CN111061152B - Attack recognition method based on deep neural network and intelligent energy power control device - Google Patents
Attack recognition method based on deep neural network and intelligent energy power control device Download PDFInfo
- Publication number
- CN111061152B CN111061152B CN201911341276.5A CN201911341276A CN111061152B CN 111061152 B CN111061152 B CN 111061152B CN 201911341276 A CN201911341276 A CN 201911341276A CN 111061152 B CN111061152 B CN 111061152B
- Authority
- CN
- China
- Prior art keywords
- layer
- module
- neural network
- deep neural
- attack
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- G—PHYSICS
- G05—CONTROLLING; REGULATING
- G05B—CONTROL OR REGULATING SYSTEMS IN GENERAL; FUNCTIONAL ELEMENTS OF SUCH SYSTEMS; MONITORING OR TESTING ARRANGEMENTS FOR SUCH SYSTEMS OR ELEMENTS
- G05B13/00—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion
- G05B13/02—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion electric
- G05B13/04—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion electric involving the use of models or simulators
- G05B13/042—Adaptive control systems, i.e. systems automatically adjusting themselves to have a performance which is optimum according to some preassigned criterion electric involving the use of models or simulators in which a parameter or coefficient is automatically adjusted to optimise the performance
Landscapes
- Engineering & Computer Science (AREA)
- Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Automation & Control Theory (AREA)
- Feedback Control In General (AREA)
Abstract
The invention provides a microgrid attack identification method based on a deep neural network, which comprises the steps of collecting messages transmitted by an intelligent energy power control device; preprocessing the message; inputting the preprocessed message into a deep neural network model for classification to obtain a classification result; performing corresponding processing according to the classification result, wherein the processing comprises performing corresponding alarm prompting according to the attack type to generate alarm information for displaying and generate corresponding log record when the message subjected to the network attack exists in the attack class, and intercepting the message; and when the messages are all normal classes, uploading the messages. The invention also provides an intelligent energy power control device. Compared with the prior art, the safe and reliable operation of the microgrid is ensured.
Description
Technical Field
The invention relates to a power grid system, in particular to an attack identification method based on a deep neural network and an intelligent energy power control device.
Background
With the continuous progress and development of human society, the demand and requirement on energy are continuously increased, and the shortage of energy restricts the development of social economy to a certain extent; the large use of traditional fossil energy by humans has led to a series of environmental problems that have come with them, and these problems have reflected to some extent the drawbacks of traditional power systems. In order to solve the above problems or contradictions, a concept of a microgrid is proposed as a new clean energy source with comprehensive utility of energy such as wind energy, solar energy, and the like. Microgrid: the micro-grid is a small power generation and distribution system consisting of a distributed power supply, an energy storage device, an energy conversion device, a load, a monitoring and protection device and the like.
The microgrid integrates a distributed power generation unit, power electronic equipment, an energy storage device and a load into a whole, can operate in an island mode to independently supply power to the load, and can also be connected with a large power grid to operate in a grid-connected mode to realize bidirectional flow of energy. The development of the microgrid technology reduces the burden of a large power grid, improves the safety and reliability of a power supply system, and is beneficial to flexible application of the power supply system.
The intelligent energy power control device in the microgrid needs to acquire the power of each micro source and load (the load in the microgrid, namely, electric equipment, consumed power, and switch on-off information and power curve of the load) in the microgrid and state information of other intelligent equipment, gives an optimal operation strategy of the microgrid system through comprehensive and intelligent analysis, realizes the coordinated operation of distributed energy in the microgrid, realizes the monitoring of the operation state of each intelligent equipment, and is responsible for information interaction with an upper energy management system and a dispatching center, and is positioned at a control center and an information center in the microgrid. However, at present, the information security management capability of each intelligent device in the microgrid is weak, and the microgrid also has a fault-tolerant function, especially as the microgrid becomes more intelligent and informationized, an information/network attack becomes a normal state, if the attack behaviors cannot be actively detected and identified, the integrity and reliability of information in the microgrid can be endangered, and an attacker can further attack an upper system through the abnormal information or by taking the intelligent energy power control device as a jumper.
Micro-source: the micro-grid is a distributed power generation unit in the micro-grid, such as photovoltaic power generation, wind power generation, micro gas turbine, fuel cell and other power generation equipment.
Disclosure of Invention
The invention aims to provide an attack identification method based on a deep neural network and an intelligent energy power control device, and aims to solve the technical problem of improving the information security and the operation reliability of a microgrid.
In order to solve the problems, the invention adopts the following technical scheme: a microgrid attack identification method based on a deep neural network comprises the following steps:
step one, collecting messages transmitted by an intelligent energy power control device;
step two, preprocessing the message;
inputting the preprocessed message into a deep neural network model for classification to obtain a classification result, wherein the classification includes a normal class and an attack class;
fourthly, according to the classification result, carrying out corresponding processing, wherein the processing comprises carrying out corresponding alarm prompting according to the attack type to generate alarm information for displaying and generate corresponding log record when the message subjected to network attack exists in the attack type, and intercepting the message; and when the messages are all normal classes, uploading the messages.
Further, the fourth step also includes sending alarm information and log records.
Further, the fourth step further includes saving the alarm information and the log record.
Further, before inputting the preprocessed packet into the deep neural network model for attack classification in the third step, model training needs to be performed on the deep neural network model, and the method includes the following steps:
the method comprises the following steps of firstly, collecting positive and negative samples of a message of the intelligent energy power control device as training samples: the positive sample is a normal message which is not attacked, the negative sample is an attacked message which is attacked by a network, and the negative sample comprises an attack sample of Dos attack and false data attack;
second, data preprocessing
Thirdly, training a model;
(1) randomly initializing weights and thresholds in a deep neural network (network) by adopting a uniform distribution function as a probability distribution function;
(2) randomly selecting a sample x from training samples1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l represents the L-th layer, L is 2, …, and L is the total number of the neural network layers;
(4) selecting a log-likelihood loss function, and calculating the error of an output layer by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1The weight of the layer l +1 is adopted, and T represents transposition; deltai,l+1Error corresponding to l +1 layer for ith sample; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight and the threshold value W of the l layerl、bl：
Wherein L is 2, …, and L is the total number of layers of the neural network; alpha is the learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) and outputting W, b to obtain the trained model.
Further, the loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe label value and the actual output of the ith class of the sample are respectively.
The invention also discloses a device for controlling the power of the intelligent energy, which comprises: processing module, power module, clock module, memory, communication module, man-machine interaction module, interchange conversion module, division acquisition module, division control module, attack detection module, wherein:
the processing module is used for connecting, communicating, receiving and sending data and control instructions with the upper layer and the lower layer through the communication module, and sending the data sent by the upper layer to the deep neural network module for real-time detection and classification; meanwhile, the system also receives alarm prompts, log records and classification results sent by the deep neural network module, and sends alarm information generated by the alarm prompts to the man-machine interaction module for display;
the power supply module is used for supplying power to each module;
the clock module is used for providing a reference clock for the processing module and the deep neural network module;
the memory is used for storing;
the communication module is used for data transmission between the processing module and the lower layer and between the processing module and the upper layer;
the human-computer interaction module is used for displaying information;
the alternating current conversion module is used for collecting analog electrical quantities of a public connection point, a micro source, an energy storage system, a load and the like, transmitting the collected analog quantities to the AD conversion module, converting the analog quantities into energy digital quantity data and then transmitting the energy digital quantity data to the deep neural network module;
the open-in acquisition module is used for receiving opening and closing state information data of a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like and sending the opening and closing state information data to the deep neural network;
the output control module is used for controlling the output sent by the processing module to control instruction signals such as a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like;
the deep neural network module is used for carrying out real-time detection, classification and output of classification results on data sent by the open acquisition module, the alternating current acquisition module and the processing module as messages through the deep neural network module, and carrying out corresponding processing according to the classification results; when a message subjected to network attack exists in the attack class, sending an alarm prompt to a processing module according to the attack class, displaying and generating a corresponding log record through a man-machine interaction module after the processing module generates alarm information according to the alarm prompt, and intercepting the message; and when the messages are all normal classes, the messages are sent to the processing module, and the processing module uploads the messages through the communication module.
Furthermore, the processing module also uploads the alarm information and the log record through the communication module and/or stores the alarm information, the log record and the message through a memory.
Further, the deep neural network module performs preprocessing after receiving the message.
Furthermore, the deep neural network module is also used for training the deep neural network model before carrying out real-time detection and classification on the data sent by the open acquisition module, the alternating current acquisition module and the processing module as messages through the deep neural network model; the deep neural network model training comprises the following steps:
(1) a uniform distribution function is adopted as a probability distribution function, and a weight and a threshold value in the deep neural network are initialized randomly;
(2) randomly selecting a sample x from training samples1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l represents the L-th layer, L is 2, …, and L is the total number of the neural network layers;
(4) selecting a log-likelihood loss function, and calculating the error of an output layer by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1The weight of the layer l +1 is adopted, and T represents transposition; deltai,l+1Error corresponding to l +1 layer for ith sample; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight and the threshold value W of the l layerl、bl：
Wherein L is 2, …, and L is the total number of layers of the neural network; alpha is the learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) and outputting W, b to obtain the trained model.
Further, the loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe label value and the actual output of the ith class of the sample are respectively.
Compared with the prior art, the method has the advantages that the messages are detected and classified in real time based on the deep neural network, the abnormal messages which are maliciously attacked in the messages are subjected to attack classification to obtain classification results, and alarm prompts and corresponding log records are generated according to the classification results; and forwarding the normal message which is not attacked by the network in the message, thereby ensuring the safe and reliable operation of the microgrid.
Drawings
Fig. 1 is a block diagram of a photovoltaic power generation system in the related art.
Fig. 2 is a flow chart of the present invention.
FIG. 3 is a schematic diagram of a deep neural network model in the present invention.
FIG. 4 is a diagram of the intelligent energy power control device of the present invention.
Fig. 5 is a schematic diagram of a specific example of the present invention.
Detailed Description
The present invention will be described in further detail with reference to the accompanying drawings and examples.
Fig. 1 is a schematic diagram of a microgrid system. In the figure, the power lines are solid lines, the power flows are solid lines with double arrows, and the communication lines are dashed lines with double arrows; the intelligent energy power control device needs to timely acquire, monitor, analyze and control data of distributed energy such as a fan, photovoltaic and the like, an energy storage system, a load and other intelligent equipment in the system, and a micro-grid comprehensive control strategy issued by an intelligent analysis upper-layer controller realizes real-time control on the micro-grid; besides the data acquisition and intelligent analysis management module, the intelligent energy power control device is internally integrated with functions and algorithms such as grid-connected and off-grid control, secondary voltage regulation and frequency modulation control, island detection and the like. The realization of the functions depends on the performance of the intelligent energy power control device and the real reliability of the acquired data; the intelligent energy power control device sends messages to upper layers (a power distribution network scheduling center and a microgrid integrated monitoring master station) in real time through a communication network, the power distribution network scheduling center (power distribution network scheduling) and the microgrid integrated monitoring master station (microgrid integrated monitoring); the lower layer is a local controller.
The message comprises voltage, current, frequency, active power, reactive power and power factor data of the public connection point; switching-on and switching-off state switching-on information of a public connection point switch, a load switching switch and the like; the control circuit is used for outputting command signals for controlling the on-off of a public connection point switch, a load switching switch and the like; a power distribution curve from an upper controller, and remote adjusting, remote controlling and start-stop commands; and data such as a load power curve, micro-source output power, running state information, environmental weather and the like from the lower layer and other data or factors capable of representing whether the micro-grid coordination controller is attacked or not are acquired from the local controller of the lower layer distributed energy.
The intelligent energy power control device needs to collect information from different devices, respond to requests and instructions of the intelligent devices and coordinate and control stable operation of the intelligent devices in the microgrid, so that the intelligent devices are vulnerable to non-legal requests and false data attacks. If an attacker launches Dos attack to the intelligent energy power control device, the intelligent energy power control device cannot respond to and process other normal and important requests in time; an attacker makes the intelligent energy power control device perform wrong analysis and issues a wrong instruction by tampering the receiving instruction of the intelligent energy power control device or tampering the running state information from the lower-layer controller; meanwhile, the micro-grid comprehensive monitoring master station receives the error value from the intelligent energy power control device and makes correspondingly wrong micro-grid system operation state estimation, so that a system administrator makes wrong decisions and the safe and stable operation of the whole micro-grid system is endangered.
Therefore, the existing intelligent energy power control device has security loopholes. Firstly, a monitoring module of the intelligent energy power control device is limited to monitoring the conditions of tripping and closing conditions of a grid-connected switch, current, voltage, power, frequency out-of-limit and the like, and monitoring the conditions of unreasonable request attack and false credit data attack is not considered; secondly, wisdom energy power control device lacks initiative attack recognition module, can not deal with the rapidity of information attack: when the communication delay is considered, when the abnormal state information of the intelligent energy power control device is uploaded to the microgrid monitoring system, an attacker carries out deeper attack on the intelligent energy power control device or gradually invades an upper-layer system.
As shown in fig. 2, the invention discloses a microgrid attack identification method for a deep neural network, which comprises the following steps:
collecting messages transmitted by an intelligent energy power control device, wherein the messages comprise voltage, current, frequency, active power, reactive power and power factor data of a public connection point; switching-on and switching-off state switching-on information of a public connection point switch, a load switching switch and the like; the control circuit is used for outputting command signals for controlling the on-off of a public connection point switch, a load switching switch and the like; a power distribution curve from an upper controller, and remote adjusting, remote controlling and start-stop commands; load power curves from a lower layer, micro-source output power, running state information, environmental weather and other data, and other data or factors capable of representing whether the intelligent energy power device is attacked or not;
secondly, preprocessing the message, wherein the message acquired from the intelligent energy power control device has a category value variable (a character type variable, such as a protocol type), needs to be processed numerically, and needs to be processed in a normalization mode in order to eliminate the influence of dimensions on model training;
inputting the preprocessed message into a deep neural network model for classification to obtain a classification result, wherein the classification includes a normal class and an attack class, and the attack class includes a Dos attack and a false data attack; the normal class is a normal message which is not attacked by the network;
fourthly, according to the classification result, carrying out corresponding processing, wherein the processing comprises carrying out corresponding alarm prompting according to the attack type to generate alarm information for displaying and generate corresponding log record when the message subjected to network attack exists in the attack type, and intercepting the message; and when the messages are all normal classes, uploading the messages.
And fourthly, uploading alarm information and log records. Therefore, the upper layer can know the operation state of the intelligent energy power control device, correct instructions can be conveniently issued, and the attack is processed when a system administrator receives alarm information (through an indicator lamp or a display interface).
And step four, saving the alarm information and the log record.
The uploading is to the microgrid comprehensive monitoring and distribution network scheduling transmission.
In the third step, before inputting the preprocessed message into the deep neural network model for attack classification, model training needs to be performed on the deep neural network model, and the method includes the following steps:
the method comprises the following steps of firstly, collecting positive and negative samples of a message of the intelligent energy power control device as training samples: the positive sample is a normal message which is not attacked, the negative sample is an attacked message which is attacked by a network, and the negative sample comprises an attack sample of Dos attack and false data attack;
secondly, data preprocessing: carrying out numeralization, normalization and feature extraction on the obtained training sample; obtaining a processed training sample set: { (x)1,y1)，(x2,y2)，…，(xm,ym) And f, wherein x is a sample input vector, y is an output vector of samples, and m is the number of samples.
Thirdly, model training: the training of the deep neural network (model) is mainly based on normal samples and attacked negative samples collected from the intelligent energy power control device, and type label values (expected output values) are marked on the normal samples and the attacked negative samples to perform supervised learning and training, and finally an optimal linear relation matrix W and bias vector b of each hidden layer and output layer are obtained, so that the obtained model can classify the training samples more possibly, and has certain classification capability on data in real-time detection; for this scheme yk1 denotes yes or no sampleBelongs to the kth category, 1 indicates yes, and 0 indicates no. K1, 2.., K, which represents a total of K classes to be classified: normal class, Dos attack, false data attack class; namely, the scheme K is 3; setting a network structure as five layers, namely, the network structure consists of an input layer, three hidden layers and an output layer;
(1) randomly initializing weights and thresholds in a deep neural network (network) by adopting a uniform distribution function as a probability distribution function;
(2) randomly selecting a sample x from training samples (the training samples comprise positive samples and negative samples)1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l denotes the L-th layer, L is 2, …, L (L is the total number of layers of the neural network);
(4) selecting a log likelihood loss function, and calculating the error (or gradient) of an output layer (L-th layer) by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1Is the weight of the l +1 layer,t represents the transposition; deltai,l+1Error corresponding to l +1 layer for ith sample; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight value of the L (L is 2, …, L is the total number of the neural network layers) layer and the threshold value Wl、bl：
Wherein α is a learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) and outputting W, b to obtain the trained model.
The purpose of the model training is to obtain the connection weight between the output nodes of each layer and the threshold value of the node of each layer. The weights and thresholds obtained after training are the best parameters capable of classifying training sample classes as far as possible, and the method has certain prediction capability on similar samples (data detected in real time). Therefore, the purpose of obtaining the weight and the threshold is to classify the real-time data, as long as the real-time data is input, the data is processed by the weight and the threshold of the input layer, the hidden layer and the output layer, the probability that the data belongs to each type is finally output, and finally the type corresponding to the maximum probability is taken as the type of the data.
The loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe i-th class label value (expected output) and the actual output of the sample are shown.
The optimization algorithm used in the model training (4) is a small batch gradient descent method.
When the model is trained, the neuron assigns a weight to each input, and the weight depends on the importance degree of the corresponding input; each layer is configured with a bias term that introduces non-linearity into the output of the neuron. For the technical scheme, because the problem of multi-classification is solved, the output layer activation function adopts a softmax function, so that the output of the output layer is the probability of normal and various attack types, and the sum of output values is ensured to be 1; then, after each sample is input to the network, the probability of the normal attack type and the probability of the various attack types are finally output through the processing of the input layer, the hidden layer and the output layer, for example, after a certain attacked sample (negative sample) is input to the network for processing, the probability of the normal attack type and the Dos attack are finally output, and the probability of the false data attack is respectively: 0.05, 0.03, 0.92; and the desired output of the network is: 0.0, 1, calculating the error between the actual output and the expected output, and if the error meets the requirement (less than or equal to the set error precision of 0.02), then learning the next sample; otherwise, indicating that the weight and the threshold of each layer in the network do not meet the set error requirement, performing back propagation on the error according to the steps in the training process, and updating the weight and the threshold; then, a new round of learning is carried out, and finally, the output probability becomes: 0.01, 0.98; and calculating the error again, and if the error meets the requirement at the moment, outputting the corresponding attack type with the highest probability as the attack type of the sample, namely the sample is the sample attacked by the false data. After all samples are trained, the obtained final weight and threshold are the optimal parameter values of the model capable of classifying the training samples as accurately as possible, and the model has certain prediction capability on similar samples (real-time data).
As shown in fig. 3, the deep neural network is composed of a fully-connected layer, a Dropout layer, and a Softmax layer. The fully connected layer maps the feature representation of the input data to a sample label space; the Dropout layer is used for preventing an overfitting phenomenon which is easy to occur in the training process and improving the detection performance; the Softmax layer is used for classification, and Softmax is a multi-output competitive classification algorithm, each output of which represents a classification type.
As shown in fig. 4, the present invention also discloses an intelligent energy power control device, which includes: processing module (CPU), power module, clock module, memory, communication module, man-machine interaction module, interchange conversion module, division acquisition module, division control module, attack detection module, wherein:
the processing module is connected with the power supply module, the deep neural network module, the communication module, the export control module, the human-computer interaction module and the memory; the processing module is used for connecting, communicating, receiving and sending data and control instructions with the upper layer and the lower layer through the communication module, and sending the data sent by the upper layer to the deep neural network module for real-time detection and classification; the processing module also coordinates and controls the work among all the modules connected with the processing module, namely, the processing module makes a correct decision to the communication module and the control module according to communication and through intelligent management, analysis and judgment; the processing module also receives an alarm prompt, a log record and a classification result sent by the deep neural network module, and sends alarm information generated by the alarm prompt to the man-machine interaction module for display;
the processing module is also used for recording the alarm information and the log, sending the alarm information and the log to the micro-grid comprehensive monitoring master station through the communication module and/or sending the alarm information and the log to the storage for storage, so that the upper-layer controller can know the running state of the intelligent energy power control device and can conveniently issue correct instructions; after receiving the alarm information, a system administrator (through an indicator light or a display interface) firstly needs to do so to deal with the attack;
the message comprises voltage, current, frequency, active power, reactive power and power factor data of the public connection point; switching-on and switching-off state switching-on information of a public connection point switch, a load switching switch and the like; the control circuit is used for outputting command signals for controlling the on-off of a public connection point switch, a load switching switch and the like; a power distribution curve from an upper controller, and remote adjusting, remote controlling and start-stop commands; load power curve from lower layer, micro source output power, running state information, environmental weather and other data or factors capable of representing whether the intelligent energy power control device is attacked;
the log records comprise attack time, attack duration, attack mode, transmission protocol type corresponding to the attack, error data segmentation, starting and ending address information (namely address information of the source equipment and the target equipment) of the error data and the like;
the power supply module is used for supplying power to each module;
the clock module is used for providing a reference clock for the processing module and the deep neural network module;
the memory is used for storing alarm information, log records, messages, control programs, electrical parameter information such as voltage and current of a public connection point, state information such as a public connection point switch, a load switching switch and a breaker switch in the microgrid system, user information and the like;
the communication module is used for data transmission between the processing module and a lower layer (local controller) and an upper layer (micro-grid integrated monitoring master station and power distribution network scheduling), and comprises intelligent equipment such as a micro-source inverter controller and an environmental weather monitoring device in a micro-grid, interactive data between the upper layer micro-grid integrated monitoring master station and a scheduling center, state information from the lower layer intelligent equipment, instruction information of the upper layer micro-grid integrated monitoring master station and the scheduling center, data such as remote signaling, remote measurement and power consumption, commands such as remote control opening and closing, remote regulation and starting and stopping, a power distribution curve from the upper layer controller, a load power curve from the lower layer, micro-source output power, operation state information, environmental weather and the like, and the data are sent to the processing module;
the human-computer interaction module is used for displaying and realizing human-computer interaction and information display, and can be a display screen or an indicator light or the combination of the display screen and the indicator light to display and provide more information so as to realize better human-computer interaction experience;
the alternating current conversion module is connected with the deep neural network module through an AD conversion module (AD), and is used for collecting analog electrical quantities of a public connection point, a micro source, an energy storage system, a load and the like, transmitting the collected analog quantities to the AD conversion module, converting the analog quantities into digital quantity data which can directly participate in calculation, and then transmitting the digital quantity data to the deep neural network module;
the open-in acquisition module is used for receiving opening and closing state information data of a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like and sending the opening and closing state information data to the deep neural network;
the output control module is used for controlling the output sent by the processing module to control instruction signals such as a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like;
the deep neural network module is used for carrying out real-time detection, classification and output of classification results on data sent by the open acquisition module, the alternating current acquisition module and the CPU as messages through the deep neural network module, and carrying out corresponding processing according to the classification results; when a message subjected to network attack exists in the attack class, sending an alarm prompt to a processing module according to the attack class, displaying and generating a corresponding log record through a man-machine interaction module after the processing module generates alarm information according to the alarm prompt, and intercepting the message; and when the messages are all normal classes, the messages are sent to the processing module, and the processing module uploads the messages through the communication module.
The classification comprises a normal class and an attack class, and the attack class comprises a Dos attack and a false data attack; the normal class is a normal message which is not attacked by the network.
The classification is carried out according to the characteristics of different attack types, for example, if the intelligent energy power control device is attacked by false data, the error times of certain type of data sent or received by the intelligent energy power control device and the deviation from normal data are obvious; if the intelligent energy power control device is attacked by Dos, the times of requests and instructions received or sent by the intelligent energy power control device within a certain time are obviously more than the times under normal conditions; the attack detection module, having been trained, recognizes the above features and classifies them as a spurious data attack, a Dos attack, respectively.
The deep neural network module is used for preprocessing after receiving the message, the received message has a category value (or character type) variable and needs to be processed numerically, and the numerically processed message needs to be processed in a normalization mode in order to eliminate the influence of the dimension on model training.
The attack classification comprises a normal class and an attack class, and the attack class comprises a Dos attack and a false data attack; the normal class is a normal message which is not attacked by the network.
The uploading is transmitted to an upper layer (micro-grid integrated monitoring and power distribution network scheduling) through a communication module.
The deep neural network module is also used for training the deep neural network model before carrying out real-time detection and classification on data sent by the open acquisition module, the alternating current acquisition module and the CPU as messages through the deep neural network model.
The training of the deep neural network (model) is mainly based on normal samples and attacked negative samples collected from the intelligent energy power control device, and type label values (expected output values) are marked on the normal samples and the attacked negative samples to perform supervised learning and training, and finally an optimal linear relation matrix W and bias vector b of each hidden layer and output layer are obtained, so that the obtained model can classify the training samples more possibly, and has certain classification capability on data in real-time detection; for this scheme ykWith {0, 1} indicating whether the sample belongs to the kth class, 1 indicating yes, and 0 indicating no. K1, 2.., K, which represents a total of K classes to be classified: is normalClass, Dos attack, false data attack class; namely, the scheme K is 3; setting a network structure as five layers, namely, the network structure consists of an input layer, three hidden layers and an output layer;
the deep neural network model training comprises the following steps: (1) randomly initializing a weight and a threshold in a deep neural network (model) by adopting a uniform distribution function as a probability distribution function;
(2) randomly selecting a sample x from a training sample set (the training sample comprises a positive sample and a negative sample)1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l denotes the L-th layer, L is 2, …, L (L is the total number of layers of the neural network);
(4) selecting a log likelihood loss function, and calculating the error (or gradient) of an output layer (L-th layer) by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1The weight of the layer l +1 is adopted, and T represents transposition; deltai,l+1Corresponds to the ith sampleError of layer l + 1; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight value of the L (L is 2, …, L is the total number of the neural network layers) layer and the threshold value Wl、bl：
Wherein α is a learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) and outputting W, b to obtain the trained model.
The purpose of the model training is to obtain the connection weight between the output nodes of each layer and the threshold value of the node of each layer. The weights and thresholds obtained after training are the best parameters capable of classifying training sample classes as far as possible, and the method has certain prediction capability on similar samples (data detected in real time). Therefore, the purpose of obtaining the weight and the threshold is to classify the real-time data, as long as the real-time data is input, the data is processed by the weight and the threshold of the input layer, the hidden layer and the output layer, the probability that the data belongs to each type is finally output, and finally the type corresponding to the maximum probability is taken as the type of the data.
The loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe i-th class label value (expected output) and the actual output of the sample are shown.
The optimization algorithm used in the model training (4) is a small batch gradient descent method.
When the model is trained, the neuron assigns a weight to each input, and the weight depends on the importance degree of the corresponding input; each layer is configured with a bias term that introduces non-linearity into the output of the neuron. For the technical scheme, because the problem of multi-classification is solved, the output layer activation function adopts a softmax function, so that the output of the output layer is the probability of normal and various attack types, and the sum of output values is ensured to be 1; then, after each sample is input to the network, the probability of the normal attack type and the probability of the various attack types are finally output through the processing of the input layer, the hidden layer and the output layer, for example, after a certain attacked sample (negative sample) is input to the network for processing, the probability of the normal attack type and the Dos attack are finally output, and the probability of the false data attack is respectively: 0.05, 0.03, 0.92; and the desired output of the network is: 0.0, 1, calculating the error between the actual output and the expected output, and if the error meets the requirement (less than or equal to the set error precision of 0.02), then learning the next sample; otherwise, indicating that the weight and the threshold of each layer in the network do not meet the set error requirement, performing back propagation on the error according to the steps in the training process, and updating the weight and the threshold; then, a new round of learning is carried out, and finally, the output probability becomes: 0.01, 0.98; and calculating the error again, and if the error meets the requirement at the moment, outputting the corresponding attack type with the highest probability as the attack type of the sample, namely the sample is the sample attacked by the false data. After all samples are trained, the obtained final weight and threshold are the optimal parameter values of the model capable of classifying the training samples as accurately as possible, and the model has certain prediction capability on similar samples (real-time data).
As shown in fig. 5, assuming that an attacker launches a Dos attack or a spurious data attack on the smart energy power control device, the attack detection module detects a message (e.g., a power instruction message) to identify the Dos attack or the spurious data attack category.
The method comprises the steps of detecting and classifying messages in real time based on a deep neural network, carrying out attack classification on abnormal messages which are maliciously attacked in the messages to obtain classification results, sending alarm prompts according to the classification results and generating corresponding log records; and forwarding the normal message which is not attacked by the network in the message, thereby ensuring the safe and reliable operation of the microgrid.
Claims (8)
1. A microgrid attack identification method based on a deep neural network is characterized in that: the method comprises the following steps:
step one, collecting messages transmitted by an intelligent energy power control device;
step two, preprocessing the message;
inputting the preprocessed message into a deep neural network model for classification to obtain a classification result, wherein the classification includes a normal class and an attack class;
in the third step, before inputting the preprocessed message into the deep neural network model for attack classification, model training needs to be performed on the deep neural network model, and the method includes the following steps:
the method comprises the following steps of firstly, collecting positive and negative samples of a message of the intelligent energy power control device as training samples: the positive sample is a normal message which is not attacked, the negative sample is an attacked message which is attacked by a network, and the negative sample comprises an attack sample of Dos attack and false data attack;
second, data preprocessing
Thirdly, training a model;
(1) a uniform distribution function is adopted as a probability distribution function, and a weight and a threshold value in the deep neural network are initialized randomly;
(2) randomly selecting a sample x from training samples1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l represents the L-th layer, L is 2, …, and L is the total number of the neural network layers;
(4) selecting a log-likelihood loss function, and calculating the error of an output layer by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1The weight of the layer l +1 is adopted, and T represents transposition; deltai,l+1Error corresponding to l +1 layer for ith sample; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight and the threshold value W of the l layerl、bl：
Wherein L is 2, …, and L is the total number of layers of the neural network; alpha is the learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) outputting W, b to obtain trained model;
fourthly, according to the classification result, carrying out corresponding processing, wherein the processing comprises carrying out corresponding alarm prompting according to the attack type to generate alarm information for displaying and generate corresponding log record when the message subjected to network attack exists in the attack type, and intercepting the message; and when the messages are all normal classes, uploading the messages.
2. The method for identifying the microgrid attack based on the deep neural network as claimed in claim 1, wherein the method comprises the following steps: and fourthly, uploading alarm information and log records.
3. The method for identifying the microgrid attack based on the deep neural network as claimed in claim 1, wherein the method comprises the following steps: and step four, saving the alarm information and the log record.
4. The method for identifying the microgrid attack based on the deep neural network as claimed in claim 1, wherein the method comprises the following steps: the loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe label value and the actual output of the ith class of the sample are respectively.
5. An intelligent energy power control device is characterized in that: the method comprises the following steps: processing module, power module, clock module, memory, communication module, man-machine interaction module, interchange conversion module, division acquisition module, division control module, attack detection module, wherein:
the processing module is used for connecting, communicating, receiving and sending data and control instructions with the upper layer and the lower layer through the communication module, and sending the data sent by the upper layer to the deep neural network module for real-time detection and classification; meanwhile, the system also receives alarm prompts, log records and classification results sent by the deep neural network module, and sends alarm information generated by the alarm prompts to the man-machine interaction module for display;
the power supply module is used for supplying power to each module;
the clock module is used for providing a reference clock for the processing module and the deep neural network module;
the memory is used for storing;
the communication module is used for data transmission between the processing module and the lower layer and between the processing module and the upper layer;
the human-computer interaction module is used for displaying information;
the alternating current conversion module is used for collecting analog electrical quantities of a public connection point, a micro source, an energy storage system, a load and the like, transmitting the collected analog quantities to the AD conversion module, converting the analog quantities into energy digital quantity data and then transmitting the energy digital quantity data to the deep neural network module;
the open-in acquisition module is used for receiving opening and closing state information data of a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like and sending the opening and closing state information data to the deep neural network;
the output control module is used for controlling the output sent by the processing module to control instruction signals such as a public connection point switch, a load switching switch in the microgrid, a breaker switch and the like;
the deep neural network module is used for carrying out real-time detection, classification and output of classification results on data sent by the open acquisition module, the alternating current acquisition module and the processing module as messages through the deep neural network module, and carrying out corresponding processing according to the classification results; when a message subjected to network attack exists in the attack class, sending an alarm prompt to a processing module according to the attack class, displaying and generating a corresponding log record through a man-machine interaction module after the processing module generates alarm information according to the alarm prompt, and intercepting the message; when the messages are all normal classes, the messages are sent to a processing module, and the processing module sends the messages to a communication module;
the deep neural network module is also used for training the deep neural network model before carrying out real-time detection and classification on data sent by the open acquisition module, the alternating current acquisition module and the processing module as messages through the deep neural network model; the deep neural network model training comprises the following steps:
(1) a uniform distribution function is adopted as a probability distribution function, and a weight and a threshold value in the deep neural network are initialized randomly;
(2) randomly selecting a sample x from training samples1It is used as the input a of the deep neural networkl；
(3) After the samples are input into the model, the output of each layer is calculated by adopting a forward propagation algorithm:
ai,l＝σ(z)＝σ(Wlai,l-1+bl)；
wherein, Wl、blRespectively is the weight and the threshold of the l layer; z is a linear vector with the output layer inactive; i is the number of training samples, i is 1,2, …, m; l represents the L-th layer, L is 2, …, and L is the total number of the neural network layers;
(4) selecting a log-likelihood loss function, and calculating the error of an output layer by adopting a gradient descent method:
wherein J is a loss function, zLIs a linear vector for which the output layer is inactive; w, b are output layer weight and threshold, respectively; x and y are respectively the input and label values of the sample, and the label value is the classification label in training and is also the expected output value of the sample;
(5) performing a back propagation function calculation:
δi,l＝(Wl+1)Tδi,l+1⊙σ'(zi,l)；
wherein L ═ L-1, …, 2; deltai,lError corresponding to the l layer for the ith sample; wl+1The weight of the layer l +1 is adopted, and T represents transposition; deltai,l+1Error corresponding to l +1 layer for ith sample; an e indicates a Hadamard product, i.e. the product of corresponding elements of the co-dimensional matrix; z is a radical ofi,lAn unactivated linear vector representing the ith sample corresponding to the ith layer; σ' represents an activation function;
(6) updating the weight and the threshold value W of the l layerl、bl：
Wherein L is 2, …, and L is the total number of layers of the neural network; alpha is the learning rate; a isi,l-1The output of the l-1 layer of the ith sample is obtained, m is the number of samples, and T represents the transposition; wl、blRespectively is the weight and the threshold of the l layer; deltai,lError corresponding to the l layer for the ith sample;
(7) judging whether all samples are learned, if not, continuing to learn the next sample, and if so, turning to the step (8);
(8) and outputting W, b to obtain the trained model.
6. The intelligent energy power control device of claim 5, wherein: the processing module also uploads the alarm information and the log record through the communication module and/or stores the alarm information, the log record and the message through a memory.
7. The intelligent energy power control device of claim 5, wherein: and the deep neural network module performs preprocessing after receiving the message.
8. The intelligent energy power control device of claim 5, wherein: the loss function in the step (4) is a log-likelihood loss function:
wherein K is the classification number; y isi、aiThe label value and the actual output of the ith class of the sample are respectively.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911341276.5A CN111061152B (en) | 2019-12-23 | 2019-12-23 | Attack recognition method based on deep neural network and intelligent energy power control device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911341276.5A CN111061152B (en) | 2019-12-23 | 2019-12-23 | Attack recognition method based on deep neural network and intelligent energy power control device |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN111061152A CN111061152A (en) | 2020-04-24 |
| CN111061152B true CN111061152B (en) | 2021-04-27 |
Family
ID=70302619
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911341276.5A Active CN111061152B (en) | 2019-12-23 | 2019-12-23 | Attack recognition method based on deep neural network and intelligent energy power control device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111061152B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111935140B (en) * | 2020-08-10 | 2022-10-28 | 中国工商银行股份有限公司 | Abnormal message identification method and device |
| CN112491854B (en) * | 2020-11-19 | 2022-12-09 | 郑州迪维勒普科技有限公司 | Multi-azimuth security intrusion detection method and system based on FCNN |
Family Cites Families (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2018041150A (en) * | 2016-09-05 | 2018-03-15 | オムロン株式会社 | Model prediction control device, method for controlling model prediction control device, information processing program, and recording medium |
| CN109271926B (en) * | 2018-09-14 | 2021-09-10 | 西安电子科技大学 | Intelligent radiation source identification method based on GRU deep convolutional network |
| CN109922038A (en) * | 2018-12-29 | 2019-06-21 | 中国电力科学研究院有限公司 | A kind of detection method and device of the abnormal data for electric power terminal |
| CN110086776A (en) * | 2019-03-22 | 2019-08-02 | 国网河南省电力公司经济技术研究院 | Intelligent substation Network Intrusion Detection System and detection method based on deep learning |
| CN110489755A (en) * | 2019-08-21 | 2019-11-22 | 广州视源电子科技股份有限公司 | Document creation method and device |
-
2019
- 2019-12-23 CN CN201911341276.5A patent/CN111061152B/en active Active
Also Published As
| Publication number | Publication date |
|---|---|
| CN111061152A (en) | 2020-04-24 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Zhou et al. | A novel transfer learning-based intelligent nonintrusive load-monitoring with limited measurements | |
| CN111131237B (en) | Microgrid attack identification method based on BP neural network and grid-connected interface device | |
| CN102801790B (en) | Microgrid energy management system based on IEC (International Electrotechnical Commission) 61850 and multi-agent method | |
| CN111880044B (en) | Online fault positioning method for distribution network containing distributed power supply | |
| CN111061152B (en) | Attack recognition method based on deep neural network and intelligent energy power control device | |
| CN107153845A (en) | A kind of isolated island detection method of the adaptive grid-connected photovoltaic system based on machine learning | |
| CN111751650B (en) | Non-invasive household electric equipment on-line monitoring system and fault identification method | |
| CN109973331A (en) | A kind of fan blade of wind generating set fault diagnosis algorithm based on bp neural network | |
| CN111144549A (en) | Microgrid attack identification method based on convolutional neural network and microgrid coordination controller | |
| CN115169719A (en) | Platform area state prediction model based on fuzzy clustering and BP neural network | |
| CN111144472A (en) | Attack identification method based on GBDT algorithm and photovoltaic grid-connected interface device | |
| CN115827579A (en) | Distributed energy storage informatization control and operation platform architecture | |
| CN115469184A (en) | New energy transmission line fault identification method based on convolutional network | |
| CN115204698A (en) | Real-time analysis method for power supply stability of low-voltage transformer area | |
| CN113379005B (en) | Intelligent energy management system and method for power grid power equipment | |
| Gurbuz et al. | Comprehensive non-intrusive load monitoring process: Device event detection, device feature extraction and device identification using KNN, random forest and decision tree | |
| CN113708350B (en) | Cloud edge cooperation-based power distribution area heavy overload abnormality judgment method and system | |
| CN110930051A (en) | Big data analysis-based resident demand response potential analysis system and method | |
| CN114430165A (en) | Micro-grid group intelligent coordination control method and device based on depth model prediction | |
| CN112036718B (en) | Electric power system safety risk assessment method considering new energy uncertainty | |
| CN111160386B (en) | Data-driven power island detection method based on active reactive power disturbance | |
| CN117674421A (en) | Digital twin power grid data transmission system | |
| CN112821456B (en) | Distributed source-storage-load matching method and device based on transfer learning | |
| CN111127251A (en) | Attack identification method based on LSTM neural network and grid-connected interface device | |
| Li et al. | Residential Photovoltaic Power Forecasting Considering Division of Weather Type Index Interval |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |