A power system network risk defense method based on markov rule reasoning

Abstract

The application provides a power system network risk defense method based on Markov rule reasoning, and realizes dynamic identification and defense of power system network risk. First, a fuzzy reasoning model for multi-source power system operation data is established, a rule capable of reflecting differences in distribution of different data characteristics is constructed in combination with triangular, trapezoidal and Gaussian membership functions, and accurate description of input state is realized; second, a rule updating mechanism based on Markov decision process is designed, state reasoning, action selection and score evaluation are performed, it is ensured that the rule can continuously adjust with the change of system state, and dynamic optimization of the number and parameters of the rule is realized; finally, a decision method for generating risk levels and defense strategies is constructed in combination with comprehensive membership output and loss function feedback, so that the model can maintain accuracy and stability when facing power grid system risk situations, and the reliability of power system network risk defense is improved.

Description

Technical Field

[0001] This invention designs a power system network risk defense method based on Markov rule reasoning, realizing the risk level assessment of the power system network's operating state and the selection of defense strategies based on the Markov decision mechanism. Since the Markov defense mechanism can reason according to the system state transition law and make optimal or near-optimal defense decisions based on the current state, it can effectively cope with continuously changing risk situations in the power system network, playing a crucial role in improving the scientific nature, real-time performance, and rationality of defense strategies. Therefore, constructing a risk defense system with Markov decision-making capabilities is of great significance for improving the security protection capability of the power system network in dynamic operating environments and ensuring the continuous and stable operation of the power grid. Background Technology

[0002] With the expansion of power system networks and the increasing complexity of their operating environments, power system networks exhibit characteristics such as diverse data types, frequent changes, and constantly evolving attack patterns. Risk assessment methods based on fixed rules or static thresholds are ill-suited to dynamic data environments. Once the system's operating state deviates, the rule base often fails to update in a timely manner, leading to delayed risk identification, high false positive rates, and a lack of responsiveness to unknown attacks. Against this backdrop, Markov Decision Processes (MDPs), capable of describing state transitions over time and providing decision strategies based on the current state, offer advantages such as adaptability to dynamic environments and continuous iterative optimization. Therefore, introducing Markov mechanisms into power system network risk analysis helps overcome the shortcomings of traditional methods that cannot automatically adjust strategies to environmental changes, and is of great significance for improving the security assessment capabilities of power system networks in dynamic scenarios.

[0003] This invention designs a power system network risk defense method based on Markov rule reasoning. It mainly utilizes multiple membership functions to construct fuzzy representations of input features and combines Markov decision processes to dynamically add rules to the rule base and optimize parameters, thereby achieving real-time assessment of power system network risks. Summary of the Invention

[0004] This invention designs a power system network risk defense method based on Markov rule reasoning. This method addresses multi-source variables such as voltage and frequency, designs a unified fuzzy input modeling approach, and establishes three types of membership functions—triangular, trapezoidal, and Gaussian—based on the statistical characteristics of the input samples to accurately describe the activation degree of each feature under different rules. It introduces a Markov rule reasoning framework, constructing system states, action sets, and rule output score functions, summarizing decision principles for rule selection, rule addition, and parameter adjustment, and achieving continuous updates to the rule structure and parameters. Finally, a risk level determination mechanism based on comprehensive membership degree and loss function is designed, which can output four categories of results: low risk, medium risk, high risk, and severe risk. Through continuous updates to the rule base and dynamic generation of risk levels, continuous monitoring of power system network operation risks and real-time support for defense strategies are achieved.

[0005] The present invention adopts the following technical solution and implementation steps:

[0006] A power system network risk defense method based on Markov rule reasoning includes the following steps:

[0007] (1) Determine the input variables required for power system network defense and the output variables for evaluating the defense results: In view of the fact that traditional rule bases cannot effectively defend against attackers forging and injecting false samples, six variables are determined as relevant variables for power system network risk defense, including voltage, frequency, power, phase angle of phasor measurement unit (PMU), network traffic characteristics, and communication metadata, with risk as the output variable;

[0008] (2) Design a training set for risk defense in power grid systems: Construct a fuzzy input matrix as: X=[x1,…,x j , …, x n ], x j =[x 1j ,…, x ij , …, x mj ] T Voltage data is a vector x1=[x 11 ,…, x 1n The frequency data is a vector x2=[x 21 ,…, x 2n The power data is a vector x3=[x 31 ,…, x 3n The PMU phase angle data is a vector x4=[x 41 ,…,x 4n The network traffic characteristic data is a vector x5=[x 51 ,…, x 5nThe communication metadata is a vector x6=[x 61 ,..., x 6n Let i = 1, ..., m, j = 1, ..., n, where m and n are the number of relevant variables and the number of samples, respectively, and T denotes matrix transpose; define the original rule base R = {r1, ..., r...} k ,…,r K Let the total number of rules K in the rule base be 10, and the k-th rule be represented as:

[0009]

[0010] Among them, B ki This represents the membership function corresponding to the k-th rule. Membership functions are divided into triangular membership functions, trapezoidal membership functions, and Gaussian membership functions.

[0011] (3) Calculate each input sample vector x j Standard deviation σ j ;

[0012] (4) When σ j <0.15, the membership degree of each element in the input sample vector is determined according to the triangular membership function y. ik (x ij ;a ik ,b ik ,c ik )calculate:

[0013]

[0014] Among them, a ik Indicates the input variable x j The minimum value of the element, initially set to 0, b ik Indicates the input variable x j The mean of the elements, initially set to 0.5, c ik Indicates the input variable x j The maximum value of the element, initially set to 1;

[0015] When 0.15≤σ j When ≤0.25, the membership degrees of each element in the input sample vector follow the trapezoidal membership function y. ik (x ij ;d ik ,e ik ,f ik ,g ik )calculate:

[0016]

[0017] Where, d ik Indicates the input variable x j The minimum value of the element, initially set to 0, e ik This indicates the point of full activation, typically located to the left of the sample mean, with an initial value set to 0.45. ik This indicates the complete activation endpoint, typically located to the right of the sample mean, with an initial value set to 0.55. ik Indicates the input variable x j The maximum value of the element, initially set to 1;

[0018] When σ j When the value is greater than 0.25, the membership degree of each element in the input sample vector follows the Gaussian membership function y. ik (x ij ;μ ik ,σ ik )calculate:

[0019]

[0020] Where, μ ik Let represent the center point of the i-th input under the k-th rule, with an initial value of 0.5, and σ. ik Let represent the standard deviation of the i-th input under the k-th rule, with an initial value of 0.2; after matching the rules, the membership matrix Y=[y1,…, y1] of the rule output is formed according to formulas (2)-(4). k , …, y K ] T y k =[y 1k ,…, y ik , …, y mk ] T Considering the dynamic characteristics of the system over time, at each sampling time t, the comprehensive membership value ϕ of the i-th output is... i (t) is obtained by weighting the outputs of all rules:

[0021]

[0022] Where, ω k y represents the weight of the k-th rule. ik (t) represents the membership degree of the i-th output under the k-th rule at time t;

[0023] The loss function L is used to describe the difference between the actual value and the predicted value, and its mathematical expression is:

[0024]

[0025] N t This indicates the total duration of the system operation. If L < 0.05, the process terminates and the risk level is output. If L > 0.05, the process will proceed to the subsequent update stage of the number of rules and parameters.

[0026] Based on the results of formula (5), the risk levels are further refined: the power system network is divided into four risk levels, namely "low risk", "medium risk", "high risk" and "severe risk", according to the rule membership degree ϕ. i The value of ϕ(t) determines the final risk level, when ϕ i When ϕ(t)≤0.3, the power system network shows no obvious signs of attack, and the system is considered low-risk; when 0.3<ϕ i When ϕ ≤ 0.6, the power system network exhibits a slight anomaly, and the system is classified as medium risk; when 0.6 < ϕ i When ϕ ≤ 0.8, the power system network exhibits high anomalies and is highly likely to be attacked, classifying the system as high-risk; when ϕ i (t) > 0.8, indicating that the power system network has suffered numerous attacks and the system is at serious risk.

[0027] (7)

[0028] (5) Establish a power system network rule update algorithm

[0029] ① The adaptive defense process of the power system network is modeled as a Markov decision process, where the set of states S represents all states of the system, and its representation is as follows:

[0030] (8)

[0031] Where τ represents the τth state of input X, τ corresponds to the number of samples j, and s τ It is a system current state description vector containing 6 feature dimensions, where Q is the total number of states generated by the system, and Q=n. The iteration time step of the rule update process is denoted as h. max h is the preset maximum iteration limit. max The value is 50, when h > h max The process terminates when the rule is updated; the action set A={+1,-1} is the operation that can be taken in a given state, A=+1 means "add rule" operation, and A=-1 means "modify rule parameter" operation;

[0032] In state s τ Next, calculate the scores for the two actions separately:

[0033] (9)

[0034] (10)

[0035] in, A constant vector, The method for calculating the probability of action selection is as follows:

[0036] (11)

[0037] (12)

[0038] The final action is:

[0039] (13)

[0040] When π(+1|s τ )=π(-1|s τ If no action is taken when the time is right, the process will terminate.

[0041] ② Rule addition: After adding rules, the original rule base R={r1,…,r k ,…,r K} becomes , where r K+1 For the addition of rules;

[0042] When performing the "rule addition" action, the standard deviation σ of the input vector is calculated by step (3). j Based on step (4), determine the applicable rule. If the Gaussian rule is applicable, determine the initial parameters μ0 and σ0 of the new rule by calculating the mean and variance of the existing rule parameter set:

[0043] (14)

[0044] (15)

[0045] in, It is the mean of all membership function parameters in the existing rule base, and its mathematical calculation process is as follows:

[0046] (16)

[0047] If the input sample is adapted to a triangular or trapezoidal rule, then the parameter (a) ik ,b ik ,c ik ) or (d ik ,e ik ,f ik ,g ik The same statistical principles are applied, referring to formulas (2) and (3).

[0048] ③ Rule parameter update: When performing the "rule parameter modification" action, before the action is executed, the applicable rule type is first selected according to steps (3) and (4):

[0049] When applying the trigonometric rule, update the parameter set (a) ik ,b ik ,c ik Adjustments are made based on the relative offset between the current input and the vertex position of the triangle.

[0050] (17)

[0051] (18)

[0052] (19)

[0053] Among them, Г a Г b Г c This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0054] When applying the trapezoidal rule, update the parameter set (d) ik ,e ik ,f ik ,g ik Its four boundary points move synchronously toward the input:

[0055] (20)

[0056] Where, p ik ={d ik ,e ik ,f ik ,g ik},Г p This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0057] Gaussian rule center μ ik Update and width σ ik The updated mathematical expression is:

[0058] (twenty one)

[0059] (twenty two)

[0060] Among them, Г μ and Г σ This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0061] By adding rules and adjusting rule parameters, adaptive adjustment of rules is achieved; after the rules are updated, the calculation process of steps (3)-(4) is input, and the membership matrix is ​​denoted as Calculate the comprehensive membership value according to formulas (2)-(5), output the risk level corresponding to the power system network according to formula (6), and calculate the loss function L according to formula (7). If L<0.05, the process terminates; if L>0.05, proceed to step (5). When the iteration number h>h max The process terminates at that time.

[0062] The inventiveness of this invention is reflected in:

[0063] To address the challenge that existing power grid system risk defense methods struggle to effectively respond to novel attacks and anomalies in dynamic environments, this invention establishes an intelligent power system network risk defense model based on Markov rule reasoning. This model utilizes a fuzzy reasoning mechanism incorporating multiple membership functions to accurately characterize complex input states by modeling the differences in the distribution of multi-source operational data features. Furthermore, an adaptive rule update algorithm based on Markov Decision Process (MDP) is designed, leveraging a closed-loop feedback loop of state-action-evaluation to dynamically optimize rule parameters and scale, effectively overcoming the bottleneck of fixed models' inability to adapt to dynamic environmental evolution. Through a decision mapping that integrates membership output and loss function feedback, the model achieves real-time risk level determination and accurate generation of defense strategies, significantly improving the robustness and reliability of the power system under complex disturbances. Detailed Implementation

[0064] To address the problem that traditional rule bases are not adaptable enough to dynamic attacks such as fake sample injection and data forgery, this invention designs a power system network risk defense method based on Markov rule reasoning. Six variables are identified as relevant variables for power system network risk defense: voltage, frequency, power, phasor measurement unit (PMU) phase angle, network traffic characteristics, and communication metadata. The risk level is used as the output variable.

[0065] The experimental data came from a power system network simulation platform and actual operation monitoring logs. After screening, 1200 sets of data remained in the experimental samples.

[0066] The present invention adopts the following technical solution and implementation steps:

[0067] A power system network risk defense method based on Markov rule reasoning includes the following steps:

[0068] (1) Determine the input variables required for power system network defense and the output variables for evaluating the defense results: In view of the fact that traditional rule bases cannot effectively defend against attackers forging and injecting false samples, six variables are determined as relevant variables for power system network risk defense, including voltage, frequency, power, phase angle of phasor measurement unit (PMU), network traffic characteristics, and communication metadata, with risk as the output variable;

[0069] (2) Design a training set for risk defense in power grid systems: Construct a fuzzy input matrix as: X=[x1,…,x j , …, x n ], x j =[x 1j ,…, x ij , …, x mj ] T Voltage data is a vector x1=[x 11 ,…, x 1n The frequency data is a vector x2=[x 21 ,…, x 2n The power data is a vector x3=[x 31 ,…, x 3n The PMU phase angle data is a vector x4=[x 41 ,…,x 4n The network traffic characteristic data is a vector x5=[x 51 ,…, x 5n The communication metadata is a vector x6=[x 61 ,..., x 6n Let i = 1, ..., m, j = 1, ..., n, where m = 6 and n = 1200 are the number of relevant variables and the number of samples, respectively, and T represents the matrix transpose; define the original rule base R = {r1, ..., r...} k ,…,r K Let the total number of rules K in the rule base be 10, and the k-th rule be represented as:

[0070] (twenty three)

[0071] Among them, B ki This represents the membership function corresponding to the k-th rule. Membership functions are divided into triangular membership functions, trapezoidal membership functions, and Gaussian membership functions.

[0072] (3) Calculate each input sample vector x j Standard deviation σ j ;

[0073] (4) When σ j<0.15, the membership degree of each element in the input sample vector is determined according to the triangular membership function y. ik (x ij ;aik,b ik ,c ik )calculate:

[0074] (twenty four)

[0075] Among them, a ik Indicates the input variable x j The minimum value of the element, initially set to 0, b ik Indicates the input variable x j The mean of the elements, initially set to 0.5, c ik Indicates the input variable x j The maximum value of the element, initially set to 1;

[0076] When 0.15≤σ j When ≤0.25, the membership degrees of each element in the input sample vector follow the trapezoidal membership function y. ik (x ij ;d ik ,e ik ,f ik ,g ik )calculate:

[0077] (25)

[0078] Where, d ik Indicates the input variable x j The minimum value of the element, initially set to 0, e ik This indicates the point of full activation, typically located to the left of the sample mean, with an initial value set to 0.45. ik This indicates the complete activation endpoint, typically located to the right of the sample mean, with an initial value set to 0.55. ik Indicates the input variable x j The maximum value of the element, initially set to 1;

[0079] When σ j When the value is greater than 0.25, the membership degree of each element in the input sample vector follows the Gaussian membership function y. ik (x ij ;μ ik ,σ ik )calculate:

[0080] (26)

[0081] Where, μ ik Let represent the center point of the i-th input under the k-th rule, with an initial value of 0.5, and σ.ik Let represent the standard deviation of the i-th input under the k-th rule, with an initial value of 0.2; after matching the rules, the membership matrix Y=[y1,…, y1] of the rule output is formed according to formulas (24)-(26). k , …, y K ] T y k =[y 1k ,…, y ik , …, y mk ] T Considering the dynamic characteristics of the system over time, at each sampling time t, the comprehensive membership value ϕ of the i-th output is... i (t) is obtained by weighting the outputs of all rules:

[0082] (27)

[0083] Where, ω k y represents the weight of the k-th rule. ik (t) represents the membership degree of the i-th output under the k-th rule at time t;

[0084] The loss function L is used to describe the difference between the actual value and the predicted value, and its mathematical expression is:

[0085] (28)

[0086] N t This indicates the total duration of the system operation. If L < 0.05, the process terminates and the risk level is output. If L > 0.05, the process will proceed to the subsequent update stage of the number of rules and parameters.

[0087] The risk level assessment is refined based on the results of formula (27): the power system network is divided into four risk levels, namely "low risk", "medium risk", "high risk" and "severe risk", according to the rule membership degree ϕ. i The value of ϕ(t) determines the final risk level, when ϕ i When ϕ(t)≤0.3, the power system network shows no obvious signs of attack, and the system is considered low-risk; when 0.3<ϕ i When ϕ ≤ 0.6, the power system network exhibits a slight anomaly, and the system is classified as medium risk; when 0.6 < ϕ i When ϕ ≤ 0.8, the power system network exhibits high anomalies and is highly likely to be attacked, classifying the system as high-risk; when ϕ i (t) > 0.8, indicating that the power system network has suffered numerous attacks and the system is at serious risk.

[0088] (29)

[0089] (5) Establish a power system network rule update algorithm

[0090] ① The adaptive defense process of the power system network is modeled as a Markov decision process, where the set of states S represents all states of the system, and its representation is as follows:

[0091] (30)

[0092] Where τ represents the τth state of input X, τ corresponds to the number of samples j, and s τ It is a system current state description vector containing 6 feature dimensions, where Q is the total number of states generated by the system, and Q=n=1200. The iteration time step of the rule update process is denoted as h. max h is the preset maximum iteration limit. max The value is 50, when h > h max The process terminates when the rule is updated; the action set A={+1,-1} is the operation that can be taken in a given state, A=+1 means "add rule" operation, and A=-1 means "modify rule parameter" operation;

[0093] In state s τ Next, calculate the scores for the two actions separately:

[0094] (31)

[0095] (32)

[0096] in, A constant vector, The method for calculating the probability of action selection is as follows:

[0097] (33)

[0098] (34)

[0099] The final action is:

[0100] (35)

[0101] When π(+1|s τ )=π(-1|s τ If no action is taken when the time is right, the process will terminate.

[0102] ② Rule addition: After adding rules, the original rule base R={r1,…,r k ,…,r K} becomes , where r K+1 For the addition of rules;

[0103] When performing the "rule addition" action, the standard deviation σ of the input vector is calculated by step (3). j Based on step (4), determine the applicable rule. If the Gaussian rule is applicable, determine the initial parameters μ0 and σ0 of the new rule by calculating the mean and variance of the existing rule parameter set:

[0104] (36)

[0105] (37)

[0106] in, It is the mean of all membership function parameters in the existing rule base, and its mathematical calculation process is as follows:

[0107] (38)

[0108] If the input sample is adapted to a triangular or trapezoidal rule, then the parameter (a) ik ,b ik ,c ik ) or (d ik ,e ik ,f ik ,g ik The same statistical principles are applied, referring to formulas (24) and (25).

[0109] ③ Rule parameter update: When performing the "rule parameter modification" action, before the action is executed, the applicable rule type is first selected according to steps (3) and (4):

[0110] When applying the trigonometric rule, update the parameter set (a) ik ,b ik ,c ik Adjustments are made based on the relative offset between the current input and the vertex position of the triangle.

[0111] (39)

[0112] (40)

[0113] (41)

[0114] Among them, Г a Г b Г c This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0115] When applying the trapezoidal rule, update the parameter set (d) ik,e ik ,f ik ,g ik Its four boundary points move synchronously toward the input:

[0116] (42)

[0117] Where, p ik ={d ik ,e ik ,f ik ,g ik},Г p This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0118] Gaussian rule center μ ik Update and width σ ik The updated mathematical expression is:

[0119] (43)

[0120] (44)

[0121] Among them, Г μ and Г σ This represents the learning rate, and its value is a random number within the range of [0.02, 0.03].

[0122] By adding rules and adjusting rule parameters, adaptive adjustment of rules is achieved; after the rules are updated, the calculation process of steps (3)-(4) is input, and the membership matrix is ​​denoted as The comprehensive membership value is calculated according to formulas (24)-(27). The risk level corresponding to the power system network is output according to formula (27). The loss function L is calculated according to formula (28). If L < 0.05, the process terminates. If L > 0.05, the process proceeds to step (5). When the number of iterations h > h max The process terminates at that time.

[0123] This invention verifies the model's prediction accuracy by comparing the real-time risk level assessment values ​​output by the system with the preset real risk states in the sample set, and by using the loss function L. Experimental results show that after introducing a Markov rule update mechanism for dynamic optimization, the average loss function value of the system can stably converge to below 0.05, and the risk level determination results are highly consistent with the actual operation of the power system. Even in complex environments where multi-source operating data fluctuates significantly or is subjected to new and unknown attacks, the model can still maintain high-precision risk mapping capabilities through online evolution of the rule base, significantly reducing the false positive and false negative rates, fully demonstrating the robustness and reliability of this invention in power system network security defense.

Claims

1. A power system network risk defense method based on Markov rule reasoning, characterized in that, Includes the following steps: (1) Determine the input variables required for power system network defense and the output variables for evaluating the defense results: Determine six variables as relevant variables for power system network risk defense, including voltage, frequency, power, phase angle of phasor measurement unit (PMU), network traffic characteristics, and communication metadata, with risk as the output variable; (2) Design a training set for risk defense in power grid systems: Construct a fuzzy input matrix as: X=[x1,…, x j ,…, x n ], x j =[x 1j ,…, x ij , …, x mj ] T Voltage data is a vector x1=[x 11 ,…, x 1n The frequency data is a vector x2=[x 21 ,…, x 2n The power data is a vector x3=[x 31 ,…, x 3n The PMU phase angle data is a vector x4=[x 41 ,…, x 4n The network traffic characteristic data is a vector x5=[x 51 ,…, x 5n The communication metadata is a vector x6=[x 61 ,..., x 6n Let i = 1, ..., m, j = 1, ..., n, where m and n are the number of relevant variables and the number of samples, respectively, and T denotes matrix transpose; define the original rule base R = {r1, ..., r...} k ,…,r K Let the total number of rules K in the rule base be 10, and the k-th rule be represented as: Among them, B ki This represents the membership function corresponding to the k-th rule. Membership functions are divided into triangular membership functions, trapezoidal membership functions, and Gaussian membership functions. (3) Calculate each input sample vector x j Standard deviation σ j ; (4) When σ j <0.15, the membership degree of each element in the input sample vector is determined according to the triangular membership function y. ik (x ij ;a ik ,b ik ,c ik )calculate: Among them, a ik Indicates the input variable x j The minimum value of the element, initially set to 0, b ik Indicates the input variable x j The mean of the elements, initially set to 0.5, c ik Indicates the input variable x j The maximum value of the element, initially set to 1; When 0.15≤σ j When ≤0.25, the membership degrees of each element in the input sample vector follow the trapezoidal membership function y. ik (x ij ;d ik ,e ik ,f ik ,g ik )calculate: Where, d ik Indicates the input variable x j The minimum value of the element, initially set to 0, e ik This indicates the point of full activation, typically located to the left of the sample mean, with an initial value set to 0.

45. ik This indicates the complete activation endpoint, typically located to the right of the sample mean, with an initial value set to 0.

55. ik Indicates the input variable x j The maximum value of the element, initially set to 1; When σ j When the value is greater than 0.25, the membership degree of each element in the input sample vector follows the Gaussian membership function y. ik (x ij ;μ ik ,σ ik )calculate: Where, μ ik Let represent the center point of the i-th input under the k-th rule, with an initial value of 0.5, and σ. ik Let represent the standard deviation of the i-th input under the k-th rule, with an initial value of 0.2; after matching the rules, the membership matrix Y=[y1,…, y1] of the rule output is formed according to formulas (2)-(4). k , …, y K ] T y k =[y 1k ,…, y ik , …, y mk ] T Considering the dynamic characteristics of the system over time, at each sampling time t, the comprehensive membership value ϕ of the i-th output is... i (t) is obtained by weighting the outputs of all rules: Where, ω k y represents the weight of the k-th rule. ik (t) represents the membership degree of the i-th output under the k-th rule at time t; The loss function L is used to describe the difference between the actual value and the predicted value, and its mathematical expression is: N t This indicates the total duration of the system operation. If L < 0.05, the process terminates and the risk level is output. If L > 0.05, the process will proceed to the subsequent update stage of the number of rules and parameters. Based on the results of formula (5), the risk levels are further refined: the power system network is divided into four risk levels, namely "low risk", "medium risk", "high risk" and "severe risk", according to the rule membership degree ϕ. i The value of ϕ(t) determines the final risk level, when ϕ i When ϕ(t)≤0.3, the power system network shows no obvious signs of attack, and the system is considered low-risk; when 0.3<ϕ i When ϕ ≤ 0.6, the power system network exhibits a slight anomaly, and the system is classified as medium risk; when 0.6 < ϕ i When ϕ ≤ 0.8, the power system network exhibits high anomalies and is highly likely to be attacked, classifying the system as high-risk; when ϕ i (t) > 0.8, indicating that the power system network has suffered numerous attacks and the system is at serious risk. (7) (5) Establish a power system network rule update algorithm ① The adaptive defense process of the power system network is modeled as a Markov decision process, where the set of states S represents all states of the system, and its representation is as follows:

2. Among them, τ represents the τth state of input X, where τ corresponds to the number of samples j, and s τ It is a system current state description vector containing 6 feature dimensions, where Q is the total number of states generated by the system, and Q=n. The iteration time step of the rule update process is denoted as h. max h is the preset maximum iteration limit. max The value is 50, when h > h max Update the process termination rules; The action set A={+1,-1} represents the operations that can be performed under a given state. A=+1 represents the "add rule" operation, and A=-1 represents the "modify rule parameter" operation. In state s τ Next, calculate the scores for the two actions separately: in, A constant vector, The method for calculating the probability of action selection is as follows: The final action is: When π(+1|s τ )=π(-1|s τ If no action is taken when the time is right, the process will terminate. ② Rule addition: After adding a rule, the original rule base... Become , where r K+1 For the addition of rules; When performing the "rule addition" action, the standard deviation σ of the input vector is calculated by step (3). j Based on step (4), determine the applicable rule. If the Gaussian rule is applicable, determine the initial parameters μ0 and σ0 of the new rule by calculating the mean and variance of the existing rule parameter set: in It is the mean of all membership function parameters in the existing rule base, and its mathematical calculation process is as follows: If the input sample is adapted to a triangular or trapezoidal rule, then the parameter (a) ik ,b ik ,c ik ) or (d ik ,e ik ,f ik ,g ik The same statistical principles are applied, referring to formulas (2) and (3). ③ Rule parameter update: When performing the "rule parameter modification" action, before the action is executed, the applicable rule type is first selected according to steps (3) and (4): When applying the trigonometric rule, update the parameter set (a) ik ,b ik ,c ik Adjustments are made based on the relative offset between the current input and the vertex position of the triangle. Among them, Г a Г b Г c This represents the learning rate, and its value is a random number within the range of [0.02, 0.03]. When applying the trapezoidal rule, update the parameter set (d) ik ,e ik ,f ik ,g ik Its four boundary points move synchronously toward the input: Where, p ik ={d ik ,e ik ,f ik ,g ik },Г p This represents the learning rate, and its value is a random number within the range of [0.02, 0.03]. Gaussian rule center μ ik Update and width σ ik The updated mathematical expression is: Among them, Г μ and Г σ This represents the learning rate, and its value is a random number within the range of [0.02, 0.03]. By adding rules and adjusting rule parameters, adaptive adjustment of rules is achieved; after the rules are updated, the calculation process of steps (3)-(4) is input, and the membership matrix is ​​denoted as Calculate the comprehensive membership value according to formulas (2)-(5), output the risk level corresponding to the power system network according to formula (6), and calculate the loss function L according to formula (7). If L<0.05, the process terminates; if L>0.05, proceed to step (5). When the iteration number h>h max The process terminates at that time.

Images