A power grid data fusion detection method and system

Abstract

The application discloses a power grid data fusion detection method and system, and relates to the technical field of power grid data processing and anomaly detection. The method obtains network layer measurement data and a first matrix to form a fusion detection sample; a first model is constrained by the first matrix to generate a first state representation; a second model is constructed in combination with a node power flow equation and counterfactual inference is performed to obtain a first data representation; and a data deviation degree and a physical network state estimation residual error are obtained accordingly, so that the characteristics of the forged data meeting the statistical distribution are effectively identified, and the detection precision of the power grid data is improved.

Description

Technical Field

[0001] This application belongs to the field of power grid data processing and anomaly detection technology, specifically relating to a power grid data fusion detection method and system. Background Technology

[0002] Power grid operation relies on real-time acquisition and processing of wide-area measurement data by dispatch automation systems (such as SCADA and WAMS). Typical measurements include node voltage amplitude, branch active / reactive power flow, node injected power, and phase angle measurements. These measurements are transmitted to the dispatch master station via communication networks for critical operations such as state estimation, security analysis, optimized dispatching, and market settlement. The completeness and reliability of the measurement data directly affect the correctness of power grid operation decisions.

[0003] Traditional power grid data verification primarily relies on Bad Data Detection (BDD) mechanisms, the core of which is Weighted Least Squares (WLS) state estimation and residual verification. This method assumes that measurement errors follow a Gaussian distribution and identifies anomalous measurements that significantly deviate from the normal statistical range by calculating the measurement residuals (the difference between the actual measurement and the state estimate) and comparing them with a threshold. However, the detection capability of WLS-BDD is limited by measurement redundancy and residual sensitivity; its detection efficiency drops significantly for carefully constructed attack vectors. Summary of the Invention

[0004] To address the shortcomings of existing technologies where purely statistical or data-driven anomaly detection is insufficient to identify spoofed data injections that are statistically hidden but violate the physical conservation relationships of the power grid, this application provides a power grid data fusion detection method and system. This method synchronously binds network layer measurement data with a first matrix and couples the first and second discriminants by combining a first model, a second model, and counterfactual inference, thereby isolating spoofed data characteristics.

[0005] Specifically, this application provides the following technical solutions: Firstly, this application provides a power grid data fusion detection method, including: Obtain network layer measurement data and the first matrix; Based on the network layer measurement data and the first matrix, a fusion detection sample is constructed; Based on the first matrix, a first model is constructed, and a first state representation is generated through the first model; Based on a preset second model, counterfactual inference is performed on the current data variables to obtain a first data representation, wherein the fused detection sample includes the current data variables; Based on the fused detection samples, the first state representation, and the first data representation, the data deviation and physical network state estimation residuals are determined. Based on the data deviation and the physical network state, the residual is estimated to determine the characteristics of the forged data.

[0006] Optionally, temporally correlate the network layer measurement data and the first matrix to form fused detection samples, including: The network layer measurement data includes node voltage measurements, branch current measurements, and node injection measurements. The first matrix is ​​constructed based on the bus status, branch status, and switch status. A fusion detection sample is constructed based on the network layer measurement data and the first matrix, and the fusion detection sample carries a topology version identifier.

[0007] Optionally, constructing the first model based on the first matrix includes: Transform the first matrix into the first coupling weights between nodes; The first coupling weight is embedded in the first model to constrain the first model to output the first state representation.

[0008] Optionally, constructing the second model includes: A variable layer is established based on the measurement variables in the fusion detection samples; A physical constraint layer is established using nodal power flow equations; An intervention layer is established based on the substitution assignment relationship of the data variable to be tested, wherein the current data variable includes the data variable to be tested.

[0009] Optionally, the counterfactual inference includes: Select the data variable to be tested from the current data variables; While keeping the first matrix and the physical constraints of adjacent nodes unchanged, generate the first data representation of the data variable to be tested; The first data representation is then backfilled into the second model.

[0010] Optionally, determining the data deviation and physical network state estimation residual based on the fused detection samples, the first state representation, and the first data representation includes: The data deviation is determined based on the fused detection samples and the first data representation; The physical network state estimation residuals are determined based on the first state characterization; A joint discriminant characterization is constructed by estimating the residuals based on the data deviation and the physical network state.

[0011] Optionally, determining the characteristics of forged data based on the residual estimation using the data deviation and the physical network state includes: The deviation of the data is first determined; A second discrimination is performed on the physical network state estimation residuals; Data variables that pass the first discrimination but fail the second discrimination are marked as forged data features.

[0012] Optionally, it also includes: The affected nodes or branches are determined based on the characteristics of the forged data. The training samples of the first model are anomaly masked; The first model is updated based on the masked training samples.

[0013] Secondly, this application provides a power grid data fusion detection system, comprising: A data acquisition unit is used to acquire network layer measurement data and a first matrix, and to construct a fusion detection sample based on the network layer measurement data and the first matrix; The first modeling unit is used to construct a first model based on the first matrix and generate a first state representation through the first model. An inference unit is used to perform counterfactual inference on the current data variables based on a preset second model to obtain a first data representation, wherein the fusion detection sample includes the current data variables; The discrimination unit is used to determine the data deviation and physical network state estimation residual based on the fused detection sample, the first state representation and the first data representation; An isolation unit is used to estimate the residual based on the data deviation and the physical network state, and to determine the characteristics of forged data.

[0014] Optionally, a discrimination result caching channel is provided between the discrimination unit and the isolation unit. The discrimination result caching channel is used to store the data deviation, the physical network state estimation residual, and the corresponding data variable identifier. The isolation unit is also used to output the affected node identifier, the affected branch identifier, and the forged data injection alarm identifier.

[0015] The beneficial effects of this application are as follows: When network layer measurement data enters the detection link, it establishes a temporal association with the first matrix, giving the detection samples a traceable physical context. The first model generates a first state representation under topological prior constraints, reducing the dependence of the pure data model on non-physical correlations. The second model and the first data representation enable the current data variables to be compared under the same physical conservation relationship. The data deviation and the physical network state estimation residual jointly participate in the discrimination, enabling the characteristics of forged data to be isolated. Attached Figure Description

[0016] Figure 1 The overall flowchart of the power grid data fusion detection method provided in the embodiments of this application is shown.

[0017] Figure 2 This is a schematic diagram of the power grid data fusion detection system provided in an embodiment of this application.

[0018] Figure 3 This is a schematic diagram illustrating the changes in data deviation and physical network state estimation residuals provided in the embodiments of this application.

[0019] Figure 4 A schematic diagram of sample distribution in the joint discrimination plane provided in the embodiments of this application. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0021] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified. It should be understood that the described embodiments are used to explain the technical solution of this application and not to unnecessarily limit the scope of protection.

[0022] In this application, network layer measurement data refers to power grid operation measurements that reach the detection system via a communication network; the first matrix refers to the node admittance relationship formed by bus status, branch status, switch status, and branch electrical parameters; and the fused detection sample refers to a composite data object that binds measurement data, the topology admittance matrix (i.e., the first matrix), the topology version identifier, and the channel mapping relationship under a unified time index. The embodiments of this application are described below with reference to the accompanying drawings.

[0023] Example 1 like Figure 1 As shown, this method includes steps S000 to S600, where steps S100 to S500 constitute the initial detection operation, and step S600 is used for operation, maintenance, and model updates. Specifically: S000, System Initialization and Calibration.

[0024] Before its initial run, the system reads the power grid dispatch model, topology management table, branch parameter table, and measurement channel table to form bus index, branch index, measurement channel index, and topology version identifier. This step does not directly output forged data characteristics, but it provides a clear physical context for each subsequent fusion detection sample. It should be noted that without this initialization process, although network layer measurement data can enter the statistical model, it is difficult to confirm its corresponding topology state and physical constraints.

[0025] For example, the system reads a 4-node distribution network. The node set is node 1, node 2, node 3, and node 4, and the branch set is branch (1,2), branch (2,3), branch (3,4), and branch (1,4). The impedance of branch (1,2) is... The impedance of branch (2,3) is The impedance of branch (3,4) is The impedance of branch (1,4) is For any branch, the system follows... The branch admittance is obtained, where Indicates the branch resistance. The branch reactance is represented by per-unit notation, a common numerical notation method used in power system analysis and engineering calculations to represent the relative values ​​of various physical quantities and parameters. If the branch switch is closed, the branch enters the first matrix; if the branch switch is open, the branch does not enter an effective coupling relationship.

[0026] In this example, the system generates a topology version when all branch switches are closed. When the switch for branch (1,4) is open, the system will... and The corresponding effective coupling is set to 0, and the diagonal terms of node 1 and node 4 are corrected simultaneously to form a new topology version. .

[0027] In addition, the system establishes a measurement channel mapping table. For example, channel C001 corresponds to the voltage of node 1, channel C002 corresponds to the voltage of node 2, channel C023 corresponds to the current of branch (2,3), and channel CP3 corresponds to the active power injection of node 3. The channel mapping table converts the network layer channel number into a physical object identifier, so that every measurement value in the subsequent fusion detection sample can be traced back to the node or branch, thereby avoiding the network layer data from being misread as a sequence of ordinary numerical values ​​without physical meaning.

[0028] S100: Obtain network layer measurement data and power grid physical layer topology admittance matrix, and perform time-series correlation between the two to form a fused detection sample.

[0029] In this embodiment, real-time measurements, channel mappings, and the current first matrix are written into the same fused detection sample. In engineering implementation, the system receives multi-channel measurements with a unified time index, reads the first matrix corresponding to the topology version, and writes the channel mapping, time index, topology version, and quality identifier to each measurement value. Specifically, this includes the following sub-steps: S110, obtain node voltage measurement, branch current measurement and node injection measurement according to the unified time index, wherein the network layer measurement data includes node voltage measurement, branch current measurement and node injection measurement.

[0030] In this embodiment, the system first receives node voltage measurements, branch current measurements, and node injection measurements from the communication network. A unified time index is used to group data arriving from different channels into the same detection window. If the master station time base is... Window length is The measurement arrival time is Then the window index can be represented as This index is used for grouping and does not change the original measurement value; at the same time, the system still retains the original timestamp to audit communication delays or channel anomalies.

[0031] For example, window length Set as When channel C001 is in Voltage measurement at node 1 Channel C002 in Voltage measurement at node 2 Channel C023 in Current measurement at branch (2,3) Channel CP3 in Active power injection measurement at node 3 At that time, all these measurements were assigned to the 501st detection window. The system organized them into a network layer measurement matrix. At the same time, it saves the channel identifier and physical object identifier for each measurement.

[0032] S120, the first matrix is ​​generated based on the bus status, branch status and switch status.

[0033] In this embodiment, within the same window, the system reads the currently valid bus set, branch set, and switch status, and generates a first matrix. Each item in the first matrix represents the following: off-diagonal items indicate effective electrical coupling between nodes, and diagonal items indicate the collection of effective branch admittances connected to that node. If the switch status changes, the system does not use the old matrix but generates a new topology version to ensure that the measurement data is consistent with the physical structure of the power grid.

[0034] For example, in window 501, the branch (1,4) switch has been turned off, and the current topology version is... System usage The corresponding first matrix If all branch closures are misused There may be a non-existent physical coupling between node 1 and node 4, and subsequent models may interpret anomalies on disconnected branches as normal correlations. Therefore, S120 uses topology version as a necessary field for fusion detection samples.

[0035] S130, the network layer measurement data is bound to the first matrix as a fusion detection sample with a topology version identifier.

[0036] The system will , Topology version Channel mapping table and quality label Combined into fusion detection samples The structure of this sample can be represented as follows: .in For network layer measurement matrices, For the first matrix, For topology version identification, This is a channel mapping table. Subsequent steps will all use this. This serves as input, preventing the model from bypassing topological physical constraints to directly process isolated measurements.

[0037] For example, if the active power injection measurement of node 3 is close to the historical value in the network layer statistical distribution, but the measurement is bound to the topology version Then, it will participate in subsequent judgments together with the current admittance relationships of branches (2,3) and (3,4). If the same measurement is incorrectly bound to... Counterfactual inference and physical residuals can produce different results. Therefore, this application treats topology version binding as part of the detection samples, rather than as ordinary log records.

[0038] S200 uses the first matrix as a priori constraint to construct a graph neural network digital twin model (i.e., the first model), and generates a physically consistent state representation (i.e., the first state representation) from the first model.

[0039] In this embodiment, a first model is constructed using a first matrix from the fused detection samples to project network layer measurement data into a state space constrained by the physical connections of the power grid, and to generate a first state representation. It should be noted that while ordinary neural networks can learn correlations from historical data, correlations do not necessarily represent effective physical coupling in the current power grid. This application uses the first matrix to limit the message passing path, enabling the model output to accept node power flow constraint checks. Specifically, it includes the following sub-steps: S210 transforms the first matrix into the first coupling weights between nodes.

[0040] The system starts from the first matrix Extract the effective coupling relationships between nodes and normalize them into physical coupling weights. (i.e., the first coupling weight). For nodes and nodes If there is no valid branch between the two, or the corresponding branch is broken in the current topology version, then If there is a valid electrical connection between the two, then It is obtained by normalizing the magnitude of the corresponding admittance term. This weight does not represent the data similarity in the communication network, but rather the electrical coupling strength in the physical layer of the power grid.

[0041] For example, in the topology version Below, there is a valid branch between node 2 and node 3, and the normalized first coupling weight... The value is 0.41; the branch between node 1 and node 4 is broken. The value is 0. If nodes 1 and 4 show a high statistical correlation in historical data due to similar load patterns, this correlation is still insufficient to cover the fact that branches are disconnected in the current topology. Therefore, the system only allows... Participation in message passing between node 2 and node 3 is not allowed. This creates non-physical coupling, and so on.

[0042] S220 embeds the first coupling weight into the message passing channel of the graph neural network.

[0043] The first model uses power grid nodes as graph nodes and the first coupling weight as graph edge weights. In the The hidden state of a layer is denoted as Its next-level state can be represented as ,in The set of adjacent nodes determined by the current first matrix. As the first coupling weight, and These are model parameters. This expression specifies that messages can only propagate along edges permitted by the current power grid topology.

[0044] For example, the initial state vector of node 2 is , representing the voltage magnitude and injection characteristics of node 2; the initial state vector of node 3 is In the example, take and For unit mapping, Then the message contribution of node 3 to node 2 is This value is not the final result, but rather demonstrates how the first matrix constrains the transmission of node information within the model. If a branch is broken, the corresponding... If the value is 0, this branch will not contribute messages.

[0045] S230, the constraint graph neural network outputs a first state representation consistent with the node power flow constraints.

[0046] The system incorporates node power flow constraints at the output of the graph neural network. Specifically, for nodes... The active and reactive states output by the model can be denoted as: and The physical reference obtained from the nodal power flow equations can be denoted as: and The physical consistency constraint can be written as: It should be noted that this constraint requires the model to not only fit historical measurements, but also to maintain consistency with the current power flow relationship corresponding to the first matrix.

[0047] For example, the physically consistent active power representation of node 3 in the model output is as follows: Reactive power is characterized as If the active power injection of node 3 in the original network layer measurement is... The model will not directly accept this value as the normal state, but will instead generate a representation that better reflects the current physical state of the power grid under topological priors and power flow constraints. This first-state representation This will serve as a reference for counterfactual inferences in S300.

[0048] It should be noted that after the fused detection samples enter the first modeling unit, they are split into two types of inputs: a node feature matrix and a first matrix. The node feature matrix provides measurement information, while the first matrix provides physical connection information. The two are recoupled in the message passing channel, and the output is a first state representation arranged by node index. Since the output still retains node and branch indices, it can be directly backfilled into the structural causal model (i.e., the second model).

[0049] S300, combined with the node power flow equation, constructs a second model, and uses the second model to perform counterfactual inference on the current data variables in the fused detection samples to obtain the first data representation.

[0050] In this embodiment, a second model is constructed based on the fused detection samples and the first state representation. This second model elevates the dependencies between power grid measurement variables from ordinary correlations to causal relationships constrained by topology and power flow. Counterfactual inference is used to replace a data variable to be tested while keeping the current first matrix and the physical constraints of adjacent nodes unchanged, and to observe whether the replacement can restore physical consistency. Specifically: S310, establish a variable layer by fusing measurement variables in the detection samples.

[0051] The system detects samples from fusion. The system extracts node voltage, branch current, node injected power, and quality identifiers, and establishes each verifiable measurement as a variable node in the variable layer. The variable layer is not a simple data table, but is bound to the channel mapping table, node index, and branch index. For the active power injection variable at node 3, the variable layer records its channel identifier, time index, topology version, physical object, and current measurement value.

[0052] For example, in In the middle, the variable layer contains , , and .in This indicates the active power injection measurement at node 3; the current value is... The variable layer records simultaneously. Candidate parent variables include node 3 voltage. Voltage of adjacent node 2 Voltage of adjacent node 4 In addition to the associated branch admittance terms, this record enables the system to identify which physical objects constrain the variable during counterfactual inference.

[0053] S320 establishes a physical constraint layer using nodal power flow equations.

[0054] The physical constraint layer incorporates the nodal power flow equations into the constraint relationships between variables, where nodes... The balance between active and reactive power is determined by the node voltage magnitude, phase angle, and the first matrix.

[0055] For example, the active power injection variable of node 3 This is related to the voltages of node 3, node 2, and node 4, as well as the admittances of branch (2,3) and branch (3,4). If branch (1,4) is disconnected, no valid constraint edge is established between node 1 and node 4. The system is thus able to distinguish between communication network dependencies and physical network dependencies. This physical constraint layer also reads the first state representation output by S200 to ensure that the counterfactual substitution value is consistent with the current topology version.

[0056] S330, establish the intervention layer based on the substitution assignment relationship of the data variables to be tested.

[0057] The intervention layer is used to perform counterfactual inferences on the current data variables. Specifically, for the variable to be tested... The system obtains alternative assignments from the first state representation. And execute in the second model It should be noted that this intervention only replaces the current data variables, does not change the first matrix, does not change the physical constraints of adjacent nodes, and does not change the original records of other untested variables within the same window.

[0058] For example, the current active power injection measurement of node 3 is The physically consistent active power characterization given by S200 is as follows: The system will Select the variable to be tested as the data variable, and... As an alternative assignment, it is written into the intervention layer and generates the first data representation. If the physical residuals of node 3 and branches (2,3) and (3,4) decrease significantly after the replacement, then the variable affects the path record as follows. .

[0059] The first data representation here is not a typical predicted value, but a physical reference obtained under the same topology, the same neighboring node constraints, and the same detection window. If a variable appears statistically normal, but significantly improves power flow conservation after being replaced with a physically consistent representation, then that variable is suspected of being injected with fabricated data. If the change in physical residuals before and after the replacement is very small, then that variable is more likely just ordinary measurement noise or irrelevant disturbance.

[0060] The three-layer structure of the second model specifically includes: Variable layer: Contains the currently measured variables; Physical constraint layer: carries node power flow constraints and the first matrix; Intervention layer: Bears the substitution assignment relationship of the variable to be tested.

[0061] The three layers jointly output counterfactual data representations (i.e., the first data representation) and variable influence paths, which are used by S400 to form data deviation and physical network state estimation residuals.

[0062] S400 obtains the data deviation and physical network state estimation residuals based on the fused detection samples, the first state characterization, and the first data characterization.

[0063] In this embodiment, S400 converts the current measurement, the first state representation, and the first data representation into two complementary indicators: data deviation and physical network state estimation residual. Data deviation reflects the degree of deviation of the current data variable relative to the counterfactual reference, while the physical network state estimation residual reflects whether this deviation violates the physical conservation relationships of nodes or branches. The two are then combined to form a joint discriminative representation. Specifically, this includes the following sub-steps: S410, determine the data deviation based on the fused detection sample and the first data characterization.

[0064] The system reads the current measurement value and corresponding first data representation for each variable to be tested, and normalizes them according to the robust scale of clean samples. Here, clean samples refer to the set of fusion detection samples retained after quality labeling during historical operation periods without attacks, faults, and with stable topology versions. The process of obtaining clean samples is as follows: the system selects samples from historical windows that meet the following conditions: the topology version corresponding to the window is consistent with the topology version of the current window to be tested; the quality labels of all measurement channels within the window are normal; the window has not been marked as having forged data injection features and has not been marked as an anomaly mask. Historical window measurements that meet the above conditions constitute the clean sample set. , where N is the number of clean samples.

[0065] Robust Scale The median absolute deviation method is used for calculation. The specific steps are as follows: First, calculate the median of the k-th variable in the clean sample set. Secondly, calculate the absolute deviation of each clean sample from the median. Finally, the median of the absolute deviation sequence is taken and multiplied by the normalization constant to obtain the robustness scale. The constant 1.4826 ensures that the robust scale is consistent with the standard deviation when the data follows a normal distribution. Moreover, compared to the ordinary standard deviation, the median absolute deviation method is not sensitive to a small number of outliers. Even if there are occasional minor perturbations in the clean sample that have not been screened out, the robust scale can still reflect the dispersion of normal operation.

[0066] Therefore, for the first With multiple variables, the data deviation can be expressed as:

[0067] in, This is the current measurement value. As the first data representation, For clean samples, robust scaling It is a small positive number. As a dimensionless numerical value, it can be compared between variables of different types.

[0068] For example, node 3 actively injects into the current measurement. First data representation Clean sample robust scale , After substituting, we get The results indicate that the variable deviates from the counterfactual reference, but whether this deviation constitutes a forgery injection needs to be determined by estimating the residuals in conjunction with the physical network state.

[0069] S420 determines the physical network state estimation residuals based on the first state characterization and the node power flow equations.

[0070] The system obtains node-level or branch-level residuals based on the first-state characterization and nodal power flow equations. For nodes... The residual can be written as:

[0071] in, and From the first state representation, and The residual is given by the current first matrix and the nodal power flow equations. This residual is expressed as per-unit power and can be located to a specific node.

[0072] For example, the first state representation of node 3 is given , The nodal power flow equations are given , The physical network state estimation residual is then... If the current suspected counterfeit measurement is taken... Backfilling, then the residual at node 3 This comparison shows that falsified measurements can disrupt physical conservation relationships.

[0073] S430 combines data deviation and physical network state estimation residuals into a joint discriminant characterization.

[0074] The system incorporates data deviation, physical network state estimation residuals, and variable influence paths into the joint discriminant representation. The joint discriminant representation can be expressed as follows: ,in Representing variables The corresponding node or branch, This represents the path of variable influence. This representation preserves statistical, physical, and locational information, avoiding the compression of all anomalies into a single, uninterpretable score.

[0075] For example, for the active power injection variable at node 3, the joint discriminant characterization is as follows: This characterization indicates that the variable deviates from the counterfactual reference, its corresponding node physical residual exceeds the normal range of clean samples, and the affected path is concentrated on node 3 and its adjacent branches.

[0076] S500, based on the data deviation and the estimated residual of the physical network state, identifies forged data features that satisfy statistical distribution but violate physical conservation relationships.

[0077] In this embodiment, the system does not individually search for the variable with the largest data deviation, nor does it individually search for the node with the largest physical residual. Instead, it identifies data variables that satisfy the statistical consistency criterion (i.e., the first criterion) but fail the physical conservation criterion (i.e., the second criterion). This combined condition corresponds to the typical characteristics of data injection fraud, where the attacker makes the data appear to conform to a statistical distribution but fails to simultaneously satisfy the physical conservation relationships of the power grid. Specifically: S510 performs the first judgment on the deviation of the data.

[0078] The system sets a statistical consistency threshold based on the distribution of data deviation in the clean samples. If a certain variable Not higher than If, statistically, the variable can be considered not to have clearly crossed the boundary; if Higher than If the value is too low, the variable is closer to a common anomaly or obvious noise. Thresholds can be formed from quantiles of clean samples, avoiding the invalidation of fixed empirical values ​​in different power grid regions.

[0079] For example, in a clean sample, the 99th percentile of data deviation is Node 3 has active variable injection. Therefore, the first criterion is passed. This result does not necessarily mean that the variable is normal, but rather that the variable has statistical concealment and its physical conservation state needs further examination.

[0080] S520 performs a second discrimination on the residuals of the physical network state estimation.

[0081] The system estimates the distribution of residuals based on the physical network state in the clean sample and sets a physical conservation threshold. If the residual of the node or branch corresponding to the variable is higher than... If the residual is not higher than 1, it indicates that the current data violates the physical conservation principle; if the residual is not higher than 1, it indicates that the current data violates the physical conservation principle. If so, it indicates that the data is compatible with the physical network state. The second criterion uses the node power flow relationships under the current topology version, thus reflecting the actual physical structure of the power grid.

[0082] For example, the 99th percentile of the node-level physical residual is The residual for estimating the physical network state corresponding to the active power injection variables at node 3 is... The value is above the threshold, therefore the second discrimination fails. Since the variable passes the first discrimination but fails the second, the system identifies it as a forged data feature.

[0083] S530, data variables that pass the first discrimination but fail the second discrimination are marked as forged data features.

[0084] The system will write data variables that meet the combination conditions into the forged data feature set. The system also outputs the affected nodes and affected branches. For the active power injection variables at node 3, the system output... Set of affected nodes Affected branch set The output includes both the time index 501 and the topology version. This facilitates subsequent auditing and maintenance location.

[0085] The contrast with counterexamples illustrates the effectiveness of this combined discrimination. If the voltage variable at node 2... However, the corresponding physical residual is If the variable deviates significantly statistically but is still physically explainable, it is more likely to be ordinary measurement noise or communication jitter. If a variable... and If the variable fails the first test but fails the second test, it may correspond to a real fault or obvious anomaly. Only variables that pass the first test but fail the second test are marked as having falsified data characteristics.

[0086] S600 performs location, sample masking, and model updates based on the characteristics of forged data.

[0087] After obtaining the characteristics of the forged data, the affected nodes or branches are further identified, the contaminated training samples are masked, and the first model is updated based on the masked samples.

[0088] The system locates affected nodes or branches based on the influence of variables on the path. For example, if... And the path of influence is The system will then write node 3, branch (2,3), and branch (3,4) into the alarm log. The alarm log also includes the topology version. Detection window 501, data deviation 3.00, physical residual And the corresponding channel identifier CP3.

[0089] When samples are masked, the system does not delete the original records, but instead marks the contaminated variables and their directly affected derivative measurements as untrainable. For window 501, the active injection of node 3 and the local derivative features it affects are not included in the digital twin model training sample pool; measurements of node 1 and node 2 within the same window that pass the second discrimination can still be retained as clean samples. This preserves the audit trail while preventing long-term attacks from contaminating the model parameters.

[0090] During model updates, the system only uses the masked training samples. If the same variable exhibits forged data characteristics in multiple consecutive windows, the system freezes the contribution of that variable channel to the model update and sends a review task to the operations and maintenance personnel. The updated first model still uses the first matrix as a priori constraints and does not change the core detection chain due to a single masking.

[0091] This application also provides a power grid data fusion detection system. For example... Figure 2 As shown, the system includes a data acquisition unit, a first modeling unit, an inference unit, a discrimination unit, and an isolation unit. Each unit can be deployed on a scheduling master server, an edge computing device, or a data processing platform composed of both. The units communicate with each other via message queues, shared data caches, or service interfaces, exchanging fused detection samples, first state representations, first data representations, and joint discrimination representations. Specifically: The data acquisition unit acquires network layer measurement data and a first matrix, and performs time-series correlation between the two to form a fused detection sample. This unit may contain an initialization subcomponent, a window alignment subcomponent, and a topology version binding subcomponent. The initialization subcomponent maintains bus, branch, and switch states and channel mappings; the window alignment subcomponent receives node voltage measurements, branch current measurements, and node injection measurements according to a unified time index; the topology version binding subcomponent binds the current measurement matrix with the corresponding first matrix to form a fused detection sample. The fused detection sample output by the data acquisition unit serves as the common data entry point for subsequent units.

[0092] The first modeling unit is used to construct a first model using a first matrix as a priori constraint, and generates a first state representation from this model. This unit may contain a first coupling weight generation subcomponent, a message passing subcomponent, and a physical consistency constraint subcomponent. The first coupling weight generation subcomponent transforms the first matrix into first coupling weights between nodes; the message passing subcomponent propagates node features along effective electrical connections in the graph neural network; and the physical consistency constraint subcomponent corrects the model output using node power flow constraints. The unit outputs a first state representation arranged by node and branch index.

[0093] The inference unit is used to construct a second model by combining the nodal power flow equations, and then uses this second model to perform counterfactual inference on the current data variables in the fused detection samples. This unit may contain a variable layer construction subcomponent, a physical constraint layer construction subcomponent, and an intervention execution subcomponent. The variable layer construction subcomponent maps measurement channels to variable nodes; the physical constraint layer construction subcomponent writes the nodal power flow equations and the first matrix into the inter-variable constraints; and the intervention execution subcomponent replaces the data variables to be tested and generates the first data representation. This unit also outputs the variable influence path for subsequent localization.

[0094] The discrimination unit is used to obtain data deviation and physical network state estimation residuals based on the fused detection samples, the first state representation, and the first data representation. This unit may contain a deviation generation subcomponent, a physical residual generation subcomponent, and a joint representation cache subcomponent. The deviation generation subcomponent outputs the data deviation for each variable to be tested; the physical residual generation subcomponent outputs the physical network state estimation residuals for the corresponding node or branch; and the joint representation cache subcomponent stores the data deviation, physical network state estimation residuals, variable identifiers, and influencing paths.

[0095] The isolation unit is used to estimate residuals based on data deviation and physical network conditions, and to identify spoofed data characteristics that satisfy statistical distributions but violate physical conservation relationships. This unit may contain a first discrimination subcomponent, a second discrimination subcomponent, and an alarm output subcomponent. The first discrimination subcomponent confirms whether the current variable maintains statistical concealment; the second discrimination subcomponent confirms whether the variable violates the physical conservation of the power grid; the alarm output subcomponent outputs the affected node identifier, the affected branch identifier, and the spoofed data injection alarm identifier.

[0096] For example, the data acquisition unit outputs fused detection samples. The first modeling unit outputs the physically consistent active power representation of node 3. The inference unit generates the first data representation for the active power injection at node 3, and the discrimination unit obtains the data deviation of 3.00 and the physical residual. Based on this, the isolation unit outputs a fake data injection alarm for node 3 and its adjacent branches. This data stream indicates that the units in the system are not isolated functional modules, but rather generate physically interpretable detection results step by step around the same fused detection sample.

[0097] It should be noted that the first model can be replaced by a topologically constrained graph filtering model, a physically constrained state-space model, or other models that can accept the prior constraints of the first matrix. The alternative model still needs to output the first state representation and be able to provide the second model with counterfactual inference. This substitution will not change the core chain of this application, namely, synchronous fusion, prior constraint modeling, counterfactual inference, dual residual acquisition, and feature injection isolation.

[0098] Similarly, the variable layer in the second model can be organized as node-level, branch-level, or region-level variables. For transmission network scenarios, node voltage, node injected power, and branch power flow variables can be set as the main focus; for distribution network scenarios, switch status, transformer area boundaries, and feeder current variables can be added. Regardless of the variable granularity, the intervention layer should keep the first matrix and the physical constraints of adjacent nodes unchanged, so that the first data representation has the same physical context.

[0099] Furthermore, the threshold can be formed by a combination of clean sample quantiles, robust statistical scales, or operating region benchmarks. The threshold formation method is an implementation parameter and does not limit the scope of protection of the claims. As long as the discrimination process retains the combined relationship between the first and second discriminations, isolation of statistically concealed forged data characteristics can be achieved.

[0100] To enable those skilled in the art to fully reproduce the detection chain of this application, the following continues to illustrate the end-to-end processing from fused detection samples to the output of forged data features, using the 501st detection window as an example.

[0101] like Figure 3 As shown, the horizontal axis represents the detection window number, and the vertical axis of the upper subplot represents the data deviation. The lower vertical axis represents the residual of the physical network state estimation. The two horizontal lines represent the statistical consistency thresholds. and physical conservation threshold The relationship between the two curves indicates that the deviation of the data within the forged injection window did not exceed [a certain threshold]. And the physical residual exceeds As is easily understood, within window 501, the samples are fused for detection. It carries measurements of node 1 voltage, node 2 voltage, branch (2,3) current, and active power injection at node 3, along with a topology version. and the first matrix Because branch (1,4) is in If the connection is broken, the model is not allowed to interpret the current measurement using the valid branch relationship between node 1 and node 4 in any subsequent step. This constraint is passed from the sample formation stage to the first model, the second model, and the physical residual model.

[0102] After S200 outputs the first state representation, the system does not directly use this representation as the final detection result. The first state representation first enters S300 as a counterfactual substitute value source. Taking the active power injection at node 3 as an example, the current measurement is... The alternative value given by the first state representation is In the second model, the system retains the admittances and topology versions of the adjacent nodes and branches of node 3, replacing only the active power injection variables of node 3. The first data representation generated after the replacement still belongs to the same detection window, thus avoiding the introduction of external data from different operating states.

[0103] In S400, the system simultaneously reads the current measurement and the first data representation. If judged solely by the distance between the current measurement and the historical mean, the active power injection at node 3 might not have clearly exceeded the limits, as an attacker could make the value fall within the historical statistical range. If judged solely by the global state estimation residual, the system might detect an increase in residuals but struggle to pinpoint which data variable triggered the physical inconsistency. This application addresses this by storing the counterfactual comparison of each variable and its corresponding physical residual as a joint discriminant representation, enabling subsequent identification steps to simultaneously observe variable-level deviations, node-level residuals, and impact paths.

[0104] For example, the joint discriminant characterization of the active power injection variables at node 3 is as follows: Where 3.00 represents the data deviation, and 0.29 represents the physical network state estimation residual for node 3. The influence path indicates that this variable mainly affects node 3, as well as branches (2,3) and (3,4). If another variable... The joint discriminant characterization is If the variable does not possess the characteristics of statistically covert forgery injection, then the system avoids coarsely marking the entire window as an anomaly through this variable-level representation.

[0105] Regarding threshold formation, the data deviation threshold and physical residual threshold All can be generated from clean samples. Clean samples refer to samples extracted from historical windows where the topology version, device operating mode, and measurement channel quality have all passed verification. The system can generate quantile thresholds for each node, each type of variable, or each operating region. For the active power injection variable at node 3, if the 99th percentile of the data deviation in the clean sample is 3.20, then... It can still be considered statistically consistent; if the 99th percentile of the physical residual at node 3 is ,but It clearly failed the second criterion.

[0106] It should be noted that the above threshold setting method is not restrictive. For areas with large load fluctuations, clean samples can be divided according to operating periods; for areas with a high proportion of renewable energy integration, clean samples can be divided according to power generation output intervals; for distribution networks with frequent topology switching, clean samples can be divided according to topology version families. Regardless of the division method used, the threshold serves the same combinational logic: the first discrimination is used to identify the concealment of the attack sample, and the second discrimination is used to identify its damage to the physical relationship of the power grid.

[0107] like Figure 3 As shown, windows 501 to 503 serve as statistically concealed forgery injection windows, with data deviation... Maintaining statistical consistency threshold The physical network state estimation residual of node 3 is nearby and has not exceeded the threshold. Exceeding the physical conservation threshold .

[0108] Furthermore, if the voltage of node 2 experiences a momentary deviation due to communication jitter, the data deviation may increase, but the power flow relationship between nodes remains largely consistent, and the residual of the physical network state estimation will not synchronously exceed the threshold. In this case, the system classifies it as a normal anomaly or channel noise candidate and does not output forged data characteristics. Conversely, if an attacker carefully selects the active power injection value of node 3 to fall within the historical statistical distribution, the data deviation may not be high, but this value will disrupt the power conservation between node 3 and its adjacent branches, and therefore will be captured by the second discrimination method of this application.

[0109] Furthermore, genuine equipment failures and spoofed data injections can be distinguished. Genuine failures typically increase both data deviation and physical network state estimation residuals simultaneously, and the impact path may extend along multiple physically adjacent nodes. Spoofed data injections, on the other hand, may appear statistically acceptable for one or a few measurement variables, but exhibit locally interpretable conservation conflicts after physical residuals and counterfactual substitutions. The system can send the former to the fault diagnosis process and the latter to the data security alarm process, thereby avoiding confusion between spoofed data injection detection and routine fault detection.

[0110] like Figure 4 As shown, the horizontal axis represents the data deviation. The vertical axis represents the residuals from the physical network state estimation. Two threshold lines and The plane is divided into four regions: lower left for normal measurements, lower right for ordinary noise, upper right for real faults, and upper left for spoofed data injection. The four types of scattered points cluster in their respective regions with different labels, demonstrating that the combined discrimination rule can effectively distinguish between different types of data. It's easy to understand that in the dual-threshold discrimination plane, normal measurements are typically located in regions where both data deviation and physical residual are below the threshold, while ordinary noise may manifest as data deviation exceeding the threshold. However, the physical residual still did not exceed Real-world faults may cause both to increase simultaneously; statistically covert forgery injections, however, fall into the category where the data deviation is no higher than [a certain value]. The physical residual is higher than The area.

[0111] Regarding the system caching strategy, when the discrimination unit saves the joint discrimination representation, it not only saves... and The system stores two values, along with variable identifiers, channel identifiers, topology versions, detection windows, and impact paths. This caching strategy allows isolated units to trace the source of each alarm. If subsequent maintenance personnel need to review the alarms, they can trace back from the alarm record to the original network layer measurement, the corresponding first matrix, the first model output, the first data representation, and the physical residual generation process.

[0112] In situations where multiple variables are attacked simultaneously, the system can test the set of variables to be tested. Each variable in the system generates a first data representation, which is then sorted according to the joint discriminative representation. If the active power injection at node 3 and the voltage at node 4 are both falsified, the system obtains... and If the paths affected by the two overlap, the system merges the paths when outputting the affected nodes and branches, but still retains the independent identifier of each variable. This allows for both the output of regional-level alarms and the preservation of variable-level evidence.

[0113] For scenarios involving missing measurements, the system has already written a quality identifier in S100. If a variable is missing, S300 can choose not to perform counterfactual intervention on that variable, but instead mark it as undiscriminable. Undiscriminable states are not directly marked as forged data characteristics. The system only performs the combined discrimination of S500 when the current variable has valid measurements, first data representation, data deviation, and physical network state estimation residuals. This process avoids misjudging communication interruptions as data forgery.

[0114] For topology switching windows, the system can either split the window into a pre-switching sub-window and a post-switching sub-window, or mark the window as temporarily deferred. If splitting is used, each sub-window is bound to a corresponding first matrix; if deferred, the window is not included in the model update sample pool. Regardless of the method, the system does not allow measurements from two different topology versions to be placed in the same fusion detection sample for physical residual discrimination.

[0115] Regarding model updates, sample masking does not alter the detection loop of claim 1. The initial detection only requires forming fused detection samples, generating a first state representation, obtaining a first data representation, acquiring double residuals, and identifying forged data features. Sample masking and model updates are subsequent maintenance measures, their purpose being to prevent identified forged samples from entering the training sample pool.

[0116] In one deployment, the data acquisition unit runs on an edge node close to the acquisition side, responsible for channel mapping, window alignment, and topology version binding; the first modeling unit and inference unit run on the scheduling master server, responsible for model inference and causal intervention; the discrimination unit and isolation unit can be deployed on the same server to reduce data transmission latency. In another deployment, all units can run as different services within the same data processing platform. These deployment differences do not alter the data flow relationships between the units.

[0117] In another implementation, the fused detection samples can include phase angle measurements, frequency measurements, switch telemetry measurements, or regional power flow exchange measurements. New incremental measurements only need to establish a correspondence in the channel mapping table and determine the parent variable and physical constraints in the second model to be included in the same detection link.

[0118] In another implementation, data deviation can be achieved using robust scaling, clean sample quantile distance, local window scale, or regional benchmark scale. Physical network state estimation residuals can be node active and reactive power residuals, branch power balance residuals, or node current injection residuals. All residual forms should meet the same requirement: they should reflect whether the current data variables violate the physical conservation relationships of the power grid and be able to be mapped back to nodes or branches.

[0119] In another implementation, the second model can be structured at different granularities, such as nodes, branches, or regions. Node-level models are suitable for locating anomalies in a single busbar or transformer substation; branch-level models are suitable for locating inconsistencies in measurements at both ends of a line; and region-level models are suitable for cross-site data fusion detection. Regardless of the granularity used, counterfactual interventions should maintain the first matrix and adjacent physical constraints unchanged.

[0120] As is easily understood, this application does not simply use graph neural networks, causal models, and power flow equations in parallel, but rather establishes a clear data production and consumption chain. That is, S100 generates fused detection samples, S200 consumes the fused detection samples and generates a first state representation, S300 consumes the first state representation and generates a first data representation, S400 consumes the first data representation and generates double residuals, and S500 consumes the double residuals and generates forged data features.

[0121] In addition, in multi-topology operation scenarios, the system can maintain an independent clean sample statistics table for each topology version.

[0122] For example, topology version The corresponding branch (1,4) is closed. Topology version The corresponding branch (1,4) is disconnected. If... The clean sample threshold below is directly used The physical coupling relationship between node 1 and node 4 will be incorrectly preserved, resulting in a distortion of the reference range of the physical network state estimation residual.

[0123] Therefore, the system is formed and In this case, you can first group by topology version, and then form thresholds within each version by load level or runtime.

[0124] Moreover, in regional power grids, the fusion detection samples can be expanded according to regional boundaries.

[0125] For example, region A contains nodes 1 to 4, and region B contains nodes 5 to 8, connected by a connecting branch (4,5). When the connecting branch is closed, there is an inter-region coupling term in the first matrix; when the connecting branch is open, the inter-region coupling term is invalid. In S200, the system generates a first coupling weight based on the current first matrix, ensuring that spoofing injections in region A are not masked by historical correlation errors in region B. Therefore, this application is applicable to single-station, distribution feeder, and cross-regional data fusion detection.

[0126] Moreover, in multi-source measurement scenarios, the same physical object may be measured by different network layer channels.

[0127] For example, the active power injection at node 3 can be provided by the automated scheduling measurement channel or by the edge acquisition device. In S100, the system stores channel identifiers and quality identifiers for different channels respectively. In S300, multiple measurements under the same physical object are treated as correlated variables in the variable layer. If two channels are statistically normal, but one channel violates the physical conservation relationship, counterfactual inference and physical residuals can help the system locate the specific channel, rather than simply outputting a node-level anomaly.

[0128] Furthermore, in scenarios where both missing and forged data occur simultaneously, the system first processes the missing data flags and then handles forgery and injection detection.

[0129] For example, if a voltage measurement at node 4 is missing, and active power injection at node 3 is suspected of being spoofed, the system applies a quality label constraint to the voltage at node 4 in the second model, and does not treat the missing measurement as a discriminant variable; at the same time, counterfactual intervention can still be performed on the active power injection at node 3. In this way, the missing variable will not be misjudged as a spoofed injection, and the spoofed variable will not completely skip detection due to the absence of adjacent measurements.

[0130] In addition, in scenarios with significant communication latency, the unified time index can be used in conjunction with the original timestamp.

[0131] The system can first group measurements by time window, and then use the original timestamps to check the measurement sequence within the same window. If the branch current measurement lags significantly behind the node voltage measurement, the system can lower the quality rating of that branch measurement and reduce the weight of its parent variable in the counterfactual inference. This processing will not change the detection steps in the claims.

[0132] In scenarios where the generation of the first state representation fails, the system can output a model unusable flag without performing forgery injection detection. For example, if the first matrix lacks key branch parameters, and S200 cannot generate a reliable first state representation, then S300 should not use the incomplete representation to generate counterfactual data. The system records this window as indicating incomplete model input and prompts for supplementary topology data. This boundary condition ensures the reliability of the first data representation source, avoiding the creation of erroneous alarms using incomplete physical models.

[0133] Regarding the threshold update cycle, the system can update the clean sample statistics table daily, weekly, or based on the number of topology version changes. During updates, windows already marked as having forged data characteristics are excluded, as are windows with unclear topology transitions. If these windows are not excluded, data injected by attackers over a long period may gradually enter the clean samples, causing threshold drift. The sample masking mechanism in S600 of this application is designed to maintain the stability of the first and second discrimination benchmarks in S500.

[0134] Regarding alarm display, the system can combine forged data characteristics, affected nodes, affected branches, topology version, detection window, data deviation, and physical network state estimation residuals into a single alarm record. For example, an alarm record can be displayed as: Window 501, Topology Version Suspected variables The first judgment passed, the second judgment failed, the affected node is node 3, and the affected branches are branches (2,3) and (3,4). This record provides verifiable evidence for operation and maintenance personnel, rather than just giving an abstract anomaly score.

[0135] In terms of model interpretation, the system can show the changes in residuals before and after counterfactual substitutions along the path of variable influence.

[0136] For example, before the active power injection replacement at node 3, the physical residual of node 3 is: After the replacement, the physical residual at node 3 decreased to The local residuals of branches (2,3) and (3,4) also decreased synchronously. This chain of changes indicates that the active power injection variable at node 3 is the main triggering variable causing the physical conservation conflict.

[0137] For security auditing, the system retains original measurements, fused detection samples, first-state representations, first-data representations, data deviations, physical network state estimation residuals, and final alarm records. Each object has a time index and topology version. Auditors can trace back from the final alarm to the original network layer measurement, or reproduce the original measurement forward to the final judgment result.

[0138] It should be noted that, assuming the attacker injects statistically covert forged data into the active injection channel of node 3, the injection magnitude keeps the data deviation near the statistical consistency threshold. Assume a total of 2000 detection windows are generated, including 1200 normal windows, 500 statistically covert forged injection windows, 200 ordinary measurement noise windows, and 100 real fault windows. Subsequently, pure statistical residual method, pure state estimation residual method, and the fusion detection method of this application are used for processing, respectively. The pure statistical residual method only identifies anomalies based on the deviation of the measured value from the historical mean; the pure state estimation residual method only identifies anomalies based on the weighted least squares state estimation residual.

[0139] Assume the detection accuracy is the proportion of correctly identified results to the total number of detection windows. During detection, the accuracy of the pure statistical residual method was 72.3%, the accuracy of the pure state estimation residual method was 81.6%, and the accuracy of the method in this application was 96.8%. It is easy to understand that the improved accuracy of the method in this application mainly stems from the effective identification of statistically covert forgery injections.

[0140] The false alarm rate is assumed to be the proportion of normal windows incorrectly labeled as forged injections. During detection, the false alarm rate was 8.5% for the pure statistical residual method, 5.2% for the pure state estimation residual method, and 1.3% for the method in this application. The reason for the lower false alarm rate of method C in this application is that the combined conditions of statistical consistency judgment and physical conservation judgment can exclude ordinary noise and physically explainable disturbances from alarms.

[0141] Let's assume the false negative rate is the proportion of statistically covert forgery injection windows that are not detected. The false negative rate of the pure statistical residual method is 56.4%, the false negative rate of the pure state estimation residual method is 32.8%, and the false negative rate of the method in this application is 4.2%. This is because the pure statistical residual method has the highest false negative rate because the attacker has controlled the injected values ​​within the statistical distribution range, and the pure statistical method cannot identify this type of attack. Although the pure state estimation residual method introduces physical residuals, it does not embed the topological admittance matrix into the model message passing channel and lacks a counterfactual inference mechanism, so it may still be bypassed when the attacker adjusts multiple related variables at the same time. The method in this application generates physically consistent state representations under topological prior constraints through a graph neural network digital twin model, and uses a structural causal model to perform counterfactual inference to obtain data deviation, so that statistically covert but physically non-conservative forgery injections can be effectively isolated.

[0142] Example 2 In this embodiment, after forming a joint discriminant characterization in S400, the system can also construct a conserved residual propagation map and use this map as auxiliary evidence for identifying forged data features in S500. However, when an attacker simultaneously modifies multiple measurement variables, the data deviation of a single variable and the residual of a single node may be dispersed, causing each variable to appear to be within the statistically permissible range. However, the combined effect of multiple variables still violates Kirchhoff's current law and power conservation relationship reflected in the node power flow equations. To address this, a conserved residual propagation map can be used to map the residual changes generated by counterfactual substitution to nodes and branches allowed by the current topology, enabling collaborative forgery injection to be identified via physical paths.

[0143] In this embodiment, the system further decomposes the joint discriminant representation obtained in S400 into three categories of objects: variable-side, conservation constraint-side, and topology propagation-side. The variable-side objects are the data variables to be tested; the conservation constraint-side objects are node power balance constraints, node current injection constraints, or branch power flow balance constraints; and the topology propagation-side objects are the valid branches determined by the current first matrix. All three categories of objects carry the same topology version identifier, thus preventing the mixing of residual contributions from different topology versions in the same graph.

[0144] For the data variables to be tested The system first reads the physical network state before the replacement to estimate the residual. , then read Replace with the residuals after the first data representation .in Indicates the index of a node constraint or branch constraint. The system can generate residual contributions. ,in To prevent tiny positive numbers with a denominator of zero. A dimensionless quantity used to represent variables. Constraints The contribution of residual improvement; when replacing When the residual of a certain node or branch decreases significantly, it indicates that there is a stronger causal contribution relationship between the variable and the conservation conflict.

[0145] Subsequently, the system establishes topology propagation gating based on the current first matrix. For two constraint objects... and If the two are connected through a valid branch in the current topology version, then the gating value is... Set to 1; if the corresponding branch is disconnected, or if the two only have a historical statistical correlation but no current physical connection, then... Set to 0. The system can also generate normalized propagation weights based on the corresponding branch admittance amplitudes. And obtain the residual contribution after propagation. This process ensures that residual contributions can only extend along paths permitted by the current power grid physical layer, avoiding the misinterpretation of communication network correlations as physical conservation conflicts.

[0146] For example, in the topology version Next, branch (1,4) is disconnected, while branches (2,3) and (3,4) are closed. The system injects active power variables into node 3. After performing the counterfactual replacement, the residual contribution of node 3 is 0.93, the residual contribution of branch (2,3) is 0.55, and the residual contribution of branch (3,4) is 0.50. The system's voltage variable at node 4... After performing the counterfactual replacement, the residual contribution of node 4 is 0.88, and the residual contribution of branch (3,4) is 0.47. Since the residual contributions of the two variables overlap at branch (3,4), and there is a currently valid physical path between node 3 and node 4, the system will... and They are grouped into the same conservation conflict cluster.

[0147] If another variable and It has a high statistical correlation in historical data, but the current topology version If the middle branch (1,4) is broken, then topology propagation gating makes the propagation value between node 1 and node 4 0. Even if Data deviation and Even if they are similar, the system will not merge them into the same conserved conflict cluster based solely on statistical correlation.

[0148] When performing identification on the S500, the system can perform combined discrimination for each conserved conflict cluster. If multiple variables within the same cluster satisfy the first discrimination, and the post-propagation residual contributions of the cluster are concentrated in the same physical path or the neighborhood of the same node, then the system marks the cluster as having collaboratively forged data characteristics. The output results may include the variable identifier within the cluster, the main triggering node, the main triggering branch, the topology version, the residual contribution ranking, and the residual changes before and after the counterfactual substitution.

[0149] It should be noted that the system does not simply output alarms based on the independent threshold of variables. Instead, it establishes a propagable causal evidence graph between the counterfactual residual decrease, the current first matrix, and the physical conservation constraints. This enables it to identify statistically hidden fake data injections that are formed by the collaboration of multiple measurement variables.

[0150] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit described above can be implemented in hardware.

[0151] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for detecting fusion of power grid data, characterized in that, include: Obtain network layer measurement data and the first matrix; Based on the network layer measurement data and the first matrix, a fusion detection sample is constructed; Based on the first matrix, a first model is constructed, and a first state representation is generated through the first model; Based on a preset second model, counterfactual inference is performed on the current data variables to obtain a first data representation, wherein the fused detection sample includes the current data variables; based on the fused detection sample, the first state representation, and the first data representation, the data deviation and physical network state estimation residuals are determined; Based on the data deviation and the physical network state, the residual is estimated to determine the characteristics of the forged data.

2. The method according to claim 1, characterized in that, The process of temporally correlating the network layer measurement data and the first matrix to form fused detection samples includes: The network layer measurement data includes node voltage measurements, branch current measurements, and node injection measurements. The first matrix is ​​constructed based on the bus status, branch status, and switch status. A fusion detection sample is constructed based on the network layer measurement data and the first matrix, and the fusion detection sample carries a topology version identifier.

3. The power grid data fusion detection method according to claim 1, characterized in that, Based on the first matrix, the construction of the first model includes: Transform the first matrix into the first coupling weights between nodes; The first coupling weight is embedded in the first model to constrain the first model to output the first state representation.

4. The power grid data fusion detection method according to claim 1, characterized in that, Constructing the second model includes: A variable layer is established based on the measurement variables in the fusion detection samples; A physical constraint layer is established using nodal power flow equations; An intervention layer is established based on the substitution assignment relationship of the data variable to be tested, wherein the current data variable includes the data variable to be tested.

5. The power grid data fusion detection method according to claim 4, characterized in that, The counterfactual inferences include: Select the data variable to be tested from the current data variables; While keeping the first matrix and the physical constraints of adjacent nodes unchanged, generate the first data representation of the data variable to be tested; The first data representation is then backfilled into the second model.

6. The power grid data fusion detection method according to claim 1, characterized in that, Based on the fused detection samples, the first state representation, and the first data representation, determining the data deviation and physical network state estimation residuals includes: The data deviation is determined based on the fused detection samples and the first data representation; The physical network state estimation residuals are determined based on the first state characterization; A joint discriminant characterization is constructed by estimating the residuals based on the data deviation and the physical network state.

7. The power grid data fusion detection method according to claim 6, characterized in that, The process of estimating residuals based on the data deviation and the physical network state to determine the characteristics of forged data includes: The deviation of the data is first determined; A second discrimination is performed on the physical network state estimation residuals; Data variables that pass the first discrimination but fail the second discrimination are marked as forged data features.

8. The power grid data fusion detection method according to claim 1, characterized in that, Also includes: The affected nodes or branches are determined based on the characteristics of the forged data. The training samples of the first model are anomaly masked; The first model is updated based on the masked training samples.

9. A power grid data fusion detection system, characterized in that, include: A data acquisition unit is used to acquire network layer measurement data and a first matrix, and to construct a fusion detection sample based on the network layer measurement data and the first matrix; The first modeling unit is used to construct a first model based on the first matrix and generate a first state representation through the first model. An inference unit is used to perform counterfactual inference on the current data variables based on a preset second model to obtain a first data representation, wherein the fusion detection sample includes the current data variables; The discrimination unit is used to determine the data deviation and physical network state estimation residual based on the fused detection sample, the first state representation and the first data representation; An isolation unit is used to estimate the residual based on the data deviation and the physical network state, and to determine the characteristics of forged data.

10. The power grid data fusion detection system according to claim 9, characterized in that, A discrimination result caching channel is provided between the discrimination unit and the isolation unit. The discrimination result caching channel is used to store the data deviation, the physical network state estimation residual, and the corresponding data variable identifier. The isolation unit is also used to output the affected node identifier, the affected branch identifier, and the forged data injection alarm identifier.

Images