Detection and defense method and system for power information physical system DoS attack

Abstract

The application provides a detection and defense method and system for a DoS attack on a power information physical system, a power information physical system model is established based on a power flow equation of a power system and a swing equation of a generator; a MAFFKF algorithm is used on a sensor side to perform state estimation on system operation, and a residual detection algorithm is designed according to the state estimation result to realize attack detection; an MPC algorithm is used on a controller side to calculate future control signals by using the most recently received measurement signals, and to compensate for data loss caused by a DoS attack; the functions of attack detection and prediction control of the power information physical system under a DoS attack are realized. The application proposes a KF algorithm based on multiple fading factors, a detection method, a control algorithm based on MPC, and a prediction control sequence is designed based on Lyapunov stability theory and LMI, and the problem of system instability caused by data loss is solved, and the stability of the system is improved.

Description

Technical Field

[0001] This invention belongs to the field of power system technology, specifically relating to a method and system for detecting and defending against DoS attacks on power cyber-physical systems. Background Technology

[0002] Cyber-physical systems (CPS) are a new type of intelligent and complex system that integrates physical systems, network communication, and computer science. Modern power systems, as a typical example of CPS, are composed of basic power networks and information networks. They are the key core of power applications and a typical representative of basic information infrastructure.

[0003] In recent years, with the continuous expansion of network scale and the increasing openness of the communication environment, information processing is gradually becoming more decentralized, making CPPS vulnerable to network attacks. Among these, DoS attacks, due to their low technical threshold and direct effects, have become the attackers' preferred choice. They disrupt the computing, storage, or bandwidth resources of the main station of the data acquisition and monitoring system in the CPPS, interrupting the real-time data interaction between the information layer and the physical layer, posing a significant threat to the secure and stable operation of the CPPS. Building a complete detection and defense system can effectively reduce the harm caused by DoS attacks.

[0004] State estimation is a crucial component of energy management systems in modern power systems and is fundamental to the safe and stable operation of CPPS (Continuous Power System). Among numerous state estimation algorithms, Kalman filtering and its derivatives have become the preferred choice for dynamic system state estimation due to their superior estimation performance and recursive computation. However, for Kalman filters that rely on continuous data, packet loss during DoS attacks prevents them from receiving new measurement data for updates and corrections. This forces the filter to rely on outdated state predictions, inevitably causing a sharp divergence in the estimation error covariance matrix, ultimately rendering the state estimate meaningless.

[0005] Furthermore, current defense strategies against DoS attacks primarily focus on the network layer, such as firewall rule upgrades and channel redundancy, which are insufficient to address attacks that penetrate deeper into the control layer. Model predictive control, on the other hand, analyzes system models and historical information to infer future system states, effectively countering network attacks that tamper with and intercept transmitted data, thus achieving a defensive objective. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method and system for detecting and defending against DoS attacks on power cyber-physical systems, for attack detection and predictive control of power cyber-physical systems under DoS attacks.

[0007] The technical solution adopted by this invention to solve the above-mentioned technical problems is: a method for detecting and defending against DoS attacks on power information physical systems, comprising the following steps: S1: Establish the CPPS discrete state-space model and the time-constrained DoS attack model; S2: Based on the CPPS model under DoS attack, a state estimator is designed using the MAFFKF algorithm to obtain the state estimate; S3: Design a detector based on the difference between the actual value and the estimated value before and after the attack; S4: The MPC algorithm is used to design the control input sequence, and the lost data is compensated when the detector detects a DoS attack. S5: Based on the derivation of the control input sequence, the following is obtained: N CPPS switching system for DoS packet loss; S6: Stability analysis of switching systems based on Lyapunov functionals and LMI; S7: Based on the stability of the switching system, the solution equations for the predictive control sequence and state feedback matrix when the CPPS reaches exponential stability are obtained.

[0008] According to the above scheme, in step S1, the CPPS discrete state-space model and the time-constrained DoS attack model are respectively: , ; In the formula, Let be the system state vector. For system output, The state transition matrix serves as the system control input. Measurement matrix , For measurement matrix; in, It is a vector set of generator bus voltage phase angles. It is a vector set of generator bus frequency deviations. It is the matrix of admittance between generator buses. It is the matrix of admittance between the generator and the load bus. It is the matrix of admittance between the load and the generator bus. It is a matrix of admittances between load buses. It is the load power consumption A set of vectors, and These are diagonal matrices representing the coefficients of the proportional and integral controllers, respectively. and These are the diagonal matrices representing the generator's inertia coefficient and damping coefficient, respectively. and They are independent of each other and satisfy the following conditions: , ,in It is a non-negative process noise covariance matrix. The measurement noise covariance matrix is ​​positive definite. This represents the frequency of DoS attacks within this time interval. For the system in the time interval Initial attack margin within. The average time interval between two consecutive DoS attacks. This represents the duration of the DoS attack. For the system in the time interval The initial attack duration remaining within the range. This represents the longest average duration of a DoS attack that the system can withstand per unit of time.

[0009] According to the above scheme, the specific steps in step S2 are as follows:

[0010]

[0011]

[0012]

[0013]

[0014]

[0015] In the formula, This is the estimated prior state value at the current moment. This is the posterior state estimate from the previous time step. This represents the current information vector. Let be the prior state error covariance matrix at the current moment. Let be the posterior state error covariance matrix of the previous time step. This represents the Kalman gain at the current moment. This is the estimated posterior state value at the current moment. Let be the posterior state error covariance matrix at the current time. This is the matrix of multiple fading factors at the current moment.

[0016] Furthermore, in step S2, the step of solving the multiple fading factor matrix is ​​as follows:

[0017]

[0018] In the formula, , and Each is a matrix , and The first of the matrix i One diagonal element.

[0019] According to the above scheme, the specific steps in step S3 are as follows: The residual test function is expressed based on Euclidean distance as follows:

[0020] In the formula, and These are the actual output values ​​of the system. and estimated value The i One element; According to the absence of attack Set the threshold value and record it as The following rules are defined to detect whether attacks exist in the system: .

[0021] According to the above scheme, the specific steps in step S4 are as follows: Assuming the attacker's maximum attack step size during a DoS attack is... The moment when the control signal was most recently successfully transmitted to the actuator was , , At this time, control the input sequence. Recorded as: , ; because There are no attacks in the time system, so only control signals are used at this time. If the system is The moment begins to be affected by the step size. The system uses attacks. Predictive control signals in data packets received at any time , … The missing data is replenished until new data packets are received. Received by the executor.

[0022] According to the above scheme, the specific steps in step S5 are as follows: When the step size of a DoS attack in CPPS is N At that time, the evolution law of the system state vector is as follows: , , ; Therefore, it will have N The CPPS of DoS packet loss can be described as a switching system: , remember For the system in The state vector at time, where Represent all states of the system as The attacked state and the unattacked state are regarded as two subsystems, with the time of successful data transmission as the dividing line. This is the switching point.

[0023] According to the above scheme, the specific steps in step S6 are as follows: Define the maximum step size of a DoS attack as N Based on Lyapunov functionals and LMI, the following inequalities hold: , , Therefore: , , The two formulas above are combined as follows: , therefore N A CPPS handover system under DoS packet loss at any handover rate with a decay rate Keep the index stable.

[0024] According to the above scheme, the specific steps in step S7 are as follows: CPPS at maximum step size Under DoS attack with attenuation rate The predictive control sequence for achieving exponential stability is: , When there exists an invertible matrix When the following inequalities hold , Mode The inequality holds true; multiply both sides of the inequality by... and get: , because Therefore We obtain the following equation: , Substituting it into the above inequality, we get: , make , , Then the inequality becomes , Based on the above derivation process, the state feedback control matrix of CPPS under predictive control can be expressed as follows: .

[0025] A detection and defense system for DoS attacks targeting power information physical systems. The modeling submodule is used to build the CPPS discrete state-space model and the time-constrained DoS attack model; The estimation submodule is used for the CPPS discrete space state model under DoS attack. It uses the MAFFKF algorithm to design a state estimator to obtain the estimated value of the system state. The attack detection submodule is used to design attack detectors based on the difference between the actual and estimated values ​​of the system output before and after an attack. The compensation submodule is used to design the control input sequence using the MPC algorithm. When the detector detects a DoS attack, it uses the corresponding predictive control input sequence to compensate for the lost data. The derivation submodule is used to derive the state vector evolution law of CPPS under a DoS attack based on the control input sequence, and obtain the state vector evolution law with the control input sequence. N CPPS switching system for DoS packet loss; The stability analysis submodule is used for Lyapunov functional and LMI-based analysis. N Stability of the CPPS switching system in the event of DoS packet loss; The prediction and solution submodule is used for... N To improve the stability of the CPPS switching system under DoS packet loss, we obtain the solution equations for the predictive control sequence and state feedback matrix when the CPPS reaches exponential stability.

[0026] The beneficial effects of this invention are as follows: 1. The present invention relates to a method and system for detecting and defending against DoS attacks on power cyber-physical systems. First, a power cyber-physical system model is established based on the power flow equations and generator oscillation equations. Then, at the sensor side, a multi-fading-factor adaptive Kalman filter algorithm is used to estimate the internal operating conditions of the system, and a residual detection algorithm is designed based on the state estimation results to achieve attack detection. Finally, at the controller side, a model predictive control algorithm is used to calculate the control signal for future periods using the most recently received measurement signal to compensate for data loss caused by the DoS attack. This achieves the functions of attack detection and predictive control of the power cyber-physical system under DoS attacks.

[0027] 2. In designing the state estimator, this invention proposes a KF algorithm based on multiple fading factors, which overcomes the limitations of traditional KF algorithms, such as easy divergence and poor estimation ability of single fading factors for multivariables. Furthermore, it proposes a detection method based on the difference between the estimated value and the true value under attack conditions.

[0028] 3. This invention takes into account that data is transmitted in the form of data packets in the network, and proposes an MPC-based control algorithm, modeling CPPS as a consideration. N A switching system for DoS packet loss was developed; and a predictive control sequence was designed based on Lyapunov stability theory and LMI, which solved the problem of system instability caused by data loss and improved the system stability.

[0029] Of course, any product implementing this invention does not necessarily need to achieve all of the advantages described above at the same time. Attached Figure Description

[0030] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0031] Figure 1 This is a flowchart of an embodiment of the present invention.

[0032] Figure 2 This is a control signal curve of CPPS under a DoS attack according to an embodiment of the present invention.

[0033] Figure 3(a) shows the generator rotor angular frequency deviation of CPPS under a DoS attack in the embodiment of the present invention. A graph showing the true value, measured value, and estimated value.

[0034] Figure 3(b) shows the generator rotor angular frequency deviation of CPPS under a DoS attack in the embodiment of the present invention. A graph showing the true value, measured value, and estimated value.

[0035] Figure 3(c) shows the generator rotor angular frequency deviation of CPPS under a DoS attack in the embodiment of the present invention. A graph showing the true value, measured value, and estimated value.

[0036] Figure 4 This is a curve showing the DoS attack detection results of an embodiment of the present invention.

[0037] Figure 5(a) is a system state response curve of predictive control based on DoS attack according to an embodiment of the present invention.

[0038] Figure 5(b) is a control input curve diagram based on predictive control under DoS attack according to an embodiment of the present invention. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0040] Example 1 See Figure 1 The specific steps for detecting and defending against DoS attacks on power information physical systems are as follows: S1: Establish the CPPS discrete state-space model and the time-constrained DoS attack model as follows: , ; In the formula, Let be the system state vector. For system output, The state transition matrix serves as the system control input. Measurement matrix , This is the measurement matrix. Where, It is a vector set of generator bus voltage phase angles. It is a vector set of generator bus frequency deviations. It is the matrix of admittance between generator buses. It is the matrix of admittance between the generator and the load bus. It is the matrix of admittance between the load and the generator bus. It is a matrix of admittances between load buses. It is the load power consumption A set of vectors, and These are diagonal matrices representing the coefficients of the proportional and integral controllers, respectively. and These are diagonal matrices representing the generator's inertia coefficient and damping coefficient, respectively. and They are independent of each other and satisfy the following conditions: , ,in It is a non-negative process noise covariance matrix. It is the positive definite measurement noise covariance matrix. This represents the frequency of DoS attacks within this time interval. For the system in the time interval Initial attack margin within. The average time interval between two consecutive DoS attacks. This represents the duration of the DoS attack. For the system in the time interval The initial attack duration remaining within the range. This represents the longest average duration of a DoS attack that the system can withstand per unit of time.

[0041] S2: Based on the CPPS discrete-space state model under DoS attack, a state estimator is designed using the MAFFKF algorithm to obtain the estimated value of the system state; specifically including: The recursive process of the MAFFKF algorithm is shown below:

[0042]

[0043]

[0044]

[0045]

[0046]

[0047] In the formula, This is the estimated prior state value at the current moment. This is the posterior state estimate from the previous time step. This represents the current information vector. Let be the prior state error covariance matrix at the current moment. Let be the posterior state error covariance matrix of the previous time step. This represents the Kalman gain at the current moment. This is the estimated posterior state value at the current moment. Let be the posterior state error covariance matrix at the current time. This is the matrix of multiple fading factors at the current moment.

[0048] The solution method for the multiple fading factor matrix is ​​as follows:

[0049]

[0050] In the formula, , and Each is a matrix , and The first of the matrix i One diagonal element.

[0051] S3: Design an attack detector based on the difference between the actual and estimated values ​​of the system output before and after the attack; specifically including: When the system is attacked, the system measures the output. A sudden change then occurs, causing the estimated value to... Compared with the actual output value of the system Significant deviations occurred in the residuals between them. If the CPPS remains in safe operation, then... Therefore, the residual test function based on Euclidean distance is expressed as:

[0052] In the formula, and These are the actual output values ​​of the system. and estimated value The i Each element.

[0053] According to the absence of attack Set the threshold value and record it as The following rules are defined to detect whether an attack exists in the system: .

[0054] S4: The MPC algorithm is used to design the control input sequence. When the detector detects a DoS attack, the corresponding predictive control input sequence is used to compensate for the lost data; specifically including: Assuming the attacker's maximum attack step size during a DoS attack is... The moment when the control signal was most recently successfully transmitted to the actuator was At this time, control the input sequence Recorded as:

[0055]

[0056] In the formula: , .because There are no attacks in the time system, so only control signals are used at this time. If the system is The moment begins to be affected by the step size. The system then uses attacks. Predictive control signals in data packets received at any time , … The missing data is replenished until new data packets are received. Received by the executor.

[0057] S5: Based on the control input sequence, derive the state vector evolution law of CPPS under DoS attack, and obtain the state vector evolution law of CPPS under DoS attack. N The CPPS switching system for DoS packet loss includes: When the step size of a DoS attack in CPPS is N At that time, the system state vector evolves according to the following rules:

[0058]

[0059]

[0060] As can be seen from the above derivation process, at the time points of two consecutive successful data transmissions and Between, the system's state vector is always composed of Determined, therefore possessing N The CPPS of a DoS packet loss can essentially be described as a switching system:

[0061] To describe the sampling time of the DoS attack, we record... For the system in The state vector at time, where Therefore, all states of the system can be represented as The attacked state and the unattacked state are considered as two subsystems, and the moment of successful data transmission... This is the switching point.

[0062] S6: Analysis based on Lyapunov functionals and LMI N The stability of the CPPS switching system under DoS packet loss; specifically including: Theorem: For and a given scalar , If a positive definite symmetric matrix exists This makes the following inequality hold:

[0063]

[0064]

[0065] Then CPPS at any switching rate decays at a certain rate. Keep the index stable.

[0066] Select the following piecewise Lyapunov functionals:

[0067]

[0068] In the formula Multiply by each side and achievable

[0069] Switching systems Substitution We can obtain:

[0070] Then this equation and equation Substituting into the above inequality, we get:

[0071] Similarly, there is

[0072] From the formula From the above inequality relationship, we can obtain:

[0073] According to the formula Generalizing the above inequality, we get:

[0074] because , so when hour, The value will approach 0, therefore the system state It is convergent.

[0075] The lemma states that for any matrix and any vector For all of them, the following inequalities hold:

[0076] According to the above lemma, for all The following inequalities hold true:

[0077] In the formula , is all possible matrices The maximum value of the maximum singular value is easily known. The upper bound is determined by To define it. As analyzed above, when hour, It is convergent, therefore It is also convergent.

[0078] The lemma states that for a real symmetric matrix... and any nonzero vector The following inequalities hold:

[0079] From the above lemma and piecewise Lyapunov functional, it can be seen that... and This makes the following equation true:

[0080] make Then the following inequality holds:

[0081] Right now Then the formula Substituting into it, we get:

[0082] This embodiment defines the maximum step size of a DoS attack as follows: N Therefore, the following inequality holds:

[0083]

[0084] Therefore, we can conclude that:

[0085]

[0086] The two formulas above can be combined into

[0087] therefore NA CPPS handover system under DoS packet loss at any handover rate with a decay rate Keep the index stable.

[0088] S7: Based on N The stability of the CPPS handover system under DoS packet loss is determined, and the predictive control sequence and the equations for solving the state feedback matrix when the CPPS reaches exponential stability are obtained; specifically including: Theorem: For and a given scalar , If a matrix exists , and This makes the following inequality hold.

[0089]

[0090]

[0091] in Then the CPPS formula has a maximum step size of Under DoS attack with attenuation rate The predictive control sequence for achieving exponential stability is

[0092] A lemma states that for a matrix , and If and only if there exists a matrix , making the inequality If this holds, then the following inequalities hold:

[0093] According to the lemma above, when there exists an invertible matrix When the following inequalities hold

[0094] Mode The inequality holds true; multiply both sides of the inequality by... and We can obtain:

[0095] because Therefore We can obtain the following equation:

[0096] Substituting it into the above inequality, we get:

[0097] make , , Then the inequality becomes

[0098] From the above derivation, it can be seen that the theorem holds, and the state feedback control matrix of CPPS under predictive control can be expressed as: .

[0099] This embodiment first establishes a power cyber-physical system model based on the power flow equations of the power system and the oscillation equations of the generator. Then, on the sensor side, a multi-fading-factor adaptive Kalman filter algorithm is used to estimate the internal operating conditions of the system, and a residual detection algorithm is designed based on the state estimation results to achieve attack detection. Finally, on the controller side, a model predictive control algorithm is used to calculate the control signal for future periods using the most recently received measurement signal to compensate for data loss caused by DoS attacks. This achieves the functions of attack detection and predictive control of the power cyber-physical system under DoS attacks.

[0100] Example 2 The steps in this embodiment are the same as in Embodiment 1, except that each step is applied to a specific instance. Specifically, it includes the following steps: S1: Establish a discrete state-space model of CPPS; establish a time-constrained DoS attack model.

[0101] (1) CPPS discrete space state model; consider a state model with For a bus-based power system, where the generator bus uses This indicates that the load bus uses express, n and m Let these represent the number of generators and loads in the system, respectively. Therefore, the power flow equations and generator oscillation equations of this power system can be written as follows:

[0102]

[0103] In the formula, Represents the generator on the bus i Power injected into the location, Represents the load on the bus i Power consumed by the location Connect the generator to the generator bus. i Voltage phase angle at that point, Connect the generator to the generator bus.j The phase angle at the point, Connect the load to the load bus i Voltage phase angle at that point, Connect the load to the load bus j The phase angle at the point, This indicates a bus. i and bus j Line admittance between It is the deviation of the rotor angular frequency from the standard angular frequency. It is the rotor inertia. It is mechanical power input. It is the damping coefficient.

[0104] Combining the two equations above, we obtain the discrete-space state model of CPPS.

[0105] In the formula, Let be the system state vector. For system output, The state transition matrix serves as the system control input. Measurement matrix , This is the measurement matrix. Where, It is a vector set of generator bus voltage phase angles. It is a vector set of generator bus frequency deviations. It is the matrix of admittance between generator buses. It is the matrix of admittance between the generator and the load bus. It is the matrix of admittance between the load and the generator bus. It is a matrix of admittances between load buses. It is the load power consumption A set of vectors, and These are diagonal matrices representing the coefficients of the proportional and integral controllers, respectively. and These are diagonal matrices representing the generator's inertia coefficient and damping coefficient, respectively. and They are independent of each other and satisfy the following conditions: , ,in It is a non-negative process noise covariance matrix. It is the positive definite measurement noise covariance matrix.

[0106] (2) Time-constrained DoS attack model; definition Time interval Frequency of internal DoS attacks This represents the duration of a DoS attack. This embodiment uses the number of attacks and their duration within a certain time period as indicators to constrain attack behavior:

[0107] In the formula, For the system in the time interval Initial attack margin within. The average time interval between two consecutive DoS attacks. For the system in the time interval The initial attack duration remaining within the range. This represents the longest average duration of a DoS attack that the system can withstand per unit of time.

[0108] S2: Design a state estimator using the MAFFKF algorithm to obtain an estimate of the system state.

[0109] Based on step S1, the system state estimate of CPPS under a DoS attack based on the MAFFKF algorithm is obtained:

[0110]

[0111]

[0112]

[0113]

[0114]

[0115] In the formula, This is the estimated prior state value at the current moment. This is the posterior state estimate from the previous time step. This represents the current information vector. Let be the prior state error covariance matrix at the current moment. Let be the posterior state error covariance matrix of the previous time step. This represents the Kalman gain at the current moment. This is the estimated posterior state value at the current moment. Let be the posterior state error covariance matrix at the current time. This is the matrix of multiple fading factors at the current moment.

[0116] The solution method for the multiple fading factor matrix is ​​as follows:

[0117]

[0118] In the formula, , and Each is a matrix , and The first of the matrix i One diagonal element.

[0119] S3: Design an attack detector based on the difference between the actual and estimated values ​​of the system output before and after the attack.

[0120] Based on step S2, when the system is attacked, the system measures the output. A sudden change then occurs, causing the estimated value to... Compared with the actual output value of the system Significant deviations occurred in the residuals between them. If the CPPS remains in safe operation, then... Therefore, the residual test function based on Euclidean distance is expressed as:

[0121] In the formula, and These are the actual output values ​​of the system. and estimated value The i Each element.

[0122] According to the absence of attack Set the threshold value and record it as The following rules are defined to detect whether an attack exists in the system:

[0123] S4: The MPC algorithm is used to design the control input sequence. When the detector detects a DoS attack, the corresponding predictive control input sequence is used to compensate for the lost data.

[0124] Assuming the attacker's maximum attack step size during a DoS attack is... The moment when the control signal was most recently successfully transmitted to the actuator was At this time, control the input sequence Recorded as:

[0125]

[0126] In the formula: , .because There are no attacks in the time system, so only control signals are used at this time. If the system is The moment begins to be affected by the step size. The system then uses attacks. Predictive control signals in data packets received at any time , … The missing data is replenished until new data packets are received. Received by the executor.

[0127] S5: Based on the control input sequence, derive the state vector evolution law of CPPS under DoS attack, and obtain the state vector evolution law of CPPS under DoS attack. N CPPS switching system for DoS packet loss.

[0128] When the step size of a DoS attack in CPPS is N At that time, the system state vector evolves according to the following rules:

[0129]

[0130]

[0131] As can be seen from the above derivation process, at the time points of two consecutive successful data transmissions and Between, the system's state vector is always composed of Determined, therefore possessing N The CPPS of a DoS packet loss can essentially be described as a switching system:

[0132] To describe the sampling time of the DoS attack, we record... For the system in The state vector at time, where Therefore, all states of the system can be represented as The attacked state and the unattacked state are considered as two subsystems, and the moment of successful data transmission... This is the switching point.

[0133] S6: Based on the CPPS switching system constructed in step S5, analyze the stability of the switching system using Lyapunov functionals and LMI.

[0134] Theorem: For and a given scalar , If a positive definite symmetric matrix exists This makes the following inequality hold:

[0135]

[0136]

[0137] Then CPPS at any switching rate decays at a certain rate. Keep the index stable.

[0138] Select the following piecewise Lyapunov functionals:

[0139]

[0140] In the formula Multiply by each side and achievable

[0141] Substitute the expression for switching systems We can obtain:

[0142] Then this equation and Substituting into the above inequality, we get:

[0143] Similarly, there is

[0144] Based on From the above inequality relationship, we can obtain:

[0145] According to the formula Generalizing the above inequality, we get:

[0146] because , so when hour, The value will approach 0, therefore the system state It is convergent.

[0147] The lemma states that for any matrix and any vector For all of them, the following inequalities hold:

[0148] According to the above lemma, for all The following inequalities hold true:

[0149] In the formula , is all possible matrices The maximum value of the maximum singular value is easily known. The upper bound is determined by To define it. As analyzed above, when hour, It is convergent, therefore It is also convergent.

[0150] The lemma states that for a real symmetric matrix... and any nonzero vector The following inequalities hold:

[0151] From the above lemma and piecewise Lyapunov functional, it can be seen that... and This makes the following equation true:

[0152] make Then the following inequality holds:

[0153] Right now Then the formula Substituting into it, we get:

[0154] This embodiment defines the maximum step size of a DoS attack as follows: N Therefore, the following inequality holds:

[0155]

[0156] Therefore, we can conclude that:

[0157]

[0158] The two formulas above can be combined into

[0159] therefore N A CPPS handover system under DoS packet loss at any handover rate with a decay rate Keep the index stable.

[0160] S7: Based on NThe stability of the CPPS switching system under DoS packet loss is determined, and the predictive control sequence and the equations for solving the state feedback matrix when the CPPS reaches exponential stability are obtained.

[0161] Theorem: For and a given scalar , If a matrix exists , and This makes the following inequality hold.

[0162]

[0163]

[0164] in Then the CPPS formula has a maximum step size of Under DoS attack with attenuation rate The predictive control sequence for achieving exponential stability is

[0165] A lemma states that for a matrix , and If and only if there exists a matrix , making the inequality If this holds, then the following inequalities hold:

[0166] According to the lemma above, when there exists an invertible matrix When the following inequalities hold

[0167] Mode The inequality holds true; multiply both sides of the inequality by... and We can obtain:

[0168] because Therefore We can obtain the following equation:

[0169] Substituting it into the above inequality, we get:

[0170] make , , Then the inequality becomes

[0171] From the above derivation, it can be seen that the theorem holds, and the state feedback control matrix of CPPS under predictive control can be expressed as: .

[0172] Control signals of CPCS under DoS attack, such as Figure 2 As shown, the loss of data packets during a DoS attack leads to instability in the control signal. Figures 3(a), (b), and (c) respectively illustrate the generator rotor angular frequency deviation. , and This paper examines the state response under DoS attacks and the state estimation performance of MAFFKF, SAFFKF, and KF methods in cases of inaccurate noise models. By comparing the estimates of the three algorithms with the measured values ​​of the system, it is easy to see that they all have good noise filtering capabilities. However, for standard KF, data loss causes the error covariance matrix to continuously diverge, and the state estimate relies entirely on inaccurate model predictions; the accumulation of bias leads to complete divergence. MAFFKF and SAFFKF, by introducing fading factors, actively increase the value of the error covariance matrix, preventing the Kalman gain from being too small. This allows the filter to give higher weight to new data when it receives new data, correcting the state estimate more quickly and effectively suppressing filter divergence caused by data loss. Furthermore, compared to SAFFKF's uniform adjustment capability for each channel, MAFFKF dynamically adjusts the values ​​of each fading factor over time for each channel to optimize the filtering effect and reduce state estimation errors. Curve analysis clearly shows that when the system suffers external attacks that cause instability, MAFFKF's state estimation performance is significantly better than SAFFKF.

[0173] DoS attack detection results are as follows: Figure 4 As shown, analysis of the detection curve reveals that, The curve suddenly rose to 0.04248, exceeding the system's original threshold of 0.04, and then... It reached a peak of 0.4718, and then... The value suddenly dropped to 0.2108, then gradually decreased until it stabilized. To ensure system stability during the attack period, the predictive control compensation gain sequence proposed in this embodiment was employed. The system's state response and control input signal are shown in Figure 5. It can be seen that although the system still experiences some fluctuations during the attack period, it remains relatively stable compared to... Figure 2Compared with the control signal input and state response in Figure 3, the instability caused by DoS attack has been greatly improved within the attack range, and the system can gradually recover stability after the attack ends.

[0174] This embodiment proposes a KF algorithm based on multiple fading factors when designing the state estimator, overcoming the limitations of traditional KF algorithms that are prone to divergence and have poor estimation capabilities for multivariate variables with a single fading factor. Furthermore, it proposes a detection method based on the difference between the estimated and true values ​​under attack conditions. Considering that data is transmitted in the network in the form of data packets, this embodiment proposes an MPC-based control algorithm, modeling CPPS as a system that considers... N A switching system for DoS packet loss was developed; and a predictive control sequence was designed based on Lyapunov stability theory and LMI, which solved the problem of system instability caused by data loss and improved the system stability.

[0175] It should be understood that the sequence number of each step in the above embodiments does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0176] Example 3 This embodiment is used to implement the principle of the above method embodiment to build a detection and defense system against DoS attacks on power cyber-physical systems, including a modeling submodule, an estimation submodule, an attack detection submodule, a derivation submodule, a stability analysis submodule, and a prediction and solution submodule; The modeling submodule is used to build the CPPS discrete state-space model and the time-constrained DoS attack model; The estimation submodule is used for the CPPS discrete space state model under DoS attack. It uses the MAFFKF algorithm to design a state estimator to obtain the estimated value of the system state. The attack detection submodule is used to design attack detectors based on the difference between the actual and estimated values ​​of the system output before and after an attack. The derivation submodule is used to design the control input sequence using the MPC algorithm. When the detector detects a DoS attack, the corresponding predicted control input sequence is used to compensate for the lost data. The derivation submodule is used to derive the state vector evolution law of CPPS under a DoS attack based on the control input sequence, and obtain the state vector evolution law with the control input sequence. N CPPS switching system for DoS packet loss; The stability analysis submodule is used for Lyapunov functional and LMI-based analysis. N Stability of the CPPS switching system in the event of DoS packet loss; The prediction and solution submodule is used for... NTo improve the stability of the CPPS switching system under DoS packet loss, we obtain the solution equations for the predictive control sequence and state feedback matrix when the CPPS reaches exponential stability.

[0177] Each submodule is mainly used to implement the various steps of the method implementation, which will not be elaborated here.

[0178] It should be noted that, depending on the implementation needs, the various steps / components described in this application can be broken down into more steps / components, or two or more steps / components or parts of the operation of steps / components can be combined into new steps / components to achieve the purpose of this invention.

[0179] This embodiment also includes a processor, a communication interface, a memory, and a communication bus; wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; the memory stores a computer program, which, when executed by the processor, causes the processor to perform the steps of a detection and defense method against DoS attacks on power cyber-physical systems.

[0180] This embodiment also provides a computer-readable storage medium storing executable instructions that, when executed by a processor, enable the processor to implement a detection and defense method against DoS attacks on power cyber-physical systems.

[0181] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects.

[0182] Furthermore, this application may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0183] This application is described with reference to the flowchart of the method and computer program product according to Embodiment 1 and the block diagram of the device (system) according to Embodiment 3. It should be understood that each step or block in the flowchart or block diagram, as well as combinations of steps or blocks in the flowchart or block diagram, can be implemented by computer program instructions.

[0184] These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing device to produce a machine, such that the instructions, which are executable by the processor of the computer or other programmable data processing device, produce instructions for implementing the process. Figure 1 One or more processes or boxes Figure 1 A detection and defense system for DoS attacks against power cyber-physical systems, specifying the functions outlined in one or more boxes.

[0185] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes or boxes Figure 1 The function specified in one or more boxes.

[0186] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes or boxes Figure 1 The steps of the detection and defense methods against DoS attacks on power cyber-physical systems are specified in one or more boxes.

[0187] The above embodiments are only used to illustrate the design concept and features of the present invention, and their purpose is to enable those skilled in the art to understand the content of the present invention and implement it accordingly. The protection scope of the present invention is not limited to the above embodiments. Therefore, all equivalent changes or modifications made based on the principles and design ideas disclosed in the present invention are within the protection scope of the present invention.

Claims

1. A method for detecting and defending against DoS attacks on power information physical systems, characterized in that: Includes the following steps: S1: Establish the CPPS discrete state-space model and the time-constrained DoS attack model; S2: Based on the CPPS model under DoS attack, a state estimator is designed using the MAFFKF algorithm to obtain the state estimate; S3: Design a detector based on the difference between the actual value and the estimated value before and after the attack; S4: The MPC algorithm is used to design the control input sequence, and the lost data is compensated when the detector detects a DoS attack. S5: Based on the derivation of the control input sequence, the following is obtained: N CPPS switching system for DoS packet loss; S6: Stability analysis of switching systems based on Lyapunov functionals and LMI; S7: Based on the stability of the switching system, the solution equations for the predictive control sequence and state feedback matrix when the CPPS reaches exponential stability are obtained.

2. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: In step S1, the CPPS discrete state-space model and the time-constrained DoS attack model are respectively: ， ； In the formula, Let be the system state vector. For system output, The state transition matrix serves as the system control input. Measurement matrix , For measurement matrix; in, It is a vector set of generator bus voltage phase angles. It is a vector set of generator bus frequency deviations. It is the matrix of admittance between generator buses. It is the matrix of admittance between the generator and the load bus. It is the matrix of admittance between the load and the generator bus. It is a matrix of admittances between load buses. It is the load power consumption A set of vectors, and These are diagonal matrices representing the coefficients of the proportional and integral controllers, respectively. and These are the diagonal matrices representing the generator's inertia coefficient and damping coefficient, respectively. and They are independent of each other and satisfy the following conditions: , ,in It is a non-negative process noise covariance matrix. The measurement noise covariance matrix is ​​positive definite. This represents the frequency of DoS attacks within this time interval. For the system in the time interval Initial attack margin within. The average time interval between two consecutive DoS attacks. This represents the duration of the DoS attack. For the system in the time interval The initial attack duration remaining within the range. This represents the longest average duration of a DoS attack that the system can withstand per unit of time.

3. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S2 are as follows: In the formula, This is the estimated prior state value at the current moment. This is the posterior state estimate from the previous time step. This represents the current information vector. Let be the prior state error covariance matrix at the current moment. Let be the posterior state error covariance matrix of the previous time step. This represents the Kalman gain at the current moment. This is the estimated posterior state value at the current moment. Let be the posterior state error covariance matrix at the current time. This is the matrix of multiple fading factors at the current moment.

4. The detection and defense method for DoS attacks on power information physical systems according to claim 3, characterized in that: In step S2, the steps for solving the multiple fading factor matrix are as follows: In the formula, , and Each is a matrix , and The first of the matrix i One diagonal element.

5. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S3 are as follows: The residual test function is expressed based on Euclidean distance as follows: In the formula, and These are the actual output values ​​of the system. and estimated value The i One element; According to the absence of attack Set the threshold value and record it as The following rules are defined to detect whether attacks exist in the system: 。 6. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S4 are as follows: Assuming the attacker's maximum attack step size during a DoS attack is... The moment when the control signal was most recently successfully transmitted to the actuator was , , At this time, control the input sequence. Recorded as: ， ； because There are no attacks in the time system, so only control signals are used at this time. If the system is The moment begins to be affected by the step size. The system uses attacks. Predictive control signals in data packets received at any time , … The missing data is replenished until new data packets are received. Received by the executor.

7. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S5 are as follows: When the step size of a DoS attack in CPPS is N At that time, the evolution law of the system state vector is as follows: ， ， ； Therefore, it will have N The CPPS of DoS packet loss can be described as a switching system: ， remember For the system in The state vector at time, where Represent all states of the system as The attacked state and the unattacked state are regarded as two subsystems, with the time of successful data transmission as the dividing line. This is the switching point.

8. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S6 are as follows: Define the maximum step size of a DoS attack as N Based on Lyapunov functionals and LMI, the following inequalities hold: , , Therefore: ， ， The two formulas above are combined as follows: ， therefore N A CPPS handover system under DoS packet loss at any handover rate with a decay rate Keep the index stable.

9. The detection and defense method for DoS attacks on power information physical systems according to claim 1, characterized in that: The specific steps in step S7 are as follows: CPPS at maximum step size Under DoS attack with attenuation rate The predictive control sequence for achieving exponential stability is: ， When there exists an invertible matrix When the following inequalities hold ， Mode The inequality holds true; multiply both sides of the inequality by... and get: ， because Therefore We obtain the following equation: ， Substituting it into the above inequality, we get: ， make , , Then the inequality becomes ， Based on the above derivation process, the state feedback control matrix of CPPS under predictive control can be expressed as follows: .

10. A detection and defense system against DoS attacks on power information physical systems, characterized in that: The modeling submodule is used to build the CPPS discrete state-space model and the time-constrained DoS attack model; The estimation submodule is used for the CPPS discrete space state model under DoS attack. It uses the MAFFKF algorithm to design a state estimator to obtain the estimated value of the system state. The attack detection submodule is used to design detectors based on the difference between the actual and estimated values ​​of the system output before and after an attack. The compensation submodule is used to design the control input sequence using the MPC algorithm. When the detector detects a DoS attack, it uses the corresponding predictive control input sequence to compensate for the lost data. The derivation submodule is used to derive the state vector evolution law of CPPS under a DoS attack based on the control input sequence, and obtain the state vector evolution law with the control input sequence. N CPPS switching system for DoS packet loss; The stability analysis submodule is used to analyze the stability of the switching system based on Lyapunov functionals and LMI. The prediction and solution submodule is used to obtain the solution equations for the predictive control sequence and state feedback matrix when the CPPS reaches exponential stability, based on the stability of the switching system.

Images