融合状态估计和深度学习的智能电网异常检测模型

兰州理工大学学报 ›› 2025, Vol. 51 ›› Issue (2): 143-151.

融合状态估计和深度学习的智能电网异常检测模型

郑铁军¹, 张宏杰¹, 王景^*2, 王洋²

1.国网宁夏电力有限公司, 宁夏银川 750001;
2.北京科东电力控制系统有限责任公司, 北京 100192

收稿日期:2024-07-31 出版日期:2025-04-28 发布日期:2025-04-29
通讯作者: 王景(1989-),男,河南南阳人,高级工程师.Email:wangjing8145@163.com
基金资助:
国网宁夏电力有限公司科技项目(5229NX230008)

Power system anomaly detection and classification based on state estimation and deep learning

ZHENG Tie-jun¹, ZHANG Hong-jie¹, WANG Jing², WANG Yang²

1. State Grid Ningxia Electric Power Co. Ltd., Yinchuan 750001, China;
2. Beijing Kedong Power Control System Co. Ltd., Beijing100192, China

Received:2024-07-31 Online:2025-04-28 Published:2025-04-29

摘要/Abstract

摘要： 针对Web攻击和DDoS攻击引发的电力系统中一系列难以检测的网络安全事件问题,提出了一种加权最小二乘法、扩展卡尔曼滤波器与两阶段深度学习异常检测模型相融合的智能电网异常检测方法.该方法采用自适应合成采样算法,解决了电力系统中网络安全数据分布不平衡问题;融合加权最小二乘法和扩展卡尔曼滤波器,借助电力系统中的动态非线性特性,通过精确的状态估计提高了智能电网异常检测的准确性,并使用χ²检验和异常检测指数检测了电力系统中的安全风险;在此基础上,将改进的深度神经网络模型和多重BiLSTM网络模型相结合,对网络安全风险事件进行了分类识别.将该方法在CICIDS2017数据集上进行数值模拟验证.数值仿真结果表明该方法能有效检测出各类攻击,具有更好的异常检测能力,并对网络安全风险事件分类精度提升了3.85%.

关键词: 智能电网, 状态估计, 异常检测, 自适应合成采样

Abstract: Aiming at a series of difficult to detect network security events in power system caused by Web attacks and DDoS attacks, a smart power grid anomaly detection method that combines the weighted least squares method, extended Kalman filter, and a two-stage deep learning anomaly detection model is proposed. This method first adopts an adaptive composite sampling algorithm to address the issue of imbalanced distribution of network security data in the power system; Then, by integrating the weighted least squares method and the extended Kalman filter to utilize the dynamic nonlinear characteristics in the power system, the accuracy of intelligent power grid anomaly detection is improved through accurate state estimation, and safety risks in the power system are detected using the chi-square test and anomaly detection indicators; On this basis, the improved deep neural network model and multiple BiLSTM network models are combined to achieve the classification and recognition of network security risk events. Finally, the proposed method was numerical simulation verified on the CICIDS2017 dataset. The numerical simulation results show that this method can effectively detect various attacks, it has better anomaly detection capability and improve the accuracy of network security risk event classification by 3.85%.

Key words: smart grid, state estimation, anomaly detection, adaptive synthetic sampling

中图分类号:

O235

郑铁军, 张宏杰, 王景, 王洋. 融合状态估计和深度学习的智能电网异常检测模型[J]. 兰州理工大学学报, 2025, 51(2): 143-151.

ZHENG Tie-jun, ZHANG Hong-jie, WANG Jing, WANG Yang. Power system anomaly detection and classification based on state estimation and deep learning[J]. Journal of Lanzhou University of Technology, 2025, 51(2): 143-151.

参考文献

[1] 岳芳,王雪珍,姜山.智能电网的网络安全风险及应对策略 [J].科技导报,2024,42(9):6-16.
[2] BALUEV D,ALI M,GRYAZINA E.State of the art approach for comprehensive power system security assessment—real case study [J].International Journal of Electrical Power & Energy Systems,2024,155:109594.
[3] 王以良,周鹏,叶卫,等.基于金字塔网络的非侵入式负荷辨识及其隐私保护方案 [J].计算机工程,2024,50(5):182-189.
[4] 杜奇伟,徐红泉,郑翔,等.面向恶意网络攻击的电力监控系统防御策略设计 [J].控制工程,2024,31(1):185-192.
[5] 金志刚,刘凯,武晓栋.智能电网AMI领域IDS研究综述 [J].信息网络安全,2023,23(1):1-8.
[6] 李坤,孟建,罗广惠,等.面向智能电网的融合通信MEC卸载策略 [J].电力信息与通信技术,2024,22(6):10-17.
[7] AURANGZEB M,WANG Y,IQBAL S,et al.Enhancing cybersecurity in smart grids:deep black box adversarial attacks and quantum voting ensemble models for blockchain privacy-preserving storage [J].Energy Reports,2024,11:2493-2515.
[8] 王素红,唐煜星,郭文豪,等.考虑优先级的智能电网业务调度与资源分配方案 [J].南方电网技术,2024,18(4):59-70+79.
[9] GUTIERREZ S A,BOTERO J F,GOMEZ N G,et al.Next-generation power substation communication networks:IEC 61850 meets programmable networks [J].IEEE Power and Energy Magazine,2023,21(5):58-67.
[10] 石乐义,朱红强,刘袆豪,等.基于相关信息熵和 CNN-BiLSTM的工业控制系统人侵检测 [J].计算机研究与发展,2019,56(11):2330-2338.
[11] YANG Y,SONG R,ZHOU Z.Network intrusion detection method based on GAN-PSO-ELM [J].Computer Engineering and Applications,2020,56(12):66-72.
[12] 丁龙斌,伍仲冬,苏佳丽.基于集成深度森林的入侵检测方法 [J].计算机工程,2020,46(3):144-150.
[13] FU R,WANG J,WANG J,et al.Very fast transient overvoltage calculation and evaluation for 500 kV gas insulated substation power substation with double circuit and long gas insulated substation busbar[J].IET Generation,Transmission & Distribution,2023,17(1):252-262.
[14] TIAN Z,ZHAO N,HILLMANSEN S,et al.Traction power substation load analysis with various train operating styles and substation fault modes [J].Energies,2020,13(11):2788.
[15] ZHAO R,YIN J,XUE Z,et al.An efficient intrusion detection method based on dynamic autoencoder [J].lEEE Wireless Communication Letters,2021,10(8):1707-1711.
[16] HAGHIGHAT M H,LI J.Intrusion detection system using voting-based neural network [J].Tsinghua Science & Technology,2021,26(4):484-495.
[17] SAFALDIN M,OTAIR M,ABUALIGAH L.Improved binary gray wolf optimizer and SVMM for intrusion detection system in wireless sensor networks [J].Journal of Ambient Intelligence and Humanized Computing,2020,12(2):1559-1576.
[18] WANG Q,ZHAO W,REN J.Intrusion detection algorithm based on image enhanced convolutional neural network [J].Journal of Intelligent and Fuzzy Systems,2021,41(1):2183-2194.
[19] ZHANG H,HUANG L,WU C Q,et al.An effective convolutional neural network based on SMOTE and gaussian mixture model for intrusion detection in imbalanced dataset [J].Computer Networks,2020,177(18):107315.
[20] LEE J H,PARK K H.GAN-based imbalanced data intrusion detection system [J].Personal and Ubiquitous Computing,2021,25(1):121-128.
[21] JIANG Y,YAO A,MA H,et al.Digital-twin-based substation operation safety monitoring system [C]//2023 8th International Conference on Intelligent Informatics and Biomedical Sciences (ICIIBMS).Okinawa,Japan:IEEE,2023:16-22.
[22] XU G,ZHANG P.Safe distance monitoring method of substation based on machine vision [C]//2021 International Conference on Neural Networks,Information and Communication Engineering.Bellingham,Washington:SPIE,2021:607-611.
[23] XIE J,LIU C C,SFORNA M,et al.On-line physical security monitoring of power substations [J].International Transactions on Electrical Energy Systems,2016,26(6):1148-1170.
[24] HE H,YANG B,GARCIA E A,et al.ADASYN:adaptive synthetic sampling approach for imbalanced learning [C]//Procedings of the 2008 International Joint Conference on Neural Networks(IJCNN).Hong Kong:IEEE,2008:1322-1328.
[25] MENG Q X,CATCHPOOLE D,SKILLICOM D,et al.Relational autoencoder for feature extraction[C]// Proceedings of the 2017 International Joint Conference on Neural Networks (IJCNN).Anchorage,AK,USA:IEEE,2017:364-371.
[26] SHARAFALDIN I,LASHKARI A H,GHORBANI A A.Toward generating a new intrusion detection dataset and intrusion traffic characterization [C]//Proceedings of the 4th International Conference on Information Systems Security and Privacy.Funchal,Madeira,Portugal:SCITEPRESS,2018:108-116.
[27] BINBUSAYYIS A,VAIYAPURI T.Identifying and benchmarking key features for cyber intrusion detection:an ensemble approach [J].IEEE Access,2019,7(10):106495-106513.
[28] VINAYAKUMAR R,ALAZAB M,SOMAN K P,et al.Deep learning approach for intelligent intrusion detection system[J].IEEE Access,2019,7(8):41525-41550.
[29] CHIBA Z,ABGHOUR N,MOUSSAID K,et al.Intelligent approach to build a deep neural Network based IDS for cloud environment using combination of machine learning algorithms [J].Computers & Security,2019,86(10):291-317.
[30] 郑灿伟,李世明,王禹贺,等.面向ICS的CGAN-DEEPFOREST入侵检测 [J].小型微型计算机系统,2023,44(4):868-874.