CN115333870B - Network attack identification method and system for wide-area synchronous measurement of smart power grid - Google Patents

Network attack identification method and system for wide-area synchronous measurement of smart power grid Download PDF

Info

Publication number
CN115333870B
CN115333870B CN202211264062.4A CN202211264062A CN115333870B CN 115333870 B CN115333870 B CN 115333870B CN 202211264062 A CN202211264062 A CN 202211264062A CN 115333870 B CN115333870 B CN 115333870B
Authority
CN
China
Prior art keywords
layer
convolution
dost
normal
ddnc
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Active
Application number
CN202211264062.4A
Other languages
Chinese (zh)
Other versions
CN115333870A (en
Inventor
姚文轩
郑瑶
邱伟
唐求
唐思豪
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Hunan University
Original Assignee
Hunan University
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Hunan University filed Critical Hunan University
Priority to CN202211264062.4A priority Critical patent/CN115333870B/en
Publication of CN115333870A publication Critical patent/CN115333870A/en
Application granted granted Critical
Publication of CN115333870B publication Critical patent/CN115333870B/en
Active legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y04—INFORMATION OR COMMUNICATION TECHNOLOGIES HAVING AN IMPACT ON OTHER TECHNOLOGY AREAS
    • Y04S—SYSTEMS INTEGRATING TECHNOLOGIES RELATED TO POWER NETWORK OPERATION, COMMUNICATION OR INFORMATION TECHNOLOGIES FOR IMPROVING THE ELECTRICAL POWER GENERATION, TRANSMISSION, DISTRIBUTION, MANAGEMENT OR USAGE, i.e. SMART GRIDS
    • Y04S40/00—Systems for electrical power generation, transmission, distribution or end-user application management characterised by the use of communication or information technologies, or communication or information technology specific aspects supporting them
    • Y04S40/20—Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)
  • Image Analysis (AREA)

Abstract

The invention discloses a network attack identification method and a system for smart grid wide area synchronous measurementf(t) Decomposing into a plurality of modal components; extracting a common component from the plurality of modal components; by measuring dataf(t) Subtracting the common component to obtain a disturbance component containing spatial position informationy(t) (ii) a Will disturb the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation; inputting the DOST characteristic matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack. The invention can extract the DOST characteristic matrix containing the spatial position information from different power grid synchronous measurement data, can carry out attack detection on the power grid synchronous measurement data through the convolutional neural network under different network attacks, and can quickly identify whether the measurement system is attacked by the network.

Description

Network attack identification method and system for wide-area synchronous measurement of smart power grid
Technical Field
The invention belongs to a network attack detection technology, and particularly relates to a network attack identification method and system for smart grid wide area synchronous measurement.
Background
The wide area measurement system is a complex network for real-time measurement sensing and dynamic control, the existing smart grid wide area synchronous measurement system is vulnerable to network attacks in the data transmission and storage processes, the network attacks forge power system disturbance by tampering with measurement data, and the power grid control system is broken down due to the defect. The network attack mainly comprises various attack behaviors such as false data injection attack and GPS signal fraud, and the false data injection attack is an attack mode with extremely strong secrecy. The network attack can directly falsify the measured value or exchange data information among different measuring devices, so that the measured data is placed at the wrong position in the data server, and the data server has stronger secrecy and has strong interference effect on the network attack detection. In recent years, more WAMS network attack events occur, which puts higher defense requirements on the power grid control system. The existing power grid synchronous measurement system mainly has the following 2 problems for network attack detection: 1. the network attack is fast in conversion and various in types, partial false data injection attacks have strong secrecy, and the fact that how to design accurate and efficient network attack detection is difficult to find due to the fact that actually measured signals are affected by disturbance such as noise, harmonic waves and the like is difficult to find out, and higher requirements are provided for the characteristic extraction of the network attack; 2. the wide area measurement system has large data volume and high requirement on network attack detection capability, the method is required to be suitable for large data processing, and the real-time requirement on the network attack identification method is high.
Disclosure of Invention
The technical problems to be solved by the invention are as follows: aiming at the problems in the prior art, the invention provides a network attack identification method and system for smart grid wide area synchronous measurement.
In order to solve the technical problems, the invention adopts the technical scheme that:
a network attack identification method for wide-area synchronous measurement of a smart grid comprises the following steps:
s101, decomposing the measurement data by using variation mode to VMDf(t) Decomposition into modal componentsIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuring dataf(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, inputting the DOST feature matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack.
Optionally, step S104 includes:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the basis function of (2)v=v+0.5 carry-in basis functions and determine different frequency multiplication numbers according to basis functionsmA DOST coefficient matrix is constructed according to the DOST coefficient matrix to obtain a value of (A)N/2,N) Of DOST feature matrix of (1), whereinNAs a disturbance componenty(t) The number of points of (a) is,vis the center of the frequency band;
s202, according to the number of the disturbance componentsNCalculating maximum frequency of multiplication respectively
Figure DEST_PATH_IMAGE001
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Figure DEST_PATH_IMAGE002
Calculating the minimum number of columns
Figure DEST_PATH_IMAGE003
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Figure DEST_PATH_IMAGE004
Doubling and then recombining to obtain a compressedA size ofN/2,N/4) The DOST feature matrix of (1).
Optionally, the convolutional neural network adopted in step S105 includes an expanded bi-normal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a full connection layer, and a softmax classifier, which are connected in sequence.
Optionally, the expanded bi-normal convolutional layer DDNC is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of an input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the cavity convolutional, the other path of the input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the two normal convolutions which are sequentially cascaded, and an output feature diagram of the cavity convolutional and an output feature diagram of the two normal convolutions which are sequentially cascaded are fused to form an output feature diagram of the expanded bi-normal convolutional layer DDNC.
Optionally, a function expression of the expanded binormal convolution layer DDNC processing the input feature map is:
Figure DEST_PATH_IMAGE005
，
in the above formula, the first and second carbon atoms are,
Figure DEST_PATH_IMAGE006
in order to expand the output characteristic diagram of the binormal convolution layer DDNC,
Figure DEST_PATH_IMAGE007
to expand the input profile of the binormal convolution layer DDNC,w i andb i respectively represent the firstiThe weights and bias terms of the filter kernels, the symbol is a one-dimensional convolution,
Figure DEST_PATH_IMAGE008
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the void convolution at the 1 st time and the normal convolution at the 2 nd time.
Optionally, a function expression of the batch normalization layer BN for processing the output characteristic graph of the expanded bi-normal convolution layer DDNC is as follows:
Figure DEST_PATH_IMAGE009
，
in the above formula, the first and second carbon atoms are,
Figure DEST_PATH_IMAGE010
is an output characteristic diagram of the batch normalization layer BN,γandβin order to train the parameters of the device,
Figure DEST_PATH_IMAGE011
output characteristic diagram of DDNC (doubly normal convolutional layer network) for expanded binormal convolutional layer
Figure 839683DEST_PATH_IMAGE006
And (3) normalized processing results of (1), and includes:
Figure DEST_PATH_IMAGE012
，
Figure DEST_PATH_IMAGE013
，
in the above formula, m is the number of filter kernels;
Figure DEST_PATH_IMAGE014
represents a constant to ensure that it is not divided by zero;
Figure DEST_PATH_IMAGE015
the variance is indicated.
Optionally, the function expression of the maximum pooling layer is:
Figure DEST_PATH_IMAGE016
，
in the above-mentioned formula, the compound has the following structure,wis the firstiStep of a feature, t is the areanThe set of sequences of (a) is,
Figure DEST_PATH_IMAGE017
is a regionnIs normalized in batches corresponding to the sequence set tOutput profile of layer BN, and output length of maximum pooling layerLIs composed ofL=((x-m)/s+1-n)/w+1，mAndsrespectively the length and the step of the convolution.
Optionally, the functional expression of the softmax classifier is:
Figure DEST_PATH_IMAGE018
，
in the above formula, the first and second carbon atoms are,
Figure DEST_PATH_IMAGE019
representation recognition as a classk i Probability of (2), maximum probability value max (p) Is indicative of the type of attack identified,y i andk i respectively representing the number of output classes and feature matrix classes,
Figure DEST_PATH_IMAGE020
the feature map output to the softmax classifier for the full connectivity layer,krepresenting the total number of categories of the spatial features.
In addition, the invention also provides a network attack identification system facing the wide area synchronous measurement of the smart grid, which comprises a microprocessor and a memory which are connected with each other, wherein the microprocessor is programmed or configured to execute the network attack identification method facing the wide area synchronous measurement of the smart grid.
In addition, the invention also provides a computer-readable storage medium, in which a computer program is stored, and the computer program is used for being programmed or configured by a microprocessor to execute the network attack identification method for the smart grid wide area synchronization measurement.
Compared with the prior art, the invention mainly has the following advantages: the method of the invention comprises the step of decomposing the measurement data by using the variational mode VMDf(t) Decomposing into a plurality of modal components; extracting a common component from the plurality of modal components; by measuring dataf(t) By subtracting a common component to obtain information containing spatial positionDisturbance componenty(t) (ii) a Will disturb the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation; inputting the DOST characteristic matrix into the trained convolutional neural network to obtain measurement dataf(t) And identifying a corresponding network attack. The invention can extract the DOST characteristic matrix containing the spatial position information from different power grid synchronous measurement data, can carry out attack detection on the power grid synchronous measurement data through the convolutional neural network under different network attacks, and can quickly identify whether the measurement system is attacked by the network.
Drawings
FIG. 1 is a schematic diagram of a basic flow of a method according to an embodiment of the present invention.
Fig. 2 is a schematic structural diagram of a convolutional neural network used in the embodiment of the present invention.
Fig. 3 is the original DOST feature matrix obtained in step S104 in the embodiment of the present invention.
Fig. 4 is a compressed DOST feature matrix in an embodiment of the invention.
FIG. 5 is a diagram illustrating a comparison between a hole convolution and a normal convolution according to an embodiment of the present invention.
FIG. 6 is a schematic diagram of an expanded binormal convolutional layer DDNC in an embodiment of the present invention.
Detailed Description
As shown in fig. 1, the network attack identification method for smart grid wide area synchronous measurement in the present embodiment includes:
s101, decomposing the measurement data by using variation mode to VMDf(t) Decomposition into modal componentsIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuring dataf(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, mixingInputting the well-trained convolutional neural network by the DOST characteristic matrix to obtain the measured dataf(t) And identifying a corresponding network attack.
The metrology data may be decomposed using variational modal decomposition of VMD in step S101f(t) Decomposition into a plurality of modal components having sparse characteristics and limited bandwidthIMF i The variational modal decomposition VMD is an existing modal decomposition method, and the variational modal decomposition VMD method extracts measurement dataf(t) Modal component ofIMF i As shown in the following formula (1):
Figure DEST_PATH_IMAGE021
，（1）
in the above-mentioned formula, the compound has the following structure,
Figure DEST_PATH_IMAGE022
representing modal componentsIMF i Mode function at time t
Figure DEST_PATH_IMAGE023
，
Figure DEST_PATH_IMAGE024
As modal componentsIMF i The magnitude at the time t is,
Figure DEST_PATH_IMAGE025
as modal componentsIMF i Phase at time t. Obtaining the last page through calculating the second gradient decompositionIMF i Satisfying the constraint condition shown in the formula (2), and introducing a secondary penalty function
Figure DEST_PATH_IMAGE026
Sum Lugrange multiplier solutionIMF i Is used to constrain the optimal solution of the variational problem.
Figure DEST_PATH_IMAGE027
，（2）
In the formula：
Figure DEST_PATH_IMAGE028
To representtPartial derivatives of (d);
Figure DEST_PATH_IMAGE029
representing a modal function
Figure 776677DEST_PATH_IMAGE023
The center of frequency of (a);
Figure DEST_PATH_IMAGE030
represents a unit pulse function;f(t) The measured data is represented by the measured data,jis an imaginary unit. It should be noted that the present embodiment relates to only the application of the variational modal decomposition VMD method, and does not relate to the improvement of the variational modal decomposition VMD method, so that the details of the implementation of the variational modal decomposition VMD are not described in detail herein. In this embodiment, the mode number of the variational mode decomposition VMD is determined by observing the center frequencyi=6, i.e. decomposition into modal components in step S101IMF i Is referred to as decomposition into six modal componentsIMF 1 ～IMF 6 The modal components of different frequencies are respectively corresponding to the high frequency and the low frequency.
From a plurality of modal components in step S102IMF i When the common component is extracted, the common component refers to the whole variation trend and the measured dataf(t) The same certain modal componentIMF i . The comparison shows that the sixth modal componentIMF 6 Global trend and measurement dataf(t) The same, therefore, the present embodiment is from multiple modal components in step S102IMF i When the common component is extracted, the common component is the sixth modal componentIMF 6 。
The calculation in step S103 can be expressed as:y(t)= f(t)- IMF j thereby obtaining a disturbance component having spatial position informationy(t)。
Perturbing in step S104Component(s) ofy(t) The calculation function expression used for extracting the DOST (discrete orthogonal S transform) characteristic matrix (time-frequency characteristic) is as follows:
Figure DEST_PATH_IMAGE031
，（3）
in the above formula, the first and second carbon atoms are,
Figure DEST_PATH_IMAGE032
representing input disturbance componentsy(t) The spatial characteristics obtained by the calculation are used,Nthe number of points of the disturbance component is represented,
Figure DEST_PATH_IMAGE033
to represent kΔ t The component of the disturbance in time,
Figure DEST_PATH_IMAGE034
which is a representation of the orthogonal basis functions,
Figure DEST_PATH_IMAGE035
to representkΔ t ，vIs the center of the band;qas indicated by the time-location of the time,βis thatvBandwidth in the center of the band, where:k=0,1…Nand has:
Figure DEST_PATH_IMAGE036
，（4）
in the above-mentioned formula, the compound has the following structure,
Figure DEST_PATH_IMAGE037
the number of the units of the imaginary number is expressed,
Figure 719357DEST_PATH_IMAGE026
the center of the time window is represented,
Figure DEST_PATH_IMAGE038
，k=0,1…N。
from the equations (3) and (4), a certain frequency multiplication factor can be deducedmDOST coefficient matrix of lowerA certain number of times calculatedmThe following DOST coefficient matrix is:
Figure DEST_PATH_IMAGE039
，（5）
the DOST coefficient matrix is defined byA 1 ,A 2 ,…,A m ｝mEach matrix block is composed of the following components, the numerical values in each matrix block are the same:
Figure DEST_PATH_IMAGE040
，（6）
Figure DEST_PATH_IMAGE041
，（7）
Figure DEST_PATH_IMAGE042
，（8）
wherein the content of the first and second substances,y(t) In order to be a disturbance component,
Figure DEST_PATH_IMAGE043
representing coefficients
Figure DEST_PATH_IMAGE044
Is composed of
Figure DEST_PATH_IMAGE045
The orthogonal basis functions of the time-of-flight,
Figure DEST_PATH_IMAGE046
representing coefficients
Figure 346778DEST_PATH_IMAGE044
Is composed of
Figure DEST_PATH_IMAGE047
The orthogonal basis functions of the time-of-flight,
Figure DEST_PATH_IMAGE048
representing coefficients
Figure 372503DEST_PATH_IMAGE044
Is composed of
Figure DEST_PATH_IMAGE049
Orthogonal basis functions of time, all frequency multiplicationmThe DOST coefficient matrix below can form a DOST feature matrix, and as shown in FIG. 3, the original DOST feature matrix has a size of (N,N). In FIG. 3, coefficients
Figure 780482DEST_PATH_IMAGE044
Where v represents the center of the band; q is time positioning; β is the bandwidth of the v band center, and is calculated as follows:
Figure DEST_PATH_IMAGE050
，（9）
Figure DEST_PATH_IMAGE051
，（10）
in the above formula, the first and second carbon atoms are,mis the frequency multiplication factor.
Referring to the foregoing functional expression of the DOST coefficient matrix, since the values in the single matrix block are the same, i.e., the values of each column and each row under the same coefficient matrix in the DOST feature matrix are the same, the redundant data will increase with the increase of the matrix. To implement a small parameter convolutional neural network, the compression matrix may reduce the detection pressure of the feature matrix identification network. The method is used for compressing the DOST characteristic matrix on the basis of not losing the original DOST characteristic matrix structure. In this embodiment, step S104 includes:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the basis function of (2)v=v+0.5 into the orthogonal basis functions and determining the different frequency multiplication numbers according to the orthogonal basis functionsmAnd constructing a DOST coefficient matrix with a size of (A)N/2,N) DOST feature matrix of (1), whereinNIs a disturbance componenty(t) The number of points of (c) is,vis the center of the frequency band;
s202, according to the number of the disturbance componentsNCalculating maximum frequency of multiplication respectively
Figure 713803DEST_PATH_IMAGE001
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Figure 382682DEST_PATH_IMAGE002
Calculate the minimum number of columns
Figure 782570DEST_PATH_IMAGE003
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Figure 802479DEST_PATH_IMAGE004
Doubling, then recombining to obtain a compressed size of: (N/2,N/4) The DOST characteristic matrix is reduced by 4 times, so that the network structure complexity of the convolutional neural network adopted in the step S105 can be reduced, the attack identification speed and accuracy are improved, and the network attack real-time identification is realized when the data volume in the smart grid wide area synchronous measurement system is large.
The compressed DOST feature matrix obtained by recombination in this embodiment is shown in FIG. 4, and it can be known from FIG. 4 that: frequency of doublingm =0, where the DOST coefficient matrix is (1, L) in size and 1 in number, and the frequency multiplication factorm=Coefficient at 0
Figure 539490DEST_PATH_IMAGE044
The values of (a) are shown in fig. 4; frequency multiplication factorm=1, where the size of the DOST coefficient matrix is (1, L), the number is 1, the frequency multiplication factorm=Coefficient of 1 hour
Figure 62876DEST_PATH_IMAGE044
The values of (a) are shown in fig. 4; frequency of current multiplicationm=2, where the DOST coefficient matrix is (2, L/2) in size and 2 in number, and the frequency multiplication factorm=Coefficient of 2 hours
Figure 899245DEST_PATH_IMAGE044
The values of (a) are shown in FIG. 4; frequency of current multiplicationm=3, where the DOST coefficient matrix is (4, L/4) in size and 4 in number, and the frequency multiplication factor ism=Coefficient of time 3
Figure 140870DEST_PATH_IMAGE044
The values of (a) are shown in fig. 4; for any number of multiplesmWherein the size of the DOST coefficient matrix is: (
Figure DEST_PATH_IMAGE052
1) in an amount of
Figure 619256DEST_PATH_IMAGE052
。
As shown in fig. 2, the convolutional neural network used in step S105 of this embodiment includes an expanded binormal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a fully-connected layer, and a softmax classifier that are connected in sequence. The local image translation invariance of the convolutional neural network ensures that the position in the image has no influence on feature extraction, and the characteristic enables the convolutional neural network to learn more abstract data, but is not sensitive to the position information any more, which needs further improvement for the task of extracting the spatial position information in the spatial feature matrix. In order to extract the spatial position information included in the DOST feature matrix sufficiently, position information is extracted by hole Convolution, but at this time, a Convolution scheme in which the hole Convolution (scaled Convolution) and 2 Normal convolutions (Normal Convolution) are merged is proposed and expressed by DDNC (scaled Double Normal Convolution). As shown in fig. 6, the expanded binormal convolutional layer DDNC in this embodiment is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of the input feature diagram of the expanded binormal convolutional layer DDNC is used as the input of the cavity convolutional, the other path is used as the input of the two normal convolutions which are sequentially cascaded, and the output feature diagram of the cavity convolutional and the output feature diagrams of the two normal convolutions which are sequentially cascaded are fused to form the output feature diagram of the expanded binormal convolutional layer DDNC.
The larger receptive field in the convolutional neural network will retain more spatial position information, but will bring more computational burden, and at this time, the hole convolution can solve this problem, as shown in fig. 5, where (a) is normal convolution (kernel = 3, stride =1, padding = 0), input is at the lower side and input at the upper side, the lower side is shaded in gray to form a convolution kernel, kernel represents the size of the convolution kernel, stride represents the moving step size, and padding represents padding. (b) The result is a hole convolution (kernel = 3, stride =1, rate =1, padding = 0), the lower side is input, the upper side is input, the lower side is shaded in gray to form a convolution kernel, and the rate represents the expansion rate. (c) Normal convolution (kernel = 5, stride =1, padding = 0), (d) normal convolution (kernel = 3, stride =1, padding = 0). The hole convolution is to fill 0 in the filter, and how much the filling is controlled by the expansion rate. The hole convolution can enlarge the receptive field of the filter under the condition of not introducing any redundant parameters and calculated quantity, and extraction of space position characteristics is realized; on the other hand, when the expansion rate is set to be different, the hole convolution has different receptive fields, and multi-scale spatial features can be extracted. However, the convolution kernel in the hole convolution is not continuous, all points in the spatial feature matrix cannot be calculated, information is extracted in a checkerboard mode, continuity of the spatial feature information is lost at this time, and detailed information in the spatial feature matrix cannot be acquired possibly. Therefore, the characteristics of the void convolution are summarized, and the main advantages comprise that (1) a larger receptive field is provided with the same calculation cost; (2) By setting different expansion rates, multi-scale information can be captured. The main disadvantages are as follows: the extracted spatial feature information is discontinuous, and the detail information is lost, but the defect can be realized by the normal convolution of a small sense eye, so that a mode of fusing the cavity convolution and the normal convolution is provided for extracting the spatial position information and the corresponding detail information of the spatial feature matrix. However, how to fuse the void convolution and the normal convolution ensures that the spatial information of the spatial feature matrix is extracted without losing the detail information, and a new mode is provided in the text to realize the fusion of the corresponding spatial information and the detail information. In fig. 5, (a) and (b) sense that the eye size is different, the range of each convolution is different, and the information extraction positions are not uniform. If the moving step stride = 2 in the convolution in (a) in fig. 5, the output size is the same under the normal convolution and the hole convolution and the convolution kernel, and the output is directly added at this time, or the outputs are merged in a merging manner, (a) the detail information obtained by the normal convolution and the orientation of the space information obtained by (b) in fig. 5 in the space feature matrix are not consistent, and the most effective feature fusion cannot be achieved. Further, it is found that the above problem can be solved under the condition that certain conditions are satisfied, where the convolution kernels kernel in (b) and (c) in fig. 5 are different, but the reception field and the output size are the same, and at this time, the detail information and the spatial information extracted in (b) and (c) in fig. 5 are consistent, but the convolution of the normal convolution reception eye and the cavity convolution is consistent, and not an optimal method, and (d) in fig. 5 is shown as a quadratic convolution under the same parameters in (a) in fig. 5, and at this time, the input in (d) in fig. 5 and the convolution of the cavity in (b) in fig. 5 are consistent, and at this time, the spatial information and the detail information extracted in the spatial matrix are in a corresponding relationship, thereby proposing a convolution cavity +2 normal convolution fusion modes, and when the following conditions are satisfied:
Figure DEST_PATH_IMAGE053
，（11）
in the above-mentioned formula, the compound has the following structure,nrepresenting the input size of a spatial feature matrix on one side;mthe magnitude is input for one side of the convolution kernel,swhich represents the convolution step size stride and,rindicating a hole convolution expansion rate, padding =0; the convolution structure is shown in FIG. 6, the input characteristic size of the cavity convolution is n x n, the expansion rate is 1, the convolution kernel size is m x m, and the output characteristic size is [ n- (m + (m-1) × r ]]S +1; the first of the two normal convolutions in the cascade has an input characteristic size of n x n, a convolution kernel size of m x m, and an output characteristic size of (m)n-m)/s +1; the second one of the two normal convolutions in the cascade has input characteristic size of (n-m)/s +1, convolution kernel size of m, and output characteristic size of [ (n-m)/s + 1-m-](s + 1), the size of the output characteristic graph of the final expanded binormal convolution layer DDNC is [ n- (m + (m-1) × r ]]/s+1。
The expanded bi-normal convolutional layer DDNC is used for extracting features, and the expanded bi-normal convolutional layer DDNC has the length ofLOf (2) a signalxThe output features are calculated in the form of a convolution. In this embodiment, the function expression of processing the input feature graph by the expanded binormal convolution layer DDNC is as follows:
Figure 528306DEST_PATH_IMAGE005
，（12）
in the above-mentioned formula, the compound has the following structure,
Figure 269997DEST_PATH_IMAGE006
to expand the output profile of the bi-normal convolutional layer DDNC,
Figure 998919DEST_PATH_IMAGE007
to expand the input profile of the binormal convolution layer DDNC,w i andb i respectively represent the firstiThe weights and bias terms of the filter kernels, the symbol is a one-dimensional convolution,
Figure 280996DEST_PATH_IMAGE008
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the hole convolution at the 1 st and the normal convolution at the 2 nd time.
The batch normalization layer BN is used for realizing data standardization, after the convolution layer is added, a BN layer is added, the input of each layer of neural network can be kept in the same distribution, and the change value of the loss function and the gradient transformation are increased by reducing the input change value, so that the higher convergence speed is obtained. In this embodiment, the function expression of the batch normalization layer BN for processing the output characteristic diagram of the expanded binormal convolution layer DDNC is as follows:
Figure 778973DEST_PATH_IMAGE009
，（13）
in the above formula, the first and second carbon atoms are,
Figure 81778DEST_PATH_IMAGE010
is an output characteristic diagram of the batch normalization layer BN,γandβin order to train the parameters of the device,
Figure 32417DEST_PATH_IMAGE011
output characteristic diagram of DDNC (doubly normal convolutional layer network) for expanded binormal convolutional layer
Figure 67586DEST_PATH_IMAGE006
And the normalized result of (1) and includes:
Figure 420070DEST_PATH_IMAGE012
，
Figure 893777DEST_PATH_IMAGE013
，（14）
in the above formula, m is the number of filter kernels;
Figure 331712DEST_PATH_IMAGE014
represents a constant to ensure that it is not divided by zero;
Figure 955591DEST_PATH_IMAGE015
represents the variance;
the max-pooling layer is used to reduce model parameters and filtering characteristics. In this embodiment, the function expression of the maximum pooling layer is:
Figure 428161DEST_PATH_IMAGE016
，（15）
in the above-mentioned formula, the compound has the following structure,wis the firstiStep of a feature, t is the areanThe set of sequences of (a) is,
Figure 948135DEST_PATH_IMAGE017
is a regionnThe output characteristic diagram of the batch normalization layer BN corresponding to the sequence set t, and the output length of the maximum normalization layerLIs composed ofL=((x-m)/s+1-n)/ w +1，mAndsrespectively the length and the step of the convolution.
Both fully connected layers are used to handle the high-level features of the multi-dimensional structure. Is provided withZ f For the output of the full link layer, in the last layer, a softmax classifier is used to classify the features, and the functional expression of the softmax classifier in this embodiment is:
Figure 873365DEST_PATH_IMAGE018
，（16）
in the above formula, the first and second carbon atoms are,
Figure 363253DEST_PATH_IMAGE019
representation recognition as a categoryk i Probability of (2), maximum probability value max: (p) Is indicative of the identified type of attack,y i andk i respectively representing the number of output classes and feature matrix classes,
Figure 424750DEST_PATH_IMAGE020
is the output of the second fully-connected layer,krepresenting the total number of categories of the spatial features. The purpose of the softmax classifier is to constrain the output vector to 0,1]。
The total parameter number of the convolutional neural network LCNN adopted in this embodiment is 2109108, and each parameter is a 32-bit floating point number, so that it can be calculated that the system memory occupied by the model is about 7.7MB. For the classic CNN models (such as inclusion-v 3, alexNet and VGG 16), the model memory is about 100MB, 200MB and 500MB or more in sequence, which requires more computation power. Therefore, the convolutional neural network LCNN used in the present embodiment has an advantage of low computational consumption.
In summary, the network attack identification method for smart grid wide area synchronous measurement in the embodiment can extract spatial features from different grid synchronous measurement data, and can perform attack detection on the grid synchronous measurement data through the adopted convolutional neural network LCNN under different network attacks, so as to quickly and accurately identify whether the measurement system is attacked by the network.
In addition, the embodiment also provides a network attack identification system facing the smart grid wide area synchronous measurement, which comprises a microprocessor and a memory which are connected with each other, wherein the microprocessor is programmed or configured to execute the network attack identification method facing the smart grid wide area synchronous measurement. In addition, the present embodiment also provides a computer-readable storage medium, where a computer program is stored in the computer-readable storage medium, and the computer program is programmed or configured by a microprocessor to execute the network attack identification method for smart grid wide area synchronization measurement.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-readable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein. The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks. These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
The above description is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments, and all technical solutions belonging to the idea of the present invention belong to the protection scope of the present invention. It should be noted that modifications and embellishments within the scope of the invention may occur to those skilled in the art without departing from the principle of the invention, and are considered to be within the scope of the invention.

Claims (7)

1. A network attack identification method for smart grid wide area synchronous measurement is characterized by comprising the following steps:
s101, decomposing the measurement data by using variation mode to VMDf(t) Decomposition into modal componentsIMF i ；
S102, from a plurality of modal componentsIMF i Extracting common components thereinIMF j ；
S103, measuring dataf(t) Subtracting the common componentIMF j Obtaining a disturbance component containing spatial position informationy(t)；
S104, disturbing the componenty(t) Extracting a DOST characteristic matrix by using discrete orthogonal S transformation;
s105, inputting the DOST feature matrix into the trained convolutional neural network to obtain measurement dataf(t) Corresponding networkAttack recognition results;
step S104 includes:
s201, according to the disturbance componenty(t) Positive frequency band of the constructed real signalpAnd negative frequency band-pIs conjugate symmetric with respect to the orthogonal basis function ofv=v+0.5 into the orthogonal basis functions and determining the different frequency multiplication numbers according to the orthogonal basis functionsmAnd constructing a DOST coefficient matrix with a size of (A)N/2,N) Of DOST feature matrix of (1), whereinNIs a disturbance componenty(t) The number of points of (c) is,vis the center of the frequency band; the function expression of the orthogonal basis function is as follows:
Figure 971691DEST_PATH_IMAGE001
，
in the above formula, the first and second carbon atoms are,
Figure 357673DEST_PATH_IMAGE002
is a function of the orthogonal basis function,
Figure 137410DEST_PATH_IMAGE003
is composed ofkΔ t At the moment of time, the time of day,vis the center of the band;qindicated as a position in time, is,βis thatvBandwidth in the center of the band, where:k=0,1…N，Nrepresenting the number of disturbance component points;
Figure 594937DEST_PATH_IMAGE004
the number of the units of an imaginary number is expressed,
Figure 674888DEST_PATH_IMAGE005
represents the center of a time window, an
Figure 825247DEST_PATH_IMAGE006
；
S202, according to the number of the disturbance componentsNSeparately calculating the maximum frequency multiplication number
Figure 561122DEST_PATH_IMAGE007
According to the number of points of the disturbance componentNAnd maximum frequency of multiplication
Figure 25601DEST_PATH_IMAGE008
Calculating the minimum number of columns
Figure 287955DEST_PATH_IMAGE009
；
S203, the size is: (N/2,N) The row number of each DOST coefficient matrix in the DOST characteristic matrix is kept unchanged, and the column number is reduced
Figure 484581DEST_PATH_IMAGE010
Doubled, then recombined to a compressed size of: (N/2,N/4) The feature matrix of the most significant bit (DOST),
the convolutional neural network adopted in the step S105 includes an expanded bi-normal convolutional layer DDNC, a batch normalization layer BN, a maximum pooling layer, a full-link layer, and a softmax classifier which are connected in sequence, the expanded bi-normal convolutional layer DDNC is a convolutional layer obtained by fusing a cavity convolutional layer and two normal convolutions, one path of an input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the cavity convolution, the other path of the input feature diagram of the expanded bi-normal convolutional layer DDNC is used as an input of the two normal convolutions which are cascaded in sequence, and an output feature diagram of the cavity convolution and an output feature diagram of the two normal convolutions which are cascaded in sequence are fused to form an output feature diagram of the expanded bi-normal convolutional layer DDNC.
2. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 1, wherein the function expression of the expanded bi-normal convolutional layer DDNC for processing the input feature graph is as follows:
Figure 504490DEST_PATH_IMAGE011
，
in the above formula, the first and second carbon atoms are,
Figure 241502DEST_PATH_IMAGE012
to expand the output profile of the bi-normal convolutional layer DDNC,
Figure 561624DEST_PATH_IMAGE013
to expand the input profile of the binormal convolution layer DDNC,w i andb i respectively representiThe weights and bias terms of the filter kernels, the symbol x is a one-dimensional convolution,
Figure 991469DEST_PATH_IMAGE014
in order to activate the function(s),nwhich represents the number of convolutions of the signal,n=1,2 are respectively the hole convolution at the 1 st and the normal convolution at the 2 nd time.
3. The network attack identification method for the smart grid wide area synchronous measurement according to claim 1, wherein a function expression of the batch normalization layer BN on the output characteristic graph of the expanded bi-normal convolution layer DDNC is as follows:
Figure 92149DEST_PATH_IMAGE015
，
in the above-mentioned formula, the compound has the following structure,
Figure 367272DEST_PATH_IMAGE016
for the output profile of the batch normalization layer BN,γandβin order to train the parameters of the device,
Figure 479585DEST_PATH_IMAGE017
output characteristic diagram of DDNC (doubly normal convolutional layer numerical control) for pair expansion of bi-normal convolutional layer
Figure 411156DEST_PATH_IMAGE012
And (3) normalized processing results of (1), and includes:
Figure 343340DEST_PATH_IMAGE018
，
Figure 422155DEST_PATH_IMAGE019
，
in the above formula, m is the number of filter kernels;
Figure 513607DEST_PATH_IMAGE020
represents a constant to ensure that it is not divided by zero;
Figure 285254DEST_PATH_IMAGE021
the variance is indicated.
4. The smart grid wide area synchronous measurement-oriented network attack identification method according to claim 1, wherein the function expression of the maximum pooling layer is as follows:
Figure 970314DEST_PATH_IMAGE022
，
in the above formula, the first and second carbon atoms are,wis the firstiStep of a feature, t is the areanThe sequence set of (a) is set,
Figure 852819DEST_PATH_IMAGE023
is a regionnThe output characteristic diagram of the batch normalization layer BN corresponding to the sequence set t, and the output length of the maximum pooling layerLIs composed ofL=((x-m)/s+1-n)/w+1，mAndsrespectively the length and the step of the convolution.
5. The network attack identification method for smart grid wide area synchronous measurement according to claim 1, wherein a function expression of the softmax classifier is as follows:
Figure 2041DEST_PATH_IMAGE024
，
in the above formula, the first and second carbon atoms are,
Figure 538064DEST_PATH_IMAGE025
representation recognition as a classk i Probability of (2), maximum probability value max (p) Is indicative of the type of attack identified,y i andk i respectively representing the number of output classes and feature matrix classes,
Figure 975999DEST_PATH_IMAGE026
the feature map output to the softmax classifier for the fully connected layer,krepresenting the total number of classes of spatial features.
6. A network attack recognition system for smart grid wide area synchronous measurement, comprising a microprocessor and a memory which are connected with each other, wherein the microprocessor is programmed or configured to execute the network attack recognition method for smart grid wide area synchronous measurement according to any one of claims 1 to 5.
7. A computer-readable storage medium, in which a computer program is stored, wherein the computer program is programmed or configured by a microprocessor to execute the network attack identification method for smart grid wide area synchronization measurement according to any one of claims 1 to 5.
CN202211264062.4A 2022-10-17 2022-10-17 Network attack identification method and system for wide-area synchronous measurement of smart power grid Active CN115333870B (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN202211264062.4A CN115333870B (en) 2022-10-17 2022-10-17 Network attack identification method and system for wide-area synchronous measurement of smart power grid

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN202211264062.4A CN115333870B (en) 2022-10-17 2022-10-17 Network attack identification method and system for wide-area synchronous measurement of smart power grid

Publications (2)

Publication Number Publication Date
CN115333870A CN115333870A (en) 2022-11-11
CN115333870B true CN115333870B (en) 2022-12-13

Family

ID=83915480

Family Applications (1)

Application Number Title Priority Date Filing Date
CN202211264062.4A Active CN115333870B (en) 2022-10-17 2022-10-17 Network attack identification method and system for wide-area synchronous measurement of smart power grid

Country Status (1)

Country Link
CN (1) CN115333870B (en)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116451006B (en) * 2023-06-12 2023-08-25 湖南大学 PMU data recovery method and system based on enhanced time sequence mode attention

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110035090A (en) * 2019-05-10 2019-07-19 燕山大学 A kind of smart grid false data detection method for injection attack
CN111145044A (en) * 2020-01-09 2020-05-12 三峡大学 Power quality disturbance detection method for power distribution network based on EWT and MFDE
CN111708350A (en) * 2020-06-17 2020-09-25 华北电力大学（保定） Hidden false data injection attack method for industrial control system

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US10931702B2 (en) * 2018-04-24 2021-02-23 Cyberfortress, Inc. Vulnerability profiling based on time series analysis of data streams

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110035090A (en) * 2019-05-10 2019-07-19 燕山大学 A kind of smart grid false data detection method for injection attack
CN111145044A (en) * 2020-01-09 2020-05-12 三峡大学 Power quality disturbance detection method for power distribution network based on EWT and MFDE
CN111708350A (en) * 2020-06-17 2020-09-25 华北电力大学（保定） Hidden false data injection attack method for industrial control system

Non-Patent Citations (3)

* Cited by examiner, † Cited by third party
Title
Variational Mode Decomposition and Decision Tree Based Detection and Classification of Power Quality Disturbances in Grid-Connected Distributed Generation System;Pankaj D. Achlerkar etl;《IEEE TRANSACTIONS ON SMART GRID》;20180731;全文 *
考虑网络攻击的广域测量信号分析关键技术研究;邱伟;《中国博士论文全文数据库信息科技辑》;20211231;全文 *
面向快速频率响应***的网络攻击防御控制策略;孙凯祺等;《中国电机工程学报》;20210820;全文 *

Also Published As

Publication number Publication date
CN115333870A (en) 2022-11-11

Similar Documents

Publication Publication Date Title
WO2020168844A1 (en) Image processing method, apparatus, equipment, and storage medium
CN111367961B (en) Time sequence data event prediction method and system based on graph convolution neural network and application thereof
CN111339321B (en) Triple authenticity detection method and device in knowledge graph
CN111860398B (en) Remote sensing image target detection method and system and terminal equipment
CN108595539A (en) A kind of recognition methods of trace analogical object and system based on big data
CN106295613A (en) A kind of unmanned plane target localization method and system
CN115333870B (en) Network attack identification method and system for wide-area synchronous measurement of smart power grid
CN111382930B (en) Time sequence data-oriented risk prediction method and system
CN111047078B (en) Traffic characteristic prediction method, system and storage medium
CN110210278A (en) A kind of video object detection method, device and storage medium
CN110084609B (en) Transaction fraud behavior deep detection method based on characterization learning
CN109145841A (en) A kind of detection method and device of the anomalous event based on video monitoring
CN108122280A (en) The method for reconstructing and device of a kind of three-dimensional point cloud
CN113269256A (en) Construction method and application of Misrc-GAN model
CN114498619A (en) Wind power prediction method and device
CN114283320A (en) Target detection method based on full convolution and without branch structure
CN116821697B (en) Mechanical equipment fault diagnosis method based on small sample learning
CN117094451B (en) Power consumption prediction method, device and terminal
CN116703568A (en) Credit card abnormal transaction identification method and device
CN113496228B (en) Human body semantic segmentation method based on Res2Net, transUNet and cooperative attention
CN112365525B (en) High-resolution remote sensing image change detection network, method and device
CN114792397A (en) SAR image urban road extraction method, system and storage medium
CN114881850A (en) Point cloud super-resolution method and device, electronic equipment and storage medium
US20230259818A1 (en) Learning device, feature calculation program generation method and similarity calculator
Jia et al. Siamese Meets Diffusion Network: SMDNet for Enhanced Change Detection in High-Resolution RS Imagery

Legal Events

Date Code Title Description
PB01 Publication
PB01 Publication
SE01 Entry into force of request for substantive examination
SE01 Entry into force of request for substantive examination
GR01 Patent grant
GR01 Patent grant