CN112165491B - Cross-space cascading fault self-adaptive early warning method and system for power grid information physical system - Google Patents

Abstract

The invention discloses a Grid Cyber-Physical Systems (GCPS) cross-Space Cascading failure self-adaptive early warning method, which is a self-adaptive early warning method suitable for a Grid Cyber-Physical system cross-Space Cascading Failure (CFAS) caused by cooperative network attack. The CFAS self-adaptive early warning method provided by the invention can accurately judge the CFAS type and the evolution process implemented by an attacker, and can assist a GCPS defender to timely block the CFAS from continuing to evolve under the condition of avoiding the interference network attack confusion.

Description

Cross-space cascading fault self-adaptive early warning method and system for power grid information physical system

Technical Field

The invention belongs to the field of safety protection of grid cyber-Physical Systems (GCPS), and relates to a cross-space cascade fault self-adaptive early warning method and system of a cyber-Physical system tolerant to periodic fault hazards.

Background

An attacker can cause a series of Space-time cooperative physical faults at a plurality of power grid physical nodes through cooperative network attack to form a large-scale cross-Space Cascade Fault (CFAS), so that the safety margin of a power grid physical system is reduced, even large-scale power failure is caused, and the stable operation of the GCPS is seriously influenced. Accurate early warning is carried out in the evolution process of the CFAS, a GCPS defender can be assisted to adopt effective protective measures to block or delay the continuous development of the CFAS, and the capability of the GCPS to resist malicious attacks is improved.

At present, research aiming at a CFAS early warning method is in a starting stage, most of research contents are a mechanism and a detection method for forming a small-range power grid physical fault caused by network attack, and the CFAS implemented by an attacker is difficult to accurately judge: firstly, the existing research object is only a small-range physical fault caused by network attack, the space-time cooperative relationship among a plurality of physical faults in the CFAS is not fully considered, and the type and the evolution trend of the CFAS are difficult to infer; secondly, the existing fault detection method works in a mode of harm zero tolerance and is difficult to provide effective decision support for blocking CFAS evolution, the existing fault detection method immediately alarms after a potential fault is found, a large number of false alarms are easily formed, even a GCPS defender is misled by interference network attack and adopts a wrong handling mode to further enlarge fault harm, frequent actions of three defense lines of a power system and a power failure defense system are caused, limited defense resources are consumed, and GCPS toughness is reduced. Therefore, an accurate and effective CFAS early warning method is urgently needed to be designed.

Disclosure of Invention

The invention aims to solve the technical problems in the prior art, provides a CFAS self-adaptive early warning method for a power grid information physical system, which is tolerant to stage fault hazards, aiming at CFAS caused by cooperative network attack, and can be applied to CFAS early warning of GCPS.

The method adopts the technical scheme that: a cross-space cascading fault self-adaptive early warning method for a power grid information physical system is characterized by comprising the following steps:

step 1: constructing a GCPS running state transition model considering the influence of the cross-space cascade fault stage fault hazard, wherein the GCPS running state transition model comprises 5 GCPS running states and 11 state transition and transition conditions;

wherein 5 GCPS running states are respectively a normal state Q₁Vulnerable operating State Q₂Operational state Q in the presence of a network attack₃Degraded service operating State Q₄And a shutdown state Q₅；

The 11 state transitions and transition conditions include Q₁→Q₁Indicating that the GCPS continues normal operation; q₁→Q₂Indicating that the GCPS operation has a bug; q₂→Q₁Indicating that the vulnerability is fixed; q₂→Q₃Indicating that the GCPS is attacked by the network; q₃→Q₁，Q₄→Q₁Indicating that the CFAS can be warned immediately and blocked from continuing to evolve; q₃→Q₄Indicating that CFAS-tolerant staged fault hazards are observed continuously; q₃→Q₅Indicating uncontrolled GCPS; q₄→Q₄Indicating continuous observation of CFAS evolution; q₄→Q₅Indicating an extended fault hazard; q₅→Q₁Indicating fault recovery and updating a CFAS knowledge base;

step 2: establishing an offline CFAS knowledge base and updating periodically;

and step 3: detecting a cooperative network attack;

capturing network flow and message of each station and GCPS real-time operation data in real time, and detecting whether network attack exists; will state Q₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and the step is switched to step 6 to execute calculation and adjustment basis;

and 4, step 4: constructing a control object set of early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

And 5: setting constraint conditions of the self-adaptive control process, and calculating the periodic fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

step 6: adaptively adjusting a control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is Q₃→Q₁And go to step 7; if there is more than one of F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold value, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is Q₃→Q₄And judging the residue

Whether the self-adaptive regulation basis is met or not, if so, turning to the step 7, if not, reducing the scale of the control object set F (t), and continuously observing the rest

Let t be t +1, and go to step 5 to calculate the periodic fault hazard; if not, judging whether the information security defense measures are executed or not,if the fault is executed, immediately alarming and assisting fault blocking, turning to step 7, if the fault is not executed, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to step 5 for calculating stage fault hazards;

and 7: outputting an early warning result and updating a CFAS knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finish CFAS early warning.

The technical scheme adopted by the system of the invention is as follows: a power grid information physical system cross-space cascading fault self-adaptive pre-warning system is characterized by comprising a first module, a second module, a third module, a fourth module, a fifth module, a sixth module and a seventh module;

the module I is used for constructing a GCPS running state transition model tolerant to stage fault hazards, and comprises 5 GCPS states and 11 state transition and transition conditions;

wherein 5 GCPS running states are respectively a normal state Q₁Vulnerable operating State Q₂Operational state Q in the presence of a network attack₃Degraded service operating State Q₄And a shutdown state Q₅；

The 11 state transitions and transition conditions include Q₁→Q₁Indicating that the GCPS continues normal operation; q₁→Q₂Indicating that the GCPS operation has a bug; q₂→Q₁Indicating that the vulnerability is fixed; q₂→Q₃Indicating that the GCPS is attacked by the network; q₃→Q₁，Q₄→Q₁Indicating that the CFAS can be warned immediately and blocked from continuing to evolve; q₃→Q₄Indicating that CFAS-tolerant staged fault hazards are observed continuously; q₃→Q₅Indicating uncontrolled GCPS; q₄→Q₄Indicating continuous observation of CFAS evolution; q₄→Q₅Indicating an extended fault hazard; q₅→Q₁Indicating fault recovery and updating the CFAS repository.

The module II is used for establishing an offline CFAS knowledge base and updating the offline CFAS knowledge base periodically;

the module III is used for detecting the cooperative network attack;

capturing network flow and message of each station and GCPS real-time operation data in real time, and detecting whether network attack exists; will state Q₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and calculation and regulation are executed;

the module IV is used for constructing a control object set for early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

The module V is used for setting constraint conditions of the self-adaptive control process and calculating the stage fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

the module six is used for adaptively adjusting a control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is S₃→S₁And go to module 7; if there is more than one of F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is S₃→S₄And judging the residue

Whether the self-adaptive regulation basis is met or not, if so, the control module is switched to a module 7, if not, the scale of the control object set F (t) is reduced, and the rest is continuously observed

Let t be t +1 and turn to calculating the stage fault hazard; if not, judging whether the information security defense measures are executed or not, if so, immediately alarming and assisting fault blocking, turning to a module 7, if not, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to calculating the stage fault hazards;

the module III is used for outputting an early warning result and updating a CFAS (computational fluid dynamics) knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finish CFAS early warning.

The beneficial effects of the invention include:

1. a control object set in the self-adaptive control process is constructed according to the network attack observation sequence at the initial moment, so that the early warning purpose is increased, the initial scale of the control object set is restricted, and the blind matching of all known CFAS types in a CFAS (computational fluid dynamics) knowledge base is avoided;

2. by tolerating gracefully staged fault hazards, the analysis time to discern CFAS is increased to more fully observe attack behavior and fault hazards.

3. The observation error and the prediction error are used as the self-adaptive adjustment basis of CFAS early warning, the scale of a control object set is dynamically reduced, the influence of interference network attack is reduced, and the control object approaches to the CFAS implemented by an attacker.

4. The defender can timely and accurately block the unformed fault path according to the CFAS early warning result so as to eliminate or reduce fault damage and reduce defense cost.

Drawings

FIG. 1 is a flow chart of a method according to an embodiment of the present invention.

Fig. 2 is a schematic diagram of a GCPS operating state transition model for tolerating the hazards of the periodic faults according to an embodiment of the present invention.

Detailed Description

In order to facilitate the understanding and implementation of the present invention for those of ordinary skill in the art, the present invention is further described in detail with reference to the accompanying drawings and examples, it is to be understood that the embodiments described herein are merely illustrative and explanatory of the present invention and are not restrictive thereof.

Referring to fig. 1, the self-adaptive early warning method for cross-space cascading faults of a power grid cyber physical system (CFAS self-adaptive early warning method) provided by the invention comprises the following steps:

step 1: constructing a GCPS running state migration model tolerant to stage fault hazards, wherein the GCPS running state migration model comprises 5 GCPS states and 11 state migration and migration conditions;

referring to fig. 2, in the GCPS operation state transition model for tolerating the periodic fault hazard provided in the embodiment, 5 GCPS operation states are respectively a normal state Q₁Vulnerable operating State Q₂Operational state Q in the presence of a network attack₃Degraded service operating State Q₄And a shutdown state Q₅；

The 11 state transitions and transition conditions include Q₁→Q₁Indicating that the GCPS continues normal operation; q₁→Q₂Indicating that the GCPS operation has a bug; q₂→Q₁Indicating that the vulnerability is fixed; q₂→Q₃Indicating that the GCPS is attacked by the network; q₃→Q₁，Q₄→Q₁Indicating that the CFAS can be warned immediately and blocked from continuing to evolve; q₃→Q₄Indicating that CFAS-tolerant staged fault hazards are observed continuously; q₃→Q₅Indicating uncontrolled GCPS; q₄→Q₄Indicating continuous observation of CFAS evolution; q₄→Q₅Indicating an extended fault hazard; q₅→Q₁Indicating fault recovery and updating CFAS repository

Step 2: establishing an offline CFAS knowledge base and updating periodically;

the defender establishes an offline CFAS knowledge base according to the mastered cascading failure knowledge and updates the CFAS knowledge base regularly. In the embodiment, the power grid cascading failure cases caused by known network attacks or communication failures are collected to serve as data sources of the knowledge base, and the CFAS type is presumed according to the existing research results.

And step 3: detecting a cooperative network attack;

the network attack detection nodes deployed in the intelligent substations capture the network flow and message of each substation and GCPS real-time operation data in real time, and detect whether network attack exists or not; will state Q₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and the step is switched to step 6 to execute calculation and mediation basis;

and 4, step 4: constructing a control object set of early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

The specific implementation of the step 4 comprises the following substeps:

step 4.1: t is t₀At the initial moment, combining the observation results of all the network attack detection nodes to obtain t₀Network attack observation sequence X (t) of time₀) Let us order

Wherein

Is t₀Single network attacks initiated at a moment;

step 4.2: x (t) is inferred according to evolution rules (Wangyufei, Lijune, Qiujia and the like) of physical faults of a power grid caused by network attacks, "a cross-space cascading fault selection and sorting method for considering attack benefits and losses", power grid technology, 2018, 42 (12): 3926-₀) The network attack in (1) is what kind of compound fault is caused at which physical nodes; note some compound fault as y_i，j，t*：

Wherein y is_i，j，t*Indicating that the ith composite fault occurs on the physical node j at the moment t, x' indicating a secondary fault, and x_i，j，t*Indicating that the physical node j has the ith physical fault at the time t;

in this embodiment, the principle of attack profit and loss is used for reasoning, as shown in formula 1.

In equation 1, O is the expected target of attack, O (t)^*) For each stage of the attack sub-target, phi_kFor a cooperative network attack scheme, x 'is network attack, x' is secondary failure,

is t^*At time instant physical node j experiences a physical fault of type i,

to make it stand againAnd failure, F_kCan be made of phi_kInitiated CFAS type, f_gainAn attack revenue function for a composite fault or CFAS;

step 4.3: searching the CFAS knowledge base to obtain various potential CFAS types containing the fault paths, and recording a certain potential CFAS type as

Order to

And in various ways

Set of as t₀Control object set F (t) at initial time₀) Let us order

And 5: setting constraint conditions of the self-adaptive control process and calculating the periodic fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

the invention provides a principle of tolerance of GCPS operation to the damage of stage faults, which comprises the following steps: in the CFAS early warning process, when the CFAS type and the evolution trend thereof implemented by an attacker can not be deduced according to the currently observed network attack and the stage fault hazard, comparing the current stage fault hazard with tolerance threshold values preset for various potential CFAS stage fault hazard tolerance degrees according to the GCPS running state: if the current phasic failure hazard is below a threshold, the GCPS is moderately allowed to operate in a degraded service mode in a state where a physical failure exists (such as a reduced safety margin, a small amount of primary equipment temporarily out of control), and continuously observe; if the current stage fault hazard reaches or exceeds a threshold value, the following measures are selected according to the current GCPS running state and the capability of a GCPS defender: firstly, when the GCPS does not operate in an emergency state, part of compound faults are blocked to reduce the damage of the stage faults and continuously observe; secondly, when the GCPS is in an emergency state or the capability of a GCPS defender, the emergency warning device immediately alarms and carries out emergency control and recovery of faults.

Based on the above principle of tolerance of the GCPS operation state to the damage of the periodic fault, the specific implementation of step 5 includes the following sub-steps:

step 5.1: setting a tolerance threshold delta of the stage fault hazard according to the GCPS running state and an expected defense target_max；

In formula 2, P_maxThe upper limit of active power allowed to be lost under the constraint condition of the periodic fault hazard tolerance principle; h_maxThe upper limit of the number of the primary equipment which is allowed to be out of control temporarily under the principle constraint condition is set according to the extreme value of the active regulation capacity of a defender on the physical system of the power grid; t is_maxAn upper limit on the duration of allowable periodic faults, T (y), subject to the principle constraints_i，j，t*) To form a single y_i，j，t*Time of (y)_i，j，t*Indicating that the physical node j has the ith composite fault at the time t;

step 5.2: calculating the hazard delta (Y) of the periodic fault according to the active power loss, the out-of-control of the primary equipment and the duration of the periodic fault_i，j，t)；

In formula 3, Y_i，j，tComposite fault y at time t for a potential CFAS of some kind_i，j，t*Set of (2), Δ (Y)_i，j，t) In order to be a risk of a stage failure,

is a complex number of virtualA part number; p (Y)_i，j，t) For the loss of active power up to time t, P (t)₀) Is t₀The active total amount of the power grid at the moment, P (t), is the active total amount of the power grid at the moment t; h (Y)_i，j，t) As primary equipment runaway rate, H (t)₀) Is t₀The total number of the controllable primary equipment at the moment, H (t) is the total number of the controllable primary equipment at the moment t;

a duration factor for a periodic fault; t > t₀。

Step 6: adaptively adjusting a control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is Q₃→Q₁And go to step 7; if there is more than one of F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold value, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is Q₃→Q₄And judge the multiplication residue

Whether the self-adaptive regulation basis is met or not, if so, turning to the step 7, if not, reducing the scale of the control object set F (t), and continuously observing the rest

Let t be t +1 and go to step 5.2 to calculate the periodic fault hazard; if not, judging whether the information security defense measures are executed or not, if so, immediately alarming and assisting fault blocking,turning to step 7, if not, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to step 5.2 to calculate the stage fault hazards;

in this embodiment, the specific implementation of step 6 includes the following sub-steps:

step 6.1: if F (t) is present only uniquely

The early warning is directly carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is Q₃→Q₁And go to step 7; otherwise, determine the various types

Δ (Y) of_i，j，t) Whether or not the threshold value δ is satisfied_maxThe constraint constraints of (2) are discussed separately as follows:

case a: if 0. ltoreq. max { Δ (Y)_i，j，t)}＜δ_maxAll of

Δ (Y) of_i，j，t) If the constraint conditions of the threshold values are met, each CFAS is tolerated to continue to evolve, the GCPS enters the degradation service, and the transition process of the running state is Q₃→Q₄Go to step 6.2;

case b: if delta_max≤min{Δ(Y_i，j，t) All of

Δ (Y) of_i，j，t) All of which do not meet the threshold constraint, a limited number of information security defensive measures are performed against the various potential CFAS in an attempt to block part Y thereof_i，j，tDecrease its delta (Y)_i，j，t) And continuously observing, wherein the transition process of the GCPS running state is Q₃→Q₄Turning to step 5.2 to calculate the stage fault hazard; conversely, after taking information security defense measures

Δ (Y) of_i，j，t) If the threshold value of the constraint condition is not met, the GCPS defense system immediately alarms and assists a GCPS defense person to carry out fault blocking and emergency control through physical fault defense measures such as three defense lines of a power system, a power failure defense system and the like, and the transition process of the GCPS running state is Q₃→Q₅→Q₁Or Q₄→Q₅→Q₁；

Case c: if min { Δ (Y)_i，j，t)}＜δ_max≤max{Δ(Y_i，j，t) I.e. part

If the constraint condition of the threshold is satisfied, the various kinds of the constraint conditions are satisfied

Tolerating the damage of the stage fault and continuously observing according to the mode of the case a, and for other various conditions which do not meet the constraint condition

Limiting the staged fault hazards according to the mode of the condition b, and turning to the step 6.2;

step 6.2: calculating and matching adaptive adjustment basis;

including calculating an observed error e of a phased fault hazard_Φ(t) prediction error e from the network attack prediction sequence_X(t +1), as in equation 3;

in formula 3, x (t) is a network attack observation sequence at time t;

and

respectively predicting sequences of network attacks at the moment t +1 deduced according to X (t)With the set of staged compound faults at time t,

for compound failures presumed from network attacks, f_gain() An attack gain function for a fault path (Wangyufei, Lijune, Qijian, and the like), "a cross-space cascading failure selection ordering method for considering attack gains and losses", a power grid technology, 2018, 42 (12): 3926-; e.g. of the type_Δ(t) observation errors of the stage fault hazards;

is the hazard of the staged compound fault at the moment t; Δ (y (t)) is the stage-wise fault hazard for each potential CFAS; e.g. of the type_X(t +1) is a prediction error of the network attack prediction sequence;

e is to be_Δ(t) and e_X(t +1) is used as the adjusting basis of the CFAS self-adaptive pre-alarm, and the judgment is carried out according to the following four conditions:

1、e_Δ(t)≈0&&e_X(t +1) ≈ 0: determining the CFAS type and the evolution trend, and turning to step 7;

2、e_Δ(t)＞0&&e_X(t +1) ≈ 0: knowing the historical stage faults, but not knowing the future evolution trend, and continuously observing;

3、e_Δ(t)≈0&&e_X(t +1) > 0: missing detection exists in historical periodic faults, the future evolution trend is known, and observation is continued;

4、e_Δ(t)＞0&&e_X(t +1) > 0: and (3) continuously observing whether the historical stage faults and the evolution trend are unknown:

step 6.3: judge the residue

Whether the adjustment basis is met is judged, if so, the step 7 is carried out, and if not, the step 6.4 is carried out;

in the formula 5, F_kThe type of CFAS actually implemented for the attacker; t is t_hEach error at the moment is approximate to 0;

step 6.4: adaptively adjusting a control object set;

reducing the solution set size according to the adjustment basis, as shown in formula 5, and then turning to step 5.2 to calculate the stage fault hazard by setting t to t + 1;

F(t+1)＝F(t)-μ(e_Δ(t)，e_X(t+1)) (5)

s.t.Δ(Y(t))＜δ_max

in formula 6, μ () is the criterion for CFAS warning; f (t) is a solution set at the time t, and the scale of the solution set is gradually reduced according to the criterion function.

And 7: outputting an early warning result and updating a CFAS knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finish CFAS early warning.

The embodiment is applied to a power information physical system, which comprises a GCPS dispatching center and a plurality of intelligent substations. And a CFAS early warning decision node is deployed in a GCPS dispatching center, the CFAS early warning decision node senses the operation state of a physical system of the power grid in real time through an SCADA and senses network attacks generated by each station in real time through a network attack detection node to judge the CFAS implemented by an attacker, and can guide each information security defense node to block a composite fault so that the stage fault hazard of the potential CFAS meets the constraint condition. And deploying information security defense nodes and network attack detection nodes in each intelligent substation. The network attack detection node captures network messages in a station control layer network and a process layer network in real time, detects real-time network attacks in the local station according to the network messages and calculates various composite fault types possibly caused by the network attacks. The information security defense node carries out attack blocking and isolation on the detected network attack through various information security defense measures and prevents or delays the formation of corresponding compound faults.

The power grid information physics system CFAS self-adaptive pre-warning system provided by the embodiment comprises a first module, a second module, a third module, a fourth module, a fifth module, a sixth module and a seventh module;

the first module is used for constructing a GCPS running state transition model tolerant to stage fault hazards, and comprises 5 GCPS states and 11 state transition and transition conditions;

the module II is used for establishing an offline CFAS knowledge base and updating the offline CFAS knowledge base periodically;

a third module, configured to detect a collaborative network attack;

capturing network flow and message of each station and GCPS real-time operation data in real time, and detecting whether network attack exists; will state S₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and calculation and mediation basis is executed;

a module IV for constructing a control object set of early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

A fifth module, configured to set constraint conditions for an adaptive control process and calculate a periodic fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

a sixth module, configured to adaptively adjust the control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is S₃→S₁And go to step 7; if there is more than one advantage in F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is S₃→S₄And judging the residue

Whether the self-adaptive regulation basis is met or not, if so, turning to the step 7, if not, reducing the scale of the control object set F (t), and continuously observing the rest

Let t be t +1 and turn to calculating the stage fault hazard; if not, judging whether the information security defense measures are executed or not, if so, immediately alarming and assisting fault blocking, turning to the step 7, if not, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to calculating the stage fault hazards;

a seventh module, configured to output an early warning result and update a CFAS knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finishAnd (5) CFAS early warning.

It should be understood that parts of the specification not set forth in detail are well within the prior art.

It should be understood that the above description of the preferred embodiments is given for clarity and not for any purpose of limitation, and that various changes, substitutions and alterations can be made herein without departing from the spirit and scope of the invention as defined by the appended claims.

Claims (6)

1. A cross-space cascading fault self-adaptive early warning method for a power grid information physical system is characterized by comprising the following steps:

step 1: constructing a GCPS running state transition model considering the influence of the cross-space cascade fault stage fault hazard, wherein the GCPS running state transition model comprises 5 GCPS running states and 11 state transition and transition conditions;

wherein 5 GCPS running states are respectively a normal state Q₁Vulnerable operating State Q₂Operational state Q in the presence of a network attack₃Degraded service operating State Q₄And a shutdown state Q₅；

The 11 state transitions and transition conditions include Q₁→Q₁Indicating that the GCPS continues normal operation; q₁→Q₂Indicating that the GCPS operation has a bug; q₂→Q₁Indicating that the vulnerability is fixed; q₂→Q₃Indicating that the GCPS is attacked by the network; q₃→Q₁，Q₄→Q₁Indicating that the CFAS can be warned immediately and blocked from continuing to evolve; q₃→Q₄Indicating that CFAS-tolerant staged fault hazards are observed continuously; q₃→Q₅Indicating uncontrolled GCPS; q₄→Q₄Indicating continuous observation of CFAS evolution; q₄→Q₅Indicating an extended fault hazard; q₅→Q₁Indicating fault recovery and updating a CFAS knowledge base;

step 2: establishing an offline CFAS knowledge base and updating periodically;

and step 3: detecting a cooperative network attack;

capturing network flow and message of each station and GCPS real-time operation data in real time, and detecting whether network attack exists; will state Q₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and the step is switched to step 6 to execute calculation and adjustment basis;

and 4, step 4: constructing a control object set of early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

And 5: setting constraint conditions of the self-adaptive control process, and calculating the periodic fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

step 6: adaptively adjusting a control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is Q₃→Q₁And go to step 7; if there is more than one of F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold value, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is Q₃→Q₄And judging the residue

Whether the self-adaptive regulation basis is met or not, if so, turning to the step 7, if not, reducing the scale of the control object set F (t), and continuously observing the rest

Let t be t +1, and go to step 5 to calculate the periodic fault hazard; if not, judging whether the information security defense measures are executed or not, if so, immediately alarming and assisting fault blocking, turning to step 7, if not, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to step 5 to calculate the stage fault hazards;

and 7: outputting an early warning result and updating a CFAS knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finish CFAS early warning.

2. The power grid cyber-physical system cross-space cascading failure adaptive early warning method according to claim 1, wherein: in step 2, the defender establishes an offline CFAS knowledge base according to the mastered cascading failure knowledge and updates the knowledge base regularly.

3. The power grid cyber-physical system cross-space cascading failure adaptive early warning method according to claim 1, wherein: the specific implementation of the step 4 comprises the following substeps:

step 4.1: t is t₀At the initial moment, combining the observation results of all the network attack detection nodes to obtain t₀Network attack observation sequence X (t) of time₀) Let us order

Wherein

Is t₀Single network attacks initiated at a moment;

step 4.2: reasoning X (t) according to evolution rule of network attack induced grid physical fault₀) The network attack in (1) is what kind of compound fault is caused at which physical nodes; record a compound fault as

Wherein y is_i，j，t*Indicating that the ith composite fault occurs on the physical node j at the moment t, x' indicating a secondary fault, and x_i，j，t*Indicating that the physical node j has the ith physical fault at the time t;

step 4.3: searching the CFAS knowledge base to obtain various potential CFAS types containing the fault paths, and recording a certain potential CFAS type as

Order to

And in various ways

Set of as t₀Control object set F (t) at initial time₀) Let us order

4. The power grid cyber-physical system cross-space cascading failure adaptive early warning method according to claim 3, wherein the specific implementation of the step 5 comprises the following sub-steps:

step 5.1: setting a tolerance threshold delta of the stage fault hazard according to the GCPS running state and an expected defense target_max；

In formula 1, P_maxThe upper limit of active power allowed to be lost under the constraint condition of the periodic fault hazard tolerance principle; h_maxThe upper limit of the number of the primary equipment which is allowed to be out of control temporarily under the principle constraint condition is set according to the extreme value of the active regulation capacity of a defender on the physical system of the power grid; t is_maxAn upper limit on the duration of allowable periodic faults, T (y), subject to the principle constraints_i，j，t*) To form a single y_i，j，t*Time of (y)_i，j，t*Indicating that the physical node j has the ith composite fault at the time t;

step 5.2: calculating the hazard delta (Y) of the periodic fault according to the active power loss, the out-of-control of the primary equipment and the duration of the periodic fault_i，j，t)；

In formula 2, Y_i，j，tComposite fault y at time t for a potential CFAS of some kind_i，j，t*Set of (2), Δ (Y)_i，j，t) In order to be a risk of a stage failure,

the imaginary part of the complex number; p (Y)_i，j，t) For the loss of active power up to time t, P (t)₀) Is t₀The active total amount of the power grid at the moment, P (t), is the active total amount of the power grid at the moment t; h (Y)_i，j，t) As primary equipment runaway rate, H (t)₀) Is t₀The total number of the controllable primary equipment at the moment, H (t) is the total number of the controllable primary equipment at the moment t;

a duration factor for a periodic fault; t > t₀。

5. The power grid cyber-physical system cross-space cascading failure adaptive early warning method according to claim 4, wherein the specific implementation of the step 6 comprises the following sub-steps:

step 6.1: if F (t) is present only uniquely

The early warning is directly carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is Q₃→Q₁And go to step 7; otherwise, determine the various types

Δ (Y) of_i，j，t) Whether or not the threshold value δ is satisfied_maxThe constraint constraints of (2) are discussed separately as follows:

case a: if 0. ltoreq. max { Δ (Y)_i，j，t)}＜δ_maxAll of

Δ (Y) of_i，j，t) If the constraint conditions of the threshold values are met, each CFAS is tolerated to continue to evolve, the GCPS enters the degradation service, and the transition process of the running state is Q₃→Q₄Go to step 6.2;

case b: if delta_max≤min{Δ(Y_i，j，t) All of

Δ (Y) of_i，j，t) All of which do not meet the threshold constraint, a limited number of information security defensive measures are performed against the various potential CFAS in an attempt to block part Y thereof_i，j，tDecrease its delta (Y)_i，j，t) And continuously observing, wherein the transition process of the GCPS running state is Q₃→Q₄Turning to step 5 to calculate the periodic fault hazard; conversely, after taking information security defense measures

Δ (Y) of_i，j，t) If the threshold value of the constraint condition is not met, the warning is immediately given and the GCPS defender is assisted to carry out fault blocking and emergency control through physical fault defense measures, wherein the transition process of the GCPS running state is Q₃→Q₅→Q₁Or Q₄→Q₅→Q₁；

Case c: if min { Δ (Y)_i，j，t)}＜δ_max≤max{Δ(Y_i，j，t) I.e. part

If the constraint condition of the threshold is satisfied, the various kinds of the constraint conditions are satisfied

Tolerating the damage of the stage fault and continuously observing according to the mode of the case a, and for other various conditions which do not meet the constraint condition

Limiting the staged fault hazards according to the mode of the condition b, and turning to the step 6.2;

step 6.2: calculating and matching adaptive adjustment basis;

including calculating an observed error e of a phased fault hazard_Φ(t) prediction error e from the network attack prediction sequence_X(t +1), as in equation 3;

in formula 3, x (t) is a network attack observation sequence at time t;

and

respectively a network attack prediction sequence at the t +1 moment deduced according to X (t) and a periodic composite fault set at the t moment,

for compound failures presumed from network attacks, f_gain() An attack revenue function for the failed path; e.g. of the type_Δ(t) observation errors of the stage fault hazards;

is the hazard of the staged compound fault at the moment t; Δ (y (t)) is the stage-wise fault hazard for each potential CFAS; e.g. of the type_X(t +1) is a prediction error of the network attack prediction sequence;

e is to be_Δ(t) and e_X(t +1) is used as the adjusting basis of the CFAS self-adaptive pre-alarm, and the judgment is carried out according to the following four conditions:

1、e_Δ(t)≈0&&e_X(t +1) ≈ 0: determining the CFAS type and the evolution trend, and turning to step 7;

2、e_Δ(t)＞0&&e_X(t +1) ≈ 0: knowing the historical stage faults, but not knowing the future evolution trend, and continuously observing;

3、e_Δ(t)≈0&&e_X(t +1) > 0: missing detection exists in historical periodic faults, the future evolution trend is known, and observation is continued;

4、e_Δ(t)＞0&&e_X(t +1) > 0: continuously observing the historical periodic faults and the evolution trend which are unknown;

step 6.3: judge the residue

Whether the adjustment basis is met is judged, if so, the step 7 is carried out, and if not, the step 6.4 is carried out;

in formula 4, F_kThe type of CFAS actually implemented for the attacker; t is t_hEach error at the moment is approximate to 0;

step 6.4: adaptively adjusting a control object set;

reducing the collective scale of the solutions according to the regulation basis, as shown in formula 5, and then turning to step 5 to calculate the stage fault hazard by setting t to t + 1;

F(t+1)＝F(t)-μ(e_Δ(t)，e_X(t+1)) (5)

s.t.Δ(Y(t))＜δ_max

in formula 5, μ () is the criterion for CFAS warning; f (t) is a solution set at the time t, and the scale of the solution set is gradually reduced according to the criterion function.

6. A power grid information physical system cross-space cascading fault self-adaptive pre-warning system is characterized by comprising a first module, a second module, a third module, a fourth module, a fifth module, a sixth module and a seventh module;

the module I is used for constructing a GCPS running state transition model tolerant to stage fault hazards, and comprises 5 GCPS states and 11 state transition and transition conditions;

wherein 5 GCPS running states are respectively a normal state Q₁Vulnerable operating State Q₂Operational state Q in the presence of a network attack₃Degraded service operating State Q₄In the state of and out of serviceState Q₅；

The 11 state transitions and transition conditions include Q₁→Q₁Indicating that the GCPS continues normal operation; q₁→Q₂Indicating that the GCPS operation has a bug; q₂→Q₁Indicating that the vulnerability is fixed; q₂→Q₃Indicating that the GCPS is attacked by the network; q₃→Q₁，Q₄→Q₁Indicating that the CFAS can be warned immediately and blocked from continuing to evolve; q₃→Q₄Indicating that CFAS-tolerant staged fault hazards are observed continuously; q₃→Q₅Indicating uncontrolled GCPS; q₄→Q₄Indicating continuous observation of CFAS evolution; q₄→Q₅Indicating an extended fault hazard; q₅→Q₁Indicating fault recovery and updating a CFAS knowledge base;

the module II is used for establishing an offline CFAS knowledge base and updating the offline CFAS knowledge base periodically;

the module III is used for detecting the cooperative network attack;

capturing network flow and message of each station and GCPS real-time operation data in real time, and detecting whether network attack exists; will state Q₃The moment of detecting the network attack for the first time is taken as the initial moment t of early warning₀(ii) a When the cooperative network attack is detected, judging whether the current time t is t or not₀If yes, inputting the network attack observation sequence X (t) at the initial moment₀) And then, early warning CFAS is started, if not, real-time network attack observation sequence X (t) and GCPS real-time operation data are input, and calculation and regulation are executed;

the module IV is used for constructing a control object set for early warning;

according to t₀Network attack observation sequence at initial moment for distinguishing various potential CFAS types

Control object set F (t) for constructing adaptive control process₀) Let t equal t₀；

The fifth module is used for setting a constraint strip of the adaptive control processChecking and calculating the stage fault hazard; setting a tolerance threshold delta for the risk of a periodic fault based on the GCPS operating state and an expected defense objective_maxAnd calculate various times at time t

Stage fault hazard Δ (y (t));

the module six is used for adaptively adjusting a control object set;

if only one is present in F (t)

Direct early warning is carried out to assist a GCPS defender to block the CFAS from continuing to evolve, and the transition process of the GCPS running state is S₃→S₁And go to module 7; if there is more than one of F (t)

Determine all residuals at time t

If the Δ (y (t)) of (a) meets the constraint condition of the threshold, if so, the CFAS is tolerated to continue to evolve and the GCPS enters the degraded service, and the transition process of the GCPS operation state is S₃→S₄And judging the residue

Whether the self-adaptive regulation basis is met or not, if so, the control module is switched to a module 7, if not, the scale of the control object set F (t) is reduced, and the rest is continuously observed

Let t be t +1 and turn to calculating the stage fault hazard; if not, judging whether the information security defense measures are executed or not, if so, immediately alarming and assisting fault blocking, turning to a module 7, if not, executing limited information security defense measures, trying to reduce partial fault hazards, and turning to calculationA periodic fault hazard;

the module III is used for outputting an early warning result and updating a CFAS (computational fluid dynamics) knowledge base;

the early warning result comprises the CFAS type F really implemented by the attacker_kAnd F, early-warned F and evolution trend_kAnd the fault occurrence scene is used as historical knowledge and added into a CFAS knowledge base to finish CFAS early warning.

Images