Method and device for analyzing mechanism of high-concealment cross-domain attack of power system under condition of cyber-physical coupling

Abstract

The application relates to the technical field of power system network security, and discloses a power system high-concealment cross-domain attack mechanism analysis method and device under information-physical coupling conditions. The application realizes bidirectional coupling linkage of a physical layer and an information layer by constructing a power information-physical system coupling model, and accurately depicts a system operation mechanism. A collaborative attack scene is built by quantifying two types of attack parameters and imposing concealment constraints, simulation analysis is carried out in combination with a coupling path, the unique influence law of the system under the collaborative attack is effectively mined, and the attack propagation path and weak links are clarified.

Description

Technical Field

[0001] This invention relates to the field of power system network security technology, specifically to a method and apparatus for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions. Background Technology

[0002] With the rapid development of smart grids, power systems are evolving from a traditional architecture dominated by physical equipment and with information playing a subordinate role, towards a Cyber-Physical Power System (CPPS) that deeply couples and intelligently collaborates with the physical system. This system uses information and communication technologies to achieve real-time monitoring, control, and scheduling of power physical equipment, significantly improving the operational efficiency and flexibility of the power system. However, it also makes the security threats faced by the system more complex and diverse.

[0003] Currently, power cyber-physical systems (CPS) face increasingly diverse attack methods. A single type of attack is no longer sufficient to pose a fatal threat to the system, but the coordinated use of multiple attack methods can trigger serious system failures or even large-scale power outages. Among these, electromagnetic interference (EMI) attacks, a typical attack method targeting power physical equipment, can interfere with the normal operation of critical power equipment such as transformers, instrument transformers, and relays through radiated or conducted electromagnetic signals, leading to decreased measurement accuracy and control logic disorder. Meanwhile, false data injection (FDI) attacks target the information communication side, tampering with measurement data (such as voltage, current, and power) transmitted to the control center to bypass traditional bad data detection algorithms and mislead the dispatch center into making incorrect decisions.

[0004] In existing technologies, there is a significant amount of research focusing solely on electromagnetic interference attacks or spoofed data injection attacks. For example, some solutions concentrate on electromagnetic interference suppression techniques, while others focus on optimizing detection algorithms for spoofed data injection attacks. However, existing technologies generally suffer from the following shortcomings: (1) There is a lack of systematic research on the coordinated attack of electromagnetic interference and false data injection, the coupling mechanism of the two attack methods has not been fully considered, and the impact path of the coordinated attack on the power cyber-physical system cannot be accurately characterized. (2) Existing attack mechanism analysis methods are mostly based on building models in a single attack scenario, ignoring the mutual induction and mutual reinforcement effects of physical side attacks and information side attacks, resulting in a large deviation between the analysis results and the actual collaborative attack scenarios; (3) The lack of a complete collaborative attack mechanism analysis process makes it difficult to support the accurate formulation of security protection strategies for power information physical systems, resulting in the system lacking effective countermeasures when facing such collaborative attacks.

[0005] Therefore, there is an urgent need for a method that can comprehensively and accurately analyze the mechanism of power cyber-physical collaborative attacks that combine electromagnetic interference and fake data injection, to fill the gap in existing technologies and improve the security protection capabilities of power cyber-physical systems. Summary of the Invention

[0006] This invention provides a method and apparatus for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, in order to solve the defects of existing technologies.

[0007] In a first aspect, the present invention provides a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, the method comprising: A coupled power information physical system model is constructed by bidirectionally coupling a power physical network topology model corresponding to multiple key physical devices in the power system and a hierarchical information processing model of multiple communication nodes. Electromagnetic interference attacks and fake data injection attacks are quantified with parameters and concealment constraints are set to establish a collaborative attack scenario. The power cyber-physical system coupling model is simulated in the cooperative attack scenario according to the preset cooperative attack coupling path, and the unique impact law of the cooperative attack on the power system is determined based on the simulation results.

[0008] This invention constructs a coupled model of a power information physical system to achieve bidirectional coupling and linkage between the physical layer and the information layer, accurately depicting the system's operating mechanism. By quantifying two types of attack parameters and imposing covert constraints to build a collaborative attack scenario, and combining the coupling path to conduct simulation analysis, it effectively uncovers the unique impact patterns of the system under collaborative attacks, clarifying the attack propagation path and weak points.

[0009] In one optional implementation, the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes are bidirectionally coupled to construct a power cyber-physical system coupling model, including: Acquire multiple key physical devices and multiple communication nodes of the power system; Using preset operational constraints, and employing the key parameters and equipment characteristics corresponding to each of the key physical devices, a power physical network topology model is constructed. A hierarchical information processing model is constructed using the aforementioned communication nodes, multiple communication links, and corresponding communication parameters. Based on the two-way coupling mapping and time synchronization mechanism of physics and information, the power physical network topology model and the hierarchical information processing model are integrated to construct a power information physical system coupling model.

[0010] This invention precisely selects key physical devices and hierarchical communication nodes in the power system, constructs a power physical network topology model based on device parameters and operational constraints, and builds a hierarchical information processing model by combining communication links and parameters. Through bidirectional coupling mapping and time synchronization mechanisms, it achieves deep integration of the physical and information layers. The constructed power information physical system coupled model can realistically reproduce the system's operating state, taking into account both the operating characteristics of physical devices and the information transmission and interaction logic. It effectively solves the problems of physical-information separation and insufficient simulation accuracy in traditional models, providing reliable model support for subsequent collaborative attack simulation, impact pattern analysis, and protection strategy formulation.

[0011] In one optional implementation, the steps of quantifying the parameters and setting concealment constraints for electromagnetic interference attacks and spoofed data injection attacks to establish a collaborative attack scenario include: Based on the collaborative mode, triggering sequence, attack target, and duration of electromagnetic interference attacks and fake data injection attacks, collaborative constraints are constructed. Based on the type, frequency, intensity, and duration of the electromagnetic interference attack, the electromagnetic interference attack parameters are quantified. By employing the threshold characteristics of traditional bad data detection algorithms, a constraint is set to conceal the data tampering. Based on the aforementioned concealment constraint, and combined with the tampering target, tampering method, and tampering range of the aforementioned fake data injection attack, the parameters of the fake data injection attack are quantified. Based on the quantized electromagnetic interference attack parameters, false data injection attack parameters, and cooperative constraints, a cooperative attack scenario is constructed.

[0012] This invention constructs collaborative constraints by clearly defining the core elements such as the collaborative modes and timing of two types of attacks, accurately quantifies electromagnetic interference attack parameters, sets concealment constraints by combining bad data detection thresholds, and quantifies the parameters for injecting false data. Finally, by integrating various parameters and constraints, a collaborative attack scenario is constructed, which can realistically simulate the collaborative process of the two types of attacks. This solves the problems of fuzzy parameters, insufficient concealment, and unclear collaborative logic in traditional scenario construction, providing realistic scenario support for subsequent attack simulation and impact pattern analysis, and improving the accuracy and targeting of attack analysis.

[0013] In one optional implementation, the preset collaborative attack coupling path includes: Single attack path analysis was performed on the electromagnetic interference attack and the fake data injection attack to determine the corresponding impact transmission links; Based on the aforementioned impact transmission links, the key coupling nodes of the electromagnetic interference attack and the false data injection attack in the power cyber-physical system coupling model are located. Based on the key coupling nodes, the electromagnetic interference attack, the false data injection attack and the control anomaly of the power information physical system coupling model are correlated to form a closed-loop coupling link. Based on the closed-loop coupling link, with the attack source, target device, communication node, control center and measurement device as network nodes, and the attack effect correlation and effect transmission flow as directed edges, a collaborative attack coupling path graph is constructed and assigned influence weights to generate a collaborative attack coupling path.

[0014] This invention analyzes the impact propagation links of two types of single attacks, accurately locating key coupling nodes within the system and forming a closed-loop coupling link by associating attack behaviors with system control anomalies. Based on network topology concepts, a weighted cooperative attack coupling path diagram is constructed to clearly depict the coupling logic and propagation direction of electromagnetic interference and false data injection attacks. This invention can intuitively quantify the attack impact weight, accurately identify the propagation channels and weak points of cooperative attacks, and overcome the deficiency of single attack path analysis in reflecting coupling linkages. It provides a clear and reliable path basis for subsequent simulation, impact pattern mining, and protection strategy formulation.

[0015] In one optional implementation, the step of simulating the power cyber-physical system coupling model in the collaborative attack scenario according to a preset collaborative attack coupling path, and determining the unique impact law of the collaborative attack on the power system based on the simulation results, includes: Based on the preset cooperative attack coupling path and the cooperative attack scenario, simulation parameters, simulation duration and simulation boundaries are set. Based on the simulation parameters, the simulation duration, and the simulation boundary, the collaborative attack parameters, collaborative constraints, and collaborative attack coupling paths of the collaborative attack scenario are input into the power information physical system coupling model for simulation. Extract physical device operation data, information-side communication data, and control command data during the simulation process to generate real-time simulation data; The simulation results of the single attack corresponding to the electromagnetic interference attack and the fake data injection attack are compared with the real-time simulation data. Based on the comparison results, the unique response characteristics of the coupled model of the power information physical system under the cooperative attack are identified, and unique influence laws are generated.

[0016] This invention relies on the simulation conditions set by the coupling path and attack scenario of coordinated attacks. Attack parameters, constraints, and coupling paths are imported into a coupling model for simulation, comprehensively collecting real-time data from multiple dimensions, including the physical side, the information side, and control commands. By comparing the simulation results of single attacks and coordinated attacks, the unique response characteristics of the system under the coupling effects of the two types of attacks are accurately identified, effectively isolating the influence of single attacks and extracting the superposition effect and propagation law of coordinated attacks. This provides reliable data support for the formulation of subsequent targeted protection measures and improves the accuracy of the analysis of the harmful mechanisms of covert coordinated attacks.

[0017] In an optional implementation, the method further includes: Based on the cooperative attack coupling path, the vulnerable links, key weak coupling nodes, and impact propagation channels of the cooperative attack in the power cyber-physical system coupling model are determined. Based on the unique impact patterns of coordinated attacks on the power system, identify the security protection weaknesses of the physical layer, information layer, and control layer of the power cyber-physical system coupling model; Based on the aforementioned vulnerable links to collaborative attacks, the aforementioned critical weak coupling nodes, the aforementioned impact propagation channels, and the aforementioned security protection shortcomings, protection strategies are set from the dimensions of boundary isolation, data verification, measurement fault tolerance, and command control of the power system.

[0018] This invention combines precise location of vulnerable points, weak nodes, and impact propagation channels in a system by integrating coordinated attack coupling paths. Based on the unique impact patterns of coordinated attacks, it identifies protection weaknesses at the physical, information, and control layers. It sets targeted protection strategies from multiple dimensions, including boundary isolation, data verification, measurement fault tolerance, and command control, to achieve precise blocking of coupled attack links. This overcomes the shortcomings of traditional protection methods, which lack specificity and cannot cope with multi-dimensional coordinated attacks, effectively reducing the risk of coordinated damage from electromagnetic interference and spoofed data injection, and improving the overall security level of power information physical systems.

[0019] Secondly, this invention provides a device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, the device comprising: The module is used to construct a coupled model of the power information physical system by bidirectionally coupling the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes. A module was established to quantify the parameters of electromagnetic interference attacks and fake data injection attacks and set covert constraints, thereby creating a collaborative attack scenario. The simulation module is used to simulate the power cyber-physical system coupling model in the cooperative attack scenario according to a preset cooperative attack coupling path, and to determine the unique impact law of the cooperative attack on the power system based on the simulation results.

[0020] In some alternative implementations, the building module includes: The acquisition unit is used to acquire multiple key physical devices and multiple communication nodes of the power system; Construct physical-side model units to build a power physical network topology model using preset operating constraints, key parameters and equipment characteristics of each key physical device; Construct an information-side model unit, which uses each communication node, multiple communication links and corresponding communication parameters to build a hierarchical information processing model; A coupled model unit is constructed to integrate the power physical network topology model and the hierarchical information processing model to build a coupled model of the power information physical system based on the two-way coupling mapping and time synchronization mechanism of physical and information.

[0021] In some alternative implementations, the building module includes: Constraint units are used to construct collaborative constraint conditions based on the collaborative mode, triggering sequence, attack target, and duration of electromagnetic interference attacks and fake data injection attacks. The first quantization unit is used to quantify the electromagnetic interference attack parameters based on the type, frequency, intensity and duration of the electromagnetic interference attack. The setting unit is used to set the threshold characteristics of traditional bad data detection algorithms to set the concealment constraints of tampered data; The second quantization unit is used to quantify the parameters of a fake data injection attack based on the concealment constraint and in combination with the object, method, and range of tampering of the fake data injection attack. Scenario units are constructed to build collaborative attack scenarios based on quantized electromagnetic interference attack parameters, spoof data injection attack parameters, and collaborative constraints.

[0022] In some optional implementations, the preset cooperative attack coupling path includes: The analysis subunit is used to perform single attack path analysis on electromagnetic interference attacks and false data injection attacks respectively, and to determine the corresponding impact transmission links. The location subunit is used to locate the key coupling nodes of electromagnetic interference attacks and false data injection attacks in the coupled model of the power cyber-physical system based on each influence transmission link. The associated subunit is used to correlate electromagnetic interference attacks, false data injection attacks and control anomalies of the power information physical system coupling model based on key coupling nodes, forming a closed-loop coupling link. The coupling path subunit is used to construct a collaborative attack coupling path graph based on a closed-loop coupling link, with the attack source, target device, communication node, control center and measurement device as network nodes, and the attack effect correlation and effect transmission flow as directed edges, and to assign influence weights to generate collaborative attack coupling paths.

[0023] In some alternative implementations, the simulation module includes: The setting unit is used to set simulation parameters, simulation duration, and simulation boundaries based on preset cooperative attack coupling paths and cooperative attack scenarios. The simulation unit is used to input the cooperative attack parameters, cooperative constraints, and cooperative attack coupling paths of the cooperative attack scenario into the power information physical system coupling model for simulation based on the simulation parameters, simulation duration, and simulation boundaries. The extraction unit is used to extract physical-side device operation data, information-side communication data, and control command data during the simulation process to generate real-time simulation data. The comparison unit is used to compare the simulation results of single attacks corresponding to electromagnetic interference attacks and spoofing data injection attacks with real-time simulation data. Based on the comparison results, it identifies the unique response characteristics of the coupled power cyber-physical system model under coordinated attacks and generates unique influence laws.

[0024] In some alternative embodiments, the device further includes: The information determination unit is used to determine the vulnerable links, key weak points, and impact propagation channels of the power cyber-physical system coupling model based on the cooperative attack coupling path. The identification unit is used to identify the security protection weaknesses of the physical layer, information layer, and control layer of the power cyber-physical system coupling model according to the unique impact of coordinated attacks on the power system. The protection unit is used to set protection strategies based on vulnerable links of collaborative attacks, weak nodes of critical coupling, impact propagation channels and various security protection shortcomings, from the dimensions of power system boundary isolation, data verification, measurement fault tolerance and command control.

[0025] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the analysis method for the highly covert cross-domain attack mechanism of power systems under the information-physical coupling conditions described in the first aspect or any corresponding embodiment.

[0026] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions described in the first aspect or any of its corresponding embodiments.

[0027] Fifthly, the present invention provides a computer program product, including computer instructions, which are used to cause a computer to execute the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under the cyber-physical coupling conditions described in the first aspect or any corresponding embodiment. Attached Figure Description

[0028] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0029] Figure 1 This is a schematic diagram of the first method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the second process for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions according to an embodiment of the present invention; Figure 3 This is an overall architecture diagram of the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions according to an embodiment of the present invention; Figure 4 This is a structural block diagram of a device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, according to an embodiment of the present invention. Figure 5 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0031] It is understood that before using the technical solutions disclosed in the various embodiments of the present invention, users should be informed of the types, scope of use, and usage scenarios of the personal information involved in the present invention and their authorization should be obtained in accordance with relevant laws and regulations through appropriate means.

[0032] The terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of that feature. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0033] This invention provides a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions. By constructing a cyber-physical system coupling model, a bidirectional coupling and linkage between the physical layer and the information layer is achieved, accurately depicting the system's operating mechanism. A collaborative attack scenario is constructed by quantifying two types of attack parameters and imposing covert constraints. Simulation analysis is then conducted in conjunction with the coupling path to effectively uncover the unique impact patterns of the system under collaborative attacks, clarifying the attack propagation path and weak points.

[0034] According to an embodiment of the present invention, an embodiment of a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0035] This embodiment provides a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions. Figure 1 This is a flowchart of a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps: This invention provides a method for analyzing the mechanism of highly concealed cross-domain attacks on power systems under cyber-physical coupling conditions. The core of this method is to address practical problems in existing technologies for analyzing collaborative attacks, such as insufficient characterization of coupling mechanisms, inaccurate quantification of impact patterns, and inadequate scenario adaptability. Specifically, firstly, it constructs a full-link coupling model between the physical and information sides, which can accurately reveal the mutual induction and reinforcement mechanisms of electromagnetic interference and false data injection, moving beyond isolated analysis of single attacks. Secondly, it establishes methods for quantifying collaborative attack parameters and identifying coupling paths, clearly depicting the complete evolution path from attack triggering to system failure, and achieving accurate quantification of the impact patterns of collaborative attacks. Thirdly, it adapts to deeply coupled power scenarios such as smart distribution networks and new energy power plants, providing a standardized collaborative attack mechanism analysis process tailored to the "physical-information" interaction characteristics of these scenarios. This process supports the optimization of attack detection algorithms and the precise formulation of protection strategies while ensuring dynamic adaptation of system security protection and business operations, effectively filling the technical gap in the systematic analysis of cyber-physical collaborative attack mechanisms in the power sector.

[0036] Step S101: A power information physical system coupling model is constructed by bidirectionally coupling the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes.

[0037] It should be noted that the power physical network topology model refers to a topological mathematical model that uses key physical devices such as transformers, generators, and lines as nodes, power transmission lines as connecting edges, and incorporates equipment operating parameters and electrical constraints to describe the physical layer structure and energy flow relationship of a power system. The layered information processing model refers to an information interaction model that, divided into perception, transmission, and application layers, relies on communication nodes and links to depict the entire process of power system measurement data acquisition, transmission, processing, and command issuance. Bidirectional coupling refers to bidirectional data interaction and linkage constraints that achieve positive coupling from the physical layer to the information layer and negative coupling from the information layer to the physical layer, enabling the physical network and information system operating states to influence each other and match in real time. The power information physical system coupling model refers to an integrated simulation model that combines the power physical network topology model and the layered information processing model, taking into account both energy flow and information flow, for simulating and analyzing the physical-information collaborative operation of a power system and the impact of attacks.

[0038] In this embodiment of the invention, based on the operating parameters and electrical constraints of key physical devices in the power physical network topology model, and combined with the information transmission characteristics and interaction logic of communication nodes at each level of the hierarchical information processing model, a bidirectional mapping relationship is established between the operating status of physical layer devices and the data transmission and command interaction of the information layer. This achieves time synchronization and linkage response between the energy flow of the physical network and the data flow of the information layer, and integrates the two to form a power information physical system coupling model that takes into account both energy flow and information flow and can accurately characterize the physical-information integrated operation characteristics of the power system.

[0039] Step S102: Quantize the parameters of electromagnetic interference attacks and fake data injection attacks respectively, set covertness constraints, and establish a collaborative attack scenario.

[0040] It should be noted that electromagnetic interference attacks refer to proactive attacks that interfere with power transformers, measuring devices, and other equipment through external electromagnetic signals, causing deviations in measurement data; spoofing data injection attacks refer to attacks that inject tampered data into power system measurement or control data, misleading system control decisions while circumventing conventional detection; parameter quantification refers to converting qualitative attack characteristics such as interference intensity, tampering magnitude, and duration into quantitative values ​​that can be used for simulation calculations; concealment constraints refer to constraints based on the threshold of conventional bad data detection algorithms, limiting the magnitude of spoofing data tampering, making it difficult for conventional security algorithms to identify tampered data; and collaborative attack scenarios refer to simulation environments that integrate the two types of attack parameters, timing constraints, and coupling relationships to simulate and reproduce the collaborative intrusion of multiple attacks into power cyber-physical systems.

[0041] In this embodiment of the invention, attack parameters are quantified based on the type, intensity, frequency, and duration of electromagnetic interference. Data tampering concealment constraints for false data injection attacks are set in conjunction with traditional bad data detection thresholds. Furthermore, collaborative constraints are determined by combining the collaborative timing, target, and coupling relationship of the two types of attacks. The quantified attack parameters and constraints are integrated to construct a collaborative attack scenario that can realistically reproduce the collaborative action process of the two types of attacks.

[0042] Step S103: Simulate the power cyber-physical system coupling model in the collaborative attack scenario according to the preset collaborative attack coupling path, and determine the unique impact law of collaborative attack on the power system based on the simulation results.

[0043] It should be noted that the coordinated attack coupling path refers to the closed-loop link formed by electromagnetic interference attacks and false data injection attacks through key coupling nodes; the unique impact law refers to the characteristics of fault propagation and impact at the system measurement, control, and physical operation levels, which are different from single attacks and are generated by the coupling and superposition of two types of attacks.

[0044] In this embodiment of the invention, the cooperative attack coupling path, attack parameters and cooperative constraints are imported into the coupling model to carry out dynamic simulation. Real-time data related to physical device operation, information transmission and control commands are collected synchronously. The system response under a single attack is compared, the influence of a single attack is removed, and the unique change characteristics of system state change, fault propagation and control anomaly under the coupling of two types of attacks are extracted, thereby obtaining the unique influence law of cooperative attacks.

[0045] This embodiment provides a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions. Figure 2 This is a flowchart of a method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps: Step S201: A power information physical system coupling model is constructed by bidirectionally coupling the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes.

[0046] In some optional implementations, step S201 above includes: Step S2011: Obtain multiple key physical devices and multiple communication nodes of the power system.

[0047] It should be noted that key physical equipment refers to the core functions of energy transmission, conversion, control, and energy storage in a power system, including transformers, instrument transformers, lines, circuit breakers, generators, and new energy inverters; communication nodes refer to the nodes in a power information system that are responsible for data acquisition, transmission, processing, and command issuance, and are divided into three functional layers: the sensing layer, the transmission layer, and the application layer. The sensing layer is the lowest layer of the communication node, primarily responsible for collecting operating parameters and measurement data of the power system's physical equipment and converting physical signals into transmittable digital signals. The transmission layer is the middle layer of the communication node, responsible for transmitting the data collected by the sensing layer to the application layer, and simultaneously transmitting control commands issued by the application layer to the sensing layer and physical equipment. The application layer is the top layer of the communication node, responsible for processing and analyzing the data transmitted by the transmission layer and generating control commands.

[0048] In this embodiment of the invention, the power system real-time monitoring system and communication network management platform accurately collect data on multiple key physical devices in the power system that support energy transmission, conversion and control, and screen out the sensing layer measurement nodes, transmission layer communication link nodes and application layer control nodes. This ensures that the acquired devices and nodes can fully cover the core links of the physical operation and information interaction of the power system, providing basic support for the subsequent construction of a power information physical system coupling model.

[0049] Step S2012: Using preset operating constraints, key parameters and equipment characteristics corresponding to each key physical device are used to construct a power physical network topology model.

[0050] It should be noted that the preset operating constraints refer to the pre-defined boundary conditions for the physical equipment and the overall system operation to ensure the safe and stable operation of the power system. These mainly include core constraints such as current carrying capacity and speed range. Key parameters are core quantitative indicators characterizing the operating status and performance of key physical equipment, such as the rated capacity of transformers, the turns ratio of instrument transformers, and the rated power of generators. Equipment characteristics refer to the inherent electrical properties and operating rules of each key physical device, such as the resistance and reactance characteristics of lines and the opening and closing characteristics of circuit breakers.

[0051] In this embodiment of the invention, the physical side model is constructed as follows: key physical devices such as transformers, instrument transformers, lines, circuit breakers, generators, and new energy inverters are selected. Based on the fundamental principles of electromagnetic induction and circuit theory, a core mathematical model of the devices is established to clarify the input and output characteristics, key parameters (resistance, reactance, rated capacity, etc.) and operating constraints (current carrying capacity, speed range, etc.) of the devices. Combined with the actual wiring logic of the power grid, a power physical network topology model is constructed to clearly describe the electrical connection relationships between devices, power transmission paths, and the distribution of key connection nodes.

[0052] Step S2013: Using each communication node, multiple communication links and corresponding communication parameters, construct a hierarchical information processing model.

[0053] It should be noted that a communication link refers to the information transmission channel connecting various communication nodes; communication parameters refer to the core parameters used to regulate the operation of the communication link, including data transmission rate, transmission delay, bit error rate, etc.

[0054] In this embodiment of the invention, the information-side model is constructed as follows: Based on power industry information and communication standards such as IEC 61850, an information transmission network model is established, covering communication nodes such as the terminal sensing layer (PMU, RTU), network transmission layer (gateway, router), and application layer (control center server), as well as communication links such as optical fiber and 5G, and key parameters such as data transmission delay, bandwidth, and bit error rate are defined; a full-process information processing model of "acquisition-preprocessing-transmission-storage-retrieval" (i.e., a hierarchical information processing model) is constructed, defining the acquisition type, sampling frequency, transmission protocol, and storage strategy of the measurement data.

[0055] Step S2014: Based on the two-way coupling mapping and time synchronization mechanism of physical and information, the power physical network topology model and the hierarchical information processing model are integrated to construct the power information physical system coupling model.

[0056] It should be noted that the two-way coupling mapping of physical and information refers to establishing the mutual association between the physical layer (such as equipment operating status and power transmission) and the information layer (such as data transmission and command issuance); the time synchronization mechanism refers to the time reference used to unify the physical layer equipment operation, information layer data transmission and command execution.

[0057] In this embodiment of the invention, coupling relationship modeling is performed by focusing on core coupling nodes such as measurement interfaces and control interfaces, analyzing the interaction logic between the physical side and the information side, integrating the power physical network topology model and the hierarchical information processing model, and establishing a coupling relationship model (i.e., the power information physical system coupling model). Forward coupling (physical → information): physical equipment operating status data is transformed into standardized information data through the measurement interface, forming a quantitative mapping between physical quantities and data; reverse coupling (information → physical): control center commands are parsed into executable actions by the interface, driving physical equipment to adjust its operating status; synchronously setting the coupling data synchronization frequency and delay threshold ensures real-time matching between the physical side status and the information side data.

[0058] Step S202: Quantize the parameters of electromagnetic interference attacks and fake data injection attacks respectively, set covertness constraints, and establish a collaborative attack scenario.

[0059] In some optional implementations, step S202 above includes: Step S2021: Based on the collaborative mode, triggering sequence, attack target, and duration of electromagnetic interference attack and fake data injection attack, construct collaborative constraints.

[0060] It should be noted that the "cooperative mode" refers to the way in which electromagnetic interference attacks and spoofed data injection attacks cooperate and work together, clearly defining the linkage logic between the two attacks, which is different from the action mode of a single attack; the triggering sequence refers to the time order and time interval between the start, action, and end of the two attacks; the attack target refers to the object that both attacks target (such as measurement equipment, control modules, etc. in the power system); and the duration refers to the length of time that the two attacks work together on the power system. The cooperative constraint conditions refer to the unified constraint standards formulated based on the cooperative mode, triggering sequence, attack target, and duration of the two attacks.

[0061] In this embodiment of the invention, the activation order, priority and interaction rules of the collaborative logic of the two attacks are defined in combination with the operation requirements of the power system. The intensity range, duration and impact boundary of the attacks are limited. At the same time, the operating parameters of the power cyber-physical system are matched to ensure that the constraints fit the actual operation scenario and can accurately regulate the collaborative operation of the two attacks.

[0062] Step S2022: Quantify the electromagnetic interference attack parameters based on the type, frequency, intensity, and duration of the electromagnetic interference attack.

[0063] It should be noted that interference frequency refers to the frequency of the electromagnetic signals emitted by the electromagnetic interference attack; interference intensity refers to the strength of the electromagnetic interference signal; and duration refers to the length of time the electromagnetic interference attack continues to act on the target device.

[0064] In this embodiment of the invention, electromagnetic interference attack parameters are quantified as follows: the core types of electromagnetic interference attacks are determined, including common types such as continuous wave interference and pulse interference, and the technical characteristics of different types of attacks are clarified; key attack parameters are sorted out, covering core indicators such as interference frequency, interference intensity, and interference duration; based on electromagnetic simulation experiments or actual test data, a quantitative relationship model of "interference intensity - physical equipment parameter deviation" is established to clarify the specific change patterns of deviation indicators such as transformer error, equipment measurement accuracy reduction, and control logic disorder under different combinations of interference parameters, providing a quantitative basis for subsequent attack impact analysis.

[0065] Step S2023: Using the threshold characteristics of traditional bad data detection algorithms, set constraints on the concealment of tampered data.

[0066] It should be noted that traditional bad data detection algorithms refer to algorithms commonly used in power systems to identify abnormal data; threshold characteristics refer to the judgment criteria set in traditional bad data detection algorithms, that is, the critical value of the normal range of data, which is judged as bad data if it exceeds the range; tampered data refers to false data that has been artificially modified.

[0067] In this embodiment of the invention, a range of data tampering amplitude is defined, a reasonable range is determined by combining the normal fluctuation range of measurement data, and reasonable constraints (i.e., concealment constraints) for data tampering are set by combining the threshold characteristics and detection logic of traditional bad data detection algorithms. This ensures that the tampered data can circumvent existing detection mechanisms, has good concealment, and avoids being identified in advance, thereby achieving the concealment of tampered data and avoiding being misjudged as abnormal data by the system. At the same time, it fits the actual operation scenario of the power system and forms an effective connection with the subsequent simulation analysis of collaborative attacks and the formulation of protection measures, ensuring the authenticity and rationality of the attack scenario simulation.

[0068] Step S2024: Based on the concealment constraint, and combined with the tampering object, tampering method, and tampering range of the fake data injection attack, quantify the parameters of the fake data injection attack.

[0069] It should be noted that the target of the tampering refers to the specific target of the spoofing data injection attack, including power system measurement data, control commands, etc.; the tampering method refers to the specific implementation method of spoofing data injection, that is, how to modify or replace real data to ensure that the tampering behavior is not easily detected; and the tampering range refers to the deviation range between the spoofing data and the real data.

[0070] In this embodiment of the invention, the parameters of the fake data injection attack are quantified: based on the set reasonableness constraints of the tampered data, the tampering object of the fake data injection is identified, and key measurement data types such as voltage, current, power, and frequency are locked; the tampering method is determined, including common methods such as fixed value tampering, proportional tampering, and random tampering, and the concealment and destructive effect of different tampering methods are analyzed.

[0071] Step S2025: Based on the quantized electromagnetic interference attack parameters, false data injection attack parameters, and cooperative constraints, construct a cooperative attack scenario.

[0072] In this embodiment of the invention, the quantified electromagnetic interference attack parameters, false data injection attack parameters and collaborative constraints are deeply integrated with the constructed power cyber-physical system coupling model and the operating requirements of key equipment. The timing, scope and linkage logic of the attack are clarified to ensure that the attack scenario fits the actual operating state of the power system and can realistically simulate the collaborative process of electromagnetic interference and false data injection.

[0073] Specifically, the definition of a coordinated attack scenario includes: clarifying the coordinated modes of electromagnetic interference and fake data injection, including typical modes such as simultaneous initiation and sequential triggering; determining the attack initiation sequence and duration under different modes based on attack information from different typical modes; defining the scope of the attack target, focusing on the core functional modules of key equipment on the physical side and locking specific transmission links and key measurement data types on the information side; determining the attack intensity variation pattern, including types such as gradual increase, constant intensity, and pulse fluctuation; and setting coordinated attack triggering conditions, clearly defining the core boundaries and initiation logic of the attack based on key elements such as physical equipment parameter deviation thresholds, abnormal information transmission status, and specific time nodes.

[0074] Specifically, the pre-defined collaborative attack coupling paths include: Step a1: Perform single attack path analysis on electromagnetic interference attacks and fake data injection attacks respectively to determine the corresponding impact transmission links.

[0075] It should be noted that single attack path analysis refers to analyzing the path, process, and scope of impact of a single type of attack on the power system. Impact propagation chain refers to the complete path of an attack, starting from the intrusion point and gradually propagating through system nodes and links, affecting various aspects of the system.

[0076] In this embodiment of the invention, single attack path analysis is performed as follows: For electromagnetic interference-only attack scenarios, the process of the attack acting on physical devices is simulated, the complete path of the generation and transmission of physical device parameter deviations is tracked, and the transmission process of deviations to the information side through the measurement interface is analyzed, as well as the degree of impact and mechanism of the impact on the accuracy and integrity of information data; For spoofing data injection-only attack scenarios, the transmission path of tampered data after entering the information transmission link from the injection point is simulated, and how tampered data circumvents the detection mechanism and reaches the control center is analyzed, as well as the specific logic and impact on scheduling decision logic and physical device operating status adjustment.

[0077] Step a2: Based on the various impact transmission links, locate the key coupling nodes of electromagnetic interference attacks and false data injection attacks in the power cyber-physical system coupling model.

[0078] It should be noted that critical coupling nodes refer to nodes in a power cyber-physical system that simultaneously bear the effects of electromagnetic interference attacks and spoofed data injection attacks, and can achieve the superposition of the effects of the two attacks, playing a key role in the stability of system operation.

[0079] In this embodiment of the invention, the impact transmission links of the two attacks are combined, the intersection nodes of the two links are sorted out, and the nodes that are simultaneously affected by the two attacks, can achieve the superposition of attack effects, and have a significant impact on the stability of system operation are investigated. The core role of the nodes in physical devices, information transmission and control process is clarified, and it is ensured that the located coupling nodes not only conform to the system operation logic, but also can connect to the simulation and protection strategy formulation of subsequent coordinated attacks, so as to achieve seamless connection with attack parameters and system model.

[0080] Step a3: Based on key coupling nodes, correlate electromagnetic interference attacks, false data injection attacks and control anomalies in the power information physical system coupling model to form a closed-loop coupling link.

[0081] It should be noted that control anomalies refer to phenomena in the coupled model of a power information physical system, such as abnormal control command issuance, disordered equipment control logic, and deviations from preset standards caused by attacks. A closed-loop coupling link refers to a closed-loop associated path centered on key coupling nodes, linking electromagnetic interference attacks, spoofing data injection attacks, and system control anomalies, with attack initiation, node transmission, anomaly generation, and reverse linkage attacks as nodes.

[0082] In this embodiment of the invention, key coupling nodes are used as the core link to link the interference effect of electromagnetic interference attacks on physical devices, the tampering effect of false data injection attacks on information transmission and control commands, and the control anomalies of the power information physical system coupling model caused by both. The linkage logic between attack effects, node transmission and control anomalies is sorted out, and a closed-loop association of attack initiation—node transmission—anomaly generation—reverse influence on attack implementation is constructed to form a complete closed-loop coupling link.

[0083] Step a4: Based on the closed-loop coupling link, with the attack source, target device, communication node, control center and measurement device as network nodes, and the attack effect correlation and effect transmission flow as directed edges, construct a cooperative attack coupling path graph and assign influence weights to generate a cooperative attack coupling path.

[0084] It should be noted that the attack source refers to the initial source of the coordinated attack, corresponding to the starting point of electromagnetic interference and spoofing attacks, and is the starting point of the attack propagation. The target device refers to the core equipment affected by the attack, including transformers and measuring devices, and is the direct bearer of the attack's impact. The control center refers to the core control unit of the power system, responsible for receiving and processing various types of data and issuing control commands; it is a critical link in the attack's impact on system operation. Measuring devices refer to equipment used to collect and transmit power system operating data, and are one of the main targets of spoofing and electromagnetic interference attacks. A directed edge refers to the direction of attack propagation, clearly defining the transmission path of the attack from one node to another. The impact weight refers to a quantified value set according to the degree of impact of the attack on each node and path.

[0085] In this embodiment of the invention, the identification of the coordinated attack coupling path is as follows: Based on the constructed power information physical system coupling model, the key coupling nodes of electromagnetic interference and false data injection are located, including core locations such as measurement data acquisition points, control command issuance points, and data transmission intersection points; the interaction between the two attacks is analyzed in depth to clarify the formation logic of the coupling path: how physical deviations caused by electromagnetic interference expand the fluctuation range of measurement data, providing natural cover for false data injection and reducing the probability of data tampering being detected; how false data injection amplifies the destructive effect of physical attacks by misleading scheduling decisions, exacerbating equipment malfunctions and system performance degradation, thus forming a closed-loop coupling link of electromagnetic interference, measurement deviation, data tampering, error control, and equipment overload. Specifically, the system sorts out the complete coupling link of physical attack, information attack, and system feedback, clarifying the role relationship and transmission order of each link.

[0086] Coupling Path Quantification Description: Based on closed-loop coupling links, a graph theory approach is used to construct a cooperative attack coupling path graph. Specifically, core elements such as attack source, target device, communication node, control center, and measurement device are represented by nodes, and edges represent the attack relationship and the transmission direction of data and energy. Based on the quantification results of attack parameters and the analysis data of single attack impact, each edge in the path graph is assigned a weight value. The weight value intuitively represents the degree of attack impact or data distortion. Through this quantified path graph, the coupling path is visualized and quantitatively represented, clearly reflecting the transmission strength and critical path of the attack impact.

[0087] Step S203: Simulate the power cyber-physical system coupling model in a collaborative attack scenario according to the preset collaborative attack coupling path, and determine the unique impact law of collaborative attack on the power system based on the simulation results.

[0088] In some optional implementations, step S203 above includes: Step S2031: Based on the preset cooperative attack coupling path and cooperative attack scenario, set the simulation parameters, simulation duration and simulation boundaries.

[0089] It should be noted that the simulation parameters are quantified parameters set to simulate the effects of a coordinated attack and the system response, adapted to the attack parameters and system model characteristics. The simulation duration sets the length of time the coordinated attack simulation will run. The simulation boundary defines the scope of the coordinated attack simulation.

[0090] In this embodiment of the invention, by combining the attack transmission logic, influence weight, and attack parameters and constraints in the coordinated attack scenario of the coupled path of the coordinated attack, the operating characteristics of the coupled model of the power information physical system are matched, the simulation parameters are reasonably set to accurately simulate the attack effect and system response, the simulation duration is specified to cover the complete process of attack initiation, transmission, effect and system recovery, and the simulation boundary is defined to limit the simulation scope and eliminate irrelevant interference factors, so as to ensure that the simulation settings fit the actual scenario and form a seamless connection with the model, path and scenario constructed above.

[0091] Step S2032: Based on the simulation parameters, simulation duration, and simulation boundaries, input the cooperative attack parameters, cooperative constraints, and cooperative attack coupling paths of the cooperative attack scenario into the power information physical system coupling model for simulation.

[0092] In this embodiment of the invention, system state simulation involves substituting the cooperative constraints, cooperative attack coupling path, and quantified cooperative attack parameters into the constructed power information physical system coupling model. Mature numerical methods such as time-domain simulation and electromagnetic transient simulation are used to simulate the entire process of cooperative attack from initiation to development to termination. Reasonable simulation parameters, simulation step size, and time range are set to ensure that the dynamic response process of the system can be fully captured.

[0093] Step S2033: Extract the physical device operation data, information side communication data, and control command data during the simulation process to generate real-time simulation data.

[0094] It should be noted that real-time simulation data refers to the data collected in real time, such as system operating parameters, attack effects, and response changes, when inputting attack parameters and constraints into the coupled model of the power information physical system for simulation in a collaborative attack scenario.

[0095] In this embodiment of the invention, time-series data of key system operating indicators are collected during the simulation process, such as physical equipment operating data, information-side communication data, and control command data. Specifically, these include bus voltage deviation, frequency fluctuation, power deficit, equipment overload, information transmission delay, and command execution error, providing comprehensive data support for subsequent analysis of influence patterns.

[0096] Step S2034: Compare the simulation results of single attacks corresponding to electromagnetic interference attacks and false data injection attacks with real-time simulation data. Based on the comparison results, identify the unique response characteristics of the power information physical system coupling model under collaborative attacks and generate unique influence laws.

[0097] It should be noted that unique response characteristics refer to system responses that differ from those under a single attack. They are generated solely by the synergistic coupling of two attacks and are manifested in unique abnormal responses and change characteristics at the physical, information, and control layers of the system.

[0098] In this embodiment of the invention, the impact patterns are extracted by comparing the differences in the changing trends, extreme values, and fluctuation amplitudes of key system operating indicators under three scenarios: coordinated attacks, electromagnetic interference attacks alone, and fake data injection attacks alone. The unique impact patterns of coordinated attacks are extracted in depth, including the critical conditions for decreased system stability, the chain reaction path of equipment failures, the rate and extent of system performance degradation, and the difficulty and duration of fault recovery. The "1+1>2" amplification effect of coordinated attacks is quantified by calculating the difference between the degree of system performance degradation caused by coordinated attacks and the combined effect of performance degradation when the two attacks act alone, thus clarifying the additional destructive effect of coordinated attacks.

[0099] In some alternative implementations, the method further includes: Step b1: Based on the cooperative attack coupling path, determine the vulnerable links, key weak coupling nodes, and impact propagation channels of the power cyber-physical system coupling model.

[0100] It should be noted that the vulnerable points in a coordinated attack refer to the system segments most easily breached, with relatively weak defenses, and that provide convenient pathways for attack propagation during a coordinated attack; these are the key entry points for attacks into the system. Critical coupling weak nodes refer to core nodes in a power information physical system that simultaneously bear the combined effects of two types of attacks, have weak anti-attack capabilities, and whose anomalies directly lead to the superposition of attack effects, affecting the overall stable operation of the system. The impact propagation channel refers to the specific path through which the effects of a coordinated attack spread from the vulnerable points, through the critical coupling weak nodes, to the system's physical, information, and control layers.

[0101] In this embodiment of the invention, based on the attack transmission logic, the influence weight of each node and the path flow in the coordinated attack coupling path, the system links most vulnerable to breach are identified during the attack initiation and transmission process. The key coupling weak nodes that simultaneously bear the effects of two types of attacks, have weak anti-attack capabilities and have a significant impact on the overall stability of the system are located. The specific path of the attack effect spreading from the intrusion link through the weak node to each level of the system is clarified, forming a corresponding association between the vulnerable links, weak nodes and the propagation channel.

[0102] Step b2: Based on the unique impact of coordinated attacks on power systems, identify the security weaknesses of the physical, information, and control layers of the power information-physical system coupling model.

[0103] It should be noted that the physical layer consists of key physical equipment such as transformers, instrument transformers, and lines, and is the system's bottom layer responsible for power transmission and conversion. The information layer consists of the perception layer, transmission layer, and application layer communication nodes. The control layer is responsible for receiving data from the information layer and issuing control commands. Security weaknesses refer to the vulnerabilities in each layer when resisting coordinated attacks, such as insufficient anti-interference capabilities, lack of verification mechanisms, and decision-making loopholes.

[0104] In this embodiment of the invention, by combining the unique response characteristics and impact propagation paths of the obtained collaborative attacks, the weaknesses in the electromagnetic interference resistance of key physical layer equipment, the data verification and transmission security performance of the information layer, and the command decision-making and execution logic of the control layer are analyzed respectively. The protection vulnerabilities of each layer in resisting electromagnetic interference and false data injection collaborative attacks are accurately located, and the causes of the shortcomings and the degree of impact of the attacks are clarified.

[0105] Step b3 involves setting up protection strategies based on vulnerable links to collaborative attacks, weak nodes in critical coupling, impact propagation channels, and various security shortcomings, from the dimensions of power system boundary isolation, data verification, measurement fault tolerance, and command control.

[0106] It should be noted that boundary isolation, to avoid irrelevant interference and ensure targeted protection, limits the scope of system protection, clearly defines the protection boundary, and eliminates invalid interference. Data verification refers to checking the authenticity and accuracy of data transmitted and stored by the system to avoid the impact of false data and erroneous commands. Measurement fault tolerance refers to optimizing the anti-interference capabilities of measurement equipment, setting up data redundancy backups, reducing measurement errors, and ensuring data accuracy. Command control refers to standardizing the entire process of generating, issuing, and executing system control commands to avoid system anomalies caused by erroneous commands. Protection strategy refers to targeted prevention and control measures developed in response to the characteristics of coordinated attacks and in combination with the vulnerabilities of each system, used to resist attacks and ensure stable system operation.

[0107] In this embodiment of the invention, combining the propagation logic of collaborative attacks with the characteristics of system operation, the following measures are implemented: In the boundary isolation dimension, system access control and attack behavior interception mechanisms are added to block the entry and spread of illegal attack signals; in the data verification dimension, data verification rules are optimized to enhance the ability to identify false data and promptly filter invalid or tampered data; in the measurement fault tolerance dimension, the anti-interference capability of measurement equipment is improved, and data redundancy backups are set to avoid measurement errors; in the command control dimension, the command generation, issuance, and execution processes are standardized, and an anomaly early warning mechanism is established to ensure that the protection strategy accurately matches the propagation path and impact patterns of collaborative attacks, thereby achieving effective prevention and control of collaborative attacks and forming a complete protection system.

[0108] Specifically, the attack mechanism is summarized as follows: Combining the results of coupling path analysis with the system impact patterns, the core mechanism of coordinated attacks is extracted from the perspective of the process from attack triggering, coupling effect, system response to failure evolution; the coordination conditions of the two types of attacks are clarified, including key elements such as attack timing matching, intensity adaptation, and target association; the coupling mechanism of mutual reinforcement between the two is revealed, and it is explained how physical-side attacks and information-side attacks induce and promote each other; the key destructive paths of coordinated attacks on power information physical systems are sorted out, and the complete evolution logic of the attack from initiation to causing system failure is clarified, forming a complete understanding of the mechanism of coordinated attacks.

[0109] This invention addresses the core problems in existing technologies for analyzing collaborative attacks on power cyber-physical systems, such as insufficient characterization of coupling mechanisms, inaccurate quantification of impact patterns, and inadequate scenario adaptability. It constructs a comprehensive technical system encompassing system modeling, attack quantification, path analysis, and mechanism revelation, achieving precise analysis of the collaborative attack mechanism of electromagnetic interference and spoofing data injection. The technical effects are significant, specifically reflected in the following three aspects: 1. More accurate characterization of collaborative attack mechanisms, filling the blind spots in single attack analysis. This invention overcomes the limitations of existing technologies that focus on isolated studies of single attacks. By constructing a cyber-physical full-link coupling model, it systematically reveals the mutually inducing and reinforcing mechanism of electromagnetic interference and false data injection. This mechanism accurately captures the coupling logic that "physical deviations provide cover for information tampering, and information tampering amplifies the effects of physical damage," effectively improving the fit and accuracy of attack mechanism characterization. By quantifying attack parameters and coupling path weights, the complete link of "attack triggering—coupling effect—system response—fault evolution" can be clearly reconstructed, improving the problem of large discrepancies between traditional analysis results and actual collaborative attack scenarios. This provides a precise basis for attack tracing and risk prediction.

[0110] 2. More scientific quantification of system impact patterns supports the precise formulation of protection strategies. This invention establishes a quantitative evaluation method for the amplification effect of coordinated attacks by comparing the differences in system response under coordinated attacks and single attack scenarios. This method can accurately extract key patterns such as the critical conditions for system stability degradation and the chain reaction paths of equipment failures, significantly improving the prediction accuracy of core indicators such as bus voltage deviation and frequency fluctuations. Based on these quantitative patterns, a targeted cross-layer protection strategy of "physical-side electromagnetic shielding + information-side detection optimization" can be formulated, effectively reducing the risk of system failures caused by coordinated attacks and significantly improving the targeting and effectiveness of security protection for power information physical systems.

[0111] 3. It has stronger adaptability and scalability to meet the needs of new power systems. This invention is fully adaptable to the "physical-information" interaction characteristics of deeply coupled cyber-physical scenarios such as smart distribution networks and new energy power plants. Its standardized analysis process is applicable to power cyber-physical systems with different voltage levels and network topologies. It is also compatible with power industry standards such as IEC 61850 and IEC 61970, and can seamlessly interface with existing SCADA systems, PMU measurement devices, and other equipment without large-scale hardware modifications, resulting in lower implementation costs. This method has good scalability; by expanding the attack type parameter library and coupling model boundary conditions, it can quickly adapt to the collaborative attack mechanism analysis of emerging business scenarios such as new energy storage and microgrids, meeting the long-term evolutionary needs of new power system security protection. This invention quantifies the impact of electromagnetic interference attacks on physical equipment parameters and the extent of tampering with measurement data by false data injection attacks. Combined with the state equations and control logic of power cyber-physical systems, it constructs a collaborative attack coupling model, and then analyzes the impact of collaborative attacks on key indicators such as system stability and power supply reliability, ultimately achieving a comprehensive revelation of the collaborative attack mechanism.

[0112] The core key point of this invention is: Power Cyber-Physical System Full-Link Coupling Modeling Technology: Focusing on the deep interaction characteristics between the physical side and the information side, it constructs a full-link model covering the device body, network topology, information transmission and coupling relationship, realizing bidirectional accurate mapping between physical quantities and information data, and providing underlying support for the analysis of collaborative attack mechanisms.

[0113] Cooperative attack parameter quantification and coupling path analysis method: By defining cooperative attack scenarios and quantifying key attack parameters, and combining graph theory tools to construct coupling path graphs, we can accurately identify the mutual induction and mutual reinforcement mechanisms of electromagnetic interference and fake data injection, and clearly depict the attack transmission path and influence weights.

[0114] The system for extracting the laws and mechanisms of collaborative attacks: Through multi-scenario simulation comparison, the "1+1>2" amplification effect of collaborative attacks is quantified. The core mechanisms are extracted from multiple process nodes such as attack triggering, coupling effect, system response, and fault evolution, providing a scientific basis for the formulation of protection strategies.

[0115] The point to be protected by this invention is: The construction of mathematical models and network topology models for key physical equipment, the construction of hierarchical communication and full-process information processing models on the information side, and the modeling of coupling relationships based on forward / reverse mapping and time synchronization mechanisms enable bidirectional linkage and precise matching between "physical" and "information".

[0116] The collaborative attack mode, triggering conditions and attack target range are clearly defined. A quantitative relationship model of "interference intensity - physical device parameter deviation" is established, and reasonable constraints on the tampering of false data are set to achieve accurate characterization and quantitative representation of attack parameters.

[0117] Based on the system coupling model, key coupling nodes are located, the attack interaction logic is analyzed, and a graph theory method is used to construct a coupling path graph and assign weights to achieve visualization and quantitative presentation of the coupling path.

[0118] By collecting key indicator data from multi-scenario simulation systems, we can compare and extract the unique impact patterns of collaborative attacks, quantify the amplification effect, and refine the collaborative attack mechanism from a full-process perspective, providing technical support for the security protection of power information physical systems.

[0119] Here is an example application: To comprehensively verify the scientific validity, accuracy, and engineering applicability of the power cyber-physical collaborative attack mechanism analysis method integrating electromagnetic interference and spoofed data injection of this invention, a new energy integration scenario of a 220kV smart distribution network under a provincial power grid was selected as the best embodiment. This scenario includes one 220kV hub substation, one 100MW centralized photovoltaic power station, one 50MW wind farm, and several 110kV / 10kV distribution network lines. It is a typical cyber-physical deeply coupled system, facing significant collaborative attack risks, and possesses excellent verification conditions. This embodiment verifies the core effectiveness of the method by completely reproducing the collaborative attack scenario and executing the analysis process.

[0120] 1. Implementation Scenario Overview: This 220kV smart distribution network covers the power supply area of ​​two counties, serving approximately 500,000 users. Figure 3 As shown, the physical side is centered on the 220kV hub substation, connecting photovoltaic power stations, wind farms, and downstream distribution network loads. Key equipment includes two 240MVA main transformers, ten high-precision current / voltage transformers, eight 220kV transmission lines, and new energy inverters, etc. The information side adopts a "fiber optic + 5G" dual communication link architecture. The physical equipment status measurement is realized through the PMU synchronous phasor measurement unit and the RTU remote terminal unit. The data is transmitted to the regional dispatch center SCADA system through the edge gateway. Data interaction is carried out using the IEC 61850 standard protocol. The dispatch command issuance cycle is 1 second. Traditional bad data detection adopts the weighted least squares method (WLS).

[0121] The simulated collaborative attack scenario in this application example is as follows: the collaborative attackers deploy electromagnetic interference equipment to carry out physical attacks on the instrument transformers in the hub substation, and at the same time, they intrude into the 5G communication link to carry out false data injection attacks on the measurement data from the new energy power station to the dispatch center. The two work together to mislead the dispatch decision and intend to cause faults such as voltage exceeding the limit and equipment overload in the distribution network.

[0122] 2. Implementation Preparation and Parameter Configuration 2.1 System Coupling Model Construction Parameters (1) Physical side model parameters Key equipment parameters: Main transformer ratio 220kV / 110kV / 10kV, short-circuit voltage 14%; Current transformer (TA) ratio 2000 / 5A, accuracy class 0.2S; Voltage transformer (TV) ratio 220kV / √3 / 0.1kV / √3, accuracy class 0.2; Photovoltaic power station inverter maximum output power 500kW, response time ≤10ms; Wind farm doubly-fed induction generator rated speed 1500r / min.

[0123] Physical network topology: The 220kV side adopts a single busbar segmented connection. Photovoltaic power plants and wind farms are connected to the hub substation via a 220kV dedicated line. The 110kV side adopts a double busbar connection to connect to the downstream distribution network load. The electrical connection relationship of each device and the main power transmission path are clearly defined as "photovoltaic / wind farm → 220kV hub substation → 110kV distribution network → user side".

[0124] Operating constraints: 220kV bus voltage allowable deviation ±5% (209kV-231kV), maximum transmission power of the line 280MW, and allowable load rate of the main transformer ≤100%.

[0125] (2) Information-side model parameters Communication nodes and links: The terminal perception layer includes 30 PMUs (sampling frequency 100Hz) and 50 RTUs (sampling frequency 10Hz); the network transmission layer deploys 10 edge gateways and 8 core routers; the application layer is a regional dispatch center server cluster; the fiber optic link transmission rate is 10Gbps, latency ≤50ms, and bit error rate ≤10%. -9 5G link transmission rate is 1Gbps, latency is ≤80ms, and bit error rate is ≤10%. -6 .

[0126] Information processing flow: Measurement data acquisition types include voltage, current, power, equipment temperature, etc.; the transmission protocol adopts IEC 61850MMS / GOOSE; data storage adopts a distributed time-series database, and real-time data is retained for 72 hours; the preprocessing stage adopts the 3σ criterion to remove outliers, and the data format is standardized to the IEC61850 standard format.

[0127] (3) Coupling parameters Coupling Interface: The measurement interface adopts an RS485 Ethernet interface, and the control interface supports command parsing and feedback; in forward coupling, the mapping coefficient between physical quantities and data is calibrated based on the parameters on the equipment nameplate, while in reverse coupling, the control command and equipment action response coefficient are determined through experimental testing.

[0128] Synchronization mechanism: The IEEE 1588PTP time synchronization protocol is adopted, the coupling data synchronization frequency is 100Hz, the delay threshold is set to 10ms, and an alarm is triggered if the timeout occurs.

[0129] 2.2 Cooperative Attack Parameter Settings (1) Attack scenario definition parameters Collaborative mode: sequential triggering mode, electromagnetic interference attack is initiated first, and false data injection attack is triggered when the measurement error of the current transformer reaches 3% (exceeding the allowable range of 0.2 level accuracy).

[0130] Attack targets: Electromagnetic interference attack targets are two 220kV side current transformers (CTs) and two current transformers (TVs) within the hub substation; spurious data injection attack targets are the measured data of photovoltaic power station output and 220kV main line current.

[0131] Attack sequence: Electromagnetic interference attack is initiated at 0s, with the interference intensity gradually increasing; at 12s, the TA measurement error reaches 3.1%, triggering a false data injection attack; at 30s, both attacks cease, and the system recovery process is observed.

[0132] (2) Attack parameter quantification Electromagnetic interference attack: The type is pulse interference, the interference frequency is 5MHz (the sensitive frequency range of the transformer), and the interference intensity gradually increases from 1.0kV / m to 2.2kV / m. Based on electromagnetic simulation, a quantitative model of "interference intensity - measurement error" is established: Δe=0.02×E-0.012 (Δe is the TA proportional error, E is the interference intensity, R²=0.98).

[0133] False data injection attack: The tampering method is proportional tampering, and the targets of tampering are the active power of photovoltaic power plants and the current data of 220kV main lines, with tampering ratios of 12% and 10% respectively; combined with the WLS detection threshold (3σ), the tampered data constraint conditions are set to ensure that the residual after tampering is ≤2.8σ, which can bypass traditional detection.

[0134] 2.3 Analysis Tools and Environment Configuration This application example uses PSCAD / EMTDC to build the physical side electromagnetic transient model and OPNET to build the information side communication model. The two are coupled and linked by an interface program written in C++. Electromagnetic interference simulation is performed using CST Microwave Studio, and the cooperative attack path visualization is performed using the Matlab graph theory toolbox. The system state simulation step size is set to 1ms, and the total simulation time is 40s (including the recovery phase after the attack).

[0135] 3. Specific Implementation Process 3.1 Step c1: Construction and Verification of the Coupling Model of Power Cyber-Physical System Based on the above parameters, a physical-side electromagnetic transient model was constructed in PSCAD / EMTDC, covering detailed models of equipment such as main transformers, instrument transformers, lines, and new energy power plants. The topology was built based on the actual power grid wiring diagram. A three-level information-side model of "terminal perception - network transmission - application processing" was constructed in OPNET, defining the entire process of data acquisition, transmission, and processing. Real-time data interaction between the physical side and the information side was realized through an interface program to verify the accuracy of the coupled model: under normal operating conditions without attacks, the deviation between the simulated value and the actual monitored value of the 220kV bus voltage was ≤2%, and the information transmission delay was ≤80ms, meeting the requirements of coupled modeling.

[0136] 3.2 Step c2: Deployment of Cooperative Attack Scenarios and Verification of Parameter Quantization The electromagnetic interference attack parameters were verified in an electromagnetic simulation environment: the TA ratio error was 0.8% when the interference intensity was 1.0 kV / m, 2.1% when the intensity was 1.6 kV / m, and 4.2% when the intensity was 2.2 kV / m, consistent with the prediction results of the quantization model. A fake data injection attack script was deployed in the information-side model to simulate the data tampering process, verifying that the tampered data could successfully bypass WLS bad data detection, and the stealth met the set requirements.

[0137] 3.3 Step c3: Cooperative Attack Coupling Path Analysis (1) Verification of a single attack path Electromagnetic interference attack alone: ​​When only an electromagnetic interference attack (intensity 2.2kV / m) is initiated, the simulation results show that the TA measurement error is 4.2%, which causes the line current data received by the information side to be distorted. The dispatch center initially judged that the line load was slightly increased, but no alarm was triggered. The maximum deviation of the 220kV bus voltage was 2.3% (within the allowable range), and there was no equipment overload.

[0138] False data injection attack: Only a false data injection attack is launched. After the tampering, the photovoltaic output data is falsely inflated by 12% and the line current data is falsely inflated by 10%. The dispatch center misjudges that the line load is too heavy and issues a command to reduce the photovoltaic output (from 100MW to 85MW). The maximum deviation of the bus voltage is 3.1%, which is still within the allowable range.

[0139] (2) Cooperative attack coupling path identification and quantification Based on the simulation of the coupled model, the transmission process of the attack impact was traced, and the core coupling path was identified: the electromagnetic interference attack caused the measurement error of the current transformer to increase, expanding the normal fluctuation range of the measurement data and providing cover for the injection of false data; the tampered composite distortion data was transmitted to the dispatch center, misleading the dispatch center to issue incorrect instructions (the photovoltaic output was reduced to 60MW, and the tap of the main transformer was adjusted down), which further aggravated the abnormal operation of physical equipment, forming a closed-loop coupled link of "electromagnetic interference → measurement deviation → data tampering → error control → equipment overload".

[0140] A coupled path graph is constructed using graph theory. The nodes include electromagnetic interference attack sources, transformers, measurement devices, 5G communication links, dispatch centers, photovoltaic inverters, and main transformers. The edge weights are assigned based on the quantification results of the attack parameters. The weight of "electromagnetic interference source - transformer" is 0.85, the weight of "transformer - measurement device" is 0.78, and the weight of "5G link - dispatch center" is 0.92, clearly showing the transmission intensity of the attack impact.

[0141] 3.4 Step c4: Analysis of the impact of coordinated attacks on the system (1) System state simulation data acquisition Through coupled model simulation, time series data of key system operation indicators were collected for the entire collaborative attack process (0-40s). The core data are shown in Table 1 below: Table 1. Core Data

[0142] (2) Extraction of influence patterns and quantification of amplification effects The extreme values ​​of key indicators for coordinated attacks and single attacks are compared, and the results are shown in Table 2 below: Table 2. Comparison Results

[0143] Analysis shows that the voltage deviation caused by the coordinated attack (-6.9%) far exceeds the superposition effect of a single attack (-2.1% + (-3.4%) = -5.5%), and is below the allowable lower limit (209kV), lasting for 5.1s; the frequency deviation is 4 times that of a single electromagnetic interference attack and 2.4 times that of a single spoofing data injection attack; the quantization amplification effect shows that the degree of damage to system performance caused by the coordinated attack is 1.25 times that of the superposition effect of a single attack, fully verifying the synergistic effect of "1+1>2".

[0144] (3) Summary of attack mechanism Combining the coupling path and the influence law, the collaborative attack mechanism in this scenario is clarified: electromagnetic interference attacks provide a "covert barrier" for false data injection attacks by damaging the measurement accuracy of physical equipment, reducing the probability of data tampering being detected; false data injection attacks amplify the destructive effect of physical side attacks by misleading scheduling decisions, forming a coupled loop of "physical distortion - information tampering - error control - physical deterioration"; the core destructive path of the attack is "transformer measurement deviation → data composite distortion → scheduling command error → voltage / frequency over-limit → equipment overload risk", ultimately threatening the safe and stable operation of the system.

[0145] 4. Implementation effect verification 4.1 Validation of the method The method of this invention successfully identified the core coupling path of the cooperative attack, and the consistency between the mechanism analysis results and the simulation data reached more than 92%. The prediction error of key indicators such as voltage deviation and frequency deviation was ≤3%, which improved the accuracy by 55% compared with the traditional single attack analysis method, thus verifying the accuracy of the method.

[0146] 4.2 Implementation effect of protection strategy Based on the attack mechanism analyzed in this invention, a targeted protection strategy was formulated and implemented in the power distribution network: electromagnetic shielding covers (shielding effectiveness ≥40dB) were installed around the instrument transformers in the hub substation to reduce the impact of electromagnetic interference; the bad data detection algorithm was optimized on the information side, and a dual verification mechanism of "instrument transformer error model + physical equipment operation constraints" was introduced. After the protection strategy was implemented, the same coordinated attack was simulated again. The lowest value of the 220kV bus voltage was 215.8kV (deviation -3.7%), and the lowest value of the frequency was 49.82Hz (deviation -0.18Hz). There were no equipment overloads, and the system security level was improved by 65%, verifying the supporting role of the method of this invention in the formulation of the protection strategy.

[0147] 5. Summary of Application Examples This application example fully implements the method of this invention in a 220kV smart distribution network renewable energy integration scenario, verifying the following core conclusions: The power information physical system coupling model constructed by this invention can accurately reflect the two-way interaction relationship between "physical" and "information", with a modeling error of ≤2%, providing a reliable basis for the analysis of collaborative attack mechanisms; The results of the collaborative attack path identification and mechanism analysis are highly consistent with the actual simulation scenario, and can clearly reveal the coupling mechanism and destruction path of the two attacks; The protection strategy developed based on the analysis results can effectively resist coordinated attacks and significantly improve the system's security protection capabilities, fully demonstrating that the method of this invention has strong engineering application value and promotion prospects.

[0148] This embodiment also provides a device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions. This device is used to implement the above embodiments and preferred embodiments, and details already described will not be repeated. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0149] This embodiment provides a device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, such as... Figure 4 As shown, it includes: Module 301 is used to construct a coupled model of the power information physical system by bidirectionally coupling the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes. Module 302 is established to quantify the parameters of electromagnetic interference attacks and fake data injection attacks and set covert constraints to establish a collaborative attack scenario. The simulation module 303 is used to simulate the coupled model of the power cyber-physical system in a cooperative attack scenario according to a preset cooperative attack coupling path, and to determine the unique impact law of the cooperative attack on the power system based on the simulation results.

[0150] In some alternative implementations, the construction module 301 includes: The acquisition unit is used to acquire multiple key physical devices and multiple communication nodes of the power system; among which, the key physical devices include transformers, instrument transformers, lines, circuit breakers, generators and new energy inverters, and the communication nodes include the sensing layer, the transmission layer and the application layer. Construct physical-side model units to build a power physical network topology model using preset operating constraints, key parameters and equipment characteristics of each key physical device; Construct an information-side model unit, which uses each communication node, multiple communication links and corresponding communication parameters to build a hierarchical information processing model; A coupled model unit is constructed to integrate the power physical network topology model and the hierarchical information processing model to build a coupled model of the power information physical system based on the two-way coupling mapping and time synchronization mechanism of physical and information.

[0151] In some alternative implementations, the establishment module 302 includes: Constraint units are used to construct collaborative constraint conditions based on the collaborative mode, triggering sequence, attack target, and duration of electromagnetic interference attacks and fake data injection attacks. The first quantization unit is used to establish a quantitative mapping relationship between the interference intensity and the deviation of physical equipment parameters by adopting the type, frequency, intensity and duration of the electromagnetic interference attack, and to quantify the electromagnetic interference attack parameters. The setting unit is used to set the threshold characteristics of traditional bad data detection algorithms to set the concealment constraints of tampered data; The second quantization unit is used to quantify the parameters of a fake data injection attack based on the concealment constraint and in combination with the object, method, and range of tampering of the fake data injection attack. Scenario units are constructed to build collaborative attack scenarios based on quantized electromagnetic interference attack parameters, spoof data injection attack parameters, and collaborative constraints.

[0152] In some optional implementations, the preset cooperative attack coupling path includes: The analysis subunit is used to perform single attack path analysis on electromagnetic interference attacks and false data injection attacks respectively, and to determine the corresponding impact transmission links. The location subunit is used to locate the key coupling nodes of electromagnetic interference attacks and false data injection attacks in the coupled model of the power cyber-physical system based on each influence transmission link. The associated subunit is used to correlate electromagnetic interference attacks, false data injection attacks and control anomalies of the power information physical system coupling model based on key coupling nodes, forming a closed-loop coupling link. The coupling path subunit is used to construct a collaborative attack coupling path graph based on a closed-loop coupling link, with the attack source, target device, communication node, control center and measurement device as network nodes, and the attack effect correlation and effect transmission flow as directed edges, and to assign influence weights to generate collaborative attack coupling paths.

[0153] In some alternative implementations, simulation module 303 includes: The setting unit is used to set simulation parameters, simulation duration, and simulation boundaries based on preset cooperative attack coupling paths and cooperative attack scenarios. The simulation unit is used to input the cooperative attack parameters, cooperative constraints, and cooperative attack coupling paths of the cooperative attack scenario into the power information physical system coupling model for simulation based on the simulation parameters, simulation duration, and simulation boundaries. The extraction unit is used to extract physical-side device operation data, information-side communication data, and control command data during the simulation process to generate real-time simulation data. The comparison unit is used to compare the simulation results of single attacks corresponding to electromagnetic interference attacks and spoofing data injection attacks with real-time simulation data. Based on the comparison results, it identifies the unique response characteristics of the coupled power cyber-physical system model under coordinated attacks and generates unique influence laws.

[0154] In some alternative embodiments, the device includes: The information determination unit is used to determine the vulnerable links, key weak points, and impact propagation channels of the power cyber-physical system coupling model based on the cooperative attack coupling path. The identification unit is used to identify the security protection weaknesses of the physical layer, information layer, and control layer of the power cyber-physical system coupling model according to the unique impact of coordinated attacks on the power system. The protection unit is used to set protection strategies based on vulnerable links of collaborative attacks, weak nodes of critical coupling, impact propagation channels and various security protection shortcomings, from the dimensions of power system boundary isolation, data verification, measurement fault tolerance and command control.

[0155] The device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions provided in this embodiment of the invention can execute the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects for executing the method. Further functional descriptions of the above modules and units are the same as in the corresponding embodiments described above, and will not be repeated here.

[0156] Figure 5 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention.

[0157] The following is a detailed reference. Figure 5 This diagram illustrates a structural schematic suitable for implementing an electronic device according to embodiments of the present invention. The electronic device may include a processor (e.g., a central processing unit, graphics processor, etc.) 401, which can perform various appropriate actions and processes according to a program stored in read-only memory (ROM) 402 or a program loaded from memory 408 into random access memory (RAM) 403. The RAM 403 also stores various programs and data required for the operation of the electronic device. The processor 401, ROM 402, and RAM 403 are interconnected via a bus 404. An input / output (I / O) interface 405 is also connected to the bus 404.

[0158] Typically, the following devices can be connected to I / O interface 405: input devices 406 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 407 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; memory devices 408 including, for example, magnetic tapes, hard disks, etc.; and communication devices 409. Communication device 409 allows electronic devices to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 5 Electronic devices with various devices are shown, but it should be understood that it is not required to implement or have all of the devices shown, and more or fewer devices may be implemented or have instead.

[0159] In particular, according to embodiments of the present invention, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments of the present invention include a computer program product comprising a computer program carried on a non-transitory computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device 409, or installed from a memory 408, or installed from a ROM 402. When the computer program is executed by the processor 401, it performs the functions defined in the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions according to embodiments of the present invention.

[0160] Figure 5 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments of the present invention.

[0161] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code. When the software or computer code is accessed and executed by the computer, processor, or hardware, the method for analyzing the highly covert cross-domain attack mechanism of power systems under cyber-physical coupling conditions shown in the above embodiments is implemented.

[0162] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0163] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims.

Claims

1. A method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, characterized in that, The method includes: A coupled power information physical system model is constructed by bidirectionally coupling a power physical network topology model corresponding to multiple key physical devices in the power system and a hierarchical information processing model of multiple communication nodes. Electromagnetic interference attacks and fake data injection attacks are quantified with parameters and concealment constraints are set to establish a collaborative attack scenario. The power cyber-physical system coupling model is simulated in the cooperative attack scenario according to the preset cooperative attack coupling path, and the unique impact law of the cooperative attack on the power system is determined based on the simulation results.

2. The method according to claim 1, characterized in that, The power cyber-physical system coupling model is constructed by bidirectionally coupling a power physical network topology model corresponding to multiple key physical devices of the power system and a hierarchical information processing model of multiple communication nodes, including: Acquire multiple key physical devices and multiple communication nodes of the power system; Using preset operational constraints, and employing the key parameters and equipment characteristics corresponding to each of the key physical devices, a power physical network topology model is constructed. A hierarchical information processing model is constructed using the aforementioned communication nodes, multiple communication links, and corresponding communication parameters. Based on the two-way coupling mapping and time synchronization mechanism of physics and information, the power physical network topology model and the hierarchical information processing model are integrated to construct a power information physical system coupling model.

3. The method according to claim 1, characterized in that, The method involves quantifying parameters and setting covert constraints for electromagnetic interference attacks and spoofed data injection attacks to establish a collaborative attack scenario, including: Based on the collaborative mode, triggering sequence, attack target, and duration of electromagnetic interference attacks and fake data injection attacks, collaborative constraints are constructed. Based on the type, frequency, intensity, and duration of the electromagnetic interference attack, the electromagnetic interference attack parameters are quantified. By employing the threshold characteristics of traditional bad data detection algorithms, a constraint is set to conceal the data tampering. Based on the aforementioned concealment constraint, and combined with the tampering target, tampering method, and tampering range of the aforementioned fake data injection attack, the parameters of the fake data injection attack are quantified. Based on the quantized electromagnetic interference attack parameters, false data injection attack parameters, and cooperative constraints, a cooperative attack scenario is constructed.

4. The method according to claim 1, characterized in that, The preset collaborative attack coupling path includes: Single attack path analysis was performed on the electromagnetic interference attack and the fake data injection attack to determine the corresponding impact transmission links; Based on the aforementioned impact transmission links, the key coupling nodes of the electromagnetic interference attack and the false data injection attack in the power cyber-physical system coupling model are located. Based on the key coupling nodes, the electromagnetic interference attack, the false data injection attack and the control anomaly of the power information physical system coupling model are correlated to form a closed-loop coupling link. Based on the closed-loop coupling link, with the attack source, target device, communication node, control center and measurement device as network nodes, and the attack effect correlation and effect transmission flow as directed edges, a collaborative attack coupling path graph is constructed and assigned influence weights to generate a collaborative attack coupling path.

5. The method according to claim 1, characterized in that, The simulation of the power cyber-physical system coupling model in the cooperative attack scenario according to the preset cooperative attack coupling path, and the determination of the unique impact law of the cooperative attack on the power system based on the simulation results, include: Based on the preset cooperative attack coupling path and the cooperative attack scenario, simulation parameters, simulation duration and simulation boundaries are set; Based on the simulation parameters, the simulation duration, and the simulation boundary, the collaborative attack parameters, collaborative constraints, and collaborative attack coupling paths of the collaborative attack scenario are input into the power information physical system coupling model for simulation. Extract physical device operation data, information-side communication data, and control command data during the simulation process to generate real-time simulation data; The simulation results of the single attack corresponding to the electromagnetic interference attack and the fake data injection attack are compared with the real-time simulation data. Based on the comparison results, the unique response characteristics of the coupled model of the power information physical system under the cooperative attack are identified, and unique influence laws are generated.

6. The method according to claim 1, characterized in that, The method further includes: Based on the aforementioned collaborative attack coupling path, the vulnerable links, key weak coupling nodes, and impact propagation channels of the collaborative attack in the power cyber-physical system coupling model are determined. Based on the unique impact patterns of coordinated attacks on the power system, identify the security protection weaknesses of the physical layer, information layer, and control layer of the power cyber-physical system coupling model; Based on the aforementioned vulnerable links to collaborative attacks, the aforementioned critical weak coupling nodes, the aforementioned impact propagation channels, and the aforementioned security protection shortcomings, protection strategies are set from the dimensions of boundary isolation, data verification, measurement fault tolerance, and command control of the power system.

7. A device for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions, characterized in that, The device includes: The module is used to construct a coupled model of the power information physical system by bidirectionally coupling the power physical network topology model corresponding to multiple key physical devices of the power system and the hierarchical information processing model of multiple communication nodes. A module was established to quantify parameters and set covert constraints for electromagnetic interference attacks and fake data injection attacks, and to establish a collaborative attack scenario. The simulation module is used to simulate the power cyber-physical system coupling model in the cooperative attack scenario according to a preset cooperative attack coupling path, and to determine the unique impact law of the cooperative attack on the power system based on the simulation results.

8. An electronic device, characterized in that, include: A memory and a processor are interconnected, the memory stores computer instructions, and the processor executes the computer instructions to perform the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing the computer to execute the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions as described in any one of claims 1 to 6.

10. A computer program product, characterized in that, The method includes computer instructions for causing a computer to execute the method for analyzing the mechanism of highly covert cross-domain attacks on power systems under cyber-physical coupling conditions as described in any one of claims 1 to 6.

Images