WO2021190188A1 - Cross-space cascading failure assessment method, appartus and device - Google Patents

Abstract

A cross-space cascading failure assessment method, apparatus and device. The method comprises: constructing a cross-space cascading failure attack graph, which comprises multiple attack paths (S11); calculating the total betweenness value of each attack path of the cross-space cascading failure attack graph (S12); acquiring a first power before cross-space cascading failure and a second power after cross-space cascading failure (S13); calculating, according to the first power and the second power, the power loss factor of a primary side of a power system caused by the cross-space cascading failure corresponding to each attack path (S14); calculating the harmfulness factor value of each attack path according to the total betweenness value of each attack path and the power loss factor of the primary side of the power system caused by the cross-space cascading failure corresponding to each attack path (S15); and sorting multiple harmfulness factor values, and assessing, according to the sorting result, the extent of the harm of the cross-space cascading failure corresponding to each attack path (S16).

Description

Evaluation method, device and equipment for cross-space cascading failure

This application claims the priority of a Chinese patent application filed with the Chinese Patent Office with an application number of 202010208624.8 on March 23, 2020, and the entire content of the application is incorporated into this application by reference.

Technical field

This application relates to the field of power grid cyber-physical systems, for example, to a method, device and equipment for evaluating cross-space cascading faults.

Background technique

With the development of new technologies such as "Internet +", big data, and artificial intelligence, the working mode of the power industry has undergone tremendous changes. As the world’s largest and most complex artificial system, the power grid has The continuous integration of physical systems has formed the embryonic form of power grid cyber-physical systems. The future power system will fully utilize modern information technologies and advanced communication technologies such as mobile interconnection and artificial intelligence to realize the interconnection of everything in the power system and human-computer interaction, creating a ubiquitous state of comprehensive perception, efficient processing of information, and convenient and flexible applications. The power Internet of Things, therefore, the impact of the information space of the power grid on the physical system cannot be ignored, and the failure of the information space usually leads to a cascading failure of the power system across spaces.

Since the source of cross-space cascading failures is in the information space, they are more concealed and more harmful than traditional power system failures. The analysis methods used in related technologies can usually only analyze and evaluate the damage to the system caused by the cross-space cascading faults in the power grid cyber-physical system. Comprehensive consideration of the degree of hazard, it is impossible to sequence the hazards of multiple cross-space cascading failures to the system, and thus it is impossible to accurately assess and locate the information and physical nodes that need to be protected in the cyber-physical system of the power grid.

Summary of the invention

This application provides a method, device and equipment for evaluating cross-space cascading failures.

A method for evaluating cross-space cascading failures is provided, including: constructing a cross-space cascading failure attack diagram of a power grid cyber-physical system, wherein the cross-space cascading failure attack diagram includes multiple attack paths; calculating the cross-space cascading failure The total betweenness value of each attack path of the attack graph; obtain the first power of the physical side of the power grid cyber-physical system before the occurrence of a cross-space cascading failure and the power grid cyber-physical system after the occurrence of the cross-space cascading failure The second power of the physical side; according to the first power and the second power, calculate the power loss factor of the primary side of the power system caused by the cross-space cascading failure corresponding to each attack path; according to the total between-value of each attack path The primary side power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path is calculated, and the criticality factor value of each attack path is calculated; multiple damages corresponding to the multiple attack paths respectively The value of the sex factor is sorted, and the damage degree of the cross-space cascading failure corresponding to each attack path is evaluated according to the sorting result.

An evaluation device for cross-space cascading failures is also provided, including: a building module configured to construct a cross-space cascading failure attack diagram of a power grid cyber-physical system, wherein the cross-space cascading failure attack diagram includes multiple attack paths; A calculation module is configured to calculate the total betweenness value of each attack path of the cross-space cascading failure attack graph; the acquisition module is configured to obtain the first power and occurrence of the power grid cyber-physical system before the cross-space cascading failure occurs The second power of the power grid cyber-physical system after the cross-space cascading failure; a second calculation module configured to calculate the cross-space cascading failure corresponding to each attack path based on the first power and the second power The primary-side power loss factor of the power system caused by the third calculation module, according to the total between-value of each attack path and the primary-side power loss factor of the power system caused by the cross-space cascading fault corresponding to each attack path, calculate the result The criticality factor value of each attack path; the evaluation module is set to sort the multiple criticality factor values corresponding to the multiple attack paths, and according to the sorting result, the cross-space cascading failures corresponding to each attack path The degree of hazard is assessed.

A computer device is also provided, including: a memory and a processor, the memory and the processor are in communication connection with each other, the memory is stored with computer instructions, and the processor executes the computer instructions to thereby Perform the above-mentioned cross-space cascading failure assessment method.

A computer-readable storage medium is also provided, and the computer-readable storage medium stores computer instructions for causing the computer to execute the above-mentioned cross-space cascading failure assessment method.

Description of the drawings

FIG. 1 is a schematic diagram of a substation automation system architecture of a power system and its bus 9 provided by an embodiment of the application;

2 is a flowchart of a method for evaluating cross-space cascading failures provided by an embodiment of the application;

FIG. 3 is a schematic structural diagram of an attack path provided by an embodiment of this application;

4 is a structural block diagram of a device for evaluating cross-space cascading failures provided by an embodiment of the application;

FIG. 5 is a schematic structural diagram of a computer device provided by an embodiment of this application.

Detailed ways

The technical solution of the present application will be described below in conjunction with the accompanying drawings.

In the description of this application, the terms "center", "upper", "lower", "left", "right", "vertical", "horizontal", "inner", "outer", etc. indicate the orientation or position The relationship is based on the orientation or position relationship shown in the drawings, which is only for the convenience of describing the application and simplifying the description, and does not indicate or imply that the device or element referred to must have a specific orientation, be constructed and operated in a specific orientation, therefore It cannot be understood as a restriction on this application. In addition, the terms "first", "second", and "third" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance.

In the description of this application, unless otherwise specified and limited, the terms "installed", "connected", and "connected" should be understood in a broad sense, for example, it may be a fixed connection, a detachable connection, or an integral connection; It can be a mechanical connection or an electrical connection; it can be a direct connection or an indirect connection through an intermediate medium, or it can be the internal connection between the two components, and it can be a wireless connection or a wired connection. The meaning of the above terms in this application can be understood according to the situation.

Example 1

This embodiment provides a method for evaluating cross-space cascading faults, which is applied to a power grid cyber-physical system. This embodiment takes a power grid cyber-physical system composed of one bay in the substation automation system of the power system and its bus 9 as an example, as shown in the figure As shown in 1, the power grid cyber-physical system includes the information space and the power grid physical system. The information space and the power grid physical system are connected through a cross-space linkage interface. The power system of the cross-space linkage interface includes multiple nodes. Take one node as an example. As shown in Figure 2, the assessment method of cross-space cascading failures includes:

S11, construct a cross-space cascading failure attack graph, which includes multiple attack paths.

Exemplarily, construct a cross-space chain attack diagram of a grid cyber-physical system composed of an interval in the substation automation system of the power system and its bus bar 9, and the cross-space chain attack diagram is composed of multiple attack paths, as shown in Figure 3 .

As an optional implementation manner of this application, the above step S11 includes:

First, determine the information threat node, the secondary side equipment fault node of the power system and the primary side disturbance node of the power system in the cross-space cascading fault attack graph.

Exemplarily, the information threat node is the initial node that generates the attack path of cross-space cascading faults, and the secondary side equipment of the power system is an auxiliary for monitoring, measuring, controlling, protecting and regulating the primary side equipment of the power system in the cyber-physical system of the power grid. Equipment, power system secondary-side equipment failure nodes are nodes that monitor, measure, control, protect, and regulate the primary-side equipment of the power system. The primary-side disturbance node of the power system is the node that affects the primary-side equipment of the power system.

As an optional implementation of the present application, the information threat node may include: denial of service attack node, direct utilization attack node, information equipment reliability failure node; power system secondary side equipment failure node may include: control signal Misoperation, refusal to move, and outage nodes of the device, measurement result deviation nodes of the measuring device, and misoperation, refusal to move, and outage nodes of the protection device. This application does not limit this, and can be determined according to actual needs.

Secondly, according to the information threat node, the secondary side equipment failure node of the power system and the power system primary side disturbance node, the attack path is formed. The attack path starts from the information threat node, passes through the secondary side equipment failure node of the power system, and ends in the primary power system. Side disturbance node.

Exemplarily, the cross-space cascading failure attack graph includes multiple attack paths, and the multiple attack paths start from the information threat node, pass through the secondary side equipment failure node of the power system, and finally the primary side disturbance node of the power system. The information threat node is the denial-of-service attack node and the direct-use attack node; the secondary side equipment failure node of the power system is the control signal device misoperation, refusal to move, and outage nodes, and the protection device malfunctions, refuses to move, and stops. This type of node; the primary-side disturbance node of the power system is the N-1 fault of the power system as an example, where the control signal device misoperation can be the control and signal device issuing an error command, and the control signal device refusal can be the control and signal device rejection Executing instructions; a malfunction of a protection device can be a malfunction of the protection device's fixed value modification, and a protection device's refusal can be a protection device's fixed value modification and refused to move. According to the information threat node, the secondary side equipment failure node of the power system, and the power system primary side disturbance node, multiple attack paths can be formed, such as "denial of service attack-control signal device refuses to execute instructions-cut/switch load-power system N -1 failure".

Thirdly, a cross-space cascading failure attack graph is formed according to the attack path.

Exemplarily, multiple attack paths can be generated according to information threat nodes, power system secondary side equipment failure nodes, and power system primary side disturbance nodes, and multiple attack paths are interwoven to form a cross-space cascading failure attack graph as shown in FIG. 3.

S12: Calculate the total betweenness value of each attack path of the cross-space cascading failure attack graph.

Exemplarily, according to the formed cross-space cascading failure attack graph, the intermediate value of multiple nodes passed by each attack path is calculated, and each attack path is calculated according to the intermediate value of multiple nodes of each attack path. The total between values. The calculation process is as follows:

First, calculate the node betweenness value of each attack path.

Exemplarily, since the attack graph includes multiple attack paths, each attack path starts from the information threat node, passes through the secondary side equipment failure node of the power system, and ends at the primary side disturbance node of the power system, and the information threat node and the power The secondary side equipment failure node of the system is different, and the node betweenness value of each attack path is also different. The intermediate value of the node can be based on the formula

It is calculated, where σ represents the total number of all shortest paths, and σ _i represents the number of shortest paths passing through node i among all the shortest paths. Take Figure 3 as an example, where the intermediate value of the "cut/turn load" node is 1, and the intermediate value of the "control and signaling device refuses to execute instructions", "control and signaling device outage", and "protection equipment outage" are 2/9, "Control and signal device issued wrong command", "Protection equipment fixed value modification-Misoperation", "Protection equipment fixed value modification-Refusal to move" nodes have a median value of 1/9.

Secondly, multiply the node betweenness values to obtain the total betweenness values corresponding to each attack path of the cross-space cascading failure attack graph.

Illustratively, multiply the node betweenness value of each attack path in the cross-space cascading failure attack graph to obtain the total betweenness value of each attack path in all the cross-space cascading failure attack graphs. The calculation formula is:

Among them, BC _k is the total betweenness value of the k-th attack path in the cross-space cascading failure attack graph, n _k is the number of nodes in the k- _{th attack path, and bc i is} the node between the i-th node on the attack path. Numerical value.

Take the attack diagram in Figure 3 as an example, the attack path "Denial of service attack-control and signaling device refuses to execute instructions-switch / load load-power system N-1 failure", "Denial of service attack-control and signaling device outage" -Load cut/switch-power system N-1 failure", "Denial of service attack-protection equipment outage-load cut/switch-power system N-1 failure", "utilization attack-control and signal device rejection command- Switching / switching load-power system N-1 failure", "utilization attack-control and signaling device outage-switching / switching load-power system N-1 failure", "utilization attack-protection equipment shutdown-switching / The total value of load-on-power system N-1 failure" is 2/9, and the attack path is "utilization attack-control and information device issued wrong command-load cut/on-power system N-1 failure", " Utilization attack-protection equipment setting value modification-misoperation-switching / switching load-power system N-1 failure", "utilization attack-protection equipment setting value modification-refusal to move-switching / switching load-power system N-1 The total value of "fault" is 1/9.

S13: Obtain the first power before the cross-space cascading failure and the second power after the cross-space cascading failure.

Exemplarily, after a cross-space cascading failure in the power grid cyber-physical system occurs, the power distribution in the power grid cyber-physical system may change, so it is necessary to obtain the first power before the cross-space cascading failure occurs and the cross-space cascading failure occurs After the second power. Among them, the first power and the second power can be based on the power flow equation

Calculated.

S14: Calculate the primary-side power loss factor of the power system caused by the cross-space cascading fault corresponding to the attack path according to the first power and the second power.

Illustratively, to give the first power P1 and the second power P2 in accordance with flow calculation equations, determining the ratio of the power loss of the power information P _rop physical system _{power loss,} power loss and _{power loss} P _rop ratio depending on the secondary side of the power system equipment _{The conditional probability P k} that triggers a disturbance on the primary side of the power system when a fault occurs (disturbance on the primary side of the power system | a failure of the equipment on the secondary side of the power system) determines the power loss factor on the primary side of the power system. The calculation process is as follows:

First, calculate the power loss ratio based on the first power and the second power.

Exemplarily, the calculation formula for calculating the power loss ratio based on the first power and the second power is as follows:

Among them, P1 is the first power before the cross-space cascading failure occurs; P2 is the second power after the cross-space cascading failure occurs.

Second, multiply the conditional probability and the power loss ratio to obtain the power loss factor of the primary side of the power system caused by the cross-space cascading failure corresponding to the attack path.

Exemplarily, the conditional probability of triggering a disturbance on the primary side of the power system P _k (disturbance on the primary side of the power system | failure of the secondary side equipment on the power system) and the power loss ratio P _{rop power loss are exemplified By multiplying, the power loss factor f k of the} primary side of the power system caused by the cross-space cascading fault corresponding to the attack path is obtained. The calculation formula is as follows:

f _k = P _k (disturbance on the primary side of the power system | failure of the equipment on the secondary side of the power system) × P _{rop power loss k}

Among them, k is the number of the attack path in the cross-space cascading failure attack graph.

S15: According to the total dielectric value and the power loss factor of the primary side of the power system, the criticality factor value of the cross-space cascading fault is calculated.

Exemplarily, according to the calculated total intermediate value BC _k of the attack path and the power loss factor f _{k of the} primary side of the power system, the criticality factor value of the cross-space cascading failure is obtained.

The calculation process is: _{multiply the total between value BC k of the} attack path and the primary power loss factor f _{k of the} power system to obtain the criticality factor Dan _{k of the} cross-space cascading fault. The calculation formula is as follows:

Dan _k ＝BC _k ×f _k

S16: Sort the criticality factor values, and evaluate the damage degree of the cross-space cascading failure corresponding to the attack path according to the sorting result.

Exemplarily, calculate the criticality factor value Dan _{k of} different attack paths, sort the criticality factor values of multiple attack paths from large to small, and perform the damage degree of the cross-space cascading failure corresponding to the attack path according to the sorting result. Evaluate. Among them, the greater the value of the criticality factor of the attack path, the higher the damage of the attack path to cross-space cascading failures. Sorting according to the value of the criticality factor of multiple cross-space cascading failures can get multiple attack path pairs. By sorting the hazard degree of cross-space cascading failures, the higher-risk cross-space cascading failure types and possible locations in the current power grid cyber-physical system can be determined.

Taking the attack diagram shown in Figure 3 as an example, if the power loss factor P _rop of the attack path in multiple cross-space cascading failure attack diagrams is the same, then the total betweenness value of each attack path and the power loss on the primary side of the power system Multiplying the factors to obtain the criticality factor value of cross-space cascading failures, including "Denial of Service Attack-Control and Signal Device Denial of Command-Switching/Loading-Power System N-1 Failure", "Denial of Service Attack-Control and Signal" Device outage-cut / load-power system N-1 failure", "Denial of service attack-protection equipment outage-cut / load-power system N-1 failure", "utilization attack-control and information device Refusal of instruction-cut/switch on load-power system N-1 failure", "utilization attack-control and information device shutdown-cut / switch load-power system N-1 failure", "utilization attack-protection equipment outage -Load cut/switch-on-power system N-1 failures" six cross-space cascading failure attack diagrams The attack path corresponding to the cross-space cascading failure is the most harmful, and can focus on protecting the current power grid cyber-physical system corresponding to the above six attacks The information and physical nodes of the path ensure the security and operational stability of the cyber-physical system of the power grid.

The cross-space cascading failure evaluation method provided by this embodiment constructs a cross-space cascading failure attack graph, which includes multiple attack paths; calculates the total between-value of each attack path of the cross-space cascading failure attack graph Obtain the first power before the cross-space cascading failure and the second power after the cross-space cascading failure; according to the first power and the second power, calculate the primary side of the power system caused by the cross-space cascading failure corresponding to the attack path Power loss factor; calculate the criticality factor value of the cross-space cascading failure according to the total between value and the power loss factor of the primary side of the power system; sort the criticality factor value, and according to the sorting result, the cross-space cascading failure corresponding to the attack path The degree of hazard is assessed. By implementing the cross-space cascading failure assessment method of the present application, it is possible to clarify the harm caused by multiple types of cross-space cascading failures caused by information threats to the power system and give the criticality ranking, so as to achieve an accurate and comprehensive assessment of multiple types of cross-space cascading failures Therefore, the information and physical nodes that need to be protected in the cyber-physical system of the power grid can be accurately located, and the security and operational stability of the cyber-physical system of the power grid can be guaranteed.

As an optional implementation manner of the present application, before step S13, the method further includes:

First, collect historical operating data, and determine the first probability of a corresponding failure for each type of power system secondary side equipment based on the historical operating data.

Exemplarily, the historical operation data is the normal operation data or failure data of the information physical system of the power grid. The number of failures of each type of power system secondary side equipment in the historical operation data is counted, and the number of failures of each type of power system secondary side equipment is calculated. The number of historical operating data and the total number of historical operating data are used to obtain the first probability of a corresponding failure of the secondary side equipment of each power system. For example, the first probability of failure A of equipment 1 on the secondary side of the power system is:

Secondly, determine the second probability that a cascading fault across the space will cause a disturbance on the primary side of the power system after the secondary side equipment of the power system fails.

Exemplarily, the number of historical operation data of the primary side disturbance of the power system caused by the failure of the secondary side equipment of the power system is obtained from the collected historical operation data, and the number of historical operation data of the primary side of the power system caused by the failure of the secondary side equipment of the power system is obtained. The number of historical operating data of side disturbance and the total number of historical operating data to obtain the second probability. For example, the probability of a disturbance B on the primary side of the power system after a fault A occurs in the secondary side equipment 1 of the power system is:

Thirdly, according to the first probability and the second probability, determine the conditional probability of each type of cross-space cascading fault that triggers the primary side disturbance of the power system when the secondary side equipment of the power system fails.

Exemplarily, according to the first probability and the second probability, a conditional probability formula can be used to determine the conditional probability of each type of cross-space cascading fault that triggers a disturbance on the primary side of the power system when the secondary side equipment of the power system fails. For example, under the condition that the equipment 1 on the secondary side of the power system has a fault A, the conditional probability of the disturbance B on the primary side of the power system is:

Example 2

This embodiment provides an assessment device for cross-space cascading failures, which can be applied to a power grid cyber-physical system, as shown in Figure 4, including:

The construction module 21 is set to construct a cross-space cascading failure attack graph, and the cross-space cascading failure attack graph includes multiple attack paths. Please refer to the relevant description of step S11 in any of the foregoing method embodiments, which will not be repeated here.

The first calculation module 22 is configured to calculate the total betweenness value of each attack path of the cross-space cascading failure attack graph. Please refer to the relevant description of step S12 in any of the foregoing method embodiments, which will not be repeated here.

The obtaining module 23 is configured to obtain the first power before the cross-space cascading failure and the second power after the cross-space cascading failure. Please refer to the related description of step S13 in any of the foregoing method embodiments, which will not be repeated here.

The second calculation module 24 is configured to calculate the primary-side power loss factor of the power system caused by the cross-space cascading fault corresponding to the attack path according to the first power and the second power. Please refer to the relevant description of step S14 in any of the foregoing method embodiments, which will not be repeated here.

The third calculation module 25 is configured to calculate the criticality factor value of the cross-space cascading fault based on the total dielectric value and the power loss factor of the primary side of the power system. Please refer to the relevant description of step S15 in any of the foregoing method embodiments, which will not be repeated here.

The evaluation module 26 is configured to sort the criticality factor values, and according to the sorting result, evaluate the damage degree of the cross-space cascading failure corresponding to the attack path. Please refer to the relevant description of step S16 in any of the foregoing method embodiments, which will not be repeated here.

The cross-space cascading failure assessment device provided in this embodiment constructs a cross-space cascading failure attack graph through building modules. The cross-space cascading failure attack graph includes multiple attack paths; the first calculation module calculates each of the cross-space cascading failure attack graphs. The total between-values of the attack paths; the acquisition module acquires the first power before the cross-space cascading failure and the second power after the cross-space cascading failure; the second calculation module can calculate based on the first power and the second power The power loss factor of the primary side of the power system caused by the cross-space cascading failure corresponding to the attack path; the third calculation module can calculate the criticality factor value of the cross-space cascading failure based on the total dielectric value and the primary power loss factor of the power system; evaluation module Then the criticality factor values are sorted, and the damage degree of the cross-space cascading failure corresponding to the attack path is evaluated according to the sorting result. This cross-space cascading failure assessment device can clarify the harm caused by multiple types of cross-space cascading failures caused by information threats to the power system and give a criticality ranking, so as to accurately and comprehensively evaluate the harm degree of multiple types of cross-space cascading failures. In this way, the information and physical nodes that need to be protected in the cyber-physical system of the power grid are accurately located, and the security and operational stability of the cyber-physical system of the power grid are guaranteed.

As an optional implementation manner of this application, the building module 21 includes:

The first determining sub-module is set to determine the information threat node of the cross-space cascading failure attack graph, the secondary side equipment failure node of the power system, and the primary side disturbance node of the power system. Please refer to the relevant description of step S11 in any of the foregoing method embodiments, which will not be repeated here.

The path formation sub-module is set to form an attack path based on the information threat node, the power system secondary side equipment failure node and the power system primary side disturbance node, and the attack path starts from the information threat node and passes through the power system secondary side equipment failure node. It ends at the primary side disturbance node of the power system. Please refer to the relevant description of step S11 in any of the foregoing method embodiments, which will not be repeated here.

The attack graph formation sub-module is set to form a cross-space cascading failure attack graph according to the attack path. Please refer to the relevant description of step S11 in any of the foregoing method embodiments, which will not be repeated here.

As an optional implementation manner of this application, the first calculation module 22 includes:

The first calculation sub-module is set to calculate the node betweenness value of each attack path. Please refer to the relevant description of step S12 in any of the foregoing method embodiments, which will not be repeated here.

Determine the sub-module and set it to multiply the node betweenness value to obtain the total betweenness value corresponding to each attack path of the cross-space cascading failure attack graph. Please refer to the relevant description of step S12 in any of the foregoing method embodiments, which will not be repeated here.

As an optional implementation manner of this application, before the obtaining module 23, it includes:

The collection sub-module is set to collect historical operating data, and determine the first probability of a corresponding failure of the secondary side equipment of each power system based on the historical operating data. Please refer to the related description of step S13 in any of the foregoing method embodiments, which will not be repeated here.

The second determining sub-module is configured to determine the second probability of a cascading fault across the space causing a disturbance on the primary side of the power system after the secondary side equipment of the power system fails. Please refer to the related description of step S13 in any of the foregoing method embodiments, which will not be repeated here.

The third determining sub-module is configured to determine the conditional probability of each type of cross-space cascading fault that triggers a disturbance on the primary side of the power system when the secondary side equipment of the power system fails according to the first probability and the second probability. Please refer to the related description of step S13 in any of the foregoing method embodiments, which will not be repeated here.

As an optional implementation manner of this application, the second calculation module 24 includes:

The second calculation sub-module is configured to calculate the power loss ratio according to the first power and the second power. Please refer to the relevant description of step S14 in any of the foregoing method embodiments, which will not be repeated here.

The first multiplication sub-module is configured to multiply the conditional probability and the power loss ratio to obtain the primary power loss factor of the power system caused by the cross-space cascading failure corresponding to the attack path. Please refer to the relevant description of step S14 in any of the foregoing method embodiments, which will not be repeated here.

As an optional implementation manner of this application, the third calculation module 25 includes:

The second multiplication sub-module is set to multiply the total dielectric value and the primary power loss factor of the power system to obtain the criticality factor value of the cross-space cascading failure. Please refer to the relevant description of step S15 in any of the foregoing method embodiments, which will not be repeated here.

Example 3

The embodiment of the present application also provides a computer device. As shown in FIG. 5, the device includes a processor 31 and a memory 32, where the processor 31 and the memory 32 can be connected by a bus or in other ways. Connect as an example.

The processor 31 may be a central processing unit (Central Processing Unit, CPU). The processor 31 may also be other general-purpose processors, digital signal processors (Digital Signal Processor, DSP), graphics processing units (Graphics Processing Unit, GPU), embedded neural network processors (Neural-network Processing Unit, NPU), or Other dedicated deep learning coprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (Field-Programmable Gate Arrays, FPGAs) or other programmable logic devices, discrete gates or transistor logic devices, discrete Chips such as hardware components, or a combination of the above-mentioned multiple types of chips.

As a non-transitory computer-readable storage medium, the memory 32 can be configured to store non-transient software programs, non-transient computer executable programs, and modules, as corresponding to the cross-space cascading failure assessment method in the embodiment of the present application Program instructions/modules (for example, the building module 21, the first calculation module 22, the acquisition module 23, the second calculation module 24, the third calculation module 25, and the evaluation module 26 shown in FIG. 4). The processor 31 executes multiple functional applications and data processing of the processor by running non-transient software programs, instructions, and modules stored in the memory 32, that is, realizes the cross-space cascading failure assessment method in the above method embodiment.

The memory 32 may include a program storage area and a data storage area. The program storage area may store an operating system and an application program required by at least one function; the data storage area may store data created by the processor 31 and the like. In addition, the memory 32 may include a high-speed random access memory, and may also include a non-transitory memory, such as at least one magnetic disk storage device, a flash memory device, or other non-transitory solid-state storage devices. In some embodiments, the memory 32 may optionally include memories remotely provided with respect to the processor 31, and these remote memories may be connected to the processor 31 through a network. Examples of the aforementioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

The one or more modules are stored in the memory 32, and when executed by the processor 31, the method for evaluating cross-space cascading failures in the method embodiment of the present application is executed.

By constructing a cross-space cascading failure attack graph, the cross-space cascading failure attack graph includes multiple attack paths; calculating the total betweenness value of each attack path in the cross-space cascading failure attack graph; obtaining the first power before the cross-space cascading failure occurs, and The second power after a cross-space cascading fault occurs; according to the first power and the second power, calculate the power loss factor of the primary side of the power system caused by the cross-space cascading fault corresponding to the attack path; according to the total dielectric value and the primary side of the power system The power loss factor is calculated to obtain the criticality factor value of the cross-space cascading failure; the criticality factor value is sorted, and the damage degree of the cross-space cascading failure corresponding to the attack path is evaluated according to the sorting result. By implementing the cross-space cascading failure assessment method of the present application, it is possible to clarify the harm caused by multiple types of cross-space cascading failures caused by information threats to the power system and give the criticality ranking, so as to achieve an accurate and comprehensive assessment of multiple types of cross-space cascading failures Therefore, the information and physical nodes that need to be protected in the cyber-physical system of the power grid can be accurately located, and the security and operational stability of the cyber-physical system of the power grid can be guaranteed.

The details of the above-mentioned computer equipment can be understood according to the corresponding related descriptions and effects in the method embodiments of the present application, and will not be repeated here.

The embodiment of the present application also provides a non-transitory computer storage medium, the computer storage medium stores computer-executable instructions, and the computer-executable instructions can execute the cross-space cascading failure assessment method in any of the foregoing method embodiments. Wherein, the storage medium can be a magnetic disk, an optical disc, a read-only memory (Read-Only Memory, ROM), a random access memory (RAM), a flash memory (Flash Memory), a hard disk (Hard Disk Drive (HDD) or Solid-State Drive (SSD), etc.; the storage medium may also include a combination of the foregoing types of memories.

Claims (10)

1. A method for assessing cascading failures across spaces, including:

   Constructing a cross-space cascading failure attack diagram of the power grid cyber-physical system, wherein the cross-space cascading failure attack diagram includes multiple attack paths;

   Calculating the total betweenness value of each attack path of the cross-space cascading failure attack graph;

   Acquiring the first power of the physical side of the power grid cyber-physical system before the occurrence of a cross-space cascading fault and the second power of the physical side of the power grid cyber-physical system after the occurrence of the cross-space cascading fault;

   According to the first power and the second power, calculate the primary-side power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path;

   According to the total between value of each attack path and the primary power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path, the criticality factor value of each attack path is calculated;

   The multiple criticality factor values corresponding to the multiple attack paths are sorted, and the damage degree of the cross-space cascading failure corresponding to each attack path is evaluated according to the sorting result.
2. The method according to claim 1, wherein said constructing a cross-space cascading failure attack diagram of a power grid cyber-physical system, wherein the cross-space cascading failure attack diagram includes multiple attack paths, including:

   Determining the information threat node, the secondary-side equipment failure node of the power system, and the primary-side disturbance node of the power system of the cross-space cascading failure attack graph;

   According to the information threat node, the power system secondary side equipment failure node, and the power system primary side disturbance node, an attack path is formed, wherein the attack path starts from the information threat node through the The fault node of the secondary side equipment of the power system ends at the primary side disturbance node of the power system;

   The cross-space cascading failure attack graph is formed according to the formed multiple attack paths.
3. The method according to claim 2, wherein the calculating the total betweenness value of each attack path of the cross-space cascading failure attack graph comprises:

   Calculate the intermediate value of multiple nodes of each attack path;

   Multiply the betweenness values of the multiple nodes to obtain the total betweenness value of each attack path.
4. The method according to claim 2, in the acquiring the first power of the physical side of the power grid cyber-physical system before the occurrence of a cross-space cascading failure and the power grid cyber-physical system after the occurrence of the cross-space cascading failure Before the second power on the physical side, it also includes:

   Collect historical operating data, and determine the first probability of a corresponding failure of each of the multiple types of power system secondary side equipment of the power system secondary side equipment according to the historical operating data;

   Determining the second probability of the primary side disturbance of the power system caused by the cross-space cascading fault corresponding to the attack path of the corresponding faulty node after the corresponding fault occurs in the secondary side equipment of the power system;

   According to the first probability and the second probability, it is determined that when the corresponding fault occurs in the secondary side equipment of the power system, the cross-space cascading fault corresponding to the attack path triggers the power system once Conditional probability of side disturbance.
5. The method according to claim 4, wherein the calculating the primary-side power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path according to the first power and the second power comprises:

   Calculating a power loss ratio according to the first power and the second power;

   The conditional probability of the cross-space cascading failure corresponding to each attack path is multiplied by the power loss ratio to obtain the primary-side power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path.
6. The method according to claim 1, wherein said calculating the primary-side power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path and the total between-value of each attack path The value of the criticality factor for each attack path, including:

   The total between value of each attack path and the primary power loss factor of the power system caused by the cross-space cascading failure corresponding to each attack path are multiplied to obtain the criticality factor value of each attack path.
7. The method according to claim 2, wherein the information threat node includes: a denial of service attack node, a direct utilization attack node, and an information equipment reliability failure node;

   The secondary-side equipment failure nodes of the power system include: control signal device misoperation, refusal, and outage nodes, measurement device measurement result deviation nodes, and protection device misoperation, refusal, and outage nodes.
8. A device for evaluating cascading failures across spaces, including:

   The construction module is configured to construct a cross-space cascading failure attack graph of the power grid cyber-physical system, wherein the cross-space cascading failure attack graph includes multiple attack paths;

   The first calculation module is configured to calculate the total betweenness value of each attack path of the cross-space cascading failure attack graph;

   An obtaining module configured to obtain the first power of the physical side of the power grid cyber-physical system before the occurrence of a cross-space cascading fault and the second power of the physical side of the power grid cyber-physical system after the occurrence of the cross-space cascading fault;

   The second calculation module is configured to calculate the primary-side power loss factor of the power system caused by the cross-space cascading fault corresponding to each attack path according to the first power and the second power;

   The third calculation module is set to calculate the harmfulness of each attack path based on the total between value of each attack path and the power loss factor of the primary side of the power system caused by the cross-space cascading failure corresponding to each attack path Factor value

   The evaluation module is configured to sort the multiple criticality factor values corresponding to the multiple attack paths, and evaluate the damage degree of the cross-space cascading failure corresponding to each attack path according to the sorting result.
9. A computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected with each other, the memory is stored with computer instructions, and the processor executes the claims by executing the computer instructions The method for evaluating cross-space cascading failures described in any one of 1-7.
10. A computer-readable storage medium storing computer instructions for causing the computer to execute the method for evaluating cross-space cascading failures according to any one of claims 1-7.

Images