A virtual power plant false data injection attack detection method and system based on conditional spatiotemporal generative adversarial network

Abstract

The application provides a virtual power plant false data injection attack detection method and system based on a conditional spatiotemporal generative adversarial network, obtains running state measurement data of each node of the virtual power plant, and performs normalization processing; a conditional encoder of the conditional spatiotemporal generative adversarial network model generates a conditional vector according to a node adjacency matrix vector and a time feature vector; after a discriminator extracts spatiotemporal features from the running state measurement data, the spatiotemporal features and the conditional vector are spliced to obtain an intermediate layer feature vector; the intermediate layer feature vector and the running state measurement data are respectively calculated to obtain a feature difference score, a time sequence consistency score and a physical constraint score; after weighted fusion, a comprehensive anomaly score is obtained; a dynamic decision threshold is obtained by using a quartile range method based on a sliding window, and the comprehensive anomaly score is compared with the dynamic decision threshold; if the comprehensive anomaly score is greater than the dynamic decision threshold, it is determined that the current measurement data exists false data injection attack; otherwise, it is a normal running state.

Description

Technical Field

[0001] This invention relates to the interdisciplinary field of power system information security and artificial intelligence, and in particular to a method and system for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks. Background Technology

[0002] Virtual Power Plants (VPPs), by integrating and regulating flexible resources such as distributed power sources, energy storage, and adjustable loads, can effectively mitigate fluctuations in renewable energy output and enhance grid regulation capabilities, becoming a key support for the safe operation of new power systems. As a typical power cyber-physical system, the operation of VPPs highly relies on the deep integration of power physical equipment and information communication networks, making them vulnerable to high-risk cyberattacks. Furthermore, due to the dispersed and complex nature of VPP access terminals and their reliance on public network communication, compared to traditional power systems, there are more attack entry points and lower barriers to entry.

[0003] Among various cyberattacks, deceptive attacks, represented by False Data Injection Attacks (FDIA), pose a serious threat to the reliable and orderly operation of virtual power plants due to their high concealment, low implementation cost, and wide potential impact. FDIAs can mislead critical decision-making processes such as state estimation, dispatch control, or market transactions by tampering with or falsifying measurement data transmitted in the system, thereby causing physical equipment failures or even market imbalances, resulting in significant losses for virtual power plant operators and the power grid. Therefore, accurately identifying FDIAs faced by virtual power plants is crucial for their stable and reliable operation.

[0004] Currently, methods for FDIA (Fault-Do-Check-Act) inspection are mainly divided into two categories: model-based and data-driven. Model-based methods establish a state estimation model based on the system's topology and physical constraints, using the statistical characteristics of the state estimation residuals or the deviation between predicted and actual measurements as the basis for inspection. However, with the increasing complexity of power grid structures and the continuous growth of data volume, accurate system models are difficult to establish, severely limiting the applicability and scalability of model-based methods in practical applications.

[0005] In contrast, data-driven methods learn attack features directly from historical data, training detection models without relying on system parameters and topology information. Existing research has employed supervised learning methods such as decision trees, support vector machines, and convolutional neural networks to construct FDIA detectors. However, data labeled with attacks in actual power grid operation scenarios is extremely difficult to obtain, posing a fundamental challenge of insufficient training samples for supervised learning methods. To address this, some studies have introduced unsupervised learning methods such as K-nearest neighbors, isolated forests, and a class of support vector machines. As attack methods become increasingly covert and intelligent, traditional machine learning methods struggle to effectively capture complex anomaly patterns in measurement data, making deep learning-based FDIA detection methods a research hotspot. However, deep learning methods also rely on massive amounts of training data, while the power industry generally suffers from multi-entity data silos and data privacy constraints, making cross-regional data collaboration difficult, resulting in insufficient model training and limited detection accuracy.

[0006] Generative Adversarial Networks (GANs), through their adversarial game mechanism between generators and discriminators, can learn data distribution characteristics without requiring large amounts of labeled data, and have received widespread attention in the field of FDIA detection in recent years. However, directly applying existing GAN-based FDIA detection methods to virtual power plant scenarios still faces many technical bottlenecks. In terms of spatiotemporal feature extraction, the output of distributed energy resources in virtual power plants is affected by multiple factors such as weather, time series, and geographical location. Measurement data exhibits strong spatiotemporal coupling characteristics, with electrical topological connections between nodes and complex temporal evolution patterns in measurement sequences. Existing methods typically employ isolated temporal or spatial models, making it difficult to achieve collaborative capture of spatiotemporal features and limiting the ability to identify complex attack signals. Regarding condition control, the generation process of traditional GANs is not subject to conditional constraints, making it impossible to differentiate modeling for the specific operating conditions of virtual power plants, resulting in insufficient adaptability of the model to different operating scenarios. Regarding threshold setting, the operating status of virtual power plants is highly dynamic, and the statistical characteristics of measurement data drift over time. Existing methods use fixed thresholds for anomaly detection, which makes it difficult to track the time-varying patterns of data distribution, resulting in a high false alarm rate and an inability to effectively distinguish between low-amplitude covert attack signals and normal power fluctuations.

[0007] To overcome the aforementioned technical bottlenecks, there is an urgent need for an FDIA detection method that can simultaneously capture the spatiotemporal coupling characteristics of virtual power plant measurement data, has adaptive operating condition capabilities, and employs a dynamic threshold mechanism, in order to establish an intelligent detection closed loop from measurement data to attack identification. Summary of the Invention

[0008] To address the problems existing in the background technology, this invention proposes a method and system for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks.

[0009] A method for detecting fake data injection attacks on virtual power plants based on conditional spatiotemporal generative adversarial networks includes the following steps: S100. Obtain the operating status measurement data of each node in the network topology corresponding to the virtual power plant, and perform normalization preprocessing on the operating status measurement data. S200. Construct a conditional spatiotemporal generative adversarial network model, including at least a conditional encoder and a discriminator; the conditional encoder generates a conditional vector based on the adjacency matrix vector of the nodes and the temporal feature vector. S300. After the discriminator extracts spatiotemporal features from the preprocessed running status measurement data, it concatenates the spatiotemporal features with the conditional vector to obtain the intermediate layer feature vector. S400. Calculate and obtain the feature difference score, temporal consistency score and physical constraint score based on the intermediate layer feature vector and the preprocessed running status measurement data, respectively. S500: Obtain a comprehensive anomaly score by weighted fusion of the feature difference score, the temporal consistency score, and the physical constraint score; S600. A dynamic decision threshold is obtained using the interquartile range method based on a sliding window. The comprehensive anomaly score is compared with the dynamic decision threshold. If the comprehensive anomaly score is greater than the dynamic decision threshold, it is determined that the measurement data at the current moment is subject to a false data injection attack; otherwise, it is determined to be in normal operating condition.

[0010] Based on the above, in step S200, the condition vector for:

[0011]

[0012] in, It is an adjacency matrix. For vectorization operations; This is a time feature vector; , , The weight matrix is ​​a learnable matrix; , , For bias terms; This indicates vector concatenation; For activation functions; This is the conditional vector for the output; The dimension of the conditional vector; The number of hours at the current data collection time. What day of the week is it?

[0013] Based on the above, in step S300, the discriminator includes a cascaded spatial feature extraction module, a temporal feature extraction module, a feature fusion module, a shared feature extraction network, and a temporal evaluation branch; the preprocessed operating state measurement data is sequentially processed by the spatial feature extraction module and the temporal feature extraction module to extract spatiotemporal features, and then input into the feature fusion module; the feature fusion module combines the extracted spatiotemporal features with the conditional vector output by the conditional encoder. The concatenated feature vectors are then mapped to intermediate layer features via a shared feature extraction network. The temporal evaluation branch outputs the temporal consistency score. The intermediate layer feature vectors... Represented as:

[0014] in, This represents all cascaded operations in the discriminator from the input layer to the output layer of the shared feature extraction network.

[0015] Based on the above, the spatial feature extraction module employs a graph attention network. For each layer, the graph attention of the input features is independently calculated at each time step along the time dimension:

[0016]

[0017] in, For the first The input feature tensor of the layer; For activation functions; For nodes The set of neighboring nodes; For the first Layers, Time Steps Next node With nodes Attention coefficient between them; For the first The feature projection matrix of the layer; The temporal feature extraction module uses temporal convolutional residual blocks to model temporal dependencies:

[0018]

[0019] in, This is the output sequence of the spatial feature extraction module; It is the length of the time window; for Feature dimensions; The kernel size; The current layer's expansion rate; These are the convolution kernel parameters; , All are causal dilated convolutions; BN is batch normalization. This is the activation function.

[0020] Based on the above, in step S400, the feature difference score Temporal consistency score and physical constraint scores They are respectively:

[0021]

[0022]

[0023]

[0024] in, and These are the baseline characteristics of the discriminator: mean and standard deviation. These are the feature vectors of the intermediate layer; It is an L2 norm; To prevent division by zero of extremely small constants; The original score for time-series consistency. For the forward computation function of the time-series evaluation branch; For nodes Those who have made contributions For nodes The load power, It is a very small constant.

[0025] Based on the above, in step S500, the comprehensive anomaly score is:

[0026] in, These are the weighting coefficients, For feature difference scores, For time-series consistency score, The score represents the physical constraint.

[0027] Based on the above, in step S600, the system maintains a length of sliding window Store the comprehensive anomaly score of the most recently judged normal time. Cold start phase: If the number of valid normal samples in the sliding window is insufficient The 95th percentile, pre-calculated and saved during the training phase, was used as the initial detection threshold. :

[0028] in This is the set of comprehensive abnormal scores for all normal samples in the training set. Normal operation phase: When the number of normal samples in the sliding window reaches After that, the interquartile range method is used to dynamically calculate the current detection threshold:

[0029] in and These are the lower quartile and upper quartile of the combined abnormal scores of all normal samples within the current sliding window, respectively.

[0030] Based on the above, in step S200, the conditional spatiotemporal generative adversarial network model further includes a generator used only in the training phase. The generator includes an initial projection module, a spatial feature extraction module, a temporal feature extraction module, and an output mapping module. The initial projection module concatenates the random noise vector and the conditional vector generated by the conditional encoder, and then inputs them into the spatial feature extraction module and the temporal feature extraction module to extract the spatial coupling features and temporal evolution features of the measurement data, respectively. The output mapping module generates fake samples. In the training phase, the discriminator is trained using fake samples and real measurement data, and the parameters of the trained discriminator and the conditional encoder are fixed and saved.

[0031] Based on the above, during the training phase, the output branch of the discriminator further includes an adversarial discrimination branch and a physical evaluation branch, wherein the adversarial discrimination branch and the physical evaluation branch are parallel branches to the temporal evaluation branch; The intermediate layer features output by the shared feature extraction network are input into three parallel output branches: an adversarial discriminant branch to distinguish between real and generated data (this branch only participates in adversarial optimization during training and is deprecated during application); a temporal evaluation branch to learn discriminative features of temporal patterns in measurement data and outputs a temporal consistency score during application; and a physical evaluation branch to learn discriminative features of physical patterns in measurement data (this branch only serves as an auxiliary task to guide the shared network during training and is deprecated during application).

[0032] A virtual power plant fake data injection attack detection system based on conditional spatiotemporal generative adversarial networks includes a computing unit, a storage device, and a computer program stored on the storage device and executable. When the computing unit executes the computer program, it implements any of the aforementioned virtual power plant fake data injection attack detection methods based on conditional spatiotemporal generative adversarial networks.

[0033] This invention has outstanding substantive features and significant progress compared to the prior art, specifically: (1) This invention constructs a conditional spatiotemporal generative adversarial network by fusing graph attention network and temporal convolutional network, which can simultaneously capture the spatial topological coupling features and temporal evolution features of virtual power plant measurement data, and significantly improves the ability to identify complex and covert attack signals. (2) By incorporating a conditional encoder into a generative adversarial network, this invention guides model training with network topology information and temporal context information, thereby achieving conditional modeling of the distribution of measurement data of a virtual power plant and enhancing the model's adaptability to different operating conditions. (3) This invention designs a multi-dimensional anomaly score detection mechanism, which weights and fuses the discriminator intermediate layer feature differences, time-series prediction errors and physical constraint violation degrees, and uses the interquartile range method based on sliding windows to dynamically calculate the detection threshold. This can effectively adapt to the time-varying characteristics of the virtual power plant's operating state, significantly distinguish between low-amplitude, highly concealed attack signals and normal operating fluctuations, and reduce the false alarm rate.

[0034] (4) This invention does not require training data with attack labels. It only requires measurement data under normal operating conditions to complete model training, which effectively solves the problem of difficulty in obtaining attack samples in actual scenarios and has good engineering application prospects. Attached Figure Description

[0035] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0036] Figure 1 This is a flowchart illustrating the process of this invention.

[0037] Figure 2 This is a schematic diagram illustrating the detection principle of the conditional generative adversarial network of this invention.

[0038] Figure 3 This is a schematic diagram of the workflow of the generator of the present invention.

[0039] Figure 4 This is a schematic diagram of the working process of the discriminator of the present invention.

[0040] Figure 5 This is a comparison chart of AUC in the ablation experiment of this invention.

[0041] Figure 6 This is a comparison chart of the performance indicators of the various models in this invention.

[0042] Figure 7 This is a comparison chart showing the change in accuracy of each model in this invention with the number of training rounds. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] like Figure 1 As shown, a method for detecting fake data injection attacks in a virtual power plant based on a conditional spatiotemporal generative adversarial network includes the following steps: S100, acquiring the operational status measurement data of each node in the network topology corresponding to the virtual power plant, and performing normalization preprocessing on the operational status measurement data; S200, constructing a conditional spatiotemporal generative adversarial network model, including at least a conditional encoder and a discriminator; the conditional encoder generates a conditional vector based on the adjacency matrix vector and temporal feature vector of the node; S300, the discriminator extracts spatiotemporal features from the preprocessed operational status measurement data, and concatenates the spatiotemporal features with the conditional vector to obtain intermediate layer features. Feature vector; S400, calculate and obtain feature difference score, temporal consistency score and physical constraint score respectively based on the intermediate layer feature vector and the preprocessed running state measurement data; S500, obtain comprehensive anomaly score by weighted fusion of the feature difference score, the temporal consistency score and the physical constraint score; S600, obtain dynamic decision threshold using the sliding window-based interquartile range method, and compare the comprehensive anomaly score with the dynamic decision threshold; if the comprehensive anomaly score is greater than the dynamic decision threshold, it is determined that the measurement data at the current time has a false data injection attack; otherwise, it is determined to be in normal operating state.

[0045] Specifically: This embodiment provides a method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks. The method includes five stages: data acquisition and preprocessing, model building, model training, anomaly score calculation, and attack determination.

[0046] The network topology of the virtual power plant is constructed. The nodes in the topology network refer to the grid-connected nodes in the virtual power plant that have power injection or load consumption, including distributed power generation grid-connection points, energy storage grid-connection points, and adjustable load access points, etc. This represents the total number of all such nodes.

[0047] In practice, this application constructs a conditional spatiotemporal generative adversarial network model. After training the model, the conditional spatiotemporal generative adversarial network model is used to detect and output results from real-time measurement data.

[0048] Example 1: Training Process 1.1 Data Acquisition and Preprocessing The system collects operational status measurement data for each node in the virtual power plant, including node power injection and voltage measurements, and constructs a node adjacency matrix based on the network topology of the virtual power plant. (Adjacency matrix) The construction rule is: if node With nodes If there is a direct electrical connection, then ,otherwise Simultaneously add a self-loop, i.e. The training and application phases use the same topology.

[0049] The collected measurement data is normalized, and time feature vectors are extracted. The preprocessed data is divided into training and test sets. The training set contains only measurement data under normal operating conditions, while the test set contains measurement data under both normal operating conditions and conditions induced by spoofing attacks.

[0050] 1.2 Construction of Conditional Spatiotemporal Generative Adversarial Network Model The Conditional Spatiotemporal Generative Adversarial Network (C-STGAN) model constructed in this embodiment includes a conditional encoder, a generator, and a discriminator. The generator and discriminator are trained through an adversarial game mechanism, enabling the discriminator to learn the spatiotemporal distribution characteristics of the virtual power plant's normal operation measurement data.

[0051] (1) Conditional encoder The conditional encoder is responsible for fusing power grid topology information and temporal context to generate conditional vectors. The adjacency matrix is ​​first vectorized and then mapped to the latent space through two fully connected layers. Simultaneously, the temporal feature vector is mapped to the same dimension through two fully connected layers. The concatenation of these two vectors is then input into the fusion layer, where they undergo hyperbolic tangent activation to obtain the conditional vectors.

[0052] in, It is an adjacency matrix. For vectorization operations; This is a time feature vector; , , The weight matrix is ​​a learnable matrix; , , For bias terms; This indicates vector concatenation; For activation functions; This is the conditional vector for the output; The dimension of the conditional vector.

[0053] This conditional vector simultaneously encodes the topological information of the virtual power plant and the temporal context information of the current moment, providing the generator and discriminator with operational condition awareness capabilities.

[0054] (2) Generator The generator includes an initial projection module, a spatial feature extraction module, a temporal feature extraction module, and an output mapping module. The generator takes a random noise vector and the conditional vector as input, and extracts the spatial coupling features and temporal evolution features of the measurement data through the spatial feature extraction module and the temporal feature extraction module, respectively, to generate generated samples that closely resemble the distribution of the real data. The generator's goal is to generate samples based on the given conditional vector. and random noise vector Generate a fake sample with the same dimensions as the real measurement data. ,in The time window length, For the number of nodes, This is the feature dimension for each node. The generated sample is input into the discriminator along with the real measurement data during the training phase, acting as a negative sample. Through adversarial training, the generator gradually learns the spatiotemporal distribution characteristics of the real data, while simultaneously forcing the discriminator to continuously strengthen its discrimination ability.

[0055] The generator's workflow is as follows: Figure 3 As shown, the initial projection module performs a joint mapping and concatenation of the random noise vector and the conditional vector output by the conditional encoder, and inputs it to two fully connected layers that both apply spectral normalization:

[0056] in, Represents the initial feature tensor. The weight matrix is ​​a learnable matrix; , is the bias term, z is the random noise vector, and c is the condition vector.

[0057] The spatial feature extraction module employs a graph attention network to model the spatial coupling relationships between nodes. For each layer, the graph attention of the input features is independently computed at each time step along the time dimension.

[0058] The mathematical expression for the attention coefficient is:

[0059] in, For the first The input feature tensor of the layer (H when l=1) 0 The input feature tensor of this module is used in the generator. The output of the initial projection module is in the discriminator. Raw measurement data ); For activation functions; For nodes The set of neighboring nodes; For the first Layers, Time Steps Next node With nodes Attention coefficient between them; For the first The feature projection matrix of the layer.

[0060] Graph attention networks dynamically calculate the influence weights between neighboring nodes through an attention mechanism, and weighted aggregate node features to adaptively capture the dynamic coupling relationships between different distributed energy nodes.

[0061] The temporal feature extraction module uses temporal convolutional residual blocks to model temporal dependencies. Temporal convolutional networks achieve efficient modeling of temporal data through causal convolution and dilated convolution: causal convolution ensures that the output at the current moment depends only on the current and historical inputs, avoiding the leakage of future information; dilated convolution expands the receptive field through skip sampling, enabling the network to capture dependencies over longer time spans. Causal dilated convolution is defined as:

[0062] The temporal convolution residual block is defined as:

[0063] in, The output sequence of the spatial feature extraction module is derived from the spatial feature extraction after the initial projection module in the generator, and directly from the spatial feature extraction of the measurement data in the discriminator. It is the length of the time window; for Feature dimensions; The kernel size; The current layer's expansion rate; These are the convolution kernel parameters; , All are causal dilated convolutions; BN is batch normalization. is the activation function. Residual connections provide a direct path for gradient propagation across layers, alleviating the vanishing gradient problem in deep networks and accelerating training convergence.

[0064] The output mapping module maps the high-level features extracted from spatial and temporal features to fake samples. These fake samples have the same dimension as the real measurement data and are used by the subsequent discriminator to distinguish between real and fake data.

[0065] (3) Mixed loss function of generator The generator's total loss function is a weighted average of adversarial loss, feature distribution distance loss, temporal consistency loss, and physical information loss:

[0066] in, This represents adversarial loss, which drives the generator to produce fake samples that can deceive the discriminator; This represents the distance loss based on the feature distribution; This represents the temporal consistency loss, constraining the evolution of generated samples over time to be consistent with the real data; To represent the loss of physical information, physical laws of power systems, such as power balance, are introduced as prior constraints. These are the corresponding weighting coefficients.

[0067] Feature distribution distance loss Defined as the L1 distance between the generated samples and the real samples in the discriminator's intermediate feature space:

[0068] in, Batch size; The first output of the generator A fake sample; For the first in the current batch One real sample; This represents the feature extraction portion of the discriminator before the final output layer; The L1 norm is used. L1 distance is employed as the feature distribution distance loss during the training phase, which has better robustness to outliers compared to L2 distance, thus helping to stabilize the generator's training process.

[0069] (4) Discriminator The discriminator comprises a cascaded spatial feature extraction module, a temporal feature extraction module, a feature fusion module, a shared feature extraction network, and three parallel output branches. The spatial and temporal feature extraction modules of the discriminator have the same structure and working principle as their corresponding modules in the generator, but their parameters are learned independently, so they will not be described further.

[0070] like Figure 4 As shown, the forward computation process of the discriminator is as follows: the input measurement data is sequentially processed by the spatial feature extraction module and the temporal feature extraction module to extract spatiotemporal features, and then input into the feature fusion module; the feature fusion module combines the extracted spatiotemporal features with the conditional vector output by the conditional encoder. The concatenated feature vectors are then mapped to intermediate layer features via a shared feature extraction network.

[0071] The intermediate layer features output by the shared feature extraction network are input into three parallel output branches: an adversarial discrimination branch to distinguish between real and generated data (this branch only participates in adversarial optimization during training and is deprecated during application); a temporal evaluation branch to learn discriminative features of temporal patterns in the measurement data, outputting a temporal consistency score during application; and a physical evaluation branch to learn discriminative features of physical patterns in the measurement data (this branch only serves as an auxiliary task to guide the shared network during training and is deprecated during application). In the application phase, anomaly evaluation in the physical dimension is performed by independent power-balanced residual calculation.

[0072] The conditional encoder is shared by the generator and discriminator. During training, its parameters are optimized along with the joint adversarial target. After training, the parameters are frozen and continue to participate in the discriminator's forward inference during the application phase, based on the real-time adjacency matrix. and time feature vector Calculate the condition vector This is for use by the feature fusion module.

[0073] The spatial feature extraction module and the temporal feature extraction module of the discriminator together constitute the spatiotemporal feature extraction path of the discriminator for the input data. In this embodiment, the discriminator takes real measurement data and fake samples output by the generator as input, and extracts spatiotemporal features through the spatial feature extraction module and the temporal feature extraction module. The discriminator is set with three parallel output branches, of which the adversarial discrimination branch is used to distinguish whether the input data is real data or generated data, the temporal evaluation branch is used to evaluate temporal consistency, and the physical evaluation branch is used to evaluate physical consistency.

[0074] The feature fusion module expands the extracted spatiotemporal features along the node dimension and concatenates them with the conditional vector output by the conditional encoder.

[0075] in, This represents the feature tensor output by the spatiotemporal feature extraction module; This is the condition vector output by the condition encoder; This indicates vector concatenation; This is the fused feature vector. The concatenated feature vector f is input to a shared feature extraction network, which consists of multiple standard fully connected layers with spectral normalization applied, each followed by a LeakyReLU activation function and Dropout regularization.

[0076]

[0077] in, , The weight matrix is ​​a spectral normalized matrix; , For bias terms; For the extracted intermediate feature vectors, spectral normalization constrains the Lipschitz constant of the discriminator by limiting the spectral norm of the weight matrix to stabilize GAN training, thereby stabilizing the GAN training process.

[0078] The adversarial branch consists of fully connected layers and has no final activation function, mapping intermediate layer features to adversarial scores:

[0079] in, This is the output layer weight matrix; For bias terms; This branch is for adversarial discrimination scoring. It only participates in adversarial optimization during the training phase and is used to distinguish real measurement data from fake samples output by the generator. The higher the score, the more likely the discriminator is to classify the input sample as real data.

[0080] (5) Training objectives of the discriminator During training, the discriminator's temporal evaluation branch and physical evaluation branch participate in training as auxiliary tasks, with their loss functions being:

[0081]

[0082] in, and These are the outputs of the discriminator's timing branch and physical branch, respectively, when the actual measurement data is input. and These are the outputs of the branches corresponding to the generator's input of forged samples. The 0s and 1s in the above loss are automatically generated binary labels based on the sample source and do not involve attack label information. The entire training process uses only measurement data under normal operating conditions, constituting unsupervised learning. The physical evaluation branch only participates in optimization during the training phase and is deprecated during the application phase.

[0083] In summary, the division of labor among the three parallel branches in the application phase is as follows: the adversarial discrimination branch and the physical evaluation branch are discarded after training and do not participate in the inference phase of the application phase; only the temporal evaluation branch is retained until the application phase, and its output is mapped by a Sigmoid algorithm to obtain the temporal consistency score. This is used to quantify the degree of deviation between the current measurement data's temporal pattern and the normal pattern. Physical constraint score during the application phase. This is accomplished by a separate power balance residual calculation module.

[0084] The discriminator is optimized using a Wasserstein loss with gradient penalty.

[0085]

[0086]

[0087] in, For the discriminator's adversarial loss, and These are the auxiliary losses for the temporal evaluation branch and the physical evaluation branch, respectively. and These are the corresponding weighting coefficients; To determine the scores based on the actual data; To determine the discrimination score for the generated data; This is a gradient penalty term; These are the gradient penalty weight coefficients; Sample points are obtained by linear interpolation of real data and generated data; The output of the discriminator for the interpolated samples; The symbol for mathematical expectation; The distribution followed by samples obtained by linear interpolation of real data and generated data; This is the gradient operator. The gradient penalty term constrains the discriminator so that the gradient norm in the interpolation space between the real and generated data is close to 1, which satisfies the Lipschitz constraint while avoiding the gradient vanishing or exploding problem caused by weight clipping.

[0088] 1.3 Model Training The conditional spatiotemporal generative adversarial network model is trained using the training set, employing a Wasserstein generative adversarial network training framework with gradient penalty.

[0089] Input all normal samples from the training set into the trained discriminator. Extract features from the intermediate layer of the discriminator:

[0090] in, This represents the feature extraction part of the discriminator before the final output layer.

[0091] Calculate the characteristic statistical benchmark of normal samples:

[0092]

[0093] Will , and normalized parameters during the training phase , Save it as a configuration file for use during real-time detection in the application phase.

[0094] like Figure 2 As shown, during training, the discriminator and generator are updated alternately. The discriminator is first updated based on real and generated samples, and the generator is then updated with the goal of deceiving the discriminator. Through adversarial training, the discriminator learns the spatiotemporal distribution characteristics of the virtual power plant's normal operation data, while its two evaluation output heads learn the capabilities of temporal consistency evaluation and physical constraint evaluation, respectively. After training, the generator is removed, and the parameters of the discriminator and conditional encoder are fixed and saved for use in the application phase. The conditional encoder and discriminator together constitute the anomaly detection front end in the application phase.

[0095] Example 2: Application Phase After training, the process for real-time detection using the model is as follows: Once the Conditional Spatiotemporal Generative Adversarial Network (CGINN) model has been trained and validated, it enters the practical deployment and application phase. At this stage, the generator is removed, and the conditional encoder and discriminator together form the anomaly detection front end, with all network parameters fixed. The entire application phase involves only a single forward inference and numerical computation, without relying on any attack labels or generated samples.

[0096] Step 1: Real-time measurement data acquisition and preprocessing The virtual power plant data acquisition and monitoring control system acquires measurement data from each node in real time. The data acquired at each sampling moment includes the active power injection, reactive power injection, and node voltage amplitude at each node. The system maintains a data set of length [length missing]. The time window forms a real-time data matrix. ,in The total number of nodes. The feature dimensions for each node.

[0097] Using the normalized parameters saved during the training phase , Standardize real-time measurement data:

[0098] in It is a very small constant to prevent division by zero errors.

[0099] Simultaneously, a node adjacency matrix is ​​constructed based on the current network topology of the virtual power plant. (The construction rules are completely consistent with those of the training phase, i.e.) Represents a node and There is a direct electrical connection, and ); based on the hour of the current data collection time and day of the week Construct time feature vectors :

[0100] Step 2: Forward computation of the conditional encoder Adjacency matrix Vectorized and time feature vectors Input the conditional encoder together to calculate the conditional vector. :

[0101] All weight matrices and bias terms These are all parameters that have been fixed and saved during the training phase and will not be updated during the application phase. Conditional vector It encodes the topological structure information and temporal context information at the current moment.

[0102] Step 3: Discriminator's single forward inference Preprocessed real-time data The spatial feature extraction module (graph attention network) and temporal feature extraction module (temporal convolutional network) of the input discriminator extract spatiotemporal features step by step. The extracted features are compared with the conditional vector obtained in step two. In the feature fusion module, the features are concatenated, and the concatenated features are mapped to intermediate layer feature vectors through a shared feature extraction network.

[0103] in This represents all cascaded operations in the discriminator from the input layer to the output layer of the shared feature extraction network, with the output being a feature vector of a fixed dimension.

[0104] This intermediate layer feature It has two uses: Use 1: Directly used for subsequent feature difference score calculation; Application 2: The timing evaluation branch (fully connected layer) of the input discriminator yields the raw timing consistency score:

[0105] in This is the forward computation function for the time series evaluation branch.

[0106] Step 4: Calculate the three-dimensional anomaly score This step is based entirely on the output of step three and the real-time measurement data itself, without relying on any generated samples or reconstruction errors.

[0107] (1) Characteristic difference score

[0108] Calculate real-time intermediate layer features Compared with the mean of normal baseline features saved during the training phase The Euclidean distance between them, and using the baseline standard deviation. Normalize the norm:

[0109] in and The mean and standard deviation vectors are calculated after training is completed, by inputting all normal samples from the training set into the discriminator to extract intermediate layer features. The larger the value, the further the current measurement data deviates from the normal distribution in the discriminator's feature space.

[0110] (2) Temporal consistency score

[0111] The raw scores output by the time-series evaluation branch in step three. Mapped to via the Sigmoid function Interval:

[0112] Because the temporal evaluation branch during the training phase is optimized with a target value of 0 for normal samples and a target value of 1 for fake samples, therefore The closer it is to 1, the less the time-series change pattern of the current measurement data deviates from normal patterns.

[0113] (3) Physical constraint score

[0114] Independent of neural networks, the power balance residual is calculated directly based on real-time measurement data:

[0115] in For nodes Those who have made contributions For nodes The load power, This is a very small constant. This fraction directly quantifies the degree to which the current measurement data violates the physical laws of power balance. Step 5: Weighted fusion to obtain the comprehensive anomaly score The outlier scores from the three dimensions mentioned above are then weighted and linearly fused:

[0116] Among them, the weighting coefficient The scores are determined through optimization on the validation set during the training phase and remain fixed during the application phase. The three scores measure anomalies from three independent perspectives: deviation from feature distribution, anomalies in temporal patterns, and violations of physical laws. They are decoupled and fused to obtain a comprehensive anomaly score.

[0117] Step Six: Dynamic Threshold Determination The system maintains a length of sliding window It stores the comprehensive anomaly score of the time when it was most recently judged as normal.

[0118] Cold start phase: If the number of valid normal samples in the sliding window is insufficient The 95th percentile, pre-calculated and saved during the training phase, was used as the initial detection threshold. :

[0119] in This is the set of comprehensive abnormal scores for all normal samples in the training set.

[0120] Normal operation phase: When the number of normal samples in the sliding window reaches After that, the interquartile range method is used to dynamically calculate the current detection threshold:

[0121] in and These are the lower quartile and upper quartile of the combined abnormal scores of all normal samples within the current sliding window, respectively.

[0122] Real-time determination rules:

[0123] Sliding window update mechanism: If the current time is determined to be normal operation, then the comprehensive anomaly score for that time will be calculated. Add sliding window Remove the oldest data in the window while keeping the window length constant. ; If an attack is detected at the current moment, the score at that moment will not be added to the sliding window to prevent attack samples from contaminating the normal baseline distribution.

[0124] Step 7: Output of Detection Results The system will determine the results and the overall anomaly score. Current dynamic threshold And sub-fractions in three dimensions The data is also output to the alarm and log module of the virtual power plant energy management system for operators' reference and subsequent analysis. Each test, from data acquisition to result output, is completed within a single time window, without relying on historical attack samples, thus meeting real-time requirements.

[0125] Example 3 This embodiment provides a virtual power plant fake data injection attack detection system based on conditional spatiotemporal generative adversarial networks, including a computing unit, a storage device, and a computer program stored on the storage device and executable. The system is characterized in that: when the computing unit executes the computer program, it implements any of the above-mentioned virtual power plant fake data injection attack detection methods based on conditional spatiotemporal generative adversarial networks.

[0126] Example 4: Experimental Results and Analysis To verify the effectiveness of this invention, experiments were conducted on a virtual power plant measurement dataset. The experiments were implemented using the PyTorch deep learning framework. The training run consisted of 100 epochs, with a batch size of 64, and the Adam optimizer was used.

[0127] (1) Evaluation indicators This embodiment uses accuracy, precision, recall, and F1 score as metrics to evaluate model performance.

[0128]

[0129]

[0130]

[0131] Wherein, TP represents the number of samples correctly identified as attacking samples (true positives); TN represents the number of normal samples correctly identified as normal (true negatives); FP represents the number of normal samples misidentified as attacking samples (false positives); and FN represents the number of attacking samples misidentified as normal (false negatives). Precision reflects the overall detection accuracy, exact rate reflects the proportion of samples detected as attacking samples that were actually attacking samples, recall reflects the proportion of actual attacking samples that were correctly detected, and the F1 score is the harmonic mean of precision and recall, comprehensively measuring detection performance.

[0132] (2) Ablation test To verify the effectiveness of each core module in the C-STGAN model, an ablation experiment was designed for analysis. Four variant models were constructed by removing the graph attention network, temporal convolutional network, adversarial training mechanism, and physical loss constraint, respectively. These variant models were trained and tested on the same dataset as the full C-STGAN model. The comparison results of the ablation experiments are shown in Table 1.

[0133] Table 1 Ablation Experiment Results As shown in Table 1, the complete C-STGAN model significantly outperforms all variants on all evaluation metrics, validating the effectiveness of the multi-component collaborative architecture.

[0134] After removing the graph attention network, the recall rate dropped from 0.9812 to 0.5500, a decrease of 43.94%, indicating that spatial feature extraction is crucial for capturing the coupling relationships between nodes and identifying distributed attacks. The graph attention network, by dynamically calculating the attention weights between neighboring nodes, can effectively identify the propagation path of attack signals in the topological space.

[0135] Removing the temporal convolutional network resulted in the most significant decreases in recall and AUC, dropping to 0.5750 and 0.7340, respectively. This indicates that extracting temporal dependent features is crucial for capturing long-range power perturbations and identifying hidden FDIA behavior. Temporal convolutional networks, through causal convolution and dilated convolution, can capture measurement change patterns at different time scales.

[0136] After removing adversarial training, the F1 score and AUC dropped to 0.6783 and 0.7405, respectively, indicating that adversarial training can effectively enhance the model's robustness to hidden perturbations.

[0137] After removing the physical loss constraint, the accuracy and F1 score decreased to 0.7478 and 0.6255, respectively, indicating that the physical prior can effectively suppress noise and reduce false alarms. The physical loss constraint, by introducing physical laws such as power balance, makes the detection results conform to the basic principles of power system operation.

[0138] like Figure 5 As shown, the AUC of the complete C-STGAN model reaches 0.9896, which is the best benchmark. The AUC decreases significantly after removing each core module, with the largest decrease observed after removing the temporal convolution module, which verifies the core supporting role of temporal feature extraction in FDIA detection.

[0139] (3) Comparative experiment To verify the detection performance of the C-STGAN model, three representative deep learning models were selected for comparative experiments: LSTM-AE (Long Short-Term Memory Autoencoder), GCN (Graph Convolutional Network), and the traditional GA model. The results of the comparative experiments are shown in Table 2.

[0140] Table 2 Comparison of experimental results As shown in Table 2, the C-STGAN model proposed in this study significantly outperforms the comparative models such as GAN, LSTM-AE, and GCN in all four core metrics: accuracy, precision, recall, and F1 score. Compared to the suboptimal model LSTM-AE, C-STGAN improves accuracy, precision, recall, and F1 score by 6.46%, 15.96%, 12.29%, and 14.16%, respectively.

[0141] Among the comparative models, LSTM-AE has certain advantages in modeling time-series features, but it does not make full use of power system topology information and physical prior knowledge, resulting in low precision. Although GCN can capture node topology relationships, it is insufficient in extracting time-series dependency features of long-term power disturbances, with a recall rate of only 0.6125. GAN is prone to mode collapse during adversarial training, resulting in low precision and recall.

[0142] like Figure 6 As shown, the C-STGAN model achieved the highest scores across all evaluation metrics, with an accuracy approaching 99% and recall and F1 score both exceeding 96%, indicating its superior attack detection capabilities. C-STGAN effectively compensates for the shortcomings of single models by integrating a multi-module collaborative architecture that combines temporal convolution, graph attention, physical loss constraints, and adversarial training, achieving simultaneous improvements in detection accuracy and robustness.

[0143] like Figure 7 As shown, the C-STGAN model consistently maintains optimal performance across all training epochs. In the early stages of training, C-STGAN's accuracy rises rapidly, demonstrating faster initial convergence and the ability to quickly learn the spatiotemporal characteristics of virtual power plant measurement data. In the middle stages, C-STGAN continues its rapid improvement, reaching 0.96 after 60 epochs, close to its final convergence value. In the later stages, the accuracy of each model gradually stabilizes. C-STGAN significantly outperforms the comparison models in both convergence speed and final accuracy.

[0144] It will be apparent to those skilled in the art that the present invention is not limited to the details of the exemplary embodiments described above, and that the invention can be implemented in other specific forms without departing from its spirit or essential characteristics. Therefore, the embodiments should be considered in all respects as exemplary and non-limiting, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

Claims

1. A method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks, characterized in that, Including the following steps: S100. Obtain the operating status measurement data of each node in the network topology corresponding to the virtual power plant, and perform normalization preprocessing on the operating status measurement data. S200. Construct a conditional spatiotemporal generative adversarial network model, which includes at least a conditional encoder and a discriminator; The condition encoder generates a condition vector based on the node's adjacency matrix vector and time feature vector. S300. After the discriminator extracts spatiotemporal features from the preprocessed running status measurement data, it concatenates the spatiotemporal features with the conditional vector to obtain the intermediate layer feature vector. S400. Calculate and obtain the feature difference score, temporal consistency score and physical constraint score based on the intermediate layer feature vector and the preprocessed running status measurement data, respectively. S500: Obtain a comprehensive anomaly score by weighted fusion of the feature difference score, the temporal consistency score, and the physical constraint score; S600. A dynamic decision threshold is obtained using the interquartile range method based on a sliding window, and the comprehensive anomaly score is compared with the dynamic decision threshold. If the overall anomaly score is greater than the dynamic judgment threshold, it is determined that the measurement data at the current moment contains a false data injection attack. Otherwise, it is determined to be in normal operating condition.

2. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S200, the condition vector for: ; ; in, It is an adjacency matrix. For vectorization operations; This is a time feature vector; , , The weight matrix is ​​a learnable matrix; , , For bias terms; This indicates vector concatenation; For activation functions; This is the conditional vector for the output; The dimension of the conditional vector; The number of hours at the current data collection time. What day of the week is it? 3. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S300, the discriminator includes a cascaded spatial feature extraction module, a temporal feature extraction module, a feature fusion module, a shared feature extraction network, and a temporal evaluation branch; the preprocessed operating state measurement data is sequentially processed by the spatial feature extraction module and the temporal feature extraction module to extract spatiotemporal features, and then input into the feature fusion module. The feature fusion module combines the extracted spatiotemporal features with the conditional vector output by the conditional encoder. The concatenated feature vectors are then mapped to intermediate layer features via a shared feature extraction network, and the temporal evaluation branch is used to output the temporal consistency score. intermediate layer feature vectors Represented as: ; in, This represents all cascaded operations in the discriminator from the input layer to the output layer of the shared feature extraction network.

4. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 3, characterized in that: The spatial feature extraction module employs a graph attention network. For each layer, the graph attention of the input features is independently computed at each time step along the time dimension. ; ; in, For the first The input feature tensor of the layer; For activation functions; For nodes The set of neighboring nodes; For the first Layers, Time Steps Next node With nodes Attention coefficient between them; For the first The feature projection matrix of the layer; The temporal feature extraction module uses temporal convolutional residual blocks to model temporal dependencies: ; ; in, This is the output sequence of the spatial feature extraction module; It is the length of the time window; for Feature dimensions; The kernel size; The current layer's expansion rate; These are the convolution kernel parameters; , All are causal dilated convolutions; BN is batch normalization. This is the activation function.

5. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S400, the feature difference score Temporal consistency score and physical constraint scores They are respectively: ; ; ; ; in, and These are the baseline characteristics of the discriminator: mean and standard deviation. These are the feature vectors of the intermediate layer; It is an L2 norm; To prevent division by zero of extremely small constants; The original score for time-series consistency. For the forward computation function of the time-series evaluation branch; For nodes Those who have made contributions For nodes The load power, It is a very small constant.

6. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S500, the comprehensive anomaly score is: ; in, These are the weighting coefficients, For feature difference scores, For time-series consistency score, The score represents the physical constraint.

7. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S600, the system maintains a length of sliding window Store the comprehensive anomaly score of the most recently judged normal time. Cold start phase: If the number of valid normal samples in the sliding window is insufficient The 95th percentile, pre-calculated and saved during the training phase, was used as the initial detection threshold. : ; in This is the set of comprehensive abnormal scores for all normal samples in the training set. Normal operation phase: When the number of normal samples in the sliding window reaches After that, the interquartile range method is used to dynamically calculate the current detection threshold: ; in and These are the lower quartile and upper quartile of the combined abnormal scores of all normal samples within the current sliding window, respectively.

8. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 1, characterized in that: In step S200, the conditional spatiotemporal generative adversarial network model further includes a generator used only during the training phase. The generator includes an initial projection module, a spatial feature extraction module, a temporal feature extraction module, and an output mapping module. The initial projection module concatenates the random noise vector and the conditional vector generated by the conditional encoder, and then inputs them into the spatial feature extraction module and the temporal feature extraction module to extract the spatial coupling features and temporal evolution features of the measurement data, respectively. The output mapping module generates fake samples. During the training phase, the discriminator is trained using fake samples and real measurement data, and the parameters of the trained discriminator and the conditional encoder are fixed and saved.

9. The method for detecting fake data injection attacks in virtual power plants based on conditional spatiotemporal generative adversarial networks according to claim 8, characterized in that: During the training phase, the output branch of the discriminator further includes an adversarial discrimination branch and a physical evaluation branch, wherein the adversarial discrimination branch and the physical evaluation branch are parallel branches to the temporal evaluation branch; The intermediate layer features output by the shared feature extraction network are input into three parallel output branches: an adversarial discriminant branch to distinguish between real and generated data (this branch only participates in adversarial optimization during training and is deprecated during application); a temporal evaluation branch to learn discriminative features of temporal patterns in measurement data and outputs a temporal consistency score during application; and a physical evaluation branch to learn discriminative features of physical patterns in measurement data (this branch only serves as an auxiliary task to guide the shared network during training and is deprecated during application).

10. A virtual power plant spoofing data injection attack detection system based on conditional spatiotemporal generative adversarial networks, comprising a processing unit, a storage device, and a computer program stored on the storage device and executable thereon, characterized in that: When the computational processing executes the computer program, it implements any one of the virtual power plant fake data injection attack detection methods based on conditional spatiotemporal generative adversarial networks as described in claims 1 to 9.

Images