CN111027058B - Method for detecting data attack of power system, computer equipment and storage medium - Google Patents

Method for detecting data attack of power system, computer equipment and storage medium Download PDF

Info

Publication number
CN111027058B
CN111027058B CN201911097514.2A CN201911097514A CN111027058B CN 111027058 B CN111027058 B CN 111027058B CN 201911097514 A CN201911097514 A CN 201911097514A CN 111027058 B CN111027058 B CN 111027058B
Authority
CN
China
Prior art keywords
data
neural network
value
time
layer
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN201911097514.2A
Other languages
Chinese (zh)
Other versions
CN111027058A (en
Inventor
张安龙
黄福全
刘子俊
晋龙兴
简学之
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Shenzhen Power Supply Bureau Co Ltd
Original Assignee
Shenzhen Power Supply Bureau Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Shenzhen Power Supply Bureau Co Ltd filed Critical Shenzhen Power Supply Bureau Co Ltd
Priority to CN201911097514.2A priority Critical patent/CN111027058B/en
Publication of CN111027058A publication Critical patent/CN111027058A/en
Application granted granted Critical
Publication of CN111027058B publication Critical patent/CN111027058B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/21—Design or setup of recognition systems or techniques; Extraction of features in feature space; Blind source separation
    • G06F18/213—Feature extraction, e.g. by transforming the feature space; Summarisation; Mappings, e.g. subspace methods
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F18/00—Pattern recognition
    • G06F18/20—Analysing
    • G06F18/24—Classification techniques
    • G06F18/241—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches
    • G06F18/2411—Classification techniques relating to the classification model, e.g. parametric or non-parametric approaches based on the proximity to a decision surface, e.g. support vector machines
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/044—Recurrent networks, e.g. Hopfield networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/04—Architecture, e.g. interconnection topology
    • G06N3/045—Combinations of networks
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N3/00—Computing arrangements based on biological models
    • G06N3/02—Neural networks
    • G06N3/08—Learning methods

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Data Mining & Analysis (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Artificial Intelligence (AREA)
  • Evolutionary Computation (AREA)
  • Software Systems (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Biophysics (AREA)
  • Computer Vision & Pattern Recognition (AREA)
  • Health & Medical Sciences (AREA)
  • Computational Linguistics (AREA)
  • Biomedical Technology (AREA)
  • Mathematical Physics (AREA)
  • General Health & Medical Sciences (AREA)
  • Molecular Biology (AREA)
  • Computing Systems (AREA)
  • Computer Security & Cryptography (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Evolutionary Biology (AREA)
  • Computer Hardware Design (AREA)
  • Management, Administration, Business Operations System, And Electronic Commerce (AREA)
  • Image Analysis (AREA)

Abstract

The application discloses a method for detecting data attack of a power system, computer equipment and a storage medium, comprising the following steps: acquiring historical measurement data of a data driving power system and carrying out normalization pretreatment on the historical measurement data; the time sequence data is input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured; outputting the full-connection layer FC of the convolutional neural network by the long and short-time memory neural network and capturing the time characteristics; the convolution neural network and the long-short-time memory neural network are provided with a Dropout layer and a batch standardization layer, and an output layer of the long-short-time memory neural network is provided with an attention mechanism; and setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection. By implementing the application, the accuracy of attack detection is higher, the detection time interval is reasonable, the generalization performance of detection is better, and the detector can identify false data, so that effective and timely measures are taken.

Description

Method for detecting data attack of power system, computer equipment and storage medium
Technical Field
The application belongs to the field of power monitoring, and relates to a method for detecting data attack of a power system, computer equipment and a storage medium.
Background
At present, with the basic completion of the third industrial revolution and the gradual promotion of the energy industry system Internet of things 3.0, the ubiquitous power Internet of things and the energy Internet consisting of a strong smart grid are gradually deeply researched and applied in the field of power systems. The composition and the operation mechanism of the electric power information physical fusion system which is an important component of the energy internet tend to be complex, and the new generation of energy power system represents the energy flow of primary equipment and the information flow of secondary equipment to be tightly coupled and interacted with each other with high efficiency. Therefore, the measurement information of the power system is easy to attack and tamper, so that the safety risk of the information of the power system is increased. The method is characterized in that the characteristics and the consequences of the information attack possibly occurring in the power system are researched in a related manner, a risk perceptron is initially constructed to detect the abnormality of the measured data, the risk and the loss of the information attack of the power system can be reduced, and corresponding references are provided for planning and design, safety and stability, scheduling distribution and emergency control of the development of the new generation of energy Internet.
Most of related power departments at home and abroad adopt an EMS/SCADA system to detect and identify bad data uploaded to a regulation and control center by a phasor synchronous measurement unit (Phasor Measurement Unit, PMU) and a remote terminal (Remote Terminal Unit, RTU) equivalent measurement unit based on state estimation and bad data identification (Bad Data Detection, BDD) and then reject the bad data. Specifically, most practical detection methods of bad data based on state estimation in a power system are a least square method and a recursive state estimation method based on Kalman filtering, and characteristics of external network attacks such as tamper attacks are not considered. Meanwhile, when a network attacker grasps the topology data of the actual power system, false data (False Data Injection Attack, FDIA) can be constructed and injected to successfully bypass the BDD, and the false data enables the power system to be erroneously decided so as to be unstable step by step, and finally, a blackout accident is caused. In a word, only relying on traditional state estimation to detect bad data cannot fully guarantee network security in a new generation ubiquitous power internet of things information system.
In the prior art, new methods for detecting abnormal data based on a neural network, a fuzzy theory and cluster analysis, intermittent statistics, a support vector machine, a Bayesian network and the like are proposed by related researchers. The method can successfully identify bad data to a certain extent, but most of the method only considers the spatial correlation or the time correlation of the measured data, and does not fully dig the complex space-time characteristics of the power system data, and the monitoring level of the method still needs to be further improved. Meanwhile, in order to improve the detection performance of the framework, the construction of the deep learning framework causes that most of the methods consume a large amount of computer resources during training, the convergence time is increased, and the real-time performance and the practicability of the monitoring cannot be fully ensured. The data uploaded to the control center by the measurement units generally have time-space correlation, wherein the time correlation refers to the time-varying characteristic of the same measurement value, and the space correlation refers to the correlation of a plurality of measurement values of the whole network or a certain area in the same time period.
Disclosure of Invention
The technical problem to be solved by the embodiment of the application is to provide a method for detecting data attack of a power system, computer equipment and a storage medium, which are used for solving the problems that a detector architecture based on space-time correlation is not available in the prior art, the detection accuracy is low, the false data identification success rate is poor, and the information security of the power system cannot be effectively protected.
In one aspect of the present application, a method for detecting a data attack in a power system is provided, which includes the steps of:
step S1, acquiring historical measurement data of a data driving power system and carrying out normalization preprocessing on the historical measurement data;
s2, performing equal batch input of the time series data into the convolutional neural network according to the time/time period and grabbing spatial features;
step S3, outputting the full-connection layer FC of the convolutional neural network by the long-and-short-term memory neural network and capturing time characteristics;
step S4, a Dropout layer and a batch standardization layer are arranged in the convolutional neural network and the long-short-time memory neural network, and an attention mechanism is arranged at an output layer of the long-short-time memory neural network;
and S5, setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
Further, in step S1, the specific process of performing the preprocessing and normalizing operations includes:
step S11, reading the original PMU/RTU measurement data stored in the local area into a memory of a detector, and preprocessing according to different areas, different measurement units and different scheduling units;
step S12, classifying PMU data into voltage amplitude, voltage phase, current amplitude and current phase, when the detector performs training learning on m measurement units in a certain area of the power system at the same time, the sampling time sequence length is T, the number of measurement parameters of one measurement unit is n, the dimension of the data is d=m×n, and the data set is expressed as follows:
wherein D represents a metrology data set; x is x t The measured value of the measuring unit at time t is real and the dimension of the data is m×n, which can be expressed as
The detector data mining reshapes the data of the time period into a time segment value, and the finally obtained data is expressed as:
wherein ,Dmap Representing the processed metrology data set; x is x vm Representing voltage magnitude data; x is x ca Representing current phase data; t is the time sequence length; t' is the time slice sequence length; processed real data set x t,map Is of the dimension of
Further, in step S11, the preprocessing performs normalization preprocessing according to the following formula:
wherein ,yscaler For the normalized measurement value, the distribution is y min To y max Between, y min Is the minimum value of the normalized value, y max For the normalized maximum value, x min Is the minimum value of the actual measurement value, x max Is the maximum value of the actual measurement value, and x represents the actual measurement value of the normalization process.
Further, in step S2, the convolutional neural network captures data space features according to the following formula:
wherein ,for the input measurement data, < >>For the convolution kernel of the jth feature map of the first convolution layer, M is the matrix block value selected during each sliding in the convolution process, b represents the bias matrix parameter, down (order) is the pooling function, and beta j Representing trainable scalar, Q 2 Representing the size of the pooling block in the pooling process, wherein Flatten is a unification function, and the ReLU function is a common modified linear activation function, w (n) Is a parameter that the model needs to be continuously adjusted when the neural network error is counter-propagating.
Further, in step S3, the long-short-term memory neural network grabbing data time feature is performed according to the following formula:
f t ＝σ(W xf x t +W hf h t-1 +b f )
i t ＝σ(W xi x t +W hi h t-1 +b i )
o t ＝σ(W xo x t +W ho h t-1 +b o )
h t ＝o t tanh(c t )
wherein ,ft Forgetting coefficient of forgetting gate, sigma is sigmoid activation function, W is weight matrix, x t H is the input value of the current moment t-1 The output value of the cell hiding layer at the previous moment, b is a bias matrix, i t As the weight value coefficient of the input gate,for the state value of the newly input cell, tanh is the activation function, c t C, for the updated cell state of the current state t-1 Is the state value of the cell at the last moment, o t For outputting the weight coefficient value of the gate, h t Is the output value of the hidden layer.
Further, in step S4, the specific process of setting a Dropout layer and a batch normalization layer is that when the detector trains and fits data, the connection between neurons is randomly disconnected according to probability so that the detector does not learn the local characteristics specific to the training set too much;
forcibly processing the distribution of the input value of each neuron into a standard normal distribution with the mean value of 0 and the variance of 1 by a regularization standard method, and adjusting the input and output feedback of each neuron according to the following formula:
y (k) ＝γ (k) x (k) +β (k)
wherein ,inputting data value x for the k-th normalized neural network (k) E is the original input data value.]Var [ -Var ] is the mean value of its input data.]To obtain the variance value of the input data value, y (k) And for the output value of the neural network corresponding to the input data, gamma is a weight parameter during the training of the neural network, and beta is a weight bias during the training of the neural network.
Further, in step S4, the output layer of the long-short-term memory neural network sets the attention mechanism according to the following formula:
h i ＝o i tanh(c i )＝f 1 (x i ,h i-1 )tanh(f 2 (x i ,h i-1 ))＝f(x i ,h i-1 )
e ti ＝v T tanh(W h h i +W s s t-1 +b)
wherein ,hi Memorizing the hidden layer output value of the neural network for the time of i moment, o i The weight coefficient value of the output gate of the neural network is memorized for a long time, c i To memorize the current state of the neural network cell for a long time, alpha ti For the current output s t Weight coefficient assigned to data value, s t Is an output vector value based on an attention mechanism.
Further, in step S5, the specific process of the output layer set support vector machine classifier of the long-short-term memory neural network is that the output layer set support vector machine classifier makes a decision on whether a measured data network attack occurs, which is specifically shown in the following formula:
f(x)＝ω T x+b
wherein D is a two-dimensional data value to be classified, x and y are two-dimensional data of the data, ω T B is a displacement term, f (x) is a dividing hyperplane, gamma is a geometric interval,to be functionally spaced, y i Is a label of the data.
Accordingly, the present application provides a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
acquiring historical measurement data of a data driving power system and carrying out normalization pretreatment on the historical measurement data;
the time sequence data is input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured;
outputting the full-connection layer FC of the convolutional neural network by the long and short-time memory neural network and capturing the time characteristics;
the convolution neural network and the long-short-time memory neural network are provided with a Dropout layer and a batch standardization layer, and an output layer of the long-short-time memory neural network is provided with an attention mechanism;
and setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
Accordingly, still another aspect of the present application provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of;
acquiring historical measurement data of a data driving power system and carrying out normalization pretreatment on the historical measurement data;
the time sequence data is input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured;
outputting the full-connection layer FC of the convolutional neural network by the long and short-time memory neural network and capturing the time characteristics;
the convolution neural network and the long-short-time memory neural network are provided with a Dropout layer and a batch standardization layer, and an output layer of the long-short-time memory neural network is provided with an attention mechanism;
and setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
The embodiment of the application has the following beneficial effects:
the embodiment of the application provides a method for detecting data attack of an electric power system, computer equipment and a storage medium, which are combined with a convolutional neural network to effectively extract the spatial characteristics of measured data, and a long-time and short-time memory neural network which is suitable for long-time sequence data characteristic learning, and the generalization performance and the robustness of a detector are improved by utilizing the classification performance of a support vector machine classifier;
compared with other learners, the detector provided by the method has better learning performance, namely higher accuracy of attack detection, reasonable detection time interval and better generalization performance, can be applied to power system measurement information attack detection, and has better application prospect;
the complex time-space characteristics of the measured data are utilized to train the attack detector, so that the information safety of the power system can be effectively ensured, and the detector can identify false data, thereby taking effective and timely measures.
Drawings
In order to more clearly illustrate the embodiments of the application or the technical solutions of the prior art, the drawings which are required in the description of the embodiments or the prior art will be briefly described, it being obvious that the drawings in the description below are only some embodiments of the application, and that it is within the scope of the application to one skilled in the art to obtain other drawings from these drawings without inventive faculty.
Fig. 1 is a schematic flow chart of a method for detecting data attacks in an electric power system according to the present application.
Fig. 2 is a schematic diagram of a convolutional neural network in an embodiment of the application for extracting data spatial features.
Fig. 3 is a block diagram of a single neuron of a long-short-term memory neural network according to an embodiment of the present application.
Fig. 4 is a schematic diagram of a long-short-term memory neural network model based on an attention mechanism according to an embodiment of the present application.
Detailed Description
The present application will be described in further detail with reference to the accompanying drawings, for the purpose of making the objects, technical solutions and advantages of the present application more apparent.
As shown in fig. 1, a main flow diagram of an embodiment of a method for detecting a data attack in an electric power system according to the present application is shown, where in the embodiment, the method includes the following steps:
step S1, acquiring historical measurement data of a data driving power system and carrying out normalization preprocessing on the historical measurement data;
in a specific embodiment, the specific process of performing the preprocessing and normalizing operations includes:
step S11, reading the original PMU/RTU measurement data stored in the local area into a memory of a detector, and preprocessing according to different areas, different measurement units and different scheduling units, wherein the preprocessing comprises conversion of different reference power and voltage levels, unification of data formats and the like;
specifically, the pretreatment is normalized according to the following formula:
wherein ,yscaler For the normalized measurement value, the distribution is y min To y max Between, y min Is the minimum value of the normalized value, y max For the normalized maximum value, x min Is the minimum value of the actual measurement value, x max Is the maximum value of the actual measurement value, and x represents the actual measurement value of the normalization process.
Step S12, measurement data are arranged according to a certain rule in preprocessing, PMU data are classified into voltage amplitude, voltage phase, current amplitude and current phase, when a detector carries out training learning on m measurement units in a certain area of a power system at the same time, the length of a sampling time sequence is T, the number of measurement parameters of one measurement unit is n, the dimension of the data is d=m×n, and a data set is expressed as follows:
wherein D represents a metrology data set; x is x t For the measured value measured by the measuring unit at time t, the value is real numberAnd the dimension of the data is m×n, which can be expressed as
The detector data mining reshapes the data of the time period into a time segment value, and the finally obtained data is expressed as:
wherein ,Dmap Representing the processed metrology data set; x is x vm Representing voltage magnitude data; x is x ca Representing current phase data; t is the time sequence length; t' is the time slice sequence length; processed real data set x t,map Is of the dimension of
Step S2, the time sequence data are input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured, the space characteristic values are effectively extracted by the convolutional neural network through training, and the time sequence learning prediction in the subsequent step is facilitated;
in a specific embodiment, the convolutional neural network captures the spatial features of the data according to the following formula:
wherein ,for the input measurement data, < >>For the convolution kernel of the jth feature map of the first convolution layer, M is the matrix block value selected during each sliding in the convolution process, b represents the bias matrix parameter, down (order) is the pooling function, and beta j Representing trainable scalar, Q 2 Representing the size of the pooling block in the pooling process, wherein Flatten is a unification function, and the ReLU function is a common modified linear activation function, w (n) Is a parameter which needs to be continuously adjusted by the model when the neural network error is in back propagation;
the convolutional neural network well solves the problem of the neural network of the multi-layer perceptron, and by changing the full connection of neurons of the multi-layer perceptron into local connection, the complexity of the network is effectively reduced, the adjustment links of parameters in the learning process are reduced, and the problem of overfitting is solved; the network model of the convolutional neural network can be adjusted step by step according to actual training data, most of the network model consists of an input layer, an output layer, a plurality of convolutional layers, a pooling layer and a full-connection layer, as shown in fig. 2, the input layer extracts the corresponding data, the characteristics of the convolutional layer are grabbed for a plurality of times, a plurality of characteristic diagrams are reserved, the pooling layer pools the characteristic diagrams of the convolutional layer in order to reduce the data dimension, the corresponding result is output into one-dimensional characteristic vectors through the full-connection layer after the pooling layer is repeated for a plurality of times, and the output layer generally adopts a softmax function for multi-classification.
Step S3, outputting the full-connection layer FC of the convolutional neural network by the long-and-short-term memory neural network and capturing time characteristics;
in an embodiment, as shown in fig. 3, the data capturing time characteristics of the long and short time memory neural network are performed according to the following formula:
f t ＝σ(W xf x t +W hf h t-1 +b f )
i t ＝σ(W xi x t +W hi h t-1 +b i )
o t ＝σ(W xo x t +W ho h t-1 +b o )
h t ＝o t tanh(c t )
wherein the input gate is configured to receive a new cell state valueAnd input gate weight value i t Two parts, both of which are composed of the input value x at the current time t Cell hidden layer output h at last moment t-1 The weight matrix W and the bias b are formed, wherein W is the weight matrix, and x t H is the input value of the current moment t-1 For the output value of the cell hidden layer at the previous moment, b is the bias matrix, +.>For the state value of the newly input cell, determining the value of the input data at the time t, i t Determining whether to allow the data to flow into the cells for inputting the weight coefficient of the gate, wherein the former generally uses tanh as an activation function, and the latter uses a sigmoid function;
the forgetting door is formed by forgetting coefficient f t The composition is similar to the composition, and is used as an important component of a long-short-term memory neural network, and the forgetting gate controls the cell state value c at the last moment t-1 The flowing weight value is used for adjusting the error gradient, so that gradient explosion and gradient disappearance are avoided; the new state value of the cell is c t Which is assigned by the weight between the cell value at the last time and the new input cell valueWhen the weight of the input gate is 0, any data cannot enter the cell, and when the value of the forgetting gate is 0, the cell discards the historical sequence data information;
the output gate is composed of an output gate weight value o t And hidden layer output h t Similarly, when the output gate weight value is 0, any data cannot be output; the data value is locked in the cell when both the input gate and the output gate are closed, so that the data value does not increase or decrease nor affect the current output.
Specifically, the long-short-term memory neural network can effectively capture the time characteristics of a large number of offline time series measurement values, and can avoid forgetting the change trend of historical data due to new data addition; the long-short-term memory neural network predicts the data value of the next moment by inputting a history moment sequence, and the length of the history moment sequence is called a log back; therefore, the long-short-term memory neural network is compared with the actual value by setting a proper log back value and outputting a predicted value after effective training, so that abnormal data in the time dimension can be recognized in time and early warning can be performed rapidly.
Step S4, a Dropout layer and a batch standardization layer are arranged in the convolutional neural network and the long-short-time memory neural network, and an attention mechanism is arranged at an output layer of the long-short-time memory neural network;
in a specific embodiment, the specific process of setting the Dropout layer and the batch standardization layer is that when the detector trains and fits data, the connection between neurons is randomly disconnected according to probability so that the detector does not learn the local characteristics specific to the training set too much;
the distribution of the input value of each neuron is forcedly processed into standard normal distribution with the mean value of 0 and the variance of 1 by a regularization standard method, so that the situation that the activated input value is close to a saturation region of a nonlinear function (activation function) along with the deepening of a network or the gradual deviation or variation of the distribution in the training process is effectively prevented, and the convergence process of a model after the input value of the neuron enters the saturation region becomes very difficult. Therefore, batch standardization can effectively solve the difficult problems of parameter adjustment, training and convergence difficulty caused by deepening of network depth, and the input and output feedback of each neuron is adjusted according to the following formula:
y (k) ＝γ (k) x (k) +β (k)
wherein ,inputting data value x for the k-th normalized neural network (k) E is the original input data value.]Var [ -Var ] is the mean value of its input data.]To obtain the variance value of the input data value, y (k) The method comprises the steps that a neural network output value corresponding to input data is obtained, gamma is a weight parameter during training of the neural network, and beta is a weight bias during training of the neural network;
specifically, as shown in fig. 4, in order to reduce the consumption of computer resources during the learning of the detector and improve the detection accuracy of the detector, the attention setting mechanism of the output layer of the long-short-term memory neural network is specifically according to the following formula:
h i ＝o i tanh(c i )＝f 1 (x i ,h i-1 )tanh(f 2 (x i ,h i-1 ))＝f(x i ,h i-1 )
e ti ＝v T tanh(W h h i +W s s t-1 +b)
wherein ,hi Memorizing the hidden layer output value of the neural network for the time of i moment, o i Is long in lengthWeight coefficient value of output gate of short-time memory neural network, c i To memorize the current state of the neural network cell for a long time, which is obtained by the current input data x i Hidden layer output h from last moment i-1 Determining alpha ti For the current output s t The greater the weight coefficient assigned to the data value, i.e. the attention weight, the greater the value represents the output of the output pair ti The greater the weight value of the incoming data, e ti For the learned weight values, are determined by a matrix transpose v of learning parameters, a coefficient matrix W and a bias matrix b, parameters are converged and determined in the learning process, and finally the matrix block value is outputted s t The output vector value based on the attention mechanism is used for respectively giving different weights to the long-short memory neural network cell output values at different moments and summing the weights.
Specifically, when the long-short-term memory neural network trains data, each subnet unit needs 4 linear MLP layers, consumes a large amount of bandwidth and computer resources, and when the large-scale power system history measurement data is learned, model training is difficult due to explosive growth of data dimension and sequence length; the attention mechanism-based model can focus the current output of the network to important hidden layer output h t Hardware requirements during training can be effectively reduced, as shown in fig. 4, which is a long-short-term memory neural network based on an attention mechanism.
The input time sequence of the long-short memory neural network is expressed asD represents a time series of data sets, x i Representing the sequence value at time i, +.>The sequence value is represented as a real value in m dimension, so the hidden layer output of the memory neural network at i time and short time is represented as:
h i ＝o i tanh(c i )＝f 1 (x i ,h i-1 )tanh(f 2 (x i ,h i-1 ))＝f(x i ,h i-1 )
therefore, in the T time, the long-short memory neural network hidden layer output is H= [ H ] 1 ,h 2 ,...,h t ,...,h T ]The attention mechanism can be simply represented by the vector α, and the state vector after focusing attention can be represented by s, then the following formula is presented:
α＝softmax(w T tanh(H))
s＝Hα T
wherein ,wT To learn parameters, the above can also be written as:
e ti ＝v T tanh(W h h i +W s s t-1 +b)
step S5, setting a support vector machine classifier on an output layer of the long-short-term memory neural network and outputting a judgment result of attack detection, thereby further improving the detection performance of the detector;
in a specific embodiment, the specific process of setting a support vector machine classifier on the output layer of the long-short-term memory neural network is that the output layer sets the support vector machine classifier to make a decision on whether the measured data network attack occurs, and the specific process is as follows:
the support vector machine is a powerful supervised learning model for sequence data classification and regression analysis, and the basic rule is to find the optimal hyperplane capable of tolerating local disturbance noise and limitation of a data set to the greatest extent, and the hyperplane can make a classification result most robust and has better generalization performance on a test set. For linear separation of training set D in a two-dimensional plane, its classification function can be expressed as:
D＝{(x (1) ,y (1) ),(x (2) ,y (2) ),...,(x (m) ,y (m) )}
f(x)＝ω T x+b
wherein D is a two-dimensional data value to be classified, x and y are two-dimensional data of the data, ω T B is a displacement term, f (x) is a dividing hyperplane, and a straight line (two-dimensional data) is drawn for classification;
the distance of any data point in data D to the hyperplane f (x) is expressed by the following formula:
wherein, gamma is the geometric interval,is a function interval;
assume thatWhen it is desired to find the parameters ω and b with the largest spacing to minimize the classification effect due to noise and local variations, i.e., to make γ have the largest value and continuously adjust the parameters ω and b, the formula can be written as:
wherein ,yi For data labels, y for binary classification problems i Can be set to 0 and 1 or can be set to-1 and 1, and the above formula considers y i =1 or-1 to find the maximum interval to satisfy the condition of classification.
Accordingly, still another aspect of the present application provides a computer device comprising a processor, a memory, and a network interface connected by a system bus. Wherein the processor of the computer device is configured to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface of the computer device is used for communicating with an external terminal through a network connection.
It will be appreciated by those skilled in the art that the structure of the computer device described above is merely a partial structure related to the present application and does not constitute a limitation of the computer device to which the present application is applied, and that a specific computer device may include more or less components than those described above, or may combine some components, or have a different arrangement of components.
In one embodiment, such a computer device is provided comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the following steps when executing the computer program:
acquiring historical measurement data of a data driving power system and carrying out normalization pretreatment on the historical measurement data;
the time sequence data is input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured;
outputting the full-connection layer FC of the convolutional neural network by the long and short-time memory neural network and capturing the time characteristics;
the convolution neural network and the long-short-time memory neural network are provided with a Dropout layer and a batch standardization layer, and an output layer of the long-short-time memory neural network is provided with an attention mechanism;
and setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
Accordingly, still another aspect of the present application provides a computer-readable storage medium having stored thereon a computer program which, when executed by a processor, performs the steps of;
acquiring historical measurement data of a data driving power system and carrying out normalization pretreatment on the historical measurement data;
the time sequence data is input into the convolutional neural network in batches according to the time/time period and the space characteristics are captured;
outputting the full-connection layer FC of the convolutional neural network by the long and short-time memory neural network and capturing the time characteristics;
the convolution neural network and the long-short-time memory neural network are provided with a Dropout layer and a batch standardization layer, and an output layer of the long-short-time memory neural network is provided with an attention mechanism;
and setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
It will be appreciated that further details of the steps involved in the computer device and computer-readable storage medium described above may be found in the limitations of the methods described above and will not be described in detail herein.
Any reference to memory, storage, database, or other medium used in embodiments provided herein may include non-volatile and/or volatile memory. The nonvolatile memory can include Read Only Memory (ROM), programmable ROM (PROM), electrically Programmable ROM (EPROM), electrically Erasable Programmable ROM (EEPROM), or flash memory. Volatile memory can include Random Access Memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms such as Static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double Data Rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous Link DRAM (SLDRAM), memory bus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), among others.
For more details, reference is made to the foregoing description of fig. 1 to 4, and no further details are given herein.
The embodiment of the application has the following beneficial effects:
the embodiment of the application provides a method for detecting data attack of an electric power system, computer equipment and a storage medium, which are used for carrying out abnormal identification on measured data of the data driving electric power system by utilizing a time-space correlation detector frame, so that faults of an information system are timely prevented from being diffused into an energy system, the safety and stability of the electric power system are further maintained to the maximum extent, and the method has higher reliability and stability, and has important indirect significance for maintaining the transient state and steady state stability of the electric power system;
the convolutional neural network and the long-short-term memory neural network are fused to conduct data mining on the spatial correlation and the time correlation of the measurement data, and experiments prove that the detection accuracy of a frame considering the spatial-temporal correlation is higher than that of a method considering the single spatial correlation and the time correlation; meanwhile, an attention mechanism is added to an output layer of the long-short memory neural network, so that the convergence time and computer resources during training are effectively reduced; in order to further improve the performance of the detector, a vector machine classifier with minimized structural risk is combined with an output layer of a long-short-term memory neural network, and the detection accuracy of the frame is further improved; proper Dropout and batch standardization are added into the framework, so that the learner is effectively prevented from falling into a local optimal solution and overfitting during training;
the convolutional neural network is fused to effectively extract the spatial characteristics of measured data, the long-short-time memory neural network is suitable for long-time sequence data characteristic learning, and the generalization performance and the robustness of the detector are improved by utilizing the classification performance of the support vector machine classifier;
compared with other learners, the detector provided by the method has better learning performance, namely higher accuracy of attack detection, reasonable detection time interval and better generalization performance, can be applied to power system measurement information attack detection, and has better application prospect;
the complex time-space characteristics of the measured data are utilized to train the attack detector, so that the information safety of the power system can be effectively ensured, and the detector can identify false data, thereby taking effective and timely measures.
The above disclosure is only a preferred embodiment of the present application, and it is needless to say that the scope of the application is not limited thereto, and therefore, the equivalent changes according to the claims of the present application still fall within the scope of the present application.

Claims (10)

1. A method for detecting a data attack in an electrical power system, comprising the steps of:
step S1, acquiring historical measurement data of a data driving power system and carrying out normalization preprocessing on the historical measurement data;
s2, performing equal batch input of the time series data into the convolutional neural network according to the time/time period and grabbing spatial features;
step S3, outputting the full-connection layer FC of the convolutional neural network according to the long-short-term memory neural network and capturing time characteristics;
step S4, a Dropout layer and a batch standardization layer are arranged in the convolutional neural network and the long-short-time memory neural network, and an attention mechanism is arranged at an output layer of the long-short-time memory neural network;
and S5, setting a support vector machine classifier at an output layer of the long-short-term memory neural network and outputting a judging result of attack detection.
2. The method of claim 1, wherein in step S1, the specific process of performing the preprocessing and normalizing operations includes:
step S11, reading the original PMU/RTU measurement data stored in the local area into a memory of a detector, and preprocessing according to different areas, different measurement units and different scheduling units;
step S12, classifying PMU data into voltage amplitude, voltage phase, current amplitude and current phase, when the detector performs training learning on m measurement units in a certain area of the power system at the same time, the sampling time sequence length is T, the number of measurement parameters of one measurement unit is n, the dimension of the data is d=m×n, and the data set is expressed as follows:
wherein D represents measurementA data set; x is x t The measured value measured by the measuring unit at the time t is real and the dimension of the data is m multiplied by n, which is expressed as
The detector reshapes the data of the time period into a time segment value, and the finally obtained data is expressed as:
wherein ,Dmap Representing the processed metrology data set; x is x vm Representing voltage amplitude data, x ca Representing current phase data; t is the time sequence length; t' is the time slice sequence length; processed real data set x t,map Is of the dimension of
3. The method according to claim 2, characterized in that in step S11, the preprocessing is normalized according to the following formula:
wherein ,yscaler For the normalized measurement value, the distribution is y min To y max Between, y min Is the minimum value of the normalized value, y max For the normalized maximum value, x min Is the minimum value of the actual measurement value, x max Is the maximum value of the actual measurement value, and x represents the actual measurement value of the normalization process.
4. A method as claimed in claim 3, characterized in that in step S2 the convolutional neural network takes the data space features according to the following formula:
wherein ,k is the input measurement data j For the convolution kernel of the jth feature map of the first convolution layer, M is the matrix block value selected during each sliding in the convolution process, b represents the bias matrix, doen (term) is the pooling function, beta j Representing trainable scalar, Q 2 Representing the size of the pooling block in the pooling process, wherein Flatten is a unification function, and the ReLU function is a common modified linear activation function, w () Is a parameter that the model needs to be continuously adjusted when the neural network error is counter-propagating.
5. The method of claim 4, wherein in step S3, the long short time memory neural network grabbing data time feature is performed according to the following formula:
f t ＝σ(W xf x t +W hf h t-1 +b f )
i t ＝σ(W xi x t +W hi h t-1 +b i )
o t ＝σ(W xo x t +W ho h t-1 +b o )
h t ＝o t tanh(c t )
wherein ,ft Forgetting coefficient of forgetting gate, sigma is sigmoid activation function, W is weight matrix, x t H is the input value of the current moment t-1 The output value of the cell hiding layer at the previous moment, b is a bias matrix, i t As the weight value coefficient of the input gate,for the state value of the newly input cell, tanh is the activation function, c t C, for the updated cell state of the current state t-1 Is the state value of the cell at the last moment, o t For outputting the weight coefficient value of the gate, h t Is the output value of the hidden layer.
6. The method according to claim 5, wherein in step S4, the specific process of setting the Dropout layer and the batch normalization layer is that, when the detector trains and fits data, the connection between neurons is randomly disconnected according to probability so that the detector does not learn the local features specific to the training set too much;
forcibly processing the distribution of the input value of each neuron into a standard normal distribution with the mean value of 0 and the variance of 1 by a regularization standard method, and adjusting the input and output feedback of each neuron according to the following formula:
y (k) ＝γ (k) x (k) +β (k)
wherein ,inputting data value x for the k-th normalized neural network (k) E is the original input data value.]Var [ -Var ] is the mean value of its input data.]To obtain the variance value of the input data value, y (k) And for the output value of the neural network corresponding to the input data, gamma is a weight parameter during the training of the neural network, and beta is a weight bias during the training of the neural network.
7. The method of claim 6, wherein in step S4, the output layer set attention mechanism of the long-short-term memory neural network is specifically according to the following formula:
h i ＝o i tanh(c i )＝f 1 (x i ,h i-1 )tanh(f 2 (x i ,h i-1 ))＝f(x i ,h i-1 )
e ti ＝v T tanh(W h h i +W s s t-1 +b)
wherein ,hi Memorizing the hidden layer output value of the neural network for the time of i moment, o i The weight coefficient value of the output gate of the neural network is memorized for a long time, c i To memorize the current state of the neural network cell for a long time, alpha ti For the current output s t Weight coefficient assigned to data value, s t Is based on attentionOutput vector value of force mechanism.
8. The method of claim 7, wherein in step S5, the specific process of setting a support vector machine classifier on the output layer of the long-short-term memory neural network is that the output layer sets the support vector machine classifier and detects whether a measured data network attack occurs, and makes a decision according to the detection result, which is specifically shown in the following formula:
D＝{(x (1) ,y (1) ),(x (2) ,y (2) ),...,(x (m) ,y (m) )}
f(x)＝ω T x+
wherein D is a two-dimensional data value to be classified, x and y are two-dimensional data of the data, ω T For normal vector, the f (x) function is a dividing hyperplane,to be functionally spaced, y i Is a label of the data.
9. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the steps of the method according to any one of claims 1 to 8 when the computer program is executed by the processor.
10. A computer readable storage medium, on which a computer program is stored, characterized in that the computer program, when being executed by a processor, implements the steps of the method of any of claims 1 to 8.
CN201911097514.2A 2019-11-12 2019-11-12 Method for detecting data attack of power system, computer equipment and storage medium Active CN111027058B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN201911097514.2A CN111027058B (en) 2019-11-12 2019-11-12 Method for detecting data attack of power system, computer equipment and storage medium

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN201911097514.2A CN111027058B (en) 2019-11-12 2019-11-12 Method for detecting data attack of power system, computer equipment and storage medium

Publications (2)

Publication Number Publication Date
CN111027058A CN111027058A (en) 2020-04-17
CN111027058B true CN111027058B (en) 2023-10-27

Family

ID=70201368

Family Applications (1)

Application Number Title Priority Date Filing Date
CN201911097514.2A Active CN111027058B (en) 2019-11-12 2019-11-12 Method for detecting data attack of power system, computer equipment and storage medium

Country Status (1)

Country Link
CN (1) CN111027058B (en)

Families Citing this family (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2021212377A1 (en) * 2020-04-22 2021-10-28 深圳市欢太数字科技有限公司 Method and apparatus for determining risky attribute of user data, and electronic device
CN111651337B (en) * 2020-05-07 2022-07-12 哈尔滨工业大学 SRAM memory space service fault classification failure detection method
CN111669385B (en) * 2020-05-29 2021-11-23 重庆理工大学 Malicious traffic monitoring system fusing deep neural network and hierarchical attention mechanism
CN111669384B (en) * 2020-05-29 2021-11-23 重庆理工大学 Malicious flow detection method integrating deep neural network and hierarchical attention mechanism
CN111600393B (en) * 2020-06-18 2020-12-25 国网四川省电力公司电力科学研究院 Method for reducing voltage measurement data of transformer substation in different voltage classes and identification method
CN112072708B (en) * 2020-07-27 2022-05-17 中国电力科学研究院有限公司 Method for improving wind power consumption level of electric power system
CN111880998B (en) * 2020-07-30 2022-09-02 平安科技（深圳）有限公司 Service system anomaly detection method and device, computer equipment and storage medium
CN113709089A (en) * 2020-09-03 2021-11-26 南宁玄鸟网络科技有限公司 System and method for filtering illegal data through Internet of things
CN112115999B (en) * 2020-09-15 2022-07-01 燕山大学 Wind turbine generator fault diagnosis method of space-time multi-scale neural network
CN112115184A (en) * 2020-09-18 2020-12-22 平安科技（深圳）有限公司 Time series data detection method and device, computer equipment and storage medium
CN112383518A (en) * 2020-10-30 2021-02-19 广东工业大学 Botnet detection method and device
CN112464848B (en) * 2020-12-07 2023-04-07 国网四川省电力公司电力科学研究院 Information flow abnormal data monitoring method and device based on density space clustering
CN112926646B (en) * 2021-02-22 2023-07-04 上海壁仞智能科技有限公司 Data batch normalization method, computing device, and computer-readable storage medium
CN112929381B (en) * 2021-02-26 2022-12-23 南方电网科学研究院有限责任公司 Detection method, device and storage medium for false injection data
CN112906673A (en) * 2021-04-09 2021-06-04 河北工业大学 Lower limb movement intention prediction method based on attention mechanism
CN113177366B (en) * 2021-05-28 2024-02-02 华北电力大学 Comprehensive energy system planning method and device and terminal equipment
CN113765880B (en) * 2021-07-01 2022-05-20 电子科技大学 Power system network attack detection method based on space-time correlation
CN115051834B (en) * 2022-05-11 2023-05-16 华北电力大学 Novel power system APT attack detection method based on STSA-transformer algorithm
CN115086029A (en) * 2022-06-15 2022-09-20 河海大学 Network intrusion detection method based on two-channel space-time feature fusion
CN116915513B (en) * 2023-09-14 2023-12-01 国网江苏省电力有限公司常州供电分公司 False data injection attack detection method and device
CN117527450A (en) * 2024-01-05 2024-02-06 南京邮电大学 Method, system and storage medium for detecting false data injection attack of power distribution network

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107961007A (en) * 2018-01-05 2018-04-27 重庆邮电大学 A kind of electroencephalogramrecognition recognition method of combination convolutional neural networks and long memory network in short-term
CN109784480A (en) * 2019-01-17 2019-05-21 武汉大学 A kind of power system state estimation method based on convolutional neural networks
CN110213244A (en) * 2019-05-15 2019-09-06 杭州电子科技大学 A kind of network inbreak detection method based on space-time characteristic fusion

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CA3000166A1 (en) * 2017-04-03 2018-10-03 Royal Bank Of Canada Systems and methods for cyberbot network detection

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN107961007A (en) * 2018-01-05 2018-04-27 重庆邮电大学 A kind of electroencephalogramrecognition recognition method of combination convolutional neural networks and long memory network in short-term
CN109784480A (en) * 2019-01-17 2019-05-21 武汉大学 A kind of power system state estimation method based on convolutional neural networks
CN110213244A (en) * 2019-05-15 2019-09-06 杭州电子科技大学 A kind of network inbreak detection method based on space-time characteristic fusion

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
杨永娇 等."一种基于深度 Encoder-Decoder 神经网络的智能 电网数据服务器流量异常检测算法".《计算机与现代化》.2019,(第10期),66-71. *

Also Published As

Publication number Publication date
CN111027058A (en) 2020-04-17

Similar Documents

Publication Publication Date Title
CN111027058B (en) Method for detecting data attack of power system, computer equipment and storage medium
Shi et al. Artificial intelligence techniques for stability analysis and control in smart grids: Methodologies, applications, challenges and future directions
Appiah et al. Long short-term memory networks based automatic feature extraction for photovoltaic array fault diagnosis
Zhang et al. Data-based line trip fault prediction in power systems using LSTM networks and SVM
Shen et al. Wind speed prediction of unmanned sailboat based on CNN and LSTM hybrid neural network
Liu et al. Communication-efficient federated learning for anomaly detection in industrial internet of things
CN109766992B (en) Industrial control abnormity detection and attack classification method based on deep learning
Li et al. An intelligent transient stability assessment framework with continual learning ability
CN116245033B (en) Artificial intelligent driven power system analysis method and intelligent software platform
Sekar et al. An improved power quality disturbance detection using deep learning approach
Hajji et al. Fault detection and diagnosis in grid-connected PV systems under irradiance variations
Zhu et al. Data/model jointly driven high-quality case generation for power system dynamic stability assessment
CN115221233A (en) Transformer substation multi-class live detection data anomaly detection method based on deep learning
Fang et al. A data-driven method for online transient stability monitoring with vision-transformer networks
Ke et al. Compound fault diagnosis method of modular multilevel converter based on improved capsule network
Beattie et al. A Robust and Explainable Data-Driven Anomaly Detection Approach For Power Electronics
CN115684786A (en) Inverter switching tube health diagnosis method, device and system based on gram angular field and parallel CNN
Du et al. A hierarchical power system transient stability assessment method considering sample imbalance
Wu et al. Identification and correction of abnormal measurement data in power system based on graph convolutional network and gated recurrent unit
Fang et al. Power distribution transformer fault diagnosis with unbalanced samples based on neighborhood component analysis and k-nearest neighbors
Adhikari et al. Real-Time Short-Term Voltage Stability Assessment using Temporal Convolutional Neural Network
Chen et al. Distribution-aware graph representation learning for transient stability assessment of power system
Wan et al. A review of power electronic parametric fault diagnosis methods
Liu et al. Fault diagnosis of photovoltaic array based on XGBoost method
Pei et al. Data-driven measurement tampering detection considering spatial-temporal correlations

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant