CN115333870A - Network attack identification method and system for smart grid wide area synchronous measurement - Google Patents
Network attack identification method and system for smart grid wide area synchronous measurement Download PDFInfo
- Publication number
- CN115333870A CN115333870A CN202211264062.4A CN202211264062A CN115333870A CN 115333870 A CN115333870 A CN 115333870A CN 202211264062 A CN202211264062 A CN 202211264062A CN 115333870 A CN115333870 A CN 115333870A
- Authority
- CN
- China
- Prior art keywords
- normal
- dost
- wide area
- network attack
- layer
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
- Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
- Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
- Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
- Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security
Abstract
The invention discloses a network attack identification method and a system for smart grid wide area synchronous measurementf(t) Decomposing into a plurality of modal components; extracting a common component from the plurality of modal components; by applying measured dataf(t) Subtracting the common component to obtain a disturbance component containing spatial position informationy(t) (ii) a Will disturb the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation; inputting the DOST characteristic matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack. The invention can extract DOST characteristic matrix containing space position information from different power grid synchronous measurement data, and can be accessed under different network attacksThe convolutional neural network can carry out attack detection on the synchronous measurement data of the power grid, and quickly identify whether the measurement system is attacked by the network.
Description
Technical Field
The invention belongs to a network attack detection technology, and particularly relates to a network attack identification method and system for smart grid wide area synchronous measurement.
Background
The wide area measurement system is a complex network for real-time measurement sensing and dynamic control, the existing smart grid wide area synchronous measurement system is vulnerable to network attacks in the data transmission and storage processes, the network attacks forge power system disturbance by tampering with measured data, and the defect can cause the power grid control system to be broken down. The network attack mainly comprises various attack behaviors such as false data injection attack and GPS signal fraud, and the false data injection attack is an attack mode with extremely strong secrecy. The network attack can directly falsify the measured value or exchange data information among different measuring devices, so that the measured data is placed at the wrong position in the data server, and the data server has stronger secrecy and has strong interference effect on the network attack detection. In recent years, more WAMS network attack events occur, which puts higher defense requirements on the power grid control system. The existing power grid synchronous measurement system mainly has the following 2 problems for network attack detection: 1. the network attack is fast in conversion and various in types, partial false data injection attacks have strong secrecy, and the fact that how to design accurate and efficient network attack detection is difficult to find due to the fact that actually measured signals are affected by disturbance such as noise, harmonic waves and the like is difficult to find out, and higher requirements are provided for the characteristic extraction of the network attack; 2. the wide area measurement system has large data volume and high requirement on network attack detection capability, the method is required to be suitable for large data processing, and the real-time requirement on the network attack identification method is high.
Disclosure of Invention
The technical problems to be solved by the invention are as follows: aiming at the problems in the prior art, the invention provides a network attack identification method and system for smart grid wide area synchronous measurement.
In order to solve the technical problems, the invention adopts the technical scheme that:
a network attack identification method for smart grid wide area synchronous measurement comprises the following steps:
s101, decomposing VMD (variable mode decomposition) to measure data by using variation modef(t) Decomposition into modal componentsIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuring dataf(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, inputting the DOST feature matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack.
Optionally, step S104 includes:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the basis function of (2)v=v+0.5 carry-in basis functions and determine different frequency multiplication numbers according to basis functionsmA DOST coefficient matrix is constructed according to the DOST coefficient matrix to obtain a value of (A)N/2,N) Of DOST feature matrix of (1), whereinNIs a disturbance componenty(t) The number of points of (a) is,vis the center of the frequency band;
s202, according to the number of the disturbance componentsNSeparately calculating the maximum frequency multiplication number
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Calculating the minimum number of columns
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Doubling, then recombining to obtain a compressed size of: (N/2,N/4) The DOST feature matrix of (1).
Optionally, the convolutional neural network adopted in step S105 includes an expanded bi-normal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a full connection layer, and a softmax classifier, which are connected in sequence.
Optionally, the expanded bi-normal convolutional layer DDNC is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of an input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the cavity convolutional, the other path of the input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the two normal convolutions which are sequentially cascaded, and an output feature diagram of the cavity convolutional and an output feature diagram of the two normal convolutions which are sequentially cascaded are fused to form an output feature diagram of the expanded bi-normal convolutional layer DDNC.
Optionally, the function expression of the expanded binormal convolution layer DDNC for processing the input feature graph is as follows:
in the above-mentioned formula, the compound has the following structure,
to expand the output profile of the bi-normal convolutional layer DDNC,
to expand the input profile of the bi-normal convolutional layer DDNC,w i andb i respectively represent the firstiThe weights and bias terms of the filter kernels, the symbol is a one-dimensional convolution,
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the hole convolution at the 1 st and the normal convolution at the 2 nd time.
Optionally, a function expression of the batch normalization layer BN for processing the output characteristic graph of the expanded bi-normal convolution layer DDNC is as follows:
in the above-mentioned formula, the compound has the following structure,
for the output profile of the batch normalization layer BN,γandβin order to train the parameters of the device,
output characteristic diagram of DDNC (doubly normal convolutional layer numerical control) for pair expansion of bi-normal convolutional layer
And the normalized result of (1) and includes:
in the above formula, m is the number of filter kernels;
represents a constant to ensure that it is not divided by zero;
the variance is indicated.
Optionally, the function expression of the maximum pooling layer is:
in the above formula, the first and second carbon atoms are,wis the firstiStep of a feature, t is the areanThe set of sequences of (a) is,
is a regionnThe output characteristic diagram of the batch normalization layer BN corresponding to the sequence set t, and the output length of the maximum pooling layerLIs composed ofL=((x-m)/s+1-n)/w+1，mAndsrespectively the length and the step of the convolution.
Optionally, the functional expression of the softmax classifier is:
in the above formula, the first and second carbon atoms are,
representation recognition as a categoryk i Probability of (2), maximum probability value max: (p) Is indicative of the type of attack identified,y i andk i respectively representing the number of output classes and feature matrix classes,
the feature map output to the softmax classifier for the full connectivity layer,krepresenting the total number of categories of the spatial features.
In addition, the invention also provides a network attack identification system facing the wide area synchronous measurement of the smart grid, which comprises a microprocessor and a memory which are connected with each other, wherein the microprocessor is programmed or configured to execute the network attack identification method facing the wide area synchronous measurement of the smart grid.
In addition, the invention also provides a computer readable storage medium, wherein a computer program is stored in the computer readable storage medium, and the computer program is programmed or configured by a microprocessor to execute the network attack identification method facing the smart grid wide area synchronous measurement.
Compared with the prior art, the invention mainly has the following advantages: the method of the invention comprises the step of decomposing the measurement data by using the variational mode VMDf(t) Decomposing into a plurality of modal components; extracting a common component from the plurality of modal components; by measuring dataf(t) Subtracting the common component to obtain a disturbance component containing spatial position informationy(t) (ii) a Will disturb the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation; inputting the DOST characteristic matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack. The DOST feature matrix containing the spatial position information can be extracted from different power grid synchronous measurement data, attack detection can be carried out on the power grid synchronous measurement data through the convolutional neural network under different network attacks, and whether the measurement system is attacked by the network or not can be rapidly identified.
Drawings
FIG. 1 is a schematic diagram of a basic process flow of a method according to an embodiment of the present invention.
Fig. 2 is a schematic structural diagram of a convolutional neural network used in the embodiment of the present invention.
Fig. 3 is a diagram illustrating the original DOST feature matrix obtained in step S104 according to the embodiment of the present invention.
Fig. 4 is a compressed DOST feature matrix in an embodiment of the invention.
FIG. 5 is a diagram illustrating a comparison between a hole convolution and a normal convolution according to an embodiment of the present invention.
FIG. 6 is a schematic diagram of an expanded bi-normal convolutional layer DDNC in an embodiment of the invention.
Detailed Description
As shown in fig. 1, the network attack identification method for smart grid wide area synchronous measurement in the present embodiment includes:
s101, decomposing VMD (variable mode decomposition) to measure data by using variation modef(t) Decomposition into multiple modal componentsMeasurement ofIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuring dataf(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, inputting the DOST feature matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack.
The metrology data may be decomposed using variational modal decomposition of VMD in step S101f(t) Decomposition into a plurality of modal components with sparse characteristics and limited bandwidthIMF i The variational modal decomposition VMD is an existing modal decomposition method, and the variational modal decomposition VMD method extracts measurement dataf(t) Modal component ofIMF i As shown in the following formula (1):
in the above formula, the first and second carbon atoms are,
representing modal componentsIMF i Mode function at time t
，
As modal componentsIMF i The magnitude at the time of the t-instant,
as modal componentsIMF i Phase at time t. Obtaining the said last color by calculating the second gradient decompositionIMF i Satisfying the constraint condition shown in the formula (2), and introducing a secondary penalty function
Solving for Lugrange multiplierIMF i The constraint variational problem of (1).
In the formula:
to representtPartial derivatives of (d);
representing a modal function
The center of frequency of (a);
representing a unit pulse function;f(t) The measured data is represented by the measured data,jin units of imaginary numbers. It should be noted that the present embodiment relates to only the application of the variational modal decomposition VMD method, and does not relate to the improvement of the variational modal decomposition VMD method, so that the details of the implementation of the variational modal decomposition VMD will not be described in detail here. In this embodiment, the mode number of the variational mode decomposition VMD is determined by observing the center frequencyi=6, i.e. decomposition into modal components in step S101IMF i Is referred to as decomposition into six modal componentsIMF 1 ～IMF 6 The modal components of different frequencies are respectively corresponding to the high frequency and the low frequency.
From a plurality of modal components in step S102IMF i When the common component is extracted, the common component refers to the whole variation trend and the measured dataf(t) The same certain modal componentIMF i . The sixth mode is divided intoMeasurement ofIMF 6 Global trend and metrology dataf(t) Similarly, in step S102, the present embodiment includes a plurality of modal componentsIMF i When the common component is extracted, the common component is the sixth modal componentIMF 6 。
The calculation in step S103 can be expressed as:y(t)= f(t)- IMF j thereby obtaining a disturbance component having spatial position informationy(t)。
In step S104, the disturbance componenty(t) The calculation function expression used for extracting the DOST (discrete orthogonal S transform) characteristic matrix (time-frequency characteristic) is as follows:
in the above formula, the first and second carbon atoms are,
representing input disturbance componentsy(t) The spatial characteristics obtained by the calculation are obtained,Nthe number of points of the disturbance component is represented,
represent kΔ t The component of the disturbance in time,
which is a representation of the orthogonal basis functions,
to representkΔ t ，vIs the center of the band;qindicated as a position in time, is,βis thatvBandwidth in the center of the band, where:k=0,1…Nand has:
in the above formula, the first and second carbon atoms are,
the number of the units of the imaginary number is expressed,
the center of the time window is represented,
，k=0,1…N。
from equations (3) and (4) a certain frequency multiplier can be derivedmDOST coefficient matrix, certain frequency multiplication number obtained by calculationmThe following DOST coefficient matrix is:
the DOST coefficient matrix is composed ofA 1 ,A 2 ,…,A m ｝mEach matrix block is composed of the following components, the numerical values in each matrix block are the same:
wherein the content of the first and second substances,y(t) In order to be a disturbance component,
representing coefficients
Is composed of
The orthogonal basis functions of the time of flight,
representing coefficients
Is composed of
The orthogonal basis functions of the time of flight,
representing coefficients
Is composed of
Orthogonal basis functions of time, all frequency multiplicationmThe DOST coefficient matrix below can form a DOST feature matrix, and as shown in FIG. 3, the original DOST feature matrix has a size of (N,N). In FIG. 3, coefficients
Where v represents the center of the band; q is time positioning; β is the bandwidth of the v band center, and is calculated as follows:
in the above formula, the first and second carbon atoms are,mis the frequency doubling rate.
Referring to the foregoing functional expression of the DOST coefficient matrix, since the values in the single matrix block are the same, i.e., the values of each column and each row under the same coefficient matrix in the DOST feature matrix are the same, the redundant data will increase with the increase of the matrix. To implement a small parameter convolutional neural network, the compression matrix may reduce the detection pressure of the feature matrix identification network. The method is used for compressing the DOST characteristic matrix on the basis of not losing the original DOST characteristic matrix structure. In this embodiment, step S104 includes:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the basis function of (A) and (B) is tov=v+0.5 into the orthogonal basis functions and determining the different frequency multiplication numbers according to the orthogonal basis functionsmAnd constructing a DOST coefficient matrix with a size of (A)N/2,N) Of DOST feature matrix of (1), whereinNIs a disturbance componenty(t) The number of points of (a) is,vis the center of the frequency band;
s202, according to the number of the disturbance componentsNCalculating maximum frequency of multiplication respectively
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Calculating the minimum number of columns
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Doubled, then recombined to a compressed size of: (N/2,N/4) The DOST characteristic matrix is reduced by 4 times, so that the network structure complexity of the convolutional neural network adopted in the step S105 can be reduced, the attack identification speed and accuracy are improved, and the network attack real-time identification is realized when the data volume in the smart grid wide area synchronous measurement system is large.
The compressed DOST feature matrix obtained by recombination in this embodiment is shown in FIG. 4, and it can be known from FIG. 4 that: frequency of doublingm =0, where the DOST coefficient matrix is (1, L) in size and 1 in number, and the frequency multiplication factorm=Coefficient at 0
The values of (a) are shown in FIG. 4; frequency multiplication factorm=1, where the size of the DOST coefficient matrix is (1, L), the number is 1, the frequency multiplication factorm=Coefficient of 1 hour
The values of (a) are shown in FIG. 4; frequency of current multiplicationm=2, where the DOST coefficient matrix is (2, L/2) in size and 2 in number, and the frequency multiplication factorm=Coefficient of 2 hours
The values of (a) are shown in fig. 4; frequency of doublingm=3, where the DOST coefficient matrix is (4, L/4) in size and 4 in number, and the frequency multiplication factor ism=Coefficient of time 3
The values of (a) are shown in FIG. 4; for arbitrary frequency multiplicationmWherein the size of the DOST coefficient matrix is: (
1) of
。
As shown in fig. 2, the convolutional neural network used in step S105 of this embodiment includes an expanded binormal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a fully-connected layer, and a softmax classifier that are connected in sequence. The local image translation invariance of the convolutional neural network ensures that the position in the image has no influence on feature extraction, and the characteristic enables the convolutional neural network to learn more abstract data, but is not sensitive to the position information any more, which needs further improvement for the task of extracting the spatial position information in the spatial feature matrix. In order to extract the spatial position information included in the DOST feature matrix sufficiently, position information is extracted by hole Convolution, but at this time, a Convolution scheme in which the hole Convolution (scaled Convolution) and 2 Normal convolutions (Normal Convolution) are merged is proposed and expressed by DDNC (scaled Double Normal Convolution). As shown in fig. 6, the expanded binormal convolutional layer DDNC in this embodiment is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of the input feature diagram of the expanded binormal convolutional layer DDNC is used as the input of the cavity convolutional, the other path is used as the input of the two normal convolutions which are sequentially cascaded, and the output feature diagram of the cavity convolutional and the output feature diagrams of the two normal convolutions which are sequentially cascaded are fused to form the output feature diagram of the expanded binormal convolutional layer DDNC.
A larger receptive field in the convolutional neural network will retain more spatial location information, but will bring more computational burden, and the hole convolution can solve this problem, as shown in fig. 5, where (a) is normal convolution (kernel = 3, stride =1, padding = 0), the lower side is input, the upper side is input, the lower side is shaded in gray to form a convolution kernel, kernel represents the size of the convolution kernel, stride represents the moving step size, and padding represents padding. (b) The result is a hole convolution (kernel = 3, stride =1, rate =1, padding = 0), the lower side is input, the upper side is input, the lower side is shaded in gray to be a convolution kernel, and the rate represents the expansion ratio. (c) Normal convolution (kernel = 5, stride =1, padding = 0), (d) normal convolution (kernel = 3, stride =1, padding = 0). The hole convolution is to fill 0 in the filter, and the filling amount is controlled by the expansion rate. The hole convolution can enlarge the receptive field of the filter under the condition of not introducing any redundant parameters and calculated quantity, and extraction of space position characteristics is realized; on the other hand, when the expansion rates are set to different values, the hole convolution has different receptive fields, and multi-scale spatial features can be extracted. However, the convolution kernel in the hole convolution is not continuous, all points in the spatial feature matrix cannot be calculated, information is extracted in a checkerboard mode, continuity of the spatial feature information is lost at this time, and detailed information in the spatial feature matrix cannot be acquired possibly. Therefore, the characteristics of the hole convolution are summarized, and the main advantages include that (1) a larger receptive field is provided with the same calculation cost; (2) By setting different expansion rates, multi-scale information can be captured. The main disadvantages are that: the extracted spatial feature information is discontinuous, and the detail information is lost, but the defect can be realized by the normal convolution of a small sense eye, so that a mode of fusing the cavity convolution and the normal convolution is provided for extracting the spatial position information and the corresponding detail information of the spatial feature matrix. However, how to fuse the void convolution and the normal convolution ensures that the spatial information of the spatial feature matrix is extracted without losing the detail information, and a new mode is provided in the text to realize the fusion of the corresponding spatial information and the detail information. In fig. 5, (a) and (b) sense that the eyes are different in size, the range of each convolution is different, and the information extraction positions are not uniform. If the moving step stride = 2 in the convolution in (a) in fig. 5, the output size is the same under the normal convolution and the hole convolution and the convolution kernel, and the output is directly added at this time, or the outputs are merged in a merging manner, (a) the detail information obtained by the normal convolution and the orientation of the space information obtained by (b) in fig. 5 in the space feature matrix are not consistent, and the most effective feature fusion cannot be achieved. Further, it is found that the above problem can be solved under the condition that certain conditions are satisfied, where the convolution kernels kernel in (b) and (c) in fig. 5 are different, but the reception field and the output size are the same, and at this time, the detail information and the spatial information extracted in (b) and (c) in fig. 5 are consistent, but the convolution of the normal convolution reception eye and the cavity convolution is consistent, and not an optimal method, and (d) in fig. 5 is shown as a quadratic convolution under the same parameters in (a) in fig. 5, and at this time, the input in (d) in fig. 5 and the convolution of the cavity in (b) in fig. 5 are consistent, and at this time, the spatial information and the detail information extracted in the spatial matrix are in a corresponding relationship, thereby proposing a convolution cavity +2 normal convolution fusion modes, and when the following conditions are satisfied:
in the above formula, the first and second carbon atoms are,nrepresenting the input size of a spatial feature matrix on one side;mfor the kernel side of the convolution kernelThe size of the input is determined by the size of the input,swhich represents the convolution step size stride and,rindicating a hole convolution expansion rate, padding =0; the convolution structure is shown in FIG. 6, the input feature size of the void convolution is n x n, the expansion rate is 1, the convolution kernel size is m x m, and the output feature size is [ n- (m + (m-1) × r ]](ii)/s +1; the input characteristic size of the first normal convolution in the two sequentially cascaded normal convolutions is n x n, the convolution kernel size is m x m, and the output characteristic size is (n-m)/s +1; the second one of the two normal convolutions in the cascade has input characteristic size of (n-m)/s +1, convolution kernel size of m, and output characteristic size of [ (n-m)/s + 1-m-](s + 1), the size of the output characteristic graph of the final expanded binormal convolution layer DDNC is [ n- (m + (m-1) × r ]]/s+1。
The expanded bi-normal convolutional layer DDNC is used for extracting features, and the expanded bi-normal convolutional layer DDNC has the length ofLOf (2) a signalxThe output features are calculated in the form of a convolution. In this embodiment, the function expression of processing the input feature graph by the expanded binormal convolution layer DDNC is as follows:
in the above formula, the first and second carbon atoms are,
to expand the output profile of the bi-normal convolutional layer DDNC,
to expand the input profile of the binormal convolution layer DDNC,w i andb i respectively represent the firstiThe weights and bias terms of the filter kernels, the symbol x is a one-dimensional convolution,
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the hole convolution at the 1 st and the normal convolution at the 2 nd time.
The batch normalization layer BN is used for realizing data standardization, after the convolutional layer, a BN layer is added, the input of each layer of neural network can be kept in the same distribution, and the change value of the loss function and the gradient transformation are increased by reducing the input change value to obtain higher convergence speed. In this embodiment, the function expression of the batch normalization layer BN for processing the output characteristic diagram of the expanded bi-normal convolution layer DDNC is as follows:
in the above formula, the first and second carbon atoms are,
is an output characteristic diagram of the batch normalization layer BN,γandβin order to train the parameters of the device,
output characteristic diagram of DDNC (doubly normal convolutional layer numerical control) for pair expansion of bi-normal convolutional layer
And the normalized result of (1) and includes:
in the above formula, m is the number of filter kernels;
represents a constant to ensure that it is not divided by zero;
represents the variance;
the max-pooling layer is used to reduce model parameters and filtering characteristics. In this embodiment, the function expression of the maximum pooling layer is:
in the above formula, the first and second carbon atoms are,wis the firstiStep of a feature, t is the areanThe set of sequences of (a) is,
is a regionnThe output characteristic diagram of the batch normalization layer BN corresponding to the sequence set t, and the output length of the maximum normalization layerLIs composed ofL=((x-m)/s+1-n)/ w + 1，mAndsrespectively the length and the step of the convolution.
Both fully connected layers are used to handle the high-level features of the multi-dimensional structure. Is provided withZ f For the output of the full link layer, in the last layer, a softmax classifier is used to classify the features, and the functional expression of the softmax classifier in this embodiment is:
in the above formula, the first and second carbon atoms are,
representation recognition as a categoryk i Probability of (2), maximum probability value max: (p) Is indicative of the type of attack identified,y i andk i respectively representing the number of output classes and feature matrix classes,
is the output of the second fully-connected layer,krepresenting the total number of categories of the spatial features. The purpose of the softmax classifier is to constrain the output vector to 0,1]。
The total parameter number of the convolutional neural network LCNN adopted in this embodiment is 2109108, and each parameter is a 32-bit floating point number, so that it can be calculated that the system memory occupied by the model is about 7.7MB. For the classic CNN models (such as inclusion-v 3, alexNet and VGG 16), the model memory is about 100MB, 200MB and 500MB or more in sequence, which requires more computation power. Therefore, the convolutional neural network LCNN used in the present embodiment has an advantage of low computation consumption.
In summary, the network attack identification method for smart grid wide area synchronous measurement in the embodiment can extract spatial features from different grid synchronous measurement data, and can perform attack detection on the grid synchronous measurement data through the adopted convolutional neural network LCNN under different network attacks, so as to quickly and accurately identify whether the measurement system is attacked by the network.
In addition, the embodiment also provides a network attack identification system facing the smart grid wide area synchronous measurement, which comprises a microprocessor and a memory which are connected with each other, wherein the microprocessor is programmed or configured to execute the network attack identification method facing the smart grid wide area synchronous measurement. In addition, the present embodiment also provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and the computer program is programmed or configured by a microprocessor to execute the network attack identification method for smart grid wide area synchronization measurement.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein. The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above description is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments, and all technical solutions belonging to the idea of the present invention belong to the protection scope of the present invention. It should be noted that modifications and embellishments within the scope of the invention may occur to those skilled in the art without departing from the principle of the invention, and are considered to be within the scope of the invention.
Claims (10)
1. A network attack identification method for smart grid wide area synchronous measurement is characterized by comprising the following steps:
s101, decomposing VMD (variable mode decomposition) to measure data by using variation modef(t) Decomposition into modal componentsIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuringData off(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, inputting the DOST feature matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack.
2. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 1, wherein the step S104 comprises:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the basis function of (A) and (B) is tov=v+0.5 carry-in basis functions and determine different frequency multiplication numbers according to basis functionsmAnd constructing a DOST coefficient matrix with a size of (A)N/2,N) Of DOST feature matrix of (1), whereinNAs a disturbance componenty(t) The number of points of (c) is,vis the center of the frequency band;
s202, according to the number of the disturbance componentsNCalculating maximum frequency of multiplication respectively
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Calculating the minimum number of columns
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Doubling and then recombining to obtain the compressed sizeIs prepared fromN/2,N/4) The DOST feature matrix of (1).
3. The network attack identification method facing smart grid wide area synchronous measurement according to claim 1, wherein the convolutional neural network adopted in step S105 includes an expanded bi-normal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a full connection layer, and a softmax classifier, which are connected in sequence.
4. The network attack identification method oriented to smart grid wide area synchronous measurement according to claim 3, wherein the expanded bi-normal convolutional layer DDNC is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of an input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the cavity convolutional, the other path of the input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the two normal convolutions which are sequentially cascaded, and an output feature diagram of the cavity convolutional and an output feature diagram of the two normal convolutions which are sequentially cascaded are fused to form an output feature diagram of the expanded bi-normal convolutional layer DDNC.
5. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 4, wherein the function expression of the expanded bi-normal convolutional layer DDNC for processing the input feature graph is as follows:
in the above formula, the first and second carbon atoms are,
to expand the output profile of the bi-normal convolutional layer DDNC,
to expand the input profile of the bi-normal convolutional layer DDNC,w i andb i respectively represent the firstiThe weights and bias terms of the filter kernels, the symbol is a one-dimensional convolution,
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the void convolution at the 1 st time and the normal convolution at the 2 nd time.
6. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 3, wherein a function expression of the batch normalization layer BN on the output characteristic graph of the expanded bi-normal convolution layer DDNC is as follows:
in the above formula, the first and second carbon atoms are,
for the output profile of the batch normalization layer BN,γandβin order to train the parameters of the device,
output characteristic diagram of DDNC (doubly normal convolutional layer numerical control) for pair expansion of bi-normal convolutional layer
And (3) normalized processing results of (1), and includes:
in the above formula, m is the number of filter kernels;
represent constants withTo ensure that it is not divided by zero;
the variance is indicated.
7. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 3, wherein the function expression of the maximum pooling layer is as follows:
in the above formula, the first and second carbon atoms are,wis the firstiStep of a feature, t is the areanThe set of sequences of (a) is,
is a regionnThe output characteristic diagram of the batch normalization layer BN corresponding to the sequence set t, and the output length of the maximum normalization layerLIs composed ofL=((x-m)/s+1-n)/w+1，mAndsrespectively length and step of convolution.
8. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 3, wherein the functional expression of the softmax classifier is as follows:
in the above-mentioned formula, the compound has the following structure,
representation recognition as a categoryk i Probability of (2), maximum probability value max: (p) Is indicative of the type of attack identified,y i andk i respectively representing the number of output classes and feature matrix classes,
the feature map output to the softmax classifier for the fully connected layer,krepresenting the total number of categories of the spatial features.
9. A network attack recognition system for smart grid wide area synchronous measurement, comprising a microprocessor and a memory connected with each other, wherein the microprocessor is programmed or configured to execute the network attack recognition method for smart grid wide area synchronous measurement according to any one of claims 1 to 8.
10. A computer-readable storage medium, wherein a computer program is stored in the computer-readable storage medium, and the computer program is programmed or configured by a microprocessor to execute the network attack identification method for smart grid wide area synchronization measurement according to any one of claims 1 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211264062.4A CN115333870B (en) | 2022-10-17 | 2022-10-17 | Network attack identification method and system for wide-area synchronous measurement of smart power grid |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202211264062.4A CN115333870B (en) | 2022-10-17 | 2022-10-17 | Network attack identification method and system for wide-area synchronous measurement of smart power grid |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN115333870A true CN115333870A (en) | 2022-11-11 |
| CN115333870B CN115333870B (en) | 2022-12-13 |
Family
ID=83915480
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202211264062.4A Active CN115333870B (en) | 2022-10-17 | 2022-10-17 | Network attack identification method and system for wide-area synchronous measurement of smart power grid |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN115333870B (en) |
Cited By (1)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116451006A (en) * | 2023-06-12 | 2023-07-18 | 湖南大学 | PMU data recovery method and system based on enhanced time sequence mode attention |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110035090A (en) * | 2019-05-10 | 2019-07-19 | 燕山大学 | A kind of smart grid false data detection method for injection attack |
| US20190327259A1 (en) * | 2018-04-24 | 2019-10-24 | Jungle Disk, L.L.C. | Vulnerability profiling based on time series analysis of data streams |
| CN111145044A (en) * | 2020-01-09 | 2020-05-12 | 三峡大学 | Power quality disturbance detection method for power distribution network based on EWT and MFDE |
| CN111708350A (en) * | 2020-06-17 | 2020-09-25 | 华北电力大学（保定） | Hidden false data injection attack method for industrial control system |
-
2022
- 2022-10-17 CN CN202211264062.4A patent/CN115333870B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20190327259A1 (en) * | 2018-04-24 | 2019-10-24 | Jungle Disk, L.L.C. | Vulnerability profiling based on time series analysis of data streams |
| CN110035090A (en) * | 2019-05-10 | 2019-07-19 | 燕山大学 | A kind of smart grid false data detection method for injection attack |
| CN111145044A (en) * | 2020-01-09 | 2020-05-12 | 三峡大学 | Power quality disturbance detection method for power distribution network based on EWT and MFDE |
| CN111708350A (en) * | 2020-06-17 | 2020-09-25 | 华北电力大学（保定） | Hidden false data injection attack method for industrial control system |
Non-Patent Citations (3)
| Title |
|---|
| PANKAJ D. ACHLERKAR ETL: "Variational Mode Decomposition and Decision Tree Based Detection and Classification of Power Quality Disturbances in Grid-Connected Distributed Generation System", 《IEEE TRANSACTIONS ON SMART GRID》 * |
| 孙凯祺等: "面向快速频率响应系统的网络攻击防御控制策略", 《中国电机工程学报》 * |
| 邱伟: "考虑网络攻击的广域测量信号分析关键技术研究", 《中国博士论文全文数据库信息科技辑》 * |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN116451006A (en) * | 2023-06-12 | 2023-07-18 | 湖南大学 | PMU data recovery method and system based on enhanced time sequence mode attention |
| CN116451006B (en) * | 2023-06-12 | 2023-08-25 | 湖南大学 | PMU data recovery method and system based on enhanced time sequence mode attention |
Also Published As
| Publication number | Publication date |
|---|---|
| CN115333870B (en) | 2022-12-13 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN110929607B (en) | Remote sensing identification method and system for urban building construction progress | |
| CN111339321B (en) | Triple authenticity detection method and device in knowledge graph | |
| CN106295613A (en) | A kind of unmanned plane target localization method and system | |
| CN109145841A (en) | A kind of detection method and device of the anomalous event based on video monitoring | |
| CN110210278A (en) | A kind of video object detection method, device and storage medium | |
| CN111860398A (en) | Remote sensing image target detection method and system and terminal equipment | |
| CN111160229B (en) | SSD network-based video target detection method and device | |
| CN115333870B (en) | Network attack identification method and system for wide-area synchronous measurement of smart power grid | |
| CN109492674A (en) | The generation method and device of SSD frame for target detection | |
| CN105260995B (en) | A kind of image repair and denoising method and system | |
| CN110084609B (en) | Transaction fraud behavior deep detection method based on characterization learning | |
| CN108122280A (en) | The method for reconstructing and device of a kind of three-dimensional point cloud | |
| CN113269256A (en) | Construction method and application of Misrc-GAN model | |
| Li et al. | Hyperspectral anomaly detection via image super-resolution processing and spatial correlation | |
| CN114742733A (en) | Cloud removing method and device, computer equipment and storage medium | |
| CN113066037A (en) | Multispectral and full-color image fusion method and system based on graph attention machine system | |
| CN105021199A (en) | LS (Least square)-based multi- model adaptive state estimation method and system | |
| CN116563649B (en) | Tensor mapping network-based hyperspectral image lightweight classification method and device | |
| CN116703568A (en) | Credit card abnormal transaction identification method and device | |
| CN116340384A (en) | Nuclear recursion maximum correlation entropy time sequence on-line prediction method based on rule evolution | |
| CN110110625A (en) | SAR image target identification method and device | |
| CN112365525B (en) | High-resolution remote sensing image change detection network, method and device | |
| CN105956595A (en) | Image feature extraction method and system | |
| CN113627404B (en) | High-generalization face replacement method and device based on causal inference and electronic equipment | |
| CN113887656B (en) | Hyperspectral image classification method combining deep learning and sparse representation |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |