CN115189350A - Real-time electricity price attack detection method and device for power grid user side and storage medium - Google Patents
Real-time electricity price attack detection method and device for power grid user side and storage medium Download PDFInfo
- Publication number
- CN115189350A CN115189350A CN202210831342.2A CN202210831342A CN115189350A CN 115189350 A CN115189350 A CN 115189350A CN 202210831342 A CN202210831342 A CN 202210831342A CN 115189350 A CN115189350 A CN 115189350A
- Authority
- CN
- China
- Prior art keywords
- time
- power grid
- attack
- load data
- real
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J3/00—Circuit arrangements for ac mains or ac distribution networks
-
- G—PHYSICS
- G01—MEASURING; TESTING
- G01R—MEASURING ELECTRIC VARIABLES; MEASURING MAGNETIC VARIABLES
- G01R31/00—Arrangements for testing electric properties; Arrangements for locating electric faults; Arrangements for electrical testing characterised by what is being tested not provided for elsewhere
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J3/00—Circuit arrangements for ac mains or ac distribution networks
- H02J3/003—Load forecast, e.g. methods or systems for forecasting future load demand
-
- H—ELECTRICITY
- H02—GENERATION; CONVERSION OR DISTRIBUTION OF ELECTRIC POWER
- H02J—CIRCUIT ARRANGEMENTS OR SYSTEMS FOR SUPPLYING OR DISTRIBUTING ELECTRIC POWER; SYSTEMS FOR STORING ELECTRIC ENERGY
- H02J2203/00—Indexing scheme relating to details of circuit arrangements for AC mains or AC distribution networks
- H02J2203/20—Simulating, e g planning, reliability check, modelling or computer assisted design [CAD]
Landscapes
- Engineering & Computer Science (AREA)
- Power Engineering (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention discloses a real-time power price attack detection method and device for a power grid user side and a storage medium. The method comprises the steps that current power utilization data of power grid users are input into a corresponding load prediction model based on a linear regression prediction algorithm in a grouping mode, predicted load data of each group of power grid users are output, and the predicted load data of each group of power grid users are aggregated to obtain the current predicted load data of a power grid user side; acquiring real-time load data of the intelligent electric meter, and calculating a load proportion coefficient according to the real-time load data and predicted load data; and accumulating the likelihood ratio of the load scale factor through a decision function, calculating attack invasion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack invasion time. According to the technical scheme, the detection precision of real-time electricity price attack is improved, and the safe and stable operation of the intelligent power system is guaranteed.
Description
Technical Field
The invention relates to the technical field of price of electricity attack detection, in particular to a real-time price of electricity attack detection method and device for a power grid user side and a storage medium.
Background
With the continuous development of the power industry, the power network is intelligently upgraded, so that an intelligent power grid is generated. Specifically, the smart grid is a power network system with multiple advantages realized by applying a secure, bidirectional network communication technology to a conventional power network.
In recent years, with higher requirements on a new generation of smart power grid, the novel smart power grid realizes real-time monitoring of the operating condition by deploying sensors at key equipment in the power network, then collects and integrates data through a communication network, and finally, a control center analyzes and evaluates the collected data to make an optimal scheduling decision for the power system. However, a new safety problem is generated, a novel online real-time electricity price response attack aiming at an intelligent dispatching system is realized, false electricity price information is injected in a user electricity consumption peak period, so that the intelligent dispatching system makes a decision to be wrong, abnormal fluctuation of a load curve is caused until a peak value is broken through, then a power grid protection device is triggered to act, large-area power failure is caused, and the purpose of attack is achieved.
However, a relatively accurate detection scheme for the real-time electricity price attack is lacked in the prior art, and therefore, in order to defend the attack and ensure the safe and stable operation of the intelligent power system, an online real-time electricity price response attack detection scheme for a power grid user side is urgently needed, and the attack is timely found to reduce loss.
Disclosure of Invention
The invention provides a real-time power price attack detection method and device for a power grid user side and a storage medium, which improve the detection precision of the real-time power price attack and ensure the safe and stable operation of an intelligent power system.
An embodiment of the invention provides a real-time power price attack detection method for a power grid user side, which comprises the following steps:
the method comprises the steps that current power utilization data of power grid users are input to a corresponding load prediction model based on a linear regression prediction algorithm in a grouping mode, predicted load data of all groups of power grid users are output, and the predicted load data of all groups of power grid users are aggregated to obtain current predicted load data of a power grid user side;
acquiring real-time load data of the intelligent electric meter, and calculating a load proportion coefficient according to the real-time load data and predicted load data;
and accumulating the likelihood ratio of the load scale factor through a decision function, calculating attack intrusion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack intrusion time.
Further, extracting characteristics of the power utilization behaviors of the power grid users, and clustering and grouping the power grid users according to the characteristic extraction result;
and according to the clustering grouping result, inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm in a grouping manner, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side.
Further, the electricity consumption data comprises user electricity consumption time data and user electricity consumption load data.
Further, the user electricity consumption time data comprises a time slice of the current electricity consumption time, a month of the current electricity consumption time, a current electricity consumption date and a day of the current electricity consumption week.
Further, the user electricity load data includes electricity consumption of 5 hours in the past of the current day, electricity consumption of the same time slice of the previous day and 5 hours in the past, electricity consumption of the same time slice of the last week and 5 hours in the past, and electricity consumption of the same time slice of the last month and 5 hours in the past.
Further, the load proportion coefficient at the current moment is calculated according to the following formula:
wherein R is t Represents the load proportionality coefficient, C t Representing real-time load data, D t Representing predicted load data, t cur Indicating the current time of day.
Further, the likelihood ratios of the load scaling factors are accumulated according to the following decision function:
G[t cur ]＝max{G[t cur -1]+s[t cur ]，0}
wherein, G [ t ] cur ]Represents t cur Generalized log-likelihood ratio of time of day, s [ t ] cur ]And the generalized log-likelihood ratio of the load proportionality coefficient at the current moment under two probability distributions is represented, wherein the two probability distributions refer to the probability distribution under an attack state and the probability distribution under a non-attack state.
Further, the attack invasion time is calculated according to the following formula:
wherein, P (R) t α) represents R in an attack state t Probability distribution of (1), P (R) t 0) represents R in the non-attacked state t Probability distribution of (1), t A Represents the time of the intrusion attack, t cur Representing the current time instant and t representing time.
The invention provides a real-time power price attack detection device on a power grid user side, which comprises a load data prediction module, a load proportionality coefficient calculation module and an attack alarm module;
the load data prediction module is used for inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm in groups, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side;
the load proportion coefficient calculation module is used for acquiring real-time load data of the intelligent electric meter and calculating a load proportion coefficient according to the real-time load data and the predicted load data;
the attack alarm module is used for accumulating the likelihood ratio of the load proportionality coefficient through a decision function, calculating attack invasion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack invasion time
Another embodiment of the present invention provides a readable storage medium, where the readable storage medium includes a stored computer program, and when the computer program is executed, the apparatus where the readable storage medium is located is controlled to execute the method for detecting a real-time price attack on a power grid user side according to any one of the method embodiments of the present invention.
The embodiment of the invention has the following beneficial effects:
the invention provides a real-time electricity price attack detection method, a real-time electricity price attack detection device and a storage medium for a power grid user side. And then, calculating a load proportion coefficient according to the real-time load data and the predicted load data, accumulating the likelihood ratio of the load proportion coefficient, and accurately judging whether an attack exists or not and accurately calculating attack invasion time according to the accumulation condition of the likelihood ratio. In summary, compared with the traditional attack detection method, the method provided by the invention can obviously improve the detection range and detection precision of the network attack on the user side of the smart grid.
Drawings
Fig. 1 is a schematic flowchart of a method for detecting a real-time price attack on a user side of a power grid according to an embodiment of the present invention;
fig. 2 is a schematic structural diagram of a real-time price attack detection apparatus on a power grid user side according to an embodiment of the present invention.
Detailed Description
The technical solutions in the present invention will be described clearly and completely with reference to the accompanying drawings, and it is obvious that the described embodiments are only some embodiments of the present invention, not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
As shown in fig. 1, a method for detecting a real-time price attack on a power grid user side according to an embodiment of the present invention includes the following steps:
and S101, inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm in groups, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side.
The embodiment of the invention enhances the accuracy of the whole load prediction at the user side through the user grouping prediction.
As one example, step S101 includes the following sub-steps:
a substep S1011 of extracting characteristics of the power utilization behaviors of the power grid users and clustering and grouping the power grid users according to the characteristic extraction result;
and the substep S1012, inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm according to the clustering grouping result, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side.
The method comprises the steps of performing feature extraction on power consumption behaviors of power grid users based on historical user load data of an intelligent ammeter, establishing a primary similar behavior feature cluster, and clustering and grouping the power grid users by using a k-means clustering algorithm; each group can be regarded as a subsystem, then a linear regression prediction algorithm and characteristic variable selection are adopted to predict the load of the subsystems (namely, the load data of the power grid user side is subjected to group prediction), then the prediction results of the subsystems are aggregated (the predicted load data of the power grid user side is obtained), and finally the prediction of the total load data of the power grid user side is realized.
According to the clustering grouping result, a corresponding load prediction model based on a linear regression prediction algorithm is established for each group of power grid users. Historical power utilization data of each group of power grid users are collected, and respective load prediction models are trained according to the historical power utilization data of each group. In consideration of the relative stability, seasonality and periodicity of the load of the power system, the load prediction model based on the linear regression prediction algorithm is selected for the grouped prediction in the embodiment of the invention.
Establishing the load prediction model based on the linear regression prediction algorithm according to the formulas (1) and (2):
y i ＝h(x (i) )+∈ i ，i＝1，...，n (1)；
h β (x (i) )＝β 0 +β 1 x i1 +β 2 x i2 +...+β m x im (2)；
wherein (y) i ，x i1 ，x i2 ...，x im ) For a set of sample data in the training set, i denotes the ith set of sample data, y i Real-time load data for the user, which is composed of characteristic variables x i1 ，x i2 ...，x im The power consumption data of the grid users influenced, i.e. input to the load prediction model based on the linear regression prediction algorithm. The power utilization data comprises user power utilization time data and user power utilization load data. The user electricity utilization time data comprises a time slice (namely, a day is divided into 48 time slices at intervals of 30 min), a month, a current electricity utilization date and a day of a current electricity utilization week, wherein the current electricity utilization time is located in the time slice. The consumer load data comprisesThe electricity consumption of the last 5 hours (i.e. 10 time slices) of the day, the total electricity consumption of the same time slice of the previous day and the last 5 hours (i.e. 11 time slices), the total electricity consumption of the same time slice of the last week and the last 5 hours (i.e. 11 time slices), and the total electricity consumption of the same time slice of the last month and the last 5 hours (i.e. 11 time slices).
Calculating the modeling error of the load prediction model based on the linear regression prediction algorithm according to formula (3):
the purpose of model training is to find a suitable coefficient matrix (i.e., β) 0 ，β 1 ，...，β m ) So that as many equations in Y = X β as possible hold, i.e. the modeling error is as small as possible. The embodiment of the invention adopts a least square method to directly solve beta, namely, the beta is solved according to the following formula:
Xβ＝Y (4)；
X T Xβ＝X T Y (5)；
β＝(X T X) -1 X T Y (6)；
since the number of training set samples, n > m, X is a column full rank matrix, i.e. (X) T X) -1 Is present, so the solution can be carried out by adopting a least square method; wherein Y = [ Y = 1 ，y 2 ，...，y n ] T ，
Step S102: and acquiring real-time load data of the intelligent electric meter, and calculating a load proportion coefficient according to the real-time load data and the predicted load data. The embodiment of the invention calculates the real-time load data acquired by the intelligent electric meter in real time and the predicted load data of the corresponding user to obtain the load proportion coefficient. The user real-time load data refers to the power consumed by the user at the current moment, which is measured by the intelligent electric meter. The calculated value of the load proportion coefficient has different normal probability distribution in a non-attack state and an attack state.
As one embodiment, the load scaling factor at the current time is calculated according to the following formula (7), that is, the load scaling factor is obtained by normalizing the real-time load data on the basis of the predicted load data:
wherein R is t Represents the load proportionality coefficient, C t Representing real-time load data, D t Representing predicted load data, t cur The current time is represented, and thus the ratio of the difference between the actual load and the electricity demand (i.e., the predicted load). Under the condition of not being attacked, the real-time load data C collected by the intelligent electric meter t Should be in demand for electricity D t The nearby fluctuation, in case of attack, is at (1 + alpha) D t Nearby fluctuations where α is an unknown parameter greater than 0. I.e. in an attack state and in an attack-free state R t Have different probability distributions:
as shown in the formula (8), in the non-attacked state, the load proportionality coefficient R t The normal distribution with the average value of 0 is followed, and in an attack state, the normal distribution with the average value of alpha is followed.
Step S103: and accumulating the likelihood ratio of the load scale factor through a decision function, calculating attack intrusion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack intrusion time.
As one embodiment, the generalized log-likelihood ratio is calculated for different probability distribution situations of the load proportion coefficient in an attack state and a non-attack state, and the likelihood ratio is accumulated.
Specifically, the method comprises the following steps: r under the state of unmarked t Has a probability ofP θ＝0 (R t ) In the attack state R t Has a probability of P θ＝α (R t ) From t =0 to t = t cur Whether attack invasion exists in the time interval or not can be judged
The probability of occurrence is noted as the following two forms.
The first form: if there is no attack invasion, it is marked as H 0 Then the probability is:
the second form: if there is attack invasion, it is marked as H 1 Then the probability is:
the generalized logarithmic nature ratio is calculated for both cases according to equation (11):
wherein, G [ t ] cur ]Represents t cur Generalized log-likelihood ratios of time of day. Accumulating the generalized log-likelihood ratios of the load scaling factors according to equation (12):
G[t cur ]＝max{G[t cur -1]+s[t cur ]，0} (12)；
wherein, G [ t ] cur ]Denotes t cur The generalized log-likelihood ratio of the time of day,
and the generalized log-likelihood ratio of the load proportionality coefficient at the current moment under two probability distributions is represented, wherein the two probability distributions refer to the probability distribution under an attack state and the probability distribution under a non-attack state. In the recursive form, for the loadWhen the generalized log-likelihood ratio of the proportionality coefficient is accumulated, only G [ t ] at the current time needs to be accumulated cur ](i.e., the log-likelihood ratio of the load scaling factor at the current time under two probability distributions) to G [ t ] at the previous time cur -1]Adding, and comparing with zero. The calculation method can ensure that the calculation task can be completed within time constraint at any time, and meets the requirement of on-line detection task.
As an embodiment, after the algorithm starts to accumulate, when the accumulated value of the likelihood ratio is greater than a preset threshold, the decision function calculates an attack intrusion time and sends an attack alarm and the attack intrusion time. That is, by recursive computation, the decision function is accumulated with the generalized log-likelihood ratio G [ t ] cur ]And comparing the threshold value with a preset threshold value h to judge whether the threshold value is broken through. If the cumulative function value is always below the set threshold value h, judging that no real-time electricity price response attack exists; if the threshold is broken through, the attack is judged to exist, and meanwhile, the attack invasion time is calculated and an alarm is given. When the intrusion time estimation is carried out, t of the logarithm likelihood ratio under two distributions can be maximized A And (3) determining the value as the attack invasion moment, namely:
wherein, P (R) t α) represents R in an attack state t Probability distribution of (c), P (R) t 0) represents R in the non-attacked state t Probability distribution of (1), t A Represents the time of the intrusion attack, t cur Indicating the current time and t the time.
Aiming at the potential safety hazard of the current power grid intelligent dispatching system, the invention can effectively detect a novel online real-time electricity price response attack aiming at the power grid user side. The detection method of the invention is based on the historical load data of the user, applies the current latest load prediction technology, and can effectively detect whether the attack exists or not by acquiring the power consumption of the load of the user (namely the real-time load data of the user) in real time. In addition, if the existence of the attack is detected, the attack injection time is calculated and the alarm is given, so that the method can help to take measures in time to prevent the attack range from being expanded, and reduce the loss caused by the abnormal fluctuation of the load curve. The detection scheme of the invention can effectively improve the capability of the intelligent scheduling system at the user side of the power grid for resisting network attack. The method provided by the invention is very helpful for detecting online real-time electricity price response attack aiming at the user side of the power grid, and is beneficial to safe and efficient operation of the power grid. In conclusion, compared with the traditional attack detection method, the method can obviously improve the detection range and the detection precision of the network attack aiming at the user side of the smart grid.
On the basis of the above embodiment of the invention, the present invention correspondingly provides an embodiment of the apparatus, as shown in fig. 2;
another embodiment of the present invention provides a real-time electricity price attack detection device on a power grid user side, which includes a load data prediction module 101, a load proportionality coefficient calculation module 102, and an attack alarm module 103;
the load data prediction module is used for inputting the current power utilization data of the power grid users to a corresponding load prediction model based on a linear regression prediction algorithm in groups, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side;
the load proportion coefficient calculation module is used for acquiring real-time load data of the intelligent electric meter and calculating a load proportion coefficient according to the real-time load data and the predicted load data;
and the attack alarm module is used for accumulating the likelihood ratio of the load proportionality coefficient through a decision function, calculating attack intrusion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack intrusion time.
For convenience and brevity of description, the embodiments of the apparatus of the present invention include all the embodiments of the power scheduling method applied to the incremental power distribution network, and are not described herein again.
On the basis of the embodiment of the invention, the invention correspondingly provides an embodiment of a readable storage medium; another embodiment of the present invention provides a readable storage medium, which includes a stored computer program, and when the computer program is executed, the computer program controls a device on which the readable storage medium is located to execute the real-time price attack detection method on the power grid user side according to any method embodiment of the present invention.
Illustratively, the computer program may be partitioned into one or more modules that are stored in the memory and executed by the processor to implement the invention. The one or more modules may be a series of computer program instruction segments capable of performing specific functions, which are used for describing the execution process of the computer program in the terminal device.
The terminal device can be a desktop computer, a notebook, a palm computer, a cloud server and other computing devices. The terminal device may include, but is not limited to, a processor, a memory.
The Processor may be a Central Processing Unit (CPU), other general purpose Processor, a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), an off-the-shelf Programmable Gate Array (FPGA) or other Programmable logic device, discrete Gate or transistor logic, discrete hardware components, etc. The general-purpose processor may be a microprocessor or the processor may be any conventional processor or the like, said processor being the control center of said terminal device, and various interfaces and lines are used to connect the various parts of the whole terminal device.
The memory may be used to store the computer programs and/or modules, and the processor may implement various functions of the terminal device by executing or executing the computer programs and/or modules stored in the memory and calling data stored in the memory. The memory may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required by at least one function (such as a sound playing function, an image playing function, etc.), and the like; the storage data area may store data (such as audio data, a phonebook, etc.) created according to the use of the cellular phone, and the like. In addition, the memory may include high speed random access memory, and may also include non-volatile memory, such as a hard disk, a memory, a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) Card, a Flash memory Card (Flash Card), at least one magnetic disk storage device, a Flash memory device, or other volatile solid state storage device.
The module/unit integrated with the terminal device may be stored in a computer-readable storage medium (i.e., the above-mentioned readable storage medium) if it is implemented in the form of a software functional unit and sold or used as a separate product. Based on such understanding, all or part of the flow of the method according to the embodiments of the present invention may also be implemented by a computer program, which may be stored in a computer-readable storage medium, and when the computer program is executed by a processor, the steps of the method embodiments may be implemented. Wherein the computer program comprises computer program code, which may be in the form of source code, object code, an executable file or some intermediate form, etc. The computer-readable medium may include: any entity or device capable of carrying the computer program code, recording medium, usb disk, removable hard disk, magnetic disk, optical disk, computer Memory, read-Only Memory (ROM), random Access Memory (RAM), electrical carrier wave signals, telecommunications signals, software distribution medium, and the like.
It should be noted that the above-described device embodiments are merely illustrative, where the units described as separate parts may or may not be physically separate, and the parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of the present embodiment. In addition, in the drawings of the embodiment of the apparatus provided by the present invention, the connection relationship between the modules indicates that there is a communication connection between them, and may be specifically implemented as one or more communication buses or signal lines. One of ordinary skill in the art can understand and implement it without inventive effort.
While the foregoing is directed to the preferred embodiment of the present invention, it will be understood by those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention.
It will be understood by those skilled in the art that all or part of the processes in the above embodiments may be implemented by hardware related to instructions of a computer program, where the computer program may be stored in a computer readable storage medium, and when executed, the computer program may include the processes in the above embodiments. The storage medium may be a magnetic disk, an optical disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), or the like.
Claims (10)
1. A real-time power price attack detection method for a power grid user side is characterized by comprising the following steps:
the method comprises the steps that current power utilization data of power grid users are input to a corresponding load prediction model based on a linear regression prediction algorithm in a grouping mode, predicted load data of each group of power grid users are output, and the predicted load data of each group of power grid users are aggregated to obtain the current predicted load data of a power grid user side;
acquiring real-time load data of the intelligent electric meter, and calculating a load proportion coefficient according to the real-time load data and predicted load data;
and accumulating the likelihood ratio of the load scale factor through a decision function, calculating attack invasion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack invasion time.
2. The method for detecting the real-time power price attack on the power grid user side according to claim 1, characterized by extracting the characteristics of the power consumption behavior of the power grid users and clustering and grouping the power grid users according to the characteristic extraction result;
and according to the clustering grouping result, inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm in a grouping manner, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side.
3. The method according to claim 2, wherein the electricity consumption data includes user electricity consumption time data and user electricity consumption load data.
4. The method according to claim 3, wherein the user electricity consumption time data includes a time slice of the current electricity consumption time, a month of the current electricity consumption time, a current electricity consumption date, and a day of the current electricity consumption week.
5. The method according to claim 4, wherein the consumer electricity load data includes electricity consumption of 5 hours in the past, electricity consumption of the same time slice of the previous day and 5 hours in the past, electricity consumption of the same time slice of the previous week and 5 hours in the past, and electricity consumption of the same time slice of the previous month and 5 hours in the past.
6. The method for detecting the real-time power rate attack on the user side of the power grid according to claim 5, wherein the load scaling factor at the current moment is calculated according to the following formula:
wherein R is t RepresentLoad proportionality coefficient, C t Representing real-time load data, D t Representing predicted load data, t cur Indicating the current time of day.
7. The method according to claim 6, wherein the likelihood ratios of the load scaling factors are accumulated according to the following decision function:
G[t cur ]＝max{G[t cur -1]+s[t cur ]，0}
wherein, G [ t ] cur ]Represents t cur Generalized log-likelihood ratio of time of day, s [ t ] cur ]And the generalized log-likelihood ratio of the load proportionality coefficient at the current moment under two probability distributions is represented, wherein the two probability distributions refer to the probability distribution under an attack state and the probability distribution under a non-attack state.
8. The method for detecting the real-time price on the user side of the power grid according to any one of claims 1 to 7, wherein the attack invasion time is calculated according to the following formula:
wherein, P (R) t α) represents R in an attack state t Probability distribution of (c), P (R) t 0) represents R in the non-attacked state t Probability distribution of (1), t A Represents the time of the intrusion attack, t cur Indicating the current time and t the time.
9. A real-time power price attack detection device on a power grid user side is characterized by comprising a load data prediction module, a load proportion coefficient calculation module and an attack alarm module;
the load data prediction module is used for inputting the current power utilization data of the power grid users into a corresponding load prediction model based on a linear regression prediction algorithm in groups, outputting the predicted load data of each group of power grid users, and aggregating the predicted load data of each group of power grid users to obtain the current predicted load data of the power grid user side;
the load proportion coefficient calculation module is used for acquiring real-time load data of the intelligent electric meter and calculating a load proportion coefficient according to the real-time load data and the predicted load data;
and the attack alarm module is used for accumulating the likelihood ratio of the load proportionality coefficient through a decision function, calculating attack intrusion time when the accumulated value of the likelihood ratio is greater than a preset threshold value, and sending an attack alarm and the attack intrusion time.
10. A readable storage medium, characterized in that the readable storage medium comprises a stored computer program, and when the computer program is executed, the readable storage medium is controlled to execute the real-time power rate attack detection method according to any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210831342.2A CN115189350A (en) | 2022-07-15 | 2022-07-15 | Real-time electricity price attack detection method and device for power grid user side and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202210831342.2A CN115189350A (en) | 2022-07-15 | 2022-07-15 | Real-time electricity price attack detection method and device for power grid user side and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN115189350A true CN115189350A (en) | 2022-10-14 |
Family
ID=83518647
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202210831342.2A Pending CN115189350A (en) | 2022-07-15 | 2022-07-15 | Real-time electricity price attack detection method and device for power grid user side and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115189350A (en) |
-
2022
- 2022-07-15 CN CN202210831342.2A patent/CN115189350A/en active Pending
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US10248528B2 (en) | System monitoring method and apparatus | |
| CN111045894B (en) | Database abnormality detection method, database abnormality detection device, computer device and storage medium | |
| US8078913B2 (en) | Automated identification of performance crisis | |
| JP2017142781A (en) | Random quotation and sudden change prediction | |
| US20210048811A1 (en) | Model generation device for life prediction, model generation method for life prediction, and recording medium storing model generation program for life prediction | |
| CN110399400B (en) | Method, device, equipment and medium for detecting abnormal data | |
| CN112148768A (en) | Index time series abnormity detection method, system and storage medium | |
| CN115659411A (en) | Method and device for data analysis | |
| CN116843216A (en) | Index early warning method and device, computer equipment and storage medium | |
| KR101960755B1 (en) | Method and apparatus of generating unacquired power data | |
| CN112882898B (en) | Anomaly detection method, system, device and medium based on big data log analysis | |
| CN111800807A (en) | Method and device for alarming number of base station users | |
| CN111783883A (en) | Abnormal data detection method and device | |
| CN104598361A (en) | Performance monitoring method and device | |
| CN116843395A (en) | Alarm classification method, device, equipment and storage medium of service system | |
| US11651271B1 (en) | Artificial intelligence system incorporating automatic model updates based on change point detection using likelihood ratios | |
| US11636377B1 (en) | Artificial intelligence system incorporating automatic model updates based on change point detection using time series decomposing and clustering | |
| CN111523083A (en) | Method and device for determining power load declaration data | |
| CN115189350A (en) | Real-time electricity price attack detection method and device for power grid user side and storage medium | |
| CN115169089A (en) | Wind power probability prediction method and device based on kernel density estimation and copula | |
| CN113298642B (en) | Order detection method and device, electronic equipment and storage medium | |
| CN113627940A (en) | Transaction amount abnormity warning method and device | |
| CN112101652B (en) | Method and device for predicting task number, readable storage medium and electronic equipment | |
| CN112183644B (en) | Index stability monitoring method and device, computer equipment and medium | |
| CN116991448B (en) | Operation and maintenance time window detection method and system of server, storage medium and server |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |