A network security intrusion detection method and system for micro-grid island operation

Abstract

The application belongs to the field of micro-grid safety monitoring, and discloses a network security intrusion detection method and system for micro-grid island operation, which collects electrical operation data, control instruction data, communication traffic data and terminal state data in the process of micro-grid island operation, and combines topological structure, communication link relationship and control instruction flow information, and after time synchronization, protocol analysis, instruction semantic coding and other pretreatments, constructs fusion detection characteristics based on electrical operation constraints, island control constraints and multi-source measurement consistency, and then outputs intrusion probability, attack type and detection confidence through an intrusion detection model, finally locates suspected attack sources and impact range and generates detection results. The application can solve the technical problem that the prior art lacks deep fusion of electrical operation constraints and information-physical coupling characteristics in the micro-grid island operation scenario.

Description

Technical Field

[0001] This application belongs to the field of microgrid security monitoring, specifically relating to a network security intrusion detection method and system for isolated operation of microgrids. Background Technology

[0002] Microgrids, as local power systems integrating distributed power sources, energy storage systems, and loads, can switch to islanded operation mode in scenarios such as main grid failures, external disturbances, or emergency power supply, maintaining the continuity and stability of local power supply through internal resource coordination. In islanded operation, microgrid systems have small capacity, low inertia, and limited regulation resources; their safe and stable operation highly depends on the accuracy of measurement data, the reliability of control commands, and the trustworthiness of communication links. In the field of network security, existing intrusion detection technologies are mainly aimed at general information networks and traditional industrial control networks, generally employing methods based on feature matching, statistical anomaly detection, or behavioral analysis. These methods identify potential network attacks and security threats by monitoring and analyzing network communication traffic, protocol messages, and access behavior. In power system security protection, some solutions have already applied intrusion detection technology to power monitoring communication networks, achieving security monitoring of power communication networks by analyzing communication traffic characteristics, detecting abnormal protocol behavior, and identifying unauthorized access.

[0003] However, existing intrusion detection technologies primarily focus on statistical analysis of communication traffic and access behavior in general information networks or traditional industrial control networks, lacking a deep integration of electrical operating constraints and cyber-physical coupling characteristics in microgrid islanded operation scenarios. During microgrid islanded operation, attackers can interfere with energy storage control, load shedding, distributed power generation output regulation, and grid connection recovery processes through methods such as spoofed data injection, abnormal control commands, communication replay, unauthorized access, denial of service, or malicious parameter tampering, leading to serious consequences such as frequency and voltage violations, critical load loss, or grid connection impact. Existing intrusion detection methods struggle to effectively identify such cyber-physical fusion attacks that combine electrical constraint violations and control semantic anomalies, and lack the ability to accurately identify attack types, locate attack sources, and generate interpretable detection evidence, resulting in significant deficiencies in network security protection under microgrid islanded operation scenarios. Summary of the Invention

[0004] This application addresses the technical problem of the lack of deep integration between electrical operation constraints and cyber-physical coupling characteristics in microgrid islanded operation scenarios in existing technologies, and provides a network security intrusion detection method and system for microgrid islanded operation.

[0005] To achieve the above objectives, this application adopts the following technical solution: Firstly, a network security intrusion detection method for isolated microgrid operations includes: Collect data during the islanded operation of the microgrid to obtain the microgrid's topology, communication link relationships, and control command flow information; The data during the islanded operation of the microgrid is subjected to time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking to obtain the processed data. Based on the processed data, and in conjunction with electrical operation constraints, islanded control constraints, and multi-source measurement consistency, a fusion detection feature is constructed. The fused detection features are input into the intrusion detection model, which outputs the intrusion probability, attack type, and detection confidence. Based on the attack type, and in conjunction with the topology information, communication link relationship information, and control command flow information, the suspected attack source and scope of impact are located. Based on the suspected attack source and the scope of impact, and combined with the intrusion probability and detection confidence, the intrusion detection result is obtained.

[0006] In some implementations, the microgrid islanding operation process includes: an islanding switching phase, an islanding self-consistent operation phase, or a grid-connected recovery phase.

[0007] In some implementations, the fused detection features include: electrical residual features, control semantic features, communication behavior features, terminal status features, islanded operation constraint features, and topology association features.

[0008] In some implementations, the electrical residual feature is constructed by comparing the electrical measurement values ​​in the processed data with the expected values ​​obtained based on the electrical operation constraint model, calculating the residual, and using the residual as the electrical residual feature.

[0009] The intrusion detection model is a multi-class deep neural network, which includes an input layer, a fully connected hidden layer, and a first branch and a second branch connected in sequence.

[0010] In some implementations, the attack types include at least one of: fake data injection, abnormal control commands, communication replay, unauthorized access, denial of service, and malicious network connection commands.

[0011] In some implementations, the intrusion detection results include: risk level, suspected attack terminal, affected device, evidence summary, and alarm information.

[0012] Secondly, a network security intrusion detection system for isolated microgrid operations includes: The data acquisition and acquisition module is used to collect data during the islanded operation of the microgrid, and to obtain the microgrid's topology information, communication link relationship information, and control command flow information. The data preprocessing module is used to perform time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking on the data during the islanded operation of the microgrid to obtain the processed data; The feature fusion construction module is used to construct fused detection features based on the processed data and in combination with electrical operation constraints, islanded control constraints, and multi-source measurement consistency. The intrusion detection module is used to input the fused detection features into the intrusion detection model and output the intrusion probability, attack type, and detection confidence. The attack source location module is used to locate the suspected attack source and the scope of influence based on the attack type, combined with the topology information, communication link relationship information and control command flow information. The detection result generation module is used to obtain intrusion detection results based on the suspected attack source and the scope of influence, combined with the intrusion probability and detection confidence.

[0013] Thirdly, a computer device includes: a processor and a computer-readable storage medium; A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements a network security intrusion detection method for islanded operation of a microgrid as described above.

[0014] Fourthly, a computer-readable storage medium storing a computer program adapted to be loaded by a processor and executed as described in the network security intrusion detection method for microgrid islanded operation.

[0015] Fifthly, a computer program product comprising a computer program, which, when executed by a processor, implements the network security intrusion detection method for isolated operation of a microgrid as described above.

[0016] Compared with the prior art, this application has the following beneficial effects: This application effectively eliminates timing and format conflicts of multi-source heterogeneous data by preprocessing multi-dimensional data during microgrid islanded operation through time synchronization and semantic encoding. It breaks through the limitations of traditional network security, which is confined to the information communication layer, by deeply integrating the physical operation mechanism—electrical operation constraints, islanded control constraints, and multi-source measurement consistency—into the feature construction process. This enables it to keenly capture and accurately identify cyber-physical fusion attacks disguised as normal communication but fundamentally violating underlying physical laws. Based on this, it not only quantifies the threat level using the multi-dimensional output indicators of the detection model—intrusion probability, attack type, and confidence level—but also further links the three-dimensional network relationships of topology, communication links, and control command flow for joint inference and analysis. This achieves a leap from simple surface-level alarms to accurately pinpointing suspected attack sources and delineating the affected area. Ultimately, it provides a security protection closed loop for microgrids during the vulnerable islanded autonomous period, combining high judgment accuracy and strong interpretability, significantly improving the emergency response efficiency and proactive defense capabilities of the power grid system. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 A flowchart of a network security intrusion detection method for isolated operation of microgrids provided in this application embodiment; Figure 2 This application provides a structural diagram of a network security intrusion detection system for isolated operation of microgrids. Figure 3 A structural diagram of a computer device provided for an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0020] In one embodiment of this application, such as Figure 1 As shown, a network security intrusion detection method for isolated operation of microgrids is provided, including: S1 collects data during the islanded operation of the microgrid, and obtains the microgrid's topology information, communication link relationship information, and control command flow information; Specifically, this also includes identifying the microgrid's operational phase. Based on the grid connection switch status, main grid status, protection actions, and microgrid control mode, it is determined whether the current phase is islanding switching, islanded autonomous operation, or grid restoration.

[0021] Data generated during the islanded operation of a microgrid includes: electrical operation data, control command data, communication traffic data, and terminal status data.

[0022] S2, perform time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking on the data during the islanded operation of the microgrid to obtain the processed data; S3. Based on the processed data, and in conjunction with electrical operation constraints, islanded control constraints, and multi-source measurement consistency, construct fused detection features; The three types of constraints take the following forms: Electrical operation constraints are a set of threshold inequality equations for voltage, frequency, power, distributed power sources, and energy storage output, which limit the safe operating range of islanded electrical systems; Island control constraints are the control logic rules for each stage of island switching, autonomy, and grid restoration, which specify the types of instructions, adjustment amplitudes, and execution sequences that are allowed to be issued; Multi-source measurement consistency is a verification relationship such as power balance and measurement matching at both ends of a branch, used to determine whether the data from the same source and related measurement points are self-consistent.

[0023] The feature construction process consists of four steps: First, basic time-series indicators are extracted from the preprocessed structured data of electrical, control, communication, and terminal systems. Then, residuals, violation markers, and measurement deviations are calculated by comparing them with the three types of constraints to generate electrical residual and island constraint verification sub-features. Communication behavior, terminal status, and topology association features are supplemented by combining microgrid topology, communication links, and command flow. Finally, all sub-features are normalized and spliced ​​and fused according to time-series windows to obtain standardized fused detection features.

[0024] S4, input the fused detection features into the intrusion detection model, and output the intrusion probability, attack type and detection confidence; This step uses a multi-class deep neural network as the intrusion detection model. The model input is a one-dimensional vector of fused detection features normalized under a single temporal window. The network structure consists of an input layer, multiple fully connected hidden layers, a Dropout regularization layer, and two independent output branches. The first branch is activated by a Sigmoid function and outputs the global intrusion probability, with a value range of [0,1], representing the overall probability of network intrusion in the current window. The second branch is connected to a Softmax activation layer and outputs the original classification probability distribution corresponding to various preset attacks. This original distribution is post-processed to obtain the attack type and detection confidence.

[0025] The intrusion probability is directly output by the first branch of the model; the category corresponding to the maximum probability value of the Softmax output is taken as the attack type. This maximum probability value is used as the detection confidence after being filtered by a threshold. The attack type and confidence are not directly output by the network. They are obtained after post-processing by comparing and filtering the probability distribution output by the classification branch.

[0026] S5. Based on the attack type, and in conjunction with the topology information, communication link relationship information, and control command flow information, locate the suspected attack source and the scope of impact. First, the corresponding tracing rules are matched according to the identified attack type. Then, the message sending terminal, command issuing node, and abnormal traffic access point are identified by combining the communication link message logs to initially screen candidate attack terminals. Next, the command transmission path and permission issuing level are traced based on the control command flow information. The distributed power sources, energy storage, loads, and communication relay equipment connected to the candidate terminals are traversed in combination with the microgrid topology. Finally, the source device and the affected device are distinguished. The terminal that initiates abnormal messages and illegal commands is marked as a suspected attack source. All devices with topological connectivity, link interconnection, and command reachability are defined as the attack impact range.

[0027] S6. Based on the suspected attack source and its impact range, and combined with the intrusion probability and detection confidence, the intrusion detection result is obtained. The intrusion detection result includes: attack type, suspected attack terminal, affected devices, evidence summary, and alarm information.

[0028] Table 1 below shows the correspondence between attack types and detection criteria: Table 1. Correspondence between attack types and detection criteria Attack type Typical manifestations Testing basis Output Fake data injection The measured values ​​are inconsistent with the actual operating conditions. Electrical residuals and multi-source consistency anomalies Abnormal measurement points and suspected terminals Abnormal control instructions Illegal load shedding or abnormal energy storage regulation Instruction semantics conflict with island constraints Abnormal commands and their sources Communication replay Old messages appear repeatedly Timestamp and serial number errors Abnormal communication link Denial of Service A sudden increase in communication delay or packet loss rate Traffic spikes and link unavailability Affected terminals Malicious grid connection command Grid connection is triggered even if synchronization conditions are not met. Grid connection constraints and permission verification failed. Preventing grid connection alarms In one embodiment of this application, such as Figure 2 As shown, a network security intrusion detection system for isolated microgrid operation is provided, comprising: The data acquisition and acquisition module is used to collect data during the islanded operation of the microgrid, and to obtain the microgrid's topology information, communication link relationship information, and control command flow information. The data preprocessing module is used to perform time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking on the data during the islanded operation of the microgrid to obtain the processed data; The feature fusion construction module is used to construct fused detection features based on the processed data and in combination with electrical operation constraints, islanded control constraints, and multi-source measurement consistency. The intrusion detection module is used to input the fused detection features into the intrusion detection model and output the intrusion probability, attack type, and detection confidence. The attack source location module is used to locate the suspected attack source and the scope of influence based on the attack type, combined with the topology information, communication link relationship information and control command flow information. The detection result generation module is used to obtain intrusion detection results based on the suspected attack source and the scope of influence, combined with the intrusion probability and detection confidence.

[0029] Specific limitations regarding a network security intrusion detection system for microgrid islanded operation can be found in the limitations of a network security intrusion detection method for microgrid islanded operation described above; the corresponding technical effects are equivalent and will not be repeated here. Each module in the aforementioned network security intrusion detection system for microgrid islanded operation can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the corresponding operations of each module.

[0030] Figure 3 An internal structural diagram of a computer device is shown in one embodiment. This computer device may specifically be a terminal or a server. Figure 3 As shown, the computer device includes a processor, memory, network interface, display, camera, and input device connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external terminals via a network connection. When the computer program is executed by the processor, it implements a network security intrusion detection method for microgrid islanded operation. The display screen can be an LCD screen or an e-ink display screen. The input device can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device casing, or an external keyboard, touchpad, or mouse.

[0031] As will be understood by those skilled in the art, computer equipment Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present invention and does not constitute a limitation on the computer device to which the present invention is applied. A specific computing device may include more or fewer components than those shown in the figure, or combine certain components, or have the same component arrangement.

[0032] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the method described above.

[0033] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0034] In summary, the network security intrusion detection method, system, computer equipment, and storage medium provided in this application embodiment for microgrid islanded operation collect electrical operation data, control command data, communication traffic data, and terminal status data during microgrid islanded operation. These data are then combined with electrical operation constraints, islanded control constraints, and multi-source measurement consistency to construct standardized fusion detection features. A deep neural network model with a dual-branch structure is used for analysis, which not only outputs the global intrusion probability but also accurately determines the attack type and provides detection confidence. Furthermore, by combining topology, communication links, and control command flow, the attack source is accurately located and its impact range is defined. This solution deeply integrates the cyber-physical coupling characteristics and electrical operation constraints in the microgrid islanded scenario, effectively identifying complex network attacks such as fake data injection and abnormal control commands. It provides intrusion detection results including evidence summaries and alarm information, significantly improving the security monitoring accuracy and emergency response efficiency under microgrid islanded operation.

[0035] The various embodiments in this specification are described in a progressive manner. For directly identical or similar parts of the embodiments, refer to each other. Each embodiment focuses on its differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments. It should be noted that the technical features of the above embodiments can be combined arbitrarily. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as the combination of these technical features does not contradict each other, it should be considered within the scope of this specification.

[0036] The above-described embodiments are merely preferred embodiments of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the invention. It should be noted that those skilled in the art can make various improvements and substitutions without departing from the principles of the present invention, and these improvements and substitutions should also be considered within the scope of protection of the present invention. Therefore, the scope of protection of this invention should be determined by the scope of the claims.

Claims

1. A network security intrusion detection method for isolated operation of microgrids, characterized in that, include: Collect data during the islanded operation of the microgrid to obtain the microgrid's topology, communication link relationships, and control command flow information; The data during the islanded operation of the microgrid is subjected to time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking to obtain the processed data. Based on the processed data, and in conjunction with electrical operation constraints, islanded control constraints, and multi-source measurement consistency, a fusion detection feature is constructed. The fused detection features are input into the intrusion detection model, which outputs the intrusion probability, attack type, and detection confidence. Based on the attack type, and in conjunction with the topology information, communication link relationship information, and control command flow information, the suspected attack source and scope of impact are located. Based on the suspected attack source and the scope of impact, and combined with the intrusion probability and detection confidence, the intrusion detection result is obtained.

2. The network security intrusion detection method for islanded operation of microgrids according to claim 1, characterized in that, The microgrid islanding operation process includes: islanding switching phase, islanding self-consistent operation phase, or grid connection recovery phase.

3. The network security intrusion detection method for islanded operation of microgrids according to claim 1, characterized in that, The fusion detection features include: electrical residual features, control semantic features, communication behavior features, terminal status features, islanded operation constraint features, and topology association features.

4. The network security intrusion detection method for islanded operation of microgrids according to claim 1, characterized in that, The intrusion detection model is a multi-class deep neural network, which includes an input layer, a fully connected hidden layer, and a first branch and a second branch connected in sequence.

5. A network security intrusion detection method for islanded operation of microgrids according to claim 1, characterized in that, The attack types include at least one of the following: fake data injection, abnormal control commands, communication replay, unauthorized access, denial of service, and malicious network connection commands.

6. A network security intrusion detection method for islanded operation of microgrids according to claim 1, characterized in that, The intrusion detection results include: risk level, suspected attack terminals, affected devices, evidence summary, and alarm information.

7. A network security intrusion detection system for isolated operation of microgrids, characterized in that, include: The data acquisition and acquisition module is used to collect data during the islanded operation of the microgrid, and to obtain the microgrid's topology information, communication link relationship information, and control command flow information. The data preprocessing module is used to perform time synchronization, protocol parsing, instruction semantic encoding, windowing processing, and outlier marking on the data during the islanded operation of the microgrid to obtain the processed data; The feature fusion construction module is used to construct fused detection features based on the processed data and in combination with electrical operation constraints, islanded control constraints, and multi-source measurement consistency. The intrusion detection module is used to input the fused detection features into the intrusion detection model and output the intrusion probability, attack type, and detection confidence. The attack source location module is used to locate the suspected attack source and the scope of influence based on the attack type, combined with the topology information, communication link relationship information and control command flow information. The detection result generation module is used to obtain intrusion detection results based on the suspected attack source and the scope of influence, combined with the intrusion probability and detection confidence.

8. A computer device, characterized in that, include: Processor and computer-readable storage media; A processor, adapted to execute computer programs; A computer-readable storage medium storing a computer program, which, when executed by the processor, implements a network security intrusion detection method for microgrid islanded operation as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program adapted to be loaded by a processor and executed as described in any one of claims 1 to 6, a network security intrusion detection method for islanded operation of a microgrid.

10. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements a network security intrusion detection method for microgrid islanded operation as described in any one of claims 1 to 6.

Images