Physical data dual boot grid fdia detection and recovery method and system

Abstract

This invention relates to a method and system for power grid FDIA detection and recovery under dual physical data guidance. The dual physical data guidance includes data-driven feature learning guidance and power system physical model constraint guidance. The method employs a self-encoding structure of "data-driven encoder + physical-guided decoder," explicitly representing the encoder's latent space as power grid state variables such as bus complex voltages. Based on node admittance matrices, branch parameters, AC power flow equations, and measurement selection matrices, these power grid state variables are mapped to reconstructed measurement vectors. FDIA is detected by comparing the residuals of the original and reconstructed measurements. Upon detecting an attack risk, the method locates the suspected attacked bus, branch, or measurement device based on the channel residuals, and simultaneously outputs a recovery reference measurement that satisfies the power system physical constraints. This invention improves the physical interpretability and physical consistency of FDIA detection.

Description

Technical Field

[0001] This invention relates to the field of power system safety monitoring technology, and in particular to a power grid FDIA detection and recovery method and system guided by physical data. Background Technology

[0002] With the rapid development of smart grids and advanced metering architectures (AMIs), the number of smart terminals, measurement devices, communication equipment, and automated control systems connected to distribution networks is constantly increasing. Power system operation is also becoming increasingly reliant on real-time measurement data, automated analysis models, and intelligent dispatch decisions. While the informatization, networking, and intelligence of the power grid are continuously improving, the power system also faces more complex cybersecurity threats. Among these, False Data Injection (FDIA) attacks, which can mislead state estimation and dispatch decisions by tampering with measurement data and constructing stealthy attack vectors using grid models, are gradually becoming one of the most threatening types of cyberattacks in smart grids.

[0003] Existing FDIA detection methods broadly include traditional state estimation residual detection methods and data-driven detection methods. Traditional state estimation methods have advantages such as clear physical meaning, clear computational process, and good engineering foundation, and utilize measurement residuals for anomaly detection, thus finding widespread application in power system operation monitoring and dispatch. However, traditional state estimation methods often fail to effectively identify covert spurious injection attacks and are easily bypassed by attack vectors. On the other hand, while existing deep learning methods can learn complex nonlinear features from large amounts of historical measurement data and have good identification capabilities for some FDIA attacks, most methods are essentially still data-driven classification or ordinary autoencoder reconstruction frameworks. Their detection results mainly rely on the distribution and statistical correlation of training data, lacking explicit modeling of grid state variables and the physical mechanisms of the power system. Although some methods can achieve data reconstruction or anomaly recovery, their recovery results are usually still feature reconstructions in a statistical sense, making it difficult to recover grid state variables with clear physical meaning, and also difficult to generate physically consistent reconstructed measurement vectors based on AC power flow equations. Therefore, model interpretability and physical consistency remain insufficient. Meanwhile, the ordinary attention mechanism mainly assigns weights based on the similarity of data features. If there is a lack of constraints on power grid topology and electrical connection relationships, it is easy to learn pseudo-correlation relationships that are statistically related but physically invalid. In scenarios with random load fluctuations and measurement noise, such pseudo-correlation relationships can easily lead to the model being overly sensitive to local anomalies, resulting in a high false alarm rate.

[0004] Furthermore, if the method can only identify spoofed data injection attacks but cannot reasonably recover the attacked measurements and further locate the source of the anomaly, even if the system can detect the anomaly, it will still be difficult to obtain reliable power grid operating status and measurement information. In this case, subsequent state estimation, power flow analysis, and dispatch control may still be based on distorted or missing measurements, and the dispatch center will also find it difficult to determine in a timely manner which bus, branch, or critical equipment is involved in the anomaly, thus making it impossible to take targeted control measures. Although some existing recovery methods can achieve data reconstruction or anomaly recovery, their recovery results usually lack a clear meaning of the power grid's physical state, making it difficult to guarantee that the recovered measurement data satisfies the AC power flow equations and Kirchhoff's laws, thereby affecting the safe and stable operation of the power grid. Therefore, in addition to attack detection, it is equally important to restore the physically consistent attacked measurements and to locate and interpret the abnormal measurements or affected power grid areas.

[0005] In summary, existing FDIA detection and recovery methods still have the following shortcomings: traditional residual-based bad data detection methods are difficult to identify covert attack vectors; existing deep learning methods lack interpretability and lack physical constraints of the power system, making them prone to learning spurious correlations; existing recovery methods cannot guarantee that recovered measurements satisfy physical mechanisms such as AC power flow equations; at the same time, most methods still have shortcomings in anomaly localization and physical inconsistency interpretation after an attack, affecting subsequent scheduling decisions and the safe operation of the power grid. Summary of the Invention

[0006] This invention provides a method and system for power grid FDIA detection and recovery with dual physical data guidance, aiming to improve the physical interpretability and physical consistency of the FDIA detection process, and enhance the ability to detect, recover and locate covert spoofed data injection attacks.

[0007] According to a first aspect of the present disclosure, a method for detecting and recovering a power grid FDIA with dual physical data guidance is provided, comprising the following steps: The system acquires power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch correlation relationships and branch admittance parameters. The measurement selection matrix is ​​configured and constructed based on actual SCADA measurement data or PMU measurement data. The power grid measurement data is input into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. The power grid state variables are input into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, branch head admittance matrix, branch end admittance matrix, AC power flow equation, and measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. By calculating the residual between the power grid measurement data and the reconstructed measurement vector data, and comparing it with the detection threshold, it can be determined whether there is a risk of false data injection attack in the current measurement. When a risk of false data injection attack is determined, the suspected attacked bus, branch or measurement device is located based on the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point. The reconstructed measurement vector is then output as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

[0008] A further technical solution of the present invention is that the data-driven encoder adopts one or more combinations of feedforward neural networks, convolutional neural networks, recurrent neural networks, long short-term memory networks, gated recurrent units, Transformers, or graph neural networks.

[0009] A further technical solution of the present invention is as follows: the data-driven encoder includes a topology-aware attention module, used to fuse the power grid topology and electrical connection relationships during feature extraction; the topology-aware attention module constructs a topology prior matrix A based on at least one of the power grid topology connection relationships, node admittance matrix, branch start-end node relationships, and branch electrical parameters, incorporates the topology prior matrix A into the attention score calculation of node features, and uses a temperature coefficient τ to perform Softmax normalization on the attention score to obtain topology attention weights; the node features are aggregated according to the topology attention weights, and the original features and the aggregated topology features are fused using a gating parameter g to obtain topology enhancement features used to generate the power grid state variables.

[0010] A further technical solution of the present invention is as follows: the power grid state variable output by the data-driven encoder is the predicted bus complex voltage vector, and the steps of obtaining the reconstructed measurement vector in the physical-guided decoder specifically include: The node injection current is obtained by calculating the product between the node admittance matrix and the grid state variables output by the data-driven encoder. Using the branch head admittance matrix and branch end admittance matrix The branch head current is obtained by calculating the product between the branch head current and the grid state variable output by the data-driven encoder. and branch end current ; The complex power vector injected into the bus is obtained by multiplying the complex conjugate of the predicted bus voltage vector and the node injection current element by element. The complex power at the beginning of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the beginning of the branch and the complex conjugate of the current at the beginning of the branch; the complex power at the end of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the end of the branch and the complex conjugate of the current at the end of the branch. The real and imaginary parts of the complex power injected into the bus are extracted to obtain the active power and reactive power injected into the bus; the real and imaginary parts of the complex power at the beginning of the branch are extracted to obtain the active power flow and reactive power flow at the beginning of the branch; the real and imaginary parts of the complex power at the end of the branch are extracted to obtain the active power flow and reactive power flow at the end of the branch. Construct a complete measurement set, which includes bus injected active power, bus injected reactive power, active power flow at the beginning of the branch, reactive power flow at the beginning of the branch, active power flow at the end of the branch, reactive power flow at the end of the branch, bus voltage amplitude, and bus voltage phase angle. The corresponding part of the actual measurement is selected from the complete measurement set using the measurement selection matrix M to obtain the reconstructed measurement vector.

[0011] A further technical solution of the present invention is as follows: In the method model training stage, normal sample measurement data is input into the data-driven encoder to obtain predicted grid state variables, and the predicted grid state variables are mapped to reconstructed measurement vectors through the physical guided decoder. The reconstruction loss is determined based on the difference between the normal sample measurement data and the reconstructed measurement vectors. The gradient of the reconstruction loss is backpropagated to the data-driven encoder through the differentiable physical mapping corresponding to the physical guided decoder to update the parameters of the data-driven encoder. At the same time, the physical model parameters of the physical guided decoder remain unchanged during the training process, so that the grid state variables output by the data-driven encoder generate physically consistent reconstructed measurements after passing through the physical guided decoder.

[0012] A further technical solution of the present invention is as follows: the method further includes a detection threshold determination method, specifically including: inputting the verification collection network measurement data into the trained method model to obtain the corresponding reconstructed measurement, calculating the reconstruction residual of each verification sample, processing the reconstruction residual with a quantile function using quantile parameters to obtain the detection threshold, and adjusting the quantile parameters according to the desired false alarm rate.

[0013] A further technical solution of the present invention is as follows: the method further includes a channel threshold determination method, specifically including: inputting the verification grid measurement data into the trained method model to obtain the corresponding reconstructed measurement, and calculating the channel residual of the k-th measurement channel, using the sum of the mean and several times the standard deviation of the channel residual of the k-th measurement channel on the verification grid measurement data as the channel threshold, or using the preset quantile of the residual distribution of the k-th measurement channel on the verification grid measurement data as the channel threshold.

[0014] A further technical solution of the present invention is as follows: Based on the channel residual and the mapping relationship between the measurement channel and the physical measurement point, the suspected attacked bus, branch or equipment is located. When the channel residual of the k-th measurement channel exceeds the corresponding channel threshold, the k-th measurement channel is marked as an abnormal measurement channel. Based on the abnormal measurement type, a corresponding physical inconsistency interpretation is generated, including: abnormal node injected power residual indicates an abnormal power balance relationship near the corresponding bus; abnormal branch power flow residual indicates an abnormal power flow constraint of the corresponding branch or a power relationship between the two ends of the line; abnormal voltage amplitude or phase angle residual indicates an abnormal deviation between the corresponding bus state quantity and the measurement result.

[0015] According to a second aspect of the present disclosure, a power grid FDIA detection and recovery system with dual physical data guidance is provided, the system comprising: The input data acquisition module is used to acquire power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch correlation relationship and branch admittance parameters. The measurement selection matrix is ​​configured and constructed according to actual SCADA measurement data or PMU measurement data. The data-driven encoder module is used to input the power grid measurement data into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. The physical guidance decoder module is used to input the power grid state variables into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, branch head admittance matrix, branch end admittance matrix, AC power flow equation and measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. The FDIA attack detection module is used to determine whether there is a risk of false data injection attack in the current measurement by calculating the residual between the power grid measurement data and the reconstructed measurement vector data and comparing it with the detection threshold. When the FDIA attack location module determines that there is a risk of false data injection attack, it locates the suspected attacked bus, branch or measurement device based on the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point, and outputs the reconstructed measurement vector as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

[0016] According to a third aspect of the present disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the above-described physical data dual-guided power grid FDIA detection and recovery method.

[0017] According to a fourth aspect of the present disclosure, a non-transitory computer-readable storage medium is provided, the storage medium storing computer instructions that, when executed by a processor, implement the steps of the above-described physical data dual-guided power grid FDIA detection and recovery method.

[0018] The present invention provides a method, system, and medium for power grid FDIA detection and recovery guided by physical data, the beneficial effects of which include: On the one hand, this invention explicitly constrains the latent feature layer of the autoencoder into power grid state variables with physical meaning, and performs physical decoding in conjunction with AC power flow equations, so that the intermediate layer of the model is no longer a black box feature lacking physical meaning, but can represent the physical state of the power grid such as bus voltage and phase angle, thereby improving the interpretability of the model and providing a basis for the location analysis and attack mechanism analysis of false data injection attacks.

[0019] On the other hand, the present invention adopts a joint structure of "data-driven encoder + physical-guided decoder". While using deep learning methods to learn complex measurement features, it introduces power system physical constraints such as node admittance matrix, branch parameters and AC power flow equations, so that the reconstructed measurement results meet the physical laws of the power grid. Thus, while realizing FDIA attack detection, it can restore reference measurements that meet the physical constraints of the power system.

[0020] Meanwhile, this invention introduces a topology-aware attention mechanism into the data-driven encoder. By calculating the attention weights of the node admittance matrix and the prior constraints of the power grid topology, the model focuses on the electrical connection and physical correlation between nodes during the feature aggregation process, reducing the non-physical pseudo-correlation that may be generated by the ordinary attention mechanism. This reduces the false alarm rate caused by factors such as measurement noise and load fluctuations, and improves the robustness of the model.

[0021] In summary, the method of this invention learns the mapping relationship from measurement data to power grid state variables through a data-driven encoder and reconstructs the measurement data based on AC power flow equations and node admittance matrices through a physical-guided decoder. This combines the feature learning capability of the data-driven model with the interpretability and consistency of the power system physical model, improving the physical interpretability and physical consistency of the FDIA detection process and enhancing the ability to detect, recover from, and locate covert spoofing attacks.

[0022] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0023] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0024] Figure 1 This is a flowchart of the power grid FDIA detection and recovery method with dual physical data guidance in this embodiment of the invention; Figure 2 This is a schematic diagram of the overall principle architecture of the power grid FDIA detection and recovery method with dual physical data guidance in this embodiment of the invention; Figure 3 This is a schematic diagram of the topology-aware attention module in an embodiment of the present invention; Figure 4 This is a schematic diagram of the physical guide decoder architecture in an embodiment of the present invention; Figure 5 This is a schematic diagram of the application process of the method model in the embodiments of the present invention; Figure 6 This is a schematic diagram of the power grid FDIA detection and recovery system structure with dual physical data guidance in an embodiment of the present invention; Figure 7 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0025] The present invention will now be described in further detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention. Furthermore, it should be noted that, for ease of description, only the parts relevant to the present invention are shown in the drawings, not the entire structure.

[0026] Before discussing the exemplary embodiments in more detail, it should be noted that some exemplary embodiments are described as processes or methods depicted as flowcharts. Although the flowcharts describe the steps as sequential processes, many of these steps can be performed in parallel, concurrently, or simultaneously. Furthermore, the order of the steps can be rearranged. The process can be terminated when its operation is complete, but may also have additional steps not included in the figures. The process can correspond to a method, function, procedure, subroutine, subroutine, etc.

[0027] The purpose of this invention is to improve the physical interpretability and physical consistency of the FDIA detection process and enhance the ability to detect, recover from, and locate covert spoofing attacks. A self-encoding structure of "data-driven encoder + physically guided decoder" is adopted, combining the feature learning capability of the data-driven model with the constraint capability of the power system physical model. Specifically, the data-driven encoder extracts features from the input measurement data, and the latent space output by the encoder is explicitly designed as power grid physical state variables, such as bus voltage amplitude and phase angle. Subsequently, the decoding end in the self-encoding structure adopts a physically guided approach, which maps the predicted power grid state variables to reconstructed measurement data based on the node admittance matrix, branch electrical parameters, AC power flow equations, and measurement selection matrix.

[0028] During the detection phase, the residual between the input measurement data and the physically reconstructed measurement data is calculated and compared with a detection threshold to determine whether the current measurement is at risk of spoofing data injection attacks. During the recovery phase, based on the estimated grid state variables and the physical-guided decoder, this invention generates reconstructed measurements that satisfy the physical constraints of the power system. These reconstructed measurements are used as recovery measurement estimates or recovery reference measurements, providing a reference for subsequent state estimation, power flow analysis, and dispatch control. Furthermore, during the location and interpretation phase, abnormal measurement points can be determined based on the residuals of each measurement channel and the measurement selection matrix. Suspected abnormal measurement points are mapped to corresponding buses, branches, or measurement devices, achieving preliminary location of the attack-affected area and explanation of the causes of physical inconsistencies. Therefore, this invention can achieve the detection, recovery reference generation, preliminary location, and physical consistency interpretation of spoofing data injection attacks within a unified physical data dual-guided self-encoding framework.

[0029] Furthermore, embodiments of the present invention can also introduce a topology-aware attention module into the data-driven encoder. This module generates a topology prior matrix based on the node admittance matrix, branch connectivity, or grid topology parameters, and incorporates this topology prior into the attention score calculation process, enabling the encoder to simultaneously consider measurement data features and electrical connectivity relationships between grid nodes when estimating grid state variables. In contrast, embodiments of the present invention, by combining the topology-aware attention mechanism, physically-state latent space representation, and physically-guided decoder, can reduce the impact of non-physical pseudo-correlation on feature learning, improve the rationality and robustness of the encoder's output grid state variables, and effectively reduce the false alarm rate.

[0030] In summary, this invention does not simply rely on black-box classifiers to identify attacks, nor does it use ordinary neural network decoders to freely reconstruct measurements. Instead, it forms a complete technical path of "measurement data → power grid physical state variables → power flow equation physical decoding → reconstructed measurements → residual detection → restoration reference generation and anomaly location interpretation".

[0031] like Figure 1 As shown, the embodiment is a power grid FDIA detection and recovery method with dual physical data guidance, including the following steps: S1. Obtain power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch association relationship and branch admittance parameters. The measurement selection matrix is ​​configured and constructed based on actual SCADA measurement data or PMU measurement data. S2. Input the power grid measurement data into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. S3. Input the power grid state variables into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, branch head admittance matrix, branch end admittance matrix, AC power flow equation and measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. S4. By calculating the residual between the power grid measurement data and the reconstructed measurement vector data, and comparing it with the detection threshold, it is determined whether there is a risk of false data injection attack in the current measurement. S5. When it is determined that there is a risk of false data injection attack, the suspected attacked bus, branch or measurement device is located according to the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point, and the reconstructed measurement vector is output as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

[0032] In step S2, the data-driven encoder employs one or more combinations of feedforward neural networks, convolutional neural networks, recurrent neural networks, long short-term memory networks, gated recurrent units, Transformers, or graph neural networks.

[0033] The data-driven encoder includes a topology-aware attention module for fusing power grid topology and electrical connectivity during feature extraction. The topology-aware attention module constructs a topology prior matrix A based on at least one of the following: power grid topology connectivity, node admittance matrix, branch start-end node relationships, and branch electrical parameters. This prior matrix A is then incorporated into the attention score calculation for node features, and the attention score is Softmax-normalized using a temperature coefficient τ to obtain topology attention weights. Node features are aggregated based on these topology attention weights, and the original features are fused with the aggregated topology features using a gating parameter g to obtain topology-enhanced features used to generate the power grid state variables.

[0034] The power grid state variables output by the data-driven encoder are the predicted bus complex voltage vector. The steps for obtaining the reconstructed measurement vector in the physically guided decoder specifically include: The node injection current is obtained by calculating the product between the node admittance matrix and the grid state variables output by the data-driven encoder. Using the branch head admittance matrix and branch end admittance matrix The branch head current is obtained by calculating the product between the branch head current and the grid state variable output by the data-driven encoder. and branch end current ; The complex power vector injected into the bus is obtained by multiplying the complex conjugate of the predicted bus voltage vector and the node injection current element by element. The complex power at the beginning of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the beginning of the branch and the complex conjugate of the current at the beginning of the branch; the complex power at the end of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the end of the branch and the complex conjugate of the current at the end of the branch. The real and imaginary parts of the complex power injected into the bus are extracted to obtain the active power and reactive power injected into the bus; the real and imaginary parts of the complex power at the beginning of the branch are extracted to obtain the active power flow and reactive power flow at the beginning of the branch; the real and imaginary parts of the complex power at the end of the branch are extracted to obtain the active power flow and reactive power flow at the end of the branch. Construct a complete measurement set, which includes bus injected active power, bus injected reactive power, active power flow at the beginning of the branch, reactive power flow at the beginning of the branch, active power flow at the end of the branch, reactive power flow at the end of the branch, bus voltage amplitude, and bus voltage phase angle. The corresponding part of the actual measurement is selected from the complete measurement set using the measurement selection matrix M to obtain the reconstructed measurement vector.

[0035] During the model training phase, normal sample measurement data is input into the data-driven encoder to obtain predicted grid state variables. The predicted grid state variables are then mapped to reconstructed measurement vectors by the physical guided decoder. The reconstruction loss is determined based on the difference between the normal sample measurement data and the reconstructed measurement vectors. The gradient of the reconstruction loss is backpropagated to the data-driven encoder through the differentiable physical mapping corresponding to the physical guided decoder to update the parameters of the data-driven encoder. Meanwhile, the physical model parameters of the physical guided decoder remain unchanged during training, so that the grid state variables output by the data-driven encoder generate physically consistent reconstructed measurements after passing through the physical guided decoder.

[0036] The method also includes a detection threshold determination method, which specifically includes: inputting the validation collection network measurement data into the trained method model to obtain the corresponding reconstructed measurement, calculating the reconstruction residual of each validation sample, processing the reconstruction residual using a quantile function with quantile parameters to obtain the detection threshold, and adjusting the quantile parameters according to the expected false alarm rate.

[0037] The method also includes a channel threshold determination method, which specifically includes: inputting the verification grid measurement data into the trained method model to obtain the corresponding reconstructed measurement, and calculating the channel residual of the k-th measurement channel. The sum of the mean of the channel residual of the k-th measurement channel on the verification grid measurement data and several times the standard deviation is used as the channel threshold, or the preset quantile of the residual distribution of the k-th measurement channel on the verification grid measurement data is used as the channel threshold.

[0038] Based on the channel residuals and the mapping relationship between measurement channels and physical measurement points, suspected attacked buses, branches, or equipment are located. When the channel residual of the k-th measurement channel exceeds the corresponding channel threshold, the k-th measurement channel is marked as an abnormal measurement channel. Based on the abnormal measurement type, a corresponding physical inconsistency interpretation is generated, including: abnormal node injected power residuals indicate an abnormal power balance relationship near the corresponding bus; abnormal branch power flow residuals indicate an abnormal power flow constraint of the corresponding branch or a power relationship between the two ends of the line; and abnormal voltage amplitude or phase angle residuals indicate an abnormal deviation between the corresponding bus state quantity and the measurement result.

[0039] In the specific implementation process, such as Figure 2 As shown, the method is divided into four functional layers according to their relationship: an input and physical model support layer, a physical guidance state reconstruction layer, a detection, localization, and recovery output layer, and an output result layer. The input and physical model support layer provides the SCADA or PMU measurement data to be detected, power grid topology information, and node admittance matrix. Channel-measurement point mapping The physical-guided state reconstruction layer utilizes the aforementioned measurement and physical model information to encode the original measurements into physically meaningful power grid state variables, and further decodes them to generate physically consistent reconstructed measurements. The detection, location, and recovery output layer completes anomaly detection, attack location, and recovery reference measurement generation based on the residuals between the original and reconstructed measurements. The output result layer summarizes and provides the detection results, location and interpretation results, and recovery reference measurements. Each layer is sequentially connected through input support, state reconstruction, residual analysis, and result output, forming a complete processing flow from measurement input to attack identification, location, and recovery.

[0040] like Figure 2 As shown, the input information in this embodiment includes power grid measurement data and power grid physical model parameters. The power grid measurement data, denoted as z, can be acquired by a SCADA system, PMU device, or other power system measurement equipment. The measurement data may include bus voltage amplitude, bus voltage phase angle, bus injected active power, bus injected reactive power, branch head active power, branch head reactive power, branch end active power, and branch end reactive power, etc.

[0041] The physical model parameters of the power grid include the node admittance matrix. Branch admittance matrix Branch end admittance matrix It may further include the branch start and end node relationships, branch admittance parameters, or network parameters used to generate the above matrix.

[0042] The power grid topology information, denoted as A, represents the connection relationships between buses, branches, and measurement points in the power system. This topology information can be represented as an adjacency matrix, or as a matrix composed of line connection relationships, branch start-end node relationships, or node admittance matrices. The derived topological constraint matrix.

[0043] The mapping relationship between measurement channels and physical measurement points is denoted as follows: This mapping represents the correspondence between each dimension of the input measurement vector and the physical measurement points of the power grid. The mapping relationship can be represented by a mapping table, index dictionary, or mapping matrix, and can be determined based on the construction rules of the complete measurement vector and the power grid topology data. Specifically, the k-th dimension of the input measurement vector can have its measurement type, corresponding bus number, corresponding branch number, branch start or end position, and measurement equipment information determined through this mapping relationship.

[0044] like Figure 2 As shown in the second layer, the data-driven encoding module is used to learn the mapping relationship between measurement data and power grid state variables. The encoder can employ one or more combinations of feedforward neural networks, convolutional neural networks, recurrent neural networks, long short-term memory networks, gated recurrent units, Transformers, or graph neural networks. Unlike ordinary autoencoders, the encoder latent space in this invention is not a compressed feature without explicit meaning, but rather an explicit representation of the power grid physical state, such as the voltage amplitude and phase angle of each bus, or the real and imaginary parts of the voltage.

[0045] Specifically, the encoder's input is a measurement vector z or a measurement sequence Z, and its output is a power grid state variable. It can be expressed as the voltage amplitude of each bus. and phase angle Where N is the number of buses:

[0046] Or it could be the real part. and Imaginary part form:

[0047] This module does not directly output a "whether an attack has occurred" classification result, but rather learns the mapping relationship between measurement data and power grid physical state variables. This allows the model's intermediate representation to have a clear power system meaning, improving the interpretability of the detection process.

[0048] like Figure 3 As shown, a topology-aware attention module is introduced into the data-driven encoder to fuse the power grid topology and electrical connections during feature extraction. For input node features... Where N represents the number of bus nodes and d represents the input feature dimension. The query matrix Q, key matrix K, and value matrix V are obtained through linear mapping:

[0049]

[0050]

[0051] in, For a trainable parameter matrix, In a specific embodiment, the formula for calculating the attention score is as follows:

[0052] in, Let represent the query vector for the i-th node. This represents the key vector of the j-th node. To determine the strength of the topology prior, the topology prior matrix A can be determined based on the power grid topology connections and the node admittance matrix. The relationship between the starting and ending nodes of the branch or the electrical parameters of the branch are used to construct the connection. Specifically, if there is an electrical connection between node i and node j, then... A larger value can be taken; if there is no direct electrical connection between the two, then It can take a small value, zero, or a negative number. In one implementation, A can be derived from the node admittance matrix. The non-zero off-diagonal elements are used to generate A; in another implementation, A can also be generated from the branch connection table or line admittance parameters. This formula subjectes the attention score to both data feature similarity and grid topology relationships, thereby reducing the likelihood of non-physical feature associations generated by ordinary attention mechanisms.

[0053] During softmax normalization, a temperature coefficient τ is introduced to adjust the smoothness of the attention distribution:

[0054] in, This represents the attention weight of node i on node j. These can be preset parameters or learnable parameters, used to avoid excessive concentration of attention weights on a few nodes. Indicates the number of nodes.

[0055] After completing the topological attention calculation, the topological aggregation feature of the i-th node is represented as:

[0056] in, This represents the feature of the i-th node after topology-aware attention aggregation. The j-th row represents the value matrix V.

[0057] To avoid excessive smoothing of the original measurement information due to topological aggregation, a further gate fusion parameter g is set to fuse the original feature path and the topological attention aggregation path:

[0058] in, Indicates original features, This represents the features after topological attention aggregation. g can be a global gating scalar obtained from training, or it can be node-level or sample-level gating weights generated from the input features through a linear mapping and a sigmoid function.

[0059] Finally, the topology-aware attention module outputs topology-enhanced features:

[0060] in, The features are the result of fusing the original feature path and the topological attention aggregation path, where f is the feature transformation function. The topological enhancement features... The data is then input into the state mapping layer, which outputs the power grid state variables.

[0061] In summary, the topology prior matrix A, the temperature coefficient τ, and the gating parameter g together constitute the constraint and fusion mechanism of the topology-aware attention module. This enables the encoder to simultaneously consider data characteristics, topology constraints, and raw measurement information when estimating the physical state variables of the power grid. This reduces the non-physical pseudo-correlation that may be generated by ordinary attention mechanisms, thereby improving the rationality of the state variable estimation results, enhancing the robustness of the model, and reducing the false alarm rate in the FDIA detection process.

[0062] like Figure 2 As shown in the second layer, the physical-guided decoder maps the grid state variables output by the encoder to reconstructed measurement vectors. Unlike traditional autoencoders that use neural network decoders, the physical-guided decoder of this invention does not employ a trainable neural network structure. Instead, it consists of node admittance matrices, branch correlation matrices, and AC power flow equations. In other words, the physical-guided decoder is a deterministic physical mapping function, and its calculation process is determined by the power system physical model. The physical-guided decoder changes the reconstruction process of the autoencoder from "free fitting of neural networks" to "deterministic mapping of power system physical equations," thereby improving model interpretability and physical consistency, and providing a basis for generating restored reference measurements after FDIA detection. Its detailed structure is as follows... Figure 4 As shown.

[0063] like Figure 4 As shown in the module input on the left, the input to the physical boot decoder consists of the following four parts: (I) Grid state variable V, which is output by the data-driven encoder and represents the predicted bus complex voltage vector:

[0064] Where N represents the number of bus nodes.

[0065] Each bus voltage can be expressed in polar coordinates:

[0066] in, This represents the voltage amplitude of the i-th bus. This represents the phase angle of the voltage at the i-th bus.

[0067] It can also be represented in rectangular coordinate form:

[0068] in, and These represent the real and imaginary parts of the bus voltage, respectively.

[0069] (II) Nodal Admittance Matrix The node admittance matrix is ​​constructed from the power grid topology and line electrical parameters, and is used to describe the electrical connection relationships between buses. .

[0070] (III) Branch correlation and branch admittance parameters: Branch correlation and branch admittance parameters are used to construct the branch head admittance matrix. With the branch end admittance matrix This data is then used for subsequent branch current and branch power flow calculations.

[0071] (IV) Measurement Selection Matrix M. The measurement selection matrix is ​​constructed based on the actual SCADA measurement data or PMU measurement data, and is used to select the part corresponding to the actual input measurement from the complete measurement set.

[0072] like Figure 4 As shown, the physical-guided decoder first predicts the complex voltage vector of the bus based on the node admittance matrix and the grid state variables. Calculate the node injection current :

[0073] Subsequently, the branch head admittance matrix is ​​constructed based on the branch correlation and branch admittance parameters. and branch end admittance matrix And calculate the current at the beginning of the branch. and branch end current :

[0074]

[0075] Next, based on the node voltage Complex conjugate with node injection current Calculate the complex power injected into the bus:

[0076] in, This represents the complex power vector injected into the bus, and ⊙ represents element-wise multiplication. Indicates complex conjugation.

[0077] Furthermore, the complex power of the branch is calculated based on the complex conjugate of the branch start / end voltage and the branch start / end current:

[0078]

[0079] in, and These represent the complex power at the beginning of the branch and the complex power at the end of the branch, respectively. and These represent the bus voltages at the beginning and end of the branch, respectively.

[0080] Subsequently, the active and reactive power are further calculated from the complex power: Busbar Injection Active / Reactive Power:

[0081]

[0082] Contributing / Uncontributing current flow at the beginning of the branch:

[0083]

[0084] Active / reactive power flow at the end of the branch:

[0085]

[0086] Here, Re and Im are complex number taking functions, representing taking the real and imaginary parts of the complex number, respectively.

[0087] Furthermore, the voltage amplitude and voltage phase angle can be directly extracted from the complex voltage vector V:

[0088]

[0089] Based on the above calculation results, a complete measurement set can be constructed:

[0090] Or it can be expressed as:

[0091] in, It represents the physical mapping function determined by the power grid state variables and the power system physical equations.

[0092] Since not all measurements in a real system are acquired by SCADA or PMU measurement data, this invention further utilizes a measurement selection matrix M to select the corresponding portion of the actual measurements from the complete measurement set to obtain the reconstructed measurement vector:

[0093] Or it can be written as:

[0094] in, This represents a reconstructed measurement vector that matches the actual input measurement dimension.

[0095] In practical detection scenarios, the implementation process includes four stages: model training, detection threshold determination, online detection and measurement recovery, and attack localization. First, the model is trained using historical measurement data under normal operating conditions, enabling it to learn the physically consistent mapping relationship between normal measurements and power grid state variables. Then, the overall detection threshold and channel threshold are determined based on the validation set residual distribution. In the online detection stage, the measurement to be detected is input into the trained model, and the presence of an FDIA attack is determined by reconstructing the residuals, and a physically consistent recovery reference measurement is output. When an anomaly is detected, the suspected attacked bus, branch, or equipment is further located based on the channel residual and the measurement channel mapping relationship, thereby realizing the integrated application of attack detection, measurement recovery, and anomaly localization.

[0096] In the initial phase, historical measurement data under normal power grid operation conditions is acquired and divided into training, validation, and test sets based on data scale and engineering requirements. The training set is used to train the data-driven encoder parameters and related learnable parameters. The validation set is used for model selection, early stopping, hyperparameter selection, and threshold determination. The test set is used to verify the model's detection performance on normal samples and spoofed data injection attack samples. The specific application process of the model is as follows: Figure 5 As shown.

[0097] like Figure 5As shown, during the training phase, the model is primarily trained using power grid measurement training set data under normal operating conditions, enabling the model to learn the mapping relationship between measurement data and power grid state variables under normal operating conditions. The input during the training phase is normal sample measurement data. Node admittance matrix Branch admittance matrix Branch end admittance matrix The measurement selection matrix M, and the topological prior matrix A used when employing the topology-aware attention module.

[0098]

[0099] in, This represents the constructor that generates the topological prior matrix from the node admittance matrix. In the preferred embodiment, the method used is: based on... The non-zero off-diagonal elements generate a binary adjacency matrix, i.e., if If ≠ 0, then bus i and bus j are considered to be electrically connected, A i,j Select 1 if the value is 1, otherwise select 0.

[0100] In a preferred embodiment, the topological prior matrix Once the model is trained, it remains fixed and is suitable for monitoring scenarios where the power grid topology is relatively fixed. In another parallel implementation, the topological prior matrix It can also be dynamically variable. During the detection phase, the status information of circuit breakers / disconnectors in the power grid can be obtained in real time. When a topology switch occurs, the topology prior matrix is ​​updated in real time according to the latest topology connection relationship. The encoder is then input to ensure the model's robustness in detecting dynamic topological changes.

[0101] First, the training samples are input into the data to drive the encoder:

[0102] in, This represents the predicted grid state variables output by the encoder. These predicted grid state variables are then input into the physical bootstrapping decoder.

[0103] in, This represents the reconstructed measurement data. Subsequently, the reconstruction loss between the original input measurement and the reconstructed measurement is calculated:

[0104] In some implementations, weighted reconstruction loss can also be set according to the accuracy or importance of different measurements:

[0105] Where W is the measurement weight matrix, which can be set according to the measurement noise variance, the accuracy of the measurement equipment, or engineering requirements.

[0106] During training, the physical-guided decoder does not update its parameters because its calculation process is determined by the power system physical equations; the neural network parameters in the data-driven encoder are updated through backpropagation of the reconstruction error. In other words, the error signal is transmitted from the reconstructed measurement end back to the encoder via the physical-guided decoder, enabling the encoder to gradually learn to generate a physically consistent reconstructed power grid state representation.

[0107] After the model training is completed, it is necessary to determine the detection threshold T used for attack detection. The specific process for determining this threshold is as follows: Figure 5 As shown in the second phase.

[0108] In one implementation, the detection threshold can be determined using validation set samples under normal operating conditions. Specifically, validation set measurement data is input into the trained model to obtain the corresponding reconstruction measurement, and the reconstruction residual for each validation sample is calculated.

[0109] in, This represents the input measurement of the i-th validation sample. This indicates the corresponding reconstruction measurement.

[0110]

[0111] in, The value represents the number of validation set samples, and q represents the quantile parameter. For example, q=0.90, q=0.95, or q=0.99 can be selected based on the project's false alarm rate requirements. A higher quantile can be chosen to reduce the false alarm rate, while a lower quantile can be chosen to increase the sensitivity of attack detection. Therefore, the threshold determination method can be adjusted according to the specific power grid operation scenario, false alarm rate requirements, missed detection risk requirements, and operation and maintenance strategies. This threshold determination method belongs to the statistical distribution threshold setting method, which can adaptively determine the detection boundary using the residual distribution of normal validation samples, without requiring a manually fixed empirical threshold.

[0112] Furthermore, to identify the specific attacked measurement channels during the localization phase, the channel thresholds for each measurement channel can be determined based on validation samples under normal operating conditions. Specifically, after model training is complete, normal validation samples are input into the trained physical-guided autoencoder to obtain the reconstructed measurements corresponding to each validation sample, and the channel residual of the k-th measurement channel is calculated. Based on the residual distribution of this channel on the normal validation samples, the channel threshold of the k-th measurement channel is determined. .

[0113] In one alternative implementation, the sum of the mean of the residuals of the k-th measurement channel and a certain multiple of the standard deviation can be used as the channel threshold. Alternatively, the preset quantile of the residual distribution of this channel can be used as the channel threshold. For channels requiring high measurement accuracy or high safety standards, lower channel thresholds can be set; for channels with higher noise levels or lower importance, higher channel thresholds can be set. Thus, different measurement channels can adaptively determine anomaly detection criteria based on their own noise levels and engineering importance.

[0114] Covert FDIA can maintain consistency of tampered measurements in the sense of traditional state estimation residuals, but the tampered measurement patterns may deviate from the normal operating data distribution. Abnormal correlations may appear between local measurements and between topology-related measurements that do not conform to normal operating patterns. The specific detection and recovery process is as follows: Figure 5 The third stage is shown in the diagram.

[0115] The encoder of this invention is subject to normal data training constraints. When the input is an attack measurement, a large residual will appear between the reconstructed measurement generated by the physical decoder and the attack measurement, thereby achieving detection. At the same time, since the reconstructed measurement is generated by predicting the power grid state variables through physical equations, it can generate recovery reference measurements or corrected measurement estimates that satisfy the physical constraints of the power system, providing a reference for subsequent state estimation, power flow analysis, and dispatch control.

[0116] During the testing phase, the measurement data to be tested will be... Input the trained model. First, the data-driven encoder outputs predicted power grid state variables based on the measurement data to be detected:

[0117] Then, the physical-guided decoder predicts the grid state variables. Node admittance matrix Branch admittance matrix Branch end admittance matrix Measurement selection matrix Reconstruction Measurement:

[0118] Next, the residuals between the input measurement and the reconstructed measurement are calculated:

[0119] Finally, compare the residual r with the preset detection threshold T. When r < T, it is determined that the current measurement data conforms to the normal power grid operation law and no false data injection attack is detected. When r ≥ T, it is determined that there is a large deviation between the current measurement data and the normal operation mode learned by the model and the physically consistent reconstruction result, and there is a risk of false data injection attack.

[0120]

[0121] Among them, the reconstructed measurement vector can be output as the restored reference measurement result, which is used to provide reference for subsequent state estimation, power flow analysis and dispatching control.

[0122] When the overall residual exceeds the detection threshold and it is determined that there is a risk of attack, enter the attack location process. Further, to improve the interpretability of the detection results, the present invention calculates the channel residuals between the original measurement vector and the reconstructed measurement vector, and generates an abnormal channel mask based on the channel residuals. The abnormal channel mask is used for attack location, abnormal measurement interpretation and operation and maintenance display, and the specific process is as shown in Figure 5 the fourth stage in

[0123] For the k-th measurement channel, calculate the channel residual between the original measurement value and the corresponding reconstructed measurement value; when the channel residual is greater than the preset channel threshold, mark this channel as a suspected abnormal channel; when the channel residual is not greater than the preset channel threshold, mark this channel as a normal channel. Thus, an abnormal channel mask is obtained. Specifically, for the k-th measurement channel, its channel residual can be expressed as:

[0124] Among them, represents the k-th measurement value in the input measurement vector, represents the corresponding reconstructed measurement value.

[0125] According to the residual magnitudes of each measurement channel, an abnormal channel mask can be generated. When the channel residual of the k-th measurement channel exceeds the preset channel threshold , mark this channel as an abnormal channel; otherwise mark it as a normal channel.

[0126] When a certain measurement channel is marked as a suspected abnormal channel, according to the measurement channel - physical measurement point mapping relationship This is mapped to the corresponding bus, branch, branch start, branch end, or measurement device. Furthermore, corresponding physical inconsistency interpretations can be generated based on the type of abnormal measurement. For example, residual differences in node injected power often indicate an anomaly in the power balance relationship near the corresponding bus; residual differences in branch power flow often indicate an anomaly in the power flow constraints of the corresponding branch or the power relationship between the two ends of the line; residual differences in voltage amplitude or phase angle often indicate an abnormal deviation between the corresponding bus state quantity and the measurement results.

[0127] Based on the above embodiments, a power grid FDIA detection and recovery method guided by both physical data is proposed, employing a self-encoding structure of "data-driven encoder + physical-guided decoder". This method learns the mapping relationship from measurement data to power grid state variables through the data-driven encoder, and reconstructs the measurement data based on AC power flow equations and node admittance matrices through the physical-guided decoder, thereby combining the feature learning capability of the data-driven model with the interpretability and consistency of the power system physical model.

[0128] Another embodiment provides a power grid FDIA detection and recovery system with dual physical data guidance, such as... Figure 6 As shown, system 600 includes: The input data acquisition module 610 is used to acquire power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch association relationship and branch admittance parameters. The measurement selection matrix is ​​constructed according to the actual SCADA or PMU measurement configuration. The data-driven encoder module 620 is used to input the power grid measurement data into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. The physical guidance decoder module 630 is used to input the power grid state variables into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, the branch head admittance matrix, the branch end admittance matrix, the AC power flow equation, and the measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. The FDIA attack detection module 640 is used to determine whether there is a risk of false data injection attack in the current measurement by calculating the residual between the power grid measurement data and the reconstructed measurement vector data and comparing it with the detection threshold. The FDIA attack location module 650, when it determines that there is a risk of false data injection attack, locates the suspected attacked bus, branch or measurement device according to the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point, and outputs the reconstructed measurement vector as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

[0129] In addition to the modules described above, the physical data dual-guided power grid FDIA detection and recovery system 600 may also include other components; however, since these components are not relevant to the content of this disclosure, their illustrations and descriptions are omitted here.

[0130] Other specific working processes of the power grid FDIA detection and recovery method using the physical data dual-guided power grid FDIA detection and recovery system 600 described above are as described in the above embodiment of the power grid FDIA detection and recovery method using physical data dual-guided power grid FDIA detection and recovery, and will not be repeated here.

[0131] Another embodiment illustrating that the system of the present invention can also be achieved by means of... Figure 7 The architecture of the computing device shown is used to implement this. Figure 7 The architecture of the computing device is shown. For example... Figure 7 As shown, it includes a computer system 710, a system bus 730, one or more CPUs 740, input / output 720, and a memory 750. The memory 750 can store various data or files used by the computer for processing and / or communication, as well as program instructions executed by the CPU for the power grid FDIA detection and recovery method, including physical data dual-booting. Figure 7 The architecture shown is merely exemplary and should be adjusted according to actual needs when implementing different devices. Figure 7 One or more components are included. The memory 750, as a computer-readable storage medium, can be used to store software programs, computer-executable programs, and modules, such as the program instructions / modules corresponding to the power grid FDIA detection and recovery method using the aforementioned physical data dual-guided method in this embodiment of the invention. One or more CPUs 740 execute various functional applications and data processing of the system of the present invention by running the software programs, instructions, and modules stored in the memory 750.

[0132] Of course, the processor of the server provided in the embodiments of the present invention is not limited to performing the method operations described above, but can also perform related operations in the power grid FDIA detection and recovery method using the above-described physical data dual guidance provided in any embodiment of the present invention.

[0133] The memory 750 may primarily include a program storage area and a data storage area. The program storage area may store the operating system and at least one application program required for a given function; the data storage area may store data created based on terminal usage. Furthermore, the memory 750 may include high-speed random access memory and non-volatile memory, such as at least one disk storage device, flash memory, or other non-volatile solid-state storage device. In some instances, the memory 750 may further include memory remotely configured relative to one or more CPUs 740, which can be connected to the device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0134] Input / output 720 can be used to receive input digital or character information, and to generate key signal inputs related to user settings and function control of the device. Input / output 720 may also include a display device such as a display screen.

[0135] This invention also provides a non-transitory computer-readable storage medium storing a computer program that, when executed by a processor, implements the power grid FDIA detection and recovery method with dual physical data guidance described in the above embodiments. The computer-readable storage medium of this invention can be any combination of one or more computer-readable media. A computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. For example, a computer-readable storage medium can be, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of computer-readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device.

[0136] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media may also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit programs for use by or in connection with an instruction execution system, apparatus, or device.

[0137] The program code contained on the storage medium can be transmitted using any suitable medium, including but not limited to wireless, wire, optical fiber, RF, etc., or any suitable combination thereof.

[0138] Furthermore, other specific operating procedures of a non-transitory computer-readable storage medium are described in the above-described embodiment of the power grid FDIA detection and recovery method with dual physical data guidance, and will not be repeated here.

[0139] To verify the effectiveness of the method of this invention, a verification experiment was conducted. The experiment used a self-written Python program to perform simulation experiments on the IEEE 14-bus power system. The simulation program was based on PyPower for AC power flow calculation and optimal power flow calculation, and a neural network model was built and trained based on PyTorch.

[0140] The IEEE 14-bus system comprises 14 bus nodes and 20 branches. The simulation uses an AC power system model, and the physical model parameters of the power grid include node admittance matrix, branch head admittance matrix, branch tail admittance matrix, branch head-end admittance matrix, branch head-end node relationship, branch admittance parameters, and measurement selection matrix.

[0141] The measurement data selected include active power flow at the branch head, active power injected into the bus, reactive power flow at the branch head, and reactive power injected into the bus. Since the IEEE 14-bus system contains 20 branches and 14 bus nodes, the measurement vector dimension is 68 dimensions.

[0142] The normal sample generation process is as follows: Different operating conditions are constructed using load data and photovoltaic output data. The original load data and photovoltaic data are uniformly processed into a 5-minute sampling interval. For each time point, the bus injection power of the IEEE 14-bus system is corrected according to the load and photovoltaic output at that time. The AC optimal power flow program is called to calculate the grid operating state under that condition. Then, corresponding measurement data is generated based on the power flow calculation results, and Gaussian measurement noise is added to the measurement data to simulate actual measurement errors. This yields 35,134 normal operation samples, each sample being a 68-dimensional measurement vector.

[0143] The samples were divided into training, validation, and test sets in a 6:2:2 ratio. The training set was used to train the model, the validation set was used to determine the detection threshold, and the test set was used to evaluate the attack detection performance. Only normally functioning samples were used during the training phase; attack samples were not used.

[0144] In the verification embodiment, the data-driven encoder employs a bidirectional LSTM structure to extract temporal features of the power grid operating state from a continuous measurement sequence. The encoder input consists of measurement data from six consecutive time points, with each time point having a measurement vector dimension of 68. Therefore, the data dimension of a single input sample is 6×68.

[0145] The number of hidden units in the bidirectional LSTM can be set from 32 to 128 depending on the measurement dimension, number of buses, and training sample size; in this simulation embodiment, the number of hidden units is set to 64. The bidirectional LSTM concatenates the hidden states at the last moment of the forward and reverse directions to obtain a 128-dimensional time-series feature vector. The output dimension of the state mapping layer is determined according to the dimension of the power grid state variables; for the IEEE 14-bus system, the real and imaginary parts of the bus complex voltages are used to represent the power grid state variables, and the output dimension of the state mapping layer is set to 28. The 28-dimensional vector output by the encoder corresponds to the real and imaginary parts of the 14 bus complex voltages, and is not a simple compressed feature without clear meaning.

[0146] The physical-guided decoder generates a 68-dimensional reconstructed measurement vector consistent with the input measurement dimension based on the bus complex voltage state, node admittance matrix, branch head admittance matrix, branch tail admittance matrix, and measurement selection matrix output by the encoder. The physical-guided decoder does not have trainable parameters; its calculation process is determined by the power system physical model. Specifically, the physical-guided decoder calculates the bus injected power and branch power flow based on the bus complex voltage state and selects the reconstructed result corresponding to the input measurement channel according to the measurement selection matrix.

[0147] The model was trained using the Adam optimizer with a learning rate of 0.0003, a batch size of 32, and a maximum training epoch of 1000. The training loss was the mean squared error between the input and reconstructed measurement vectors. An early stopping strategy was employed: training was stopped when the validation set loss failed to decrease for 20 consecutive epochs, and the model parameters with the lowest validation set loss were saved. During training, the error between the input and reconstructed measurements was propagated from the reconstructed measurement source through the physically guided decoder to the data-driven encoder, enabling the encoder to learn to generate a physically consistent reconstructed grid state representation.

[0148] The threshold determination process for the verification example is as follows: Input the normal measurement samples of the verification set into the trained model to obtain the reconstructed measurement corresponding to each verification sample, and calculate the residual between the input measurement and the reconstructed measurement; determine the 0.92 quantile of the verification set residual as the detection threshold.

[0149] During the testing phase, if the residual of the test sample is greater than or equal to the detection threshold, it is determined that there is a risk of false data injection attack; if the residual of the test sample is less than the detection threshold, it is determined that no risk of false data injection attack is detected.

[0150] The attack sample construction process is as follows: Attack samples are selected from the normal samples in the test set. Two unbalanced buses are chosen as attack targets, and perturbations are applied to the voltage amplitude and voltage phase angle corresponding to the attacked buses. The voltage amplitude perturbation ratio is set to 0.20, and the voltage phase angle perturbation ratio is also set to 0.20. Subsequently, attack measurements are regenerated based on the perturbed grid state, and these attack measurements are used as input samples for the testing phase.

[0151] This attack sample does not directly add random noise to the measurement data, but is generated by the power system measurement model based on the disturbed power grid state. Therefore, it is used to simulate a covert spoofing attack with physical consistency.

[0152] To verify the effectiveness of the method of this invention, three comparative methods were set up: traditional bad data detection methods, ordinary LSTM autoencoder methods, and the method of this invention. The three methods were evaluated under the same IEEE 14-node system, the same 68-dimensional measurement configuration, the same test set, and the same attack samples. The F1 score was used as the evaluation metric.

[0153] The experimental results are as follows: Under the same IEEE 14-node test conditions, the F1 score of the traditional bad data detection method is about 0.15, the F1 score of the ordinary LSTM autoencoder method is about 0.96, and the F1 score of the method of the present invention reaches more than 0.95, and is about 0.98 in this simulation embodiment.

[0154] The ordinary LSTM autoencoder comparison method uses the same input measurement dimension, time window length, training set partitioning, optimizer, and batch size. The encoder of the ordinary LSTM autoencoder consists of three LSTM layers with hidden dimensions of 48, 29, and 10 respectively, compressing a 6×68 measurement sequence into 10-dimensional latent features. Its decoder also consists of three LSTM layers with hidden dimensions of 10, 29, and 48, reconstructing a 68-dimensional measurement vector through a linear output layer. The latent features of this ordinary LSTM autoencoder do not have a clear physical meaning related to the power grid, and the decoder is not based on AC power flow relationships.

[0155] The verification results show that, under the same test conditions, the method of the present invention has a higher ability to identify fake data injection attacks than traditional bad data detection methods; compared with the ordinary LSTM autoencoder method, the method of the present invention further improves the F1 score.

[0156] Compared to traditional bad data detection methods, the method of this invention does not rely solely on state estimation residuals for attack judgment. Instead, it uses normal operation samples to train and obtain the mapping relationship from measurement data to power grid state variables. It also discovers anomalies by physically guiding the reconstruction results and the differences between the input measurements. Therefore, it can improve the ability to identify covert fake data injection attacks.

[0157] Compared to the conventional LSTM autoencoder method, the advantages of this invention are as follows: First, the encoder latent space has a clear physical meaning, representing the complex voltage state of the bus, rather than a compressed feature without a definite meaning; Second, the decoder generates reconstructed measurements based on the node admittance matrix, branch admittance matrix, and AC power flow relationship, rather than being freely fitted by a neural network; Third, the reconstructed measurement vector can serve as a recovery reference measurement that satisfies the physical constraints of the power grid, providing a reference for subsequent state estimation, power flow analysis, and scheduling control; Fourth, when an attack risk is detected, the suspected abnormal bus, branch, or measurement device can be output based on the residuals of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point, thus forming a continuous processing flow of detection, location, and recovery reference generation.

[0158] In this document, the terms “comprising,” “including,” or any other variations thereof are intended to cover non-exclusive inclusion, such that a step or method that comprises a list of elements includes not only those elements but also other elements not expressly listed or inherent to such a step or method.

[0159] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A method for power grid FDIA detection and recovery guided by physical data, characterized in that, Includes the following steps: The system acquires power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch correlation relationships and branch admittance parameters. The measurement selection matrix is ​​configured and constructed based on actual SCADA measurement data or PMU measurement data. The power grid measurement data is input into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. The power grid state variables are input into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, branch head admittance matrix, branch end admittance matrix, AC power flow equation, and measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. By calculating the residual between the power grid measurement data and the reconstructed measurement vector data, and comparing it with the detection threshold, it can be determined whether there is a risk of false data injection attack in the current measurement. When a risk of false data injection attack is determined, the suspected attacked bus, branch or measurement device is located based on the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point. The reconstructed measurement vector is then output as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

2. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, The data-driven encoder includes a topology-aware attention module for fusing power grid topology and electrical connectivity during feature extraction. The topology-aware attention module constructs a topology prior matrix A based on at least one of the following: power grid topology connectivity, node admittance matrix, branch start-end node relationships, and branch electrical parameters. This prior matrix A is then incorporated into the attention score calculation of node features, and the attention score is Softmax-normalized using a temperature coefficient τ to obtain topology attention weights. Node features are aggregated based on these topology attention weights, and the original features are fused with the aggregated topology features using a gating parameter g to obtain topology-enhanced features for generating the power grid state variables.

3. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, The power grid state variables output by the data-driven encoder are the predicted bus complex voltage vector. The steps for obtaining the reconstructed measurement vector in the physically guided decoder specifically include: The node injection current is obtained by calculating the product between the node admittance matrix and the grid state variables output by the data-driven encoder. Using the branch head admittance matrix and branch end admittance matrix The branch head current is obtained by calculating the product between the branch head current and the grid state variable output by the data-driven encoder. and branch end current ; The complex power vector injected into the bus is obtained by multiplying the complex conjugate of the predicted bus voltage vector and the node injection current element by element. The complex power at the beginning of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the beginning of the branch and the complex conjugate of the current at the beginning of the branch; the complex power at the end of the branch is obtained by calculating the element-by-element multiplication between the bus voltage corresponding to the end of the branch and the complex conjugate of the current at the end of the branch. The real and imaginary parts of the complex power injected into the bus are extracted to obtain the active power and reactive power injected into the bus; the real and imaginary parts of the complex power at the beginning of the branch are extracted to obtain the active power flow and reactive power flow at the beginning of the branch; the real and imaginary parts of the complex power at the end of the branch are extracted to obtain the active power flow and reactive power flow at the end of the branch. Construct a complete measurement set, which includes bus injected active power, bus injected reactive power, active power flow at the beginning of the branch, reactive power flow at the beginning of the branch, active power flow at the end of the branch, reactive power flow at the end of the branch, bus voltage amplitude, and bus voltage phase angle. The corresponding part of the actual measurement is selected from the complete measurement set using the measurement selection matrix M to obtain the reconstructed measurement vector.

4. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, During the model training phase, normal sample measurement data is input into the data-driven encoder to obtain predicted grid state variables. The predicted grid state variables are then mapped to reconstructed measurement vectors by the physical guided decoder. The reconstruction loss is determined based on the difference between the normal sample measurement data and the reconstructed measurement vectors. The gradient of the reconstruction loss is backpropagated to the data-driven encoder through the differentiable physical mapping corresponding to the physical guided decoder to update the parameters of the data-driven encoder. Meanwhile, the physical model parameters of the physical guided decoder remain unchanged during training, so that the grid state variables output by the data-driven encoder generate physically consistent reconstructed measurements after passing through the physical guided decoder.

5. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, The method also includes a detection threshold determination method, which specifically includes: inputting the verification collection network measurement data into the trained method model to obtain the corresponding reconstructed measurement, calculating the reconstruction residual of each verification sample, processing the reconstruction residual using a quantile function with quantile parameters to obtain the detection threshold, and adjusting the quantile parameters according to the expected false alarm rate.

6. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, The method further includes a channel threshold determination method, specifically including: inputting the verification grid measurement data into the trained method model to obtain the corresponding reconstructed measurement, and calculating the channel residual of the k-th measurement channel, using the sum of the mean and several times the standard deviation of the channel residual of the k-th measurement channel on the verification grid measurement data as the channel threshold, or using the preset quantile of the residual distribution of the k-th measurement channel on the verification grid measurement data as the channel threshold.

7. The power grid FDIA detection and recovery method with dual physical data guidance according to claim 1, characterized in that, Based on the channel residuals and the mapping relationship between measurement channels and physical measurement points, suspected attacked buses, branches, or equipment are located. When the channel residual of the k-th measurement channel exceeds the corresponding channel threshold, the k-th measurement channel is marked as an abnormal measurement channel. Based on the abnormal measurement type, a corresponding physical inconsistency interpretation is generated, including: abnormal node injected power residuals indicate an abnormal power balance relationship near the corresponding bus; abnormal branch power flow residuals indicate an abnormal power flow constraint of the corresponding branch or a power relationship between the two ends of the line; and abnormal voltage amplitude or phase angle residuals indicate an abnormal deviation between the corresponding bus state quantity and the measurement result.

8. A power grid FDIA detection and recovery system with dual physical data guidance, characterized in that, The system includes: The input data acquisition module is used to acquire power grid measurement data, power grid physical model parameters, measurement selection matrix, and measurement channel-physical measurement point mapping relationship. The power grid physical model parameters include node admittance matrix, branch head admittance matrix, and branch end admittance matrix. The branch head admittance matrix and branch end admittance matrix are constructed from branch correlation relationship and branch admittance parameters. The measurement selection matrix is ​​configured and constructed according to actual SCADA measurement data or PMU measurement data. The data-driven encoder module is used to input the power grid measurement data into the data-driven encoder to obtain the power grid state variables explicitly represented by the implicit space of the data-driven encoder. The power grid state variables are bus complex voltage vectors and are represented in the form of bus voltage amplitude and phase angle or the form of bus voltage real part and imaginary part. The physical guidance decoder module is used to input the power grid state variables into the physical guidance decoder. The physical guidance decoder constructs a deterministic physical mapping based on the node admittance matrix, branch head admittance matrix, branch end admittance matrix, AC power flow equation and measurement selection matrix, and generates a reconstructed measurement vector corresponding to the power grid measurement data. The FDIA attack detection module is used to determine whether there is a risk of false data injection attack in the current measurement by calculating the residual between the power grid measurement data and the reconstructed measurement vector data and comparing it with the detection threshold. When the FDIA attack location module determines that there is a risk of false data injection attack, it locates the suspected attacked bus, branch or measurement device based on the channel residual of each measurement channel and the mapping relationship between the measurement channel and the physical measurement point, and outputs the reconstructed measurement vector as a recovery reference measurement for use in state estimation, power flow analysis or scheduling control.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the power grid FDIA detection and recovery method with dual physical data guidance as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, When the instruction is executed by the processor, it implements the steps of the power grid FDIA detection and recovery method with dual physical data guidance as described in any one of claims 1 to 7.

Images