A power artificial intelligence application vulnerable node identification and protection method based on gradient saliency

Abstract

The application belongs to the technical field of power system and artificial intelligence security, and more particularly to a power artificial intelligence application vulnerable node identification and protection method based on gradient significance. The method comprises: rearranging and zero-padded extension of the original feature vector of the power system operation state sample, constructing a two-dimensional feature matrix and completing model training; based on model back propagation and spatial smoothing technology, extracting a high-sensitive feature area with a higher dependence degree in the model judgment process; using descending extraction and feature rearrangement index, accurately reverse mapping and positioning the two-dimensional high-sensitive area to the original one-dimensional core physical measuring point; based on node sensitivity quantification of single-point attack cost, formulating and outputting a hierarchical priority protection strategy of core vulnerable nodes. The application solves the problem that the existing power system anomaly detection method is difficult to identify the key dependent measuring point of the model, difficult to locate the vulnerable node and guide the protection deployment accordingly.

Description

Technical Field

[0001] This invention belongs to the technical field of power system and artificial intelligence security, and more specifically, relates to a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency. Background Technology

[0002] With advancements in deep learning technology, particularly in feature extraction and massive data processing, deep learning-based intelligent safety assessment applications for power systems have become crucial for monitoring their operational status and ensuring safe operation. However, these applications, which rely on real-time power system measurement data as input, face security threats such as adversarial attacks. For instance, attackers can exploit potential vulnerabilities in power information system communication protocols to launch man-in-the-middle attacks during measurement data transmission, tampering with real-time measurement data and misleading the output of power AI applications.

[0003] In power systems, real-time measurement data typically includes various types of data such as line power flow, generator output, and load power. Due to constraints from physical laws such as Kirchhoff's laws, there are close correlations between different measuring points and different types of measurement data. Furthermore, intelligent security assessment applications directly classify or detect raw multidimensional operational data; their internal decision-making mechanisms exhibit typical black-box characteristics, making it difficult to explicitly analyze the dependencies between classification results and various nodes and data types. In adversarial attack scenarios, the complex dependencies between classification results and various nodes and data types make it difficult to identify the key measuring point areas that the model truly relies on. Once an attacker injects localized false data into a small number of highly sensitive nodes, even if most other nodes remain normal, the detection model may still misjudge or miss detections, thus affecting the reliability of power system anomaly detection.

[0004] In existing technologies, one type of method focuses on improving the overall classification accuracy of the model, but lacks the ability to locate key vulnerable nodes and cannot answer the question of "which physical measurement points the model relies on for discrimination". Another type of method can verify the vulnerability of the model through attack experiments, but usually stays at the level of attack effect evaluation and has not yet formed a complete technical closed loop of "key area identification - physical node mapping - protection strategy generation". Therefore, it is difficult to directly guide the deployment of protection resources and the improvement of model robustness. Summary of the Invention

[0005] This invention aims to overcome at least one of the defects of the existing technology and provide a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency. By combining the spatiotemporal correlation of multidimensional power grid operation data, the original features are structurally rearranged and matrix-represented. The key dependency regions in the anomaly detection model are identified using model gradient saliency and mapped back to actual physical nodes. This provides a basis for prioritizing the protection of key measurement points and deploying protection resources, thereby improving the protection capability of the power system anomaly detection model against local false data injection attacks. This solves the problem that existing power system anomaly detection methods are unable to identify key dependency measurement points of the model, locate vulnerable nodes, and guide protection deployment accordingly.

[0006] The detailed technical solution of this invention is as follows: A method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency, the method comprising: S1. Collect power system operating status samples and organize them into a format of length [missing information]. The original one-dimensional feature vector is then rearranged based on correlation and padded with zeros to expand the dimension, thus constructing a two-dimensional feature matrix. The two-dimensional feature matrix is ​​used as input and the corresponding running state label is used as output label to train a convolutional neural network classification model, thereby obtaining a basic anomaly detection model for subsequent gradient significance analysis. S2. Based on the classification output of the basic anomaly detection model, the local gradient of the two-dimensional feature matrix is ​​combined with spatial smoothing technology to extract highly sensitive feature regions with high model decision dependence. S3. Extract the values ​​with the highest significance from the significance heatmap. Each location index is used as a key vulnerable region to obtain a set of key vulnerable nodes; S4. Quantify the cost of a single point of attack based on the sensitivity of each node, classify vulnerable nodes according to the attack cost, and output a layered priority protection strategy.

[0007] Furthermore, S1 specifically includes: S11. Collect N power system operation status samples. Each operation status sample includes line power flow, generator active power output and load active power data. For any operation status sample, arrange the D physical measurement features it contains in a preset order to form a one-dimensional original feature vector of length D. Each running status sample is configured with a corresponding running status label y, where y=1 indicates normal running status and y=0 indicates abnormal or attack status. S12. Calculate the Pearson correlation coefficient between each feature based on all original feature vectors to obtain the feature correlation matrix; An adjacency matrix is ​​constructed based on the correlation coefficient threshold, and a feature rearrangement index is generated using the inverse Cuthill-McKee algorithm. For the original feature vector Reorder; S13. Pad the original feature vector X with zeros and expand its dimension so that the number of features after expansion is a perfect square number, in order to meet the requirement of the number of features to be reconstructed into a two-dimensional square matrix. S14. Divide all running state samples into training set and test set according to a preset ratio, and reconstruct the expanded feature vector into a two-dimensional feature matrix M through the above steps. Using the two-dimensional feature matrix M corresponding to the training set as the input of the convolutional neural network and the corresponding running state label y as the supervised output, the convolutional neural network is iteratively trained to obtain a basic anomaly detection model for identifying normal running state and abnormal or attack state.

[0008] The test set is not used in the parameter iteration update of the convolutional neural network and is reserved for subsequent gradient significance analysis.

[0009] Furthermore, S2 specifically includes: S21. Select the target category to be analyzed. The computational basic anomaly detection model is designed for the target category. The output score is related to the input two-dimensional feature matrix. gradient: (1) In formula (1), Indicates the target category. This represents the model's output score for the target category. Indicates model parameters, This indicates the significance of the local gradient of the input matrix, reflecting the direct impact of input changes on model predictions; S22. Select K test samples from the test set and calculate the gradient significance matrix corresponding to each test sample; calculate the mean of the absolute values ​​of the K gradient significance matrices and perform a two-dimensional convolution with a Gaussian kernel to obtain a smoothed significance heatmap. : (2) In formula (2), K represents the number of test samples selected from the test set and used for gradient significance analysis; Indicates the test sample index; Indicates the first The gradient significance matrix corresponding to each test sample; Indicates the Gaussian filter kernel; This represents a two-dimensional convolution operation.

[0010] This processing is used to reduce the impact of noise from single samples and local features, resulting in a globally stable saliency heatmap.

[0011] S23. Perform dimensional masking filtering to filter the saliency heatmap. The pixel gradient value at the corresponding zero-padding position is forcibly reset to negative infinity, and then the highly sensitive feature regions with high model decision dependence are extracted; the dimensionality masking mechanism is used to prevent the model from identifying invalid zero-padding pixels as key regions, thus maintaining the rigor of feature mapping.

[0012] Furthermore, S3 specifically includes: S31. The global saliency heatmap after dimensionality masking. Flatten it into a one-dimensional vector and sort it in descending order of significance value; S32. Select the k most significant indexes from the sorting results to form a set of highly significant indexes: (3) In formula (3), The highest significance value indicates the top An index set consisting of positions; This represents the index of the j-th highly salient position in the rearranged eigenvector. , k This indicates the number of critical vulnerable nodes that need to be extracted. Rearrange the index using the generated features By performing a table lookup and mapping, we obtain the set of critical vulnerable nodes: (4) In formula (4), This represents the feature rearrangement index, where the index value corresponding to the rearranged position represents the physical measurement point number corresponding to that position in the original feature vector; This represents the set of critical vulnerable nodes obtained from the mapping.

[0013] Since step S23 has set the significance value of the zero-padding position to negative infinity, all the highly significant position indices correspond to valid original physical measurement points.

[0014] Furthermore, S3 also includes perturbation-based verification of the set of critical vulnerable nodes to verify the sensitivity of the extracted critical nodes, specifically including: S33. Extract clean test samples from the power system under normal operating conditions as benchmark data; Subsequently, in the feature space of the benchmark data, the set of critical vulnerable nodes obtained by reverse mapping is... The control group is set up by randomly selecting an equal number of non-critical nodes from the remaining feature space. .

[0015] S34. Construct relative quantity perturbation verification and absolute quantity perturbation verification respectively: In the relative perturbation verification, the same tampering factor was applied to both the experimental and control groups. Proportional disturbances; relative power flow distortion disturbances, proportionally stretched physical characteristic values: (5) In formula (5), Indicates the first The original feature values ​​corresponding to each physical measurement point ; Indicates the relative multiple of alteration; This represents the characteristic value after relative perturbation.

[0016] In the absolute perturbation verification, the same fixed offset was applied to both the experimental and control groups. Translational perturbation; absolute translational over-limit perturbation, applying a fixed-size absolute offset: (6) In formula (6), Represents a fixed absolute value of alteration; Indicates the first The characteristic values ​​of a physical measuring point after absolute perturbation.

[0017] S35. Input the perturbed experimental group samples and control group samples into the basic anomaly detection model respectively, and count the proportion of samples in the experimental group and control group that are judged to be in an abnormal or attack state, and obtain the corresponding model alarm rate respectively; under the same perturbation type and the same perturbation intensity, if the model alarm rate of the experimental group is higher than the preset multiple of the model alarm rate of the control group, then the extracted key vulnerable nodes are determined to have passed the perturbation control verification.

[0018] Furthermore, S4 specifically includes: S41. Construct a single-point attack cost metric to assess the vulnerability of physical nodes: (7) In formula (7), Indicates the first The gradient significance value is obtained after the input features corresponding to each physical measurement point are processed by two-dimensional spatial smoothing and dimensional masking. This indicates a very small positive number that prevents the denominator from being zero; Indicates the first The attack cost corresponding to each physical measurement point. The larger the gradient significance value, the lower the calculated attack cost, indicating that the input feature corresponding to that physical measurement point has a more significant impact on the model's judgment result.

[0019] S42, Based on attack cost metrics The physical nodes are sorted in ascending order, with those having lower attack costs being more vulnerable. A set of vulnerable nodes that should be prioritized for protection is identified, and these vulnerable nodes are then protected first. This phase forces attackers to migrate to higher-cost, suboptimal nodes, thus completing the survivability defense deployment.

[0020] S43. Based on the obtained layered protection priority, when protection resources are limited, prioritize the configuration of protection resources for more vulnerable nodes, making it difficult for attackers to continue to tamper with such highly sensitive nodes, and forcing the attack target to move to the second-best node with higher attack cost, thereby reducing the impact of local false data injection on the model's judgment results.

[0021] Compared with the prior art, the beneficial effects of the present invention are as follows: (1) The present invention provides a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency. The method is based on a two-dimensional matrix representation method of feature correlation rearrangement. By performing correlation analysis, topological rearrangement and two-dimensional matrix construction on the multi-dimensional operation features of the power system, the physical quantities with strong correlations are as close as possible in spatial distribution, which is conducive to the extraction of local correlation features by convolutional neural networks, thereby improving the ability of the anomaly detection model to represent the structured operation information of the power system.

[0022] (2) The present invention provides a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency. By using the key vulnerable node identification method based on gradient saliency, the gradient response of the model output with respect to the input matrix is ​​calculated, the highly significant regions that have a significant impact on the discrimination results are extracted, and the region is back-mapped to the original physical feature space, thereby realizing the location of key vulnerable nodes, improving the interpretability of the anomaly detection model, and providing a basis for the identification of key risk measurement points.

[0023] (3) This invention provides a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency. It discloses a priority protection method for critical vulnerable nodes. Based on the identification results of critical vulnerable nodes, a node priority protection scheme can be further formed, allowing protection resources to be deployed preferentially to key measurement points that have a significant impact on model discrimination, thereby enhancing the anomaly detection model's ability to protect against local false data injection attacks. After protection is implemented at critical nodes, the model's defense penetration rate decreases significantly, verifying the effectiveness of the method of this invention. Attached Figure Description

[0024] Figure 1 This is a flowchart of a method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency, as described in this invention.

[0025] Figure 2 This is a heat map showing the significance of key vulnerable areas in Embodiment 1 of the present invention.

[0026] Figure 3 is a response curve diagram of the model alarm rate under different attack intensities in Embodiment 1 of the present invention.

[0027] Figure 4 is an execution schematic diagram of defense line penetration rate before and after key node protection in Embodiment 1 of the present invention. DETAILED DESCRIPTION

[0028] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0029] It should be pointed out that the following detailed description is illustrative and aims to provide further explanation of the present invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by those of ordinary skill in the technical field to which the present invention pertains.

[0030] It should be noted that the terms used herein are only for the purpose of describing specific embodiments, and are not intended to limit the exemplary embodiments according to the present invention. As used herein, unless the context clearly indicates otherwise, the singular forms are also intended to include the plural forms. Furthermore, it should be understood that when the terms "contain" and / or "include" are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0031] On the premise of no conflict, the embodiments of the present invention and the features in the embodiments can be combined with each other.

[0032] Embodiment 1 With reference Figure 1 , this embodiment provides a method for identifying and protecting vulnerable nodes of electric power artificial intelligence applications based on gradient saliency, and the method comprises: S1. Collect operating state samples of the power system, and perform topology rearrangement and matrix construction; Collect the operating state samples of the power system and organize them into a one-dimensional original feature vector form with a length of , then perform correlation rearrangement and zero-padding dimension expansion to construct a two-dimensional feature matrix; taking the two-dimensional feature matrix as input and the corresponding operating state label as the output label, train a convolutional neural network classification model to obtain a basic anomaly detection model for subsequent gradient saliency analysis.

[0033] Specifically, the step S1 specifically comprises: S11. Collect operating state samples of the power system, and each operating state sample includes line power flow, generator active output and load active power data; arranging the physical measurement features contained in the i-th operating state sample in a preset order to form a length of physical measurement features arranged in a preset order to form a length of One-dimensional original feature vector (8) In formula (8), , This represents the total number of samples in the running state. This represents the total number of features contained in each running state sample. Indicates the first In the nth running status sample The measurement characteristic values ​​corresponding to each physical measurement point The physical measurement points include line power flow measurement points, generator active power output measurement points, and load active power measurement points. Each physical measurement point corresponds to an input feature in the original feature vector; a corresponding operating status label is configured for each operating status sample. ,in Indicates normal operating status. This indicates an abnormal or attacking state.

[0034] S12, Feature correlation rearrangement; The Pearson correlation coefficient between each feature is calculated based on all original feature vectors to obtain the feature correlation matrix; an adjacency matrix is ​​constructed based on the correlation coefficient threshold, and the inverse Cuthill-McKee algorithm is used to generate a feature rearrangement index. For the original feature vector Reorder the items.

[0035] S13. Pad the rearranged eigenvectors with zeros; Zero-padding and dimension expansion are performed to reshape it into a two-dimensional square matrix, with the number of zeros padded satisfying the following condition: (9) In formula (9), This indicates the number of zero values ​​added to the end of the rearranged eigenvector; The original feature dimension; Let be the feature dimension after zero-padding, and require... It is a perfect square.

[0036] S14. Divide all running status samples into training set and test set according to a preset ratio, and reconstruct the expanded feature vector into a two-dimensional feature matrix M through the above steps; in this embodiment, the ratio of the number of samples in the training set to the test set is 8:2.

[0037] Using the two-dimensional feature matrix M corresponding to the training set as the input of the convolutional neural network and the corresponding running state label y as the supervised output, the convolutional neural network is iteratively trained to obtain a basic anomaly detection model for identifying normal running state and abnormal or attack state.

[0038] The test set is not involved in the parameter iteration update of the convolutional neural network and is reserved for subsequent gradient saliency analysis. After topological rearrangement and matrix construction are completed, the gradient saliency feature extraction stage begins. Matrix reconstruction ensures that physical topological features can be effectively extracted and represented by the convolutional network. The gradient saliency feature extraction stage mainly utilizes the backpropagation mechanism of the deep learning model to obtain local sensitivity, and applies two-dimensional spatial smoothing filtering on this basis, which is a feature attribution process from a white-box perspective.

[0039] S2, Gradient saliency feature extraction; Based on the backpropagation of the basic anomaly detection model combined with spatial smoothing technology, highly sensitive feature regions with high model decision dependence are extracted.

[0040] S2 specifically includes the following steps: S21, Gradient estimation calculation.

[0041] After the basic anomaly detection model is trained, the calculation of the basic anomaly detection model for the target category is performed. The output score is related to the input two-dimensional feature matrix. Gradient (backpropagation): (1) In formula (1), The target category is defined, and the target category includes a normal category and an anomaly / attack category; in this embodiment, the anomaly / attack category is used as the target category, i.e. ; The parameter is The basic anomaly detection model is designed for input two-dimensional feature matrices. Output target category The predicted score; This represents the target category prediction score with respect to the input two-dimensional feature matrix. The gradient significance matrix is ​​used to characterize the degree of influence of feature changes at each position in the matrix on the target category prediction results.

[0042] S22, Spatial smoothing processing.

[0043] After the basic anomaly detection model has been trained, samples are selected from the test set pre-divided in step S14 that has not participated in the iterative update of the convolutional neural network parameters. For each test sample, calculate the gradient significance matrix corresponding to that test sample; for the... The absolute values ​​of the gradient significance matrices are averaged, and spatial smoothing is performed using a Gaussian filter to obtain the significance heatmap. : (2) In formula (2), K represents the number of test samples selected from the test set and used for gradient significance analysis; Indicates the test sample index; Indicates the first The gradient significance matrix corresponding to each test sample; Indicates the Gaussian filter kernel; This represents a two-dimensional convolution operation. This processing is used to reduce the impact of noise from single samples and local features, resulting in a globally stable saliency heatmap.

[0044] S23, Dimensional mask filtering.

[0045] Perform dimensional mask filtering to filter the saliency heatmap The pixel gradient value at the zero-padding position in step S13 is forcibly reset to negative infinity. Then, highly sensitive feature regions with high model decision dependence are extracted; the dimension masking mechanism is used to prevent the model from identifying invalid zero-padding pixels as key regions, thus maintaining the rigor of feature mapping.

[0046] S3, reverse mapping of fragile physical nodes; Based on the descending extraction results and feature rearrangement index, the two-dimensional highly sensitive region is reverse-mapped to the original one-dimensional physical measurement points to obtain the set of key vulnerable nodes.

[0047] Vulnerable physical node reverse mapping is used to accurately trace and locate the most vulnerable core physical measurement points in the actual power system by using descending order filtering and reordering index lookup tables based on the obtained two-dimensional global saliency heat map.

[0048] Specifically, S3 includes the following steps: S31. Extract highly sensitive areas.

[0049] Global saliency heatmap after dimension masking Flatten it into a one-dimensional vector and sort it in descending order of significance value.

[0050] S32. Generate a set of critical vulnerable nodes. Select the k most significant position indices from the sorting results in step S31 to form a set of highly significant position indices: (3) In formula (3), The highest significance value indicates the top An index set consisting of positions; This represents the index of the j-th highly salient position in the rearranged eigenvector. , k This indicates the number of critical vulnerable nodes that need to be extracted. Rearrange the index based on the features generated in step S12 By performing a lookup table mapping on the set of highly salient location indices, a set of critical vulnerable nodes is obtained: (4) In formula (4), This represents the feature rearrangement index generated in step S12, where Indicates the rearranged first... The original physical measurement point number corresponding to each location; This represents the set of critical vulnerable nodes obtained by reverse mapping.

[0051] Since step S23 has set the saliency value of the zero-padding position to negative infinity, all the highly saliency position indices correspond to valid original physical measurement points. This step achieves cross-domain localization and tracing from the two-dimensional feature domain to the actual one-dimensional physical domain.

[0052] Furthermore, in an optional verification method, the set of critical vulnerable nodes can be subjected to perturbation-controlled verification to verify the sensitivity of the extracted critical nodes, specifically including: S33. Pure test samples under normal operating conditions (Normal) of the power system can be extracted as benchmark data; Subsequently, in the feature space of the benchmark data, the set of critical vulnerable nodes obtained by reverse mapping is... The control group is set up by randomly selecting an equal number of non-critical nodes from the remaining feature space. .

[0053] S34. Relative quantity perturbation verification and absolute quantity perturbation verification can be constructed separately; In the relative perturbation verification, the same tampering factor was applied to both the experimental and control groups. Proportional disturbances; relative power flow distortion disturbances, proportionally stretched physical characteristic values: (5) In formula (5), Indicates the first The original feature values ​​corresponding to each physical measurement point ; Indicates the relative multiple of alteration; This represents the characteristic value after relative perturbation.

[0054] In the absolute perturbation verification, the same fixed offset was applied to both the experimental and control groups. Translational perturbation; absolute translational over-limit perturbation, applying a fixed-size absolute offset: (6) In formula (6), Represents a fixed absolute value of alteration; Indicates the first The characteristic values ​​of a physical measuring point after absolute perturbation.

[0055] S35. Input the perturbed experimental group samples and control group samples into the basic anomaly detection model respectively, and count the proportion of samples in the experimental group and control group that are judged to be in an abnormal or attack state, and obtain the corresponding model alarm rate respectively; under the same perturbation type and the same perturbation intensity, if the model alarm rate of the experimental group is higher than the preset multiple of the model alarm rate of the control group, then the extracted key vulnerable nodes are determined to have passed the perturbation control verification.

[0056] By using both relative and absolute perturbation methods, the dependence of the verification results on a single perturbation form can be reduced.

[0057] S4. Generation of priority protection strategies for critical vulnerable nodes; Based on the sensitivity of each node, the cost of a single point of attack is quantified. Vulnerable nodes are sorted from low to high attack cost to determine a set of priority protection nodes. When protection resources are limited, protection resources are configured for the set of priority protection nodes first, so that attackers cannot or find it difficult to continue to tamper with such highly sensitive nodes, and force the attack target to shift to the second-best node with a higher attack cost, thereby reducing the impact of local false data injection on the model's judgment results.

[0058] Targeted protection strategy generation is used to quantify the protection priority of different nodes and maximize protection effectiveness with limited resources.

[0059] Specifically, S4 includes the following steps: S41, Quantification of Single-Point Attack Costs.

[0060] To assess the vulnerability of physical nodes, a single point of attack cost metric is constructed: (7) In formula (7), Indicates the first The gradient significance value is obtained after the input features corresponding to each physical measurement point are processed by two-dimensional spatial smoothing and dimensional masking. This indicates a very small positive number that prevents the denominator from being zero; Indicates the first The attack cost corresponding to each physical measurement point.

[0061] This formula reveals the asymmetric vulnerability of highly sensitive nodes, which requires extremely low tampering costs.

[0062] S42, Output layered protection strategy.

[0063] Based on attack cost The physical nodes are sorted in ascending order, with those having lower attack costs being more vulnerable. The set of vulnerable nodes that should be prioritized for protection is determined, and priority protection is implemented for these vulnerable nodes.

[0064] This phase forces attackers to move to high-cost suboptimal nodes, thereby completing the deployment of survivability defenses.

[0065] S43, Prioritize the allocation of protection resources.

[0066] Based on the layered protection priority obtained in step S42, when protection resources are limited, protection resources are prioritized for vulnerable nodes with lower attack costs and higher gradient sensitivity. This makes it difficult for attackers to continue to tamper with such highly sensitive nodes and forces the attack target to shift to the suboptimal node with higher attack costs, thereby reducing the impact of local false data injection on the model's judgment results.

[0067] It should be noted that the layered priority protection strategy is not limited to a certain type of fixed hardware protection device, but rather determines the priority deployment targets of limited protection resources based on the identification results of critical vulnerable nodes and the attack cost ranking, thereby providing node-level priority basis for subsequent protection measures such as data integrity verification, redundancy measurement, access control or manual review.

[0068] On the other hand, this embodiment conducted experiments in the IEEE 14-bus power system data environment and verified the effectiveness of critical vulnerable node identification and priority protection. The experiments focused on examining the critical node identification results, changes in model alarm rates under different attack locations, and changes in model defense penetration rates before and after critical node protection, in order to evaluate the effectiveness of the method of this invention.

[0069] (1) Data and Model The IEEE 14-bus system is a typical test platform for power system analysis and security assessment, comprising generators, transmission lines, buses, and load nodes, and is commonly used for power system operation status analysis and disturbance detection tasks. In this experiment, the input data consists of 45 dimensions of operational features, with the first 20 dimensions representing line power flow characteristics, dimensions 21 to 34 representing generator active power output characteristics, and dimensions 35 to 45 representing load active power characteristics. The classification model employs a convolutional neural network structure. The input is a 7×7 single-channel two-dimensional feature matrix constructed by rearranging correlations and padding with zeros. The output layer consists of a Softmax activation function, used for both Normal and Attack outputs. The dataset is divided into training and test sets in an 8:2 ratio.

[0070] (2) Comparison method The performance of the method proposed in this invention is verified by setting different attack locations, different attack intensities, and comparing the protection of key nodes before and after.

[0071] (3) Implementation details During model training, the Adam optimizer was used, with a batch size of 64 and a total of 20 training epochs. In the experiment, the Pearson correlation coefficient matrix between the 45-dimensional features was first calculated, and an adjacency matrix was constructed using a threshold of 0.3. After removing diagonal self-loops, the RCM algorithm was used to generate a feature rearrangement index. Subsequently, the rearranged features were zero-padded to expand to 49 dimensions and reconstructed into a 7×7 two-dimensional single-channel feature matrix, which served as the input to the convolutional neural network. After model training, the gradient of the attack category output with respect to the input matrix was calculated for the test set input. The absolute values ​​of the gradients were averaged and then Gaussian smoothed to extract key vulnerable regions and obtain key vulnerable nodes through reverse mapping.

[0072] To verify the effectiveness of the method of the present invention, a set of comparative experiments were designed around the identification and priority protection of critical vulnerable nodes to evaluate the changes in model response before and after different attack locations, different attack intensities, and critical node protection.

[0073] like Figure 2 As shown, the horizontal axis represents the column index of the 7×7 two-dimensional feature matrix after RCM rearrangement, and the vertical axis represents the row index of the 7×7 two-dimensional feature matrix after RCM rearrangement. The color represents the gradient significance value at the corresponding position. The closer the color is to red, the more sensitive the model is to that position. This invention first calculates the gradient significance heatmap of the input matrix based on the trained anomaly detection model and extracts the key regions with the highest significance. Then, it obtains the key vulnerable nodes in the original physical feature space through reverse mapping of the rearranged index. Experimental results show that the identified Top-5 key vulnerable nodes are 36, 38, 42, 35, and 39, i.e., the red asterisks represent the selected Top-5 key vulnerable positions, which are concentrated in the load feature region. This indicates that this invention can effectively locate key measurement points with a high degree of dependence in the model discrimination process.

[0074] like Figure 3 As shown, under different attack intensities, the model alarm rate exhibits significant differences when attacking 5 key nodes, 2 key nodes, and non-key nodes. When the attack is concentrated on key vulnerable nodes, the model alarm rate increases significantly, indicating extremely high risk (attacking 5 core nodes). When the attack involves only a few key nodes or falls on non-key nodes, the model response is significantly weaker, corresponding to: medium risk (attacking 2 core nodes + 3 edge nodes); and low risk (attacking 0 core nodes + 5 edge nodes). These results demonstrate that the key vulnerable nodes identified in this invention can effectively characterize the model's dependence on locally highly sensitive features, thus verifying the effectiveness of the key node identification results.

[0075] like Figure 4As shown, this embodiment further constructs an attack cost index based on node sensitivity to quantitatively evaluate the change in attack cost before and after implementing the layered targeted hardening strategy. The results show that, in the unprotected state, the average tampering required by attackers against the Top-5 core test points is relatively low; when the layered hardening scheme of this invention is activated, prioritizing the protection of the Top-5 critical nodes, attackers are forced to shift to suboptimal nodes, and the single-point attack cost required increases significantly; if further deep layered hardening is implemented, the attack cost will further increase, thereby significantly increasing the difficulty of attack implementation. Target A (Unprotected): Top-5 core nodes [3638423539]; Target B (protected): The attacker was forced to relocate to the Next-5 suboptimal node [27121825]; [Attack the unprotected Top-5 nodes]; Alarm rate: 73.30%; [With Top-5 nodes protected, hackers were forced to shift their targets to suboptimal nodes]; Alarm rate: 3.18%; Conclusion: The attack effectiveness decreased by 70.1%.

[0076] The results indicate that prioritizing the deployment of protective resources at highly sensitive key measurement points can effectively increase the difficulty for attackers to launch attacks and improve the targeting and effectiveness of protective resource configuration.

[0077] Obviously, the above embodiments of the present invention are merely examples for clearly illustrating the technical solutions of the present invention, and are not intended to limit the specific implementation of the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the claims of the present invention should be included within the protection scope of the claims of the present invention.

Claims

1. A method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency, characterized in that, The method includes: S1. Collect power system operating status samples and organize them into a format of length [missing information]. The original one-dimensional feature vector is then rearranged based on correlation and padded with zeros to expand the dimension, thus constructing a two-dimensional feature matrix. Step S1 specifically includes: S11. Collect N power system operation status samples. Each operation status sample includes line power flow, generator active power output and load active power data. For any operation status sample, arrange the D physical measurement features it contains in a preset order to form a one-dimensional original feature vector of length D. Each running status sample is configured with a corresponding running status label y, where y=1 indicates normal running status and y=0 indicates abnormal or attack status. S12. Calculate the Pearson correlation coefficient between each feature based on all original feature vectors to obtain the feature correlation matrix; An adjacency matrix is ​​constructed based on the correlation coefficient threshold, and a feature rearrangement index is generated using the inverse Cuthill-McKee algorithm. For the original feature vector Reorder; S13. Pad the original feature vector X with zeros and expand its dimension so that the number of features after expansion is a perfect square number, in order to meet the requirement of the number of features to be reconstructed into a two-dimensional square matrix. S14. Divide all running state samples into training set and test set according to a preset ratio, and reconstruct the expanded feature vector into a two-dimensional feature matrix M through the above steps. The convolutional neural network is iteratively trained using the two-dimensional feature matrix M corresponding to the training set as the input and the corresponding running state label y as the supervised output to obtain the basic anomaly detection model. Using the two-dimensional feature matrix as input and the corresponding running state label as output label, a convolutional neural network classification model is trained to obtain a basic anomaly detection model; S2. Based on the classification output of the basic anomaly detection model, the local gradient of the two-dimensional feature matrix is ​​combined with spatial smoothing technology to extract highly sensitive feature regions with high model decision dependence. S3. Extract the indexes of the locations with the highest significance values ​​from the significance heatmap as key vulnerable regions to obtain a set of key vulnerable nodes; S4. Quantify the cost of a single point of attack based on the sensitivity of each node, classify vulnerable nodes according to the attack cost, and output a layered priority protection strategy.

2. The method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency as described in claim 1, characterized in that, S2 specifically includes: S21. Select the target category to be analyzed. The computational basic anomaly detection model is designed for the target category. The output score is related to the input two-dimensional feature matrix. gradient: （1） In formula (1), Indicates the target category, This represents the model's output score for the target category. Indicates model parameters, This indicates the significance of the local gradient of the input matrix; S22. Select K test samples from the test set and calculate the gradient significance matrix corresponding to each test sample; calculate the mean of the absolute values ​​of the K gradient significance matrices and perform a two-dimensional convolution with a Gaussian kernel to obtain a smoothed significance heatmap. : （2） In formula (2), K represents the number of test samples selected from the test set and used for gradient significance analysis; Indicates the index of the test sample; Indicates the first The gradient significance matrix corresponding to each test sample; Indicates the Gaussian filter kernel; Represents a two-dimensional convolution operation; S23. Perform dimensional masking filtering to filter the saliency heatmap. The pixel gradient value at the corresponding zero-padding position is forcibly reset to negative infinity, and then the highly sensitive feature regions with high model decision dependence are extracted.

3. The method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency as described in claim 1, characterized in that, S3 specifically includes: S31. The global saliency heatmap after dimensionality masking. Flatten it into a one-dimensional vector and sort it in descending order of significance value; S32. Select the k most significant indexes from the sorting results, which represent the number of critical vulnerable nodes to be extracted, to form a set of highly significant indexes: （3） In formula (3), The highest significance value indicates the top An index set consisting of 10 positions; This represents the index of the j-th highly significant position in the rearranged eigenvector. ; Rearrange the index using the generated features By performing a table lookup and mapping, we obtain the set of critical vulnerable nodes: （4） In formula (4), This represents the set of critical vulnerable nodes obtained by reverse mapping; This indicates a feature rearrangement index.

4. The method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency as described in claim 3, characterized in that, S3 further includes perturbation comparison verification of the set of critical vulnerable nodes, specifically including: S33. Extract test samples from the power system under normal operating conditions as benchmark data; Subsequently, in the feature space of the benchmark data, the set of critical vulnerable nodes obtained by reverse mapping is... The control group is set up by randomly selecting an equal number of non-critical nodes from the remaining feature space. ; S34. Construct relative quantity perturbation verification and absolute quantity perturbation verification respectively: In the relative perturbation verification, the same tampering factor was applied to both the experimental and control groups. Proportional disturbances; relative power flow distortion disturbances, proportionally stretched physical characteristic values: （5） In formula (5), Indicates the first The original feature values ​​corresponding to each physical measurement point ; Indicates the relative multiple of alteration; This represents the characteristic value after relative perturbation; In the absolute perturbation verification, the same fixed offset was applied to both the experimental and control groups. Translational perturbation; absolute translational over-limit perturbation, applying a fixed-size absolute offset: （6） In formula (6), Represents a fixed absolute value of alteration; Indicates the first Characteristic values ​​of a physical measuring point after absolute quantity perturbation; S35. Input the disturbed experimental group samples and control group samples into the basic anomaly detection model, respectively, and calculate the proportion of samples in the experimental group and control group that are judged to be in an abnormal or attack state, and obtain the corresponding model alarm rate. Under the same perturbation type and intensity, if the alarm rate of the experimental group is higher than the preset multiple of the alarm rate of the control group, the extracted key vulnerable nodes are determined to have passed the perturbation control verification.

5. The method for identifying and protecting vulnerable nodes in power artificial intelligence applications based on gradient saliency as described in claim 1, characterized in that, S4 specifically includes: S41. Construct a single-point attack cost metric to assess the vulnerability of physical nodes: （7） In formula (7), Indicates the first The gradient significance value is obtained after the input features corresponding to each physical measurement point are processed by two-dimensional spatial smoothing and dimensional masking. This indicates a very small positive number that prevents the denominator from being zero; Indicates the first The attack cost corresponding to each physical measurement point; S42, Based on attack cost The physical nodes are sorted in ascending order, with those having the lowest attack cost being the most vulnerable. A set of vulnerable nodes is determined for priority protection, and priority protection is implemented for these vulnerable nodes. S43. Based on the obtained layered protection priority, when protection resources are limited, prioritize the configuration of protection resources for more vulnerable nodes, forcing the attack target to move to the second-best node with higher attack cost.

Images