Anti-attack digital watermark embedding and tracing method and system for time series data

Abstract

The application provides an anti-attack digital watermark embedding and tracing method and system for time series data, and relates to the technical field of industrial Internet of Things security. The method comprises the following steps: transforming a pseudo-random sequence corresponding to a synchronization time reference of a power grid measurement terminal into a virtual state disturbance vector matching the dimension of a power grid system state variable; constructing a topological parameter matrix according to the physical connection relationship of a power grid line, and mapping the virtual state disturbance vector to a measurement signal space through the topological parameter matrix to obtain a watermark injection signal; superimposing the watermark injection signal corresponding to each power grid measurement terminal into the real-time electrical measurement value collected, and outputting a measurement data stream; decoupling and separating the virtual state disturbance vector from the system state estimation result of the measurement data stream according to the inverse mapping relationship of the topological parameter matrix to obtain the real physical state of the power grid without watermark. By implementing the method, it can be prevented that the legal data is misjudged as bad data by the state estimation program and is removed.

Description

Technical Field

[0001] This application relates to the field of industrial Internet of Things security technology, and in particular to a method and system for embedding and tracing anti-attack digital watermarks for time-series data. Background Technology

[0002] With the development of smart grids, wide-area measurement systems are widely used for real-time monitoring. To prevent attacks using false data and ensure data authenticity, digital watermarking technology has been introduced as a proactive defense measure to achieve data traceability by embedding hidden identifiers.

[0003] In related technologies, digital watermarking schemes for power grids are typically based on the principle of spread spectrum communication. That is, a pseudo-random noise sequence that follows a specific distribution and is mutually independent is generated, multiplied by a small intensity coefficient, and then used as a watermark signal to be directly superimposed on the original voltage or current measurement time series data collected by each terminal.

[0004] However, power grid data is strictly governed by physical laws, and there is inherent nonlinear coupling between nodes. Since pseudo-random noise sequences in related technologies lack this physical characteristic, their superposition inevitably disrupts the constraints between data points, leading to significant unbalanced residuals during system state estimation. This makes it highly susceptible to misjudging legitimate data with watermarks as "bad data" and filtering it out, or causing serious deviations in the calculated system physical state. Summary of the Invention

[0005] This application provides a method and system for anti-attack digital watermarking embedding and tracing of time-series data, which is used to address the problem that some digital watermarking embedding methods ignore the physical constraints of the power grid, resulting in high residuals in system state estimation, which in turn causes watermark failure or distortion of state monitoring results.

[0006] In a first aspect, this application provides a method for anti-attack digital watermarking embedding and tracing of time-series data, applied to a digital watermarking embedding and tracing system, the system including a power grid measurement terminal and a receiving end, the method comprising: The pseudo-random sequence corresponding to the synchronization time reference of the power grid measurement terminal is transformed into a virtual state disturbance vector that matches the dimension of the power grid system state variables. The pseudo-random sequence is obtained by inputting the synchronization time reference into a preset chaotic mapping model. A topology parameter matrix is ​​constructed based on the physical connection relationship of the power grid lines, and the virtual state disturbance vector is mapped to the measurement signal space through the topology parameter matrix to obtain a watermark injection signal that satisfies the physical constraints. The watermark injection signal corresponding to each of the power grid measurement terminals is collaboratively superimposed onto the collected real-time electrical measurement values, and a measurement data stream containing the hidden fingerprint is output. Based on the topology parameter matrix, the virtual state disturbance vector is decoupled and separated from the system state estimation result of the measurement data stream to obtain the watermark-free true physical state of the power grid.

[0007] By employing the aforementioned technical solution, the system utilizes a chaotic mapping model to transform the time base into a pseudo-random sequence, and further transforms it into a virtual state disturbance vector consistent with the system's state variable dimension. Subsequently, instead of directly superimposing noise, the system maps the state-level disturbance to the measurement signal space through a topology parameter matrix based on the physical connection relationship of the power grid topology. Since the injected signal is generated through mapping from a physical model, it satisfies power grid physical constraints such as Kirchhoff's laws. This processing ensures that the watermarked measurement data does not produce significant residuals due to violations of physical laws during system state estimation. This guarantees data traceability while, to a certain extent, preventing legitimate data from being misjudged as bad data and discarded by the state estimation program, thus maintaining the normal operation of power grid monitoring services.

[0008] In some embodiments, the step of constructing a topology parameter matrix based on the physical connection relationship of the power grid lines and mapping the virtual state disturbance vector to the measurement signal space through the topology parameter matrix to obtain a watermark injection signal that satisfies the physical constraints specifically includes: The Jacobian matrix under the current power grid operating state is constructed as the topology parameter matrix, and the space spanned by the column vectors of the Jacobian matrix represents the physical consistency constraint space of the power grid measurement data. Calculate the product of the Jacobian matrix and the virtual state perturbation vector to generate a pseudo-measurement increment located within the feasible region of the physical state; The pseudo-measurement increment is directly determined as the watermark injection signal.

[0009] By adopting the above technical solution, the system constructs a Jacobian matrix representing the current operating state of the power grid, and uses the space spanned by the column vectors of this matrix to accurately define the range of physical consistency constraints. By calculating the product of the Jacobian matrix and the virtual state disturbance vector, the pseudo-measurement increment generated by the system strictly falls within the feasible region of the power grid's physical state. This linearization mapping based on the Jacobian matrix ensures a high degree of fit between the watermark signal and the current nonlinear power flow characteristics of the power grid, so that the data after watermarking still maintains a high degree of physical self-consistency in mathematical structure. This reduces the risk that the watermark signal can be identified or filtered by attackers through physical consistency verification methods, and improves the concealment of the watermark.

[0010] In some embodiments, the step of directly determining the pseudo-measurement increment as the watermark injection signal specifically includes: Obtain the safe operating boundary parameters under the current operating state of the power grid, wherein the safe operating boundary parameters limit the allowable fluctuation range of electrical measurement values; The difference between the collected real-time electrical measurement values ​​and the safety operation boundary parameters is calculated to obtain the real-time safety margin of each measurement point; Determine whether the amplitude of the real-time electrical measurement value plus the pseudo-measurement increment is within the allowable fluctuation range; If not, the pseudo-measurement increment is scaled proportionally based on the real-time safety margin, and the scaled pseudo-measurement increment is determined as the watermark injection signal. If so, the pseudo-measurement increment is directly determined as the watermark injection signal.

[0011] By adopting the above technical solution, the system introduces a safety boundary verification mechanism before watermarking. The system acquires the power grid's safe operating boundary parameters and calculates the real-time safety margin, actively determining whether the electrical measurement values ​​after watermarking will exceed the allowable fluctuation range. When a potential limit violation is detected, the system scales the pseudo-measurement increment proportionally based on the real-time safety margin. This adaptive adjustment strategy ensures that the watermarking process does not cause false alarms such as voltage over-limit or overload.

[0012] In some embodiments, the step of constructing the Jacobian matrix under the current power grid operating state as the topology parameter matrix specifically includes: Real-time monitoring of discrete state states of power grid switching stations and circuit breakers; when a sudden change in topology is detected, the system state estimate from the previous moment is locked. The dynamic Jacobian matrix is ​​recalculated based on the switch state after the mutation and the estimated system state. Calculate the null projection deviation between the dynamic Jacobian matrix and the Jacobian matrix before the mutation; If the null projection deviation exceeds a preset threshold, the superposition of the watermark injection signal will be paused for the current two consecutive sampling periods until the null projection deviation does not exceed the preset threshold.

[0013] By adopting the above technical solution, the system monitors the status of switches and circuit breakers in real time. Once a change in topology is detected, the system not only recalculates the dynamic Jacobian matrix but also further quantifies its null-space projection deviation from the matrix before the mutation. When the deviation exceeds a threshold, it indicates that the linearization model error is large, and the system can promptly pause watermark injection until the model stabilizes. This mechanism effectively prevents abnormal residuals caused by model mismatch leading to violations of physical constraints in the watermark signal during power grid operation transients or drastic topology changes, thus enhancing the robustness of the watermark system under complex dynamic conditions.

[0014] In some embodiments, before the step of collaboratively superimposing the watermark injection signal corresponding to each of the power grid measurement terminals onto the acquired real-time electrical measurement values ​​and outputting a measurement data stream containing a hidden fingerprint, the method further includes: A sliding window variance analysis was performed on the collected real-time electrical measurements to calculate the ambient noise floor intensity under the current time window. Substitute the environmental measurement noise floor intensity into a preset data statistical distribution model to calculate the noise floor masking threshold. The watermark injection signal is modulated such that the energy spectral density of the watermark injection signal is lower than the noise substrate masking threshold, and the signal-to-noise ratio of the watermark injection signal to the intensity of the environmental measurement noise substrate remains constant during the modulation process.

[0015] By employing the above technical solution, the system calculates the ambient noise floor intensity under a sliding window in real time and determines the noise floor masking threshold by combining it with a data statistical distribution model. Based on this, the energy spectral density of the watermark injection signal is modulated to ensure that the energy of the watermark signal is always controlled below the perceived threshold of ambient noise and maintains a constant signal-to-noise ratio. This processing makes the watermark signal almost indistinguishable from background noise in terms of statistical characteristics, achieving "hiding under noise." This makes it difficult for attackers to detect the watermark's presence through spectral analysis or statistical detection methods, further enhancing the imperceptibility of digital watermarks.

[0016] In some embodiments, after the step of decoupling and separating the virtual state disturbance vector from the system state estimation result of the measurement data stream based on the topology parameter matrix to obtain the watermark-free true physical state of the power grid, the method further includes: The decoupled virtual state perturbation vector and the locally generated standard reference sequence are obtained respectively; Calculate the correlation coefficient between the virtual state perturbation vector and the standard reference sequence; If the correlation coefficient is greater than the preset authentication threshold, and the estimated residual of the actual physical state of the power grid after watermark removal is within the preset normal range, then the tracing is determined to be successful. If the correlation coefficient is less than or equal to the authentication threshold, or the estimated residual after removing the watermark exceeds the normal range, an attack or data anomaly is determined, the result is discarded, and an alarm is triggered.

[0017] By adopting the above technical solution, the system constructs a dual-verification tracing logic at the receiving end. The system not only calculates the correlation coefficient between the decoupled virtual state perturbation vector and the standard reference sequence to verify identity, but also simultaneously monitors whether the state estimation residual after watermark removal is within the normal range. Tracing is only considered successful when identity authentication is passed and the physical state residual is normal; otherwise, an alarm is triggered. This mechanism can more accurately distinguish between normal data fluctuations, legitimate watermarked data, and malicious fictitious data injection (FDI) attacks, providing the power grid with a high-confidence anomaly intrusion detection capability while achieving data ownership confirmation.

[0018] In some embodiments, before the step of decoupling and separating the virtual state disturbance vector from the system state estimation result of the measurement data stream based on the topology parameter matrix to obtain the watermark-free true physical state of the power grid, the method further includes: Based on a preset time window step, multiple sets of candidate pseudo-random sequences are generated before and after the current synchronization time reference at the receiving end; Construct candidate state perturbation vectors corresponding to the candidate pseudo-random sequences in each group; Calculate the cross-correlation coefficient between the system state estimation results and the candidate state perturbation vectors of each group; The current time synchronization deviation is determined based on the maximum cross-correlation coefficient, and the timing parameters of the chaotic mapping model are calibrated based on the time synchronization deviation.

[0019] By adopting the above technical solution, the system introduces a timing calibration mechanism based on the maximum cross-correlation coefficient. Considering the potential time asynchrony caused by network transmission, the system generates multiple candidate pseudo-random sequences for preceding and following time windows at the receiving end, and performs matching calculations with the system state estimation results for each. The specific time synchronization deviation is determined by finding the peak value of the cross-correlation coefficient, and the chaotic mapping parameters are calibrated accordingly. This process enables the system to possess "soft synchronization" capability, ensuring accurate watermark extraction even when there is clock drift or transmission delay between the power grid measurement terminal and the receiving end, thus guaranteeing the availability of the traceability function and its anti-interference capability.

[0020] Secondly, this application provides a digital watermark embedding and traceability system, the system comprising: one or more processors and a memory; The memory is coupled to the one or more processors. The memory is used to store computer program code, which includes computer instructions. The one or more processors call the computer instructions so that the system can implement the attack-resistant digital watermark embedding and tracing method for time-series data provided in the above embodiments, which will not be described in detail here.

[0021] Thirdly, this application provides a computer-readable storage medium including instructions that, when executed on a digital watermark embedding and tracing system, enable the system to implement the attack-resistant digital watermark embedding and tracing method for time-series data provided in the above embodiments, which will not be elaborated here.

[0022] Fourthly, this application provides a computer program product, including a computer program / instruction, characterized in that, when the computer program / instruction is run on a digital watermarking embedding and tracing system, the system can implement the anti-attack digital watermarking embedding and tracing method for time-series data provided in the above embodiments, which will not be elaborated here.

[0023] One or more technical solutions provided in the embodiments of this application have at least the following technical effects or advantages: 1. The system transforms the pseudo-random sequence derived from the time base into a virtual perturbation in the state space, and then forcibly projects it onto the measurement signal space using a Jacobian matrix. This derivation process ensures that the generated watermark signal strictly adheres to the physical constraints of the power grid, such as Kirchhoff's laws, in its mathematical structure, appearing as if it were a tiny state fluctuation of the power grid system itself. This processing method can fundamentally "deceive" the state estimator of the power grid control center, allowing the watermarked measurement data to pass smoothly through the bad data identification and removal module. While ensuring the legitimacy of the data stream, it addresses the core pain point of traditional watermarks being filtered out by the system due to violations of physical laws.

[0024] 2. On the one hand, the system calculates the safe operating boundaries and real-time margins of each node in the power grid in real time, dynamically scaling the watermark amplitude to ensure that watermark superposition will not trigger false alarms such as voltage over-limit under any operating condition, thus strictly guaranteeing the physical operation safety of the power grid. On the other hand, by combining the ambient noise floor intensity and data statistical distribution model, the watermark signal is modulated with energy spectral density to keep it hidden below the perception threshold of ambient noise. This combination of "physical safety boundary restriction" and "noise-hidden modulation" ensures that the watermark scheme will not interfere with normal scheduling decisions in harsh industrial control environments, and is difficult to detect by statistical detection methods, achieving a balance between high reliability and high concealment.

[0025] 3. To address the common time synchronization problem in distributed measurement networks, this technical solution introduces a tracing mechanism with "soft synchronization" capabilities. The receiving end generates multiple candidate sequences within a sliding time window and calculates the peak value of the cross-correlation coefficient, automatically identifying and calibrating the time offset during transmission and accurately locking the phase of the watermark embedding. Based on this, the solution employs a dual authentication logic of "identity correlation" and "physical residual normality," which not only confirms the data source through sequence comparison but also determines whether a spoofed data injection attack has occurred by estimating the residual after decoupling the state. Attached Figure Description

[0026] Figure 1 This is a flowchart illustrating an anti-attack digital watermark embedding and tracing method for time-series data in an embodiment of this application; Figure 2 This is another flowchart illustrating an anti-attack digital watermark embedding and tracing method for time-series data in an embodiment of this application; Figure 3 This is a schematic diagram of the physical device structure of a digital watermark embedding and traceability system in the embodiments of this application. Detailed Implementation

[0027] The terminology used in the following embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. As used in the specification and appended claims of this application, the singular expressions “a,” “an,” “the,” “the,” “the,” and “this” are intended to include the plural expressions as well, unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used in this application refers to any or all possible combinations including one or more of the listed items.

[0028] Hereinafter, the terms "first" and "second" are used for descriptive purposes only and should not be construed as implying or suggesting relative importance or implicitly indicating the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature, and in the description of the embodiments of this application, unless otherwise stated, "multiple" means two or more.

[0029] For ease of understanding, the method provided in this implementation is described in process below. Please refer to [link / reference]. Figure 1 This is a flowchart illustrating a method for embedding and tracing anti-attack digital watermarks for time-series data in an embodiment of this application.

[0030] S101. Transform the pseudo-random sequence corresponding to the synchronization time reference of the power grid measurement terminal into a virtual state disturbance vector that matches the dimension of the power grid system state variables.

[0031] Among them, the synchronization time reference refers to the reference signal that keeps the time consistent among power grid measurement terminals, which is used to ensure the timing consistency of data acquisition and processing of each terminal; the pseudo-random sequence refers to a sequence that has similar random characteristics but actually has a definite generation law, obtained by inputting the synchronization time reference into a preset chaotic mapping model; the power grid system state variables refer to the set of key parameters used to describe the power grid operating state; the virtual state disturbance vector refers to the vector that matches the dimension of the power grid system state variables and is used to generate watermark signals in the future; and the chaotic mapping model refers to the preset mathematical model used to transform the synchronization time reference into a pseudo-random sequence.

[0032] This step is performed in the initial stage of the system's digital watermark embedding. Specifically, after the power grid measurement terminal completes the real-time electrical measurement value acquisition, but before the watermark injection signal is generated, it is necessary to first construct a basic vector that adapts to the power grid system state to facilitate the subsequent generation of a watermark signal that conforms to physical constraints.

[0033] Specifically, the system acquires the synchronization time reference of the power grid measurement terminal. This reference is crucial for ensuring the timing synchronization of the entire watermarking system, guaranteeing the consistency of the subsequently generated pseudo-random sequences in the time dimension. Next, the system inputs this synchronization time reference into a preset chaotic mapping model. Through the operation of the chaotic mapping model, a pseudo-random sequence is generated. This sequence possesses characteristics similar to randomness, ensuring the concealment of the watermark, while its deterministic generation logic facilitates matching and verification during subsequent tracing. Subsequently, the system needs to define the dimension of the power grid system's state variables. This dimension is determined by the scale, structure, and monitoring requirements of the power grid, such as the number of state parameters including voltage and current. Finally, the system uses a specific transformation algorithm to convert the generated pseudo-random sequence into a virtual state perturbation vector that perfectly matches the dimension of the power grid system's state variables. This ensures that the vector is compatible with the state space of the power grid system, facilitating the subsequent generation of watermark signals based on the physical characteristics of the power grid.

[0034] Optionally, the system can read the synchronization time reference data from the power grid measurement terminal to ensure the accuracy and integrity of the data; input the synchronization time reference data into a preset Logistic chaotic mapping model, set appropriate chaotic parameters (such as initial values ​​and control parameters), and run the model to generate a pseudo-random sequence; the system obtains the dimensional information of the power grid system state variables, which can be retrieved from the system parameter configuration of the power grid dispatch center; and uses a vector dimension expansion or compression algorithm to adjust the generated pseudo-random sequence into a vector consistent with the dimension of the power grid system state variables, which is the virtual state disturbance vector.

[0035] Optionally, the system can also acquire a high-precision synchronization time reference from the power grid measurement terminal via a GPS synchronization module, perform time calibration to eliminate minor time deviations, input the calibrated synchronization time reference into a preset Lorenz chaotic mapping model to generate an initial pseudo-random sequence, normalize the initial pseudo-random sequence to ensure its values ​​fall within a preset range, query the power grid system's topology and state monitoring parameter list to determine the dimension of the state variables, and use a matrix transformation algorithm to map the normalized pseudo-random sequence into a virtual state disturbance vector matching the dimension of the state variables. It is understood that other chaotic mapping models or vector transformation algorithms can also be used to implement this step; this is not limited here.

[0036] S102. Construct a topology parameter matrix based on the physical connection relationship of the power grid lines, and map the virtual state disturbance vector to the measurement signal space through the topology parameter matrix to obtain a watermark injection signal that meets the physical constraints.

[0037] Among them, the physical connection relationship of power grid lines refers to the actual electrical connection method and correlation between various nodes, lines, switching equipment, etc. in the power grid; the topology parameter matrix refers to the matrix constructed based on the physical connection relationship of power grid lines to characterize the topological characteristics of the power grid; the measurement signal space refers to the space composed of various electrical measurement signals collected by all measurement terminals of the power grid; physical constraints refer to the physical laws and operating rules that must be followed during the operation of the power grid (such as Kirchhoff's laws); and the watermark injection signal refers to the signal that carries hidden fingerprint information and is embedded in the real-time electrical measurement value.

[0038] Specifically, the system acquires the physical connections of the power grid, including the connections between substations, transmission lines, and distribution equipment, as well as the current status of equipment such as switches and circuit breakers. This information forms the basis for constructing the topology parameter matrix. Based on the acquired physical connections, the system constructs the topology parameter matrix using specific mathematical modeling methods. This matrix accurately reflects the topology and electrical characteristics of the power grid, ensuring that the subsequent vector mapping process follows the physical laws of the power grid. Next, the system inputs the previously generated virtual state disturbance vector into the constructed topology parameter matrix. Through matrix multiplication and other operations, the virtual state disturbance vector is mapped from the system state space to the measurement signal space. During the mapping process, the topology parameter matrix can constrain and adjust the virtual state disturbance vector, ensuring that the generated signal satisfies the physical constraints of the power grid and does not violate physical laws such as Kirchhoff's laws. The final signal obtained is the watermark injection signal, which carries information for traceability and conforms to the physical characteristics of the power grid measurement signals.

[0039] Optionally, the system can collect connection information and operating status data of various nodes, lines, and switching equipment in the power grid in real time through the interface of the power grid monitoring system; based on the collected physical connection relationships, an initial topology parameter matrix is ​​constructed using the node admittance matrix construction method and combined with the electrical parameters of the power grid (such as resistance, reactance, etc.); the validity of the initial topology parameter matrix is ​​verified to ensure that the matrix can accurately represent the physical connection characteristics and electrical constraint relationships of the power grid; the virtual state disturbance vector is multiplied with the verified topology parameter matrix to obtain a preliminary mapping signal; the preliminary mapping signal is verified to see if it meets the physical constraint conditions of the power grid. If it does, it is determined to be a watermark injection signal; if it does not, the topology parameter matrix is ​​adjusted and remapped.

[0040] Optionally, the system can also call historical connection relationship data in the power grid topology database and combine it with real-time monitored equipment status information to update the physical connection relationship of the current power grid lines; using the Jacobian matrix construction method, a topology parameter matrix is ​​constructed based on the current operating state of the power grid (such as current voltage and current values). The space spanned by the column vectors of this matrix can represent the physical consistency constraint space of the power grid measurement data; the virtual state disturbance vector is input into the constructed Jacobian matrix and mapped to the measurement signal space through linear transformation operation; the mapped signal is physically constrained and verified, including whether it meets the requirements of power balance, voltage amplitude range, etc.; the signal that passes the verification is determined as the watermark injection signal.

[0041] S103. The watermark injection signal corresponding to each power grid measurement terminal is collaboratively superimposed onto the collected real-time electrical measurement value, and the measurement data stream containing the hidden fingerprint is output.

[0042] Among them, the power grid measurement terminal refers to the equipment installed at various monitoring points of the power grid for collecting electrical measurement values; real-time electrical measurement values ​​refer to the electrical parameter values ​​such as voltage, current, and power that the power grid measurement terminal collects in real time, reflecting the operating status of the power grid; hidden fingerprint refers to the concealed identification information carried in the watermark injection signal for data traceability; and measurement data stream refers to the continuous measurement data sequence output by each power grid measurement terminal after the watermark injection signal is superimposed.

[0043] Specifically, the system assigns a corresponding watermark injection signal to each power grid measurement terminal. Since the monitoring location and acquisition parameters of different measurement terminals may be different, the corresponding watermark injection signal will also be adapted according to the characteristics of the terminal to ensure that the watermark signal of each terminal can match the data it collects.

[0044] Next, the system acquires real-time electrical measurement values ​​collected by each power grid measurement terminal. These data are raw data reflecting the current operating status of the power grid, and their real-time acquisition and accuracy must be guaranteed. Then, the system adopts a collaborative overlay method to superimpose the watermark injection signal corresponding to each terminal with the real-time electrical measurement value of that terminal. Collaborative overlay means that the watermark overlay process of each terminal takes into account the overall operating status of the power grid and data correlation, avoiding anomalies in the overall data caused by the overlay of watermarks from a single terminal. During the overlay process, the amplitude and energy of the watermark injection signal need to be strictly controlled to ensure that the superimposed measurement data does not exceed the parameter range of normal power grid operation, and that the watermark signal has good concealment and cannot be detected by conventional data monitoring methods.

[0045] Finally, the system integrates all the superimposed measurement data into a continuous measurement data stream, outputs it, and transmits it to the receiving end. This data stream contains both real information about the power grid operation and a hidden fingerprint for traceability.

[0046] Optionally, the system establishes a unique identifier for each power grid measurement terminal, assigns a corresponding watermark injection signal based on the terminal identifier, and stores the correspondence between the terminal and the watermark signal; it receives real-time electrical measurement values ​​uploaded by each power grid measurement terminal in real time, preprocesses the data (such as removing outliers and filtering) to ensure the reliability of the original data; it matches the corresponding watermark injection signal according to the terminal identifier, and uses a point-by-point superposition method to add each data point of the watermark signal to the corresponding data point of the real-time electrical measurement value; during the superposition process, it monitors the amplitude of the superimposed data in real time, and if the data is found to exceed the power grid safe operation boundary, it dynamically adjusts the amplitude of the watermark signal and re-superimposes it; it integrates the superimposed measurement data of all terminals in chronological order to form a measurement data stream and outputs it.

[0047] S104. Based on the topology parameter matrix, decouple and separate the virtual state disturbance vector from the system state estimation results of the measurement data stream to obtain the watermark-free true physical state of the power grid.

[0048] Among them, the system state estimation result refers to the estimation result of the power grid operation state obtained by the receiving end after analyzing and processing the measurement data stream; decoupling and separation refers to the process of separating the virtual state disturbance vector contained in the system state estimation result from the real state information of the power grid; the real physical state of the power grid refers to the actual operating state of the power grid without watermark injection, which is the state information reflecting the real operating conditions of the power grid.

[0049] Specifically, the receiving end receives the transmitted measurement data stream and preprocesses it, including data synchronization and noise reduction, to ensure data quality. Next, the receiving end uses a pre-defined system state estimation algorithm (a system state estimation algorithm is an algorithm based on the topological parameter matrix (i.e., the Jacobian matrix) used to solve for the system state space from the observations in the measurement space (such as weighted least squares)). Utilizing the physical constraints represented by the topological parameter matrix, the receiving end iteratively solves the preprocessed measurement data stream to obtain the system state estimation result.

[0050] Since the watermark is generated based on physical mapping at the transmitting end, the system state estimation result essentially includes a component of a virtual state disturbance vector. At this point, the receiving end locally generates a standard reference virtual state disturbance vector synchronized with the transmitting end, and separates this virtual state disturbance vector from the system state estimation result through vector subtraction or an equivalent removal operation. The remaining portion represents the true physical state information of the power grid after watermark removal. This information accurately reflects the actual operating conditions of the power grid, providing a reliable basis for power grid scheduling, monitoring, and other related work.

[0051] Optionally, the system can receive the measurement data stream through the receiving end, perform time synchronization calibration on the data stream to ensure the timing consistency of the data; call the preset state estimation algorithm, using the topology parameter matrix as the basis for calculation, to solve the state of the calibrated measurement data stream and obtain the system state estimation result containing mixed information; the system simultaneously reconstructs the virtual state disturbance vector based on the current time synchronization reference; directly calculate the difference between the system state estimation result and the virtual state disturbance vector, thereby completing the decoupling, obtaining the watermark-free true physical state of the power grid, and verifying the validity of the true physical state.

[0052] In the above embodiment, the system utilizes a chaotic mapping model to transform the time base into a pseudo-random sequence, and further transforms it into a virtual state disturbance vector consistent with the system state variable dimension. Subsequently, instead of directly superimposing noise, the system maps the state-level disturbance to the measurement signal space through a topology parameter matrix based on the physical connection relationship of the power grid topology. Since the injected signal is generated through mapping of the physical model, it satisfies power grid physical constraints such as Kirchhoff's laws. This processing ensures that the watermarked measurement data does not produce significant residuals due to violations of physical laws when undergoing system state estimation. Thus, while ensuring data traceability, it also prevents legitimate data from being misjudged as bad data and discarded by the state estimation program, maintaining the normal operation of power grid monitoring services.

[0053] The following provides a more detailed description of the process of the method provided in this implementation. Please refer to [link / reference]. Figure 2 This is another flowchart illustrating an anti-attack digital watermarking embedding and tracing method for time-series data in an embodiment of this application.

[0054] S201. Real-time monitoring of discrete state bits of power grid switching stations and circuit breakers. When a sudden change in topology is detected, the estimated system state value of the previous moment is locked.

[0055] Among them, a power grid switching station refers to a key location used for centralized control and management of power grid switching equipment and for realizing the connection and disconnection of power grid lines; a circuit breaker refers to an electrical device used to disconnect or connect circuits when a power grid fails or is operating normally; a discrete state bit refers to a discrete data bit used to represent the on / off state of the power grid switching station and circuit breaker (e.g., 1 for on and 0 for off); a topology change refers to a sudden change in the connection relationship of power grid nodes and lines caused by changes in the state of equipment such as switches and circuit breakers; and the system state estimate of the previous moment refers to the result data obtained by estimating the operating state of the power grid before detecting a topology change.

[0056] This step is performed during the process of the system constructing the Jacobian matrix (as the topology parameter matrix) under the current power grid operating state. The specific scenario is that the system needs to adapt to the dynamic changes in the power grid topology in real time to ensure that the watermark injection signal generated subsequently always conforms to the physical constraints of the power grid and avoids model mismatch due to topology abrupt changes.

[0057] The system continuously monitors the discrete state positions of all switching stations and circuit breakers in the power grid in real time. This is because the on / off status of these devices directly determines the physical connection relationship of the power grid, and changes in their state directly lead to changes in the power grid topology. Specifically, the system establishes real-time communication with the power grid equipment monitoring module, periodically collects discrete state position data of each switching station and circuit breaker, and compares it with the state data of the previous collection period. When a change in state data is detected, and this change causes a sudden change in core topology information such as the connection relationship of power grid nodes and the on / off status of lines (i.e., abrupt change in topology), the system immediately locks the system state estimate from the previous moment.

[0058] It is understandable that after a topological change, the current state of the power grid is not yet stable. Directly using the changed state to calculate the Jacobian matrix would lead to insufficient matrix accuracy. Locking the system state estimate from the previous moment can provide stable and reliable basic data for subsequent recalculation of the dynamic Jacobian matrix, ensuring the accuracy of the matrix.

[0059] Optionally, the system is configured with a timed data acquisition task, setting the acquisition period (e.g., 10 milliseconds / time). Communication is established with the control units of the power grid switching stations and circuit breakers via an industrial Ethernet interface. During each acquisition, discrete status bit data from each device is read and stored in a local cache, while simultaneously recording the acquisition timestamp. The currently acquired discrete status bit data is compared bit-by-bit with the data stored in the previous period to determine if there is a status change. If a status change is detected, further analysis is conducted to determine whether the change will lead to a change in the power grid topology (e.g., line connectivity, node relationships). If so, it is determined to be a topology abrupt change. The system state estimate value from the previous moment is immediately extracted from the local cache, marked as locked, and subsequent calculations are prohibited from modifying this value.

[0060] S202. Based on the estimated switching state and system state after the mutation, the dynamic Jacobian matrix is ​​recalculated, and the null projection deviation between the dynamic Jacobian matrix and the Jacobian matrix before the mutation is calculated.

[0061] Specifically, the system acquires the switching state after the abrupt change. This state is the final state determined after a brief period of stabilization, ensuring that the matrix constructed based on this state accurately reflects the grid topology after the abrupt change. Next, based on the locked system state estimate from the previous moment, and combined with the grid topology corresponding to the switching state after the abrupt change, the system calls a preset Jacobian matrix calculation algorithm to recalculate the dynamic Jacobian matrix. Subsequently, the system calculates the null-space projection deviation between the dynamic Jacobian matrix and the Jacobian matrix before the abrupt change. The null-space projection deviation accurately reflects the difference in the physical constraint representation capabilities of the two matrices. The larger the deviation, the more significant the impact of the topology abrupt change on the physical constraint relationships of the grid. If the original watermark generation logic is continued to be used in this case, the watermark signal may violate the new physical constraints.

[0062] It can be understood that after a topological mutation, the physical constraints of the power grid, such as node associations and line parameters, change. The original Jacobian matrix before the mutation can no longer accurately represent the physical consistency constraint space of the current power grid, and a dynamic Jacobian matrix adapted to the new topology must be obtained by recalculation.

[0063] S203. If the zero-space projection deviation exceeds the preset threshold, the superposition of the watermark injection signal will be paused in the current two consecutive sampling periods until the zero-space projection deviation does not exceed the preset threshold.

[0064] The preset threshold refers to the critical value set in advance by the system to determine whether the zero-space projection deviation is within an acceptable range. This threshold is determined based on the power grid operation stability requirements and the watermark signal adaptation capability. The current two consecutive sampling cycles refer to the two consecutive data acquisition cycles that follow the moment when the deviation exceeds the threshold (consistent with the acquisition cycle in S201).

[0065] Specifically, the system compares the null projection deviation calculated in S202 with a preset threshold. When the null projection deviation exceeds the preset threshold, it is determined that the difference between the dynamic Jacobian matrix and the Jacobian matrix before the mutation is too large. In this case, the watermark injection signal generated based on the dynamic Jacobian matrix may not be fully adapted to the new power grid physical constraints. If it is forcibly superimposed, the watermarked data may be misjudged as bad data or affect the accuracy of power grid status monitoring. Therefore, the system triggers a pause mechanism to stop the superposition operation of the watermark injection signal within the current two consecutive sampling periods.

[0066] Setting a pause time of two consecutive sampling cycles is to allow sufficient time for the power grid topology to stabilize, while also allowing the system time to re-monitor and calculate the null projection deviation. During the pause, the system continuously monitors the change in the null projection deviation. When the deviation drops below a preset threshold, it is determined that the dynamic Jacobian matrix can stably represent the physical constraints of the current power grid, and the superposition operation of the watermark injection signal is resumed. If the deviation still does not meet the standard after two sampling cycles, the pause continues until the deviation meets the requirements.

[0067] It should be noted that if the receiver detects a change in the remote signaling of the switch state while continuously detecting a correlation coefficient below the threshold but a normal state estimation residual, it will determine that the watermark injection has been suspended due to a topological change and will not trigger an attack alarm.

[0068] S204. Calculate the product of the Jacobian matrix and the virtual state perturbation vector to generate a pseudo-measurement increment located in the feasible domain of the physical state.

[0069] Among them, the pseudo-measurement increment refers to the incremental data obtained by multiplying the Jacobian matrix and the virtual state disturbance vector, which is used as the basis for the watermark injection signal; the physical state feasible region refers to the range of values ​​in which electrical measurements can exist stably under the current operating state of the power grid, which is determined by the physical laws of the power grid and operating constraints.

[0070] Specifically, the system obtains the currently used Jacobian matrix (under normal operating conditions, the pre-constructed Jacobian matrix is ​​used directly; after a topological change and when the deviation meets the standard, a dynamic Jacobian matrix is ​​used). The space spanned by the column vectors of this matrix can accurately represent the physical consistency constraint space of the power grid measurement data. Next, the system retrieves the previously generated virtual state disturbance vector, which matches the dimension of the power grid system state variables and can reflect the core identification information of the watermark.

[0071] Then, the system performs matrix multiplication, multiplying the Jacobian matrix with the virtual state disturbance vector. Since the Jacobian matrix represents the physical constraints of the power grid, this multiplication operation is equivalent to mapping the disturbance at the virtual state level to the measurement signal space. This ensures that the generated pseudo-measurement increment strictly follows the physical laws of the power grid (such as Kirchhoff's laws) and naturally falls within the feasible region of the physical state. As the basis for the watermark injection signal, the pseudo-measurement increment's conformity to physical constraints ensures that when subsequently superimposed on the real-time electrical measurement value, it will not produce significant residuals due to violations of physical laws, thus guaranteeing the concealment and legitimacy of the watermark signal.

[0072] Optionally, the system imports the Jacobian matrix and the virtual state disturbance vector into the matrix operation module, ensuring that their dimensions meet the requirements of multiplication (the number of columns in the Jacobian matrix is ​​consistent with the number of rows in the virtual state disturbance vector); it calls the matrix multiplication algorithm to perform the operation row by row and column by column, calculating the product of the Jacobian matrix and the virtual state disturbance vector; it performs a preliminary verification of the product result to determine whether its value is within the approximate range of the feasible domain of the power grid physical state (e.g., voltage increment within ±0.05kV); if the verification passes, the product result is identified as the pseudo-measurement increment; if it fails, the generation process of the Jacobian matrix or the virtual state disturbance vector is checked, and the error is eliminated before recalculation.

[0073] S205. Obtain the safe operating boundary parameters under the current operating state of the power grid, and calculate the difference between the collected real-time electrical measurement values ​​and the safe operating boundary parameters to obtain the real-time safety margin of each measurement point.

[0074] Among them, the safe operation boundary parameters refer to the parameters that limit the allowable fluctuation range of electrical measurement values ​​of the power grid, including the upper limit of voltage, the lower limit of voltage, the upper limit of current, the upper limit of power, etc., which are determined by the power grid design standards and operating procedures.

[0075] The system acquires the safe operating boundary parameters under the current operating status of the power grid. These parameters are not fixed, but are dynamically updated according to the operating conditions of the power grid (such as load changes, seasonal adjustments, etc.). The system can obtain the latest boundary parameters in real time by communicating with the parameter management system of the power grid dispatch center to ensure the accuracy of the parameters.

[0076] Next, the system collects real-time electrical measurement values ​​from each measurement point. These values ​​come from the power grid measurement terminal and are preprocessed (e.g., filtering, noise reduction) to ensure data reliability. Then, for each measurement point, the system calculates the difference between the real-time electrical measurement value and the corresponding safe operating boundary parameter: for upper limit parameters (e.g., upper voltage limit), the difference is the upper limit parameter minus the real-time measurement value; for lower limit parameters (e.g., lower voltage limit), the difference is the real-time measurement value minus the lower limit parameter. This difference is the real-time safety margin for each measurement point. The larger the real-time safety margin, the farther the electrical value at that measurement point is from the safety boundary, and the larger the amplitude of the superimposed watermark injection signal; conversely, the smaller the real-time safety margin, the smaller the superimposed amplitude. This is achieved by calculating the real-time safety margin.

[0077] S206. If the amplitude of the real-time electrical measurement value superimposed with the pseudo-measurement increment is within the allowable fluctuation range, then the pseudo-measurement increment is scaled proportionally as a whole based on the real-time safety margin, and the scaled pseudo-measurement increment is determined as the watermark injection signal.

[0078] Specifically, the system adds the real-time electrical measurement values ​​of each measurement point to the corresponding pseudo-measurement increment amplitude, and determines whether the superimposed amplitude exceeds the allowable fluctuation range limited by the safety operation boundary parameters. When the prediction result is that it exceeds the limit, it indicates that the amplitude of the current pseudo-measurement increment is too large. Direct superposition would lead to the grid operation parameters exceeding the limit, triggering false alarms or operational risks. At this time, the system performs overall proportional amplitude scaling on the pseudo-measurement increment based on the real-time safety margin of each measurement point, selecting the minimum value among all real-time safety margins as the scaling basis. This ensures that the amplitude of the scaled pseudo-measurement increment, after being superimposed with the real-time electrical measurement value of any measurement point, will not exceed the allowable fluctuation range. By adopting an overall proportional scaling method, the vector characteristics of the pseudo-measurement increment remain unchanged, that is, the core identification information of the watermark is not destroyed; only the amplitude is adjusted to the safe range. Finally, the scaled pseudo-measurement increment is determined as the watermark injection signal, which satisfies both the safety operation requirements and ensures the traceability of the watermark.

[0079] Optionally, for each measurement point, the system calculates the superposition of the real-time electrical measurement value and the pseudo-measurement increment (adding if the pseudo-measurement increment is positive, subtracting if negative); compares the superposition value of each measurement point with the corresponding allowable fluctuation range (safe operation boundary parameter) to determine if there is an out-of-range situation; if there is an out-of-range situation, collects the real-time safety margin of all measurement points, determines the minimum value as the maximum allowable scaling reference; calculates the scaling ratio: scaling ratio = maximum allowable scaling reference ÷ the out-of-range value (the part exceeding the allowable range) after the current pseudo-measurement increment and the real-time measurement value are superimposed; multiplies all elements of the pseudo-measurement increment by the scaling ratio to obtain the scaled pseudo-measurement increment, which is determined as the watermark injection signal.

[0080] S207. If the amplitude of the real-time electrical measurement value superimposed with the pseudo-measurement increment is not within the allowable fluctuation range, then the pseudo-measurement increment shall be directly determined as the watermark injection signal.

[0081] Specifically, following the same predictive logic as S206, the system calculates the superimposed amplitude of the real-time electrical measurement values ​​and pseudo-measurement increments at each measurement point, and compares it with the allowable fluctuation range (safe operation boundary parameters). When the superimposed amplitude of all measurement points is within the allowable fluctuation range, it indicates that the current pseudo-measurement increment amplitude is appropriate, will not cause the power grid electrical parameters to exceed limits, and will not affect the safe and stable operation of the power grid. At this time, the system does not need to make any adjustments to the pseudo-measurement increment and directly identifies it as a watermark injection signal. This is because the pseudo-measurement increment has been mapped by the Jacobian matrix, satisfies the physical constraints of the power grid, and the amplitude is within the safety margin. The superimposed data can carry implicit fingerprint information and successfully pass the power grid state estimation verification, and will not be misjudged as bad data, while ensuring the normal operation of power grid monitoring services.

[0082] S208. Perform sliding window variance analysis on the collected real-time electrical measurement values, calculate the environmental measurement noise floor intensity under the current time window, and substitute the environmental measurement noise floor intensity into the preset data statistical distribution model to calculate the noise floor masking threshold.

[0083] Specifically, the system acquires parameters for determining the sliding window, including the window length and sliding step size. The window length needs to be set according to the sampling frequency and noise fluctuation period of the power grid measurement data to ensure accurate capture of the statistical characteristics of noise. The sliding step size determines the real-time performance and efficiency of the analysis. Next, the system performs sliding window variance analysis on the collected real-time electrical measurement values. By calculating the variance of the data within each window, signal fluctuations caused by changes in the normal operating state of the power grid are eliminated, retaining only the random environmental noise fluctuation characteristics, and thus calculating the environmental measurement noise floor intensity under the current time window. Subsequently, the system substitutes the calculated environmental measurement noise floor intensity into a preset data statistical distribution model. This model has been calibrated with a large amount of experimental data and can output corresponding noise floor masking thresholds according to different noise intensities—the higher the noise intensity, the higher the noise floor masking threshold, and the greater the allowable energy spectral density of the watermark signal; conversely, the lower the threshold, the more strictly the watermark energy needs to be controlled. The final noise floor masking threshold is then obtained.

[0084] Optionally, the system configures sliding window parameters, setting the window length to 100 sampling points and the sliding step size to 50 sampling points, adapting to the measurement data with a power grid sampling frequency of 50Hz; it extracts the measurement values ​​within the current time window from the real-time electrical measurement data stream, uses the moving average method to remove the trend term (changes in the normal state of the power grid) from the data, and retains the fluctuation term; it calculates the variance of the fluctuation term, multiplies the variance value by a preset coefficient (calibrated according to the accuracy of the measurement equipment), and obtains the environmental measurement noise floor intensity; it retrieves the locally stored data statistical distribution model (built based on psychoacoustic principles), inputs the noise floor intensity into the model; the model outputs the current noise floor masking threshold by looking up a preset threshold mapping table and performing linear interpolation calculation.

[0085] It should be noted that the above data statistical distribution model is a probabilistic statistical model constructed based on the random error characteristics of power grid measurement data. During the acquisition of electrical quantities, power grid measurement terminals are affected by electromagnetic interference and device thermal noise, resulting in background noise in the acquired data typically exhibiting Gaussian white noise (or a normal distribution). The model's purpose is to characterize the statistical regularity of data fluctuations within the current time window, specifically by calculating the statistical parameters (such as standard deviation) of the current environmental measurement noise floor intensity to construct a noise probability density function under the current operating conditions. Based on this probability density function, the model uses the principle of statistical confidence intervals (e.g., selecting 3 times the standard deviation as the confidence boundary) to calculate a masking threshold (i.e., a statistical concealment threshold). This threshold physically represents the statistical boundary by which the system distinguishes between "normal random noise" and "abnormal signals." As long as the energy spectral density of the watermark injection signal is controlled below the threshold calculated by this model, from a statistical analysis perspective, the watermark signal will be confused with the original environmental noise, making it mathematically impossible to distinguish between inherent random noise and artificially injected signals. This achieves the "noise-hidden" and statistically invisible nature of the watermark signal.

[0086] S209. Modulate the watermark injection signal so that the energy spectral density of the watermark injection signal is lower than the noise substrate masking threshold.

[0087] The system obtains the noise substrate masking threshold and the environmental noise substrate intensity obtained from S208, and determines the core constraints that the watermark injection signal needs to meet: the energy spectral density is lower than the noise substrate masking threshold throughout the process, and the signal-to-noise ratio with the noise substrate intensity remains constant (the preset signal-to-noise ratio is usually between -10dB and -5dB, taking into account both concealment and extractability).

[0088] Next, the system performs spectral analysis on the watermark injection signal to obtain its current energy spectral density distribution and determine whether there are frequency components exceeding the noise floor masking threshold. If so, the frequency component is attenuated using amplitude scaling, while other frequency components are adjusted synchronously to ensure that the overall signal spectrum shape remains unchanged (preserving the watermark identification information), with only the overall energy level decreasing. During modulation, the system calculates the signal-to-noise ratio (SNR) between the watermark signal and the noise floor intensity in real time and dynamically corrects the watermark amplitude through a feedback adjustment mechanism—if the SNR is too high, the watermark energy is appropriately reduced; if the SNR is too low, the watermark energy is increased without exceeding the noise floor masking threshold, ultimately ensuring that the modulated watermark signal meets both concealment requirements and can be accurately extracted during subsequent tracing.

[0089] Optionally, the system can perform a discrete Fourier transform on the watermark injection signal to obtain the energy spectral density at each frequency point; compare the energy spectral density at each frequency point with the noise floor masking threshold, and mark the frequency points that exceed the threshold; calculate the maximum proportion exceeding the threshold, and attenuate the energy spectral density of all frequency points proportionally according to this proportion to ensure that all frequency points are below the threshold after attenuation; calculate the signal-to-noise ratio (SNR) of the modulated watermark signal and the intensity of the environmental measurement noise floor, and if it deviates from the preset value (e.g., -8dB), fine-tune the overall amplitude of the signal until the SNR stabilizes at the preset value; and perform an inverse Fourier transform on the modulated spectrum to restore the watermark injection signal in the time domain.

[0090] Optionally, the system can also employ an adaptive filtering algorithm to decompose the watermark injection signal into multiple sub-band signals (corresponding to different frequency ranges); for each sub-band signal, allocate the corresponding maximum allowable energy according to the noise floor masking threshold, with higher sub-band noise intensity resulting in a larger allowable energy allocation; adjust the amplitude of each sub-band signal to ensure its energy does not exceed the allocated allowable value, while maintaining the amplitude ratio of each sub-band signal unchanged (preserving watermark characteristics); monitor the overall signal-to-noise ratio in real time, dynamically correct the amplitude of each sub-band signal using a PID control algorithm to ensure a constant signal-to-noise ratio; and reconstruct each sub-band signal into a complete watermark injection signal to complete modulation.

[0091] S210. Based on the preset time window step size, generate multiple sets of candidate pseudo-random sequences before and after the current synchronization time reference at the receiving end, and construct the candidate state perturbation vector corresponding to each set of candidate pseudo-random sequences.

[0092] Specifically, the system obtains the preset time window step size and time coverage range. The step size is usually set according to the network transmission latency characteristics (e.g., 1 millisecond / step), and the coverage range needs to include the time deviations that are likely to occur (e.g., before and after 50 milliseconds) to ensure that no real synchronization time points are missed.

[0093] Next, the receiving end uses its current synchronization time reference as the center and generates multiple sets of candidate pseudo-random sequences before and after the reference according to a preset step size. For example, if the reference time is t0, the step size is 1 millisecond, and it covers 50 milliseconds before and after the reference, then 101 sets of candidate sequences are generated: t0-50ms, t0-49ms, ..., t0, ..., t0+49ms, and t0+50ms. The generation algorithm for each set of candidate pseudo-random sequences is the same as that of the power grid measurement terminal (the same chaotic mapping model), only the input time reference is different.

[0094] Subsequently, following the same transformation logic as S101, the system transforms each set of candidate pseudo-random sequences into candidate state perturbation vectors that match the dimensions of the power grid system's state variables, ensuring that the structure and dimensions of the candidate vectors are completely consistent with the virtual state perturbation vectors used when embedding watermarks. The generated sets of candidate state perturbation vectors will be used for subsequent cross-correlation calculations with the system state estimation results to locate the true time synchronization point.

[0095] S211. Calculate the cross-correlation coefficient between the system state estimation results and the disturbance vectors of each group of candidate states.

[0096] Specifically, the system converts the system state estimation result obtained from the receiver into a vector form with the same dimension as the candidate state perturbation vector, ensuring that the two can be cross-correlated. If the system state estimation result is a multi-dimensional matrix, the state dimension related to the watermark perturbation is extracted to form a separate vector.

[0097] Next, the system traverses all candidate state perturbation vectors in the candidate vector cache pool and performs cross-correlation calculations with the system state estimation result vector one by one. During the calculation, the two vectors are first centered (subtracting their respective means) to eliminate the influence of DC components on the correlation. Then, the cross-correlation coefficient of each group is obtained by calculating the ratio of the product of covariance and standard deviation.

[0098] It is understandable that the candidate vector corresponding to the real watermark (i.e., the vector whose input time base is consistent with the measurement terminal) will be highly correlated with the watermark perturbation component in the system state estimation result, thus exhibiting a cross-correlation coefficient that is significantly higher than that of other candidate vectors.

[0099] Optionally, the system can extract the state variable vector (e.g., 20-dimensional) from the system state estimation results and use it as the target vector for cross-correlation calculation; center the target vector and each group of candidate state perturbation vectors respectively, i.e., subtract the mean of the vector from each element; calculate the covariance of the centered target vector and candidate vectors, and then calculate the standard deviation of the two vectors respectively. Divide the covariance by the product of the two standard deviations to obtain the cross-correlation coefficient; perform validity verification on the calculated cross-correlation coefficient. If the absolute value of the coefficient is greater than 0.8, it is marked as high correlation, and if it is less than 0.2, it is marked as low correlation; sort the cross-correlation coefficients of all candidate vectors according to the corresponding candidate time points, generate a "time point-correlation coefficient" lookup table and store it.

[0100] S212. Determine the current time synchronization deviation based on the maximum cross-correlation coefficient, and calibrate the timing parameters of the chaotic mapping model based on the time synchronization deviation.

[0101] Specifically, the system searches for the maximum cross-correlation coefficient in the "Time Point-Correlation Coefficient" lookup table, determining the candidate vector corresponding to this maximum value and its associated candidate time point. Since this candidate vector has the strongest correlation with the system state estimation result, its corresponding candidate time point is the closest to the true time reference when the power grid measurement terminal embeds the watermark. Next, the system calculates the difference between the current receiver's synchronization time reference and this candidate time point; this difference is the current time synchronization deviation. For example, if the receiver's reference is t0, and the candidate time point corresponding to the maximum correlation coefficient is t0+15ms, then the time synchronization deviation is +15ms, indicating that the receiver's reference lags by 15ms. Subsequently, the system calibrates the timing parameters of the chaotic mapping model based on the time synchronization deviation: if the deviation is +15ms, the model's input time reference is offset by +15ms to ensure that the subsequently generated standard reference sequence (used for traceability verification) is completely synchronized in the time dimension with the sequence when the measurement terminal embeds the watermark. The calibrated chaotic mapping model will be able to generate a reference sequence consistent with the original watermark sequence.

[0102] S213. Obtain the decoupled virtual state perturbation vector and the locally generated standard reference sequence respectively, and calculate the correlation coefficient between the virtual state perturbation vector and the standard reference sequence.

[0103] Specifically, the system obtains the separated virtual state disturbance vector from the decoupling module, ensuring that the vector has removed the real power grid state components and only retains the watermark-related disturbance components. At the same time, it verifies the consistency of the vector dimension, format and standard reference sequence—if inconsistent, it performs format conversion or re-decoupling.

[0104] Next, the system calls the calibrated chaotic mapping model, inputs the initial parameters consistent with the measurement terminal and the calibrated time base, and generates a standard reference sequence. This sequence is the "standard answer" for the watermark, and only legally embedded watermark vectors can be highly correlated with it.

[0105] Subsequently, the system employs the same cross-correlation coefficient calculation method as S211 to calculate the correlation coefficient between the decoupling vector and the standard reference sequence. During the calculation, noise interference in the vector must be eliminated (e.g., through low-pass filtering) to ensure that the correlation coefficient accurately reflects the degree of matching between the two. If the decoupling vector is a legitimate watermark, the correlation coefficient will be significantly higher than the preset authentication threshold; if the data has been tampered with or attacked, the correlation between the decoupling vector and the standard reference sequence will be extremely low, with the correlation coefficient below the threshold. The final correlation coefficient, together with the subsequently estimated residual index, constitutes the dual basis for source tracing determination.

[0106] Optionally, the system can receive virtual state disturbance vectors from the decoupling module, perform noise filtering on the vectors (using the Kalman filter algorithm) to remove interference noise introduced during the decoupling process; call the calibrated Lorenz chaotic mapping model, input preset initial values, control parameters, and calibrated time base, and generate a standard reference sequence; normalize the decoupling vectors and the standard reference sequence respectively to ensure that their amplitudes are on the same order of magnitude; calculate the Pearson correlation coefficient between the two vectors, specifically by calculating the covariance divided by the product of the standard deviations of the two vectors; retain the calculated correlation coefficient to three decimal places, perform a preliminary comparison with the preset authentication threshold (e.g., 0.85), and record the comparison results.

[0107] S214. If the correlation coefficient is greater than the preset authentication threshold, and the estimated residual of the actual physical state of the power grid after watermark removal is within the preset normal range, then the tracing is deemed successful.

[0108] Specifically, the system compares the correlation coefficient calculated by S213 with the preset authentication threshold. The preset authentication threshold is usually set between 0.8 and 0.9. If the correlation coefficient is greater than this threshold, it indicates that the decoupled virtual state perturbation vector is highly correlated with the standard reference sequence, the watermark source is legitimate, and the data has not been replaced or tampered with.

[0109] Next, the estimated residual of the true physical state of the power grid after watermark removal is calculated—that is, the norm of the difference between the true physical state vector and the vector of the measurement data stream after state estimation. This residual reflects the degree of fit between the measurement data and the actual operating state of the power grid. If the estimated residual is within a preset normal range (e.g., the residual norm is less than 0.05), it indicates that the measurement data has not been subjected to a fake data injection attack and can truly reflect the operating state of the power grid.

[0110] The system determines that the source tracing is successful only when both verifications pass: confirming the legality of the data source (watermark matching) and the authenticity of the data (normal status). This dual verification mechanism can effectively distinguish between different scenarios such as "legitimate watermark + normal data", "legitimate watermark + attacked data", and "illegal watermark + any data", thereby improving the credibility of the source tracing results.

[0111] S215. If the correlation coefficient is less than or equal to the authentication threshold, or the estimated residual after removing the watermark exceeds the normal range, an attack or data anomaly is determined, the result is discarded and an alarm is triggered.

[0112] Specifically, the system determines whether either of the following conditions is met: "correlation coefficient is less than or equal to the authentication threshold" or "estimated residual exceeds the normal range." If the correlation coefficient is less than or equal to the authentication threshold, possible reasons include watermark tampering, illegal data source (uploaded from an unauthorized measurement terminal), or watermark decoupling failure, essentially indicating an untrustworthy data source. If the estimated residual exceeds the normal range, possible reasons include measurement data being subjected to a fake data injection attack (attackers tamper with data to mislead power grid dispatch), or measurement equipment malfunction causing data distortion, essentially indicating inaccurate data content. Regardless of which condition is met, the system determines that an attack or data anomaly has occurred—regardless of whether it is a specific attack or a non-malicious anomaly; the core issue is that the data no longer possesses credibility and usability.

[0113] Subsequently, the system performs two key operations: First, it discards the current power grid physical state estimation results, prohibiting this data from entering core business processes such as power grid dispatching and monitoring to avoid decision-making errors due to erroneous data; second, it triggers an alarm mechanism. The alarm information must include key information such as the anomaly type (watermark mismatch / residual exceeding the standard), correlation coefficient, estimated residual, data acquisition time, and measurement terminal identifier, and notifies maintenance personnel and the monitoring center through various means such as SMS, platform pop-ups, and audible and visual alarms. Simultaneously, the system records anomaly logs, including a complete event timeline and data snapshots, providing a basis for subsequent problem investigation and tracing.

[0114] The digital watermark embedding and traceability system of this invention is applied to electronic devices. Figure 3 A schematic diagram of the architecture of an electronic device suitable for implementing embodiments of the present invention is shown.

[0115] It should be noted that, Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0116] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by instructions (computer programs), or by instructions (computer programs) controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor. The electronic device of this embodiment includes a storage medium and a processor, wherein the storage medium stores multiple instructions that can be loaded by the processor to execute any step of the method provided in the embodiments of the present invention.

[0117] Specifically, the storage medium and the processor are electrically connected directly or indirectly to enable data transmission or interaction. For example, these components can be electrically connected to each other via one or more signal lines. The storage medium stores computer-executable instructions that implement data access control methods, including at least one software functional module that can be stored in the storage medium in the form of software or firmware. The processor executes various functional applications and data processing by running the software program and module stored in the storage medium. The storage medium can be, but is not limited to, Random Access Memory (RAM), Read-Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), Electrically Erasable Programmable Read-Only Memory (EEPROM), etc. The storage medium stores the program, and the processor executes the program after receiving the execution instructions.

[0118] Furthermore, the software programs and modules within the aforementioned storage medium may also include an operating system, which may include various software components and / or drivers for managing system tasks (e.g., memory management, storage device control, power management, etc.) and can communicate with various hardware or software components to provide an operating environment for other software components. The processor may be an integrated circuit chip with signal processing capabilities. The aforementioned processor may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc., which can implement or execute the methods, steps, and logic flowcharts disclosed in this embodiment. The general-purpose processor may be a microprocessor or any conventional processor.

[0119] Since the instructions stored in the storage medium can execute the steps in any of the methods provided in the embodiments of the present invention, the beneficial effects of any of the methods provided in the embodiments of the present invention can be achieved, as detailed in the preceding embodiments, and will not be repeated here.

[0120] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for anti-attack digital watermarking embedding and tracing of time-series data, applied to a digital watermarking embedding and tracing system, the system comprising a power grid measurement terminal and a receiving end, characterized in that, The method includes: The pseudo-random sequence corresponding to the synchronization time reference of the power grid measurement terminal is transformed into a virtual state disturbance vector that matches the dimension of the power grid system state variables. The pseudo-random sequence is obtained by inputting the synchronization time reference into a preset chaotic mapping model. A topology parameter matrix is ​​constructed based on the physical connection relationship of the power grid lines, and the virtual state disturbance vector is mapped to the measurement signal space through the topology parameter matrix to obtain a watermark injection signal that satisfies the physical constraints. The watermark injection signal corresponding to each of the power grid measurement terminals is collaboratively superimposed onto the collected real-time electrical measurement values, and a measurement data stream containing the hidden fingerprint is output. Based on the topology parameter matrix, the virtual state disturbance vector is decoupled and separated from the system state estimation result of the measurement data stream to obtain the watermark-free true physical state of the power grid.

2. The method according to claim 1, characterized in that, The step of constructing a topology parameter matrix based on the physical connection relationship of the power grid lines, and mapping the virtual state disturbance vector to the measurement signal space through the topology parameter matrix to obtain a watermark injection signal that satisfies the physical constraints, specifically includes: The Jacobian matrix under the current power grid operating state is constructed as the topology parameter matrix, and the space spanned by the column vectors of the Jacobian matrix represents the physical consistency constraint space of the power grid measurement data. Calculate the product of the Jacobian matrix and the virtual state perturbation vector to generate a pseudo-measurement increment located within the feasible region of the physical state; The pseudo-measurement increment is directly determined as the watermark injection signal.

3. The method according to claim 2, characterized in that, The step of directly determining the pseudo-measurement increment as the watermark injection signal specifically includes: Obtain the safe operating boundary parameters under the current operating state of the power grid, wherein the safe operating boundary parameters limit the allowable fluctuation range of electrical measurement values; The difference between the collected real-time electrical measurement values ​​and the safety operation boundary parameters is calculated to obtain the real-time safety margin of each measurement point; Determine whether the amplitude of the real-time electrical measurement value plus the pseudo-measurement increment is within the allowable fluctuation range; If not, the pseudo-measurement increment is scaled proportionally based on the real-time safety margin, and the scaled pseudo-measurement increment is determined as the watermark injection signal. If so, the pseudo-measurement increment is directly determined as the watermark injection signal.

4. The method according to claim 2, characterized in that, The step of constructing the Jacobian matrix under the current power grid operating state as the topology parameter matrix specifically includes: Real-time monitoring of discrete state states of power grid switching stations and circuit breakers; when a sudden change in topology is detected, the system state estimate from the previous moment is locked. The dynamic Jacobian matrix is ​​recalculated based on the switch state after the mutation and the estimated system state. Calculate the null projection deviation between the dynamic Jacobian matrix and the Jacobian matrix before the mutation; If the null projection deviation exceeds a preset threshold, the superposition of the watermark injection signal will be paused for the current two consecutive sampling periods until the null projection deviation does not exceed the preset threshold.

5. The method according to claim 1, characterized in that, Before the step of collaboratively superimposing the watermark injection signal corresponding to each of the power grid measurement terminals onto the acquired real-time electrical measurement values ​​and outputting a measurement data stream containing a hidden fingerprint, the method further includes: A sliding window variance analysis was performed on the collected real-time electrical measurements to calculate the ambient noise floor intensity under the current time window. Substitute the environmental measurement noise floor intensity into a preset data statistical distribution model to calculate the noise floor masking threshold. The watermark injection signal is modulated such that the energy spectral density of the watermark injection signal is lower than the noise substrate masking threshold, and the signal-to-noise ratio of the watermark injection signal to the intensity of the environmental measurement noise substrate remains constant during the modulation process.

6. The method according to claim 1, characterized in that, After the step of decoupling and separating the virtual state disturbance vector from the system state estimation result of the measurement data stream based on the topology parameter matrix to obtain the watermark-free true physical state of the power grid, the method further includes: The decoupled virtual state perturbation vector and the locally generated standard reference sequence are obtained respectively; Calculate the correlation coefficient between the virtual state perturbation vector and the standard reference sequence; If the correlation coefficient is greater than the preset authentication threshold, and the estimated residual of the actual physical state of the power grid after watermark removal is within the preset normal range, then the tracing is determined to be successful. If the correlation coefficient is less than or equal to the authentication threshold, or the estimated residual after removing the watermark exceeds the normal range, an attack or data anomaly is determined, the result is discarded, and an alarm is triggered.

7. The method according to claim 1, characterized in that, Before the step of decoupling and separating the virtual state disturbance vector from the system state estimation result of the measurement data stream based on the topology parameter matrix to obtain the watermark-free true physical state of the power grid, the method further includes: Based on a preset time window step, multiple sets of candidate pseudo-random sequences are generated before and after the current synchronization time reference at the receiving end; Construct candidate state perturbation vectors corresponding to the candidate pseudo-random sequences in each group; Calculate the cross-correlation coefficient between the system state estimation results and the candidate state perturbation vectors of each group; The current time synchronization deviation is determined based on the maximum cross-correlation coefficient, and the timing parameters of the chaotic mapping model are calibrated based on the time synchronization deviation.

8. A digital watermark embedding and traceability system, characterized in that, The system includes: one or more processors and memory; The memory is coupled to the one or more processors, the memory being used to store computer program code, the computer program code including computer instructions, the one or more processors invoking the computer instructions to cause the system to perform the method as described in any one of claims 1-7.

9. A computer-readable storage medium comprising instructions, characterized in that, When the instructions are run on the digital watermark embedding and traceability system, the system performs the method as described in any one of claims 1-7.

10. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is run on the digital watermark embedding and traceability system, the system performs the method as described in any one of claims 1-7.

Images