WO2022262780A1 - 一种自适应的广义累计和gps欺骗攻击检测方法 - Google Patents

一种自适应的广义累计和gps欺骗攻击检测方法 Download PDF

Info

Publication number
WO2022262780A1
WO2022262780A1 PCT/CN2022/098980 CN2022098980W WO2022262780A1 WO 2022262780 A1 WO2022262780 A1 WO 2022262780A1 CN 2022098980 W CN2022098980 W CN 2022098980W WO 2022262780 A1 WO2022262780 A1 WO 2022262780A1
Authority
WO
WIPO (PCT)
Prior art keywords
time
attack
measurement
gps spoofing
covariance matrix
Prior art date
Application number
PCT/CN2022/098980
Other languages
English (en)
French (fr)
Inventor
夏卓群
邹子威
尹波
廖曙光
邢利
文琴
Original Assignee
长沙理工大学
长沙麦融高科股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 长沙理工大学, 长沙麦融高科股份有限公司 filed Critical 长沙理工大学
Publication of WO2022262780A1 publication Critical patent/WO2022262780A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G01—MEASURING; TESTING
    • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
    • G01S19/00—Satellite radio beacon positioning systems; Determining position, velocity or attitude using signals transmitted by such systems
    • G01S19/01—Satellite radio beacon positioning systems transmitting time-stamped messages, e.g. GPS [Global Positioning System], GLONASS [Global Orbiting Navigation Satellite System] or GALILEO
    • G01S19/13—Receivers
    • G01S19/21—Interference related issues ; Issues related to cross-correlation, spoofing or other methods of denial of service
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/16—Matrix or vector computation, e.g. matrix-matrix or matrix-vector multiplication, matrix factorization
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F17/00—Digital computing or data processing equipment or methods, specially adapted for specific functions
    • G06F17/10—Complex mathematical operations
    • G06F17/18—Complex mathematical operations for evaluating statistical data, e.g. average values, frequency distributions, probability functions, regression analysis
    • H—ELECTRICITY
    • H03—ELECTRONIC CIRCUITRY
    • H03H—IMPEDANCE NETWORKS, e.g. RESONANT CIRCUITS; RESONATORS
    • H03H17/00—Networks using digital techniques
    • H03H17/02—Frequency selective networks
    • H03H17/0248—Filters characterised by a particular frequency response or filtering method
    • H03H17/0255—Filters based on statistics
    • H03H17/0257—KALMAN filters
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Definitions

  • the invention relates to the technical field of grid detection, in particular to a GPS deception attack detection method.
  • WAMS Wide Area Monitoring System
  • SCADA supervisory control and data acquisition
  • PMU phasor measurement unit
  • SCADA supervisory control and data acquisition
  • PMUs are widely used in smart grids due to their precise acquisition frequency and precise synchronization time.
  • the PMU can measure the voltage and current of each node in the power system, and attach a time stamp to provide accurate timing information.
  • the PMU usually uses the Global Positioning System (GPS) to provide time synchronization.
  • GPS Global Positioning System
  • the GPS receiver of the PMU receives GPS signals from different satellites in a radio frequency (RF) manner. These signals contain unencrypted C/A codes (mainly for civilian use, such as PMU receivers), and encrypted P(Y) codes (mainly for military purposes).
  • RF radio frequency
  • GPS spoofing jamming refers to the navigation and time synchronization process of the signal receiver that interferes with the generation of false GPS signals. Spoofers can send some interference through low-cost or portable devices, causing the receiving device to lose track of the real signal.
  • the cheater will send a fake GPS signal, and since the characteristics of the fake signal and the real signal are consistent, the signal receiving device will be deceived by the fake signal.
  • GPS spoofing attack is one of the biggest risks facing infinite information security.
  • the North American Electric Reliability Corporation announced that spoofing the GPS signal of the PMU signal receiving device will destroy the normal operation of the PMU.
  • the timing error obviously exceeds the specified standard, it may induce a tripping accident of the generator.
  • the grid is interconnected, failure in one area is likely to cause failure in other areas. Therefore, detecting GSA in the smart grid is very important to ensure the normal operation of the power system.
  • the Global Positioning System provides an accurate and synchronized time reference for the PMUs in the power system to measure voltage and current.
  • the GSA includes two types, namely mutation attack and slow persistent attack.
  • mutation-type GSA means that when the PMU is attacked by a mutation-type attack, the phase angle and phase shift of the signal will suddenly increase from 0 to a certain fixed value. During the attack, the value basically does not change until the end of the attack , the phase angle and phase shift of the signal changes back to 0.
  • slow-sustained GSA means that when the PMU is attacked by the slow-sustained type, the phase angle and phase shift of the signal will increase or decrease linearly with time until the attack ends, and the phase angle and phase shift of the signal will change again. back to 0.
  • the first direction is the detection and research of GPS signals and receiving equipment at the level of physical equipment.
  • the second type of direction is to analyze the measurement data in the power system at the data level.
  • the first type of direction mainly detects GSA by analyzing the GPS carrier-to-noise ratio, the number of visible satellites, and the observed signal statistics. These methods all need to improve the existing GPS receiving equipment to a certain extent and increase the hardware cost in order to realize the effective detection of GSA.
  • the second type of direction is to regard GSA as a kind of false injection attack in the power system.
  • This type of direction can be divided into four research methods:
  • the first method uses the relationship between the electric quantities at both ends of the transmission line model to detect GSA, such as a density-based spatial clustering method for online detection, classification, and data recovery operations of PMU measurements.
  • GSA such as a density-based spatial clustering method for online detection, classification, and data recovery operations of PMU measurements.
  • this type of attack cannot be automatically classified.
  • Literature [2] (Xue A, Xu F, Xu J, et al.Online pattern recognition and data correction of PMU data under GPS spoofing attack[J].Journal of Modern Power Systems and Clean Energy,2020,8(6): 1240-1249.)
  • a new GSA pattern recognition method is proposed, which uses a sliding window to collect PMU measurement data, and analyzes the mean, variance and linear relationship of the collected data to subdivide the attack pattern of GSA.
  • the sliding window used in this document is a fixed sliding window, and the size of the window cannot be adjusted in time according to the attack situation.
  • the second method utilizes multi-terminal PMU data in the system to mine the similarity between normal PMU data to detect GSA.
  • the third method is to perform GSA detection at the power system level.
  • This approach generally uses state estimation or system modeling to detect GSA.
  • the power system is regarded as a static system, that is, the dynamic behavior of the power system is ignored to perform GSA detection on the PMU measurement data, so the detection accuracy is not high.
  • Document [1] (S.Siamak, M.Dehghani and M.Mohammadi,”Dynamic GPS Spoofing Attack Detection,Localization,and Measurement Correction Exploiting PMU and SCADA,”in IEEE Systems Journal, doi:10.1109/JSYST.2020.3001016) proposed An anti-GSA mechanism that utilizes PMU and SCADA measurements and then uses dynamic filters to estimate the phase shift induced by spoofing attacks.
  • the fourth method uses machine learning to process the measurement data. This method trains the data to obtain a classification model for GSA detection.
  • the current research mainly has the following problems: 1.
  • the filter used is the traditional Kalman filter, which cannot obtain more accurate estimation accuracy and ensure the accuracy of the estimated state; 2.
  • the detection of slow and persistent GSA is not considered , this kind of attack mode with a smaller attack range is often more concealed, and it is difficult to detect it when the attack range does not exceed the threshold, and it has already caused a certain impact on the normal measurement of the system; Attack patterns are classified and identified.
  • the technical problem to be solved by the present invention is to provide a method that can quickly, accurately and effectively detect GPS spoofing attacks (GSA) and divide GPS spoofing attacks (GSA) on the basis of not transforming the hardware of GPS receiving equipment in the existing power system type of method.
  • the present invention provides a kind of self-adaptive generalized accumulation and GPS spoofing attack detection method, comprising the following steps:
  • step S6 if the cumulative statistic ⁇ t is equal to 0, it is determined that the system has not been attacked by GPS spoofing, which is a normal situation, and the width w of the sliding window is reduced according to a certain weight and returns to step S2, otherwise, the next step is performed;
  • step S7 if the cumulative statistic ⁇ t is greater than the preset threshold Thr, it is determined that the system has suffered a GPS spoofing attack, increase the width w of the sliding window according to a certain weight and return to step S2, otherwise execute the next step;
  • step S8 if all the measurement data of the phasor measurement units PMU have been detected, then end, otherwise, the measurement time t is incremented by 1 and returns to step S2.
  • step S7 if the cumulative statistic ⁇ t described in step S7 is greater than the preset threshold Thr, it is determined that the system has suffered a GPS spoofing attack, and increasing the width w of the sliding window according to a certain weight also includes the following steps:
  • step S71 if the cumulative statistic ⁇ t-1 at time t-1 is not greater than 0, then it is determined that the system is subjected to a mutation-type GPS spoofing attack, increase the width w of the sliding window according to a certain weight and return to step S2, otherwise execute the next step;
  • step S73 if the absolute value of the correlation coefficient r(t, ⁇ ) is greater than the preset threshold, it is determined that the system is suffering from a slow and persistent GPS spoofing attack, and the width w of the sliding window is increased according to a certain weight and returns to step S2, otherwise, the next step is performed;
  • step S74 determine that the system has suffered other types of GPS spoofing attacks, increase the width w of the sliding window according to a certain weight, and return to step S2.
  • the preset threshold in step S73 is 0.8.
  • step S7 the step of increasing the width w of the sliding window according to a certain weight as described in step S7 is as follows: Increase the width of the sliding window to w 1 , where K is the total number of measurement data, and ⁇ 1 is a constant between 0 and 1.
  • step S6 the step of reducing the width w of the sliding window according to a certain weight as described in step S6 is as follows: Reduce the width of the sliding window to w 2 , where K is the total number of measurement data, and ⁇ 2 is a constant between 0 and 1.
  • step S3 Furthermore, the state vector at the time of prediction t in step S3 and the error covariance matrix The steps are:
  • S31 according to Predict the state vector at time t in is the predicted value of the state vector at time t under normal conditions, is the predicted value of the state vector at time t under the condition of GPS spoofing attack, Measure the update value for the state vector t-1 under normal circumstances, is the state vector t-1 time measurement update value under the condition of GPS spoofing attack, A is the state transition matrix;
  • A is the state transition matrix
  • a T is the transposition of the state transition matrix A
  • Q t-1 is the process noise covariance matrix at time t-1.
  • step S4 the generalized logarithmic likelihood ratio is used to calculate the ratio ⁇ t of the attack probability to the non-attack probability at the current moment, and the steps for updating the cumulative statistic ⁇ t are:
  • step S5 error covariance matrix
  • G t P t - B T (BP t - B T +R t ) -1 , where P t - is the predicted value of the error covariance matrix at time t, and B is the measurement matrix, B T is the transpose of measurement matrix B, R t is the process noise covariance matrix at time t;
  • S52 according to update state vector in is the state vector t under normal circumstances to measure the update value at time t, is the updated value measured at time t of the state vector under GPS spoofing attack, is the predicted value of the state vector at time t, is the predicted value of the state vector at time t under normal conditions, is the predicted value of the state vector at time t under GPS spoofing attack, z m,t is the measurement data at time t, B is the measurement matrix, Attack vectors created for the attacker;
  • the weight ⁇ of the distribution estimated value and the value at the previous time in step S54 and step S55 is a constant between 0 and 1.
  • the width of the sliding window is one of the important factors, and a fixed window is not suitable for complex and variable data streams.
  • the method disclosed in the present invention uses an adaptive sliding window to collect PMU measurement data. When it is detected that the PMU is attacked, the width of the sliding window is increased according to a certain weight; when the attack is detected to stop, the width of the sliding window is reduced according to a certain weight. .
  • the adaptive sliding window can automatically adjust the width of the most suitable sliding window according to different situations, and can detect all PMU measurement data attacked by GPS spoofing faster, thereby repairing the corresponding damaged data and effectively reducing
  • the running time of the algorithm ensures the normal operation of the power system.
  • the method disclosed in the present invention uses the improved Kalman filter to calculate the state estimation value of the measurement data.
  • the covariance matrices Q t and R t of the process noise w t and the measurement noise v t have an important impact on the performance of dynamic state estimation. Failure to choose the appropriate Qt and Rt will significantly reduce the performance of the Kalman filter , and even cause the filter to diverge.
  • the Q t and R t values are generally set as constants, and then adjusted continuously according to the experimental results during the experiment. This method obviously takes up a lot of computing time and resource consumption. And the best filtering performance cannot be obtained.
  • the method disclosed in the present invention uses the generalized logarithm likelihood ratio to calculate the probability of suffering from GSA, and uses the generalized cumulative sum algorithm (CUSUM algorithm) to accumulate the probability.
  • CCSUM algorithm generalized cumulative sum algorithm
  • the cumulative statistic exceeds a predetermined threshold, the system is considered to have suffered from GSA.
  • the attack type judge the value of the cumulative statistic ⁇ t- 1 at time t-1, if the value of ⁇ t-1 is equal to 0, it indicates that no attack occurred before time t, the attack occurred at time t and The attack range is very large, and the attack type of GSA is mutant GSA. If the value of ⁇ t-1 is greater than 0, it indicates that there is an attack before time t-1, but the attack range is relatively small.
  • the slow sustained GSA usually adopts a linear method to increase the attack range.
  • the correlation coefficient is used to further identify the GSA type, and whether the attack is slow persistent attack is judged by calculating the linear relationship between time t and phase angle ⁇ in a sliding window.
  • the invention also discloses a method for detecting the GSA attack type, which is more conducive to the system to make a corresponding attack defense strategy.
  • Figure 1 is a schematic diagram of mutant GSA.
  • Figure 2 is a schematic diagram of slow-sustained GSA.
  • Fig. 3 is a flowchart of an embodiment of the present invention.
  • Fig. 4 is a structural diagram of the IEEE-39 bus system used in the simulation experiment of an embodiment of the present invention.
  • FIG. 5 is a schematic diagram of an impact of a mutant GSA on a PMU in a simulation experiment simulating a mutant attack scenario according to an embodiment of the present invention.
  • FIG. 6 is a simulation experiment result of using an embodiment of the present invention to detect a mutant GSA in a simulation experiment simulating a mutant attack scenario according to an embodiment of the present invention.
  • FIG. 7 shows the change of the sliding window of detecting the mutant GSA using the embodiment of the present invention in a simulation experiment simulating a mutant attack scenario according to an embodiment of the present invention.
  • FIG. 8 is a schematic diagram of the influence of the slow and persistent GSA on the PMU in a simulation experiment simulating a slow and persistent attack scenario according to an embodiment of the present invention.
  • FIG. 9 is a simulation experiment result of using the embodiment of the present invention to detect slow persistent GSA in a simulation experiment simulating a slow persistent attack scenario according to an embodiment of the present invention.
  • Fig. 10 is a simulation experiment of an embodiment of the present invention to simulate the slow and persistent attack scene using the embodiment of the present invention to detect the sliding window changes of the slow and persistent GSA.
  • Fig. 11 is a schematic diagram of the impact of the slow persistent GSA on the PMU in a simulation experiment simulating a hybrid attack scenario according to an embodiment of the present invention.
  • FIG. 12 is a simulation experiment result of using the embodiment of the present invention to detect a hybrid GSA in a simulation experiment simulating a hybrid attack scenario according to an embodiment of the present invention.
  • Fig. 13 is a simulation experiment of an embodiment of the present invention to simulate a hybrid attack scenario using the embodiment of the present invention to detect changes in the sliding window of the hybrid GSA.
  • the power system is composed of M+1 buses, in which N PMUs are installed.
  • the state estimation value x M,t represents the phase angle of the Mth bus.
  • A is the state transition matrix
  • B is the measurement matrix
  • ⁇ t and vt are independent additive white Gaussian random processes, where I M is an M ⁇ M unit matrix, and I N is an N ⁇ N unit matrix.
  • the covariance matrix Q t of ⁇ t is The covariance matrix R t of v t is Among them, E(*) is the mathematical expectation value.
  • a kind of self-adaptive generalized accumulation and GPS spoofing attack detection method comprises the following steps:
  • S31 according to Predict the state vector at time t in is the predicted value of the state vector at time t under normal conditions, is the predicted value of the state vector at time t under the condition of GPS spoofing attack, Measure the update value for the state vector t-1 under normal circumstances, is the state vector t-1 time measurement update value under the condition of GPS spoofing attack, A is the state transition matrix;
  • the error covariance matrix P t + , the measurement noise covariance matrix R t and the process noise covariance matrix Q t include the following steps:
  • G t P t - B T (BP t - B T +R t ) -1 , where P t - is the predicted value of the error covariance matrix at time t, and B is the measurement matrix, B T is the transpose of measurement matrix B, R t is the process noise covariance matrix at time t;
  • S52 according to update state vector in is the state vector t under normal circumstances to measure the update value at time t, is the updated value measured at time t of the state vector under GPS spoofing attack, is the predicted value of the state vector at time t, is the predicted value of the state vector at time t under normal conditions, is the predicted value of the state vector at time t under GPS spoofing attack, z m,t is the measurement data at time t, B is the measurement matrix, Attack vectors created for the attacker;
  • step S54 and step S55 the weight ⁇ of the distribution estimated value and the value at the previous moment is a constant between 0 and 1.
  • step S7 if the cumulative statistic ⁇ t is greater than the preset threshold Thr, it is determined that the system suffers from GPS spoofing attacks, and further determines the type of GPS spoofing attacks on the system, according to Increase the width of the sliding window to w 1 , where K is the total number of measurement data, and ⁇ 1 is a constant between 0 and 1, and return to step S2, otherwise execute the next step.
  • the steps for further determining the type of GPS spoofing attack on the system are as follows:
  • step S71 If the cumulative statistic ⁇ t-1 at time t-1 is not greater than 0, then it is determined that the system is subjected to a mutation-type GPS spoofing attack, according to Increase the width of the sliding window to w 1 and return to step S2, otherwise perform the next step;
  • step S73 if the absolute value of the correlation coefficient r(t, ⁇ ) is greater than the preset threshold, it is determined that the system has suffered a slow and persistent GPS spoofing attack, according to Increase the width of the sliding window to w 1 and return to step S2, otherwise perform the next step;
  • step S74 determine that the system suffers from other types of GPS spoofing attacks, according to Increase the width of the sliding window to w 1 and return to step S2.
  • the preset threshold value in step S73 is 0.8.
  • step S8 if all the measurement data of the phasor measurement units PMU have been detected, then end, otherwise, the measurement time t is incremented by 1 and returns to step S2.
  • the IEEE-39 bus system shown in Figure 4 which consists of a New England 10-machine system, 10 generators, 39 buses and 46 transmission lines.
  • the IEEE-39 system based on PowerWorld simulation software can provide real-time and accurate measurement information, thereby simulating the process of PMU collecting power system data. Then import the obtained data into MATLABR2017a to evaluate the performance of the detection method disclosed in this embodiment.
  • the parameters used in the experiment are set as follows, where f represents the system frequency, the default is 50HZ; ⁇ t is the process noise, set to 1 ⁇ 10 -4 ; v t is the measurement noise, set to 2 ⁇ 10 -4 , t is the PMU data sampling time interval, which is set to 0.02s; the judgment threshold Thr is obtained according to the IEEE C37.118 standard, which stipulates that the synchronization error is limited to 1%, and the corresponding phase angle error is 0.5730 (degrees). In the simulation experiment of this embodiment, the judgment threshold Thr is taken as 0.57302T, and the weight ⁇ of the assigned estimated value and the value at the previous moment is an adaptive constant.
  • the simulation experiment of this embodiment evaluates the performance of the proposed algorithm by analyzing the time consumption of each algorithm in a single attack and multiple attacks and estimating the relative error accuracy.
  • literature [1] proposes an anti-GSA mechanism, which uses PMU and SCADA system to measure the phase shift caused by spoofing attacks by using PMU and SCADA system to detect GSA.
  • Literature [4] (Risbud P, Gatsis N, Taha A. Vulnerability analysis of smart grids to GPS spoofing [J]. IEEE Transactions on Smart Grid, 2018, 10(4): 3535-3548.) proposed a method using alternate Minimization algorithm to detect multiple GSAs.
  • Literature [5] (X.Fan, L.Du and D.Duan, "Synchrophasor Data Correction Under GPS Spoofing Attack: A State Estimation Based Approach," 2018 IEEE/PES Transmission and Distribution Conference and Exposition (T&D), Denver, CO ,2018,pp.1-9,doi:10.1109/TDC.2018.8440488.) proposed a deceptive matching algorithm, using the golden section search algorithm to find the angle of attack to detect GSA.
  • time consumption represents the time consumed by the detection algorithm to run in the detection of 100 data samples.
  • the estimated relative error is defined as in represents the estimated state value, and ⁇ represents the true value.
  • Table 1 and Table 2 show the comparison of the detection results of each detection algorithm when detecting a single GSA and multiple GSAs.
  • the scheme proposed in this example is compared with the static state estimation schemes in literature [4] and literature [5]. There is obviously less time consumption and a smaller estimation relative error.
  • the scheme proposed in this embodiment is close to its time consumption and state estimation relative error accuracy, and can The attack types are effectively classified, and various performance analyzes of the comprehensive algorithm are carried out.
  • the scheme of this embodiment can effectively classify the attack types of the GSA under the condition that the time consumption is small and the relative estimation error is small. Therefore, the scheme proposed in this embodiment is superior to other detection schemes.
  • the simulation experiment of this embodiment mainly analyzes three kinds of GSA attack scenarios, which are: sudden attack scenario, slow and persistent attack scenario and mixed attack scenario. By simulating the three attack modes, the impact on the PMU measurement data .
  • the detection method proposed in this embodiment is used to detect attacks in real time and classify attack modes, and also shows the change process of the adaptive sliding window under the three attack modes.
  • the GSA attack mode considered in this scenario is that the attacker suddenly injects an attack signal with a very strong signal amplitude, which interferes with the normal GPS signal reception, thereby attacking the process of PMU data collection, resulting in inaccurate measurement data.
  • the attacker carried out multiple mutation attacks on the PMU, causing its phase angle to change beyond the threshold specified by the system, which affected the normal operation of the system.
  • the attack mode considered in this scenario is that the attacker slowly injects and continuously strengthens the attack signal until the attack signal affects the normal GPS receiving signal.
  • This attack mode is different from the previous mutant attack mode.
  • the impact of the attack does not exceed the When the threshold is exceeded, it is difficult to detect such attacks.
  • the slow and persistent attack has already had a certain impact on the system.
  • Figure 8 shows the impact of the slow sustained GSA on the PMU. In the four time periods of 0.22 to 0.62 seconds, 1.16 to 1.54 seconds, 2.14 to 2.52 seconds, and 3.22 to 3.54 seconds, the power system has suffered from slow sustained The impact of the attack during this period of time cannot be detected in the previous research.
  • the detection effect of the detection scheme proposed in this embodiment is shown in Figure 9. With the increase of the attack range, the value of the cumulative statistic ⁇ t increases rapidly. This type of attack can be detected in real time shortly after the attack occurs.
  • Figure 10 shows how the adaptive sliding window width changes when the algorithm detects this type of attack.
  • This scenario takes into account that the attacker will not only use one mode of attack in actual attacks, but often a mixed attack of multiple attack modes.
  • the simulation experiment of this embodiment simulates an attack scenario in which mutation attacks and slow persistent attacks are performed alternately.
  • a mutation attack occurred, followed immediately by a slow sustained attack.
  • the attacker launched a total of 4 attacks, attacking the PMU with a mutation attack and a slow continuous attack respectively, affecting its data collection.
  • FIG. 12 the detection of hybrid attacks by the detection scheme proposed in this embodiment is shown.
  • the detection scheme can detect the attack in real time, and can determine the type of attack and submit it to the system for further processing.
  • Figure 13 shows how the adaptive sliding window changes as the attack is detected.
  • sequence adjustment, combination and deletion can be performed according to actual needs.

Landscapes

  • Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Mathematical Physics (AREA)
  • Data Mining & Analysis (AREA)
  • Computational Mathematics (AREA)
  • Theoretical Computer Science (AREA)
  • Mathematical Analysis (AREA)
  • Mathematical Optimization (AREA)
  • Pure & Applied Mathematics (AREA)
  • Software Systems (AREA)
  • Probability & Statistics with Applications (AREA)
  • Algebra (AREA)
  • General Engineering & Computer Science (AREA)
  • Databases & Information Systems (AREA)
  • Remote Sensing (AREA)
  • Radar, Positioning & Navigation (AREA)
  • Computing Systems (AREA)
  • Evolutionary Biology (AREA)
  • Operations Research (AREA)
  • Bioinformatics & Computational Biology (AREA)
  • Computer Hardware Design (AREA)
  • Bioinformatics & Cheminformatics (AREA)
  • Life Sciences & Earth Sciences (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Position Fixing By Use Of Radio Waves (AREA)

Abstract

一种自适应的广义累计和GPS欺骗攻击检测方法，包括以下步骤：初始化（S1）；使用自适应滑动窗口来收集相量测量单元PMU量测数据z m,t（S2）；进行改进卡尔曼滤波预测步骤（S3）；使用广义对数似然比求解比值γ t，更新累计统计量β t（S4）；进行改进卡尔曼滤波测量更新步骤（S5）；若累计统计量β t等于0，则判定系统未遭受GPS欺骗攻击（S6）；若累计统计量β t大于预设阈值Thr，则判定系统遭受GPS欺骗攻击（S7）。该GPS欺骗攻击检测方法根据不同的情况自动调整最适合的滑动窗口的宽度，能够更快地检测到所有受到GPS欺骗攻击的PMU量测数据，从而对相应受损数据进行修复，并且能有效减少算法的运行时间，确保电力系统的正常运行。该GPS欺骗攻击检测方法还提出了对GPS欺骗攻击类型进行检测的方法，更有利于系统做出对应的攻击防御策略。

Description

一种自适应的广义累计和GPS欺骗攻击检测方法 技术领域
本发明涉及电网检测技术领域，尤其涉及GPS欺骗攻击检测方法。
背景技术
广域检测系统(WAMS)对于捕获电网中的实时性能至关重要，而系统中最关键的实时数据就来源于电网中的数据采集装置：监控与数据采集(SCADA)系统以及相量测量单元(PMU)。与SCADA系统相比，PMU由于其精准的采集频率和精确的同步时间在智能电网中得到了广泛的应用，作为智能电网中最重要的数据来源之一，PMU被称为“电网之眼”。PMU可以测量电力系统中各个节点的电压和电流，并附上时间戳以提供精确的计时信息，为了确保PMU能精确的进行同步采样，PMU通常使用全球定位系统(GPS)来提供时间同步。PMU的GPS接收机以射频(radio frequency,RF)方式接收来自不同卫星的GPS信号。这些信号包含未加密的C/A码(主要用于民用，例如PMU接收机)，以及加密的P(Y)码(主要用于军事目的)。
由于民用GPS与其信号接收设备之间采用的是没有加密认证机制的明码进行通信。因此，熟悉GPS报文协议的攻击者能发送虚假的信号对接收设备进行欺骗。当GPS被欺骗时，其精确的时间同步也变得不可靠。GPS欺骗干扰是指通过产生虚假的GPS信号干扰信号接收机的导航和时间同步过程。欺骗者可以通过低成本或者便携式的设备发送某些干扰，导致信号接收设备失去对真实信号的追踪。当信号接收设备搜索信号时，欺骗者将发送伪造的GPS信号，由于伪造的信号和真实的信号之间的特征一致，因此信号接收设备将会被伪造信号欺骗。当信号接收设备被欺骗时，会使得PMU测量值的时间标签发生改变，从而导致由PMU提供的测量值发生变化。GPS欺骗攻击(GSA)是无限信息安全面临的最大风险之一，北美电力可靠性公司(NERC)宣布，对PMU信号接收设备的GPS信号进行欺骗会破坏PMU的正常运行。根据IEEEC37.118标准要求，若时序误差明显超过了规定标准则可能诱使发电机发生跳闸事故。并且，由于电网内部是相互连通的，一个区域发生故障很有可能导致其他区域也发生故障。因此，检测智能电网中的GSA对于保证电力系统正常运行来说至关重要。
全球定位系统(GPS)为电力系统中的PMU测量电压和电流提供精确和同步的时间参考，电力系统中的PMU会给每个信号都分配一个时间戳，用于同时间采样。如果攻击者成功攻 击了PMU的信号接收端时，接收端的时间就会受到攻击者改变，从t变成了t+t GSA，其中t GSA为受到GSA影响而改变的时间，因为时间发生了改变，导致被PMU测量的信号的相角发生了改变：θ atk＝θ+θ GSA，θ GSA＝2πft GSA，其中θ和θ atk分别为GSA前后被测信号的相角，t GSA为GSA引起的时间戳改变，θ GSA为GSA所引起的相移，f为电力系统中的频率。GSA包括两种类型，分别为突变型攻击和慢速持续型攻击。如图1所示，突变型GSA是指当PMU受到突变型攻击时，信号的相角相移会突然从0增加到某一固定值，在攻击期间，该值基本上不发生变化直到攻击结束，信号的相角相移又变回0。如图2所示，慢速持续型GSA是指当PMU受到慢速持续型攻击时，信号的相角相移会随着时间线性得增加或减少直到攻击结束，信号的相角相移又变回0。
目前对GSA检测领域的研究主要有两种方向，第一类方向是在物理设备层面上对GPS信号和接收设备的检测研究。第二类方向是在数据层面上对电力系统中的量测数据进行分析。
第一类方向主要通过分析GPS载波噪声比，可见卫星的数量以及观测到的信号统计信息来检测GSA。这类方法都需要对现有的GPS接收设备进行一定程度的改进，增加硬件成本，才能实现GSA的有效检测。
第二类方向是将GSA看作电力系统中的虚假注入攻击的一种，这一类方向可分为4种研究方法：
1、第一种方法利用传输线模型的两端电量之间的关系来检测GSA，例如一种基于密度的空间聚类方法，用于在线检测、分类和数据恢复PMU测量的操作。然而，这种类型的攻击不能自动分类。文献[2](Xue A,Xu F,Xu J,et al.Online pattern recognition and data correction of PMU data under GPS spoofing attack[J].Journal of Modern Power Systems and Clean Energy,2020,8(6):1240-1249.)提出了一种新的GSA模式识别方法，使用滑动窗口收集PMU量测数据，并对收集的数据进行均值和方差以及线性关系分析，将GSA的攻击模式进行细分。但是，该文献使用的滑动窗口为固定式的滑动窗口，不能根据攻击情况及时调整窗口大小。
2、第二种方法利用系统中的多终端PMU数据挖掘正常PMU数据之间的相似性，从而检测GSA。
3、第三种方法在电力系统的层面上进行GSA检测。这种方法一般使用状态估计或系统建模来检测GSA。例如，将电力系统视为静态的系统，也就是忽略电力系统的动态行为来对PMU量测数据进行GSA检测，因此检测的精度不高。文献[1](S.Siamak,M.Dehghani and M.Mohammadi,"Dynamic GPS Spoofing Attack Detection,Localization,and Measurement  Correction Exploiting PMU and SCADA,"in IEEE Systems Journal,doi:10.1109/JSYST.2020.3001016)提出了一种反GSA机制，利用PMU和监控与数据采集系统测量，再使用动态滤波器估计欺骗攻击引起的相移。并且给出了该检测方法中PMU与SCADA数据融合的结果，在检测到GSA后进行数据修正。文献[3](S.Siamak,M.Dehghani and M.Mohammadi,"Counteracting GPS Spoofing Attack on PMUs by Dynamic State Estimation,"2019 Smart Grid Conference(SGC),Tehran,Iran,2019,pp.1-5,doi:10.1109/SGC49328.2019.9056583.)提出了一种对抗GSA的动态估计器。该方法在线估计了多次GPS欺骗攻击造成的相位角差，并对欺骗测量值进行修正。这类方法一般需要对电力系统的系统配置有充足的了解，并且文献[1]和[3]中使用的卡尔曼滤波器都是最基础的卡尔曼滤波器，不能达到最优的滤波性能，最大程度减少噪声的影响。并且先前提出的检测算法中，并不能及时有效的检测出慢速持续欺骗攻击。慢速持续型欺骗攻击若在一段时间内引起的相角偏移未超过阈值时，则系统无法检测到攻击的发生，只有当相角偏差超过规定阈值时，系统才能检测到。此时，攻击者已经对系统的正常运行造成了明显的影响。
4、第四种方法使用机器学习对量测数据进行处理，此类方法通过对数据进行训练，得到分类模型进行GSA检测。
总之，目前研究主要存在以下问题：一、使用的滤波器为传统的卡尔曼滤波，并不能获得更精确的估计精度，确保估计状态的准确性；二、并未考虑到检测慢速持续型GSA，这种攻击幅度较小的攻击模式往往更隐蔽，在攻击幅度未超过阈值时很难将其检测出来，并且已经对系统的正常测量造成了一定的影响；三、并未考虑到将GSA的攻击模式进行分类并识别。
发明内容
本发明要解决的技术问题是，提供一种能够在不改造现有电力系统GPS接收设备硬件的基础上，快速、准确、有效的检测GPS欺骗攻击(GSA)，并划分GPS欺骗攻击(GSA)类型的方法。
为解决上述技术问题，本发明提供了一种自适应的广义累计和GPS欺骗攻击检测方法，包括以下步骤：
S1，初始化工作：设置相量测量单元PMU的测量时刻t＝0，累积统计量β t＝0，滑动窗口宽度w＝w 0，累积统计量判定阀值Thr＝Thr 0。
S2，使用自适应滑动窗口来收集相量测量单元PMU量测数据z m,t。
S3，进行改进卡尔曼滤波预测步骤，预测t时刻的状态向量
Figure PCTCN2022098980-appb-000001
和误差协方差矩阵
Figure PCTCN2022098980-appb-000002
S4，使用广义对数似然比求解当前时刻发生攻击概率与不发生攻击概率的比值γ t，更新累计统计量β t；
S5，进行改进卡尔曼滤波测量更新步骤，更新状态向量
Figure PCTCN2022098980-appb-000003
误差协方差矩阵
Figure PCTCN2022098980-appb-000004
测量噪声协方差矩阵R t以及过程噪声协方差矩阵Q t；
S6，若累计统计量β t等于0，则判定系统未遭受GPS欺骗攻击，为正常情况，按一定权重减小滑动窗口的宽度w并返回步骤S2，否则执行下一步；
S7，若累计统计量β t大于预设阈值Thr，则判定系统遭受GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
S8，若所有相量测量单元PMU量测数据都被检测完则结束，否则测量时刻t增加1并返回步骤S2。
更进一步，步骤S7所述若累计统计量β t大于预设阈值Thr，则判定系统遭受了GPS欺骗攻击，按一定权重增加滑动窗口的宽度w还包括以下步骤：
S71，若t-1时刻累计统计量β t-1不大于0，则判定系统遭受突变型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
S72，若t-1时刻累计统计量β t-1大于0，则按照
Figure PCTCN2022098980-appb-000005
计算该段滑动窗口内时间t与相角θ之间的相关系数r(t,θ)，其中cov(t,θ)为时间t与相角θ的协方差值，D(t)为时间t的方差，D(θ)为的相角θ方差；
S73，若相关系数r(t,θ)的绝对值大于预设阈值，则判定系统遭受慢速持续型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
S74，判定系统遭受其他类型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2。
更进一步，步骤S73中所述预设阈值为0.8。
更进一步，步骤S7中所述按一定权重增加滑动窗口的宽度w的步骤为：按照
Figure PCTCN2022098980-appb-000006
将滑动窗口的宽度增加为w 1，其中K为量测数据的总数，λ 1为0至1之间的常数。
更进一步，步骤S6中所述按一定权重减小滑动窗口的宽度w的步骤为：按照
Figure PCTCN2022098980-appb-000007
将滑动窗口的宽度减小为w 2，其中K为量测数据的总数，λ 2为0至1之间的常数。
更进一步，步骤S3中所述预测t时刻的状态向量
Figure PCTCN2022098980-appb-000008
和误差协方差矩阵
Figure PCTCN2022098980-appb-000009
的步骤为：
S31，按照
Figure PCTCN2022098980-appb-000010
预测t时刻的状态向量
Figure PCTCN2022098980-appb-000011
其中
Figure PCTCN2022098980-appb-000012
为正常情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000013
为受到GPS欺骗攻击情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000014
为正常情况下的状态向量t-1时刻测量更新值，
Figure PCTCN2022098980-appb-000015
为受到GPS欺骗攻击情况下的状态向量t-1时刻测量更新值，A为状态转移矩阵；
S32，按照
Figure PCTCN2022098980-appb-000016
预测t时刻的误差协方差矩阵
Figure PCTCN2022098980-appb-000017
其中A为状态转移矩阵，A T为状态转移矩阵A的转置，
Figure PCTCN2022098980-appb-000018
为t-1时刻的误差协方差矩阵测量更新值，Q t-1为t-1时刻过程噪声协方差矩阵。
更进一步，步骤S4中所述使用广义对数似然比求解当前时刻发生攻击概率与不发生攻击概率的比值γ t，更新累计统计量β t的步骤为：
S41，按照
Figure PCTCN2022098980-appb-000019
计算当前时刻发生攻击概率与不发生攻击概率的比值γ t，其中
Figure PCTCN2022098980-appb-000020
为测量噪声的方差，z m,t为t时刻量测数据，B为测量矩阵，
Figure PCTCN2022098980-appb-000021
为t时刻的状态向量预测值，
Figure PCTCN2022098980-appb-000022
为攻击者造成的攻击向量；
S42，按照β t＝(β t-1+γ t) +计算t时刻累积统计量β t。
更进一步，步骤S5中所述更新状态向量
Figure PCTCN2022098980-appb-000023
误差协方差矩阵
Figure PCTCN2022098980-appb-000024
测量噪声协方差矩阵R t以及过程噪声协方差矩阵Q t的步骤为：
S51，按照G t＝P t -B T(BP t -B T+R t) -1计算卡尔曼增益G t，其中P t -为t时刻的误差协方差矩阵预测值，B为测量矩阵，B T为测量矩阵B的转置，R t为t时刻的过程噪声协方差矩阵；
S52，按照
Figure PCTCN2022098980-appb-000025
更新状态向量
Figure PCTCN2022098980-appb-000026
其中
Figure PCTCN2022098980-appb-000027
为正常情况 下的状态向量t时刻测量更新值，
Figure PCTCN2022098980-appb-000028
为受到GPS欺骗攻击情况下的状态向量t时刻测量更新值，
Figure PCTCN2022098980-appb-000029
为t时刻的状态向量预测值，
Figure PCTCN2022098980-appb-000030
为正常情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000031
为受到GPS欺骗攻击情况下的状态向量t时刻预测值，z m,t为t时刻量测数据，B为测量矩阵，
Figure PCTCN2022098980-appb-000032
为攻击者造成的攻击向量；
S53，按照P t +＝(I-G tB)P t -更新误差协方差矩阵P t +，其中I为单位矩阵；
S54，按照
Figure PCTCN2022098980-appb-000033
更新测量噪声协方差矩阵R t，其中R t-1为t-1时刻测量噪声协方差矩阵，μ为分配估计值和上一时刻值的权重；
S55，按照
Figure PCTCN2022098980-appb-000034
更新过程噪声协方差矩阵Q t，其中Q t-1为t-1时刻过程噪声协方差矩阵。
更进一步，步骤S54和步骤S55中所述分配估计值和上一时刻值的权重μ为0到1之间的常数。
本发明的有益效果在于：
在收集PMU测量数据的过程中，滑动窗口的宽度是重要的因素之一，固定不变的窗口不适用于数据复杂多变的数据流。本发明公开的方法使用自适应滑动窗口来收集PMU测量数据，当检测到PMU受到攻击时，按照一定的权重增加滑动窗口的宽度；当检测到攻击停止时，按照一定的权重减少滑动窗口的宽度。自适应滑动窗口中可以根据不同的情况自动调整最适合的滑动窗口的宽度，能够更快的检测到所有受到GPS欺骗攻击的PMU量测数据，从而对相应受损数据进行修复，并且能有效减少算法的运行时间，确保电力系统的正常运行。
收集完PMU测量数据之后，本发明公开的方法使用改进的卡尔曼滤波器计算测量数据的状态估计值。在卡尔曼滤波器中，过程噪声w t和测量噪声v t的协方差矩阵Q t和R t对于动态状态估计的性能有重要的影响。若没有选择合适的Q t和R t会显著降低卡尔曼滤波器的性能，甚至导致滤波器发散。在先前研究中使用的传统的卡尔曼滤波器中一般会将Q t和R t值设置为常量，然后在实验过程中根据实验结果不断调整，这种方法显然占用了很多计算时间以及资源消耗，并且也不能获得最佳的滤波性能。为了解决此问题，本发明实用的一种改进卡尔曼滤波器，在进行测量更新的迭代步骤中，通过给上一时刻的Q t-1和R t-1以及当前时刻的Q t和R t 估计值不同的权重，从而实现对噪声协方差矩阵的自适应动态调整，提高了动态状态估计的精度。
本发明公开的方法使用广义对数似然比求出可能遭受GSA的概率，并使用广义累计和算法(CUSUM算法)累积该概率，当累积统计量超过预定阈值时，则认为系统遭受了GSA。为了对攻击类型进行细分，判断t-1时刻累积统计量β t-1的值，若β t-1的值等于0，则表明t时刻之前并未发生攻击，攻击是在t时刻产生并且攻击幅度很大，GSA的攻击类型为突变型GSA。若β t-1的值大于0，则表明t-1时刻之前也存在攻击情况，只是攻击幅度较小。由于慢速持续型GSA通常是采取线性方式增加攻击幅度。为了进一步判断攻击类型是否为慢速持续型GSA，使用相关系数来进一步识别GSA类型，通过计算一个滑动窗口内时间t与相角θ之间的线性关系来判断攻击是否为慢速持续型攻击。总之，本发明还公开了对GSA攻击类型进行检测的方法，更有利于系统做出对应的攻击防御策略。
附图说明
图1是突变型GSA示意图。
图2是慢速持续型GSA示意图。
图3是本发明一实施方式流程图。
图4是本发明一实施方式仿真实验所用的IEEE-39总线系统结构图。
图5是本发明一实施方式仿真实验模拟突变型攻击场景中突变型GSA对PMU造成影响示意图。
图6是本发明一实施方式仿真实验模拟突变型攻击场景中使用本发明实施方式检测突变型GSA的仿真实验结果。
图7是本发明一实施方式仿真实验模拟突变型攻击场景中使用本发明实施方式检测突变型GSA的滑动窗口变化情况。
图8是本发明一实施方式仿真实验模拟慢速持续型攻击场景中慢速持续型GSA对PMU造成的影响示意图。
图9是本发明一实施方式仿真实验模拟慢速持续型攻击场景中使用本发明实施方式检测慢速持续型GSA的仿真实验结果。
图10是本发明一实施方式仿真实验模拟慢速持续型攻击场景中使用本发明实施方式检测慢速持续型GSA的滑动窗口变化情况。
图11是本发明一实施方式仿真实验模拟混合型攻击场景中慢速持续型GSA对PMU造 成的影响示意图。
图12是本发明一实施方式仿真实验模拟混合型攻击场景中使用本发明实施方式检测混合型GSA的仿真实验结果。
图13是本发明一实施方式仿真实验模拟混合型攻击场景中使用本发明实施方式检测混合型GSA的滑动窗口变化情况。
具体实施方式
下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例是本发明一部分实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都属于本发明保护的范围。
应当理解，当在本说明书和所附权利要求书中使用时，术语“包括”和“包含”指示所描述特征、整体、步骤、操作、元素和/或组件的存在，但并不排除一个或多个其它特征、整体、步骤、操作、元素、组件和/或其集合的存在或添加。
还应当进一步理解，在本发明说明书和所附权利要求书中使用的术语“和/或”是指相关联列出的项中的一个或多个的任何组合以及所有可能组合，并且包括这些组合。
本实施例中，假设电力系统由M+1条总线组成，其中安装了N个PMU。电力系统中，状态估计值x M,t表示第M条总线的相位角。用电力系统的状态向量x t＝[x 1,t,x 2,t,…,x M,t] T表示在时间t处M条总线的相位角的集合。z N,t表示第N个PMU的量测值，电力系统中所有PMU的量测值集合为z t＝[z 1,t,z 2,t,…,z N,t] T。系统模型为
Figure PCTCN2022098980-appb-000035
其中A为状态转移矩阵，B为测量矩阵，ω t＝[ω 1,t,ω 2,t,…,ω M,t] T为过程噪声，v t＝[v 1,t,v 2,t,…,v N,t] T为测量噪声。假设ω t和v t是独立的加性白色高斯随机过程，其中
Figure PCTCN2022098980-appb-000036
I M为M×M的单位矩阵，I N为N×N的单位矩阵。ω t的协方差矩阵Q t为
Figure PCTCN2022098980-appb-000037
v t的协方差矩阵R t为
Figure PCTCN2022098980-appb-000038
其中E(*)为求数学期望值。慢速持续型攻击的测量向量
Figure PCTCN2022098980-appb-000039
其中
Figure PCTCN2022098980-appb-000040
为攻击者造成的攻击向量。
如图3所示，本实施例提供的一种自适应的广义累计和GPS欺骗攻击检测方法，包括以下步骤：
S1，初始化工作：设置相量测量单元PMU的测量时刻t＝0，累积统计量β t＝0，滑动窗口 宽度w＝w 0，累积统计量判定阀值Thr＝Thr 0。
S2，使用自适应滑动窗口来收集相量测量单元PMU量测数据z m,t。
S3，进行改进卡尔曼滤波预测步骤，预测t时刻的状态向量
Figure PCTCN2022098980-appb-000041
和误差协方差矩阵P t -，包括以下步骤：
S31，按照
Figure PCTCN2022098980-appb-000042
预测t时刻的状态向量
Figure PCTCN2022098980-appb-000043
其中
Figure PCTCN2022098980-appb-000044
为正常情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000045
为受到GPS欺骗攻击情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000046
为正常情况下的状态向量t-1时刻测量更新值，
Figure PCTCN2022098980-appb-000047
为受到GPS欺骗攻击情况下的状态向量t-1时刻测量更新值，A为状态转移矩阵；
S32，按照
Figure PCTCN2022098980-appb-000048
预测t时刻的误差协方差矩阵P t -，其中A为状态转移矩阵，A T为状态转移矩阵A的转置，
Figure PCTCN2022098980-appb-000049
为t-1时刻的误差协方差矩阵测量更新值，Q t-1为t-1时刻过程噪声协方差矩阵。
S4，使用广义对数似然比求解当前时刻发生攻击概率与不发生攻击概率的比值γ t，更新累计统计量β t，包括以下步骤：
S41，按照
Figure PCTCN2022098980-appb-000050
计算当前时刻发生攻击概率与不发生攻击概率的比值γ t，其中
Figure PCTCN2022098980-appb-000051
为测量噪声的方差，z m,t为t时刻量测数据，B为测量矩阵，
Figure PCTCN2022098980-appb-000052
为t时刻的状态向量预测值，
Figure PCTCN2022098980-appb-000053
为攻击者造成的攻击向量；
S42，按照β t＝(β t-1+γ t) +计算t时刻累积统计量β t。
S5，进行改进卡尔曼滤波测量更新步骤，更新状态向量
Figure PCTCN2022098980-appb-000054
误差协方差矩阵P t +、测量噪声协方差矩阵R t以及过程噪声协方差矩阵Q t，包括以下步骤：
S51，按照G t＝P t -B T(BP t -B T+R t) -1计算卡尔曼增益G t，其中P t -为t时刻的误差协方差矩阵预测值，B为测量矩阵，B T为测量矩阵B的转置，R t为t时刻的过程噪声协方差矩阵；
S52，按照
Figure PCTCN2022098980-appb-000055
更新状态向量
Figure PCTCN2022098980-appb-000056
其中
Figure PCTCN2022098980-appb-000057
为正常情况下的状态向量t时刻测量更新值，
Figure PCTCN2022098980-appb-000058
为受到GPS欺骗攻击情况下的状态向量t时刻测量更新值，
Figure PCTCN2022098980-appb-000059
为t时刻的状态向量预测值，
Figure PCTCN2022098980-appb-000060
为正常情况下的状态向量t时刻预测值，
Figure PCTCN2022098980-appb-000061
为受到GPS欺骗攻击情况下的状态向量t时刻预测值，z m,t为t时刻量测数据，B为测量矩阵，
Figure PCTCN2022098980-appb-000062
为攻击者造成的攻击向量；
S53，按照P t +＝(I-G tB)P t -更新误差协方差矩阵P t +，其中I为单位矩阵；
S54，按照
Figure PCTCN2022098980-appb-000063
更新测量噪声协方差矩阵R t，其中R t-1为t-1时刻测量噪声协方差矩阵，μ为分配估计值和上一时刻值的权重；
S55，按照
Figure PCTCN2022098980-appb-000064
更新过程噪声协方差矩阵Q t，其中Q t-1为t-1时刻过程噪声协方差矩阵。
步骤S54和步骤S55中所述分配估计值和上一时刻值的权重μ为0到1之间的常数。
S6，若累计统计量β t等于0，则判定系统未遭受GPS欺骗攻击，为正常情况，按照
Figure PCTCN2022098980-appb-000065
将滑动窗口的宽度减小为w 2，其中K为量测数据的总数，λ 2为0至1之间的常数，并返回步骤S2。否则执行下一步；
S7，若累计统计量β t大于预设阈值Thr，则判定系统遭受GPS欺骗攻击，进一步判定系统遭受GPS欺骗攻击的类型，按照
Figure PCTCN2022098980-appb-000066
将滑动窗口的宽度增加为w 1，其中K为量测数据的总数，λ 1为0至1之间的常数，并返回步骤S2，否则执行下一步。其中进一步判定系统遭受GPS欺骗攻击的类型的步骤如下：
S71，若t-1时刻累计统计量β t-1不大于0，则判定系统遭受突变型GPS欺骗攻击，按照
Figure PCTCN2022098980-appb-000067
将滑动窗口的宽度增加为w 1并返回步骤S2，否则执行下一步；
S72，若t-1时刻累计统计量β t-1大于0，则按照
Figure PCTCN2022098980-appb-000068
计算该段滑动窗口内时间t与相角θ之间的相关系数r(t,θ)，其中cov(t,θ)为时间t与相角θ的协方差值，D(t)为 时间t的方差，D(θ)为的相角θ方差；
S73，若相关系数r(t,θ)的绝对值大于预设阈值，则判定系统遭受慢速持续型GPS欺骗攻击，按照
Figure PCTCN2022098980-appb-000069
将滑动窗口的宽度增加为w 1并返回步骤S2，否则执行下一步；
S74，判定系统遭受其他类型GPS欺骗攻击，按照
Figure PCTCN2022098980-appb-000070
将滑动窗口的宽度增加为w 1并返回步骤S2。
作为更优化的方案，步骤S73中所述预设阈值为0.8。
S8，若所有相量测量单元PMU量测数据都被检测完则结束，否则测量时刻t增加1并返回步骤S2。
为了验证本实施例公开的检测方法的性能，使用如图4所示的IEEE-39总线系统，该系统由新英格兰10机系统、10台发电机、39条总线以及46条传输线组成。基于PowerWorld仿真软件的IEEE-39系统能提供实时并精确的测量信息，从而模拟PMU收集电力系统数据的过程。然后将所得数据导入MATLABR2017a中评估本实施例公开的检测方法的性能。实验中所用到的参数设置如下，其中f表示系统频率，默认为50HZ；ω t为过程噪声，设定为1×10 -4；v t为测量噪声，设定为2×10 -4，t为PMU数据采样时间间隔，设定为0.02s；判定阀值Thr根据IEEE C37.118标准取得，此标准中规定同步误差限制为1％，对应的相角误差为0.5730(度)。本实施例仿真实验中判定阀值Thr取0.57302T，分配估计值和上一时刻值的权重μ为自适应常数，根据实验调试，μ为0.4时，卡尔曼滤波性能最佳，估计的相对状态误差最小。权重λ 1取0.8，权重λ 2取0.5。系统的运行算法的计算机规格如下所示：CPU：Intel(R)Core(TM)i5-9400 CPU@2.90GHZ；内存：16GB。
本实施例仿真实验通过分析单次攻击和多次攻击中各算法的时间消耗以及估计相对误差精度来评估提出的算法的性能。其中文献[1]提出了一种抗GSA机制，即利用PMU和SCADA系统测量动态滤波器估计欺骗攻击引起的相移，从而检测GSA。文献[4](Risbud P,Gatsis N,Taha A.Vulnerability analysis of smart grids to GPS spoofing[J].IEEE Transactions on Smart Grid,2018,10(4):3535-3548.)提出了一种使用交替最小化算法来检测多次GSA。文献[5](X.Fan,L.Du and D.Duan,"Synchrophasor Data Correction Under GPS Spoofing Attack:A State Estimation Based Approach,"2018 IEEE/PES Transmission and Distribution Conference and Exposition(T&D),Denver,CO,2018,pp.1-9,doi:10.1109/TDC.2018.8440488.)提出了一种欺骗 匹配算法，利用黄金分割搜索算法求出攻击角，从而检测GSA。评估的指标有两个：时间消耗、估计相对误差，其中时间消耗表示在检测100个数据样本中，检测算法运行所消耗的时间。估计相对误差被定义为
Figure PCTCN2022098980-appb-000071
其中
Figure PCTCN2022098980-appb-000072
表示估计的状态值，θ表示真实值。
表1以及表2展示了各检测算法在检测单次GSA以及多次GSA时的检测结果对比，其中本实施例提出的方案相比于文献[4]和文献[5]的静态状态估计方案中有明显较小的时间消耗以及较小的估计相对误差，其次，与动态状态估计检测方案[1]对比中，本实施例提出的方案于其时间消耗以及状态估计相对误差精度接近，并且能将攻击类型进行有效分类，综合算法的各项性能分析，本实施例的方案在保证时间消耗较小以及估计相对误差较小的情况下，能有效将GSA的攻击类型分类出。因此，本实施例提出的方案要优于其他检测方案。
表1单次GSA检测结果对比表
Figure PCTCN2022098980-appb-000073
表2多次GSA检测结果对比表
Figure PCTCN2022098980-appb-000074
本实施例仿真实验主要分析了三种GSA的攻击场景，分别是：突变型攻击场景、慢速持续型攻击场景以及混合型攻击场景，通过模拟出三种攻击模式，对PMU量测数据造成影响。并使用本实施例提出的检测方法来实时检测攻击并进行攻击模式分类，同时也展示了自适应滑动窗口在三种攻击模式下的变化过程。
A、突变型攻击场景
此场景考虑到的GSA攻击模式为攻击者突然注入信号幅度极强的攻击信号，因此干扰正常的GPS信号接收，从而使PMU采集数据的过程受到攻击，导致量测数据不准确。如图5所示，在0到4秒的时间里，攻击者对PMU进行了多次突变型攻击，导致其相角改变超过了系统规定的阈值，对系统的正常运行造成了影响。使用本实施例提出的检测方案对此攻击场景进行攻击检测，如图6所示，当发生突变型GSA时，累积统计量β t会统计出该PMU发 生GSA的概率，并且在检测出累积值超过规定的阈值时，判断前一时刻累积统计量的值，从而分析GSA的类型，图6展示了提出的攻击检测器检测突变型GSA的情况，当攻击发生的前一时刻时，发生GSA的概率为0，当发生攻击时，累积统计量β t立马超过阈值，因此检测方案判断攻击发生的类型为突变型GSA，并且在攻击结束后，β t的值将会重置为0。图7展示了自适应滑动窗口检测到攻击情况下窗口宽度的变化情况，图中可以明显看出攻击发生时，滑动窗口宽度发生了一定的改变，在攻击结束时，窗口宽度又恢复正常。
B、慢速持续型攻击场景
此场景考虑到的攻击模式为攻击者缓慢注入并持续增强攻击信号，直到攻击信号影响正常的GPS接收信号，此攻击模式不同于之前的突变型攻击模式，当攻击造成的影响未超过系统规定的阈值时，很难将此类攻击检测到。此时，慢速持续型攻击已经对系统造成的一定的影响。图8展示了慢速持续型GSA对PMU造成的影响，在0.22至0.62秒、1.16至1.54秒、2.14至2.52秒、3.22至3.54秒这4个时间段中，电力系统已经遭受了慢速持续型攻击，先前的研究中并不能检测出这一段时间的攻击影响，使用本实施例提出的检测方案的检测效果如图9所示，随着攻击幅度的增强，累积统计量β t的值快速增长，在攻击发生不久，此类型攻击就能被实时检测。图10展示了当算法检测此类型攻击时，自适应滑动窗口宽度的变化情况。
C、混合型攻击场景
此场景考虑到攻击者在实际攻击中不会只采用一种模式的攻击，往往是多种攻击模式的混合攻击。为了验证本实施例检测方法在检测混合型攻击场景下的检测性能，本实施例仿真实验模拟了突变型攻击和慢速持续型攻击交替进行的攻击场景。如图11所示，在0.38秒到0.9秒这段时间里，发生了一次突变型攻击，随后又立马出现了慢速持续型攻击。在采集数据的4秒内，攻击者总共发起了4次攻击，分别用突变型攻击和慢速持续型攻击来攻击PMU，影响其采集数据。在图12中，展示了本实施例提出的检测方案对混合型攻击的检测情况。如图12所示，在发生GSA后，检测方案能实时检测出攻击，并且能判断出攻击的类型从而提交给系统作进一步处理。图13展示了随着攻击的检测自适应滑动窗口的变化情况。
本发明实施例可以根据实际需要进行顺序调整、合并和删减。
实施例对本方案进行了详细的介绍，本文中应用了具体个例对本发明的原理及实施方式进行了阐述，以上实施例只是用于帮助理解本发明的方法及其核心思想；同时，对于本领域的一般技术人员，依据本发明的思想，在具体实施方式及应用范围上均会有改变之处，综上所述，本说明书内容不应理解为对本发明的限制。

Claims (9)

  1. 一种自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，包括以下步骤：
    S1，初始化工作：设置相量测量单元PMU的测量时刻t＝0，累积统计量β t＝0，滑动窗口宽度w＝w 0，累积统计量判定阀值Thr＝Thr 0；
    S2，使用自适应滑动窗口来收集相量测量单元PMU量测数据z m,t；
    S3，进行改进卡尔曼滤波预测步骤，预测t时刻的状态向量
    Figure PCTCN2022098980-appb-100001
    和误差协方差矩阵P t -；
    S4，使用广义对数似然比求解当前时刻发生攻击概率与不发生攻击概率的比值γ t，更新累计统计量β t；
    S5，进行改进卡尔曼滤波测量更新步骤，更新状态向量
    Figure PCTCN2022098980-appb-100002
    误差协方差矩阵P t +、测量噪声协方差矩阵R t以及过程噪声协方差矩阵Q t；
    S6，若累计统计量β t等于0，则判定系统未遭受GPS欺骗攻击，为正常情况，按一定权重减小滑动窗口的宽度w并返回步骤S2，否则执行下一步；
    S7，若累计统计量β t大于预设阈值Thr，则判定系统遭受GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
    S8，若所有相量测量单元PMU量测数据都被检测完则结束，否则测量时刻t增加1并返回步骤S2。
  2. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S7所述若累计统计量β t大于预设阈值Thr，则判定系统遭受了GPS欺骗攻击，按一定权重增加滑动窗口的宽度w还包括以下步骤：
    S71，若t-1时刻累计统计量β t-1不大于0，则判定系统遭受突变型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
    S72，若t-1时刻累计统计量β t-1大于0，则按照
    Figure PCTCN2022098980-appb-100003
    计算该段滑动窗口内时间t与相角θ之间的相关系数r(t,θ)，其中cov(t,θ)为时间t与相角θ的协方差值，D(t)为时间t的方差，D(θ)为的相角θ方差；
    S73，若相关系数r(t,θ)的绝对值大于预设阈值，则判定系统遭受慢速持续型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2，否则执行下一步；
    S74，判定系统遭受其他类型GPS欺骗攻击，按一定权重增加滑动窗口的宽度w并返回步骤S2。
  3. 根据权利要求2所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S73中所述预设阈值为0.8。
  4. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S7中所述按一定权重增加滑动窗口的宽度w的步骤为：按照
    Figure PCTCN2022098980-appb-100004
    将滑动窗口的宽度增加为w 1，其中K为量测数据的总数，λ 1为0至1之间的常数。
  5. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S6中所述按一定权重减小滑动窗口的宽度w的步骤为：按照
    Figure PCTCN2022098980-appb-100005
    将滑动窗口的宽度减小为w 2，其中K为量测数据的总数，λ 2为0至1之间的常数。
  6. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S3中所述预测t时刻的状态向量
    Figure PCTCN2022098980-appb-100006
    和误差协方差矩阵P t -的步骤为：
    S31，按照
    Figure PCTCN2022098980-appb-100007
    预测t时刻的状态向量
    Figure PCTCN2022098980-appb-100008
    其中
    Figure PCTCN2022098980-appb-100009
    为正常情况下的状态向量t时刻预测值，
    Figure PCTCN2022098980-appb-100010
    为受到GPS欺骗攻击情况下的状态向量t时刻预测值，
    Figure PCTCN2022098980-appb-100011
    为正常情况下的状态向量t-1时刻测量更新值，
    Figure PCTCN2022098980-appb-100012
    为受到GPS欺骗攻击情况下的状态向量t-1时刻测量更新值，A为状态转移矩阵；
    S32，按照
    Figure PCTCN2022098980-appb-100013
    预测t时刻的误差协方差矩阵P t -，其中A为状态转移矩阵，A T为状态转移矩阵A的转置，
    Figure PCTCN2022098980-appb-100014
    为t-1时刻的误差协方差矩阵测量更新值，Q t-1为t-1时刻过程噪声协方差矩阵。
  7. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S4中所述使用广义对数似然比求解当前时刻发生攻击概率与不发生攻击概率的比值γ t，更新累计统计量β t的步骤为：
    S41，按照
    Figure PCTCN2022098980-appb-100015
    计算当前时刻发生攻击概率与不发生攻击概率的比值γ t，其中
    Figure PCTCN2022098980-appb-100016
    为测量噪声的方差，z m,t为t时刻量测数据，B为测量矩阵，
    Figure PCTCN2022098980-appb-100017
    为t时刻的状态向量预测值，
    Figure PCTCN2022098980-appb-100018
    为攻击者造成的攻击向量；
    S42，按照β t＝(β t-1+γ t) +计算t时刻累积统计量β t。
  8. 根据权利要求1所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S5中所述更新状态向量
    Figure PCTCN2022098980-appb-100019
    误差协方差矩阵P t +、测量噪声协方差矩阵R t以及过程噪声协方差矩阵Q t的步骤为：
    S51，按照G t＝P t -B T(BP t -B T+R t) -1计算卡尔曼增益G t，其中P t -为t时刻的误差协方差矩阵预测值，B为测量矩阵，B T为测量矩阵B的转置，R t为t时刻的过程噪声协方差矩阵；
    S52，按照
    Figure PCTCN2022098980-appb-100020
    更新状态向量
    Figure PCTCN2022098980-appb-100021
    其中
    Figure PCTCN2022098980-appb-100022
    为正常情况下的状态向量t时刻测量更新值，
    Figure PCTCN2022098980-appb-100023
    为受到GPS欺骗攻击情况下的状态向量t时刻测量更新值，
    Figure PCTCN2022098980-appb-100024
    为t时刻的状态向量预测值，
    Figure PCTCN2022098980-appb-100025
    为正常情况下的状态向量t时刻预测值，
    Figure PCTCN2022098980-appb-100026
    为受到GPS欺骗攻击情况下的状态向量t时刻预测值，z m,t为t时刻量测数据，B为测量矩阵，
    Figure PCTCN2022098980-appb-100027
    为攻击者造成的攻击向量；
    S53，按照P t +＝(I-G tB)P t -更新误差协方差矩阵P t +，其中I为单位矩阵；
    S54，按照
    Figure PCTCN2022098980-appb-100028
    更新测量噪声协方差矩阵R t，其中R t-1为t-1时刻测量噪声协方差矩阵，μ为分配估计值和上一时刻值的权重；
    S55，按照
    Figure PCTCN2022098980-appb-100029
    更新过程噪声协方差矩阵Q t，其中Q t-1为t-1时刻过程噪声协方差矩阵。
  9. 根据权利要求8所述自适应的广义累计和GPS欺骗攻击检测方法，其特征在于，步骤S54和步骤S55中所述分配估计值和上一时刻值的权重μ为0到1之间的常数。
PCT/CN2022/098980 2021-06-17 2022-06-15 一种自适应的广义累计和gps欺骗攻击检测方法 WO2022262780A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110670355.1 2021-06-17
CN202110670355.1A CN113534199B (zh) 2021-06-17 2021-06-17 一种自适应的广义累计和gps欺骗攻击检测方法

Publications (1)

Publication Number Publication Date
WO2022262780A1 true WO2022262780A1 (zh) 2022-12-22

Family

ID=78096131

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/098980 WO2022262780A1 (zh) 2021-06-17 2022-06-15 一种自适应的广义累计和gps欺骗攻击检测方法

Country Status (2)

Country Link
CN (1) CN113534199B (zh)
WO (1) WO2022262780A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117194866A (zh) * 2023-09-11 2023-12-08 哈尔滨理工大学 一种基于质量弹簧阻尼系统的分布式滤波方法

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113534199B (zh) * 2021-06-17 2022-08-26 长沙理工大学 一种自适应的广义累计和gps欺骗攻击检测方法
CN116736043B (zh) * 2023-08-14 2023-10-13 山东理工大学 一种电力系统线路故障特征主动增强检测方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150293234A1 (en) * 2014-04-09 2015-10-15 The Mitre Corporation Positioning, Navigation, and Timing Device Interference and Spoofing Detector With Timing Mitigation
CN106932686A (zh) * 2017-03-21 2017-07-07 国网上海市电力公司 基于最大最小特征值法的电网异常快速检测方法
US20190187294A1 (en) * 2017-12-20 2019-06-20 Board Of Regents, The University Of Texas System Method and system for detecting and mitigating time synchronization attacks of global positioning system (gps) receivers
CN111723366A (zh) * 2019-03-19 2020-09-29 中国科学院沈阳自动化研究所 一种基于状态估计偏差的错误数据注入攻击鲁棒检测方法
CN113534199A (zh) * 2021-06-17 2021-10-22 长沙理工大学 一种自适应的广义累计和gps欺骗攻击检测方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102096086B (zh) * 2010-11-22 2012-09-05 北京航空航天大学 一种基于gps/ins组合导航系统不同测量特性的自适应滤波方法
US9466881B1 (en) * 2011-11-16 2016-10-11 Exelis, Inc. Detection of wireless data jamming and spoofing
CN103983996A (zh) * 2014-05-09 2014-08-13 北京航空航天大学 一种抗gps野值的紧组合自适应滤波方法
US10641906B2 (en) * 2016-09-27 2020-05-05 Bae Systems Information And Electronic Systems Integrations Inc. GPS jammer and spoofer detection
CN109444922A (zh) * 2018-11-28 2019-03-08 北京工业大学 面向自主导航无人机gps欺骗检测与防御方法
US11280913B2 (en) * 2019-05-31 2022-03-22 At&T Intellectual Property I, L.P. Global positioning system spoofing countermeasures
CN110715660B (zh) * 2019-11-21 2023-06-06 中国人民解放军63961部队 基于卡尔曼滤波估计的北斗/惯性组合抗欺骗干扰方法
CN110942109A (zh) * 2019-12-17 2020-03-31 浙江大学 一种基于机器学习的pmu防御虚假数据注入攻击方法
CN111443363B (zh) * 2020-01-17 2023-07-04 中国人民解放军战略支援部队信息工程大学 一种卫星导航的欺骗识别方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150293234A1 (en) * 2014-04-09 2015-10-15 The Mitre Corporation Positioning, Navigation, and Timing Device Interference and Spoofing Detector With Timing Mitigation
CN106932686A (zh) * 2017-03-21 2017-07-07 国网上海市电力公司 基于最大最小特征值法的电网异常快速检测方法
US20190187294A1 (en) * 2017-12-20 2019-06-20 Board Of Regents, The University Of Texas System Method and system for detecting and mitigating time synchronization attacks of global positioning system (gps) receivers
CN111723366A (zh) * 2019-03-19 2020-09-29 中国科学院沈阳自动化研究所 一种基于状态估计偏差的错误数据注入攻击鲁棒检测方法
CN113534199A (zh) * 2021-06-17 2021-10-22 长沙理工大学 一种自适应的广义累计和gps欺骗攻击检测方法

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
AKHLAGHI SHAHROKH; ZHOU NING; HUANG ZHENYU: "Adaptive adjustment of noise covariance in Kalman filter for dynamic state estimation", 2017 IEEE POWER & ENERGY SOCIETY GENERAL MEETING, IEEE, 16 July 2017 (2017-07-16), pages 1 - 5, XP033309082, DOI: 10.1109/PESGM.2017.8273755 *
PRADHAN PARTH; NAGANANDA KYATSANDRA; VENKITASUBRAMANIAM PARV; KISHORE SHALINEE; BLUM RICK S.: "GPS spoofing attack characterization and detection in smart grids", 2016 IEEE CONFERENCE ON COMMUNICATIONS AND NETWORK SECURITY (CNS), IEEE, 17 October 2016 (2016-10-17), pages 391 - 395, XP033068180, DOI: 10.1109/CNS.2016.7860525 *
SIAMAK SARA; DEHGHANI MARYAM; MOHAMMADI MOHSEN: "Counteracting GPS Spoofing Attack on PMUs by Dynamic State Estimation", 2019 SMART GRID CONFERENCE (SGC), IEEE, 18 December 2019 (2019-12-18), pages 1 - 5, XP033753682, DOI: 10.1109/SGC49328.2019.9056583 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117194866A (zh) * 2023-09-11 2023-12-08 哈尔滨理工大学 一种基于质量弹簧阻尼系统的分布式滤波方法
CN117194866B (zh) * 2023-09-11 2024-03-26 哈尔滨理工大学 一种基于质量弹簧阻尼系统的分布式滤波方法

Also Published As

Publication number Publication date
CN113534199A (zh) 2021-10-22
CN113534199B (zh) 2022-08-26

Similar Documents

Publication Publication Date Title
WO2022262780A1 (zh) 一种自适应的广义累计和gps欺骗攻击检测方法
CN110942109A (zh) 一种基于机器学习的pmu防御虚假数据注入攻击方法
Musleh et al. Detection of false data injection attacks in smart grids: A real-time principle component analysis
CN109459705A (zh) 一种抗野值鲁棒无迹卡尔曼滤波的动力电池soc估计方法
CN103728599B (zh) 用异地配置的主被动雷达网抑制欺骗式假目标干扰的方法
CN104573510A (zh) 一种智能电网恶意数据注入攻击及检测方法
CN103368175A (zh) 电力系统动态稳定在线评估方法
CN109672485A (zh) 基于信道状态信息室内人员实时入侵及运动速度检测方法
CN110930265A (zh) 一种基于移地距离的电力系统虚假数据注入攻击检测方法
CN103954943A (zh) 网络化雷达系统抗欺骗式干扰方法
CN105445710A (zh) 隐形雷达低截获概率性能评估方法
CN112924943B (zh) 协方差阵-位置偏差联合检验的虚假航迹鉴别方法及系统
CN110007299A (zh) 一种基于混合坐标伪谱技术的微弱目标检测跟踪方法
Xue et al. Online pattern recognition and data correction of PMU data under GPS spoofing attack
CN105044686A (zh) 一种雷达密集假目标干扰抑制方法
Wang et al. An accurate false data detection in smart grid based on residual recurrent neural network and adaptive threshold
CN109633628A (zh) 基于分布式组网雷达数据融合的抗rgpo干扰的方法
Xue et al. Data-driven detection for GPS spoofing attack using phasor measurements in smart grid
Bhatnagar et al. Improved automatic target recognition using singular value decomposition
Geris et al. Joint state estimation and cyber-attack detection based on feature grouping
Zhang et al. A three-dimensional node security localization method for WSN based on improved RSSI-LSSVR algorithm
CN102621535B (zh) 一种高效的协方差矩阵结构估计方法
CN111999715B (zh) 异质杂波下目标知识辅助自适应融合检测方法
Fan et al. Closed-form solution for synchrophasor data correction under GPS spoofing attack
CN115166784B (zh) 一种欺骗式干扰检测方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22824255

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE