A power system false data injection attack detection method and system

Abstract

The application discloses a kind of false data injection attack detection method and system of power system, comprising: generating new energy output with time sequence correlation and load uncertainty scene, combining multi-class user demand response model to construct dynamic power input data;Based on the data, alternating current flow calculation is carried out, node voltage amplitude is extracted and measurement noise and data packet loss are simulated, and a space-time voltage sample set is constructed;Local spatial features of voltage and node topological dependence features based on power grid topology are extracted using a double-branch encoder, and are fused into a latent variable space;In latent variable space, a time series prediction model is constructed using a learnable linear evolution matrix to generate voltage prediction values, and a detection threshold is set based on the statistical properties of the prediction error to identify false data injection attacks.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, and in particular to a method and system for detecting fake data injection attacks in power systems. Background Technology

[0002] With the deep integration of smart grids and distributed energy resources, power system operators rely heavily on voltage forecasting information to make operational decisions and plans under various grid conditions. However, spoofing attacks can compromise the accuracy of state estimations by tampering with measurement data, leading to scheduling errors, equipment malfunctions, and even widespread power outages. From the attacker's perspective, typical attack types include pulse attacks, scaling attacks, ramping attacks, and random attacks.

[0003] While existing technologies have improved the accuracy of voltage prediction to some extent, operators may still make erroneous decisions when prediction data is tampered with in a coordinated manner by highly skilled attackers. Therefore, there is an urgent need to develop spoofing injection attack detection methods that combine high sensitivity with low computational complexity to ensure the safe and stable operation of the power grid under complex attack environments. Summary of the Invention

[0004] The main objective of this invention is to provide a method for detecting fake data injection attacks in power systems.

[0005] Another objective of this invention is to propose a system for detecting false data injection attacks in power systems.

[0006] The third objective of this invention is to provide a computer device.

[0007] A fourth objective of this invention is to provide a non-transitory computer-readable storage medium.

[0008] To achieve the above objectives, a first aspect of the present invention provides a method for detecting spoofed data injection attacks in power systems, comprising:

[0009] Generate scenarios of uncertainties in new energy output and load that include time-series correlations, and construct dynamic power input data by combining multiple user demand response models; Based on the dynamic power input data, AC power flow calculations are performed on the distribution network model, node voltage amplitudes are extracted, and noise and data packet loss are simulated and measured to construct a voltage sample set containing time and spatial dimensions. A dual-branch encoder is used to extract features from the voltage sample set. The first branch extracts local spatial features of voltage, and the second branch extracts node topological dependency features based on the power grid topology. The fused features are then mapped to the latent variable space. A time-series prediction model is constructed in the latent variable space based on a learnable linear evolution matrix to generate voltage prediction values. A detection threshold is set according to the error statistics between the actual voltage value and the voltage prediction value to identify false data injection attacks.

[0010] In one embodiment of the present invention, the step of generating a scenario of uncertain new energy output and load with temporal correlation, and constructing dynamic power input data by combining multiple user demand response models, includes: Multiple initial samples are generated using Latin hypercube sampling, and the Gaussian Copula function is used to introduce temporal correlation into the initial samples to obtain a sample matrix with temporal correlation. The sample matrix is ​​inversely transformed and mapped according to the probability distributions of new energy sources and loads to obtain the disturbance power of wind power, photovoltaic power and loads, and the actual new energy power is calculated. A demand response model for multiple user types is constructed. The optimal demand response rate is calculated based on price elasticity and random noise is superimposed to generate demand response scenarios, thereby correcting the load power curve and outputting dynamic power input data.

[0011] In one embodiment of the present invention, the step of performing AC power flow calculation on the distribution network model based on the dynamic power input data, extracting node voltage amplitudes and simulating measurement noise and data packet loss, and constructing a voltage sample set containing time and spatial dimensions includes: Based on the dynamic power input data, AC power flow calculations are performed on the distribution network model to extract the voltage amplitude of each node; Measurement noise is applied to the voltage amplitude, and random packet loss and interpolation filling are performed to output a voltage sample set containing time and spatial dimensions.

[0012] In one embodiment of the present invention, the feature extraction of the voltage sample set using a dual-branch encoder, wherein the first branch extracts local spatial features of voltage and the second branch extracts node topological dependency features, and the fused features are mapped to the latent variable space, includes: Construct a two-branch encoder consisting of CNN branches and GNN branches; The voltage sample set is input into the CNN branch to extract local spatial features of voltage. The voltage sample set is input into the GNN branch, and the node topological dependency features are extracted based on the adjacency matrix constructed from the power grid topology. The local spatial features and the topological dependency features are fused and mapped to output the feature representation in the latent variable space.

[0013] In one embodiment of the present invention, the extraction of node topological dependency features from the adjacency matrix constructed based on the power grid topology includes: Based on the admittance matrix of the distribution network, an adjacency matrix is ​​constructed and then symmetric normalization is performed to obtain a symmetric normalized matrix. The input voltage samples are subjected to graph convolution operation using the symmetric normalization matrix to extract the topological dependency features between nodes.

[0014] In one embodiment of the present invention, the step of constructing a time-series prediction model based on a learnable linear evolution matrix in the latent variable space to generate voltage prediction values ​​includes: Input the latent variables at the current time step into a learnable linear evolution matrix to obtain the latent variables at the next time step; The latent variables at the next time step are input into the decoder to obtain the predicted voltage value at the next time step.

[0015] In one embodiment of the present invention, the step of setting a detection threshold based on the error statistical characteristics between the actual voltage value and the predicted voltage value to identify false data injection attacks includes: Calculate the error between the actual voltage value and the predicted voltage value, and set a detection threshold based on the statistical distribution characteristics of the error; When the real-time error exceeds the detection threshold, it is determined that a false data injection attack has occurred.

[0016] To achieve the above objectives, a second aspect of the present invention provides a power system spoofed data injection attack detection system, comprising: The wind-solar-load scenario generation module is used to generate new energy output and load uncertainty scenarios with time-series correlation, and to construct dynamic power input data by combining multiple user demand response models; The voltage sample set construction module is used to perform AC power flow calculation on the distribution network model based on the dynamic power input data, extract the node voltage amplitude and simulate and measure noise and data packet loss, and construct a voltage sample set containing time and spatial dimensions. The dual-branch encoder module is used to extract features from the voltage sample set using a dual-branch encoder. The first branch extracts local spatial features of voltage, and the second branch extracts node topology dependency features based on the power grid topology. The fused features are then mapped to the latent variable space. A time-series prediction network module is used to construct a time-series prediction model based on a learnable linear evolution matrix in the latent variable space to generate voltage prediction values; The attack detection module is used to set a detection threshold based on the error statistics between the actual voltage value and the predicted voltage value to identify false data injection attacks.

[0017] To achieve the above objectives, a third aspect of this application provides a computer device, including a processor and a memory; wherein the processor runs a program corresponding to the executable program code stored in the memory, for implementing a power system spoofing data injection attack detection method as described in the first aspect embodiment.

[0018] To achieve the above objectives, a fourth aspect of this application provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a method for detecting false data injection attacks in a power system as described in the first aspect.

[0019] The embodiments of the present invention have the following beneficial effects: This invention improves the physical realism and diversity of training data by integrating Gaussian Copula and Latin hypercube sampling uncertainty scene generation techniques; enhances the discriminative representation ability of multidimensional features by collaboratively extracting voltage local spatial features and node topological dependency features through a CNN-GNN dual-branch encoder; reduces the computational complexity of time series prediction and enhances long-term prediction robustness by dynamically modeling the latent variable space using a learnable Koopman linear evolution matrix; and improves the real-time identification sensitivity and detection efficiency against various fake data injection attacks by setting an adaptive detection threshold using the 3-sigma statistical criterion. Attached Figure Description

[0020] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein: Figure 1 A flowchart of a method for detecting fake data injection attacks in a power system, provided in an embodiment of the present invention; Figure 2 This is a structural diagram of a power system spoofing data injection attack detection system provided in an embodiment of the present invention. Detailed Implementation

[0021] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0022] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0023] The following describes a method and system for detecting false data injection attacks in a power system according to an embodiment of the present invention, with reference to the accompanying drawings.

[0024] Example 1 This embodiment provides a method for detecting fake data injection attacks in power systems, such as... Figure 1 As shown, the method includes the following steps: S1 generates a scenario of uncertainties in new energy output and load that includes time-series correlation, and constructs dynamic power input data by combining multiple user demand response models.

[0025] S2, Based on the dynamic power input data, perform AC power flow calculation on the distribution network model, extract node voltage amplitude, simulate and measure noise and data packet loss, and construct a voltage sample set containing time and spatial dimensions.

[0026] S3, the voltage sample set is feature extracted using a dual-branch encoder, wherein the first branch extracts local spatial features of voltage, and the second branch extracts node topology dependency features based on the power grid topology, and the fused features are mapped to the latent variable space.

[0027] S4, a time-series prediction model is constructed in the latent variable space based on a learnable linear evolution matrix to generate voltage prediction values, and a detection threshold is set according to the error statistics between the actual voltage value and the voltage prediction value to identify false data injection attacks.

[0028] Specifically, step S1 includes: To address the detection needs of various spoofed data injection attacks in power systems, this paper utilizes Latin hypercube sampling combined with Gaussian Copula to generate wind-solar-load uncertainty scenarios. Latin hypercube sampling ensures uniform coverage of samples in the probability space, while Gaussian Copula introduces time correlation through the covariance matrix, making the generated wind speed, illumination, and load sequences more closely match actual fluctuation patterns. At the same time, multiple user demand response models are introduced to construct dynamic power input.

[0029] In this step, a scene generation framework is constructed based on Latin hypercube sampling. The specific generation steps for the scene are as follows: (1) Assume that wind power, photovoltaic power and load output follow Weibull distribution, Beta distribution and log-normal distribution respectively; (2) Generate a standard uniformly distributed sample matrix using LHS. The Gaussian Copula function is then used to transform it into a sample matrix with temporal correlation. Its core transformation process is as follows: , In the formula, This represents the standard normal distribution sample matrix. The cumulative distribution function represents the standard normal distribution. This represents a normally distributed sample with temporal correlation. Represents the Cholesky lower triangular matrix; (3) Transform the matrix By inversely transforming the actual probability distributions of wind, solar, and load respectively, we can obtain the corresponding physical quantities, namely wind power, solar power, and load disturbance power. , and for: , In the formula, This represents the normalized wind power output. This represents the mean of normalized wind power. This represents the wind power noise scaling factor. Indicates base wind power capacity. Indicates the numerical correction term. Represents the normalized photovoltaic power. This represents the mean of normalized photovoltaic power. This represents the photovoltaic noise scaling factor. Indicates the base photovoltaic power. This represents the normalized load power. This represents the mean of the normalized load power. This represents the load noise scaling factor. Indicates the base load power; Time access system Actual wind power in each scenario and photovoltaic power They are respectively: , In the formula, Indicates the penetration rate of clean energy. express Time access system Wind power disturbance power in each scenario express Time access system Photovoltaic disturbance power in each scenario.

[0030] To characterize the impact of demand response on the spatiotemporal distribution of load, a demand response model based on price elasticity was constructed, considering the heterogeneity of multiple user groups and response uncertainty. Utilizing... right Baseline expected response rate at time point Make dynamic adjustments.

[0031] , In the formula, express The target expected response rate at any given time. Indicates the sensitivity coefficient; Residential, commercial, and industrial users are considered to determine the optimal demand response participation level based on a trade-off between electricity cost savings and comfort loss. The total cost for minimizing the decision objectives of each user group is: , In the formula, express Time of the first Response rate to user needs This represents the price sensitivity coefficient. express Real-time electricity prices This indicates the reference electricity price. Indicates the comfort loss coefficient; Solving for the minimum total cost for various user decision objectives yields the following results. Time of the first The optimal solution for the demand response rate of user class for: , The system's overall expected response rate is a weighted sum of response rates for all user types. To simulate response uncertainty, in Random noise is superimposed to generate multiple sets of demand response scenarios.

[0032] , In the formula, express Time of the first The actual response rate to user needs. This represents random noise.

[0033] Specifically, step S2 includes: Based on the above scenario generation framework, the AC power flow is solved hourly based on the 33-node distribution network model. The voltage amplitude of all nodes is extracted and measurement noise and packet loss simulation are added to form a voltage sample set containing both time and space dimensions.

[0034] In the MATPOWER environment, the reference capacity and reference voltage are set, the admittance matrix is ​​converted into per-unit values, the net active load is set for each time section and the AC power flow calculation function is called to extract the voltage amplitude of each node; the addition of measurement noise and packet loss simulation includes adding noise with a standard deviation of 0.02 times the voltage standard deviation, and randomly discarding 5% of the data points before filling with linear interpolation; (1) Net active power calculation: For the first The scene is At this moment Net active power of each node for: , In the formula, express Time access system The actual load power of each scenario; (2) AC power flow calculation: net active power As input, a set of nonlinear equations describing the steady-state operation of a power system are solved. For a node in the system... Its active power and reactive power The equilibrium equations are as follows: , In the formula, and These represent the voltage magnitude and phase angle at the node, respectively. and These represent the real and imaginary parts of the elements in the system admittance matrix, respectively. (3) Dataset construction: Power flow calculation generates a voltage time series for each scenario. ; , In the formula, Represent a The matrix represents the first... In this scenario At the moment of the first Voltage amplitude at each node; (4) Noise and packet loss processing: Add noise and packet loss to the voltage data obtained from power flow calculation, simulate the measurement environment, and construct the input-output pairs required for distribution network training.

[0035] Specifically, step S3 includes: Based on the voltage data above, in order to fully explore the spatial and topological information in the voltage data, a dual-branch encoder is designed: the CNN branch extracts the local spatial features of voltage and the GNN branch extracts the topological dependency features of nodes. The dual-branch features are fused and mapped to the latent variable space through a fully connected layer.

[0036] The model input data mainly includes node voltage state data and grid topology data. These two types of data reflect the dynamic response characteristics and static structural characteristics of the distribution network, respectively, and together form the basis of data-driven dynamic modeling. The specific construction steps are as follows: (1) Node voltage state data: Node voltage state data is derived from time-series simulations of the distribution network operation status. For data containing... Distribution network of nodes, in Node voltage state vector at time t Defined as: , In the formula, for Time of the first The per-unit voltage amplitude of each node; (2) Topology data: based on the distribution network admittance matrix Constructing the adjacency matrix This is used to characterize the electrical connections between nodes. To facilitate GNN processing, the matrix... Normalization is performed to obtain a symmetric normalized matrix. As the topological input for the GNN branch; (3) Koopman linearization: using the Koopman operator Elevate the nonlinear system to a linear infinite-dimensional space: , In the formula, To fuse the observation functions learned by the encoder, For an unknown nonlinear dynamic observation function, It is a finite-dimensional Koopman matrix; In this step, the encoder in the proposed model consists of both CNN and GNN branches, achieving joint learning of "local spatial features + global topological features" through feature fusion. The specific structure of the dual-branch encoder is as follows: (1) Local spatial feature extraction in CNN branches. CNN is a deep learning architecture specifically designed for processing grid-like data. The CNN branches mainly consist of convolutional layers, pooling layers, and fully connected layers, and the ReLU activation function is introduced to enhance non-linear expressive power. The CNN encoder expression is: , In the formula, This represents the output of the first convolutional layer. This represents the activation function. This represents the weight matrix of the first convolutional layer. This represents the bias vector of the first convolutional layer. Indicates the output of the pooling layer. This indicates max pooling. This represents the output of the second convolutional layer. This represents the weight matrix of the second convolutional layer. This represents the bias vector of the second convolutional layer. express The output of the CNN branch at each moment, This represents the weight matrix of the fully connected layer in a CNN branch. This represents the bias vector of a fully connected layer in a CNN branch. (2) Topology-aware feature extraction in the GNN branch. The topological relationships between power grid nodes are obtained through the adjacency matrix. Quantification, Based on the admittance matrix of the distribution network Constructing the absolute values ​​of each element. To avoid feature scaling issues caused by node differences, it is necessary to... Perform symmetric normalization: , In the formula, Represents a symmetric normalized matrix. Degree matrix, Represents the identity matrix; based on To achieve topological dependency modeling, the expression is: , In the formula, This represents the output of the graph convolutional layer. This represents the weight matrix of the graph convolutional layer. This represents the bias vector of the graph convolutional layer. express At any given time, the GNN branch outputs... This represents the weight matrix of the fully connected layer in the GNN branch. This represents the bias vector of the fully connected layer in the GNN branch.

[0037] Specifically, step S4 includes: A learnable Koopman matrix is ​​introduced into the latent variable space to construct a global linear evolution model, and the encoder, Koopman layer and decoder are integrated to form an end-to-end temporal prediction network.

[0038] The CNN-GNN-Koopman model employs a "dual-branch encoder-feature fusion-Koopman linear dynamics-decoder" structure. The CNN captures the local spatial correlations between distribution network nodes, while the GNN utilizes topological information to capture global dependencies. The CNN-GNN dual-branch feature fusion model then models linear dynamics, ultimately decoding to obtain the voltage assessment result.

[0039] To simultaneously preserve both local spatial features and topologically aware features, this paper employs a CNN-GNN dual-branch encoder and maps the two types of latent representations into a unified fused latent space through a learnable fully connected fusion layer. The Koopman layer implements linear dynamic evolution within this latent space, i.e., through... Current potential state Mapped to the next moment .

[0040] , , In the formula, express Voltage vector at time, Represents the decoder weight matrix. This represents the decoder bias vector.

[0041] Furthermore, a detection threshold is set based on the 3-sigma criterion of prediction error to identify fake data injection attacks such as pulse attacks, scaling attacks, ramp attacks, and random attacks in real time.

[0042] (1) Pulse attack: The voltage prediction is modified to a higher / lower value at a specific point during the entire attack duration, and the pulse attack parameters are set to ; , In the formula, This indicates a voltage prediction value that has been altered due to a cyberattack. This indicates the original voltage value that has not been altered by any cyberattack. Indicates the time when a pulse attack occurs; (2) Scaling attack: A scaling attack involves modifying a value over a specified duration and multiplying it by a scaling attack parameter. ; , In the formula, , These represent the start and end times of a network attack, respectively. (3) Climbing Attack: There are two types of climbing attacks. Type I climbing attacks only consider climbing anomalies. This involves multiplying values ​​within a specified range by a climbing function. ; , Type II ramp attacks consider both ascending and descending ramp anomalies. This type of attack is more challenging for operators to detect; , , In the formula, Indicates the underlying value, used to represent and Approximate midpoint between; (4) Random attack: Random attack involves adding the positive value returned by a uniform random function to the voltage prediction; , In the formula, This represents a uniformly distributed random number generator. This represents a scaling factor, defined as half of the maximum predicted voltage value, i.e. .

[0043] In summary, the method presented in this embodiment proposes a spoofing attack detection method for power systems based on CNN-GNN-Koopman. By fusing wind-solar-load uncertainty scenario generation with multiple user response models, a dynamic power boundary reflecting real operating conditions is constructed. A dual-branch encoder is used to extract local voltage spatial patterns and node topological dependencies, achieving complementary enhancement at the feature level. A learnable linear evolution Koopman operator is introduced to dynamically approximate latent variables in a low dimension, significantly reducing the online computational burden of time series prediction. Based on the statistical threshold detection mechanism of prediction residuals, various forms of spoofing attacks can be sensitively identified without prior attack templates, effectively balancing detection accuracy and real-time performance.

[0044] In summary, this application addresses the dual challenges of high-proportion renewable energy integration and complex network attack threats in power systems. It proposes a spoofing attack detection method based on CNN-GNN-Koopman, providing a unified detection framework with high sensitivity and low complexity for safe power grid operation. This invention overcomes the contradictions between feature representation, dynamic evolution, and computational efficiency in traditional methods by organically integrating the advantages of local perception, topology modeling, and linear dimensionality increase, laying a solid technical foundation for online attack early warning and rapid response in power systems.

[0045] Example 2 This invention also provides a power system spoofed data injection attack detection system, such as... Figure 2 As shown, the system 10 includes: The wind-solar-load scenario generation module 100 is used to generate new energy output and load uncertainty scenarios with time-series correlation, and to construct dynamic power input data by combining multiple user demand response models.

[0046] Specifically, a wind-solar-load uncertainty scenario is generated by using Latin hypercube sampling combined with Gaussian Copula, and dynamic power input is constructed by introducing multiple user demand response models.

[0047] The voltage sample set construction module 200 is used to perform AC power flow calculation on the distribution network model based on the dynamic power input data, extract the node voltage amplitude and simulate and measure noise and data packet loss, and construct a voltage sample set containing time and spatial dimensions.

[0048] Specifically, it is used to solve AC power flow point by point on a time-by-time basis based on a 33-node distribution network model, extract node voltage amplitude, and add measurement noise and packet loss simulation to form a voltage sample set containing both time and space dimensions.

[0049] The dual-branch encoder module 300 is used to extract features from the voltage sample set using a dual-branch encoder. The first branch extracts local spatial features of voltage, and the second branch extracts node topology dependency features based on the power grid topology. The fused features are then mapped to the latent variable space.

[0050] Specifically, the CNN branch is used to extract local spatial features of voltage and the GNN branch to extract topological dependency features of nodes. The features of the two branches are fused and then mapped to the latent variable space through a fully connected layer.

[0051] The time series prediction network module 400 is used to construct a time series prediction model based on a learnable linear evolution matrix in the latent variable space to generate voltage prediction values.

[0052] Specifically, it is used to introduce a learnable Koopman matrix into the latent variable space to construct a global linear evolution model, and integrates the encoder, Koopman layer and decoder to form an end-to-end temporal prediction network.

[0053] The attack detection module 500 is used to set a detection threshold based on the error statistics between the actual voltage value and the predicted voltage value to identify false data injection attacks.

[0054] Specifically, it is used to set detection thresholds based on the 3-sigma criterion of prediction error, and to identify fake data injection attacks such as pulse attacks, scaling attacks, ramp attacks and random attacks in real time.

[0055] Example 3 To implement the methods of the above embodiments, the present invention also provides a computer device, which includes a memory and a processor; wherein the processor runs a program corresponding to the executable program code by reading executable program code stored in the memory, so as to implement the various steps of the methods described above.

[0056] Example 4 To implement the above embodiments, this application also proposes a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the method described in the foregoing embodiments.

[0057] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

[0058] In the description of this specification, the references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., refer to specific features, structures, materials, or characteristics described in connection with that embodiment or example, which are included in at least one embodiment or example of the present invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples. Moreover, without contradiction, those skilled in the art can combine and integrate the different embodiments or examples described in this specification, as well as the features of different embodiments or examples.

[0059] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this invention, "a plurality of" means at least two, such as two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for detecting spoofed data injection attacks in power systems, characterized in that, Includes the following steps: Generate scenarios of uncertainties in new energy output and load that include time-series correlations, and construct dynamic power input data by combining multiple user demand response models; Based on the dynamic power input data, AC power flow calculations are performed on the distribution network model, node voltage amplitudes are extracted, and noise and data packet loss are simulated and measured to construct a voltage sample set containing time and spatial dimensions. A dual-branch encoder is used to extract features from the voltage sample set. The first branch extracts local spatial features of voltage, and the second branch extracts node topological dependency features based on the power grid topology. The fused features are then mapped to the latent variable space. A time-series prediction model is constructed in the latent variable space based on a learnable linear evolution matrix to generate voltage prediction values. A detection threshold is set according to the error statistics between the actual voltage value and the voltage prediction value to identify false data injection attacks.

2. The method according to claim 1, characterized in that, The generation of uncertain scenarios involving renewable energy output and load with time-series correlation, and the construction of dynamic power input data by combining multiple user demand response models, includes: Multiple initial samples are generated using Latin hypercube sampling, and the Gaussian Copula function is used to introduce temporal correlation into the initial samples to obtain a sample matrix with temporal correlation. The sample matrix is ​​inversely transformed and mapped according to the probability distributions of new energy sources and loads to obtain the disturbance power of wind power, photovoltaic power and loads, and the actual new energy power is calculated. A demand response model for multiple user types is constructed. The optimal demand response rate is calculated based on price elasticity and random noise is superimposed to generate demand response scenarios, thereby correcting the load power curve and outputting dynamic power input data.

3. The method according to claim 1, characterized in that, The process involves calculating AC power flow in the distribution network model based on the dynamic power input data, extracting node voltage amplitudes, simulating and measuring noise and data loss, and constructing a voltage sample set containing both time and spatial dimensions, including: Based on the dynamic power input data, AC power flow calculations are performed on the distribution network model to extract the voltage amplitude of each node; Measurement noise is applied to the voltage amplitude, and random packet loss and interpolation filling are performed to output a voltage sample set containing time and spatial dimensions.

4. The method according to claim 1, characterized in that, The step of using a dual-branch encoder to extract features from the voltage sample set, wherein the first branch extracts local spatial features of the voltage and the second branch extracts node topological dependency features, and the fused features are mapped to the latent variable space, including: Construct a two-branch encoder consisting of CNN branches and GNN branches; The voltage sample set is input into the CNN branch to extract local spatial features of voltage. The voltage sample set is input into the GNN branch, and the node topological dependency features are extracted based on the adjacency matrix constructed from the power grid topology. The local spatial features and the topological dependency features are fused and mapped to output the feature representation in the latent variable space.

5. The method according to claim 4, characterized in that, The method for extracting node topological dependency features based on the adjacency matrix constructed from the power grid topology includes: Based on the admittance matrix of the distribution network, an adjacency matrix is ​​constructed and then symmetric normalization is performed to obtain a symmetric normalized matrix. The input voltage samples are subjected to graph convolution operation using the symmetric normalization matrix to extract the topological dependency features between nodes.

6. The method according to claim 1, characterized in that, The step of constructing a time-series prediction model based on a learnable linear evolution matrix in the latent variable space to generate voltage prediction values ​​includes: Input the latent variables at the current time step into a learnable linear evolution matrix to obtain the latent variables at the next time step; The latent variables at the next time step are input into the decoder to obtain the predicted voltage value at the next time step.

7. The method according to claim 1, characterized in that, The step of setting a detection threshold based on the error statistics between the actual voltage value and the predicted voltage value to identify spoofed data injection attacks includes: Calculate the error between the actual voltage value and the predicted voltage value, and set a detection threshold based on the statistical distribution characteristics of the error; When the real-time error exceeds the detection threshold, it is determined that a false data injection attack has occurred.

8. A power system spoofed data injection attack detection system, used to implement the method of any one of claims 1-7, characterized in that, include: The wind-solar-load scenario generation module is used to generate new energy output and load uncertainty scenarios with time-series correlation, and to construct dynamic power input data by combining multiple user demand response models; The voltage sample set construction module is used to perform AC power flow calculation on the distribution network model based on the dynamic power input data, extract the node voltage amplitude and simulate and measure noise and data packet loss, and construct a voltage sample set containing time and spatial dimensions. The dual-branch encoder module is used to extract features from the voltage sample set using a dual-branch encoder. The first branch extracts local spatial features of voltage, and the second branch extracts node topology dependency features based on the power grid topology. The fused features are then mapped to the latent variable space. A time-series prediction network module is used to construct a time-series prediction model based on a learnable linear evolution matrix in the latent variable space to generate voltage prediction values; The attack detection module is used to set a detection threshold based on the error statistics between the actual voltage value and the predicted voltage value to identify false data injection attacks.

9. A computer device, characterized in that, Including processor and memory; The processor reads executable program code stored in the memory to run a program corresponding to the executable program code, so as to implement a power system fake data injection attack detection method as described in any one of claims 1-7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements a method for detecting false data injection attacks in a power system as described in any one of claims 1-7.

Images