CN110855683B - Method for carrying out attack detection and reconstruction on electric power information physical system - Google Patents
Method for carrying out attack detection and reconstruction on electric power information physical system Download PDFInfo
- Publication number
- CN110855683B CN110855683B CN201911126969.2A CN201911126969A CN110855683B CN 110855683 B CN110855683 B CN 110855683B CN 201911126969 A CN201911126969 A CN 201911126969A CN 110855683 B CN110855683 B CN 110855683B
- Authority
- CN
- China
- Prior art keywords
- physical system
- power information
- attack
- information physical
- signal
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/145—Network analysis or design involving simulating, designing, planning or modelling of a network
Abstract
The invention relates to a method for carrying out attack detection and reconstruction on a power information physical system. The invention designs a method for carrying out attack detection on a power information physical system by combining a sliding-mode observer and a self-adaptive method, which widens the attack condition from the existing function boundary to part of the known upper boundary functions and estimates the unknown upper boundary value by the self-adaptive method; for some attacks which can not realize attack detection by comparing the residual signal with the threshold value, in order to ensure the accuracy of the attack detection, the method utilizes the residual signal to converge to zero to reconstruct the attack signal, and carries out attack judgment on the reconstructed attack signal according to attack detection logic; the method is also popularized to the condition that the power information physical system is attacked by the sensor, and the detection and reconstruction of the power information physical system attacked by the sensor are realized; the invention takes the example that the physical system of the power information containing three motors and six buses is attacked to carry out attack detection and reconstruction.
Description
Technical Field
The invention relates to the field of information security of power information physical systems, in particular to a method for carrying out attack detection and reconstruction on a power information physical system.
Background
With the increase of the node scale of the power information physical system, the diversification of the communication mode and the improvement of the automation control level, the technical means for attacking the power terminal equipment are continuously increased, the attack of the power information physical system can be timely detected, the important effect on improving the performance of the power information physical system is played, the damage of the system can be reduced, and the brought negative effects can be reduced to the maximum extent. On the basis of deeply analyzing the relatively undetectable attack and the absolutely undetectable attack, the conditions that the absolutely undetectable attack is zero and the relatively undetectable attack is a stable signal are obtained, and then the conditions of attack signal reconstruction and detection are established according to a vector decomposition method, namely, the state attack and the sensor attack exist respectively.
The existing attack detection method only injects malicious data attack aiming at single synchronous phase angle measurement, for example, the Chinese patent application No. 201510062192.3, because the attack of hackers on the power information system is arbitrary, it is not known which channel is attacked, nor is it known which channels are attacked at the same time, therefore, when the problem of attack detection is researched, it is not appropriate to select a single channel. In the prior art, no literature report and practical application related to a method for detecting and reconstructing the attack of the power information physical system, which has good stability, high accuracy and high response speed, are available so far.
Disclosure of Invention
The invention aims to overcome the defects of the prior art and provides a method for carrying out attack detection and reconstruction on a power information physical system, which has the advantages of good stability, high accuracy and high response speed.
The technical scheme adopted for realizing the aim of the invention is as follows: 1. a method for carrying out attack detection and reconstruction on a power information physical system is characterized by comprising the following contents:
1) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a state:
y(t)＝Cx(t)+Duu(t) (1)
wherein x (t) is a state signal when the power information physical system is under state attack, y (t) is an output signal when the power information physical system is under state attack, u (t) is a controlled input signal of the power information physical system,
is the differentiation of the state signal when the power information physical system is attacked by the state, Bηηx(t) is a status attack signal of the Power information physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
2) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a sensor:
y′(t)＝Cx′(t)+Duu(t)+Dηηs(t) (2)
wherein x '(t) is a state signal when the electrical information physical system is attacked by the sensor, y' (t) is an output signal when the electrical information physical system is attacked by the sensor, u (t) is a controlled input signal of the electrical information physical system,
is the differentiation of the state signal when the electrical power information physical system is attacked by a sensor, Dηηs(t) is the sensor attack signal of the Power cyber-physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
3) the method comprises the following steps of establishing a mathematical model of the adaptive sliding mode observer when a power information physical system containing three motors and six buses is attacked by states:
wherein
Is the state signal of the adaptive sliding mode observer when a state attack is encountered,
is the output signal of the adaptive sliding mode observer under a state attack, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer,
is the differential of the state signal of the adaptive sliding mode observer when the state attack is received, u (t) is the controlled input signal of the electric power information physical system, y (t) is the output signal of the electric power information physical system when the state attack is received, B (t)ηIs a selection matrix of a state attack signal of the power information physical system, L is a gain matrix of an adaptive sliding mode observer when the state attack is received, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
4) when a mathematical model of the adaptive sliding mode observer is established when an electric power information physical system containing three motors and six buses is attacked by a sensor, according to an attack detection scheme of the electric power information physical system:
introducing a low-pass filter into an output signal y' (t) when the electric power information physical system is attacked by a sensor:
wherein
Is the output signal of the low-pass filter, x'f(t) is the integration of the output signal of the low-pass filter, the integration constant is 0, y' (t) is the output signal when the power information physical system is attacked by the sensor, As，BsIs a designed Huvitz matrix, having:
in the formula Dηηs(t) is the sensor attack signal of the Power cyber-physical System, C, DuIs a system parameter with proper dimension in the electric power information physical system, u (t) is a controlled input signal of the electric power information physical system;
defining: v (t) ═ x' (t)T,x′f(t)T]T,y″(t)＝x′f(t), a mathematical model of the electric power information physical system comprising three motors and six buses under the attack of a sensor after the electric power information physical system is introduced into a low-pass filter is described as follows:
y″(t)＝C′v(t) (6)
wherein v (t) is a state signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, y' (t) is an output signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, u (t) is a controlled input signal of the electric power information physical system,
is the differential, D ', of the state signal when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced'ηηs(t) is a sensor attack signal of the physical system of the electric power information after the introduction of the low-pass filter, A ', B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
the method comprises the following steps of establishing a mathematical model of the self-adaptive sliding mode observer when an electric power information physical system containing three motors and six buses is attacked by a sensor after being introduced into a low-pass filter:
wherein
Is a state signal of the adaptive sliding mode observer when the electric power information physical system is attacked by a sensor after the low-pass filter is introduced,
is the output signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after a low-pass filter is introduced into the adaptive sliding mode observer,
is the derivative of the state signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, u (t) is the controlled input signal of the electric power information physical system, y '(t) is the output signal when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, D'ηIs a selection matrix of a sensor attack signal of a power information physical system after introducing a low-pass filter, G is a gain matrix of an adaptive sliding mode observer when the sensor is attacked, A 'and B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
5) the output signal y (t) of the power information physical system under the condition attack and the output signal of the adaptive sliding mode observer under the condition attack are utilized
Residual signal generated in the process of reconstructing the state attack signal and converging to zeroThe output signal y' (t) of the electric power information physical system under the sensor attack after the low-pass filter is introduced and the output signal of the adaptive sliding mode observer when the electric power information physical system under the sensor attack after the low-pass filter is introduced are utilized
Residual signals generated in the process of reconstructing the sensor attack signals are converged to zero:
when the electric power information physical system is attacked by the state:
Bηηx(t)-Bηvx(t)＝0 (8)
in the formula Bηηx(t) is a status attack signal of the Power information physical System, BηIs a selection matrix of state attack signals of the power information physical system, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer;
defining:
the constant K is greater than 0, and the reconstruction v can be achieved byx(t)：
ρxIs that
With an integration constant of 0, vx(t) is a reconstructed signal of a state attack of the adaptive sliding mode observer, wherein
Fx＝Bη TPCT(CCT)-1，BηIs a selection matrix of state attack signals in the power information physical system, P is a matrix which is larger than 0 and meets the system requirements, C is a matrix with proper dimensionality in the power information physical systemThe system parameters of (1);
to reduce jitter, the signal vx(t) is modified to:
where δ is guaranteed to be sufficiently small;
when the electric power information physical system is attacked by the sensor:
D′ηηs(t)-D′ηvs(t)＝0 (11)
d 'in the formula'ηηs(t) is a sensor attack signal of the physical system of the power information after introduction of the low-pass filter, D'ηIs a selection matrix of sensor attack signals of a power information physical system after introducing a low-pass filter, vs(t) a reconstructed signal of the electric power information physical system sensor attack after a low-pass filter is introduced into the adaptive sliding mode observer;
defining:
the constant M is greater than 0, and the reconstruction v can be achieved bys(t)：
ρsIs that
With an integration constant of 0, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after introducing a low-pass filter in the adaptive sliding mode observer, wherein
Fs＝D′η TQC′T(C′C′T)-1，D′ηIs the electric power introduced after the low-pass filterThe method comprises the following steps that a selection matrix of sensor attack signals of the cyber-physical system is provided, Q is a matrix which is larger than 0 and meets system requirements, and C' is a system parameter with proper dimensionality in the cyber-physical system after a low-pass filter is introduced;
to reduce jitter, the signal vs(t) is modified to:
where δ is guaranteed to be sufficiently small;
6) setting an attack detection logic of the power information physical system:
firstly, reconstructing state attack signal v of power information physical system by using residual signalxiDesigning a state attack detection logic:
Wherein v isxiIs a reconstructed state attack signal, Th, of a power information physical systemxiIs an attack threshold value given by the reconstruction state attack of the power information physical system, | vxi| represents an absolute value of a reconfiguration state attack signal of the power information physical system, FlagiAn alarm signal indicating a state attack of the electrical information physical system;
secondly, reconstructing sensor attack signal v of electric power information physical system by using residual signalsiDesigning a sensor attack detection logic:
Wherein v issiIs a reconstructed sensor attack signal, Th, of a power information physical systemsiIs an attack threshold value given by the attack of a reconstruction sensor of a power information physical system, | vsiI represents the absolute value of the reconstructed sensor attack signal of the power information physical system, FlagiAn alarm signal indicative of a sensor attack of the electrical cyber-physical system.
The invention discloses a method for carrying out attack detection and reconstruction on an electric power information physical system, which designs a method for carrying out attack detection on the electric power information physical system by combining a sliding-mode observer and a self-adaptive method, widens the attack condition from the existing function boundary into part of upper boundary functions, and estimates an unknown upper boundary value by the self-adaptive method; for some attacks which can not realize attack detection by comparing a residual signal with a threshold value, in order to ensure the accuracy of the attack detection, the method utilizes the residual signal to converge to zero for attack signal reconstruction, not only can accurately obtain a reconstructed signal of the power information physical system attack, but also can detect the attack signal exceeding a certain threshold value, and carries out attack judgment on the reconstructed attack signal according to attack detection logic; the method is also popularized to the condition that the power information physical system is attacked by the sensor, and a corresponding self-adaptive sliding mode observer and an attack signal reconstruction method are designed, so that attack detection and reconstruction of the power information physical system sensor attack are realized; the method takes the case that a physical system of the electric power information containing three motors and six buses is attacked to carry out attack detection and reconstruction, and has the advantages of being scientific and reasonable, good in stability, high in accuracy, high in response speed and the like.
Drawings
FIG. 1 is a diagram of a three-motor six-bus power information physical system attack detection architecture of the present invention;
FIG. 2 is a flowchart of the power cyber-physical system attack detection of the present invention;
FIG. 3 is a diagram of the detection response of the Power Messaging physical System of the present invention to a state attack;
FIG. 4 is a diagram of the detection response of the power cyber-physical system of the present invention to three state attacks;
FIG. 5 is a graph of the detection response of the Power Messaging physical System of the present invention to a sensor attack;
fig. 6 is a detection response diagram of the power cyber-physical system of the present invention under attack of three sensors.
Detailed Description
The invention is further illustrated with reference to the following figures and examples.
Referring to fig. 1, the method for attack detection and reconstruction of an electric power information physical system of the present invention combines a sliding mode observer and a self-adaptive method to perform attack detection on the electric power information physical system, widens the attack condition from the existing function boundary known to a part of upper boundary functions known, and estimates an unknown upper boundary value by the self-adaptive method, thereby designing a self-adaptive sliding mode observer to realize simultaneous estimation of the state of the electric power information physical system and an attack signal; for general attack signals, the detection of the attack signals can be realized by comparing residual signals generated between output signals of a power information physical system and an adaptive sliding mode observer with a set threshold, however, for special attack signals, the detection of the attack cannot be realized by comparing the residual signals with the set threshold, in order to ensure the accuracy of the attack detection, a method for reconstructing the attack signals is adopted for the attack detection, and a novel detection logic for reconstructing the attack signals is also provided.
Aiming at the situation that the electric power information physical system is attacked by the state, a sliding mode observer is combined with a self-adaptive method, a self-adaptive sliding mode observer aiming at the state attack is designed, and a system state signal and a state attack signal of the electric power information physical system are observed at the same time; the state attack is detected by using a self-adaptive sliding mode observer and a method for reconstructing an attack signal, so that not only can the state attack signal of the electric power information physical system be accurately obtained, but also the state attack signal exceeding a certain threshold value can be detected; in addition, the method is popularized to the situation that the power information physical system is attacked by the sensor, a low-pass filter is introduced into an output signal of the power information physical system attacked by the sensor to obtain a correspondingly expanded power information physical system, and a corresponding self-adaptive sliding mode observer and attack reconstruction method are designed to realize detection of the sensor attack of the power information physical system. Finally, the method provided by the invention is applied to an electric power information physical system containing three motors and six buses, and the electric power information physical system is a power grid system, so that simulation calculation is carried out.
Referring to fig. 1-2, the method for attack detection and reconstruction of a power information physical system according to the present invention includes:
1) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a state:
y(t)＝Cx(t)+Duu(t) (1)
wherein x (t) is a state signal when the power information physical system is under state attack, y (t) is an output signal when the power information physical system is under state attack, u (t) is a controlled input signal of the power information physical system,
is the differentiation of the state signal when the power information physical system is attacked by the state, Bηηx(t) is a status attack signal of the Power information physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
2) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a sensor:
wherein x '(t) is a state signal when the electrical information physical system is attacked by the sensor, y' (t) is an output signal when the electrical information physical system is attacked by the sensor, u (t) is a controlled input signal of the electrical information physical system,
is the differentiation of the state signal when the electrical power information physical system is attacked by a sensor, Dηηs(t) is the sensor attack signal of the Power cyber-physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
3) the method comprises the following steps of establishing a mathematical model of the adaptive sliding mode observer when a power information physical system containing three motors and six buses is attacked by states:
wherein
Is the state signal of the adaptive sliding mode observer when a state attack is encountered,
is the output signal of the adaptive sliding mode observer under a state attack, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer,
is the differential of the state signal of the adaptive sliding mode observer when the state attack is received, u (t) is the controlled input signal of the electric power information physical system, y (t) is the output signal of the electric power information physical system when the state attack is received, B (t)ηIs a selection matrix of a state attack signal of the power information physical system, L is a gain matrix of an adaptive sliding mode observer when the state attack is received, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
4) when a mathematical model of the adaptive sliding mode observer is established when an electric power information physical system containing three motors and six buses is attacked by a sensor, according to an attack detection scheme of the electric power information physical system:
introducing a low-pass filter into an output signal y' (t) when the electric power information physical system is attacked by a sensor:
wherein
Is the output signal of the low-pass filter, x'f(t) is the integration of the output signal of the low-pass filter, the integration constant is 0, y' (t) is the output signal when the power information physical system is attacked by the sensor, As，BsIs a designed Huvitz matrix, having:
in the formula Dηηs(t) is the sensor attack signal of the Power cyber-physical System, C, DuIs a system parameter with proper dimension in the electric power information physical system, u (t) is a controlled input signal of the electric power information physical system;
defining:v(t)＝[x′(t)T,x′f(t)T]T,y″(t)＝x′f(t), a mathematical model of the electric power information physical system comprising three motors and six buses under the attack of a sensor after the electric power information physical system is introduced into a low-pass filter is described as follows:
y″(t)＝C′v(t) (6)
wherein v (t) is a state signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, y' (t) is an output signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, u (t) is a controlled input signal of the electric power information physical system,
is the differential, D ', of the state signal when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced'ηηs(t) is a sensor attack signal of the physical system of the electric power information after the introduction of the low-pass filter, A ', B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
the method comprises the following steps of establishing a mathematical model of the self-adaptive sliding mode observer when an electric power information physical system containing three motors and six buses is attacked by a sensor after being introduced into a low-pass filter:
wherein
Is to introduce low-pass filteringThe state signal of the adaptive sliding mode observer when the post-wave power information physical system is attacked by the sensor,
is the output signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after a low-pass filter is introduced into the adaptive sliding mode observer,
is the derivative of the state signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, u (t) is the controlled input signal of the electric power information physical system, y '(t) is the output signal when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, D'ηIs a selection matrix of a sensor attack signal of a power information physical system after introducing a low-pass filter, G is a gain matrix of an adaptive sliding mode observer when the sensor is attacked, A 'and B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
5) the output signal y (t) of the power information physical system under the condition attack and the output signal of the adaptive sliding mode observer under the condition attack are utilized
Residual signals generated between the two are converged to zero to reconstruct state attack signals, and output signals y' (t) of the electric power information physical system under the sensor attack after the low-pass filter is introduced and output signals of the adaptive sliding mode observer under the sensor attack after the low-pass filter is introduced are utilized
Residual signals generated in the process of reconstructing the sensor attack signals are converged to zero:
when the electric power information physical system is attacked by the state:
Bηηx(t)-Bηvx(t)＝0 (8)
in the formula Bηηx(t) is a status attack signal of the Power information physical System, BηIs a selection matrix of state attack signals of the power information physical system, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer;
defining:
the constant K is greater than 0, and the reconstruction v can be achieved byx(t)：
ρxIs that
With an integration constant of 0, vx(t) is a reconstructed signal of a state attack of the adaptive sliding mode observer, wherein
Fx＝Bη TPCT(CCT)-1，BηThe method is characterized in that the method is a selection matrix of state attack signals in the power information physical system, P is a matrix which is larger than 0 and meets system requirements, and C is a system parameter with proper dimensionality in the power information physical system;
to reduce jitter, the signal vx(t) is modified to:
where δ is guaranteed to be sufficiently small;
when the electric power information physical system is attacked by the sensor:
D′ηηs(t)-D′ηvs(t)＝0 (11)
d 'in the formula'ηηs(t) is a sensor attack signal of the physical system of the power information after introduction of the low-pass filter, D'ηIs a selection matrix of sensor attack signals of a power information physical system after introducing a low-pass filter, vs(t) a reconstructed signal of the electric power information physical system sensor attack after a low-pass filter is introduced into the adaptive sliding mode observer;
defining:
the constant M is greater than 0, and the reconstruction v can be achieved bys(t)：
ρsIs that
With an integration constant of 0, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after introducing a low-pass filter in the adaptive sliding mode observer, wherein
Fs＝D′η TQC′T(C′C′T)-1，D′ηThe method is characterized in that a selection matrix of a sensor attack signal of the electric power information physical system after a low-pass filter is introduced is used, Q is a matrix which is larger than 0 and meets the system requirement, and C' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
to reduce jitter, the signal vs(t) is modified to:
where δ is guaranteed to be sufficiently small;
6) setting an attack detection logic of the power information physical system:
firstly, reconstructing state attack signal v of power information physical system by using residual signalxiDesigning a state attack detection logic:
Wherein v isxiIs a reconstructed state attack signal, Th, of a power information physical systemxiIs an attack threshold value given by the reconstruction state attack of the power information physical system, | vxi| represents an absolute value of a reconfiguration state attack signal of the power information physical system, FlagiAn alarm signal indicating a state attack of the electrical information physical system;
secondly, reconstructing sensor attack signal v of electric power information physical system by using residual signalsiDesigning a sensor attack detection logic:
Wherein v issiIs a reconstructed sensor attack signal, Th, of a power information physical systemsiIs an attack threshold value given by the attack of a reconstruction sensor of a power information physical system, | vsiI represents the absolute value of the reconstructed sensor attack signal of the power information physical systemFor value, FlagiAn alarm signal indicative of a sensor attack of the electrical cyber-physical system.
Embodiment and results:
referring to fig. 3-6, the designed electric information physical system model and its corresponding adaptive sliding mode observer initially make it work in a stable operation state, and the implementation is as follows:
the first step is as follows: injecting a state attack to the power information physical system and giving a simulation result;
the second step is that: three state attacks are injected into the power information physical system, and a simulation result is given;
the third step: injecting a sensor attack to the electric power information physical system, and giving a simulation result;
the fourth step: three sensors are injected into the power information physical system to attack, and a simulation result is given.
Analysis shows that by using the method for carrying out attack detection and reconstruction on the power information physical system, the value of the state signal of the power information physical system and the value of attack reconstruction can be obtained more accurately, and the attack signal exceeding a certain threshold value can be detected; simulation results show that the method for attack detection and reconstruction of the power information physical system can accurately observe the system state signal of the power information physical system, reconstruct the attack signal in the power information physical system and realize attack detection by using the reconstructed attack signal.
The embodiments of the present invention are not exhaustive, and those skilled in the art will still fall within the scope of the present invention as claimed without simple duplication and modification by the inventive efforts.
Claims (1)
1. A method for carrying out attack detection and reconstruction on a power information physical system is characterized by comprising the following contents:
1) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a state:
y(t)＝Cx(t)+Duu(t) (1)
wherein x (t) is a state signal when the power information physical system is under state attack, y (t) is an output signal when the power information physical system is under state attack, u (t) is a controlled input signal of the power information physical system,
is the differentiation of the state signal when the power information physical system is attacked by the state, Bηηx(t) is a status attack signal of the Power information physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
2) establishing a mathematical model when a power information physical system comprising three motors and six buses is attacked by a sensor:
y′(t)＝Cx′(t)+Duu(t)+Dηηs(t) (2)
wherein x '(t) is a state signal when the electrical information physical system is attacked by the sensor, y' (t) is an output signal when the electrical information physical system is attacked by the sensor, u (t) is a controlled input signal of the electrical information physical system,
is the differentiation of the state signal when the electrical power information physical system is attacked by a sensor, Dηηs(t) is the sensor attack signal of the Power cyber-physical System, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
3) the method comprises the following steps of establishing a mathematical model of the adaptive sliding mode observer when a power information physical system containing three motors and six buses is attacked by states:
wherein
Is the state signal of the adaptive sliding mode observer when a state attack is encountered,
is the output signal of the adaptive sliding mode observer under a state attack, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer,
is the differential of the state signal of the adaptive sliding mode observer when the state attack is received, u (t) is the controlled input signal of the electric power information physical system, y (t) is the output signal of the electric power information physical system when the state attack is received, B (t)ηIs a selection matrix of a state attack signal of the power information physical system, L is a gain matrix of an adaptive sliding mode observer when the state attack is received, A, Bu、C、DuIs a system parameter with proper dimensionality in the power information physical system;
4) when a mathematical model of the adaptive sliding mode observer is established when an electric power information physical system containing three motors and six buses is attacked by a sensor, according to an attack detection scheme of the electric power information physical system:
introducing a low-pass filter into an output signal y' (t) when the electric power information physical system is attacked by a sensor:
wherein
Is the output signal of the low-pass filter, x'f(t) is the integration of the output signal of the low-pass filter, the integration constant is 0, y' (t) is the output signal when the power information physical system is attacked by the sensor, As，BsIs a designed Huvitz matrix, having:
in the formula Dηηs(t) is the sensor attack signal of the Power cyber-physical System, C, DuIs a system parameter with proper dimension in the electric power information physical system, u (t) is a controlled input signal of the electric power information physical system;
defining: v (t) ═ x' (t)T,x′f(t)T]T,y″(t)＝x′f(t), a mathematical model of the electric power information physical system comprising three motors and six buses under the attack of a sensor after the electric power information physical system is introduced into a low-pass filter is described as follows:
y″(t)＝C′v(t) (6)
wherein v (t) is a state signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, y' (t) is an output signal of the electric power information physical system under the sensor attack after the low-pass filter is introduced, u (t) is a controlled input signal of the electric power information physical system,
is the differential, D ', of the state signal when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced'ηηs(t) is a sensor attack signal of the physical system of the electric power information after the introduction of the low-pass filter, A ', B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
the method comprises the following steps of establishing a mathematical model of the self-adaptive sliding mode observer when an electric power information physical system containing three motors and six buses is attacked by a sensor after being introduced into a low-pass filter:
wherein
Is a state signal of the adaptive sliding mode observer when the electric power information physical system is attacked by a sensor after the low-pass filter is introduced,
is the output signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after a low-pass filter is introduced into the adaptive sliding mode observer,
is the differentiation of the state signal of the adaptive sliding mode observer when the electric power information physical system is attacked by the sensor after the low-pass filter is introduced, u (t) is the controlled input signal of the electric power information physical system, y' (t) is the electric power information object after the low-pass filter is introducedOutput signal of physical system under attack of sensor, D'ηIs a selection matrix of a sensor attack signal of a power information physical system after introducing a low-pass filter, G is a gain matrix of an adaptive sliding mode observer when the sensor is attacked, A 'and B'uC' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
5) the output signal y (t) of the power information physical system under the condition attack and the output signal of the adaptive sliding mode observer under the condition attack are utilized
Residual signals generated between the two are converged to zero to reconstruct state attack signals, and output signals y' (t) of the electric power information physical system under the sensor attack after the low-pass filter is introduced and output signals of the adaptive sliding mode observer under the sensor attack after the low-pass filter is introduced are utilized
Residual signals generated in the process of reconstructing the sensor attack signals are converged to zero:
when the electric power information physical system is attacked by the state:
Bηηx(t)-Bηvx(t)＝0 (8)
in the formula Bηηx(t) is a status attack signal of the Power information physical System, BηIs a selection matrix of state attack signals of the power information physical system, vx(t) is the reconstructed signal of the state attack in the adaptive sliding mode observer;
defining:
the constant K is greater than 0, and the reconstruction v can be achieved byx(t)：
ρxIs that
With an integration constant of 0, vx(t) is a reconstructed signal of a state attack of the adaptive sliding mode observer, wherein
Fx＝Bη TPCT(CCT)-1，BηThe method is characterized in that the method is a selection matrix of state attack signals in the power information physical system, P is a matrix which is larger than 0 and meets system requirements, and C is a system parameter with proper dimensionality in the power information physical system;
to reduce jitter, the signal vx(t) is modified to:
where δ is guaranteed to be sufficiently small;
when the electric power information physical system is attacked by the sensor:
D′ηηs(t)-D′ηvs(t)＝0 (11)
d 'in the formula'ηηs(t) is a sensor attack signal of the physical system of the power information after introduction of the low-pass filter, D'ηIs a selection matrix of sensor attack signals of a power information physical system after introducing a low-pass filter, vs(t) a reconstructed signal of the electric power information physical system sensor attack after a low-pass filter is introduced into the adaptive sliding mode observer;
defining:
the constant M is greater than 0, and the reconstruction v can be achieved bys(t)：
ρsIs that
With an integration constant of 0, vs(t) is a reconstructed signal of the sensor attack of the electrical information physical system after introducing a low-pass filter in the adaptive sliding mode observer, wherein
D′ηThe method is characterized in that a selection matrix of a sensor attack signal of the electric power information physical system after a low-pass filter is introduced is used, Q is a matrix which is larger than 0 and meets the system requirement, and C' is a system parameter with proper dimensionality in the electric power information physical system after the low-pass filter is introduced;
to reduce jitter, the signal vs(t) is modified to:
where δ is guaranteed to be sufficiently small;
6) setting an attack detection logic of the power information physical system:
firstly, reconstructing state attack signal v of power information physical system by using residual signalxiDesigning a state attack detection logic:
Wherein v isxiIs a reconstructed state attack signal, Th, of a power information physical systemxiIs an attack threshold value given by the reconstruction state attack of the power information physical system, | vxi| represents an absolute value of a reconfiguration state attack signal of the power information physical system, FlagiAn alarm signal indicating a state attack of the electrical information physical system;
secondly, reconstructing sensor attack signal v of electric power information physical system by using residual signalsiDesigning a sensor attack detection logic:
Wherein v issiIs a reconstructed sensor attack signal, Th, of a power information physical systemsiIs an attack threshold value given by the attack of a reconstruction sensor of a power information physical system, | vsiI represents the absolute value of the reconstructed sensor attack signal of the power information physical system, FlagiAn alarm signal indicative of a sensor attack of the electrical cyber-physical system.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911126969.2A CN110855683B (en) | 2019-11-18 | 2019-11-18 | Method for carrying out attack detection and reconstruction on electric power information physical system |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201911126969.2A CN110855683B (en) | 2019-11-18 | 2019-11-18 | Method for carrying out attack detection and reconstruction on electric power information physical system |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN110855683A CN110855683A (en) | 2020-02-28 |
| CN110855683B true CN110855683B (en) | 2021-08-10 |
Family
ID=69602056
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201911126969.2A Active CN110855683B (en) | 2019-11-18 | 2019-11-18 | Method for carrying out attack detection and reconstruction on electric power information physical system |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110855683B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111258223A (en) * | 2020-03-12 | 2020-06-09 | 电子科技大学 | Sliding mode-based switching networked control system safety control method |
| CN112398840B (en) * | 2020-11-06 | 2022-03-08 | 国网山东省电力公司 | Electric power information physical system attack positioning method based on self-adaptive sliding mode observer |
| CN112666920A (en) * | 2020-12-11 | 2021-04-16 | 国网辽宁省电力有限公司经济技术研究院 | Attack monitoring and hazard assessment method for power information physical system |
| CN112788049B (en) * | 2021-01-24 | 2022-03-22 | 国网山东省电力公司 | Power information physical system attack detection method based on adaptive Kalman filter |
| CN113094712B (en) * | 2021-05-17 | 2022-08-26 | 国网山东省电力公司电力科学研究院 | Power information physical system attack defense method based on self-adaptive sliding mode controller |
| CN115051872B (en) * | 2022-06-30 | 2023-03-17 | 苏州科技大学 | Attack detection method considering attack signal and unknown disturbance based on interconnected CPS |
| CN115643111B (en) * | 2022-12-22 | 2023-03-17 | 北京卓翼智能科技有限公司 | State estimation method of multi-agent system under malicious attack |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106415580A (en) * | 2014-06-24 | 2017-02-15 | 高通股份有限公司 | Methods and systems for thwarting side channel attacks |
| CN106713354A (en) * | 2017-01-23 | 2017-05-24 | 全球能源互联网研究院 | Method for evaluating vulnerability node of electric cyber-physical system based on undetectable information attack pre-warning technology |
| CN108196448A (en) * | 2017-12-25 | 2018-06-22 | 北京理工大学 | False data injection attacks method based on inaccurate mathematical model |
| CN108628331A (en) * | 2018-05-09 | 2018-10-09 | 北京航空航天大学 | A kind of spacecraft attitude control method of Spatial Countermeasure environment lower sensor under fire |
| CN108718310A (en) * | 2018-05-18 | 2018-10-30 | 安徽继远软件有限公司 | Multi-level attack signatures generation based on deep learning and malicious act recognition methods |
-
2019
- 2019-11-18 CN CN201911126969.2A patent/CN110855683B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106415580A (en) * | 2014-06-24 | 2017-02-15 | 高通股份有限公司 | Methods and systems for thwarting side channel attacks |
| CN106713354A (en) * | 2017-01-23 | 2017-05-24 | 全球能源互联网研究院 | Method for evaluating vulnerability node of electric cyber-physical system based on undetectable information attack pre-warning technology |
| CN108196448A (en) * | 2017-12-25 | 2018-06-22 | 北京理工大学 | False data injection attacks method based on inaccurate mathematical model |
| CN108628331A (en) * | 2018-05-09 | 2018-10-09 | 北京航空航天大学 | A kind of spacecraft attitude control method of Spatial Countermeasure environment lower sensor under fire |
| CN108718310A (en) * | 2018-05-18 | 2018-10-30 | 安徽继远软件有限公司 | Multi-level attack signatures generation based on deep learning and malicious act recognition methods |
Non-Patent Citations (3)
| Title |
|---|
| An improved robust adaptive parameter identifier for DC-DC converters using H-infinity design;Palak Jain等;《2018 IEEE Applied Power Electronics Conference and Exposition (APEC)》;20180419;全文 * |
| Sensor Fault Detection and Fault-Tolerant Control;JIAN LI等;《IEEE Access》;20190418;全文 * |
| 基于变论域模糊控制的无刷直流电机转速问题;赵天宇;《控制与应用技术》;20171110;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN110855683A (en) | 2020-02-28 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110855683B (en) | Method for carrying out attack detection and reconstruction on electric power information physical system | |
| Greblicki et al. | Identification of discrete Hammerstein systems using kernel regression estimates | |
| Chen | Stability analysis for 2-D systems with interval time-varying delays and saturation nonlinearities | |
| Peng et al. | Dynamics analysis of fractional-order permanent magnet synchronous motor and its DSP implementation | |
| Li et al. | Fault diagnosis for networked control systems with delayed measurements and inputs | |
| CN105224428A (en) | The arrow borne computer dynamic characteristic test method and system of control signal digital transmission | |
| CN111208731B (en) | Method for attack detection and reconstruction of electric power information physical system | |
| CN204496021U (en) | A kind of transient electromagnetic device of amplifying transient electromagnetic signal based on sectional type | |
| CN115208680A (en) | Dynamic network risk prediction method based on graph neural network | |
| CN110543162B (en) | Multiple fault identification method for motion control system under strong noise | |
| KR20180032522A (en) | Joint identification of merge signals in non-cooperative digital telecommunications | |
| CN111521858A (en) | Method for extracting double-frequency alternating current component in rotating coordinate system | |
| Hong et al. | A simplified form of the bias-eliminating least squares method for errors-in-variables identification | |
| CN109582914B (en) | Parallel fusion estimation method of noise-related deviation system | |
| Young | An instrumental variable approach to ARMA model identification and estimation | |
| Ding | Semi-global stabilisation of a class of non-minimum phase non-linear output-feedback systems | |
| Gao et al. | Adaptive synchronization of hyperchaotic Lü system with uncertainty | |
| Tang et al. | An augmented generalized likelihood ratio test detector for signal detection in clutter and noise | |
| Zhang et al. | On the failure of power system automatic generation control due to measurement noise | |
| CN112398840B (en) | Electric power information physical system attack positioning method based on self-adaptive sliding mode observer | |
| CN110636053B (en) | Network attack detection method based on local mean decomposition and support vector machine | |
| Chen | Mixed monotone iterative technique for impulsive periodic boundary value problems in Banach spaces | |
| Djamai et al. | Continuous-time model identification using reinitialized partial moments-application to power amplifier modeling | |
| CN105678072A (en) | Method for reducing error of electronic instrument transformer under influence of message jitter | |
| CN105607138B (en) | A kind of jamproof circuit of geomagnetic sensor and method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |