# Attack and Protection Technology of Intelligent Terminals for New Energy Internet Transmission, Transformation, and Distribution

Authors: Shengda Wang; Mingming Zhao; Danni Liu; Weijia Su; Song Zhang
Journal: Journal of Control Science and Engineering
 (2022)

---

## Abstract

In order to improve the ability of the new energy Internet to defend against external attacks, the author proposes a dual Markov chain-based FDIA detection method suitable for the new energy Internet. Taking into account the FDIA principles and characteristics of the new energy Internet, and the fact that the new energy Internet contains a large amount of measurement data and changing operating states, the data to be detected is mapped to two different state spaces, and two different Markovs are generated. The detector of FDIA is generated according to the accuracy of energy Internet operation state estimated by the model. The correctness and effectiveness of the proposed detection method are verified by experimental cases. Experimental results show: The proposed FDIA detection method has excellent detection probability and less detection calculation, the detection probability can reach 98.60%, and the false alarm probability is only 1.35%, compared with the support vector machine method, the calculation amount is reduced by an order of magnitude. It is proven that the method can meet the application requirements of the new energy Internet.


---

## Body

## 1. Introduction

Energy Internet is a comprehensive application of advanced communication technology, power electronics technology, and intelligent management technology, connecting distributed renewable energy stations dominated by wind and solar energy, it is a complex system that realizes the interconnection and interaction of power network, natural gas network, transportation network, and information network. In the energy Internet, the energy transfer between various energy sources and the information exchange and communication of intelligent devices are realized by industrial control systems [1]. With the accelerated implementation of “Industry 4.0” and “Integration of Industrialization and Industrialization,” industrial control equipment is more complex and diverse, and the risks of wireless application technology, industrial network viruses, and database management vulnerabilities will become more advanced and persistent threats (Advanced Persistent Threat, APT) into the industrial control system.Data is the core asset of the Energy Internet, in the future, the data sources of the Energy Internet will cover all aspects of energy production, transmission, transaction, consumption, etc., showing the characteristics of extensive sources, large scale, and complex types [2]. The opening, interconnection, and sharing mechanism of the Energy Internet will lead to continuous malicious network attacks, these malicious network attacks take advantage of the coupling between the extensive cyber-physical systems in the Energy Internet, and produce a chain reaction of interactive communication, as a result, it will inevitably pose a great threat to the business system data in the production, transmission, transaction, and consumption of the energy Internet. Therefore, it is particularly important to study the data security of the energy Internet based on network attacks.


## 2. Literature Review

Jember et al. focus on the standardization of global smart grid support projects and innovative academic results in related areas, including generation, transmission, distribution, and microgrids, and including smart grid information management systems such as smart meter reading, real-time status monitoring, and data aggregation analysis modeling, as well as a detailed comprehensive analysis of advanced communication technologies, and pointed out that the smart grid information security threat defense will become a difficult problem that needs to be broken through in the future development of smart grid [3]. Dong proposed a specific framework for secure data aggregation using homomorphic encryption algorithms in a distributed energy environment, the user-end collection device uses homomorphic encryption to encrypt the collected user privacy-sensitive data, and edge nodes such as gateways in the Energy Internet can aggregate the data of users in the area without decryption, although this framework enables efficient data aggregation, it does not consider systems for real-time data collection [4]. In order to solve the problem of personal user privacy caused by frequent data collection, KHanna proposed a scheme for aggregating time series data, which supports high-frequency device data collection, and regularly uploads encrypted data to the aggregator to ensure the privacy of personal data [5]. Zhang proposed to develop a reputation-based trust management scheme for user devices and data centers in cloud systems. However, due to the more dynamic nature of the energy Internet system, device trust management is more complicated. The literature proposes an anonymous wireless LAN authentication protocol [6]. Specifically, replacing a person's real identity with a pseudonym, in order to prevent people from being tracked, however, this solution is not suitable for high-dynamic systems with real-time updates of devices. Zhu Before adding the gated recurrent unit structure to the fully connected layer of the convolutional neural network, a hybrid neural network was established to train the historical measurement data of the power grid. Similarly, the spatial and temporal characteristics of the data were extracted to realize the detection of false data. Detection of Injection Attack (FDIA) [7].The author first analyzes the principle and characteristics of FDIA, and clarifies the construction method of FDIA; Then, an FDIA detection method for the new energy Internet based on dual Markov chains is proposed, which maps the huge measurement vector generated at each sampling moment to 2 distance spaces, and generates 2 Markov chain models to adapt to energy. The ever-changing state of the Internet, at the same time, the FDIA detector is generated according to the accuracy of the energy Internet operating state estimated by each model. Finally, a typical case is used to verify the proposed detection method, which further shows that the proposed FDIA detection method can meet the requirements of the new energy Internet for detection speed and detection accuracy.


## 3. Research Methods

### 3.1. Principles and Characteristics of FDIA

The new energy Internet is a large-scale power information physical system, and the errors of the information system are inseparable from the accidents of the physical system. Therefore, by analyzing the principle of FDIA acting on the new energy Internet, combined with the inherent bad data detection method of the power system, the concealment characteristics of FDIA are obtained, and the diversity characteristics of FDIA are obtained through the actual situation, ensure that the attack examples used in the study meet the requirements of practical applications [8].The principle of FDIA acting on the new energy Internet is shown in Figure1. When the false data vector attacks the information system of the new energy Internet, the measurement vector Z becomes Z+a, which causes the state estimation result x^ to generate a state error vector c, which in turn causes the scheduling model to generate an incorrect scheduling policy control variable u′, eventually, the physical system runs in an abnormal state x′.Figure 1
The schematic diagram of FDIA acting on the new energy Internet.In practical situations, random disturbances of the measurement or telecontrol system will cause the measurement vectorZ to produce bad data with random error characteristics. Bad data is not an attack, and the existing power system state estimation methods have passed rW detection and rN detection, realizing the detection of bad data [9]. The specific bad data detection methods are as follows.Calculate the residualri of the ith measurement, the weighted residual rWi , the regularized residual rNi, and the calculation expressions are shown in equations (1)–(3), respectively.(1)ri=zi−hix^,(2)rWi=riσi,(3)rNi=riσNi.Among them,zi is the value of the ith measurement; σi is the standard deviation of the measurement error of the ith measurement; σNi is the standard deviation of ri; and hix^ is the estimated value of the ith measurement, obtained by substituting x^ (the estimated value of voltage amplitude U and phase θ) into the measurement function hθ,U. The specific measurement function hθ,U includes the branch active power measurement function Pijθ,U, the branch reactive power measurement function Qijθ,U, the node injected active power measurement function Piθ,U, the node injected reactive power measurement function Qiθ,U, and the node voltage amplitude value. The measurement function Ui is shown in formula (4).(4)hθ,U=Pijθ,UQijθ,UPiθ,UQiθ,UUi.Equation (4) is a nonlinear equation system, the resistance component in the equation can be ignored in the transmission network, and it is approximated as a linear equation system. However, for distribution networks with lower voltage levels, the resistive component should not be ignored. Therefore, considering the application requirements of the new energy Internet, the author does not ignore the resistance component [10].If the residual calculation result satisfies formula (5), it means that there is bad data in the measurement vector.(5)maxrwi>δtr1ormaxrNi>δtr2.Among them,δtr1 and δtr2 are the thresholds for detecting rw and rN, respectively.Stealth is an important feature of FDIA, which comes from the vulnerability of bad data detection methods. When there is no false data a and when false data a is included, the calculation expressions of the residuals are shown in equation (6) and equation (7) respectively.(6)r1=Z−hx^,(7)r2=Z+a−hx^+c.Among them,r1 and r2 are the residual vectors when they do not contain and contain false data, respectively.If the ideal attack vector a is constructed to satisfy equation (8), then r1=r2, as a result, the bad data detection method based on residual calculation in the power system fails to detect false data. In other words, existing bad data detection methods are not suitable for FDIA detection [11].(8)a=hx^+c−hx^.Meanwhile, FDIA with cryptic features exhibits diverse features [12]. ①Incomplete attack capabilities lead to different false data with different degrees of sparsity. Let such an attack vector be a′, which is a vector with zero elements that can only achieve attacks on specific measurements. And the residual of the state estimation injected with a′ cannot trigger bad data detection, that is, the residual satisfies Equation (9). ② Different FDIAs have different degrees of influence on the measurement vector Z, resulting in different attack strengths of different FDIAs. The smaller the strength of the attack vector is, the smaller the change of the measurement vector Z is, attacks are hard to detect. The calculation expression of the attack strength Pa (unit is dB) adopted by the author is shown in formula (10).(9)maxrwi>δtr1,maxrNi>δtr2.(10)Pa=20lg∑i=1mai′/zim.Among them,ai′ is the element of a′; m is the number of measurement units.To sum up, FDIA shows inherent concealment and diversity characteristics. In order to meet the requirements of practical applications, the detection method of FDIA should be able to detect various FDIAs.


### 3.2. FDIA Detection Method Suitable for New Energy Internet

According to the Markov chain, the operation state change model of the energy Internet is established, and the difference between the state change caused by FDIA and the normal state change law can be analyzed, and the detection of the energy Internet FDIA can be realized [13].In order to improve the comprehensiveness of detection, so that the detection range of FDIA can cover FDIA with different sparsity and attack strength, and ensure that it is sensitive enough to weak attacks, the author uses two complementary Markov chains to model the operation state of the new energy Internet, and solves the problem that a single Markov chain model cannot effectively distinguish some FDIAs. Therefore, in order to avoid the false detection problem caused by the detection blind spot of a single Markov chain, the FDIA detection method should be generated based on the dual Markov chain model of the new energy Internet [14].(1)The Markov Chain Model of the Operational State of the New Energy Internet.The new energy Internet contains many measurement values with random variation characteristics, studying the state change process of each measurement separately will greatly reduce the computational efficiency. Energy Internet as a whole, and among them, the measurement values are mutually influenced. Therefore, the author studies the measurement vectorZ at each sampling moment as a whole.It can be seen from equations (4) and (8) that, as long as there is an attack vector, the measurement sub-vectors (branch active power measurement Pij, branch reactive power measurement Qij, node injected active power measurement Pi, node injected reactive power measurement Qi, and node voltage amplitude measurement Ui) are subject to change. Therefore, to reduce the amount of data used for detection, this study selects the measurement sub-vectors Pij and Pi to construct a vector ZD, and uses the Markov chain to model the state change process of ZD, and analyzes the state of ZD and its transition law.The state space, one-step transition matrix, and initial probability distribution vector are the three key elements for establishing the Markov chain model of the energy Internet, which together determine the properties of the Markov chain [15].For the state space, by calculating the Euclidean distanced between ZD and the specified reference vector ZB, the similarity between the two is represented, and the evaluation standard of ZD is unified; At the same time, considering that the energy Internet has a large amount of historical measurement data, the measurement vectors with close distance values are processed into the same state, and the distance values are further classified to generate a state space.According to formula (11), the range of the distance value corresponding to the state in the state space is calculated.(11)dmin+i−2l,dmin+ili=1,2,…,NS.Among them,NS is the number of states in the state space; l is the interval; dmin is the minimum value of the distance value d of all historical measurement data, and the calculation expression of d is shown in formula (12).(12)d=∑n=1NzZD,n−ZB,n2.Among them,ZD,n and ZB,n are the nth elements in ZD and ZB, respectively; Nz is the number of elements in ZD.For the one-step transition matrix, the distance of each historical measurement data and its corresponding state are calculated according to (11) and (12), and the one-step transition matrix P from state Si to state Sj is obtained, as shown in formula (13).(13)P=pSi,Sj,(14)pSi,Sj=NijNi.Among them,Nij is the number of samples transferred from state Si to state Sj in one step; Ni is the number of samples in state Si.For the initial probability distribution vector, the sampling time before the time to be detected is taken as the initial time, and the state variable at this time isX0, in the case of known historical data, its initial probability distribution vector π0 is known. The value of the element πSi0 in π0 is shown in formula (15).(15)πSi0=1X0=Si,0other.(2) FDIA detection method based on double Markov chain.The key to FDIA detection of the new energy Internet lies in how to process the measurement changes caused by the attack vector into obvious changes in state values. However, the state change process of the new energy Internet is random and complex, which makes the single Markov chain established according to equations (11)–(15) insensitive to attack vectors with different sparsity and attack strengths, that is, the comprehensiveness of detection cannot be guaranteed, so that the detection probability is insufficient [16].In order to make the operating state changes sufficiently sensitive to the diversity of FDIA, the authors choose two approximately complementary scenarios, using this as a benchmark scenario, a double Markov chain is generated. As a result, an FDIA detection method based on double Markov chains is constructed, and the structure is shown in Figure2. The specific selection process of the two reference vectors ZB1 and ZB2 is shown in Figure 3. In Figure 3, PLh and QLh are the historical active power and reactive power of the node load, respectively; PLh,max and QLh,max are the maximum values of the historical active power and reactive power of the node load respectively; PDG is the capacity of the distributed power supply; Pij,1 and Pij,2 are the branch active powers of scenario 1 and scenario 2, respectively; Pi,1 and Pi,2 inject active power into the nodes of Scenario 1 and Scenario 2, respectively.Figure 2
Structure of FDIA detection method based on double Markov chain.Figure 3
Flow chart of selection of reference vector.Scenario 1 is the operating condition where the grid is fully loaded and the output power of the distributed power supply is 0, reflecting the situation of heavy load but no output of the distributed power supply; Scenario 2 is the operating condition where the grid is connected to half of the load and the distributed power supply is outputting full power, which reflects the situation of light load but the full output of the distributed power supply. By selecting a reference vector in two scenarios, it can be ensured that various false data will significantly change the operating state represented by the Markov chain model, reducing the probability of false detection [17].For each Markov chain model in the dual model, the results can be obtained separately according to equations (11)–(15), historical data, and different reference values.According to the generated double Markov chain model, the probability distribution vectorsπ1 and π2 of the operating state of the energy Internet at the time to be detected can be obtained, and then the expectation of the operating state at the time to be detected can be obtained, the running states S1E and S2E at the moment to be detected are estimated. The specific calculation expressions are shown in formulas (16)–(19).(16)π1=π10P1,(17)π2=π20P2,(18)S1E=∑n=1NS1π1,nS1,n,(19)S2E=∑n=1NS2π2,nS2,n.Among them,P1 and P2 are the one-step transition matrices of the two Markov chains respectively; π10 and π20 are the initial probability distribution vectors of the two Markov chains respectively; NS1 and NS2 are the number of states of the two Markov chains respectively; S1,n and S2,n are the nth position in the state space of the two Markov chains respectively a status value; π1,n and π2,n are the nth elements of π1 and π2, respectively.Two Markov chain models are used to estimate the historical data samples respectively, and the estimated values of the historical state are obtained asSZB1E and SZB2E, respectively. According to two different reference vectors, the actual values of the historical state are calculated as SZB1E and SZB2E, respectively, and the error values D1 and D2 between the actual state and the estimated state are calculated according to (20) and (21), respectively.(20)D1=SZB1−SZB1E,(21)D2=SZB2−SZB2E.D1 and D2 reflect the accuracy of estimating known historical states using two different Markov chain models. The confidence interval is selected in the range of 95% to 99%, find D1∗ and D2∗ in D1 and D2 to satisfy (22) and (23) respectively, that is, the absolute values of 95%∼99% of the elements in D1 and D2 are not greater than D1∗ and D2∗, respectively. In this way, it can be considered that the estimated error intervals of the two Markov chains in the operating state of the Energy Internet are −D1∗,D1∗ and −D2∗,D2∗D2∗, respectively.(22)95%≤pD1,n≤D1∗,n=1,2,…,Nh≤99%,(23)95%≤pD2,n≤D2∗,n=1,2,…,Nh≤99%.Among them,p· represents the probability of occurrence of an event ·; and Nh is the sampling number of historical data.The accuracy of estimating the state of the data to be detected using the Markov chain model is the same as the accuracy of estimating the state of the historical data, and in order to ensure that the detector is sufficiently sensitive to the diversity of FDIA, generate a dual Markov chain energy Internet FDIA detector based on estimated error intervals−D1∗,D1∗ and −D2∗,D2∗, as shown in Equation (24).(24)H0:S1E−D1∗<S1T<S1E+D1∗,S2E−D2∗<S2T<S2E+D2∗,H1:S1T≤S1E−D1∗orS1T≥S1E+D1∗orS2T≤S2E−D2∗orS2T≥S2E+D2∗.Among them,H0 is the assumption that the detection data is normal; H1 is the assumption that the detection data is false data; S1T and S2T are the actual state values under the conditions of two different reference values at the time to be detected ZD calculated according to formulas (11) and (12), respectively. If the actual state value satisfies the assumption H1, it means that there is FDIA, that is, any Markov chain judges that the error between the actual state S1T,S2T of the vector to be detected and the estimated state S1E,S2E does not meet the normal estimation error interval of the Markov chain model, then it is considered that there is FDIA.(3) FDIA detection process based on double Markov chain.The author's proposed new energy Internet FDIA detection process based on a double Markov chain and its own characteristics can be seen, the FDIA detection method based on the double Markov chain is very suitable for the new energy Internet, the main reasons are as follows: ① Although the Markov chain uses a certain amount of historical data to complete the modeling of the operating state of the energy Internet, under the same amount of historical data, compared with the machine learning method based on historical data training, its computational complexity and performance are significantly reduced. The computational load is reduced obviously, and the performance is better. ② The one-step transition matrix in the Markov chain modeling process only needs to be generated once before detection, and after each detection, the new unattacked sample value is added to the historical database, and the one-step transition matrix is updated in real-time, the amount of computation is significantly smaller than the training model update of the machine learning method. ③ When the double Markov chain model is applied in practice, the parallel computing method can be adopted, and the application of double chain has little effect on the overall detection time [18].


## 3.1. Principles and Characteristics of FDIA

The new energy Internet is a large-scale power information physical system, and the errors of the information system are inseparable from the accidents of the physical system. Therefore, by analyzing the principle of FDIA acting on the new energy Internet, combined with the inherent bad data detection method of the power system, the concealment characteristics of FDIA are obtained, and the diversity characteristics of FDIA are obtained through the actual situation, ensure that the attack examples used in the study meet the requirements of practical applications [8].The principle of FDIA acting on the new energy Internet is shown in Figure1. When the false data vector attacks the information system of the new energy Internet, the measurement vector Z becomes Z+a, which causes the state estimation result x^ to generate a state error vector c, which in turn causes the scheduling model to generate an incorrect scheduling policy control variable u′, eventually, the physical system runs in an abnormal state x′.Figure 1
The schematic diagram of FDIA acting on the new energy Internet.In practical situations, random disturbances of the measurement or telecontrol system will cause the measurement vectorZ to produce bad data with random error characteristics. Bad data is not an attack, and the existing power system state estimation methods have passed rW detection and rN detection, realizing the detection of bad data [9]. The specific bad data detection methods are as follows.Calculate the residualri of the ith measurement, the weighted residual rWi , the regularized residual rNi, and the calculation expressions are shown in equations (1)–(3), respectively.(1)ri=zi−hix^,(2)rWi=riσi,(3)rNi=riσNi.Among them,zi is the value of the ith measurement; σi is the standard deviation of the measurement error of the ith measurement; σNi is the standard deviation of ri; and hix^ is the estimated value of the ith measurement, obtained by substituting x^ (the estimated value of voltage amplitude U and phase θ) into the measurement function hθ,U. The specific measurement function hθ,U includes the branch active power measurement function Pijθ,U, the branch reactive power measurement function Qijθ,U, the node injected active power measurement function Piθ,U, the node injected reactive power measurement function Qiθ,U, and the node voltage amplitude value. The measurement function Ui is shown in formula (4).(4)hθ,U=Pijθ,UQijθ,UPiθ,UQiθ,UUi.Equation (4) is a nonlinear equation system, the resistance component in the equation can be ignored in the transmission network, and it is approximated as a linear equation system. However, for distribution networks with lower voltage levels, the resistive component should not be ignored. Therefore, considering the application requirements of the new energy Internet, the author does not ignore the resistance component [10].If the residual calculation result satisfies formula (5), it means that there is bad data in the measurement vector.(5)maxrwi>δtr1ormaxrNi>δtr2.Among them,δtr1 and δtr2 are the thresholds for detecting rw and rN, respectively.Stealth is an important feature of FDIA, which comes from the vulnerability of bad data detection methods. When there is no false data a and when false data a is included, the calculation expressions of the residuals are shown in equation (6) and equation (7) respectively.(6)r1=Z−hx^,(7)r2=Z+a−hx^+c.Among them,r1 and r2 are the residual vectors when they do not contain and contain false data, respectively.If the ideal attack vector a is constructed to satisfy equation (8), then r1=r2, as a result, the bad data detection method based on residual calculation in the power system fails to detect false data. In other words, existing bad data detection methods are not suitable for FDIA detection [11].(8)a=hx^+c−hx^.Meanwhile, FDIA with cryptic features exhibits diverse features [12]. ①Incomplete attack capabilities lead to different false data with different degrees of sparsity. Let such an attack vector be a′, which is a vector with zero elements that can only achieve attacks on specific measurements. And the residual of the state estimation injected with a′ cannot trigger bad data detection, that is, the residual satisfies Equation (9). ② Different FDIAs have different degrees of influence on the measurement vector Z, resulting in different attack strengths of different FDIAs. The smaller the strength of the attack vector is, the smaller the change of the measurement vector Z is, attacks are hard to detect. The calculation expression of the attack strength Pa (unit is dB) adopted by the author is shown in formula (10).(9)maxrwi>δtr1,maxrNi>δtr2.(10)Pa=20lg∑i=1mai′/zim.Among them,ai′ is the element of a′; m is the number of measurement units.To sum up, FDIA shows inherent concealment and diversity characteristics. In order to meet the requirements of practical applications, the detection method of FDIA should be able to detect various FDIAs.


## 3.2. FDIA Detection Method Suitable for New Energy Internet

According to the Markov chain, the operation state change model of the energy Internet is established, and the difference between the state change caused by FDIA and the normal state change law can be analyzed, and the detection of the energy Internet FDIA can be realized [13].In order to improve the comprehensiveness of detection, so that the detection range of FDIA can cover FDIA with different sparsity and attack strength, and ensure that it is sensitive enough to weak attacks, the author uses two complementary Markov chains to model the operation state of the new energy Internet, and solves the problem that a single Markov chain model cannot effectively distinguish some FDIAs. Therefore, in order to avoid the false detection problem caused by the detection blind spot of a single Markov chain, the FDIA detection method should be generated based on the dual Markov chain model of the new energy Internet [14].(1)The Markov Chain Model of the Operational State of the New Energy Internet.The new energy Internet contains many measurement values with random variation characteristics, studying the state change process of each measurement separately will greatly reduce the computational efficiency. Energy Internet as a whole, and among them, the measurement values are mutually influenced. Therefore, the author studies the measurement vectorZ at each sampling moment as a whole.It can be seen from equations (4) and (8) that, as long as there is an attack vector, the measurement sub-vectors (branch active power measurement Pij, branch reactive power measurement Qij, node injected active power measurement Pi, node injected reactive power measurement Qi, and node voltage amplitude measurement Ui) are subject to change. Therefore, to reduce the amount of data used for detection, this study selects the measurement sub-vectors Pij and Pi to construct a vector ZD, and uses the Markov chain to model the state change process of ZD, and analyzes the state of ZD and its transition law.The state space, one-step transition matrix, and initial probability distribution vector are the three key elements for establishing the Markov chain model of the energy Internet, which together determine the properties of the Markov chain [15].For the state space, by calculating the Euclidean distanced between ZD and the specified reference vector ZB, the similarity between the two is represented, and the evaluation standard of ZD is unified; At the same time, considering that the energy Internet has a large amount of historical measurement data, the measurement vectors with close distance values are processed into the same state, and the distance values are further classified to generate a state space.According to formula (11), the range of the distance value corresponding to the state in the state space is calculated.(11)dmin+i−2l,dmin+ili=1,2,…,NS.Among them,NS is the number of states in the state space; l is the interval; dmin is the minimum value of the distance value d of all historical measurement data, and the calculation expression of d is shown in formula (12).(12)d=∑n=1NzZD,n−ZB,n2.Among them,ZD,n and ZB,n are the nth elements in ZD and ZB, respectively; Nz is the number of elements in ZD.For the one-step transition matrix, the distance of each historical measurement data and its corresponding state are calculated according to (11) and (12), and the one-step transition matrix P from state Si to state Sj is obtained, as shown in formula (13).(13)P=pSi,Sj,(14)pSi,Sj=NijNi.Among them,Nij is the number of samples transferred from state Si to state Sj in one step; Ni is the number of samples in state Si.For the initial probability distribution vector, the sampling time before the time to be detected is taken as the initial time, and the state variable at this time isX0, in the case of known historical data, its initial probability distribution vector π0 is known. The value of the element πSi0 in π0 is shown in formula (15).(15)πSi0=1X0=Si,0other.(2) FDIA detection method based on double Markov chain.The key to FDIA detection of the new energy Internet lies in how to process the measurement changes caused by the attack vector into obvious changes in state values. However, the state change process of the new energy Internet is random and complex, which makes the single Markov chain established according to equations (11)–(15) insensitive to attack vectors with different sparsity and attack strengths, that is, the comprehensiveness of detection cannot be guaranteed, so that the detection probability is insufficient [16].In order to make the operating state changes sufficiently sensitive to the diversity of FDIA, the authors choose two approximately complementary scenarios, using this as a benchmark scenario, a double Markov chain is generated. As a result, an FDIA detection method based on double Markov chains is constructed, and the structure is shown in Figure2. The specific selection process of the two reference vectors ZB1 and ZB2 is shown in Figure 3. In Figure 3, PLh and QLh are the historical active power and reactive power of the node load, respectively; PLh,max and QLh,max are the maximum values of the historical active power and reactive power of the node load respectively; PDG is the capacity of the distributed power supply; Pij,1 and Pij,2 are the branch active powers of scenario 1 and scenario 2, respectively; Pi,1 and Pi,2 inject active power into the nodes of Scenario 1 and Scenario 2, respectively.Figure 2
Structure of FDIA detection method based on double Markov chain.Figure 3
Flow chart of selection of reference vector.Scenario 1 is the operating condition where the grid is fully loaded and the output power of the distributed power supply is 0, reflecting the situation of heavy load but no output of the distributed power supply; Scenario 2 is the operating condition where the grid is connected to half of the load and the distributed power supply is outputting full power, which reflects the situation of light load but the full output of the distributed power supply. By selecting a reference vector in two scenarios, it can be ensured that various false data will significantly change the operating state represented by the Markov chain model, reducing the probability of false detection [17].For each Markov chain model in the dual model, the results can be obtained separately according to equations (11)–(15), historical data, and different reference values.According to the generated double Markov chain model, the probability distribution vectorsπ1 and π2 of the operating state of the energy Internet at the time to be detected can be obtained, and then the expectation of the operating state at the time to be detected can be obtained, the running states S1E and S2E at the moment to be detected are estimated. The specific calculation expressions are shown in formulas (16)–(19).(16)π1=π10P1,(17)π2=π20P2,(18)S1E=∑n=1NS1π1,nS1,n,(19)S2E=∑n=1NS2π2,nS2,n.Among them,P1 and P2 are the one-step transition matrices of the two Markov chains respectively; π10 and π20 are the initial probability distribution vectors of the two Markov chains respectively; NS1 and NS2 are the number of states of the two Markov chains respectively; S1,n and S2,n are the nth position in the state space of the two Markov chains respectively a status value; π1,n and π2,n are the nth elements of π1 and π2, respectively.Two Markov chain models are used to estimate the historical data samples respectively, and the estimated values of the historical state are obtained asSZB1E and SZB2E, respectively. According to two different reference vectors, the actual values of the historical state are calculated as SZB1E and SZB2E, respectively, and the error values D1 and D2 between the actual state and the estimated state are calculated according to (20) and (21), respectively.(20)D1=SZB1−SZB1E,(21)D2=SZB2−SZB2E.D1 and D2 reflect the accuracy of estimating known historical states using two different Markov chain models. The confidence interval is selected in the range of 95% to 99%, find D1∗ and D2∗ in D1 and D2 to satisfy (22) and (23) respectively, that is, the absolute values of 95%∼99% of the elements in D1 and D2 are not greater than D1∗ and D2∗, respectively. In this way, it can be considered that the estimated error intervals of the two Markov chains in the operating state of the Energy Internet are −D1∗,D1∗ and −D2∗,D2∗D2∗, respectively.(22)95%≤pD1,n≤D1∗,n=1,2,…,Nh≤99%,(23)95%≤pD2,n≤D2∗,n=1,2,…,Nh≤99%.Among them,p· represents the probability of occurrence of an event ·; and Nh is the sampling number of historical data.The accuracy of estimating the state of the data to be detected using the Markov chain model is the same as the accuracy of estimating the state of the historical data, and in order to ensure that the detector is sufficiently sensitive to the diversity of FDIA, generate a dual Markov chain energy Internet FDIA detector based on estimated error intervals−D1∗,D1∗ and −D2∗,D2∗, as shown in Equation (24).(24)H0:S1E−D1∗<S1T<S1E+D1∗,S2E−D2∗<S2T<S2E+D2∗,H1:S1T≤S1E−D1∗orS1T≥S1E+D1∗orS2T≤S2E−D2∗orS2T≥S2E+D2∗.Among them,H0 is the assumption that the detection data is normal; H1 is the assumption that the detection data is false data; S1T and S2T are the actual state values under the conditions of two different reference values at the time to be detected ZD calculated according to formulas (11) and (12), respectively. If the actual state value satisfies the assumption H1, it means that there is FDIA, that is, any Markov chain judges that the error between the actual state S1T,S2T of the vector to be detected and the estimated state S1E,S2E does not meet the normal estimation error interval of the Markov chain model, then it is considered that there is FDIA.(3) FDIA detection process based on double Markov chain.The author's proposed new energy Internet FDIA detection process based on a double Markov chain and its own characteristics can be seen, the FDIA detection method based on the double Markov chain is very suitable for the new energy Internet, the main reasons are as follows: ① Although the Markov chain uses a certain amount of historical data to complete the modeling of the operating state of the energy Internet, under the same amount of historical data, compared with the machine learning method based on historical data training, its computational complexity and performance are significantly reduced. The computational load is reduced obviously, and the performance is better. ② The one-step transition matrix in the Markov chain modeling process only needs to be generated once before detection, and after each detection, the new unattacked sample value is added to the historical database, and the one-step transition matrix is updated in real-time, the amount of computation is significantly smaller than the training model update of the machine learning method. ③ When the double Markov chain model is applied in practice, the parallel computing method can be adopted, and the application of double chain has little effect on the overall detection time [18].


## 4. Analysis of Results

The author adopts a standard 33-node distribution network model and adds typical random power sources and loads on the basis of the original network, the modified example structure is shown in Figure4. In the figure, node 1 is the system power supply, node 9 is connected to an electric vehicle charging station, and node 17 and node 32 are, respectively, connected to a photovoltaic power supply with a capacity of 0.5 MW. Based on the measurement data collected by the power grid and a large number of fake data constructed, the author's example verifies the correctness and effectiveness of the proposed FDIA detection method.Figure 4
Topological structure of the 33-node distribution network after transformation.


### 4.1. Generation of Grid Measurement Data

The measurement data of the power grid is obtained from the measurement data of the load, photovoltaic power source, and electric vehicle charging station. Among them, the measurement data of load and photovoltaic power supply are constructed based on the changing trend of active power measurement data from August 22 to September 20, 2019 (30 days in total) based on the WESTERN region given by the website of PJM Company in the United States. Multiply the original load power and photovoltaic power supply power by the power per unit value at each moment, and the measurement data of each node load and photovoltaic power source sampled every 5 minutes is constructed [19].The measurement data of the electric vehicle charging station is generated according to the load characteristics of the electric vehicle. In the case of knowing the number of electric vehicles, charging power, cruising range, the probability distribution function of charging start time, the probability distribution function of daily mileage, etc., generate load variation curves of EV charging stations sampled every 5 min. Among them, the number of simulated electric vehicles is 100, the charging power is 3.5 kW, and the cruising range is 300 km.According to the load power, photovoltaic power generation power, and electric vehicle charging station load power sampled every 5 minutes, use the power flow calculation tool to calculate the power flow value of the power grid as the measurement data recorded by the electric meter, and add random errors that meet the normal data requirements to form 163, the measurement data of 30 d of measurement units (active and reactive power measurement of 32 branches, active and reactive power measurement of 33 nodes, and voltage amplitude measurement of 33 nodes) [20].


### 4.2. Generation of Power Grid Attack Data

The loads and power sources in the new energy Internet are random, resulting in multiple state changes in a day. In order to verify the detection performance of the proposed detection method at different times, the calculation example in this section will be 03 : 00, 06 : 00, 09 : 00, 12 : 00, 15 : 00, 18 : 00, 21 : 00 on September 20., 24 : 00, these 8 moments are the injection moments of FDIA.According to the characteristics of FDIA, a series of fake data are randomly constructed [21]. In order to cover as much as possible FDIA with different attack strengths and sparse degrees, randomly generate 8 × 6000 covert attack vector groups a1−a8 for the above 8 times, the attack intensity range is [−30, 5] dB, and the zero elements of each attack vector satisfy the uniform distribution, and the specific zero elements at different times, the distribution is shown in Figure 5.Figure 5
Distribution of zero elements of attack vector.


### 4.3. FDIA Detection

The detection method proposed by the author is used to detect the large amount of false dataa1−a8 generated in Section 4.2. In order to verify the detection performance advantage of the detection method proposed by the author, the Gaussian kernel function SVM with excellent performance is used to detect the same false data sample a1−a8. Among them, SVM adopts the same historical measurement sample, 29 normal data samples, and 29 typical fake data samples are generated respectively for the above eight moments as training samples.The detection probability of the FDIA detection method proposed by the author is better than that of the SVM method at each detection moment, and the lowest detection probability can reach 98.60% (12 : 00), which is significantly better than the highest detection probability of the SVM method of 76.92% (24 : 00). This is because the SVM method needs to use both normal data and fake data as training samples, and the fake data samples are difficult to cover as much as possible, and the fake data with different attack intensities and sparse degrees makes detection feature extraction difficult; The detection method proposed by the author only needs to model and analyze the state change law of normal data samples over time and does not need to consider false data samples, which reduces the impact of false data on the accuracy of the detection model.In order to verify the necessity and correctness of using the double Markov chain, the detection probability of the single Markov chain 1 and the single Markov chain 2 to the attack vector groupa1−a8 (the key information of detection is the same as that in Table 1) is calculated respectively, the results are all about 90%, it is less than the minimum detection probability of the double-stranded model of 98.60% (12 : 00), indicating that the double-stranded model will significantly improve the detection probability, which verifies the necessity and correctness of using the double-stranded model.Table 1
Comparison of the calculation amount of the two detection methods.
Detection methodMultiplication calculation amountAddition calculation amountAuthor method≥398≥524SVM method≥3944≥7482In order to verify the false alarm performance of the detection method proposed by the author, at 03 : 00, 06 : 00, 09 : 00, 12 : 00, 15 : 00, 18 : 00, 21 : 00, 24 : 00 on September 20, respectively, construct 500 normal data that meet the normal measurement error requirements at any time, and the detection method proposed by the author is used for detection, of which only 1.35% of the data is misjudged as false data, indicating that the detection method proposed by the author has very superior false alarm performance [22]. In order to verify the detection performance of the detection method proposed by the author with the change of attack intensity, the detection probability of the attack vector group a1−a8 with the change of attack intensity is calculated, and the results are shown in Figure 6.Figure 6
Variation curve of detection probability with attack intensity.As can be seen from Figure6, when the attack strength of FDIA is greater than -20 dB, the detection probability has reached 99.66% (close to 100%), and when the attack strength is very weak (-30 dB), the detection probability is also greater than 90%. It shows that the FDIA detection method proposed by the author is comprehensive, and further shows that the proposed detection method has very superior detection performance [23].In order to verify the computational advantage of the detection method proposed by the author, the computational cost of the detection method proposed by the author and the SVM detection method in a single detection process are calculated respectively, the results are shown in Table1.It can be seen from Table1, the detection calculation amount of the detection method proposed by the author is reduced by an order of magnitude compared with the SVM method. This is because the false data training samples added by the SVM method will increase the amount of detection calculation, and it is difficult to meet the requirements of detection speed and accuracy at the same time. The detection method proposed by the author does not need to consider false data samples, which effectively reduces the amount of detection calculation. The calculation results show that the proposed detection method has superior detection performance and less computation, the detection probability can reach 98.60%, and the false alarm probability is only 1.35% [24].The results of the above examples verify the correctness and effectiveness of the FDIA detection method proposed by the author, and its superior detection probability, false alarm probability, and detection calculation amount fully meet the application requirements of the new energy Internet [25–27].


## 4.1. Generation of Grid Measurement Data

The measurement data of the power grid is obtained from the measurement data of the load, photovoltaic power source, and electric vehicle charging station. Among them, the measurement data of load and photovoltaic power supply are constructed based on the changing trend of active power measurement data from August 22 to September 20, 2019 (30 days in total) based on the WESTERN region given by the website of PJM Company in the United States. Multiply the original load power and photovoltaic power supply power by the power per unit value at each moment, and the measurement data of each node load and photovoltaic power source sampled every 5 minutes is constructed [19].The measurement data of the electric vehicle charging station is generated according to the load characteristics of the electric vehicle. In the case of knowing the number of electric vehicles, charging power, cruising range, the probability distribution function of charging start time, the probability distribution function of daily mileage, etc., generate load variation curves of EV charging stations sampled every 5 min. Among them, the number of simulated electric vehicles is 100, the charging power is 3.5 kW, and the cruising range is 300 km.According to the load power, photovoltaic power generation power, and electric vehicle charging station load power sampled every 5 minutes, use the power flow calculation tool to calculate the power flow value of the power grid as the measurement data recorded by the electric meter, and add random errors that meet the normal data requirements to form 163, the measurement data of 30 d of measurement units (active and reactive power measurement of 32 branches, active and reactive power measurement of 33 nodes, and voltage amplitude measurement of 33 nodes) [20].


## 4.2. Generation of Power Grid Attack Data

The loads and power sources in the new energy Internet are random, resulting in multiple state changes in a day. In order to verify the detection performance of the proposed detection method at different times, the calculation example in this section will be 03 : 00, 06 : 00, 09 : 00, 12 : 00, 15 : 00, 18 : 00, 21 : 00 on September 20., 24 : 00, these 8 moments are the injection moments of FDIA.According to the characteristics of FDIA, a series of fake data are randomly constructed [21]. In order to cover as much as possible FDIA with different attack strengths and sparse degrees, randomly generate 8 × 6000 covert attack vector groups a1−a8 for the above 8 times, the attack intensity range is [−30, 5] dB, and the zero elements of each attack vector satisfy the uniform distribution, and the specific zero elements at different times, the distribution is shown in Figure 5.Figure 5
Distribution of zero elements of attack vector.


## 4.3. FDIA Detection

The detection method proposed by the author is used to detect the large amount of false dataa1−a8 generated in Section 4.2. In order to verify the detection performance advantage of the detection method proposed by the author, the Gaussian kernel function SVM with excellent performance is used to detect the same false data sample a1−a8. Among them, SVM adopts the same historical measurement sample, 29 normal data samples, and 29 typical fake data samples are generated respectively for the above eight moments as training samples.The detection probability of the FDIA detection method proposed by the author is better than that of the SVM method at each detection moment, and the lowest detection probability can reach 98.60% (12 : 00), which is significantly better than the highest detection probability of the SVM method of 76.92% (24 : 00). This is because the SVM method needs to use both normal data and fake data as training samples, and the fake data samples are difficult to cover as much as possible, and the fake data with different attack intensities and sparse degrees makes detection feature extraction difficult; The detection method proposed by the author only needs to model and analyze the state change law of normal data samples over time and does not need to consider false data samples, which reduces the impact of false data on the accuracy of the detection model.In order to verify the necessity and correctness of using the double Markov chain, the detection probability of the single Markov chain 1 and the single Markov chain 2 to the attack vector groupa1−a8 (the key information of detection is the same as that in Table 1) is calculated respectively, the results are all about 90%, it is less than the minimum detection probability of the double-stranded model of 98.60% (12 : 00), indicating that the double-stranded model will significantly improve the detection probability, which verifies the necessity and correctness of using the double-stranded model.Table 1
Comparison of the calculation amount of the two detection methods.
Detection methodMultiplication calculation amountAddition calculation amountAuthor method≥398≥524SVM method≥3944≥7482In order to verify the false alarm performance of the detection method proposed by the author, at 03 : 00, 06 : 00, 09 : 00, 12 : 00, 15 : 00, 18 : 00, 21 : 00, 24 : 00 on September 20, respectively, construct 500 normal data that meet the normal measurement error requirements at any time, and the detection method proposed by the author is used for detection, of which only 1.35% of the data is misjudged as false data, indicating that the detection method proposed by the author has very superior false alarm performance [22]. In order to verify the detection performance of the detection method proposed by the author with the change of attack intensity, the detection probability of the attack vector group a1−a8 with the change of attack intensity is calculated, and the results are shown in Figure 6.Figure 6
Variation curve of detection probability with attack intensity.As can be seen from Figure6, when the attack strength of FDIA is greater than -20 dB, the detection probability has reached 99.66% (close to 100%), and when the attack strength is very weak (-30 dB), the detection probability is also greater than 90%. It shows that the FDIA detection method proposed by the author is comprehensive, and further shows that the proposed detection method has very superior detection performance [23].In order to verify the computational advantage of the detection method proposed by the author, the computational cost of the detection method proposed by the author and the SVM detection method in a single detection process are calculated respectively, the results are shown in Table1.It can be seen from Table1, the detection calculation amount of the detection method proposed by the author is reduced by an order of magnitude compared with the SVM method. This is because the false data training samples added by the SVM method will increase the amount of detection calculation, and it is difficult to meet the requirements of detection speed and accuracy at the same time. The detection method proposed by the author does not need to consider false data samples, which effectively reduces the amount of detection calculation. The calculation results show that the proposed detection method has superior detection performance and less computation, the detection probability can reach 98.60%, and the false alarm probability is only 1.35% [24].The results of the above examples verify the correctness and effectiveness of the FDIA detection method proposed by the author, and its superior detection probability, false alarm probability, and detection calculation amount fully meet the application requirements of the new energy Internet [25–27].


## 5. Conclusion

The FDIA detection method of the new energy Internet based on a double Markov chain is studied, and the following conclusions can be drawn based on the example simulation:(1)
Use the Markov chain to model the operation state of the new energy Internet, and generate the state space by the Euclidean distance between the measurement vector and the reference vector, which can well describe the correlation and difference between the measurement vectors, it avoids separate analysis of a large number of random measurement data, improves the detection performance, and reduces the amount of calculation;(2)
The dual Markov chain model selects two different operating scenarios as reference vectors, which can ensure that hidden and diverse attack vectors can cause significant changes in the state value of the new energy Internet Markov chain model, reducing the probability of false detection;(3)
The results of the calculation example show that the proposed detection method has superior detection performance and less computation, the detection probability can reach 98.60%, and the false alarm probability is only 1.35%, compared with SVM, the calculation amount is reduced by an order of magnitude, which fully meets the application requirements of the new energy Internet for FDIA detection accuracy and real-time performance.



---

*Source: 1620500-2022-07-30.xml*