CN113904786B - False data injection attack identification method based on line topology analysis and tide characteristics - Google Patents
False data injection attack identification method based on line topology analysis and tide characteristics Download PDFInfo
- Publication number
- CN113904786B CN113904786B CN202110729263.6A CN202110729263A CN113904786B CN 113904786 B CN113904786 B CN 113904786B CN 202110729263 A CN202110729263 A CN 202110729263A CN 113904786 B CN113904786 B CN 113904786B
- Authority
- CN
- China
- Prior art keywords
- data
- graph
- line
- node
- power system
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 88
- 238000002347 injection Methods 0.000 title claims abstract description 25
- 239000007924 injection Substances 0.000 title claims abstract description 25
- 238000004458 analytical method Methods 0.000 title claims abstract description 20
- 230000007246 mechanism Effects 0.000 claims abstract description 39
- 238000005096 rolling process Methods 0.000 claims abstract description 32
- 238000006243 chemical reaction Methods 0.000 claims abstract description 25
- 238000013528 artificial neural network Methods 0.000 claims abstract description 20
- 230000006870 function Effects 0.000 claims description 58
- 239000011159 matrix material Substances 0.000 claims description 58
- 239000010410 layer Substances 0.000 claims description 37
- 230000004913 activation Effects 0.000 claims description 34
- 238000012549 training Methods 0.000 claims description 29
- 238000004364 calculation method Methods 0.000 claims description 24
- 238000012360 testing method Methods 0.000 claims description 23
- 238000010586 diagram Methods 0.000 claims description 20
- 230000008569 process Effects 0.000 claims description 18
- 230000005540 biological transmission Effects 0.000 claims description 16
- 239000013598 vector Substances 0.000 claims description 16
- 230000003993 interaction Effects 0.000 claims description 12
- 238000013507 mapping Methods 0.000 claims description 12
- 230000008859 change Effects 0.000 claims description 11
- 238000010606 normalization Methods 0.000 claims description 10
- 238000007781 pre-processing Methods 0.000 claims description 10
- 238000010248 power generation Methods 0.000 claims description 5
- 239000002356 single layer Substances 0.000 claims description 5
- 238000002759 z-score normalization Methods 0.000 claims description 4
- 238000002372 labelling Methods 0.000 claims description 3
- 238000010276 construction Methods 0.000 description 10
- 238000001514 detection method Methods 0.000 description 8
- 238000005259 measurement Methods 0.000 description 7
- 238000013527 convolutional neural network Methods 0.000 description 5
- 239000003795 chemical substances by application Substances 0.000 description 4
- 238000012545 processing Methods 0.000 description 4
- 230000009466 transformation Effects 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000003062 neural network model Methods 0.000 description 3
- 238000010187 selection method Methods 0.000 description 3
- 241000283690 Bos taurus Species 0.000 description 2
- 230000004075 alteration Effects 0.000 description 2
- 238000007796 conventional method Methods 0.000 description 2
- 230000008878 coupling Effects 0.000 description 2
- 238000010168 coupling process Methods 0.000 description 2
- 238000005859 coupling reaction Methods 0.000 description 2
- 238000000605 extraction Methods 0.000 description 2
- 230000006872 improvement Effects 0.000 description 2
- 210000005036 nerve Anatomy 0.000 description 2
- 230000001537 neural effect Effects 0.000 description 2
- 238000005457 optimization Methods 0.000 description 2
- 239000000243 solution Substances 0.000 description 2
- 238000011425 standardization method Methods 0.000 description 2
- 238000006467 substitution reaction Methods 0.000 description 2
- 206010063385 Intellectualisation Diseases 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 238000010835 comparative analysis Methods 0.000 description 1
- 238000013135 deep learning Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 230000005611 electricity Effects 0.000 description 1
- 238000002474 experimental method Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- POFWRMVFWIJXHP-UHFFFAOYSA-N n-benzyl-9-(oxan-2-yl)purin-6-amine Chemical compound C=1C=CC=CC=1CNC(C=1N=C2)=NC=NC=1N2C1CCCCO1 POFWRMVFWIJXHP-UHFFFAOYSA-N 0.000 description 1
- 238000003672 processing method Methods 0.000 description 1
- 238000011160 research Methods 0.000 description 1
- 238000004088 simulation Methods 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/04—Architecture, e.g. interconnection topology
- G06N3/045—Combinations of networks
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N3/00—Computing arrangements based on biological models
- G06N3/02—Neural networks
- G06N3/08—Learning methods
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J3/00—Circuit arrangements for ac mains or ac distribution networks
- H02J3/04—Circuit arrangements for ac mains or ac distribution networks for connecting networks of the same frequency but supplied from different sources
- H02J3/06—Controlling transfer of power between connected networks; Controlling sharing of load between connected networks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/12—Discovery or management of network topologies
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/16—Threshold monitoring
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J2203/00—Indexing scheme relating to details of circuit arrangements for AC mains or AC distribution networks
- H02J2203/10—Power transmission or distribution systems management focussing at grid-level, e.g. load flow analysis, node profile computation, meshed network optimisation, active network management or spinning reserve management
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Landscapes
- Engineering & Computer Science (AREA)
- Physics & Mathematics (AREA)
- Theoretical Computer Science (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Artificial Intelligence (AREA)
- Data Mining & Analysis (AREA)
- Evolutionary Computation (AREA)
- Biophysics (AREA)
- Molecular Biology (AREA)
- Biomedical Technology (AREA)
- Computational Linguistics (AREA)
- General Physics & Mathematics (AREA)
- Mathematical Physics (AREA)
- Software Systems (AREA)
- Life Sciences & Earth Sciences (AREA)
- Health & Medical Sciences (AREA)
- Computer Hardware Design (AREA)
- Power Engineering (AREA)
- Supply And Distribution Of Alternating Current (AREA)
Abstract
The invention discloses a false data injection attack identification method based on line topology analysis and tide characteristics, which comprises the following steps: 1) Acquiring historical power flow data and an original topological structure of a power system; 2) Obtaining a power system conversion topological structure; 3) Injecting a plurality of attack data into the historical trend data to obtain trend sample data with false data; 4) Extracting a tide characteristic value of tide sample data, and marking whether attack data exist or not; 5) Based on the tidal current characteristic value of the tidal current sample data, establishing a graph convolution network model for judging whether the power system is attacked; 6) Acquiring current power flow data of the power system, and extracting a power flow characteristic value of the current power flow data; and inputting the current characteristic value of the current power flow data into the graph rolling network model, and judging whether the power system line is attacked or not and the position of the attacked line. The invention utilizes the graph attention mechanism neural network to realize the determination of the false data attack position.
Description
Technical Field
The invention relates to the field of network information security of power systems, in particular to a false data injection attack identification method based on line topology analysis and tide characteristics.
Background
With the development of industry 4.0, more and more industries gradually realize the intellectualization of the industry by fusing more informatization technologies. The power system is the largest manual system in the world, is also an industrial system integrating information technology and automation technology earlier, and forms a power information physical system integrating real-time sensing, dynamic control and information decision. However, the construction of this system has a new impact on the vulnerability of the grid. In the information interaction process, an attacker destroys the network information security of the power system through means such as replay attack, false data injection attack (False Data Injection Attacks, FDIAs) and the like, so that a control center misuses the system to still normally operate, misleads the control center to make a wrong decision, and causes the primary equipment in the system to be out of operation or a key line to be disconnected to cause interactive linkage faults. Therefore, detecting and identifying the FDIAs in the power system is important to ensure safe and stable operation of the power system.
In the existing research method, system data under a single time section is generally considered, and FDIAs detection is carried out by combining spatial characteristics of the data. However, the false data constructed by an attacker generally accords with the operation rule of the power system, and efficient detection of FDIAs is difficult to achieve by only considering the spatial characteristics of the data under continuous time sections. When false data injection attacks are identified, the existing method is generally based on a traditional topological structure, namely a primary device is taken as a node, a transmission line is taken as an edge to form a topological structure of a power system, and an attacker can realize the attack of the false data by tampering line measurement data, so that the structure is difficult to realize the accurate positioning of the attack position.
Disclosure of Invention
The invention aims to provide a false data injection attack identification method based on line topology analysis and tide characteristics, which comprises the following steps:
1) And acquiring historical power flow data and an original topological structure of the power system.
2) And converting the original topological structure of the power system to obtain a conversion topological structure of the power system.
The steps for establishing the conversion topological structure diagram are as follows:
2.1 Establishing an adjacency matrix a for characterizing the original topology of the power system G The method comprises the following steps:
based on the concept of complex network theory and graph theory, for a topology structure diagram with N nodes and M edges, a node adjacency matrix A with N x N can be used G Representing a graph network structure in which element a in the matrix ij Represented as
A G ＝[a ij ] N×N
Wherein a is ij Representing node adjacency matrix A G Is a component of the group. v i 、v j Representing the ith and jth nodes of the graph network.
2.2 Extracting node adjacency matrix A G The number of adjacent nodes of each node in the array, and writing the adjacent nodes into a cell array A cell Is a kind of medium.
2.3 Determining adjacent lines of lines in a traditional topological graph of the power system and constructing a cell array E based on a line topological structure cell 。
2.4 Using the lines as nodes of the topological structure diagram, searching adjacent lines of each line, thereby establishing a line adjacent matrix A G ’。
2.5 According to the line adjacency matrix A) G And', establishing a power system conversion topological structure taking the lines as nodes and the connection relationship between the lines as edges.
3) And injecting a plurality of attack data into the historical trend data to obtain trend sample data with false data.
Attack data a is as follows:
a＝Hc (2)
wherein c= [ c ] 1 ,c 2 ,...,c n ] T Is an arbitrary non-zero vector. c E R n×1 . n is the number of states. H is a jacobian matrix characterizing the topology of the power system. .
4) And extracting a tide characteristic value of the tide sample data, and labeling whether attack data exist on the tide characteristic value.
The tidal current characteristic value comprises an electrical betweenness and a tidal current offset coefficient index.
The electrical medium number B e (m, n) is as follows:
wherein L and G are respectively the collection of load nodes and power generation nodes in the power grid. W (W) i And W is j Representing the active power and node load values of the generator output, respectively. I ij (m, n) represents the electricity between the lines (m, n) after the unit current source is connected between the power source node i and the load node jFlow variation.
Tidal current offset coefficient index M i The following is shown:
wherein P is i0 And P j0 The initial active power of line i and line j are shown, respectively. L is the set of all transmission lines in the power grid. ΔP ji Is the amount of change in active power of line j due to line i opening.
The characteristic value of the tide is the preprocessed data. The preprocessing includes z-score normalization of the data. The normalized x' data is shown below:
wherein x is μ And x σ The sample mean and standard deviation, respectively. x represents the data before preprocessing.
5) And establishing a graph convolution network model for judging whether the power system is attacked or not based on the tidal current characteristic value of the tidal current sample data.
The step of establishing a graph roll-up network model for determining whether the power system is attacked includes:
5.1 Randomly dividing the tidal current characteristic values of the tidal current sample data into a test set and a training set.
5.2 A graph rolling network is built. The graph roll-up network model comprises an input layer, a plurality of hidden layers and an output layer.
5.3 Training the graph rolling network by using the training set to obtain the trained graph rolling network.
5.4 Testing the trained graph rolling network by using the test set, if the accuracy rate of the output result of the graph rolling network is greater than a preset threshold value, completing the establishment of a graph rolling network model, otherwise, re-acquiring the tidal current sample data and the tidal current characteristic value, and returning to the step 1).
The feature learning relationship between the feature values of any two layers of nodes of the graph-convolution network model is as follows:
where l represents the number of layers in which the node is located. s represents node v i Is defined, the number of adjacent nodes of (a).
Representing the eigenvalues of the ni-th node in the first layer. ni is the number of the neighbor node of node i. g% · ) Representing an activation function.
Is a network weight.
Is the eigenvalue of node i at layer l+1.
The output characteristics h' of the graph roll-up network model are as follows:
wherein alpha is ij For the attention factor, W is a shareable network parameter.
Acquisition of attention coefficient alpha ij The method comprises the following steps:
a) Recording M-dimensional characteristic input set of all line nodes in power system conversion topological structure as 
The output feature set is +.>
b) Calculating the degree of interaction e between the line nodes ij The method comprises the following steps:
where W is a sharable parameter. [ · || · ]Representing stitching. Shared attention mechanism a # · ) For mapping the spliced features to the correlation coefficient e ij And finally, completing the learning of the correlation between the node i and the node j.
c) Mapping of splice characteristics by using nonlinear activation function leak ReLU single-layer feedforward neural network, and updating of interaction degree e ij The following are provided:
its parameter is weight vector
The calculation formula of the correlation coefficient can be expressed as
In the method, in the process of the invention,
representing the weight vector.
Representing the input.
d) Using softmax function to influence degree of interaction e ij Normalized to the attention coefficient alpha ij The method comprises the following steps:
the activation function of the graph roll-up network model is an ELUs function.
Representing the input.
ELUs function as follows:
wherein α is an adjustment parameter. x is input data. g (x) is output data.
6) And acquiring current power flow data of the power system, and extracting a power flow characteristic value of the current power flow data. And inputting the current tidal current characteristic value of the current tidal current data into the graph rolling network model, and judging whether the power system line is attacked or not.
The invention has the technical effects that the traditional topological structure is transformed without doubt, the graph neural network FDIAs identification method considering the branch power flow characteristics is provided by utilizing the graph attention mechanism neural network, the characteristic vector representing the power flow characteristics of each branch is calculated through the power flow value of the line, and the deep data characteristics are mined by utilizing the connection relation among the lines and the neural network on the topological structure, so that the determination of the false data attack position is realized. The invention determines the identification precision and accuracy of the method by comparing with other identification methods under different attack degrees.
Drawings
FIG. 1 is a flow chart of a method for identifying FDIAs of the neural network of the figure taking into consideration branch tidal current characteristics;
FIG. 2 is a diagram of IEEE39 standard system circuit connections after topology conversion;
fig. 3 is a graph roll-up network and loss function dropping process for the graph annotation mechanism.
Detailed Description
The present invention is further described below with reference to examples, but it should not be construed that the scope of the above subject matter of the present invention is limited to the following examples. Various substitutions and alterations are made according to the ordinary skill and familiar means of the art without departing from the technical spirit of the invention, and all such substitutions and alterations are intended to be included in the scope of the invention.
Example 1:
referring to fig. 1 to 3, a false data injection attack identification method based on line topology analysis and tide characteristics includes the following steps:
1) And acquiring historical power flow data and an original topological structure of the power system.
2) And converting the original topological structure of the power system to obtain a conversion topological structure of the power system.
The steps for establishing the conversion topological structure diagram are as follows:
2.1 Establishing an adjacency matrix a for characterizing the original topology of the power system G The method comprises the following steps:
based on the concept of complex network theory and graph theory, for a topology structure diagram with N nodes and M edges, a node adjacency matrix A with N x N can be used G Representing a graph network structure in which element a in the matrix ij Represented as
A G ＝[a ij ] N×N
Wherein a is ij Representing node adjacency matrix A G Is a component of the group. v i 、v j Representing the ith and jth nodes of the graph network.
2.2 Extracting node adjacency matrix A G The number of adjacent nodes of each node in the array, and writing the adjacent nodes into a cell array A cell Is a kind of medium.
2.3 Determining adjacent lines of lines in a traditional topological graph of the power system and constructing a cell array E based on a line topological structure cell 。
2.4 Using the lines as nodes of the topological structure diagram, searching adjacent lines of each line, thereby establishing a line adjacent matrix A G ’。
2.5 According to the line adjacency matrix A) G And', establishing a power system conversion topological structure taking the lines as nodes and the connection relationship between the lines as edges.
3) And injecting a plurality of attack data into the historical trend data to obtain trend sample data with false data.
Attack data a is as follows:
a＝Hc (2)
wherein c= [ c ] 1 ,c 2 ,...,c n ] T Is an arbitrary non-zero vector. c E R n×1 . n is the number of states. H is a jacobian matrix characterizing the topology of the power system. .
4) And extracting a tide characteristic value of the tide sample data, and labeling whether attack data exist on the tide characteristic value.
The tidal current characteristic value comprises an electrical betweenness and a tidal current offset coefficient index.
The electrical medium number B e (m, n) is as follows:
wherein L and G are respectively the collection of load nodes and power generation nodes in the power grid. W (W) i And W is j Representing the active power and node load values of the generator output, respectively. I ij (m, n) represents the amount of current change between the lines (m, n) after the unit current source is connected between the power supply node i and the load node j.
Tidal current offset coefficient index M i The following is shown:
wherein P is i0 And P j0 The initial active power of line i and line j are shown, respectively. L is the set of all transmission lines in the power grid. ΔP ji Is the amount of change in active power of line j due to line i opening.
The characteristic value of the tide is the preprocessed data. The preprocessing includes z-score normalization of the data. The normalized x' data is shown below:
wherein x is μ And x σ The sample mean and standard deviation, respectively. x represents the data before preprocessing.
5) And establishing a graph convolution network model for judging whether the power system is attacked or not based on the tidal current characteristic value of the tidal current sample data.
The step of establishing a graph roll-up network model for determining whether the power system is attacked includes:
5.1 Randomly dividing the tidal current characteristic values of the tidal current sample data into a test set and a training set.
5.2 A graph rolling network is built. The graph roll-up network model comprises an input layer, a plurality of hidden layers and an output layer.
5.3 Training the graph rolling network by using the training set to obtain the trained graph rolling network.
5.4 Testing the trained graph rolling network by using the test set, if the accuracy rate of the output result of the graph rolling network is greater than a preset threshold value, completing the establishment of a graph rolling network model, otherwise, re-acquiring the tidal current sample data and the tidal current characteristic value, and returning to the step 1).
The feature learning relationship between the feature values of any two layers of nodes of the graph-convolution network model is as follows:
where l represents the number of layers in which the node is located. s represents node v i Is defined, the number of adjacent nodes of (a).
Representing the eigenvalues of the ni-th node in the first layer. ni is the number of the neighbor node of node i. g% · ) Representing an activation function. w is the network weight.
Is the eigenvalue of node i at layer l+1.
The output characteristics h' of the graph roll-up network model are as follows:
wherein alpha is ij For the attention factor, W is a shareable network parameter.
Acquisition of attention coefficient alpha ij The method comprises the following steps:
a) Recording M-dimensional characteristic input set of all line nodes in power system conversion topological structure as 
The output feature set is +.>
b) Calculating the degree of interaction e between the line nodes ij The method comprises the following steps:
where W is a sharable parameter. [ · || · ]Representing stitching. Shared attention mechanism a # · ) For mapping the spliced features to the correlation coefficient e ij And finally, completing the learning of the correlation between the node i and the node j.
Representing the input.
c) Mapping of splice characteristics by using nonlinear activation function leak ReLU single-layer feedforward neural network, and updating of interaction degree e ij The following are provided:
its parameter is weight vector
The calculation formula of the correlation coefficient can be expressed as
In the method, in the process of the invention,
representing the weight vector.
d) Using softmax function to influence degree of interaction e ij Normalized to the attention coefficient alpha ij The method comprises the following steps:
the activation function of the graph roll-up network model is an ELUs function.
Representing the input.
ELUs function as follows:
wherein α is an adjustment parameter. x is input data. g (x) is output data.
6) And acquiring current power flow data of the power system, and extracting a power flow characteristic value of the current power flow data. And inputting the current tidal current characteristic value of the current tidal current data into the graph rolling network model, and judging whether the power system line is attacked or not.
Example 2:
a false data injection attack identification method based on line topology analysis and tide characteristics comprises the following steps:
1) And converting the traditional topological structure of the power system to obtain the topological structure among the lines of the power system.
2) And (3) utilizing branch power flow data of the power system, injecting attack data into the power flow data based on a false data construction method, calculating an electrical betterment and a power flow offset coefficient index as power flow characteristics of the line, and marking whether the attack exists on the data.
3) And selecting an appropriate attention mechanism activation function and a loss function, and constructing an attention mechanism-based graph neural network model.
4) And carrying out normalization processing on the line tide characteristics by using a z-score method to obtain a node characteristic data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set.
5) The training sample set is used for parameter updating and optimizing of the graphic neural network, and the test set is used for verifying that the proposed method can accurately identify the attacked line and realize the identification of false data injection attack.
Example 3:
the main steps of the false data injection attack identification method based on line topology analysis and tide characteristics are as follows, referring to embodiment 2, wherein the main steps of establishing a conversion topology structure diagram are as follows:
1) Based on the concept of complex network theory and graph theory, for a topology structure diagram with N nodes and M edges, an adjacent matrix A of N can be used G Representing a graph network structure in which element a in the matrix ij Represented as
2) According to the adjacency matrix A G The number of adjacent nodes of each node can be known, and the number of 1 in the row of the adjacent matrix, i.e. the number of nodes adjacent to the node, can be taken as the value, so as to determine the elements in the cell array. In other words, a ij When=1, it means that the two nodes are connected. Using a cell array A cell And (3) representing.
3) Because the converted topological graph takes the lines as nodes and the connection relationship between the lines as edges, the lines in the traditional topological graph of the power system need to be numbered so as to find adjacent lines of the lines to form a corresponding cell array.
4) When a line is a node of a topology structure diagram, a neighboring line of each line is found. And according to the array formed by the line numbers, the adjacent matrix of the line connected with the head-to-tail node of the corresponding line, namely the branch.
5) Line topology based cell array E cell A corresponding line-based adjacency expression matrix A can be established G ’。
6) In a line adjacent matrix A G And drawing a topological graph structure of the electric power system by taking lines as nodes and the connection relationship between the lines as edges according to the' as a basis.
7) And (5) completing the construction of the topological structure conversion model diagram of the power system.
Example 4:
A false data injection attack identification method based on line topology analysis and power flow characteristics mainly includes the steps of referring to embodiment 2, according to power flow data of each branch in a power system, injecting attack amount into original power flow data according to a false data construction mode, and therefore a feature matrix of nodes of each branch is established. The establishment of the feature matrix considering the branch power flow mainly comprises the following two aspects:
1) Method for constructing false data
Given a known power system topology, an attacker injects an attack vector a into the measurement system, which satisfies
a＝Hc (2)
Wherein c= [ c ] 1 ,c 2 ,...,c n ] T For arbitrary non-zero vectors, c.epsilon.R n×1 N is the number of states, the measurement value becomes z a After =z+a, the state estimation value is
Accordingly, the residual equation becomes
As can be seen from the formula (4), when FDIAs exist in the measurement data, the residual error is still kept within the allowed range of the threshold value, so that the detection and identification of the bad data module are bypassed, and the attack on the power system is successfully initiated.
2) Node characteristic value considering branch tidal current data
2.1 Electrical medium number)
The electric energy in the electric power system is output by the generator, is transmitted to the load node through the line for power consumption, and the transmission of the tide accords with kirchhoff law. In other words, the magnitude of the power flow is affected by the magnitude of the impedance of the branch, and in the power flow transmission process, a line with the minimum impedance value often flows. Therefore, under the condition of considering the power topological structure and the tide at the same time, the electric betweenness is taken as one of the characteristics of the line nodes, the distribution and consumption of the load, the coupling relation between the magnitude of the generated energy and the topological structure of the power system are reflected, and the use condition of the power supply and the load on each power transmission line is reflected. The calculation formula is as follows:
Wherein L and G are respectively a set of load nodes and power generation nodes in the power grid; w (W) i And W is j Respectively representing active power and node load values output by the generator; i ij (m, n) represents the amount of current change between the lines (m, n), i.e., the unit power change value, after the unit current source is connected between the power source node i and the load node j.
2.2 Tide offset coefficient index)
In considering the operating state of the power system, a factor that must be considered is the transmission and distribution of the power flow between the lines. According to the safety principle of the power system N-1, when a certain line in the system goes out of operation, the system realizes self-regulation through the redistribution of tide. If during self-regulation the tidal current distribution is unbalanced, for example, some lines are charged with relatively little tidal current and some lines are charged with too much tidal current, causing the lines to be taken out of service due to overload, thus creating a power system cascading failure. The tide offset coefficient index can be used for expressing the influence of the change of the tide in a certain line on the tide in the whole system and quantitatively analyzing the mutual influence among the lines in the system. The power flow offset coefficient index is thus used as one of the features reflecting the power flow in the power system. The calculation formula of the index is as follows:
P in the formula i0 And P j0 The initial active power of the line i and the line j is respectively represented, L is the set of all the transmission lines in the power grid, and DeltaP ji Is the amount of change in active power of line j due to line i opening.
Example 5:
a false data injection attack identification method based on line topology analysis and tide characteristics mainly includes the steps as shown in the embodiment 2, wherein a convolutional neural network function selection mode based on an attention mechanism is as follows:
1) Solution mode of graph convolution network
When the nodes in the graph perform convolution operation, the characteristic learning relationship between the node characteristic values of the two nerve unit layers is that
Wherein l represents the layer number of the node, s represents the node v i Is defined by the number of adjacent nodes of the (a),
and the characteristic value of the ni-th node in the first layer is represented, ni is the number of the neighbor node of the node i, and in the graph rolling network, the characteristic value of the node i in the first layer is only related to the adjacent node of the node i in the first layer. g% · ) And the representation activation function is used for carrying out nonlinear learning on the data characteristics, w is the network weight, and the data characteristics are continuously updated in the training process.
Input signals x, x epsilon R for matrix composed of node features in the graph n Is defined as F (x) =u T x, accordingly, inverse definition of fourier transform Is that
Wherein->
Representing the frequency domain signal result of the input signal after fourier transformation. Conversion signal->
The elements in (a) are the coordinates of the image signals in orthogonal space based on the eigenvectors of the Laplacian matrix, thereby completing the task of projecting the original input into the corresponding image. Thus, the input signal can be converted into
Which is exactly the inverse of the fourier transform. Therefore, the calculation formula of the graph convolution operation obtained by combining the calculation formula of the convolutional neural network and the spectrogram theory is as follows
Wherein the method comprises the steps of
For inputting signals, f l For the number of layers of the input signal>
Updated parameters for the convolutional network.
In the power information physical system, the importance degree of each branch circuit to the system is different based on the admittance matrix and the circuit connection condition of each branch circuit, namely the weight of the edges in the converted topological graph is different. In addition, each branch circuit is disconnected according to different operation requirements, and the training and testing stages of the traditional graph convolutional network need to use topological graphs with the same structure, and the calculation cost is increased along with the increase of the topological structure scale, so that the problem of dynamic graph cannot be solved. In order to solve the problems, a graph attention mechanism is introduced to learn the feature weights of adjacent nodes through a network, and the adjacent node features are weighted and summed to complete the convolution operation of the graph neural network.
2) Function selection method of graph attention mechanism
On the basis of the atlas convolutional neural network, the graph attention mechanism calculates the connection coefficient between the nodes according to the connection relation and the node characteristics of the adjacent nodes, and distributes different weights for the nodes, so that the connection coefficient is taken as the difference consideration of each node. For an N-line power system, the M-dimensional feature input set of all line nodes in the conversion topology is expressed as
Its output feature set is +.>
For a specific node i, calculating the adjacent nodes and the correlation coefficients thereof, namely the degree of interaction between the line nodes, one by one, wherein the formula is as follows
Enhanced representation and concatenation of original input features by linear transformation of sharable parameters W · || · ]Shared attention mechanism a # · ) Mapping the spliced features to a correlation coefficient e ij And finally, completing the learning of the correlation between the node i and the node j. In the graph attention mechanism, a nonlinear activation function LeakyReLU single-layer feedforward neural network with a negative half-axis slope of 0.2 is used for mapping the splicing characteristics, and the parameters are weight vectors
The calculation formula of the correlation coefficient can be expressed as
Because of the difference in the dimensions of the correlation coefficients, the correlation coefficients between the nodes calculated in the formula (4.5) are normalized by using a softmax function, so that the weights between the nodes can be better distributed, and the attention coefficient can be obtained.
And according to the attention coefficients among the normalized nodes, similar to a graph convolution network, carrying out weighted summation on the characteristics of each node to obtain the output characteristics h' of the nodes.
Wherein alpha is ij For normalized attention coefficients, W is a sharable network parameter.
The graph attention mechanism reflects the correlation degree among the line nodes by using the attention coefficient, and aggregates the characteristics of adjacent nodes, so that the dependence of the traditional graph rolling network on the topological structure is eliminated, and the graph rolling network is suitable for a system with continuously changed topology. For power systems, the topology has dynamic characteristics due to the opening and closing of circuit breakers and the difference in line capacity. When the FDIAs are identified, the method is more suitable for feature learning and judging whether the branch is attacked or not by using the graph annotation mechanism network.
3) Method for selecting activation function
The invention introduces a novel activation function: ELUs functions for mapping features in two layers of neural units in a graph attention mechanism, which make some improvements based on ReLU activation functions. The ReLU activation function uniformly treats negative values as 0 and carries out linear output on positive values, so that the output value of the function has no negative value, the result is larger than 0 when the output is subjected to mean value calculation, the lower layer is easy to bias, mean value deviation is generated, and the problem of non-convergence occurs when a deeper network is trained. ELUs effectively solve this problem by introducing a negative activation function, whose formula is as follows
Where α is an adjustment parameter that controls the position at which the negative portion of the ELUs activation function reaches saturation.
When the graph annotating force mechanism is used for training and learning the topological graph of the power system, the number of nodes is large, and the topological structure is changed due to the disconnection of the branches, so that ELUs with strong noise robustness are selected as an activation function, and the problem of non-convergence of training is avoided.
Example 6:
the main steps of the false data injection attack identification method based on line topology analysis and tide characteristics are as shown in the embodiment 2, wherein in order to keep the dimension of node characteristics consistent, data needs to be preprocessed, and the processing method is as follows:
common min-max normalization methods process data based on the difference between the maximum and minimum values in a sample. For the power system scene of the practical application of the invention, considering the influence of the broken line of the power transmission line on the topological structure (for example, the power is 0 when the line is out of operation), a small number of data points deviating from the average value of the sample can appear in the sample. Preprocessing data based on maximum or minimum values in conventional methods may be affected by deviating data. Therefore, the z-score standardization method considering the whole information of the sample is selected to preprocess the data, and the method selects the standard deviation and the mean value of the sample to process the original data, so that the influence of a small amount of deviation data on data normalization is effectively solved, the distribution characteristics of the original data are ensured, and the characteristic extraction is facilitated. The calculation formula is as follows
Wherein x is μ And x σ The sample mean and standard deviation, respectively.
Example 7:
a false data injection attack identification method based on line topology analysis and tide characteristics mainly comprises the following steps of embodiment 2, wherein the process of parameter adjustment and optimization of the method by using training data samples and test data samples is as follows:
and reading a line admittance matrix and historical operation load data of the power system, obtaining a node adjacency matrix, and constructing a conversion topological structure diagram taking lines as nodes and the connection relationship between the lines as edges.
Based on the historical coincidence data, using a cow method to calculate the power flow data in the line, and using a false data construction method to inject false data into the historical power flow, so as to construct a power flow sample with the false data. Based on the existing power flow data, calculating a node characteristic matrix considering power flow operation characteristics, and taking the node characteristic matrix as input of a graph attention mechanism neural network to judge an attacked line.
Preprocessing the node characteristic data with complete calculation according to a normalization formula, and dividing the node characteristic data into a test sample and a training sample. The training sample data is used for adjusting parameters of a convolutional network based on a graph attention mechanism, and a graph rolling network model with the final purpose of whether nodes are attacked or not is constructed. The test sample is used for verifying the effectiveness of the FDIAs identification method and judging a specific attacked line; if the FDIAs do not exist, the identification process is ended.
Example 8:
an experiment of a false data injection attack identification method based on line topology analysis and tide characteristics mainly comprises the following steps:
1) And converting the traditional topological structure of the power system to obtain the topological structure among the lines of the power system. The correlation between the standard example lines of the IEEE39 node is drawn by using the Pytorch deep learning framework, and 46 lines are total. It should be noted that in the running process of Python, the initial value of the number is 0, and therefore, the number in the figure takes a value of 0-45. The line number in the topological structure diagram is based on the result of PowerWorld tide simulation calculation, and the final topological structure conversion result is shown in fig. 2.
2) And (3) utilizing branch power flow data of the power system, injecting attack data into the power flow data based on a false data construction method, calculating an electrical betterment and a power flow offset coefficient index as power flow characteristics of the line, and marking whether the attack exists on the data. And accessing the IEEE39 node to a continuous time load in a week of a transformer substation in a certain area in China, processing according to load data of the IEEE39 node to obtain a per unit value of the load data, and taking the per unit value into an IEEE39 system to obtain tide data. The final node characteristic calculation results are shown in table 1.
Table 1 characteristic values of nodes
| Line numbering | Electric medium number | Tidal current offset coefficient | Line numbering | Electric medium number | Tidal current offset coefficient |
| 1 | 1.075 | 22.43 | 24 | 0.986 | 26.41 |
| 2 | 0.320 | -20.62 | 25 | 2.080 | -4.92 |
| 3 | 1.780 | -9.55 | 26 | 2.930 | 5.92 |
| 4 | 1.930 | 3.54 | 27 | 1.938 | -0.02 |
| 5 | 0.984 | 0 | 28 | 1.330 | -0.02 |
| 6 | 0.998 | -69.67 | 29 | 1.256 | -0.01 |
| 7 | 0.874 | 11.07 | 30 | 0.864 | 2.27 |
| 8 | 0.968 | 11.89 | 31 | 0.798 | 35.28 |
| 9 | 0.784 | 0.94 | 32 | 0.782 | 0.01 |
| 10 | 0.886 | 5.78 | 33 | 0.537 | 0 |
| 11 | 0.936 | 2.21 | 34 | 0.254 | 0 |
| 12 | 0.952 | 2.68 | 35 | 1.135 | -0.01 |
| 13 | 1.273 | -5.10 | 36 | 1.325 | 0.10 |
| 14 | 0.682 | 102.97 | 37 | 0.584 | 0 |
| 15 | 0.920 | 5.50 | 38 | 1.324 | 0 |
| 16 | 0.889 | 55.95 | 39 | 0.654 | 0 |
| 17 | 0.546 | 55.95 | 40 | 1.456 | -13.40 |
| 18 | 1.180 | -4.45 | 41 | 0.576 | 0 |
| 19 | 1.220 | 4.45 | 42 | 1.800 | -3.39 |
| 20 | 0.687 | 0 | 43 | 0.236 | 0.05 |
| 21 | 1.260 | 47.71 | 44 | 1.246 | -0.03 |
| 22 | 1.147 | -30.03 | 45 | 0.998 | 0.01 |
| 23 | 1.330 | 5.01 | 46 | 0.847 | 0 |
As apparent from table 1, there is a certain relationship between the electrical betweenness of the lines and the degree between each node in the topology map, and the distribution state of the power flow of each node (i.e. each line) is reflected on the basis of fully considering the topology structure. For different line nodes, the partial index values have larger deviation and different index dimensions, so as to ensure the normal operation of the detection model, realize the identification of the attacked line, normalize each index in the node characteristic matrix according to a z-score normalization method, and perform subsequent calculation as the node matrix of the neural network based on the graph attention mechanism.
3) And selecting an appropriate attention mechanism activation function and a loss function, and constructing an attention mechanism-based graph neural network model. The invention selects ELUs as the activation function, selects cross entropy as the loss function, and determines the weight coefficient of each node in the conversion topological structure diagram by using the mapping of the LeakyReLU activation function and the activation function in the process of updating the attention mechanism. The convergence of the neural network is shown in FIG. 3, and the detection performance is shown in Table 2.
Table 2 example performance index results based on IEEE39 standard system
4) And carrying out normalization processing on the line tide characteristics by using a z-score method to obtain a node characteristic data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set. Calculating the normalized result of each node characteristic in the table 1 according to the normalized equation of the z-score, and carrying out settlement in the graph annotation force mechanism convolutional network determined in the step 3).
5) The training sample set is used for parameter updating and optimizing of the graphic neural network, and the test set is used for verifying that the proposed method can accurately identify the attacked line and realize the identification of false data injection attack. The final results are shown in Table 3, with the amplitude perturbations being set to 0.005,0.05 and 0.1, respectively, at different amplitude perturbations sigma, as compared to other false data recognition methods.
TABLE 3 comparative analysis of identification results for different methods
From the data in table 3, the graph convolution network based on the traditional topological structure, the algorithm for fusing the convolution neural network and the bad data and the convolution network based on the circuit topological structure provided by the invention have no great difference in precision and recall rate. However, when the amplitude disturbance of the state value increases, the accuracy and precision of the first two methods are continuously reduced, while the detection precision and recall of the method provided by the invention are gradually increased within a small range, and the stable level is maintained. This is because the first two methods are both based on the original topology structure, and perform identification analysis on the state estimation value of the node, when the amplitude disturbance occurs in the system, the larger the disturbance amplitude is, the greater the possibility that the normal data is misjudged, resulting in a decrease in detection performance. The method provided by the invention considers the connection relation between the lines and the characteristics of tide data, and can more reflect the characteristics of the system when disturbance occurs in the system based on the lines.
Example 9:
referring to fig. 1, a false data injection attack identification method based on line topology analysis and tide characteristics mainly comprises the following steps:
1) And converting the traditional topological structure of the power system to obtain the topological structure among the lines of the power system.
The main steps for converting the traditional topological structure of the power system are as follows:
1.1 Based on the concept of complex network theory and graph theory, for a topology structure with N nodes and M edges, the graph network structure can be represented by an n×n adjacency matrix AG, where the elements aij in the matrix are represented as
1.2 The number of adjacent nodes per node is known from the adjacency matrix AG, and the number of 1's, i.e., the number of nodes adjacent to the node, in the row of the adjacency matrix determines the elements in the cell array. In other words, aij=1 indicates that two nodes are connected. Using a cell array Acell representation.
1.3 Because the converted topological graph takes the lines as nodes and the connection relationship between the lines as edges, the lines in the traditional topological graph of the power system need to be numbered so as to find the adjacent lines of the lines to form a corresponding cell array.
1.4 When a line is a node of the topology structure diagram, a neighboring line of each line is found. And according to the array formed by the line numbers, the adjacent matrix of the line connected with the head-to-tail node of the corresponding line, namely the branch.
1.5 A line topology based cell array Ecell can establish a corresponding line based adjacency expression matrix AG'.
1.6 Based on the line adjacent matrix AG', drawing a topology diagram structure of the power system with lines as nodes and the connection relationship between the lines as edges.
1.7 Completing the construction of the topological structure conversion model diagram of the power system.
2) And (3) utilizing branch power flow data of the power system, injecting attack data into the power flow data based on a false data construction method, calculating an electrical betterment and a power flow offset coefficient index as power flow characteristics of the line, and marking whether the attack exists on the data.
According to the power flow data of each branch in the power system, the attack quantity is injected into the original power flow data according to the construction mode of the false data, so that the characteristic matrix of each branch node is established. The establishment of the feature matrix considering the branch power flow mainly comprises the following two aspects:
2.1 Mode of constructing dummy data
Given a known power system topology, an attacker injects an attack vector a into the measurement system, which satisfies
a＝Hc (2)
Wherein c= [ c ] 1 ,c 2 ,...,c n ] T For arbitrary non-zero vectors, c.epsilon.R n×1 N is the number of states, the measurement value becomes z a After =z+a, the state estimation value is
Accordingly, the residual equation becomes
As can be seen from the formula (4), when FDIAs exist in the measurement data, the residual error is still kept within the allowed range of the threshold value, so that the detection and identification of the bad data module are bypassed, and the attack on the power system is successfully initiated.
2.2 Taking into account node characteristic values of branch tidal current data
2.2.1 Electrical medium number)
The electric energy in the electric power system is output by the generator, is transmitted to the load node through the line for power consumption, and the transmission of the tide accords with kirchhoff law. In other words, the magnitude of the power flow is affected by the magnitude of the impedance of the branch, and in the power flow transmission process, a line with the minimum impedance value often flows. Therefore, under the condition of considering the power topological structure and the tide at the same time, the electric betweenness is taken as one of the characteristics of the line nodes, the distribution and consumption of the load, the coupling relation between the magnitude of the generated energy and the topological structure of the power system are reflected, and the use condition of the power supply and the load on each power transmission line is reflected. The calculation formula is as follows:
wherein L and G are respectively a set of load nodes and power generation nodes in the power grid; w (W) i And W is j Respectively representing active power and node load values output by the generator; i ij (m, n) represents the power node i and the load node After the unit current source is connected between j, the current variation between the lines (m, n), namely the unit power variation value.
2.2.2 Tide offset coefficient index)
In considering the operating state of the power system, a factor that must be considered is the transmission and distribution of the power flow between the lines. According to the safety principle of the power system N-1, when a certain line in the system goes out of operation, the system realizes self-regulation through the redistribution of tide. If during self-regulation the tidal current distribution is unbalanced, for example, some lines are charged with relatively little tidal current and some lines are charged with too much tidal current, causing the lines to be taken out of service due to overload, thus creating a power system cascading failure. The tide offset coefficient index can be used for expressing the influence of the change of the tide in a certain line on the tide in the whole system and quantitatively analyzing the mutual influence among the lines in the system. The power flow offset coefficient index is thus used as one of the features reflecting the power flow in the power system. The calculation formula of the index is as follows:
p in the formula i0 And P j0 The initial active power of the line i and the line j is respectively represented, L is the set of all the transmission lines in the power grid, and DeltaP ji Is the amount of change in active power of line j due to line i opening.
3) And selecting an appropriate attention mechanism activation function and a loss function, and constructing an attention mechanism-based graph neural network model.
The selection method of the graph attention mechanism activation function and the loss function is as follows:
3.1 Solution mode of graph convolution network
When the nodes in the graph perform convolution operation, the characteristic learning relationship between the node characteristic values of the two nerve unit layers is that
Wherein l represents the layer number of the node, s represents the node v i Is defined by the number of adjacent nodes of the (a),
and the characteristic value of the ni-th node in the first layer is represented, ni is the number of the neighbor node of the node i, and in the graph rolling network, the characteristic value of the node i in the first layer is only related to the adjacent node of the node i in the first layer. g% · ) And the representation activation function is used for carrying out nonlinear learning on the data characteristics, w is the network weight, and the data characteristics are continuously updated in the training process.
Input signals x, x epsilon R for matrix composed of node features in the graph n Is defined as F (x) =u T x, accordingly, the inverse of the Fourier transform is defined as
Wherein->
Representing the frequency domain signal result of the input signal after fourier transformation. Conversion signal->
The elements in (a) are the coordinates of the image signals in orthogonal space based on the eigenvectors of the Laplacian matrix, thereby completing the task of projecting the original input into the corresponding image. Thus, the input signal can be converted into 
Which is exactly the inverse of the fourier transform. Therefore, the calculation formula of the graph convolution operation obtained by combining the calculation formula of the convolutional neural network and the spectrogram theory is as follows
Wherein the method comprises the steps of
For inputting signals, f l For the number of layers of the input signal>
Updated parameters for the convolutional network.
In the power information physical system, the importance degree of each branch circuit to the system is different based on the admittance matrix and the circuit connection condition of each branch circuit, namely the weight of the edges in the converted topological graph is different. In addition, each branch circuit is disconnected according to different operation requirements, and the training and testing stages of the traditional graph convolutional network need to use topological graphs with the same structure, and the calculation cost is increased along with the increase of the topological structure scale, so that the problem of dynamic graph cannot be solved. In order to solve the problems, a graph attention mechanism is introduced to learn the feature weights of adjacent nodes through a network, and the adjacent node features are weighted and summed to complete the convolution operation of the graph neural network.
3.2 Function selection method of graph annotation force mechanism
On the basis of the atlas convolutional neural network, the graph attention mechanism calculates the connection coefficient between the nodes according to the connection relation and the node characteristics of the adjacent nodes, and distributes different weights for the nodes, so that the connection coefficient is taken as the difference consideration of each node. For an N-line power system, the M-dimensional feature input set of all line nodes in the conversion topology is expressed as 
Its output feature set is +.>
For a specific node i, calculating the adjacent nodes and the correlation coefficients thereof, namely the degree of interaction between the line nodes, one by one, wherein the formula is as follows
Through the cocoaLinear transformation of shared parameter W to enhance representation of original input features and concatenation · || · ]Shared attention mechanism a # · ) Mapping the spliced features to a correlation coefficient e ij And finally, completing the learning of the correlation between the node i and the node j. In the graph attention mechanism, a nonlinear activation function LeakyReLU single-layer feedforward neural network with a negative half-axis slope of 0.2 is used for mapping the splicing characteristics, and the parameters are weight vectors
The calculation formula of the correlation coefficient can be expressed as
Because of the difference in the dimensions of the correlation coefficients, the correlation coefficients between the nodes calculated in the formula (4.5) are normalized by using a softmax function, so that the weights between the nodes can be better distributed, and the attention coefficient can be obtained.
And according to the attention coefficients among the normalized nodes, similar to a graph convolution network, carrying out weighted summation on the characteristics of each node to obtain the output characteristics h' of the nodes.
Wherein alpha is ij For normalized attention coefficients, W is a sharable network parameter.
The graph attention mechanism reflects the correlation degree among the line nodes by using the attention coefficient, and aggregates the characteristics of adjacent nodes, so that the dependence of the traditional graph rolling network on the topological structure is eliminated, and the graph rolling network is suitable for a system with continuously changed topology. For power systems, the topology has dynamic characteristics due to the opening and closing of circuit breakers and the difference in line capacity. When the FDIAs are identified, the method is more suitable for feature learning and judging whether the branch is attacked or not by using the graph annotation mechanism network.
3.3 Method for selecting activation function
The invention introduces a novel activation function: ELUs functions for mapping features in two layers of neural units in a graph attention mechanism, which make some improvements based on ReLU activation functions. The ReLU activation function uniformly treats negative values as 0 and carries out linear output on positive values, so that the output value of the function has no negative value, the result is larger than 0 when the output is subjected to mean value calculation, the lower layer is easy to bias, mean value deviation is generated, and the problem of non-convergence occurs when a deeper network is trained. ELUs effectively solve this problem by introducing a negative activation function, whose formula is as follows
Where α is an adjustment parameter that controls the position at which the negative portion of the ELUs activation function reaches saturation.
When the graph annotating force mechanism is used for training and learning the topological graph of the power system, the number of nodes is large, and the topological structure is changed due to the disconnection of the branches, so that ELUs with strong noise robustness are selected as an activation function, and the problem of non-convergence of training is avoided.
4) And carrying out normalization processing on the line tide characteristics by using a z-score method to obtain a node characteristic data set with consistent dimensions. The normalized data set is divided into a training sample set and a test sample set.
Common min-max normalization methods process data based on the difference between the maximum and minimum values in a sample. For the power system scene of the practical application of the invention, considering the influence of the broken line of the power transmission line on the topological structure (for example, the power is 0 when the line is out of operation), a small number of data points deviating from the average value of the sample can appear in the sample. Preprocessing data based on maximum or minimum values in conventional methods may be affected by deviating data. Therefore, the z-score standardization method considering the whole information of the sample is selected to preprocess the data, and the method selects the standard deviation and the mean value of the sample to process the original data, so that the influence of a small amount of deviation data on data normalization is effectively solved, the distribution characteristics of the original data are ensured, and the characteristic extraction is facilitated. The calculation formula is as follows
Wherein x is μ And x σ The sample mean and standard deviation, respectively.
5) The training sample set is used for parameter updating and optimizing of the graphic neural network, and the test set is used for verifying that the proposed method can accurately identify the attacked line and realize the identification of false data injection attack.
The process of parameter adjustment and optimization of the proposed method using training data samples and test data samples is as follows:
5.1 Reading a line admittance matrix and historical operation load data of the power system, obtaining a node adjacency matrix, and constructing a conversion topology structure diagram taking lines as nodes and the connection relationship between the lines as edges.
5.2 Based on the historical coincidence data, using a bovine-derived method to calculate the power flow data in the line, and using a false data construction method to inject false data into the historical power flow, so as to construct a power flow sample with the false data. Based on the existing power flow data, calculating a node characteristic matrix considering power flow operation characteristics, and taking the node characteristic matrix as input of a graph attention mechanism neural network to judge an attacked line.
5.3 Preprocessing the node characteristic data with complete calculation according to a normalization formula, and dividing the node characteristic data into a test sample and a training sample. The training sample data is used for adjusting parameters of a convolutional network based on a graph attention mechanism, and a graph rolling network model with the final purpose of whether nodes are attacked or not is constructed. The test sample is used for verifying the effectiveness of the FDIAs identification method and judging a specific attacked line; if the FDIAs do not exist, the identification process is ended.
Claims (5)
1. A false data injection attack identification method based on line topology analysis and tide characteristics is characterized by comprising the following steps:
1) Acquiring historical power flow data and an original topological structure of a power system;
2) Converting an original topological structure of the power system to obtain a conversion topological structure of the power system;
the steps for establishing the power system conversion topology structure are as follows:
2.1 Establishing an adjacency matrix a for characterizing the original topology of the power system G The method comprises the following steps:
based on the concept of complex network theory and graph theory, for a topology structure diagram with N nodes and M edges, a node adjacency matrix A with N x M is used G Representing a graph network structure in which element a in the matrix ij Represented as
Wherein a is ij Representing node adjacency matrix A G Elements of (a) and (b); v i 、v j Representing the ith and jth nodes of the graph network;
2.2 Extracting node adjacency matrix A G The number of adjacent nodes of each node in the array, and writing the adjacent nodes into a cell array A cell In (a) and (b);
2.3 Determining adjacent lines of lines in a traditional topological graph of the power system and constructing a cell array E based on a line topological structure cell ；
2.4 Using the lines as nodes of the topological structure diagram, searching adjacent lines of each line, thereby establishing a line adjacent matrix A G ’；
2.5 According to the line adjacency matrix A) G ' establishing a power system conversion topological structure taking lines as nodes and the connection relationship between the lines as edges;
3) Injecting a plurality of attack data into the historical trend data to obtain trend sample data with false data;
4) Extracting a tide characteristic value of the tide sample data, and labeling whether attack data exist on the tide characteristic value;
5) Based on the tidal current characteristic value of the tidal current sample data, establishing a graph convolution network model for judging whether the power system is attacked;
the tide characteristic value comprises an electrical betweenness and a tide offset coefficient index;
the electrical medium number B e (m, n) is as follows:
wherein L and G are respectively a set of load nodes and power generation nodes in the power grid; w (W) i And W is j Respectively representing active power and node load values output by the generator; i ij (m, n) represents the amount of current change between the lines (m, n) after the unit current source is connected between the power source node i and the load node j;
tidal current offset coefficient index M i The following is shown:
wherein P is i'0 And P j'0 The initial active power of line i 'and line j', respectively; l' is a set of all power transmission lines in the power grid; ΔP j'i' The change amount of active power of the line j 'caused by disconnection of the line i';
The step of establishing a graph roll-up network model for determining whether the power system is attacked includes:
5.1 Randomly dividing the tide characteristic value of the tide sample data into a test set and a training set;
5.2 Building a graph rolling network; the graph rolling network model comprises an input layer, a plurality of hidden layers and an output layer;
5.3 Training the graph rolling network by using a training set to obtain a trained graph rolling network;
5.4 Testing the trained graph rolling network by using the test set, if the accuracy rate of the output result of the graph rolling network is greater than a preset threshold value, completing the establishment of a graph rolling network model, otherwise, re-acquiring the tidal current sample data and the tidal current characteristic value, and returning to the step 5.1);
the feature learning relationship between the feature values of any two layers of nodes of the graph-convolution network model is as follows:
wherein, l represents the layer number of the node; s represents node v i Is the number of adjacent nodes;
representing the characteristic value of the ni node in the first layer; ni is the number of the neighbor node of the node i; g () represents an activation function;
Is a network weight;
The characteristic value of the node i in the layer 1+1;
output features of the graph roll-up network model
The following is shown:
wherein a' ij For the attention factor, W is a sharable network parameter;
representing an input;
6) Acquiring current power flow data of the power system, and extracting a power flow characteristic value of the current power flow data; and inputting the current tidal current characteristic value of the current tidal current data into the graph rolling network model, and judging whether the power system line is attacked or not.
2. The false data injection attack identification method based on line topology analysis and tide characteristics according to claim 1, wherein attack data a is as follows:
a＝Hc (6)
wherein c= [ c ] 1 ,c 2 ,...,c n ] T Is an arbitrary non-zero vector; c E R n×1 The method comprises the steps of carrying out a first treatment on the surface of the n is the number of states; h is a jacobian matrix characterizing the topology of the power system.
3. The false data injection attack identification method based on line topology analysis and power flow characteristics according to claim 1, wherein the power flow characteristic value is preprocessed data; the preprocessing includes z-score normalization of the data; the normalized x' data is shown below:
wherein x is μ And x σ Respectively sample mean and standard deviation; x represents the data before preprocessing.
4. The false data injection attack identification method based on line topology analysis and tide characteristics according to claim 1, wherein attention coefficient a 'is obtained' ij The method comprises the following steps:
1) Recording M-dimensional characteristic input set of all line nodes in power system conversion topological structure as
The output feature set is +.>
2) Calculating the degree of interaction e between the line nodes ij The method comprises the following steps:
wherein W is a sharable parameter; [. I. ]]Representing and splicing; the shared attention mechanism a ()' is used to map the stitched features to the correlation coefficient e ij The study of the correlation between the node i and the node j is completed;
representing an input; />
3) Mapping of splice characteristics by using nonlinear activation function LeakyReLU single-layer feedforward neural network, and updating of interaction degree e ij The following are provided:
its parameter is weight vector
The calculation formula of the correlation coefficient can be expressed as
In the method, in the process of the invention,
representing a weight vector;
4) Using softmax function to influence degree of interaction e ij Normalization is performed to obtain attention coefficient a' ij The method comprises the following steps:
in the method, in the process of the invention,
representing the input.
5. The false data injection attack identification method based on line topology analysis and power flow characteristics according to claim 1, wherein the activation function of the graph rolling network model is an ELus function;
ELUs function as follows:
wherein alpha is an adjustment parameter; x is input data; g (x) is output data.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110729263.6A CN113904786B (en) | 2021-06-29 | 2021-06-29 | False data injection attack identification method based on line topology analysis and tide characteristics |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110729263.6A CN113904786B (en) | 2021-06-29 | 2021-06-29 | False data injection attack identification method based on line topology analysis and tide characteristics |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113904786A CN113904786A (en) | 2022-01-07 |
| CN113904786B true CN113904786B (en) | 2023-05-30 |
Family
ID=79187535
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110729263.6A Active CN113904786B (en) | 2021-06-29 | 2021-06-29 | False data injection attack identification method based on line topology analysis and tide characteristics |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113904786B (en) |
Families Citing this family (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114050975B (en) * | 2022-01-10 | 2022-04-19 | 苏州浪潮智能科技有限公司 | Heterogeneous multi-node interconnection topology generation method and storage medium |
| CN114527651A (en) * | 2022-01-21 | 2022-05-24 | 深圳市三旺通信股份有限公司 | Attack detection method, system, device and storage medium for control system |
| CN114615042B (en) * | 2022-03-08 | 2023-04-07 | 中国矿业大学 | Attack defense method for power generator to maliciously attack power grid to gain profit |
| CN114865638A (en) * | 2022-03-22 | 2022-08-05 | 武汉大学 | Power grid low-voltage load shedding emergency control method based on deep graph reinforcement learning |
| CN114978586B (en) * | 2022-04-12 | 2023-07-04 | 东北电力大学 | Power grid attack detection method and system based on attack genes and electronic equipment |
| CN115144695B (en) * | 2022-06-29 | 2023-09-19 | 国网北京市电力公司 | Method, device, equipment and medium for searching fault line of low-current grounding system |
| CN116304621B (en) * | 2023-03-01 | 2024-06-04 | 浙江大学 | Smart grid false data injection attack positioning method based on frequency spectrum domain data driving |
Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108234492A (en) * | 2018-01-02 | 2018-06-29 | 国网四川省电力公司信息通信公司 | Consider the power information physics concerted attack analysis method of load data falseness injection |
| CN110035090A (en) * | 2019-05-10 | 2019-07-19 | 燕山大学 | A kind of smart grid false data detection method for injection attack |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110929989B (en) * | 2019-10-29 | 2023-04-18 | 重庆大学 | N-1 safety checking method with uncertainty based on deep learning |
| AU2020103195A4 (en) * | 2020-11-03 | 2021-01-14 | East China University Of Science And Technology | A Method for Detecting Vulnerability of Large-scale Power Grid Based On Complex Network |
-
2021
- 2021-06-29 CN CN202110729263.6A patent/CN113904786B/en active Active
Patent Citations (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN108234492A (en) * | 2018-01-02 | 2018-06-29 | 国网四川省电力公司信息通信公司 | Consider the power information physics concerted attack analysis method of load data falseness injection |
| CN110035090A (en) * | 2019-05-10 | 2019-07-19 | 燕山大学 | A kind of smart grid false data detection method for injection attack |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113904786A (en) | 2022-01-07 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113904786B (en) | False data injection attack identification method based on line topology analysis and tide characteristics | |
| CN109635928B (en) | Voltage sag reason identification method based on deep learning model fusion | |
| Tonelli‐Neto et al. | Fuzzy based methodologies comparison for high‐impedance fault diagnosis in radial distribution feeders | |
| CN104809722A (en) | Electrical device fault diagnosis method based on infrared thermography | |
| CN110889111A (en) | Power grid virtual data injection attack detection method based on deep belief network | |
| CN109995031A (en) | Probabilistic Load Flow deep learning calculation method based on physical model | |
| Qu et al. | Active and passive hybrid detection method for power CPS false data injection attacks with improved AKF and GRU‐CNN | |
| Mola et al. | ANFIS model based on fuzzy C‐mean, grid partitioning and subtractive clustering to detection of stator winding inter‐turn fault for PM synchronous motor | |
| CN116527346A (en) | Threat node perception method based on deep learning graph neural network theory | |
| Ye et al. | Single pole‐to‐ground fault location method for mmc‐hvdc system using wavelet decomposition and dbn | |
| Eidiani | A rapid state estimation method for calculating transmission capacity despite cyber security concerns | |
| CN114415056A (en) | Distributed power supply island fault detection method | |
| CN114189047A (en) | False data detection and correction method for active power distribution network state estimation | |
| Chi et al. | A fault diagnosis method of double-layer LSTM for 10 kV single-core cable based on multiple observable electrical quantities | |
| CN115291039B (en) | Single-phase earth fault line selection method for resonance earthing system | |
| Lukomski et al. | Power system topology verification using artificial neural networks: maximum utilization of measurement data | |
| Yan et al. | Application of random matrix model in multiple abnormal sources detection and location based on PMU monitoring data in distribution network | |
| Zeng et al. | Load component decomposition and online modelling based on small disturbance response characteristic matching | |
| CN110391935B (en) | Measurement degree evaluation method and system considering information physical coupling characteristics and information disturbance | |
| CN114841266A (en) | Voltage sag identification method based on triple prototype network under small sample | |
| CN108133280A (en) | A kind of icing flashover influence factor screening technique based on inclined mutual information method | |
| CN114519294A (en) | Power cable fault identification method based on wavelet singular entropy and BP neural network | |
| Lu et al. | Anomaly Recognition Method for Massive Data of Power Internet of Things Based on Bayesian Belief Network | |
| Wang et al. | Distribution System Anomaly Detection Based on AnoGAN Embedded with Cross-Stitch Units | |
| You | Safe Operation Management of Urban Smart Grid Based on Deep Learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |