针对PMU测量的虚假数据注入攻击检测方法

False Data Injection Attack Detection Method against PMU Measurements

针对向量测量单元(Phasor Measure Unit,PMU)测量的虚假数据注入攻击检测,文章提出了修正鲁棒性随机砍伐森林(Corrected Robust Random Cut Forest,CRRCF)无监督在线学习检测方法。首先,鲁棒性随机砍伐森林(Robust Random Cut Forest,RRCF)是一种无监督在线学习算法,该算法可以快速适应拓扑变化后的PMU测量数据,并通过生成异常得分反映样本的异常程度;然后,根据RRCF的异常得分,CRRCF使用高斯Q函数和滑动窗口计算异常概率;最后,异常概率修正了RRCF对异常程度的判断,以适应攻击数量、攻击幅度的变化。仿真结果表明,与静态学习方法相比,在线学习方法能够解决拓扑变化带来的概念漂移问题;而与其他在线学习方法相比,CRRCF能够在攻击数量、攻击幅度变化时始终保持较高的检测精度和F1分数。

A novel unsupervised online learning detection method was proposed for false data injection attack detection of PMU measurements,which was called corrected robust random cut forest(CRRCF).Firstly,RRCF was an unsupervised online-learning algorithm,which could quickly adapt to the PMU measurement after the topology change and generate abnormal scores to reflect the abnormal degree of samples.Secondly,according to the abnormal scores of RRCF,CRRCF used Gaussian Q function and sliding window to calculatethe abnormal probability.Thirdly,the abnormal probability modified the judgment of abnormal degree from RRCF and adapted to changes of attack number and attack magnitude.The simulation results show that compared with the static learning method,the online learning method can solve the problem of concept drift caused by topology changes,while compared with other online learning methods,CRRCF can always maintain higher detection accuracy and F1 score when the attack number and the attack magnitude change.