CN116708026B - Method and device for detecting network attack of direct-current micro-grid and estimating global state - Google Patents

Abstract

The invention relates to the technical field of electric power, in particular to a method and a device for detecting network attack and estimating global state of a direct current micro-grid. The method comprises the following steps: determining an initial global state vector and an initial covariance matrix; determining an estimated state vector of the current time region according to the initial global state vector, the initial covariance matrix, the input vectors of all regions at the initial time and the observed state vector of the current time region; determining an area which is not attacked by the network according to the area estimation state vector at the current moment; updating the initial global state vector by using the area estimation state vector of the area not attacked by the network to obtain an updated global estimation state; and taking the current moment as the initial moment, and iteratively calculating the area estimation state vector of each area at the next moment according to the updated global estimation state. The method and the device detect the specific condition of the network attack, analyze the specific attacked area when the network attack occurs, provide accurate health state estimation and have practical value.

Description

DC microgrid network attack detection and global state estimation method and device

Technical field

This article relates to the field of power technology, especially DC microgrid network attack detection and global state estimation methods and devices.

Background technique

DC microgrid is an important part of the intelligent power distribution system. It can effectively solve the problem of utilizing distributed renewable energy power generation and is of great significance to promoting energy conservation and emission reduction and achieving sustainable energy development. The DC microgrid connects distributed generating units through a communication network and shares information with the control decision center to build an interconnected and collaborative smart DC microgrid. Communication networks are vulnerable to various network attacks, such as false data injection attacks, communication delay attacks, denial of service attacks, etc., which will have a huge impact on system stability and performance, leading to incorrect supervision decisions by the control decision center.

Existing smart DC microgrid network attack detection methods focus on detecting attack locations at smart DC microgrid fault locations. When multiple network attacks occur simultaneously, there is a lack of research on the total number of attacks and the attack locations of each network attack. This makes it impossible to accurately obtain network attack information about complex attack situations. At the same time, most studies lack accurate state estimation of the entire microgrid when an attack occurs, and research on the communication quality of the network cannot play a role in the power Internet of Things.

Contents of the invention

In order to solve the above-mentioned problem that the existing technology cannot accurately obtain complex attack situations, embodiments of this article provide a DC microgrid network attack detection and global state estimation method and device.

The embodiments of this article provide a DC microgrid network attack detection and global state estimation method. The method includes: determining the initial global state vector and initial coordination according to the state vectors of the buck converters in all areas of the DC microgrid at the initial moment. Variance matrix, the initial global state vector is the global state vector at the initial moment; according to the initial global state vector, the initial covariance matrix, the input vectors of all regions at the initial moment, and the regional state observation vector at the current moment, the current moment is determined Regional estimated state vector, wherein the elements in the regional state observation vector at the current moment are the sum of the output voltage of the step-down converter in each region, the noise signal received by each region, and the network attack signal received; according to the regional estimate at the current moment The state vector determines the area in the DC microgrid that has not been attacked by the network; uses the regional estimated state vector of the area that has not been attacked by the network to update the initial global state vector to obtain the updated global estimated state; use the current moment as the initial moment , based on the updated global estimated state, iteratively calculate the regional estimated state vector of each region at the next moment.

According to one aspect of the embodiments of this article, determining the regional estimation state at the current moment includes: determining the initial regional estimation state vector and the estimated covariance matrix according to the initial global state vector and the initial covariance matrix; according to the initial regional estimation state vector and the estimated covariance matrix The covariance matrix uses the volume points to calculate the first regional estimated state vector and the first estimated covariance matrix; based on the first regional estimated state vector and the first estimated covariance matrix and the Kalman filter algorithm, determine the current moment regional estimated state vector and The estimated covariance matrix at the current moment.

According to one aspect of the embodiments of this article, determining the areas in the DC microgrid that are not subject to network attacks based on the regional estimation status at the current moment includes: determining the attack characteristic value of each area at the current moment based on the area estimation status of each area; determining the attack characteristic value of each area at the current moment; The degree of deviation between the attack characteristic value and the average regional state vector of the regional estimated state; the area where the deviation exceeds the preset threshold is determined to be an area subject to network attacks; the area where the deviation is less than or equal to the preset threshold is determined to be under attack Areas subject to cyberattacks.

According to one aspect of the embodiments of this article, the method further includes: performing cluster analysis on the attack characteristic values of each area at the current moment to obtain cluster clusters; according to the number of cluster clusters, each attack characteristic value in the cluster Corresponding area, determine the number of network attacks suffered by the area.

According to one aspect of the embodiments of this article, determining the global estimated state includes: determining whether the number of areas not subject to network attacks exceeds half of the total number of areas; if so, determining the global estimated state; if not, not performing global state estimation.

Embodiments of this article also disclose a DC microgrid network attack detection and global state estimation device. The device includes: an initial determination unit for determining the state vector of the buck converters in all areas of the DC microgrid at the initial moment. , determine the initial global state vector and the initial covariance matrix, where the initial global state vector is the global state vector at the initial moment;

The current determination unit is configured to determine the regional estimated state vector at the current moment based on the initial global state vector, the initial covariance matrix, the input vectors of all regions at the initial moment, and the regional state observation vector at the current moment, wherein the current moment The elements in the regional state observation vector are the sum of the output voltage of the step-down converter in each region, the noise signal received by each region, and the network attack signal received; the network attack determination unit is used to estimate the state vector according to the current moment of the region, and determine Areas within the DC microgrid that have not been attacked by the network; an update unit, used to update the initial global state vector using the regional estimated state vector of the area that has not been attacked by the network, to obtain an updated global estimated state; an iterative calculation unit, with Taking the current moment as the initial moment, based on the updated global estimated state, iteratively calculates the regional estimated state vector of each region at the next moment.

The embodiments of this article also provide a computer device. The computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the DC Microgrid network attack detection and global state estimation method.

Embodiments of this specification also provide a computer-readable storage medium that stores a computer program. When the computer program is executed by a processor, the DC microgrid network attack detection and global state estimation method is implemented. .

The embodiment of this article detects the specific situation of network attacks, analyzes the specific attacked areas when multiple network attacks occur, and provides accurate health status estimates, which has practical value.

Description of the drawings

In order to more clearly illustrate the embodiments of this article or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings in the following description are only For some embodiments of this article, those of ordinary skill in the art can also obtain other drawings based on these drawings without exerting creative efforts.

Figure 1 shows a flow chart of a DC microgrid network attack detection and global state estimation method according to the embodiment of this article;

Figure 2 shows a flow chart of a method for determining the regional estimation status at the current moment according to an embodiment of this article;

Figure 3 shows a flow chart of a method for determining areas not subject to network attacks according to an embodiment of this article;

Figure 4 shows a flow chart of a method for determining the number of network attacks in an area according to an embodiment of this article;

Figure 5 shows a flow chart of a method for determining the global estimated state according to the embodiment of this article;

Figure 6 shows a schematic structural diagram of a DC microgrid network attack detection and global state estimation device according to the embodiment of this article;

Figure 7 shows a schematic diagram of the DC microgrid network attack detection and global state estimation system according to the embodiment of this article;

Figure 8 shows a schematic structural diagram of a computer device according to an embodiment of this article.

Explanation of drawing symbols:

601. Initial determination unit;

602. Current determined unit;

603. Network attack determination unit;

604. Update unit;

605. Iterative calculation unit;

802. Computer equipment;

804, processor;

806. Memory;

808. Driving mechanism;

810. Input/output module;

812. Input device;

814. Output device;

816. Presentation equipment;

818. Graphical user interface;

820. Network interface;

822. Communication link;

824, communication bus.

Detailed ways

In order to enable those skilled in the art to better understand the technical solutions in this specification, the technical solutions in the embodiments of this document will be clearly and completely described below in conjunction with the drawings in the embodiments of this document. Obviously, the described implementation The examples are only part of the embodiments herein, but not all of the embodiments. Based on the embodiments in this article, all other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection in this article.

It should be noted that the terms “first”, “second”, etc. in the description, claims and above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It is to be understood that the data so used are interchangeable under appropriate circumstances so that the embodiments described herein can be practiced in sequences other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, apparatus, product or equipment that includes a series of steps or units and need not be limited to those explicitly listed. Those steps or elements may instead include other steps or elements not expressly listed or inherent to the process, method, product or apparatus.

This specification provides method operation steps as described in the examples or flow charts, but more or less operation steps may be included based on routine or non-inventive efforts. The sequence of steps listed in the embodiment is only one way of executing the sequence of many steps, and does not represent the only execution sequence. When the actual system or device product is executed, the methods shown in the embodiments or drawings may be executed sequentially or in parallel.

It should be noted that the DC microgrid network attack detection and global state estimation methods in this article can be used in the field of power technology and communication security. This article does not limit the application fields of the methods and devices.

Figure 1 shows a flow chart of a DC microgrid network attack detection and global state estimation method according to the embodiment of this article, which specifically includes the following steps:

Step 101: Determine the initial global state vector and the initial covariance matrix based on the state vectors of the buck converters in all areas of the DC microgrid at the initial moment. The initial global state vector is the global state vector at the initial moment.

In the embodiment of this description, each of all areas within the DC microgrid has a step-down converter. The state vector of the buck converter in each area of the DC microgrid at the initial moment can be expressed by express. Among them, i represents the i- th area, k represents the current time as the k-th time, and in the embodiment of this specification, the k -th time is represented as the initial time. Among them, the state vector at the initial moment can be understood as the electrical signal output by each area at the initial moment, including: the output voltage and output current of the buck converter.

In some embodiments of this specification, a DC microgrid global state estimator and a network attack detection locator are designed for the overall DC microgrid, and a local state estimator is designed for each area in the DC microgrid. Multiple local state estimators The devices are distributed in parallel in each area. Among them, the global state estimator and attack detection locator are connected to all local state estimators. The local state estimator of each region performs nonlinear regional state estimation of this region based on the output signals of other regions, thereby obtaining the regional estimated state of each region.

In the embodiment of this specification, the state vector of each region at the initial moment Can be used as input to the global state estimator for all regions.

Directly obtain the global estimated state vector at time k from the global state estimator of the DC microgrid and its covariance matrix/> . Based on the combination of the local state estimators at the current time k and the previous time k-1 , the initial regional estimated state vector of the i- th region at time k can be calculated/> and estimated covariance matrix/> . The detailed calculation method is described in Figure 2.

Step 102: Determine the regional estimated state vector at the current moment based on the initial global state vector, the initial covariance matrix, the input vectors of all regions at the initial moment, and the regional state observation vector at the current moment, where the regional state observation at the current moment The elements in the vector are the sum of the output voltage of the buck converter in each area, the noise signal received by each area, and the network attack signal received.

In some embodiments of this specification, the input vectors of all areas at the initial moment are represented by U. The regional input vector of the i- th regional local state estimator is given by express. The regional state observation vector at the current moment is represented by Z , . Among them, M represents the total number of areas. The regional state observation vector at the current moment can be collected directly from the DC microgrid. Further, the regional state vector is calculated based on the regional state observation vector.

In the embodiment of this specification, the elements in the regional state observation vector at the current moment are the sum of the output voltage of the buck converter in each region, the noise signal received by each region, and the network attack signal received. It can be expressed by the following formula: , where,/> Represents the measurement output signal of the i- th area;/> Indicates the external noise received by the i- th area;/> Indicates the network attack q suffered by the i -th area. The specific description of this step on determining the current regional estimation status is shown in Figure 2.

Step 103: Determine the area within the DC microgrid that is not subject to network attacks based on the current regional estimated state vector. In this step, based on the regional estimated status of each region, the attack characteristic value of each region at the current moment is determined, and the deviation degree of the region from the average regional status vector is determined based on the attack characteristic value to further determine whether the region is subject to a network attack. For a detailed description of step 103, see the description in Figure 3 .

Step 104: Update the initial global state vector using the regional estimated state vector of the area that has not been attacked by the network to obtain an updated global estimated state. The regional estimated state vector of an area that has not received a network attack is more accurate. Therefore, the regional estimated state vector of this healthy area is used to update the initial global vector at the next moment to obtain the updated global estimated state.

Step 105: Using the current time as the initial time, iteratively calculate the regional estimated state vector of each region at the next time based on the updated global estimated state.

Based on the updated global estimated state of the DC microgrid, calculate the regional estimated state of each region at the next moment. Considering that each region may use different sensors when measuring the output signal, the measured output signal will have different noise characteristics. , reliability level and measurement accuracy, so this step introduces the information weight factor of each region to accurately evaluate the local state vector of the local state estimator in each region.

Specifically, the following formula is used to determine the regional estimated state at the next moment.

in, represents the information weight factor of each region at time k , and M represents the total number of regions. When the performance of the sensors responsible for measuring output signals in each area is the same,/> , M represents the total number of areas.

Figure 2 shows a flow chart of a method for determining the regional estimation status at the current moment according to an embodiment of this article, which specifically includes the following steps:

Step 201: Determine the initial regional estimated state vector and estimated covariance matrix based on the initial global state vector and initial covariance matrix. In some embodiments of this specification, the initial regional estimated state vector and estimated covariance matrix are determined by, for example, the following formula:

, where,/> Represents the information weight factor of each area at time k . When the performance of the sensors responsible for measuring the output signal in each area is the same,/> ;/> Represents the initial regional estimated state vector of the i- th region at time k ;/> Represents the global state estimation state vector at time k ;/> Represents the covariance matrix of the initial regional estimated state vector of the i- th region at time k ; N is an array, indicating the serial numbers of all regions of the smart DC microgrid; A is an array, indicating the areas where the smart DC microgrid is under network attack at the current moment serial number.

Step 202: Calculate the first regional estimated state vector and the first estimated covariance matrix using volume points based on the initial regional estimated state vector and estimated covariance matrix. The initial regional estimated state vector determined in the previous steps is the predicted regional estimated state vector, which is not a completely real regional state vector. Therefore, in this step, the first regional estimated state vector and the first estimated covariance matrix are determined according to the following formula:

;

in, The prior prediction vector representing the regional state vector of the i- th region at time k+1 is the first regional estimated state vector,/> The covariance matrix representing the a priori prediction error of the regional state vector of the i -th region at time k+1 is the first estimated covariance matrix;/> Represents the volume point; m is the number of all volume points, which is m =4 ;/> Indicates the first/> volume points;/> Represents the identity matrix;/> for/> The variance matrix;/> Represents the initial regional estimated state vector of the i- th region at time k ;/> Represents the covariance matrix of the initial regional estimated state vector of the i -th region at time k .

Step 203: Determine the current regional estimated state vector and the current estimated covariance matrix based on the first regional estimated state vector, the first estimated covariance matrix and the Kalman filter algorithm.

In the embodiment of this specification, the following formula is used to determine the current time regional estimated state vector and the current time estimated covariance matrix:

;

in, Represents the prior prediction vector of the regional state observation vector of the i- th regional local state estimator at time k+1 ;/> Represents the regional state vector of the i- th region at time k+1 , which is the regional estimated state vector at the current time,/> Represents the covariance matrix of the regional state vector of the i -th region at time k+1 , which is the estimated covariance matrix at the current time;/> is the Kalman gain,/> Represents the relationship matrix between the local state vector and the local state observation vector.

Figure 3 shows a flow chart of a method for determining areas not subject to network attacks according to the embodiment of this article, which specifically includes the following steps:

Step 301: Determine the attack characteristic value of each area at the current time based on the area estimation status of each area. In the embodiment of this specification, attack characteristic values can reflect the impact of network attacks on different areas. This step can calculate the attack characteristic value of each area based on the regional estimation status of each area. The attack characteristic value represents the deviation of the attack suffered by the area from the average area status of all areas. Among them, the larger the attack characteristic value and the greater the degree of deviation, the greater the impact caused by the area being attacked; conversely, the smaller the attack characteristic value and the smaller the degree of deviation, the smaller the change caused by the area being attacked. In this step, the attack characteristic value of each area is calculated according to the following formula.

;

Indicates the attack characteristic value of the i - th area at k+1 time (that is, the next time);/> Represents the average regional state vector of all local state estimators; W is a weight matrix, used to adjust the importance of the local state of each regional local state estimator.

Step 302: Determine the degree of deviation between the attack characteristic value and the average regional state vector of the regional estimated state. The degree of deviation is determined based on the size of the attack characteristic value.

Step 303: Determine areas where the degree of deviation exceeds a preset threshold as areas subject to network attacks. In the example of this manual, based on the degree of deviation and the size of the attack characteristic value, a preset threshold is set to determine whether it belongs to the network attack area. If the deviation calculated based on the attack characteristic value is greater than the preset threshold, it means that the area is subject to a network attack.

Step 304: Determine areas where the degree of deviation is less than or equal to a preset threshold as areas not subject to network attacks. If the deviation calculated based on the attack characteristic value is less than the preset threshold, it means that the area has not been attacked by a network.

Figure 4 shows a flow chart of a method for determining the number of network attacks in an area according to an embodiment of this article, which specifically includes the following steps:

Step 401: Perform cluster analysis on the attack characteristic values of each area at the current moment to obtain cluster clusters.

In this step, the fuzzy c-means clustering algorithm is used to process the attack characteristic values of each area at the current moment, thereby detecting the network attacks in each area. Among them, the analysis determines the number of attacks and types of network attacks in each area, thereby clustering different areas.

With, construct an objective function and complete clustering by minimizing the objective function. Randomly initialize the membership degree, calculate the cluster center corresponding to the current membership degree, and iteratively calculate the membership degree and the cluster center corresponding to the membership degree until the clustering end condition is met. Among them, the formula expression of the objective function is as follows:

;

in, is the degree of membership;/> is the number of clusters;/> Represents the jth cluster center, M is the total number of regions,/> Indicates the attack characteristic value of the i- th area at time k+1 .

The calculation formula of cluster center is as follows:

;/> Represents the bth cluster center;

Among them, the membership iteration formula is expressed as follows:

;/> Represents the jth cluster center,/> Represents the bth cluster center; the conditional formula for the end of clustering is as follows:

,/> Represents the objective function after the t -th iteration;/> is the clustering end threshold.

Step 402: Determine the number of network attacks in the area based on the number of clusters and the areas corresponding to each attack characteristic value in the cluster.

In the embodiment of this specification, after performing cluster analysis on the attack characteristic values of each area, a cluster cluster can be obtained. The number of clusters obtained by clustering can reflect the number of cyber attacks in a region. Among them, the cluster with the smallest cluster center is the safe cluster, and the attack characteristic value of this cluster has the smallest deviation. The area corresponding to each attack characteristic value in the security cluster is the security area that has not suffered network attacks. At this time, the number of network attacks suffered by the smart microgrid at the current moment is .

For example, if the number of clusters is 5, it is subject to 4 network attacks. Furthermore, based on the attack characteristic values, it can be determined whether the network attacks suffered by different areas are of the same type. Except for the security cluster, each other cluster represents a network attack. The areas corresponding to each attack characteristic value in the same cluster are the areas that have suffered the same attack. The serial number of each area under network attack at the current moment is represented by the array A , and the number of areas under network attack at the current moment can be represented by a .

In the embodiment of this specification, the attack detection locator analyzes the sequence number of the area under attack and the number of areas under network attack. Further isolate the local state estimator that produces errors due to network attacks, and receive the regional state vector and its covariance matrix estimated in step 203 by the local state estimator of the safe area that has not suffered network attacks.

In some embodiments of this specification, the initial global state vector is updated using the regional estimated state of the area not subject to network attacks. Specifically, the following formula is used to determine the updated global estimated state:

;

Among them, A represents the serial number of the area under attack, N is an array including the serial numbers of all areas of the DC microgrid, then NA represents the serial number of the area that has not been attacked by the network; Represents the global estimation vector of the current time zone,/> Represents the covariance matrix of the global estimated vector at the current moment. The embodiments of this specification detect the specific circumstances of network attacks, analyze the specific attacked areas when multiple network attacks occur, and provide accurate health status estimates.

Figure 5 shows a flow chart of a method for determining the global estimated state according to the embodiment of this article, which specifically includes the following steps:

Step 501: Determine whether the number of areas not subject to network attacks exceeds half of the total number of areas. Determine the number of areas Na that are not subject to network attacks, and its relationship with the size of 0.5 M.

Step 502, if yes, determine the global estimated state. In this step, when the number of areas subject to network attacks is less than half of the total number of areas M , the regional state vector and its covariance matrix information of the local state estimator of each area received by the global state estimator is sufficient, In this way, the global estimated state of the smart DC microgrid can be calculated and obtained.

Step 503, if not, no global state estimation is performed. When the number of areas under attack is greater than or equal to half of the total number of areas, that is When , the number of local state vectors and their covariance matrix information of each local state estimator received by the global state estimator is small, and the global estimated state of the smart DC microgrid cannot be fully calculated;

Figure 6 is a schematic structural diagram of a DC microgrid network attack detection and global state estimation device according to the embodiment of this article. This figure describes the basic structure of the DC microgrid network attack detection and global state estimation device, and its functions Units and modules can be implemented in software, or general chips or specific chips can be used to implement DC microgrid network attack detection and global state estimation. The DC microgrid network attack detection and global state estimation device specifically includes:

The initial determination unit 601 is used to determine the initial global state vector and the initial covariance matrix based on the state vectors of the step-down converters in all areas of the DC microgrid at the initial moment. The initial global state vector is the global state at the initial moment. vector;

The current determination unit 602 is configured to determine the current regional estimated state vector according to the initial global state vector, the initial covariance matrix, the input vectors of all regions at the initial time, and the current regional state observation vector, wherein the current The elements in the moment-to-moment regional state observation vector are the sum of the output voltage of the buck converter in each region, the noise signal received by each region, and the network attack signal received;

The network attack determination unit 603 is used to determine the area in the DC microgrid that is not subject to network attacks based on the current regional estimation state vector;

The update unit 604 is configured to update the initial global state vector using the regional estimated state vector of the area not subject to network attacks to obtain the updated global estimated state;

The iterative calculation unit 605 is configured to use the current time as the initial time, and iteratively calculate the regional estimated state vector of each region at the next time based on the updated global estimated state.

The embodiments of this specification are suitable for nonlinear systems such as smart DC microgrids containing nonlinear loads. There is no need to linearize the nonlinear equations, which reduces the burden of online calculations. This solution uses multiple filters arranged in parallel to avoid the need for a single volume. The Kalman filter has the disadvantage of weak noise reduction ability, achieving better noise reduction effect and reducing the impact of noise on the final global estimated state; calculating the attack eigenvalue based on the residual through the weighted 2 norm, reducing the state changes caused by the attack The detection is more sensitive and the success rate of detection is enhanced; the attack estimation is eliminated through the clustering method, and each regional information weight factor is introduced to reflect the reliability of sensors in different regions, improving the accuracy of global state estimation; it can detect the network The specific circumstances of the attack, analyzing the specific attacked areas when multiple network attacks occurred, and providing accurate health status estimates are of practical value.

Figure 7 shows a schematic diagram of the DC microgrid network attack detection and global state estimation system according to the embodiment of this article. In the figure, there are multiple areas in the DC microgrid, namely area 1, area 2, area i ...area M. Each area includes DC power supplies, step-down converters and non-linear loads. The buck converter has parameters such as capacitance, inductance and resistance, and the nonlinear load in the area includes resistance and constant power. The system includes a global state estimator and a network attack detection locator, and each area in the DC microgrid has a local state estimator. The global state estimator and attack detection locator are connected to all local state estimators.

Specifically, the local state estimator of each region outputs the initial state vector of each region at the previous moment as the input signal of the global state estimator. The output of the global state estimator is returned to the local state estimator, which is used to calculate the regional state estimate at the next moment.

As shown in Figure 8, it is a computer device provided by the embodiment of this article. The DC microgrid network attack detection and global state estimation methods described in this application can be applied to the computer equipment. The computer device 802 may include one or more processors 804, such as one or more central processing units (CPUs), each of which may implement one or more hardware threads. Computer device 802 may also include any memory 806 for storing any kind of information such as code, settings, data, and the like. Without limitation, for example, the memory 806 may include any one or more combinations of the following: any type of RAM, any type of ROM, flash memory device, hard disk, optical disk, etc. More generally, any memory can use any technology to store information. Further, any memory can provide volatile or non-volatile retention of information. Further, any memory may represent a fixed or removable component of computer device 802. In one instance, when processor 804 executes associated instructions stored in any memory or combination of memories, computer device 802 may perform any operation of the associated instructions. The computer device 802 also includes one or more drive mechanisms 808 for interacting with any memory, such as a hard disk drive, an optical disk drive, and the like.

Computer device 802 may also include an input/output module 810 (I/O) for receiving various inputs (via input device 812) and for providing various outputs (via output device 814). One particular output mechanism may include a presentation device 816 and an associated graphical user interface (GUI) 818. In other embodiments, the input/output module 810 (I/O), the input device 812 and the output device 814 may not be included, and may only be used as a computer device in the network. Computer device 802 may also include one or more network interfaces 820 for exchanging data with other devices via one or more communication links 822 . One or more communication buses 824 couple together the components described above.

Communication link 822 may be implemented in any manner, such as through a local area network, a wide area network (eg, the Internet), a point-to-point connection, etc., or any combination thereof. Communication link 822 may include any combination of hardwired links, wireless links, routers, gateway functions, name servers, etc. governed by any protocol or combination of protocols.

Corresponding to the methods in Figures 1 to 5, embodiments of this article also provide a computer-readable storage medium. The computer-readable storage medium stores a computer program. The computer program executes the steps of the above method when run by a processor. .

Embodiments of this document also provide computer-readable instructions, wherein when a processor executes the instructions, the program therein causes the processor to perform the methods shown in FIGS. 1 to 5 .

It should be understood that in the various embodiments of this article, the size of the sequence numbers of the above-mentioned processes does not mean the order of execution. The execution order of each process should be determined by its functions and internal logic, and should not be used in the implementation of the embodiments of this article. The process constitutes any limitation.

It should also be understood that in the embodiments of this article, the term "and/or" is only an association relationship describing associated objects, indicating that three relationships can exist. For example, A and/or B can mean: A exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this article generally indicates that the related objects are an "or" relationship.

Those of ordinary skill in the art can appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented with electronic hardware, computer software, or a combination of both. In order to clearly illustrate the relationship between hardware and software Interchangeability, in the above description, the composition and steps of each example have been generally described according to functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. The skilled artisan may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of this article.

Those skilled in the art can clearly understand that for the convenience and simplicity of description, the specific working processes of the systems, devices and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be described again here.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices and methods can be implemented in other ways. For example, the device embodiments described above are only illustrative. For example, the division of the units is only a logical function division. In actual implementation, there may be other division methods. For example, multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented. In addition, the coupling or direct coupling or communication connection between each other shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be electrical, mechanical or other forms of connection.

The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiments of this article.

In addition, each functional unit in each embodiment of this article can be integrated into one processing unit, each unit can exist physically alone, or two or more units can be integrated into one unit. The above integrated units can be implemented in the form of hardware or software functional units.

If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it may be stored in a computer-readable storage medium. Based on this understanding, the technical solution in this article essentially contributes to the existing technology, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions to cause a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in various embodiments of this article. The aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program code. .

This article uses specific embodiments to illustrate the principles and implementation methods of this article. The description of the above embodiments is only used to help understand the methods and core ideas of this article; at the same time, for those of ordinary skill in the field, based on the ideas of this article , there will be changes in the specific implementation and application scope. In summary, the content of this description should not be understood as a limitation of this article.

Claims (12)

1. A method for detecting a direct current micro-grid network attack and estimating a global state, the method comprising:

determining an initial global state vector and an initial covariance matrix according to state vectors of buck converters of all areas in a direct current micro-grid at an initial moment, wherein the initial global state vector is a global state vector at the initial moment;

determining an area estimation state vector at the current moment according to the initial global state vector, the initial covariance matrix, input vectors of all areas at the initial moment and an area state observation vector at the current moment, wherein elements in the area state observation vector at the current moment are the sum of output voltage of the buck converter at each area, noise signals received by each area and network attack signals received by each area;

According to the current time zone estimation state vector, determining a zone which is not attacked by the network in the direct current micro-grid;

updating the initial global state vector by using the area estimation state vector of the area not attacked by the network to obtain an updated global estimation state;

and taking the current moment as the initial moment, and iteratively calculating the area estimation state vector of each area at the next moment according to the updated global estimation state.

2. The method for detecting and estimating a global state of a dc micro-grid network attack according to claim 1, wherein determining the area estimation state at the current moment comprises:

determining an initial region estimation state vector and an estimation covariance matrix according to the initial global state vector and the initial covariance matrix;

calculating a first region estimation state vector and a first estimation covariance matrix by using volume points according to the initial region estimation state vector and the estimation covariance matrix;

and determining the area estimation state vector at the current moment and the estimation covariance matrix at the current moment according to the first area estimation state vector, the first estimation covariance matrix and the Kalman filtering algorithm.

3. The method for detecting and estimating the global state of a direct current micro grid network attack according to claim 2, wherein the method comprises the following steps: the initial region estimation state vector and the estimation covariance matrix are determined by using the following formula: Wherein->Representation->Information weighting factors of each region at a time, when the sensor performance of each region responsible for measuring the output signal is the same, < >>M represents the total number of areas, a represents the total number of areas subject to network attacks,each region information weight factor indicating the time k+1; />Representation->Time of day (time)iInitial region estimation state vectors for individual regions; />Representation->Estimating a state vector by a global state at a moment; />Representation->Time of day (time)iInitial region estimation state vector covariance matrix of each region;Nthe system is an array, and represents all area serial numbers of the intelligent direct current micro-grid;Ais an array, which indicates the sequence number of the area of the intelligent direct-current micro-grid under network attack at the current moment,/->And represents the covariance matrix of the global state estimation vector at time k.

4. The method for detecting and estimating a global state of a dc micro-grid network attack of claim 3, wherein the first area estimation state vector and the first estimation covariance matrix are determined by using the following formula:

wherein (1)>Representation of k+ 1Time->Priori pre-prediction of region state vectors for individual regionsA measured vector, namely the first area estimation state vector,Representation ofk+1Time->A covariance matrix of the prior prediction errors of the regional state vectors of the individual regions is the first estimated covariance matrix; / >Representing a volume point;mfor all volume points, this is takenm=4；/>Represent the firstjA plurality of volume points; />Representing the identity matrix; />Is->Is a variance matrix of (a); />Representation ofkTime of day (time)iInitial region estimation state vectors for individual regions; />Representation->Time->Initial region estimation state vector covariance matrix of each region, f ()A relationship function representing a region state vector at a previous time and a region state vector at a subsequent time;a region input vector representing an i-th region at a time k; />A relationship function representing a region state vector at a current time and a region input vector at the current time; />A transpose of the matrix of prior prediction errors of the region state vector representing the i-th region at time k+1.

5. The method for detecting and estimating a global state of a direct current micro-grid network attack according to claim 4, wherein the current time zone estimation state vector and the current time estimation covariance matrix are determined by using the following formula:

wherein (1)>Representation ofTime->A priori prediction vector of the regional state observation vector of the regional local state estimator of each region; />Representation ofTime->The regional state vector of each region is the regional estimation state vector of the current moment, +. >Representation->Time->The covariance matrix of the regional state vector of each region is the estimated covariance matrix of the current moment; />For Kalman gain, ++>Is a relation matrix of the regional state vector and the regional state observation vector,>represents time k-1>The initial region of each region estimates the covariance matrix of the state vector.

6. The method for detecting and estimating the global state of network attacks on a direct current micro-grid according to claim 5, wherein determining the area which is not attacked by the network in the direct current micro-grid according to the current time area estimation state comprises:

according to the area estimation state of each area, determining the attack characteristic value of each area at the current moment;

determining the deviation degree of the attack characteristic value and the average area state vector of the area estimation state;

determining an area with the deviation degree exceeding a preset threshold value as an area under network attack;

and determining the area with the deviation degree smaller than or equal to the preset threshold value as the area not attacked by the network.

7. The method of direct current micro grid network attack detection and global state estimation according to claim 6, further comprising:

performing cluster analysis on the attack characteristic values of each region at the current moment to obtain a cluster;

And determining the number of network attacks to which the area is subjected according to the number of the clustered clusters and the areas corresponding to the attack characteristic values in the clusters.

8. The method of claim 7, wherein updating the initial global state vector with the area estimation state of the area not under network attack comprises:

the updated global estimated state is determined using the following formula:wherein, Ais an array, represents the sequence number of the area under attack,Nthe array comprises serial numbers of all areas of the direct current micro-grid; />Representing the global estimate vector of the current time zone, +.>And the covariance matrix of the global estimation vector at the current moment is represented.

9. The method for detecting and estimating a global state of a dc micro-grid network attack of claim 8, wherein determining the global estimated state comprises:

judging whether the number of the areas not attacked by the network exceeds half of the total number of the areas;

if yes, determining a global estimation state;

if not, the global state estimation is not performed.

10. A direct current micro grid network attack detection and global state estimation device, the device comprising:

The initial determining unit is used for determining an initial global state vector and an initial covariance matrix according to the state vectors of the buck converters of all areas in the direct current micro-grid at the initial moment, wherein the initial global state vector is the global state vector at the initial moment;

the current determining unit is used for determining a current time zone estimation state vector according to the initial global state vector, the initial covariance matrix, input vectors of all zones at the initial time and a current time zone state observation vector, wherein elements in the current time zone state observation vector are the sum of output voltage of the buck converter of each zone, noise signals received by each zone and network attack signals received by each zone;

the network attack determining unit is used for determining an area which is not attacked by the network in the direct current micro-grid according to the area estimation state vector at the current moment;

the updating unit is used for updating the initial global state vector by utilizing the area estimation state vector of the area which is not attacked by the network to obtain an updated global estimation state;

and the iterative calculation unit is used for taking the current moment as the initial moment and iteratively calculating the area estimation state vector of each area at the next moment according to the updated global estimation state.

11. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method of any of claims 1 to 9 when executing the computer program.

12. A computer-readable storage medium, characterized in that the computer-readable storage medium stores a computer program which, when executed by a processor, implements the method of any one of claims 1 to 9.