CN113904786B - False data injection attack identification method based on line topology analysis and tide characteristics - Google Patents

Abstract

The invention discloses a false data injection attack identification method based on line topology analysis and power flow characteristics. The steps include: 1) obtaining the historical power flow data and original topology structure of the power system; Inject some attack data into the data to obtain the power flow sample data with false data; 4) Extract the power flow characteristic value of the power flow sample data, and label whether there is attack data; 5) Based on the power flow characteristic value of the power flow sample data, establish a A graph convolutional network model for judging whether the power system is attacked; 6) Obtaining the current power flow data of the power system, and extracting the power flow eigenvalues of the current power flow data; inputting the power flow eigenvalues of the current power flow data into the graph convolutional network model , to determine whether the power system line is attacked and the location of the attacked line. The invention utilizes the graph attention mechanism neural network to realize the determination of the false data attack position.

Description

A false data injection attack identification method based on line topology analysis and power flow characteristics

Technical Field

The invention relates to the field of power system network information security issues, and in particular to a false data injection attack identification method based on line topology analysis and power flow characteristics.

Background Art

With the development of Industry 4.0, more and more industries are gradually realizing the intelligence of industries by integrating more information technologies. The power system is the largest artificial system in the world and also an industrial system that integrates information technology and automation technology earlier. It constitutes a power information-physical system that can integrate real-time perception, dynamic control and information decision-making. However, the construction of this system has a new impact on the vulnerability of the power grid. During the information interaction process, attackers use replay attacks, false data injection attacks (FDIAs) and other means to destroy the network information security of the power system, making the control center mistakenly believe that the system is still operating normally, misleading the control center to make wrong decisions, causing the primary equipment in the system to exit operation or the key line to be disconnected, causing interactive chain failures. Therefore, it is very important to detect and identify FDIAs in the power system to ensure the safe and stable operation of the power system.

In existing research methods, system data under a single time section is usually considered, and the spatial characteristics of the data are combined to detect FDIAs. However, the false data constructed by the attacker usually conforms to the operating rules of the power system. It is difficult to effectively detect FDIAs by only considering the spatial characteristics of the data under continuous time sections. When identifying false data injection attacks, existing methods are usually based on traditional topological structures, that is, the topological structure of the power system is composed of primary devices as nodes and transmission lines as edges. Since the attacker implements false data attacks by tampering with line measurement data, this structure is difficult to accurately locate the attack location.

Summary of the invention

The purpose of the present invention is to provide a false data injection attack identification method based on line topology analysis and power flow characteristics, comprising the following steps:

1) Obtain the historical power flow data and original topology of the power system.

2) Convert the original topology of the power system to obtain a converted topology of the power system.

The steps to create a conversion topology diagram are as follows:

2.1) Establish the adjacency matrix _AG used to characterize the original topological structure of the power system, that is:

According to the concepts of complex network theory and graph theory, for a topological graph with N nodes and M edges, the graph network structure can be represented by an N*N node adjacency matrix _AG , where the elements _aij in the matrix are represented as

_AG ＝[ _aij ] _N×N

Where _aij represents the elements in the node adjacency matrix _AG . _vi and _vj represent the i-th and j-th nodes in the graph network.

2.2) Extract the number of adjacent nodes of each node in the node adjacency matrix _AG and write it into the cell array _Acell .

2.3) Determine the adjacent lines of the lines in the traditional topology diagram of the power system and construct a cell array E _cell based on the line topology structure.

2.4) Taking the lines as nodes of the topological structure graph, find the adjacent lines of each line, so as to establish the line adjacency matrix _AG '.

2.5) According to the line adjacency matrix _AG ', a power system conversion topology is established with the lines as nodes and the connection relationships between lines as edges.

3) Inject some attack data into the historical flow data to obtain flow sample data containing false data.

The attack data a is as follows:

a＝Hc (2)

Where, c = [c ₁ ,c ₂ ,..., _cn ] ^T is an arbitrary non-zero vector. ^{c∈R n×1} . n is the number of states. H is the Jacobian matrix that characterizes the topological structure of the power system.

4) Extract the power flow characteristic value of the power flow sample data, and label the power flow characteristic value with whether there is attack data.

The power flow characteristic values include electrical intermediate value and power flow deviation coefficient index.

The electrical intermediate number _Be (m,n) is as follows:

Where L and G are the sets of load nodes and generation nodes in the power grid. _Wi and _Wj represent the active power output of the generator and the node load value, respectively. ^Iij (m,n) represents the current change between lines (m,n) after a unit current source is connected between power node i and load node j.

The power flow deviation coefficient index _Mi is as follows:

Where P _i0 and P _j0 represent the initial active power of line i and line j respectively. L is the set of all transmission lines in the power grid. ΔP _ji is the change in active power of line j caused by disconnection of line i.

The power flow characteristic value is preprocessed data. The preprocessing includes z-score standardization of the data. The standardized x' data is as follows:

Where _xμ and _xσ are the sample mean and standard deviation respectively. x represents the data before preprocessing.

5) Based on the power flow characteristic values of the power flow sample data, a graph convolutional network model is established to determine whether the power system is attacked.

The steps of establishing a graph convolutional network model for determining whether the power system is attacked include:

5.1) Randomly divide the tidal characteristic values of tidal sample data into a test set and a training set.

5.2) Build a graph convolutional network. The graph convolutional network model includes an input layer, several hidden layers and an output layer.

5.3) Using the training set to train the graph convolutional network to obtain a trained graph convolutional network.

5.4) Use the test set to test the trained graph convolutional network. If the accuracy of the graph convolutional network output result is greater than the preset threshold, the graph convolutional network model is established. Otherwise, the flow sample data and flow characteristic values are re-obtained and return to step 1).

The feature learning relationship between the feature values of any two layers of nodes in the graph convolutional network model is as follows:

表示第l层中第ni个节点的特征值。ni为节点i邻居节点的编号。g(^·)表示激活函数。

为网络权重。

为节点i在第l+1层的特征值。Where l represents the layer number of the node. s represents the number of adjacent nodes of node _vi .

represents the eigenvalue of the ni-th node in the l-th layer. ni is the number of the neighboring node of node i. g( ^· ) represents the activation function.

is the network weight.

is the eigenvalue of node i at the l+1th layer.

The output feature h' of the graph convolutional network model is as follows:

Where α _ij is the attention coefficient and W is the shareable network parameter.

The steps of obtaining the attention coefficient α _ij include:

输出特征集合为

a) The M-dimensional feature input set of all line nodes in the power system conversion topology is

The output feature set is

b) Calculate the mutual influence degree e _ij between line nodes, that is:

Where W is a sharable parameter. [ ^· || ^· ] represents concatenation. The shared attention mechanism a( ^· ) is used to map the concatenated features to the correlation coefficient e _ij to complete the learning of the correlation between node i and node j.

c) Use the nonlinear activation function Leaky ReLU single-layer feedforward neural network to map the splicing features and update the mutual influence degree e _ij as follows:

则相关系数的计算公式可以表示为Its parameter is the weight vector

The calculation formula of the correlation coefficient can be expressed as

表示权重向量。

表示输入。In the formula,

represents the weight vector.

Represents input.

d) Use the softmax function to normalize the mutual influence degree e _ij and obtain the appropriate attention coefficient α _ij , that is:

表示输入。The activation function of the graph convolutional network model is the ELUs function.

Represents input.

The ELUs function is as follows:

In the formula, α is the adjustment parameter, x is the input data, and g(x) is the output data.

6) Obtaining the current power flow data of the power system and extracting the power flow characteristic value of the current power flow data. Inputting the power flow characteristic value of the current power flow data into the graph convolutional network model to determine whether the power system line is attacked and the attacked line.

The technical effect of the present invention is unquestionable. The present invention transforms the traditional topological structure, uses the graph attention mechanism neural network, and proposes a graph neural network FDIAs identification method that considers the branch flow characteristics. The characteristic vector representing the flow characteristics of each branch is calculated by the flow value of the line, and the connection relationship between the lines and the neural network on the topological structure are used to mine the deep characteristics of the data to determine the attack location of the false data. The present invention determines the identification precision and accuracy of this method by comparing it with other identification methods under different attack levels.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a flow chart of the graph neural network FDIAs identification method considering branch power flow characteristics;

FIG2 is a diagram showing the line connection relationship of the IEEE39 standard system after topology conversion;

Figure 3 shows the loss function descent process of the graph convolutional network and graph attention mechanism.

DETAILED DESCRIPTION

The present invention is further described below in conjunction with the embodiments, but it should not be understood that the above subject matter of the present invention is limited to the following embodiments. Without departing from the above technical ideas of the present invention, various substitutions and changes are made according to the common technical knowledge and customary means in the art, which should all be included in the protection scope of the present invention.

Embodiment 1:

Referring to FIG. 1 to FIG. 3 , a false data injection attack identification method based on line topology analysis and power flow characteristics includes the following steps:

1) Obtain the historical power flow data and original topology of the power system.

2) Convert the original topology of the power system to obtain a converted topology of the power system.

The steps to create a conversion topology diagram are as follows:

2.1) Establish the adjacency matrix _AG used to characterize the original topological structure of the power system, that is:

According to the concepts of complex network theory and graph theory, for a topological graph with N nodes and M edges, the graph network structure can be represented by an N*N node adjacency matrix _AG , where the elements _aij in the matrix are represented as

_AG ＝[ _aij ] _N×N

Where _aij represents the elements in the node adjacency matrix _AG . _vi and _vj represent the i-th and j-th nodes in the graph network.

2.2) Extract the number of adjacent nodes of each node in the node adjacency matrix _AG and write it into the cell array _Acell .

2.3) Determine the adjacent lines of the lines in the traditional topology diagram of the power system and construct a cell array E _cell based on the line topology structure.

2.4) Taking the lines as nodes of the topological structure graph, find the adjacent lines of each line, so as to establish the line adjacency matrix _AG '.

2.5) According to the line adjacency matrix _AG ', a power system conversion topology is established with the lines as nodes and the connection relationships between lines as edges.

3) Inject some attack data into the historical flow data to obtain flow sample data containing false data.

The attack data a is as follows:

a＝Hc (2)

Where, c = [c ₁ ,c ₂ ,..., _cn ] ^T is an arbitrary non-zero vector. ^{c∈R n×1} . n is the number of states. H is the Jacobian matrix that characterizes the topological structure of the power system.

4) Extract the power flow characteristic value of the power flow sample data, and label the power flow characteristic value with whether there is attack data.

The power flow characteristic values include electrical intermediate value and power flow deviation coefficient index.

The electrical intermediate number _Be (m,n) is as follows:

Where L and G are the sets of load nodes and generation nodes in the power grid. _Wi and _Wj represent the active power output of the generator and the node load value, respectively. ^Iij (m,n) represents the current change between lines (m,n) after a unit current source is connected between power node i and load node j.

The power flow deviation coefficient index _Mi is as follows:

Where P _i0 and P _j0 represent the initial active power of line i and line j respectively. L is the set of all transmission lines in the power grid. ΔP _ji is the change in active power of line j caused by disconnection of line i.

The power flow characteristic value is preprocessed data. The preprocessing includes z-score standardization of the data. The standardized x' data is as follows:

Where _xμ and _xσ are the sample mean and standard deviation respectively. x represents the data before preprocessing.

5) Based on the power flow characteristic values of the power flow sample data, a graph convolutional network model is established to determine whether the power system is attacked.

The steps of establishing a graph convolutional network model for determining whether the power system is attacked include:

5.1) Randomly divide the tidal characteristic values of tidal sample data into a test set and a training set.

5.2) Build a graph convolutional network. The graph convolutional network model includes an input layer, several hidden layers and an output layer.

5.3) Using the training set to train the graph convolutional network to obtain a trained graph convolutional network.

5.4) Use the test set to test the trained graph convolutional network. If the accuracy of the graph convolutional network output result is greater than the preset threshold, the graph convolutional network model is established. Otherwise, the flow sample data and flow characteristic values are re-obtained and return to step 1).

The feature learning relationship between the feature values of any two layers of nodes in the graph convolutional network model is as follows:

表示第l层中第ni个节点的特征值。ni为节点i邻居节点的编号。g(^·)表示激活函数。w为网络权重。

为节点i在第l+1层的特征值。Where l represents the layer number of the node. s represents the number of adjacent nodes of node _vi .

represents the eigenvalue of the ni-th node in the l-th layer. ni is the number of the neighboring node of node i. g( ^· ) represents the activation function. w is the network weight.

is the eigenvalue of node i at the l+1th layer.

The output feature h' of the graph convolutional network model is as follows:

Where α _ij is the attention coefficient and W is the shareable network parameter.

The steps of obtaining the attention coefficient α _ij include:

输出特征集合为

a) The M-dimensional feature input set of all line nodes in the power system conversion topology is

The output feature set is

b) Calculate the mutual influence degree e _ij between line nodes, that is:

表示输入。Where W is a sharable parameter. [ ^· || ^· ] represents concatenation. The shared attention mechanism a( ^· ) is used to map the concatenated features to the correlation coefficient e _ij to complete the learning of the correlation between node i and node j.

Represents input.

c) Use the nonlinear activation function Leaky ReLU single-layer feedforward neural network to map the splicing features and update the mutual influence degree e _ij as follows:

则相关系数的计算公式可以表示为Its parameter is the weight vector

The calculation formula of the correlation coefficient can be expressed as

表示权重向量。In the formula,

represents the weight vector.

d) Use the softmax function to normalize the mutual influence degree e _ij and obtain the appropriate attention coefficient α _ij , that is:

表示输入。The activation function of the graph convolutional network model is the ELUs function.

Represents input.

The ELUs function is as follows:

In the formula, α is the adjustment parameter, x is the input data, and g(x) is the output data.

6) Obtaining the current power flow data of the power system and extracting the power flow characteristic value of the current power flow data. Inputting the power flow characteristic value of the current power flow data into the graph convolutional network model to determine whether the power system line is attacked and the attacked line.

Embodiment 2:

A false data injection attack identification method based on line topology analysis and power flow characteristics, the steps are as follows:

1) Convert the traditional topological structure of the power system to obtain the topological structure between the power system lines.

2) Using the power system branch flow data, the attack data is injected into the flow data based on the false data construction method, the electrical intermediate number and flow deviation coefficient indicators are calculated as the flow characteristics of the line, and the data is marked whether there is an attack.

3) Select appropriate graph attention mechanism activation function and loss function, and build a graph neural network model based on the attention mechanism.

4) Use the z-score method to normalize the line flow characteristics and obtain a node feature data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set.

5) The training sample set is used for parameter updating and optimization of the graph neural network, and the test set is used to verify that the proposed method can accurately identify the attacked lines and realize the identification of false data injection attacks.

Embodiment 3:

A false data injection attack identification method based on line topology analysis and power flow characteristics, the main steps of which are shown in Example 2, wherein the main steps of establishing a conversion topology diagram are as follows:

1) According to the concepts of complex network theory and graph theory, for a topological graph with N nodes and M edges, the graph network structure can be represented by an N*N adjacency matrix _AG , where the elements _aij in the matrix are represented as

2) According to the adjacency matrix _AG , we can know the number of adjacent nodes of each node. In the row of the adjacency matrix, the number of 1s is the number of nodes adjacent to the node, thus determining the elements in the cell array. In other words, when _aij = 1, it means that the two nodes are connected. It is represented by the cell array A _cell .

3) Since the converted topology graph uses lines as nodes and the connection relationship between lines as edges, it is necessary to number the lines in the traditional topology graph of the power system to find the adjacent lines of the lines to form the corresponding cell array.

4) When the line is used as a node in the topological structure diagram, find the adjacent lines of each line. According to the array composed of line numbers, the lines connected to the first and last nodes of the corresponding line are the adjacency matrix of the branch.

5) Based on the cell array E _cell of the circuit topology structure, the corresponding circuit-based adjacency expression matrix _AG ' can be established.

6) Based on the line adjacency matrix _AG ', draw the power system topology structure with the lines as nodes and the connection relationships between lines as edges.

7) Complete the construction of the power system topology transformation model diagram.

Embodiment 4:

A method for identifying false data injection attacks based on line topology analysis and power flow characteristics, the main steps of which are shown in Example 2, wherein, according to the power flow data of each branch in the power system, the attack amount is injected into the original power flow data in accordance with the construction method of false data, thereby establishing a characteristic matrix of each branch node. Establishing a characteristic matrix considering branch power flow mainly includes the following two aspects:

1) How to construct false data

Given a known power system topology, the attacker injects an attack vector a into the measurement system that satisfies

a＝Hc (2)

Where c = [c ₁ ,c ₂ ,..., _cn ] ^T is an arbitrary non-zero vector, c∈R ^n×1 , and n is the number of states. After the measured value becomes _za = z+a, the state estimate is

Accordingly, the residual equation becomes

It can be seen from formula (4) that when FDIAs exist in the measurement data, the residual remains within the range allowed by the threshold, thereby bypassing the detection and identification of the bad data module and successfully launching an attack on the power system.

2) Consider the node characteristic value of branch flow data

2.1) Electrical dielectric constant

The electric energy in the power system is output by the generator and transmitted to the load node through the line for power consumption, and the propagation of the power flow conforms to Kirchhoff's law. In other words, the size of the power flow is affected by the size of the branch impedance. During the power flow transmission process, it often flows through the line with the smallest impedance value. Therefore, while considering the power topology and power flow at the same time, the electrical intermediate number is used as one of the characteristics of the line node, reflecting the distribution and consumption of the load, the size of the power generation and the coupling relationship between the topology of the power system, and reflecting the use of each transmission line by the power source and the load. The calculation formula is:

Among them, L and G are the sets of load nodes and power generation nodes in the power grid respectively; _Wi and _Wj represent the active power output of the generator and the node load value respectively; ^Iij (m,n) represents the current change between the lines (m,n) after a unit current source is connected between the power node i and the load node j, that is, the unit power change value.

2.2) Flow deviation coefficient index

When considering the operating status of the power system, the factors that must be considered are the transmission and distribution of power flow between lines. According to the N-1 safety principle of the power system, when a line in the system is out of operation, the system achieves self-regulation through the redistribution of power flow. If the power flow distribution is unbalanced during the self-regulation process, for example, some lines bear relatively small amounts of power flow, while some lines bear too much power flow, causing the line to be out of operation due to overload, resulting in a chain failure of the power system. The power flow deviation coefficient index can be used to indicate the impact of changes in power flow in a certain line on the power flow in the entire system, and to quantitatively analyze the mutual influence between lines in the system. Therefore, the power flow deviation coefficient index is used as one of the characteristics of power flow in the power system. The calculation formula of this index is as follows:

Where P _i0 and P _j0 represent the initial active power of line i and line j respectively, L is the set of all transmission lines in the power grid, and ΔP _ji is the change in active power of line j caused by the disconnection of line i.

Embodiment 5:

A false data injection attack identification method based on line topology analysis and power flow characteristics, the main steps are shown in Example 2, wherein the convolutional neural network function selection method based on the attention mechanism is as follows:

1) How to solve graph convolutional networks

When the nodes in the figure are convolved, the feature learning relationship between the node feature values of the two neural unit layers is

表示第l层中第ni个节点的特征值，ni为节点i邻居节点的编号，在图卷积网络中，节点i在第l+1层的特征值只与其在第l层的邻接节点相关。g(^·)表示激活函数，用于对数据特征进行非线性学习，w为网络权重，在训练过程中不断更新。Among them, l represents the layer number of the node, s represents the number of adjacent nodes of node _vi ,

It represents the eigenvalue of the nith node in the lth layer, ni is the number of the neighboring node of node i. In the graph convolutional network, the eigenvalue of node i in the l+1th layer is only related to its neighboring nodes in the lth layer. g( ^· ) represents the activation function, which is used for nonlinear learning of data features. w is the network weight, which is continuously updated during the training process.

其中

表示输入信号经由傅里叶变换后的频域信号结果。变换信号

中的元素正是以Laplacian矩阵的特征向量为基的正交空间中图信号的坐标，从而完成将原始输入投影到相应图中的任务。因此，输入信号可转化为

其恰好为傅里叶变换的逆。因此，结合卷积神经网络计算公式和谱图理论可得图卷积操作的计算公式为For a matrix input signal x consisting of node features in the graph, the graph Fourier transform of ^x∈Rn is defined as F(x)= ^UTx . Correspondingly, the inverse Fourier transform is defined as

in

It represents the frequency domain signal result after Fourier transform of the input signal.

The elements in are the coordinates of the graph signal in the orthogonal space based on the eigenvectors of the Laplacian matrix, thus completing the task of projecting the original input into the corresponding graph. Therefore, the input signal can be converted into

It is exactly the inverse of Fourier transform. Therefore, combining the convolutional neural network calculation formula and spectral graph theory, the calculation formula for graph convolution operation is:

为输入信号，f_l为输入信号的层数，

为卷积网络进行更新的参数。in

is the input signal, _fl is the number of layers of the input signal,

Update the parameters of the convolutional network.

In the power cyber-physical system, based on the admittance matrix and line connection of each branch, the importance of each branch to the system is different, that is, the weights of the edges in the converted topology graph are different. In addition, each branch will be disconnected according to different operating requirements, and the training and testing phases of the traditional graph convolutional network require the use of topological graphs with the same structure. The computational cost increases with the growth of the topological structure scale, and it is unable to handle dynamic graph problems. To solve these problems, the graph attention mechanism is introduced to learn the feature weights of adjacent nodes through the network, weighted sum the features of adjacent nodes, and complete the convolution operation of the graph neural network.

2) Function selection method for graph attention mechanism

其输出特征集合为

对于特定节点i，逐个计算邻接节点及自身与其的相关系数，即线路节点之间的相互影响程度，公式如下Based on the graph convolutional neural network, the graph attention mechanism calculates the connection coefficient between nodes according to the connection relationship and node features of adjacent nodes, and assigns different weights to them as a consideration of the difference between each node. For a power system with N lines, the M-dimensional feature input set of all line nodes in the conversion topology is expressed as

Its output feature set is

For a specific node i, the correlation coefficients of the adjacent nodes and itself with it are calculated one by one, that is, the degree of mutual influence between the line nodes. The formula is as follows

则相关系数的计算公式可以表示为The original input features are enhanced and concatenated through the linear transformation of the shared parameter W [ ^· || ^· ], and the shared attention mechanism a( ^· ) maps the concatenated features to the correlation coefficient e _ij to complete the learning of the correlation between node i and node j. Usually in the graph attention mechanism, a nonlinear activation function LeakyReLU single-layer feedforward neural network with a negative semi-axis slope of 0.2 is used to map the concatenated features, and its parameters are the weight vector

The calculation formula of the correlation coefficient can be expressed as

Due to the different dimensions of the correlation coefficient, the softmax function is usually used to normalize the node correlation coefficient calculated by formula (4.5) to better distribute the weights between nodes and obtain the attention coefficient.

According to the normalized attention coefficient between nodes, similar to the graph convolutional network, the features of each node are weighted and summed to obtain the output feature h' of the node.

Among them, α _ij is the normalized attention coefficient, and W is the shareable network parameter.

The graph attention mechanism uses the attention coefficient to reflect the correlation between line nodes and aggregates the features of adjacent nodes, getting rid of the dependence of traditional graph convolutional networks on topological structures and being suitable for systems with constantly changing topologies. For power systems, the topological structure has dynamic characteristics due to the different opening and closing of circuit breakers and line capacities. When identifying FDIAs, it is more appropriate to use the graph attention mechanism network for feature learning and judging whether the branch is under attack or not.

3) Method for selecting activation function

This invention will introduce a new activation function: ELUs function, which is used to map features in two neural unit layers in the graph attention mechanism. The ELUs function makes some improvements based on the ReLU activation function. The ReLU activation function treats negative values as 0 and outputs positive values linearly. Therefore, the output value of this function has no negative values. When the output is averaged, the result is greater than 0, which is easy to bias the lower layer and produce mean shift. When training deeper networks, there will be non-convergence problems. The ELUs function effectively solves this problem by introducing a negative value activation function. Its calculation formula is as follows

The α in the formula is an adjustment parameter that controls the position where the negative part of the ELUs activation function reaches saturation.

When the present invention uses the graph attention mechanism to train and learn the power system topology graph, due to the large number of nodes and the disconnection of branches will change the topology structure, ELUs with strong noise robustness are selected as the activation function to avoid the problem of non-convergence of training.

Embodiment 6:

A false data injection attack identification method based on line topology analysis and power flow characteristics, the main steps are shown in Example 2, wherein, in order to make the dimension of the node characteristics consistent, the data needs to be preprocessed, and the processing method is as follows:

The common min-max normalization method processes the data based on the difference between the maximum and minimum values in the sample. For the power system scenario in which the present invention is actually applied, considering the impact of transmission line disconnection on the topology (such as because the power is 0 when the line is out of operation), a small number of data points that deviate from the sample mean may appear in the sample. The traditional method pre-processes the data based on the maximum or minimum value, which may be affected by the deviated data. Therefore, the present invention selects the z-score normalization method that considers the overall information of the sample to pre-process the data. This method selects the sample standard deviation and mean to process the original data, which effectively solves the impact of a small amount of deviated data on data normalization, and ensures the distribution characteristics of the original data, which is conducive to feature extraction. Its calculation formula is

Where _xμ and _xσ are the sample mean and standard deviation respectively.

Embodiment 7:

A false data injection attack identification method based on line topology analysis and power flow characteristics, the main steps of which are shown in Example 2, wherein the process of adjusting parameters and optimizing the proposed method using training data samples and test data samples is as follows:

Read the line admittance matrix and historical operating load data of the power system, obtain the node adjacency matrix, and construct a conversion topology diagram with lines as nodes and connection relationships between lines as edges.

Based on historical data, the Newton method is used to calculate the flow data in the line. The false data construction method is used to inject false data into the historical flow to construct a flow sample with false data. Based on the existing flow data, the node feature matrix considering the flow operation characteristics is calculated as the input of the graph attention mechanism neural network to determine the attacked line.

The calculated node feature data is preprocessed according to the normalization formula and divided into test samples and training samples. The training sample data is used to adjust the parameters of the convolutional network based on the graph attention mechanism and construct a graph convolutional network model with the ultimate goal of whether the node is attacked. The test sample is used to verify the effectiveness of the FDIAs identification method and determine the specific attacked line; if there is no FDIAs, the identification process ends.

Embodiment 8:

An experiment of a false data injection attack identification method based on line topology analysis and power flow characteristics. The main steps are as follows:

1) Convert the traditional topology of the power system to obtain the topology between the power system lines. Use the Pytorch deep learning framework to draw the correlation between the lines of the IEEE39 node standard example, with a total of 46 lines. It should be noted that during the Python running process, the initial value of the number is 0, so the number in the figure is 0-45. The line numbering in this topology diagram is based on the results of the PowerWorld power flow simulation calculation. The final topology conversion result is shown in Figure 2.

2) Using the power system branch flow data, based on the construction method of false data, the attack data is injected into the flow data, the electrical intermediate number and flow deviation coefficient index are calculated as the flow characteristics of the line, and the data is marked whether there is an attack. The IEEE39 node is connected to the continuous time load of a substation in a certain area of the country within a week, and the load data of the IEEE39 node is processed to obtain the per-unit value of the load data, which is brought into the IEEE39 system to obtain the flow data. The final node feature calculation results are shown in Table 1.

Table 1 Eigenvalues of each node

Line number Electrical Intermediacy Power flow deviation coefficient Line number Electrical Intermediacy Power flow deviation coefficient 1 1.075 22.43 twenty four 0.986 26.41 2 0.320 -20.62 25 2.080 -4.92 3 1.780 -9.55 26 2.930 5.92 4 1.930 3.54 27 1.938 -0.02 5 0.984 0 28 1.330 -0.02 6 0.998 -69.67 29 1.256 -0.01 7 0.874 11.07 30 0.864 2.27 8 0.968 11.89 31 0.798 35.28 9 0.784 0.94 32 0.782 0.01 10 0.886 5.78 33 0.537 0 11 0.936 2.21 34 0.254 0 12 0.952 2.68 35 1.135 -0.01 13 1.273 -5.10 36 1.325 0.10 14 0.682 102.97 37 0.584 0 15 0.920 5.50 38 1.324 0 16 0.889 55.95 39 0.654 0 17 0.546 55.95 40 1.456 -13.40 18 1.180 -4.45 41 0.576 0 19 1.220 4.45 42 1.800 -3.39 20 0.687 0 43 0.236 0.05 twenty one 1.260 47.71 44 1.246 -0.03 twenty two 1.147 -30.03 45 0.998 0.01 twenty three 1.330 5.01 46 0.847 0

It can be clearly seen from Table 1 that there is a certain relationship between the size of the electrical betweenness of the line and the degree between each node in the topological diagram. On the basis of fully considering the topological structure, it reflects the distribution state of the power flow of each node (i.e., each line). For different line nodes, the numerical deviation of some indicators is large and the dimensions of each indicator are different. In order to ensure the normal operation of the detection model and realize the identification of the attacked line, the indicators in the node feature matrix are normalized according to the z-score normalization method, and used as the node matrix of the neural network based on the graph attention mechanism for subsequent calculations.

3) Select appropriate graph attention mechanism activation function and loss function to construct a graph neural network model based on the attention mechanism. The present invention selects ELUs as the activation function and cross entropy as the loss function. In the process of updating the attention mechanism, the weight coefficient of each node in the conversion topology diagram is determined by using the LeakyReLU activation function and the mapping of the activation function. The convergence process of the neural network is compared in Figure 3, and the detection performance is shown in Table 2.

Table 2 Performance index results of the example based on the IEEE39 standard system

4) Use the z-score method to normalize the line flow characteristics to obtain a node feature data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set. According to the z-score normalization equation, the normalized results of each node feature in Table 1 are calculated and brought into the graph attention mechanism convolutional network determined in step 3) for settlement.

5) The training sample set is used for parameter update and optimization of the graph neural network, and the test set is used to verify that the proposed method can accurately identify the attacked lines and realize the identification of false data injection attacks. Under different amplitude perturbations σ, where the amplitude perturbations are set to 0.005, 0.05 and 0.1 respectively, compared with other false data identification methods, the final results are shown in Table 3.

Table 3 Comparative analysis of identification results of different methods

From the data in Table 3, there is not much difference in accuracy and recall between the graph convolutional network based on the traditional topology structure, the algorithm of convolutional neural network and bad data fusion, and the convolutional network based on the line topology structure graph proposed in the present invention. However, when the amplitude disturbance of the state value increases, the accuracy and precision of the first two methods continue to decrease, while the detection accuracy and recall rate of the method proposed in the present invention gradually increase within a small range and maintain a stable level. This is because the first two methods identify and analyze the state estimation value of the node on the basis of the original topology structure. When the amplitude disturbance occurs in the system, the larger the disturbance amplitude, the greater the possibility of misjudgment of normal data, resulting in a decrease in detection performance. The method proposed in the present invention takes into account the connection relationship between the lines and the characteristics of the flow data, and is based on the line, which can better reflect the system characteristics when disturbance occurs in the system.

Embodiment 9:

Referring to FIG1 , a false data injection attack identification method based on line topology analysis and power flow characteristics mainly includes the following steps:

1) Convert the traditional topological structure of the power system to obtain the topological structure between the power system lines.

The main steps to convert the traditional topology of the power system are as follows:

1.1) According to the concepts of complex network theory and graph theory, for a topological graph with N nodes and M edges, the graph network structure can be represented by an N*N adjacency matrix AG, where the element aij in the matrix is represented as

1.2) According to the adjacency matrix AG, we can know the number of adjacent nodes of each node. In the row of the adjacency matrix, the number of 1s is the number of nodes adjacent to the node, thus determining the elements in the cell array. In other words, when aij=1, it means that the two nodes are connected. It is represented by the cell array Acell.

1.3) Since the converted topology graph uses lines as nodes and the connection relationship between lines as edges, it is necessary to number the lines in the traditional topology graph of the power system to find the adjacent lines of the lines to form the corresponding cell array.

1.4) When the line is used as a node in the topological structure diagram, find the adjacent lines of each line. According to the array composed of line numbers, the lines connected to the first and last nodes of the corresponding line are the adjacency matrix of the branch.

1.5) Based on the cell array Ecell of the circuit topology structure, the corresponding circuit-based adjacency expression matrix AG’ can be established.

1.6) Based on the line adjacency matrix AG’, draw the power system topology structure with the lines as nodes and the connection relationships between lines as edges.

1.7) Complete the construction of the power system topology transformation model diagram.

2) Using the power system branch flow data, the attack data is injected into the flow data based on the false data construction method, the electrical intermediate number and flow deviation coefficient indicators are calculated as the flow characteristics of the line, and the data is marked whether there is an attack.

According to the flow data of each branch in the power system, the attack amount is injected into the original flow data according to the construction method of false data, so as to establish the characteristic matrix of each branch node. The establishment of the characteristic matrix considering the branch flow mainly includes the following two aspects:

2.1) How to construct fake data

Given a known power system topology, the attacker injects an attack vector a into the measurement system that satisfies

a＝Hc (2)

Where c = [c ₁ ,c ₂ ,..., _cn ] ^T is an arbitrary non-zero vector, c∈R ^n×1 , and n is the number of states. After the measured value becomes _za = z+a, the state estimate is

Accordingly, the residual equation becomes

It can be seen from formula (4) that when FDIAs exist in the measurement data, the residual remains within the range allowed by the threshold, thereby bypassing the detection and identification of the bad data module and successfully launching an attack on the power system.

2.2) Considering the node characteristic values of branch flow data

2.2.1) Electrical dielectric constant

The electric energy in the power system is output by the generator and transmitted to the load node through the line for power consumption, and the propagation of the power flow conforms to Kirchhoff's law. In other words, the size of the power flow is affected by the size of the branch impedance. During the power flow transmission process, it often flows through the line with the smallest impedance value. Therefore, while considering the power topology and power flow at the same time, the electrical intermediate number is used as one of the characteristics of the line node, reflecting the distribution and consumption of the load, the size of the power generation and the coupling relationship between the topology of the power system, and reflecting the use of each transmission line by the power source and the load. The calculation formula is:

Among them, L and G are the sets of load nodes and power generation nodes in the power grid respectively; _Wi and _Wj represent the active power output of the generator and the node load value respectively; ^Iij (m,n) represents the current change between the lines (m,n) after a unit current source is connected between the power node i and the load node j, that is, the unit power change value.

2.2.2) Flow deviation coefficient index

When considering the operating status of the power system, the factors that must be considered are the transmission and distribution of power flow between lines. According to the N-1 safety principle of the power system, when a line in the system is out of operation, the system achieves self-regulation through the redistribution of power flow. If the power flow distribution is unbalanced during the self-regulation process, for example, some lines bear relatively small amounts of power flow, while some lines bear too much power flow, causing the line to be out of operation due to overload, resulting in a chain failure of the power system. The power flow deviation coefficient index can be used to indicate the impact of changes in power flow in a certain line on the power flow in the entire system, and to quantitatively analyze the mutual influence between lines in the system. Therefore, the power flow deviation coefficient index is used as one of the characteristics of power flow in the power system. The calculation formula of this index is as follows:

Where P _i0 and P _j0 represent the initial active power of line i and line j respectively, L is the set of all transmission lines in the power grid, and ΔP _ji is the change in active power of line j caused by the disconnection of line i.

3) Select appropriate graph attention mechanism activation function and loss function, and build a graph neural network model based on the attention mechanism.

The method for selecting the activation function and loss function of the graph attention mechanism is as follows:

3.1) Graph Convolutional Network Solution

When the nodes in the figure are convolved, the feature learning relationship between the node feature values of the two neural unit layers is

表示第l层中第ni个节点的特征值，ni为节点i邻居节点的编号，在图卷积网络中，节点i在第l+1层的特征值只与其在第l层的邻接节点相关。g(^·)表示激活函数，用于对数据特征进行非线性学习，w为网络权重，在训练过程中不断更新。Among them, l represents the layer number of the node, s represents the number of adjacent nodes of node _vi ,

It represents the eigenvalue of the nith node in the lth layer, ni is the number of the neighboring node of node i. In the graph convolutional network, the eigenvalue of node i in the l+1th layer is only related to its neighboring nodes in the lth layer. g( ^· ) represents the activation function, which is used for nonlinear learning of data features. w is the network weight, which is continuously updated during the training process.

其中

表示输入信号经由傅里叶变换后的频域信号结果。变换信号

中的元素正是以Laplacian矩阵的特征向量为基的正交空间中图信号的坐标，从而完成将原始输入投影到相应图中的任务。因此，输入信号可转化为

其恰好为傅里叶变换的逆。因此，结合卷积神经网络计算公式和谱图理论可得图卷积操作的计算公式为For a matrix input signal x consisting of node features in the graph, the graph Fourier transform of ^x∈Rn is defined as F(x)= ^UTx . Correspondingly, the inverse Fourier transform is defined as

in

It represents the frequency domain signal result after Fourier transform of the input signal.

The elements in are the coordinates of the graph signal in the orthogonal space based on the eigenvectors of the Laplacian matrix, thus completing the task of projecting the original input into the corresponding graph. Therefore, the input signal can be converted into

It is exactly the inverse of Fourier transform. Therefore, combining the convolutional neural network calculation formula and spectral graph theory, the calculation formula for graph convolution operation is:

为输入信号，f_l为输入信号的层数，

为卷积网络进行更新的参数。in

is the input signal, _fl is the number of layers of the input signal,

Update the parameters of the convolutional network.

In the power cyber-physical system, based on the admittance matrix and line connection of each branch, the importance of each branch to the system is different, that is, the weights of the edges in the converted topology graph are different. In addition, each branch will be disconnected according to different operating requirements, and the training and testing phases of the traditional graph convolutional network require the use of topological graphs with the same structure. The computational cost increases with the growth of the topological structure scale, and it is unable to handle dynamic graph problems. To solve these problems, the graph attention mechanism is introduced to learn the feature weights of adjacent nodes through the network, weighted sum the features of adjacent nodes, and complete the convolution operation of the graph neural network.

3.2) Function Selection Method for Graph Attention Mechanism

其输出特征集合为

对于特定节点i，逐个计算邻接节点及自身与其的相关系数，即线路节点之间的相互影响程度，公式如下Based on the graph convolutional neural network, the graph attention mechanism calculates the connection coefficient between nodes according to the connection relationship and node features of adjacent nodes, and assigns different weights to them as a consideration of the difference between each node. For a power system with N lines, the M-dimensional feature input set of all line nodes in the conversion topology is expressed as

Its output feature set is

For a specific node i, the correlation coefficients of the adjacent nodes and itself with it are calculated one by one, that is, the degree of mutual influence between the line nodes. The formula is as follows

则相关系数的计算公式可以表示为The original input features are enhanced and concatenated through the linear transformation of the shared parameter W [ ^· || ^· ], and the shared attention mechanism a( ^· ) maps the concatenated features to the correlation coefficient e _ij to complete the learning of the correlation between node i and node j. Usually in the graph attention mechanism, a nonlinear activation function LeakyReLU single-layer feedforward neural network with a negative semi-axis slope of 0.2 is used to map the concatenated features, and its parameters are the weight vector

The calculation formula of the correlation coefficient can be expressed as

Due to the different dimensions of the correlation coefficient, the softmax function is usually used to normalize the node correlation coefficient calculated by formula (4.5) to better distribute the weights between nodes and obtain the attention coefficient.

According to the normalized attention coefficient between nodes, similar to the graph convolutional network, the features of each node are weighted and summed to obtain the output feature h' of the node.

Among them, α _ij is the normalized attention coefficient, and W is the shareable network parameter.

The graph attention mechanism uses the attention coefficient to reflect the correlation between line nodes and aggregates the features of adjacent nodes, getting rid of the dependence of traditional graph convolutional networks on topological structures and being suitable for systems with constantly changing topologies. For power systems, the topological structure has dynamic characteristics due to the different opening and closing of circuit breakers and line capacities. When identifying FDIAs, it is more appropriate to use the graph attention mechanism network for feature learning and judging whether the branch is under attack or not.

3.3) Method for selecting activation function

This invention will introduce a new activation function: ELUs function, which is used to map features in two neural unit layers in the graph attention mechanism. The ELUs function makes some improvements based on the ReLU activation function. The ReLU activation function treats negative values as 0 and outputs positive values linearly. Therefore, the output value of this function has no negative values. When the output is averaged, the result is greater than 0, which is easy to bias the lower layer and produce mean shift. When training deeper networks, there will be non-convergence problems. The ELUs function effectively solves this problem by introducing a negative value activation function. Its calculation formula is as follows

The α in the formula is an adjustment parameter that controls the position where the negative part of the ELUs activation function reaches saturation.

When the present invention uses the graph attention mechanism to train and learn the power system topology graph, due to the large number of nodes and the disconnection of branches will change the topology structure, ELUs with strong noise robustness are selected as the activation function to avoid the problem of non-convergence of training.

4) Use the z-score method to normalize the line flow characteristics and obtain a node feature data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set.

The common min-max normalization method processes the data based on the difference between the maximum and minimum values in the sample. For the power system scenario in which the present invention is actually applied, considering the impact of transmission line disconnection on the topology (such as because the power is 0 when the line is out of operation), a small number of data points that deviate from the sample mean may appear in the sample. The traditional method pre-processes the data based on the maximum or minimum value, which may be affected by the deviated data. Therefore, the present invention selects the z-score normalization method that considers the overall information of the sample to pre-process the data. This method selects the sample standard deviation and mean to process the original data, which effectively solves the impact of a small amount of deviated data on data normalization, and ensures the distribution characteristics of the original data, which is conducive to feature extraction. Its calculation formula is

Where _xμ and _xσ are the sample mean and standard deviation respectively.

5) The training sample set is used for parameter updating and optimization of the graph neural network, and the test set is used to verify that the proposed method can accurately identify the attacked lines and realize the identification of false data injection attacks.

The process of adjusting and optimizing the parameters of the proposed method using training data samples and test data samples is as follows:

5.1) Read the line admittance matrix and historical operating load data of the power system, obtain the node adjacency matrix, and construct a conversion topology diagram with lines as nodes and the connection relationships between lines as edges.

5.2) Based on the historical data, the Newton method is used to calculate the flow data in the line. The false data construction method is used to inject false data into the historical flow to construct a flow sample with false data. Based on the existing flow data, the node feature matrix considering the flow operation characteristics is calculated as the input of the graph attention mechanism neural network to determine the attacked line.

5.3) The calculated node feature data is preprocessed according to the normalization formula and divided into test samples and training samples. The training sample data is used to adjust the parameters of the convolutional network based on the graph attention mechanism and construct a graph convolutional network model with the ultimate goal of whether the node is attacked. The test sample is used to verify the effectiveness of the FDIAs identification method and determine the specific attacked line; if there is no FDIAs, the identification process ends.

Claims (5)

1. A false data injection attack identification method based on line topology analysis and power flow characteristics, characterized in that it includes the following steps: 1) Obtain historical power flow data and original topology of the power system; 2) Converting the original topological structure of the power system to obtain a converted topological structure of the power system; The steps to establish the power system conversion topology are as follows: 2.1) Establish the adjacency matrix _AG used to characterize the original topological structure of the power system, that is: According to the concepts of complex network theory and graph theory, for a topological graph with N nodes and M edges, the graph network structure is represented by an N*M node adjacency matrix _AG , where the elements _aij in the matrix are represented as

In the formula, _aij represents the elements in the node adjacency matrix _AG ; _vi and _vj represent the i-th and j-th nodes in the graph network; 2.2) Extract the number of adjacent nodes of each node in the node adjacency matrix _AG and write it into _the cell array Acell; 2.3) Determine the adjacent lines of the lines in the traditional topology diagram of the power system, and construct a cell array E _cell based on the line topology structure; 2.4) Taking the lines as nodes of the topological structure graph, find the adjacent lines of each line, so as to establish the line adjacency matrix _AG '; 2.5) According to the line adjacency matrix _AG ', establish the power system conversion topology structure with the lines as nodes and the connection relationship between lines as edges; 3) Inject some attack data into the historical flow data to obtain flow sample data containing false data; 4) Extract the power flow characteristic value of the power flow sample data, and label the power flow characteristic value with whether there is attack data; 5) Based on the power flow characteristic values of the power flow sample data, a graph convolutional network model is established to determine whether the power system is attacked; The power flow characteristic values include the electrical intermediate value and the power flow deviation coefficient index; The electrical intermediate number _Be (m,n) is as follows:

Where L and G are the sets of load nodes and generation nodes in the power grid, respectively; _Wi and _Wj represent the active power output by the generator and the node load value, respectively; ^Iij (m,n) represents the current change between the lines (m,n) after a unit current source is connected between the power node i and the load node j; The power flow deviation coefficient index _Mi is as follows:

Where, P _i'0 and P _j'0 represent the initial active power of line i' and line j'respectively;L' is the set of all transmission lines in the power grid; ΔP _j'i' is the change in active power of line j' caused by the disconnection of line i'; The steps of establishing a graph convolutional network model for determining whether the power system is attacked include: 5.1) Randomly divide the power flow characteristic values of the power flow sample data into a test set and a training set; 5.2) Building a graph convolutional network; the graph convolutional network model includes an input layer, several hidden layers and an output layer; 5.3) Using the training set to train the graph convolutional network to obtain a trained graph convolutional network; 5.4) Use the test set to test the trained graph convolutional network. If the accuracy of the output result of the graph convolutional network is greater than the preset threshold, the establishment of the graph convolutional network model is completed. Otherwise, the power flow sample data and power flow characteristic values are re-obtained, and return to step 5.1); The feature learning relationship between the feature values of any two layers of nodes in the graph convolutional network model is as follows:

In the formula, l represents the layer number of the node; s represents the number of adjacent nodes of node _vi ;

represents the characteristic value of the ni-th node in the l-th layer; ni is the number of the neighboring node of node i; g(.) represents the activation function;

is the network weight;

is the eigenvalue of node i at layer l+1; Output features of the graph convolutional network model

As shown below:

In the formula, _a′ij is the attention coefficient, and W is the shareable network parameter;

Represents input; 6) Obtaining the current power flow data of the power system and extracting the power flow characteristic values of the current power flow data; inputting the power flow characteristic values of the current power flow data into the graph convolutional network model to determine whether the power system line is attacked and the attacked line. 2. According to a method for identifying false data injection attacks based on line topology analysis and power flow characteristics according to claim 1, it is characterized in that the attack data a is as follows: a＝Hc (6) Wherein, c = [c ₁ ,c ₂ ,..., _cn ] ^T is an arbitrary non-zero vector; c∈R ^n×1 ; n is the number of states; and H is the Jacobian matrix characterizing the topological structure of the power system. 3. According to the method for identifying false data injection attacks based on line topology analysis and power flow characteristics of claim 1, it is characterized in that the power flow characteristic value is pre-processed data; the pre-processing includes z-score standardization of the data; the data of x' after standardization is as follows:

In the formula, _xμ and _xσ are the sample mean and standard deviation respectively; x represents the data before preprocessing. 4. According to a method for identifying false data injection attacks based on line topology analysis and power flow characteristics as described in claim 1, it is characterized in that the step of obtaining the attention coefficient a′ _ij comprises: 1) The M-dimensional feature input set of all line nodes in the power system conversion topology is

The output feature set is

2) Calculate the mutual influence degree e _ij between line nodes, that is:

Where W is a sharable parameter; [·||·] represents concatenation; the shared attention mechanism a(.) is used to map the concatenated features to the correlation coefficient e _ij to complete the learning of the correlation between node i and node j;

Represents input; 3) Use the nonlinear activation function LeakyReLU single-layer feedforward neural network to map the splicing features and update the mutual influence degree e _ij as follows: Its parameter is the weight vector

The calculation formula of the correlation coefficient can be expressed as

In the formula,

represents the weight vector; 4) Use the softmax function to normalize the mutual influence degree e _ij and obtain the appropriate attention coefficient a′ _ij , that is:

In the formula,

Represents input. 5. According to a method for identifying false data injection attacks based on line topology analysis and power flow characteristics according to claim 1, it is characterized in that the activation function of the graph convolutional network model is an ELUs function; The ELUs function is as follows:

In the formula, α is the adjustment parameter; x is the input data; g(x) is the output data.

Images