FDIA detection method and system based on federal clustering average, terminal and storage medium

Abstract

The application relates to the technical field of data monitoring and discloses an FDIA detection method, system, terminal and storage medium based on federal clustering average, the method comprising the following steps: constructing all standardized samples of a client and clustering; constructing a weighted average gradient of the client according to local model parameters and clustering clusters to iteratively optimize the local model; inputting the local model optimization parameters into a central server to globally average to obtain global parameters, inputting the global parameters into the client to optimize the local model; and using the optimized local model to identify false data to obtain attack data vectors and target measurement vectors in a false data injection attack. The application considers the Non-IID distribution property of distributed measurement, protects data privacy through a hierarchical architecture integrating a client, a subserver and a central server, is scalable, and improves the detection efficiency of false injection attack data.

Description

Technical Field

[0001] This invention relates to the field of data monitoring technology, and in particular to an FDIA detection method, system, terminal, and computer-readable storage medium based on federated clustering average. Background Technology

[0002] Centralized FDIA (False Data Injection Attack) detection models typically require aggregating sensitive power grid data (such as substation measurements, load consumption profiles, and generation forecasts) into a centralized data center. However, due to risks such as privacy breaches and compliance violations, such architectures face increasing scrutiny and are exposed to cyber-physical attacks or system-wide failures.

[0003] Federated learning (FL) allows for distributed model training among distributed clients without exchanging raw data. However, FL inherently suffers from performance degradation under highly non-IID (non-independent and identically distributed) distributions.

[0004] Therefore, existing technologies still need to be improved and developed. Summary of the Invention

[0005] The main objective of this invention is to provide a method, system, terminal, and computer-readable storage medium for FDIA detection based on federated clustering averaging, aiming to solve the problems of data leakage and low scalability of data transmission in the measurement of spoofed data injection attacks in the prior art.

[0006] To achieve the above objectives, the present invention provides an FDIA detection method based on federated clustering averages, the FDIA detection method based on federated clustering averages comprising the following steps: Obtain the local model parameters of multiple clients and the local dataset of each client, and construct all standardized samples for each client based on the feature mean and standard deviation vector of each local dataset; For each client, each standardized sample is clustered to obtain a cluster for each client; Based on each local model parameter and each cluster, a weighted average gradient is constructed for each client. Each local model is iteratively optimized using each weighted average gradient to obtain the local model optimization parameters after each iteration. All the local model optimization parameters are input to the central server for global averaging to obtain global parameters for updating the global model of the central server. The global parameters are then input to each client to optimize each local model. The optimized local model is used to identify the fake data input to the corresponding client, and the attack data vector and target measurement vector in the fake data injection attack are obtained.

[0007] Optionally, the FDIA detection method based on federated clustering averages, wherein obtaining the local model parameters of multiple clients and the local dataset of each client, and constructing all standardized samples for each client based on the feature mean and standard deviation vector of each local dataset, specifically includes: Obtain the local model parameters of multiple clients and the local dataset of each client, and extract the feature mean and standard deviation vector of each local dataset; For each client, all samples in the local dataset are converted into corresponding standardized samples based on the feature mean and the standard deviation vector.

[0008] Optionally, the FDIA detection method based on federated clustering averages, wherein the step of clustering each standardized sample for each client to obtain a cluster cluster for each client specifically includes: For each client, the standardized sample is randomly defined as the first cluster center, and the standardized sample farthest from the first cluster center is defined as the second cluster center; Define a clustering threshold and calculate the clustering distance between each standardized sample and the first cluster center and the second cluster center; If there exists a clustering distance less than the clustering threshold, then the clustering distance is defined as the clustering threshold for the current round, until the minimum clustering threshold is obtained; The cluster center corresponding to the minimum clustering threshold is defined as the target cluster center of the client, and all the standardized samples are added to the target cluster center to obtain the cluster cluster of the client.

[0009] Optionally, the FDIA detection method based on federated clustering averages, wherein constructing a weighted average gradient for each client based on each local model parameter and each cluster, and iteratively optimizing each local model using each weighted average gradient to obtain the local model optimization parameters after each iteration, specifically includes: For each client, the current gradient of each cluster is constructed based on the local model parameters and the cluster cluster; The weighted average gradient of the cluster in the current iteration round is obtained by weighted fusion of all historical gradients of the client and the current gradient. Based on the clustering clusters, construct the client's objective function and the global function used to train the global model in the next iteration round; The client's local model is optimized using the objective function and the weighted average gradient to obtain the local model optimization parameters in all iteration rounds.

[0010] Optionally, the FDIA detection method based on federated clustering averaging, wherein constructing the client's objective function and the global function used to train the global model in the next iteration based on the cluster clusters specifically includes: Determine the sample size of all the standardized samples in the cluster of each client; Based on the sample size and the total number of clients, construct the objective function for each client: ; ; ; in, Indicates a global function. Indicates the number of clients. Indicates sample size. This indicates the index of the current client. Indicates the first Intermediate functions for each client, Indicates the first Clustering of clients, Indicates the first The target function for each client, Indicates the first i A standardized sample, Indicates the predicted first i One sample, Indicates the number of iterations in the current iteration round. i Local model parameters for each client. l This represents the loss function.

[0011] Optionally, the FDIA detection method based on federated clustering averaging, wherein the step of inputting all the local model optimization parameters to a central server for global averaging to obtain global parameters for updating the global model of the central server, and then inputting the global parameters to each client to optimize each local model, specifically includes: All the local model optimization parameters in each iteration are input to the central server for aggregation to obtain the corresponding global parameters. The global parameters in each iteration are then weighted and fused to obtain the target global parameters. The target global parameters are input into the local model of each client, and each local model is optimized according to the target global parameters to obtain the local model optimized in the current iteration.

[0012] Optionally, the FDIA detection method based on federated clustering averaging, wherein the step of inputting all the local model optimization parameters in each iteration round to a central server for aggregation to obtain the corresponding global parameters, and performing weighted fusion of the global parameters in each round to obtain the target global parameters, specifically includes: For the current iteration optimization process, the local model optimization parameters of each client are weighted and aggregated to obtain the global parameters in the current iteration: Based on the similarity in each of the global parameters, a corresponding aggregation weight is added to each of the global parameters; Based on all the aggregate weights, all the global parameters are fused to obtain the target global parameters.

[0013] Furthermore, to achieve the above objectives, the present invention also provides an FDIA detection system based on federated clustering averaging, wherein the FDIA detection system based on federated clustering averaging includes: The data standardization module is used to obtain the local model parameters of multiple clients and the local dataset of each client, and to construct all standardized samples of each client based on the feature mean and standard deviation vector of each local dataset; The clustering module is used to cluster each standardized sample for each client to obtain a cluster for each client; The client transformation module is used to construct a weighted average gradient for each client based on each local model parameter and each cluster, and to iteratively optimize each local model using each weighted average gradient to obtain the local model optimization parameters after each iteration. The intermediate aggregation and global averaging module is used to input all the local model optimization parameters to the central server for global averaging, obtain global parameters for updating the global model of the central server, and input the global parameters to each client to optimize each local model. The client-side measurement module is used to identify fake data input to the corresponding client using an optimized local model, and to obtain the attack data vector and target measurement vector in the fake data injection attack.

[0014] Furthermore, to achieve the above objectives, the present invention also provides a terminal, wherein the terminal includes: a memory, a processor, and a federated clustering average-based FDIA detection program stored in the memory and executable on the processor, wherein the federated clustering average-based FDIA detection program, when executed by the processor, implements the steps of the federated clustering average-based FDIA detection method as described above.

[0015] Furthermore, to achieve the above objectives, the present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores an FDIA detection program based on federated clustering average, the FDIA detection program based on federated clustering average being executed by a processor to implement the steps of the FDIA detection method based on federated clustering average as described above.

[0016] In this invention, local model parameters from multiple clients and local datasets for each client are obtained. Standardized samples for each client are constructed based on the feature mean and standard deviation vectors of each local dataset. For each client, the standardized samples are clustered to obtain clusters for each client. A weighted average gradient for each client is constructed based on the local model parameters and clusters. Each local model is iteratively optimized using the weighted average gradient to obtain optimized parameters for each local model after each iteration. All optimized parameters are input to a central server for global averaging to obtain global parameters for updating the global model of the central server. These global parameters are then input to each client to optimize each local model. The optimized local models are used to identify spoofed data input to the corresponding clients, obtaining attack data vectors and target measurement vectors from spoofed data injection attacks. This invention considers the Non-IID distribution nature of distributed measurements, protects data privacy through a hierarchical architecture integrating clients, sub-servers, and a central server, has scalability, and improves the detection efficiency of spoofed injection attack data. Attached Figure Description

[0017] Figure 1 This is a flowchart of a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention; Figure 2 This is a schematic diagram of the framework of FedClusAvg, a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention. Figure 3 This is a flowchart of the FedClusAvg method, a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention. Figure 4 This is a flowchart of the FedClusAvg+ method, a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention. Figure 5 This is a comparison chart of the first ROC index of different algorithms in a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention. Figure 6 This is a comparison chart of the second ROC index of different algorithms in a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention; Figure 7 This is a schematic diagram illustrating the average communication delay of different algorithms in a preferred embodiment of the FDIA detection method based on federated clustering averaging of the present invention. Figure 8 This is a structural diagram of a preferred embodiment of the FDIA detection system based on federated clustering averaging of the present invention; Figure 9 This is a structural diagram of a preferred embodiment of the terminal of the present invention. Detailed Implementation

[0018] To make the objectives, technical solutions, and advantages of this invention clearer and more explicit, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

[0019] Modern smart grid infrastructure is evolving into complex cyber-physical systems (CPS) to ensure operational reliability and resilience against extreme external shocks. However, the increasing frequency of extreme weather events such as typhoons, ice storms, and floods introduces significant uncertainty into grid monitoring. During these events, Supervisory Control and Data Acquisition (SCADA) and measurement devices such as phasor measurement units (PMUs) are affected by harsh environmental conditions, leading to data heterogeneity and significant spatiotemporal errors. During these periods, cyber adversaries frequently launch False Data Injection Attacks (FDIAs) because environmental noise can mask malicious data manipulation, resulting in erroneous emergency dispatch decisions and disrupting grid recovery efforts. Traditional centralized detection frameworks are unsuitable for resilient operation planning due to the risk of single points of failure and the high cost of transmitting large amounts of sensor data under bandwidth constraints during emergencies.

[0020] To address these issues, a Federated Learning (FL) scheme was developed, which achieves efficient communication and a heterogeneous sensing architecture for safe energy data sharing through edge-cloud collaboration, and a collaborative learning framework for detecting FDIA using vertical FL. Although FL has proven effective in smart grid anomaly detection, the heterogeneous data distribution across clients can cause model divergence and hinder global convergence. Frequent communication between clients and the central server can cause latency and increase bandwidth usage. The limited computing and memory capacity of many edge devices makes local training of large-scale models challenging.

[0021] To this end, this invention discloses an FDIA detection method based on federated clustering averaging, which improves FDIA detection in Non-IID (Not Independent and Identically Distributed) and resource-constrained environments, enhances detection accuracy under heterogeneous data distribution, reduces communication frequency and bandwidth consumption, and provides an effective solution for safe and efficient FDIA detection in large-scale distributed power systems.

[0022] The preferred embodiment of the FDIA detection method based on federated clustering averaging described in this invention, such as... Figure 1 As shown, the FDIA detection method based on federated clustering averages includes the following steps: Step S10: Obtain the local model parameters of multiple clients and the local dataset of each client, and construct all standardized samples of each client based on the feature mean and standard deviation vector of each local dataset.

[0023] Among them, such as Figure 2 As shown, in the method disclosed in this invention (Federated Cluster Averaging), the private data of each client cannot be exchanged. The samples of each client are encrypted and aligned, the model is trained locally, and then the model parameters are updated through gradient sharing, thereby achieving the purpose of federated training mode.

[0024] Specifically, the local model parameters of multiple clients and the local dataset of each client are obtained, and the feature mean and standard deviation vector of each local dataset are extracted; For each client, all samples in the local dataset are converted into corresponding standardized samples based on the feature mean and the standard deviation vector.

[0025] Among them, such as Figure 3 As shown, the overall process of FedClusAvg is illustrated. It can be seen that FedClusAvg retains the traditional two-layer federated learning architecture consisting of a client and a central server, while introducing hierarchical clustering and hierarchical sampling mechanisms to effectively solve the challenges brought about by data heterogeneity.

[0026] Specifically, for each client, to mitigate the inherent Non-IID characteristics of the local data distribution, a clustering operation is performed on the local data distribution. The local dataset is divided into multiple small subsets, and each subset is treated as an independent sub-client.

[0027] To ensure effective clustering and fair comparison among features, all sample feature values ​​are standardized to eliminate the influence of different units and measurement scales.

[0028] For each client's local dataset, extract its feature mean and standard deviation vector, and then transform all samples into standardized samples based on the feature mean and standard deviation vector: ; in, Indicates the client k The i A standardized sample, Indicates the client k The i One sample, Indicates the client k The characteristic mean, Indicates the clientk The standard deviation vector.

[0029] The division is performed element-wise, which ensures that the normalization reflects the basic characteristic distribution of the local grid measurement rather than the characteristics of individual samples. In order to eliminate the similarity and proportional bias between samples, the present invention further clusters the standardized samples of each client.

[0030] Step S20: For each client, cluster each standardized sample to obtain a cluster of each client.

[0031] In one of the embodiments disclosed in this invention, the client uses a weighted averaging strategy (including but not limited to this) to aggregate the learned model parameters from all sub-clients to generate an updated local model, which is then sent to a central server for global aggregation.

[0032] Specifically, for each client, the standardized sample is randomly defined as the first cluster center, and the standardized sample farthest from the first cluster center is defined as the second cluster center; Define a clustering threshold and calculate the clustering distance between each standardized sample and the first cluster center and the second cluster center; If there exists a clustering distance less than the clustering threshold, then the clustering distance is defined as the clustering threshold for the current round, until the minimum clustering threshold is obtained; The cluster center corresponding to the minimum clustering threshold is defined as the target cluster center of the client, and all the standardized samples are added to the target cluster center to obtain the cluster cluster of the client.

[0033] First, a threshold is selected as the clustering threshold (within the range of (0, 1)). Any sample is selected as the first cluster center, and the standardized sample farthest from this first cluster center in the local dataset is selected as the second cluster center. Then, new cluster centers are searched. Based on the existing two cluster centers, the distance between other standardized samples and these two cluster centers is calculated. If there is a standardized sample whose distance from any cluster center is greater than the defined clustering threshold, this standardized sample is defined as a new cluster center, and this process continues to find new cluster centers until the final cluster center is found (i.e., the distance from all standardized samples to this cluster center is the shortest). At this point, all standardized samples can be assigned to this cluster center according to the nearest neighbor principle, thus obtaining the clustering cluster of this client.

[0034] In this invention, clients with high internal data variability are divided into smaller virtual sub-clients based on feature similarity. These sub-clients are used to construct local training sets through stratified sampling to reduce intra-client variability. This resampling mechanism effectively mitigates the distribution variance within each client, thereby stabilizing the training dynamics under non-independent and identically distributed conditions.

[0035] Step S30: Construct a weighted average gradient for each client based on each local model parameter and each cluster, and use each weighted average gradient to iteratively optimize each local model to obtain the local model optimization parameters after each iteration.

[0036] In this invention, after local training, a weighted aggregation scheme is applied during model synchronization. The aggregation weights are determined based on training quality and parameter consistency, thereby achieving more accurate and adaptive global model updates.

[0037] Specifically, for each client, the current gradient of each cluster is constructed based on the local model parameters and the cluster cluster; The weighted average gradient of the cluster in the current iteration round is obtained by weighted fusion of all historical gradients of the client and the current gradient. Based on the clustering clusters, construct the client's objective function and the global function used to train the global model in the next iteration round; The client's local model is optimized using the objective function and the weighted average gradient to obtain the local model optimization parameters in all iteration rounds.

[0038] To simplify the description of the method described in this invention, two simplifying assumptions are made regarding the client's local dataset: first, each client's local dataset contains more than 100 standardized samples, which ensures sufficient statistical support for clustering; second, in the optimal classification scheme, the distance between cluster centers must exceed 50% of the average pairwise distance between samples before clustering. This condition ensures sufficient separability between clusters.

[0039] After clustering each client, each client is transformed into a micro-federated learning framework, whose internal algorithm execution process is as follows: (1) First, obtain the current local model parameters from the client; (2) Calculate the gradient of the local dataset based on the current local model parameters and the corresponding clusters; (3) Finally, the gradient is returned to the client for training the local model.

[0040] Furthermore, after obtaining the gradients of the client during each training iteration, its weighted average gradient can be calculated: ; ; ; in, This represents the weighted average gradient. Indicates aggregate weight, Indicates the first k Gradient of each client, Indicates the first k The first client's j The number of standardized samples in each category. Indicates the first k The first client's m The gradient of a standardized sample. m express index, Indicates the first k The number of standardized samples per client.

[0041] Then, in each client, the weighted average gradient is used to train the current iteration process.

[0042] Further, the sample size of all the standardized samples in the cluster of each client is determined; Based on the sample size and the total number of clients, construct the objective function for each client: ; ; ; in, Indicates a global function. Indicates the number of clients. Indicates sample size. This indicates the index of the current client. Indicates the first Intermediate functions for each client, Indicates the first Clustering of clients, Indicates the first The target function for each client, Indicates the first i A standardized sample, Indicates the predicted first i One sample, Indicates the number of iterations in the current iteration round. i Local model parameters for each client.l This represents the loss function.

[0043] At the start of each communication round, all clients download the latest global model parameters from the central server. Each client uses the sampled data to perform multiple rounds of local training to generate new local model parameters. Based on the local model parameters of all clients, the server aggregates them to generate a new global model, which is then broadcast to all clients for use in the next iteration.

[0044] In the federated learning process disclosed in this invention, it is assumed that there are K individual clients participating in the training. The objective function for each client can be constructed based on its sample size and the total number of clients.

[0045] In this invention, the local dataset of each client is first clustered according to its inherent feature attributes. Next, hierarchical sampling is performed. This ensures that the constructed local training subset is more balanced and can represent the underlying data distribution. While retaining the traditional two-layer federated learning architecture consisting of clients and a central server, hierarchical clustering and hierarchical sampling mechanisms are introduced to effectively solve the challenges brought about by data heterogeneity.

[0046] Step S40: Input all the local model optimization parameters into the central server for global averaging to obtain global parameters for updating the global model of the central server, and input the global parameters into each client to optimize each local model.

[0047] Specifically, all the local model optimization parameters in each iteration are input to the central server for aggregation to obtain the corresponding global parameters. The global parameters in each iteration are then weighted and fused to obtain the target global parameters. The target global parameters are input into the local model of each client, and each local model is optimized according to the target global parameters to obtain the local model optimized in the current iteration.

[0048] On the server side, in order to minimize the impact of Non-IID data on model accuracy, this invention proposes to use the degree of deviation of parameters from the average parameters as the weight of the next round of model parameter updates for each client. When the deviation is large, the weight is reduced accordingly, and when the deviation is small, the weight is increased.

[0049] Furthermore, for the current iteration optimization process, the local model optimization parameters of each client are weighted and aggregated to obtain the global parameters in the current iteration: Based on the similarity in each of the global parameters, a corresponding aggregation weight is added to each of the global parameters; Based on all the aggregate weights, all the global parameters are fused to obtain the target global parameters.

[0050] Specifically, the first step is to obtain the updated local model parameters from each client in this round. (in, t Indicates indexes for different clients, m (Represents the client's iteration count index), and calculates the global parameter for the latest parameter value: ; in, Indicates the first t +1 client, Indicates the first m The next update of the aggregate weight.

[0051] In this invention, higher weights are assigned to updates that are closer to consensus, which can mitigate client drift under non-independent and identically distributed conditions. ; in, Represents the average model parameters. Temperature parameters that indicate the sensitivity to control deviation. The indicator function ensures that local models exhibiting large biases (often caused by noise in heterogeneous data) are penalized, thereby enhancing the stability of global model convergence. ; in, Represents the target's global parameters. n Indicates the number of standardized samples.

[0052] Furthermore, to address the issues of scalability and communication efficiency, this invention introduces an enhanced FedClusAvg+ algorithm, such as... Figure 4 As shown, the FedClusAvg+ algorithm introduces a hierarchical three-tier architecture, comprising clients, sub-servers, and a central server. In this design, multiple clients first communicate with the second-tier sub-servers, which perform intermediate aggregations of local model updates. These aggregation results are then transmitted to the central server for global averaging. Once the central model is updated, the new parameters are propagated back to each sub-server, which then distributes them to its respective clients. To improve interpretability, the components of the hierarchical architecture are mapped to real-world smart grid infrastructures.

[0053] Step S50: Use the optimized local model to identify the fake data input to the corresponding client, and obtain the attack data vector and target measurement vector in the fake data injection attack.

[0054] In the embodiments disclosed in this invention, the personal client corresponds to a distributed measurement device, such as a substation-level phasor measurement unit (PMU), a smart meter, or an intelligent electronic device (IED); the sub-server represents a regional control center or edge computing gateway that manages data aggregation for a specific geographical or topological area; and the service terminal is equivalent to the main control center of the central utility, which performs the final global model synchronization.

[0055] Taking the standard DC state estimation model of the power system in the client as an example, its measurement model is defined as follows: ; Where z represents the measurement vector, H represents the system topology matrix, x represents the state vector, and e represents Gaussian measurement noise.

[0056] Suppose an FDIA attacker injects a malicious vector 'a', causing the compromised measurement result to become: ; in, This indicates a damaged measurement result.

[0057] To maintain stealth and bypass bad data detection mechanisms, attackers construct malicious vectors as follows: ; Here, c represents a malicious vector that is consistent with the grid topology.

[0058] In the embodiments disclosed in this invention, the optimized local model is used to identify the fake data input to the corresponding client, and to determine the malicious vector (i.e., the attack data vector) and the target measurement vector injected into the data by the attacker.

[0059] This hierarchical communication strategy significantly reduces the number of communication rounds and alleviates bandwidth constraints, thereby improving overall training efficiency. Furthermore, by distributing aggregation and computation, the framework enhances system robustness, reduces the risk of single points of failure, and strengthens real-time response capabilities, which is crucial for FDIA detection in smart grid environments.

[0060] To further evaluate the detection performance of the FedClusAvg and FedClusAvg+ algorithms disclosed in this invention, seven widely used statistical metrics were employed: accuracy, precision, recall, F-measure (F1 score), receiver operating characteristic curve (ROC), area under curve (AUC), and Kolmogorov-Smirnov (KS test) statistic.

[0061] Among them, accuracy measures the proportion of correctly classified samples out of all evaluated samples; precision represents the proportion of true positive samples out of the samples predicted as positive; recall (also known as sensitivity) measures the proportion of actual positive samples correctly identified by the model; the F1 score is the harmonic mean of accuracy and recall, providing a balanced measure when the class distribution is uneven; ROC refers to plotting the true positive rate versus the false positive rate at different thresholds; AUC represents the area under the ROC curve, indicating the probability that the classifier will rank a randomly selected positive instance higher than a randomly selected negative instance; the KS statistic measures the maximum difference between the cumulative distribution functions of positive and negative samples, reflecting the discriminative power of the model.

[0062] To verify the feasibility and effectiveness of the proposed FedClusAvg and FedClusAvg+ algorithms, this invention uses the IEEE 118-Bus dataset (a standard test model widely used in power system research and simulation) for evaluation. The IEEE 118-Bus dataset contains 13 input features and 1 target label, which include various attributes from bus or node data, generator data, load data, branch data, and Transformer data.

[0063] In distributed energy systems, data typically originates from different physical devices, geographical regions, and operational statuses, naturally exhibiting Non-IID characteristics. The Non-IID problem mainly manifests as an imbalance in data distribution between different buses, generators, and load nodes, leading to degraded model generalization in federated learning or data-driven analytics.

[0064] Secondly, a federated learning-based FDIA detection model is constructed based on the FedClusAvg algorithm. This model is used to determine whether a specific state variable has been maliciously compromised. After multiple rounds of feature engineering and verification, 13 information-rich features are selected as inputs to the detection model, and the output indicates whether a given bus state variable has been affected by FDIA.

[0065] In the experiment, grid datasets collected from different nodes were randomly divided into training and test sets, containing 60,000 and 10,000 samples respectively. The ratio of attack samples to normal samples was maintained at 2:8 to simulate a real intrusion scenario. To reflect the non-IID nature of data in a federated environment, the training set was divided into 100 client datasets using a label skew strategy, with the proportion of attack samples varying from client to client.

[0066] FDIA detection was performed using the Rec-AD model (Recurrent Adversarial Network for Anomaly Detection), integrated into the FedClusAvg framework; all model weights were initialized to zero, and the learning rate was set to 0.01. Both FedClusAvg and the FedAvg algorithm were implemented using the FedML framework (Federated Machine Learning Library). Experiments were performed in a Visual Studio Code (VSCode) environment with Python extensions, running on Ubuntu 20.04.4 LTS and Python 3.8. Software dependencies included PyTorch 1.13 and FedML 0.7.1; specific experimental configurations are shown in Table 1. Table 1: Experiment Configuration Table

[0067] In the first part of the experiment, the performance of FedClusAvg and FedAvg algorithms was compared under the same federated learning conditions. Both models were trained for 400 iterations using the same training dataset. The obtained parameters were then evaluated on the test set to assess the effectiveness of the models. Specific results are shown in Table 2. Table 2: Comparison Results

[0068] Among them, such as Figure 5 As shown, Figure 5 (a) shows the ROC metric of the FedClusAvg algorithm. Figure 5 (b) shows the ROC metric of the FedAvg algorithm, and the KS statistic measures the maximum difference between the true positive rate and the false positive rate. The higher the value, the better the separation between the positive and negative categories.

[0069] Furthermore, in the second part of the experiment, the FedClusAvg+ and FedAvg+ algorithms were evaluated under the same settings as in the previous section, with the only modification being the introduction of a three-layer hierarchical communication parameter Q. Descriptive statistics of the evaluation metrics are summarized in Table 3: Table 3: Summary Table of Evaluation Indicators

[0070] The corresponding ROC curves for the evaluation indicators are as follows: Figure 6 As shown ( Figure 6 (a) shows the ROC metric of the FedClusAvg+ algorithm. Figure 6(b) shows the ROC index of the FedAvg+ algorithm; it can be seen that the KS statistic of the FedClusAvg+ algorithm exceeds that of FedClusAvg+, indicating that its classification ability is stronger.

[0071] It's important to note that the recall values ​​of FedAvg and FedAvg+ are consistently lower than those achieved by FedClusAvg and FedClusAvg+. This difference is likely due to the significant impact of data heterogeneity. Because FedAvg and FedAvg+ apply a uniform average across all clients without considering the underlying Non-IID features, their global models typically fail to adequately generalize to diverse data distributions. Specifically, when attack patterns are unevenly distributed across clients, the global model often performs poorly in detecting a small number of attack cases, resulting in lower recall.

[0072] Furthermore, the lack of advanced aggregation strategies in FedAvg+ may lead to ineffective integration of client-specific knowledge. In contrast, both FedClusAvg and FedClusAvg+ utilize cluster-based parameter aggregation mechanisms, which better capture structural variations in local data. This enables the global model to generalize more effectively across heterogeneous clients, resulting in higher recall and overall performance in FDIA detection tasks.

[0073] Analysis of the aforementioned evaluation metrics shows that FedClusAvg and FedClusAvg+ outperform their baseline peers on all evaluation criteria. Furthermore, the proposed algorithms exhibit superior stability, thereby improving the real-time responsiveness and robustness of FDIA detection. By reducing the risk of regional misclassification, this contributes to the overall security and intelligence of modern smart grid infrastructure.

[0074] To further evaluate the advantages of the proposed hierarchical communication framework, comparative experiments were conducted on the IEEE 118 bus system dataset, evaluating FedClusAvg+ with FedProx (Federated Proximal, a FL algorithm) and FedNova (Federated Learning via Normalized Averaging, another FL algorithm) using FDIA detection. FedProx introduces an approximation term to reduce the impact of client model drift, while FedNova applies normalized update aggregation to stabilize convergence. Despite these design improvements, both methods exhibit limited performance gains under non-uniform conditions.

[0075] Experimental results show that FedClusAvg+ outperforms FedProx and FedNova in all metrics, including accuracy, precision, recall, and F1 score. Specifically, FedClusAvg+ has an average accuracy of 96.32% and an F1 score of 96.11%, while FedProx has an average accuracy of 94.45%, FedNova has an average accuracy of 94.89% and an F1 score of 94.89%, and FedNova has an average accuracy of 93.96% and an F1 score of 94.08%.

[0076] These results highlight the effectiveness of multi-layer architectures in addressing the challenges of non-independent and identically distributed data and improving overall detection performance. To ensure statistical rigor, all experiments were run five times independently using different random seeds.

[0077] Furthermore, the results reported in Tables 2 and 3 include standard deviations that account for variability. Additionally, t-tests were performed, confirming that the performance improvement of FedClusAvg+ compared to baseline methods such as FedAvg and FedProx was statistically significant (p < 0.05). FedClusAvg+ retains the cluster-based aggregation advantages of FedClusAvg while introducing a sub-server layer into intermediate client-server communication. This hierarchical architecture eliminates the communication bottleneck of the central server, improves training throughput, and enhances the scalability of large-scale joint deployments. These features make FedClusAvg+ particularly suitable for practical applications in distributed and latency-sensitive environments such as smart grids.

[0078] Furthermore, in the embodiments disclosed in this invention, the baseline detection performance of FedAvg+ and FedClusAvg+ at different system scales was compared, and the results are shown in Table 4: Table 4: Baseline Detection Performance Comparison Table

[0079] Among them, IEEE 300-bus represents a standard test model widely used in power system research and simulation. In all scenarios, FedClusAvg+ outperforms FedClusAvg+. Notably, in a provincial grid environment, FedClusAvg+ achieves an accuracy of 92.8%, 2.5 percentage points higher than FedClusAvg+, indicating stronger generalization ability and robustness in large-scale systems. Furthermore, comparisons with FedProx and FedNova confirm that FedClusAvg+ achieves superior performance in all evaluated benchmarks.

[0080] In the four test systems, FedClusAvg+ achieved an average accuracy of 94.63% and an AUC of 0.9425, significantly outperforming the other methods. This advantage is attributed to its hierarchical communication framework and client clustering strategy, which together mitigate communication latency, model drift, and data heterogeneity. In the baseline, FedProx typically surpasses FedAvg+ by introducing a proximal term that constrains the divergence between the local and global models. This yields approximately 0.6%–1.0% and 0.005–0.008 gains in accuracy and AUC, respectively, which is particularly significant in heterogeneous environments such as regional or provincial grids.

[0081] While its communication standardization offers a theoretical convergence advantage, this hasn't translated into a meaningful gain in FDIA detection performance. In some scenarios, FedNova even performs worse than FedAvg+, suggesting it's better suited for correcting imbalanced local updates than for enhancing detection capabilities.

[0082] As system size increases, performance differences between algorithms become more pronounced. While these differences are negligible in small-scale systems (such as IEEE 118-bus or IEEE 300-bus), they become significant in more complex settings where communication architecture, aggregation strategies, and robustness are crucial for detection effectiveness.

[0083] Furthermore, under progressive FDIA (Subtle Attack Types), FedClusAvg+ achieved a recall rate of 94.1%, 3.8 percentage points higher than FedAvg+, while reducing the FAR (False Alarm Rate) by 2.9 percentage points. These results highlight that FedClusAvg+, with its clustering and attention mechanisms, is more effective at capturing subtle attack patterns.

[0084] In this unbalanced situation, the advantages of FedClusAvg+ become even more apparent, with an 8.2% improvement in accuracy, a 6.3% improvement in recall, and a 7.3% improvement in F1 score compared to FedAvg+. These results highlight the effectiveness of hierarchical clustering and adaptive aggregation in handling minority class detection, maintaining a low false alarm rate, and ensuring practical applicability in real-world grid surveillance.

[0085] Furthermore, this invention investigated the model adaptability under different levels of customer heterogeneity; the results show that the performance of both methods decreases with increasing heterogeneity; however, FedClusAvg+ exhibits significantly higher robustness. Under high heterogeneity (70% variation), FedClusAvg+ maintained 89.7% accuracy on the IEEE 300 bus system, 8.5 percentage points higher than FedAvg+. On provincial power grids, this gap widened to 9.9 percentage points. These results validate the effectiveness of FedClusAvg+'s hierarchical clustering in addressing data distribution differences and demonstrate its applicability to large-scale, resource-diverse power system environments.

[0086] Furthermore, in the FDIA detection task based on the IEEE 118 bus dataset, this invention compares and analyzes the communication efficiency and system scalability of the traditional federated cluster averaging algorithm (FedClusAvg) and its enhanced variant (FedClusAvg+) with a three-layer communication architecture.

[0087] In terms of communication efficiency, FedClusAvg+ has a significant advantage over FedClusAvg. The original FedClusAvg used a standard client-server architecture, where each round of communication involved all clients uploading their local model updates to a central server, and then downloading the updated global model. As the number of clients increases or network bandwidth becomes limited, this centralized communication model can lead to severe congestion, especially in low-bandwidth environments such as WiFi.

[0088] To address this limitation, FedClusAvg+ introduces a middleware layer of sub-servers, forming a hierarchical client-sub-server-central server communication topology. In each round of communication, the client first transmits its locally trained model to a designated sub-server. These sub-servers perform local aggregation and forward the aggregated updates to the central server. By reducing direct communication between the client and the central server, this architecture significantly eliminates communication bottlenecks and supports parallel processing across multiple sub-servers, thereby reducing overall system latency.

[0089] Among them, such as Figure 7As shown, experimental results on the IEEE 118 bus dataset indicate that under WiFi conditions (10Mbps), FedClusAvg's average communication latency per round is approximately 320 seconds, while FedClusAvg+ reduces this latency to around 270 seconds, a reduction of approximately 15.6%. Under 5G conditions (100Mbps), the advantage becomes even more pronounced: FedClusAvg+ achieves a latency of 85 seconds per round, while FedClusAvg's latency is 100 seconds per round. Despite the introduction of sub-servers in the hierarchical architecture, the computational overhead of the local cluster in the IEEE 118 node system accounts for only 2.3% of the total training time. In contrast, due to the alleviation of bandwidth bottlenecks, the overall communication time is reduced by 15.6%, with even better results in the 5G environment. These results highlight the superior bandwidth utilization and network adaptability of the hierarchical FedClusAvg+ design.

[0090] Furthermore, FedClusAvg+ supports enhanced concurrency by allowing multiple sub-servers to simultaneously aggregate updates from different subsets of clients. This alleviates the congestion that often occurs when a large number of clients communicate with a single central server concurrently. Therefore, FedClusAvg+ not only improves communication efficiency and reduces latency, but also provides a more scalable foundation for deployments in large-scale federated environments.

[0091] This invention proposes an enhanced federated learning framework based on the FedClusAvg algorithm to address key challenges in FDIA detection in smart grids. The framework addresses the non-independent and identically distributed nature of distributed measurements and protects data privacy through a hierarchical architecture integrating clients, sub-servers, and a central server. By combining cluster sampling, bias-based weighted aggregation, and multi-layer communication, the method improves model generalization, detection accuracy, and training efficiency. It significantly reduces the number of communications and bandwidth consumption while enhancing robustness against regional misclassification and adversarial exploitation due to data heterogeneity. Experimental evaluations on IEEE 118 and 300 bus systems demonstrate that the proposed algorithm consistently outperforms classic methods such as FedAvg, FedProx, and FedNova in terms of accuracy, recall, and communication efficiency. Furthermore, the framework ensures privacy compliance, reduces the risk of data leakage, and makes it suitable for practical deployment in large-scale, heterogeneous, and safety-critical power systems. In summary, the proposed method advances the development of secure, scalable, and privacy-preserving FDIA detection solutions for modern smart grids. Furthermore, this framework ensures privacy compliance and reduces the risk of data breaches, making it suitable for practical deployment in large-scale, heterogeneous, and safety-critical power systems. In summary, the proposed approach facilitates the development of secure, scalable, communication-efficient, and heterogeneous sensing FDIA detection solutions for modern smart grids.

[0092] Furthermore, such as Figure 8 As shown, based on the above-described FDIA detection method based on federated clustering averaging, the present invention also provides a corresponding FDIA detection system based on federated clustering averaging, wherein the FDIA detection system based on federated clustering averaging includes: The data standardization module 51 is used to obtain the local model parameters of multiple clients and the local dataset of each client, and to construct all standardized samples of each client based on the feature mean and standard deviation vector of each local dataset; Clustering module 52 is used to cluster each standardized sample for each client to obtain a cluster cluster for each client; The client transformation module 53 is used to construct a weighted average gradient for each client based on each local model parameter and each cluster, and to iteratively optimize each local model using each weighted average gradient to obtain the local model optimization parameters of each local model after each iteration. The intermediate aggregation and global averaging module 54 is used to input all the local model optimization parameters to the central server for global averaging, to obtain global parameters for updating the global model of the central server, and to input the global parameters to each client to optimize each local model. The client measurement module 55 is used to identify the fake data input to the corresponding client using the optimized local model, and obtain the attack data vector and target measurement vector in the fake data injection attack.

[0093] Furthermore, such as Figure 9 As shown, based on the above-mentioned FDIA detection method and system based on federated clustering average, the present invention also provides a terminal, which includes a processor 10, a memory 20 and a display 30. Figure 9 Only some of the terminal components are shown; however, it should be understood that it is not required to implement all of the components shown, and more or fewer components may be implemented instead.

[0094] In some embodiments, the memory 20 may be an internal storage unit of the terminal, such as a hard disk or memory. In other embodiments, the memory 20 may be an external storage device of the terminal, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc. Further, the memory 20 may include both internal and external storage devices. The memory 20 is used to store application software and various types of data installed on the terminal, such as the program code installed on the terminal. The memory 20 can also be used to temporarily store data that has been output or will be output. In one embodiment, the memory 20 stores an FDIA detection program 40 based on federated clustering average, which can be executed by the processor 10 to implement the FDIA detection method based on federated clustering average in this application.

[0095] In some embodiments, the processor 10 may be a central processing unit (CPU), a microprocessor, or other data processing chip, used to run program code stored in the memory 20 or process data, such as executing the FDIA detection method based on federated clustering average.

[0096] In some embodiments, the display 30 may be an LED display, a liquid crystal display, a touch-sensitive liquid crystal display, or an OLED (Organic Light-Emitting Diode) touchscreen. The display 30 is used to display information on the terminal and to display a visual user interface. The components of the terminal communicate with each other via a system bus.

[0097] In one embodiment, when the processor 10 executes the FDIA detection program 40 based on federated clustering average in the memory 20, it implements the steps of the FDIA detection method based on federated clustering average as described above.

[0098] The present invention also provides a computer-readable storage medium, wherein the computer-readable storage medium stores an FDIA detection program based on federated clustering average, the FDIA detection program based on federated clustering average being executed by a processor to implement the steps of the FDIA detection method based on federated clustering average as described above.

[0099] In summary, this invention provides a method and related equipment for FDIA detection based on federated clustering averaging. The method includes: acquiring local model parameters of multiple clients and local datasets of each client; constructing all standardized samples for each client based on the feature mean and standard deviation vector of each local dataset; clustering each standardized sample for each client to obtain a cluster cluster for each client; constructing a weighted average gradient for each client based on each local model parameter and each cluster cluster; iteratively optimizing each local model using each weighted average gradient to obtain optimized parameters for each local model after each iteration; inputting all optimized parameters of the local models into a central server for global averaging to obtain global parameters for updating the global model of the central server; inputting the global parameters into each client to optimize each local model; and using the optimized local models to identify fake data input to the corresponding client to obtain attack data vectors and target measurement vectors in fake data injection attacks. This invention takes into account the non-IID distribution nature of distributed measurement, protects data privacy through a hierarchical architecture integrating clients, sub-servers and a central server, has scalability, and improves the detection efficiency of fake injection attack data.

[0100] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or terminal that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or terminal. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or terminal that includes that element.

[0101] Of course, those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware (such as a processor, controller, etc.). The program can be stored in a computer-readable storage medium, and when executed, it can include the processes described in the above method embodiments. The computer-readable storage medium can be a memory, magnetic disk, optical disk, etc.

[0102] It should be understood that the application of the present invention is not limited to the examples above. Those skilled in the art can make improvements or modifications based on the above description, and all such improvements and modifications should fall within the protection scope of the appended claims.

Claims

1. A method for detecting FDIA based on federated clustering averaging, characterized in that, The FDIA detection method based on federated clustering averages includes: Obtain the local model parameters of multiple clients and the local dataset of each client, and construct all standardized samples for each client based on the feature mean and standard deviation vector of each local dataset; For each client, each standardized sample is clustered to obtain a cluster for each client; Based on each local model parameter and each cluster, a weighted average gradient is constructed for each client. Each local model is iteratively optimized using each weighted average gradient to obtain the local model optimization parameters after each iteration. All the local model optimization parameters are input to the central server for global averaging to obtain global parameters for updating the global model of the central server. The global parameters are then input to each client to optimize each local model. The optimized local model is used to identify the fake data input to the corresponding client, and the attack data vector and target measurement vector in the fake data injection attack are obtained.

2. The FDIA detection method based on federated clustering averaging according to claim 1, characterized in that, The step of obtaining the local model parameters of multiple clients and the local dataset of each client, and constructing all standardized samples for each client based on the feature mean and standard deviation vector of each local dataset, specifically includes: Obtain the local model parameters of multiple clients and the local dataset of each client, and extract the feature mean and standard deviation vector of each local dataset; For each client, all samples in the local dataset are converted into corresponding standardized samples based on the feature mean and the standard deviation vector.

3. The FDIA detection method based on federated clustering averaging according to claim 1, characterized in that, The step of clustering each standardized sample for each client to obtain a cluster for each client specifically includes: For each client, the standardized sample is randomly defined as the first cluster center, and the standardized sample farthest from the first cluster center is defined as the second cluster center; Define a clustering threshold and calculate the clustering distance between each standardized sample and the first cluster center and the second cluster center; If there exists a clustering distance less than the clustering threshold, then the clustering distance is defined as the clustering threshold for the current round, until the minimum clustering threshold is obtained; The cluster center corresponding to the minimum clustering threshold is defined as the target cluster center of the client, and all the standardized samples are added to the target cluster center to obtain the cluster cluster of the client.

4. The FDIA detection method based on federated clustering averaging according to claim 1, characterized in that, The step of constructing a weighted average gradient for each client based on each local model parameter and each cluster, and iteratively optimizing each local model using each weighted average gradient to obtain the local model optimization parameters after each iteration, specifically includes: For each client, the current gradient of each cluster is constructed based on the local model parameters and the cluster cluster; The weighted average gradient of the cluster in the current iteration round is obtained by weighted fusion of all historical gradients of the client and the current gradient. Based on the clustering clusters, construct the client's objective function and the global function used to train the global model in the next iteration round; The client's local model is optimized using the objective function and the weighted average gradient to obtain the local model optimization parameters in all iteration rounds.

5. The FDIA detection method based on federated clustering averaging according to claim 4, characterized in that, The step of constructing the client's objective function and the global function for training the global model in the next iteration based on the clustered clusters specifically includes: Determine the sample size of all the standardized samples in the cluster of each client; Based on the sample size and the total number of clients, construct the objective function for each client: ； ； ； in, Indicates a global function. Indicates the number of clients. Indicates sample size. This indicates the index of the current client. Indicates the first Intermediate functions for each client, Indicates the first Clustering of clients, Indicates the first The target function for each client, Indicates the first i A standardized sample, Indicates the predicted first i One sample, Indicates the number of iterations in the current iteration round. i Local model parameters for each client. l This represents the loss function.

6. The FDIA detection method based on federated clustering averaging according to claim 1, characterized in that, The process of inputting all the local model optimization parameters to the central server for global averaging to obtain global parameters for updating the global model of the central server, and then inputting the global parameters to each client to optimize each local model, specifically includes: All the local model optimization parameters in each iteration are input to the central server for aggregation to obtain the corresponding global parameters. The global parameters in each iteration are then weighted and fused to obtain the target global parameters. The target global parameters are input into the local model of each client, and each local model is optimized according to the target global parameters to obtain the local model optimized in the current iteration.

7. The FDIA detection method based on federated clustering averaging according to claim 6, characterized in that, The process of inputting all the local model optimization parameters from each iteration round to the central server for aggregation to obtain the corresponding global parameters, and then weighting and fusing the global parameters from each round to obtain the target global parameters, specifically includes: For the current iteration optimization process, the local model optimization parameters of each client are weighted and aggregated to obtain the global parameters in the current iteration: Based on the similarity in each of the global parameters, a corresponding aggregation weight is added to each of the global parameters; Based on all the aggregate weights, all the global parameters are fused to obtain the target global parameters.

8. An FDIA detection system based on federated clustering averaging, characterized in that, The FDIA detection system based on federated clustering average is used to implement the FDIA detection method based on federated clustering average as described in any one of claims 1-7, wherein the FDIA detection system based on federated clustering average includes: The data standardization module is used to obtain the local model parameters of multiple clients and the local dataset of each client, and to construct all standardized samples of each client based on the feature mean and standard deviation vector of each local dataset; The clustering module is used to cluster each standardized sample for each client to obtain a cluster for each client; The client transformation module is used to construct a weighted average gradient for each client based on each local model parameter and each cluster, and to iteratively optimize each local model using each weighted average gradient to obtain the local model optimization parameters after each iteration. The intermediate aggregation and global averaging module is used to input all the local model optimization parameters to the central server for global averaging, obtain global parameters for updating the global model of the central server, and input the global parameters to each client to optimize each local model. The client-side measurement module is used to identify fake data input to the corresponding client using an optimized local model, and to obtain the attack data vector and target measurement vector in the fake data injection attack.

9. A terminal, characterized in that, The terminal includes: a memory, a processor, and a federated clustering average-based FDIA detection program stored in the memory and executable on the processor. When the federated clustering average-based FDIA detection program is executed by the processor, it implements the steps of the federated clustering average-based FDIA detection method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an FDIA detection program based on federated clustering average, which, when executed by a processor, implements the steps of the FDIA detection method based on federated clustering average as described in any one of claims 1-7.

Images