency within an acceptable range, avoiding excessive consumption of computational resources and degradation of real-time performance due to an excessive number of models.

[0061] The multimodal anomaly detection module is the core of the system's algorithm, designed to improve the ability to identify complex and varied poisoning attacks by integrating multiple anomaly detection techniques. It comprises at least two independent anomaly detection models that receive multidimensional features output from the anomaly feature extraction module in parallel and perform anomaly evaluation independently.

[0062] Statistical methods (such as sliding window Z-score) are suitable for detecting instantaneous or local outliers and offer extremely high real-time performance. Within a sliding window... Inside, calculate data points Z-score: in, and windows respectively The mean and standard deviation of the data. When If the threshold is exceeded, it is considered abnormal.

[0063] Machine learning-based methods (such as Isolation Forest) are efficient unsupervised anomaly detection algorithms. They construct isolation trees by randomly selecting features and randomly partitioning data points, excelling at identifying sparse outliers and structural anomalies in the feature space. Anomalies are typically closer to the root node (i.e., shorter path lengths) and are therefore easier to isolate. Their anomaly scores... Based on path length : in, Is In the isolated forest of data points Average path length, It is given hour The adjustment factor for the average path length.

[0064] Deep learning-based methods (such as LSTM autoencoders) excel at processing time-series data, and their reconstruction error mechanisms are highly sensitive to covert attacks and temporal context anomalies. LSTM autoencoders first compress the time-series data into a low-dimensional latent space using an encoder, and then reconstruct it using a decoder. Reconstruction errors are small for normal data, but large for anomalous data. (Reconstruction error) If the threshold is exceeded, it is considered an anomaly. These models work in parallel, each outputting an anomaly score. or abnormal tags This enhances the coverage against various types of attacks. To ensure the best balance between real-time performance and robustness, the optimal number of anomaly detection models in practical applications is two to five complementary models.

[0065] Fusion Decision Module: Connected to the multimodal anomaly detection module, this module receives the output of the multimodal anomaly detection module and comprehensively judges whether the current data contains poisoning attacks based on a preset fusion strategy, thereby reducing the risk of misjudgment by a single model. The fusion decision module receives anomaly scores or labels from multiple anomaly detection models and makes a final poisoning attack judgment based on the preset fusion strategy. This module aims to combine the advantages of various models to improve the overall robustness and accuracy of detection and reduce misjudgment by a single model. Commonly used fusion strategies include: Weighted average method: assigning different weights to each model based on its historical performance, confidence level, or expert experience. Calculate the final fusion anomaly score. .when If the threshold is exceeded, it is considered an attack.

[0066] Voting method: Each model outputs an anomaly label (0 for normal, 1 for abnormal), and a majority vote (if more than half of the models determine it as abnormal, it is an attack) or a weighted voting strategy is adopted.

[0067] Ensemble learning methods train a meta-classifier (such as logistic regression or support vector machine) to learn how to combine the outputs of various base models to make more complex decisions. In experimental testing, this strategy achieved an F1 score of 0.88, making it a preferred solution for ensuring high accuracy and low false positive rate.

[0068] Defense Response Module: Connected to the fusion decision module, this module takes corresponding defensive measures based on preset defense strategies when a poisoning attack is detected, in order to mitigate the impact of the attack on load forecasting. When the fusion decision module determines that a poisoning attack exists, this module immediately takes response measures according to the preset defense strategies to protect the accuracy of load forecasting and the security of the power system. Specific measures include: Abnormal data isolation: Specific data points or data segments that are identified as being under attack are removed from the subsequent load forecasting model input stream to prevent them from polluting the forecasting model.

[0069] Data Repair / Replacement: To maintain the integrity of the data stream and the continuity of predictions, various strategies can be used to replace isolated attack data: Historical data replacement: Normal load data from the same time in the past (such as the same hour of the previous day or week) is used for filling.

[0070] Adjacent area load data interpolation: Inferring and filling by using load data from neighboring areas with similar geographical locations or functions.

[0071] Load forecasting model-based interpolation: A pre-trained auxiliary short-term load forecasting model is used to interpolate and predict the attacked data, generating reasonable replacement values. Experimental results show that this strategy achieves the highest repair accuracy and can maximize the integrity of the data stream and the continuity of prediction.

[0072] Warning notification: Immediately send detailed alert information to system administrators, schedulers, or relevant operators, including the time of the attack, the affected data points, the possible attack types, and the defensive measures already taken, to facilitate manual intervention, attack tracing analysis, and the development of longer-term security strategies.

[0073] Load Forecasting Module: Connected to the Defense Response Module, this module receives data processed by the Defense Response Module and uses a pre-trained load forecasting model to predict power load, ensuring forecast accuracy. The load forecasting module receives the clean data stream processed by the Defense Response Module and uses a pre-trained, high-precision load forecasting model to predict future power load. These models can include traditional time-series models (such as ARIMA, SARIMA), machine learning models (such as XGBoost, LightGBM), or more advanced deep learning models (such as models based on RNN, LSTM, GRU, Transformer, or Attention mechanisms). These models can capture the complex nonlinear, temporal, and periodic patterns of power load, outputting highly reliable short-term, medium-term, or long-term load forecast results.

[0074] Feedback and Iteration Module: Connecting the load forecasting module, multimodal anomaly detection module, and fusion decision module, this module adaptively adjusts and optimizes the parameters of the anomaly detection model, fusion strategy, or load forecasting model based on load forecasting results (e.g., forecasting error) and anomaly detection performance (e.g., false alarm rate, false negative rate), enabling continuous system learning and performance improvement. The Feedback and Iteration module is responsible for the adaptive optimization of the entire system's performance. This module continuously monitors load forecasting accuracy (e.g., Mean Absolute Error (MAE), Root Mean Square Error (RMSE), Mean Absolute Percentage Error (MAPE)) and anomaly detection performance (e.g., false alarm rate, false negative rate, precision, recall, F1 score). Based on these evaluation metrics, the system can automatically or manually adjust: Anomaly detection model parameters: such as the threshold of the sliding window Z-score, the number of trees and sample size in the isolation forest, the network structure of the LSTM autoencoder, and the training hyperparameters.

[0075] Fusion strategy parameters: such as the weights of each model in the weighted average method.

[0076] Load prediction model parameters: such as learning rate, batch size, number of layers in deep learning models, or hyperparameters in traditional models.

[0077] Through this closed-loop feedback mechanism, the system can continuously learn and adapt to new data patterns and evolving attack strategies, thereby achieving continuous improvement in defense performance and long-term stability in prediction accuracy.

[0078] The specific implementation process of the system is as follows: Figure 4 As shown, First, data acquisition and preprocessing: the data acquisition module obtains the original power load and related data, and the data preprocessing module cleans, fills missing values, handles outliers, and normalizes or standardizes the original data. Then, real-time feature extraction is performed. Multidimensional features are extracted from the preprocessed data through the anomaly feature extraction module. These multidimensional features include, but are not limited to, time-series features, statistical features, correlation features, and periodic features. Then, parallel anomaly detection is performed. At least two independent anomaly detection models in the multimodal anomaly detection module receive multidimensional features in parallel and perform anomaly detection independently, outputting their respective anomaly scores or anomaly labels. The fusion decision module receives the output of the multimodal anomaly detection module and makes a comprehensive judgment on whether the current data is subject to poisoning attacks based on the preset fusion strategy. When a poisoning attack is detected, the defense response module takes corresponding defensive measures according to the preset defense strategy. These measures include, but are not limited to, abnormal data isolation, data repair / replacement, and early warning notification. The load forecasting module receives data processed by the defense response module and uses a pre-trained load forecasting model to forecast power load. Finally, model feedback and iteration are performed. Based on the load forecasting results and anomaly detection performance, the parameters of the anomaly detection model, fusion strategy, or load forecasting model are adaptively adjusted and optimized through the feedback and iteration module.

[0079] In summary, this system's modular design facilitates expansion, allowing for easy introduction or updating of anomaly detection models. The number of models is controlled within 2 to 5 complementary models, adapting to constantly evolving network threats. The inclusion of feedback and iteration modules enables the system to learn and optimize itself based on operational performance. Through continuous iteration, detection performance can be improved by more than 10%, continuously enhancing defense capabilities.

[0080] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A data poisoning attack defense method based on abnormal data detection, characterized in that, The method includes the following steps: S1, after preprocessing the original power load data, extract multidimensional features from the preprocessed data; S2, input the multidimensional features into a heterogeneous model group, and output the anomaly score and corresponding confidence level of each model; the heterogeneous model group consists of multiple independent models with complementary detection mechanisms; S3, collect the historical detection accuracy of each model, and calculate the dynamic trust weight based on the historical detection accuracy; based on the dynamic trust weight and the anomaly score of each model, fuse to generate an attack judgment result; S4, when the attack judgment result shows that there is a data poisoning attack, use the reconstruction mechanism corresponding to the model with the highest confidence level to generate a safe load sequence to replace the original power load data; otherwise, directly use the original power load data as the safe load sequence; output the safe load sequence.

2. The data poisoning attack defense method based on abnormal data detection according to claim 1, characterized in that, The preprocessing in S1 includes missing value imputation and data normalization; The multidimensional features include time-domain statistical features, specifically including: the mean, variance, skewness, kurtosis, and rate of change of adjacent time points of the power load data.

3. The data poisoning attack defense method based on abnormal data detection according to claim 1, characterized in that, The heterogeneous model group in S2 includes: a statistics-based model for capturing transient anomalies, a machine learning-based model for capturing structural anomalies, and a deep learning-based model for capturing temporal context anomalies.

4. A data poisoning attack defense method based on abnormal data detection according to claim 3, characterized in that, The statistical model specifically employs the sliding window Z-score algorithm, the machine learning model specifically employs the isolated forest algorithm, and the deep learning model specifically employs the LSTM autoencoder. The outlier scores and corresponding confidence levels for each model in S2 are calculated as follows: For statistically based models, the anomaly score is the absolute value of the Z-score of the data point, and the confidence score is the normalized value calculated based on the probability density of this absolute value within the historical window. For machine learning-based models, the anomaly score is the reciprocal of the sample path length in the isolated tree, and the confidence score is the normalized value of the ratio of the path length to the average path length of the tree. For deep learning-based models, the anomaly score is the mean squared error between the input data and the reconstructed data, and the confidence score is the normalized value of the ratio of the difference between the mean squared error and the preset anomaly threshold.

5. A data poisoning attack defense method based on abnormal data detection according to claim 4, characterized in that, The reconstruction mechanism in S4 includes: For statistical models, the corresponding reconstruction mechanism is to replace the original abnormal data with the mean of the normal data within the current sliding window. For machine learning-based models, the corresponding reconstruction mechanism is to replace the original abnormal data with linear interpolation of the normal time points adjacent to the anomaly point. For deep learning-based models, the corresponding reconstruction mechanism is to directly replace the original abnormal data with the reconstructed data generated by the output layer of the LSTM autoencoder.

6. A data poisoning attack defense method based on abnormal data detection according to claim 1, characterized in that, The specific formula for calculating the dynamic trust weight in S3 is as follows: in, Let be the dynamic trust weight of the i-th model at the current time t; Let be the dynamic trust weight of the i-th model at the previous time step; The preset historical forgetting factor has a value range of (0, 1). Let be the historical detection accuracy of the i-th model at the previous time step.

7. A data poisoning attack defense method based on abnormal data detection according to claim 1, characterized in that, When generating attack judgment results in S3, the fusion strategy includes: weighted average method, voting method or ensemble learning method; the ensemble learning method specifically uses a trained meta-classifier to complete the fusion process.

8. A data poisoning attack defense method based on abnormal data detection according to claim 1, characterized in that, The output safe load sequence of S4 is followed by a feedback iteration process, which specifically includes: The safe load sequence is input into the load prediction model, and the power load prediction value is output. The load prediction error is calculated based on the actual load data at the next time step. The anomaly detection effect is evaluated by combining the attack judgment results. The historical detection accuracy is updated based on load prediction error and anomaly detection performance, thereby achieving dynamic trust weight updates.

9. A data poisoning attack defense method based on abnormal data detection according to claim 8, characterized in that, The specific process for updating the historical detection accuracy includes: Set the prediction error tolerance threshold and the accuracy adjustment step size; Based on the attack assessment results, the anomaly detection effectiveness is evaluated and the historical detection accuracy is updated in two scenarios: When the attack assessment results indicate the presence of a data poisoning attack: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is determined to be effective, and the historical detection accuracy of the model with the highest confidence is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the anomaly detection effect is judged as a false alarm or reconstruction failure, and the historical detection accuracy of the model with the highest confidence is reduced by the preset accuracy adjustment step size. When the attack detection result indicates that no data poisoning attack exists: If the load prediction error is less than the prediction error tolerance threshold, the anomaly detection effect is judged as correct rejection, and the historical detection accuracy of all models that give normal scores is increased by the preset accuracy adjustment step size. If the load prediction error is greater than or equal to the prediction error tolerance threshold, the abnormal detection effect is determined to be a missed detection, and the historical detection accuracy of all models that give normal scores is reduced by the preset accuracy adjustment step size.

10. A data poisoning attack defense system based on abnormal data detection, characterized in that, The system operates using a data poisoning attack defense method based on abnormal data detection as described in any one of claims 1-9, the system comprising: The data preprocessing module is used to preprocess the raw power load data and then extract multidimensional features from the preprocessed data. The heterogeneous model detection module has a built-in heterogeneous model group, which is used to input multi-dimensional features into the heterogeneous model group and output the anomaly score and corresponding confidence level of each model. The attack determination module is used to collect the historical detection accuracy of each model and calculate the dynamic trust weight. Based on the dynamic trust weight and the abnormal score of each model, the attack determination result is generated by weighting. The defense reconstruction module is used to execute defense strategies based on the attack determination results: when a data poisoning attack is determined to exist, the reconstruction mechanism corresponding to the model with the highest confidence level is used to generate a safe load sequence to replace the original power load data; otherwise, the original power load data is directly used as the safe load sequence; finally, the module outputs the safe load sequence.

Images