基于Stacking和孤立森林的虚假数据注入攻击防御策略

False data injection attacks defense strategy based on stacking and isolation forest

针对电力信息物理系统受到虚假数据注入攻击后无法安全稳定运行的问题,本文提出了一种基于Stacking和孤立森林的两阶段数据清洗方法。首先,由多异质学习器组成的Stacking分类模型对实时量测数据样本进行异常检测,判断当前时刻量测样本中是否存在虚假数据;其次,虚假数据的量测样本与基于负荷预测和潮流计算生成的当前时刻伪量测数据作差,得到量测误差向量,将量测误差向量输入孤立森林异常检测模型中进行二次辨识,定位受攻击的量测位置,并由伪量测数据进行替换修正;最后,通过IEEE-33节点测试系统仿真实验验证本文所提方法的有效性。

To address the problem of the power cyber physical system cannot operate safely and stably after being attacked by false data,a two-stage data cleansing method that combines Stacking and Isolation Forest is proposed.First,a Stacking classification model composed of multiple heteroge-neous learners performs anomaly detection on real-time measurement data samples,and determines whether there are false data in the current measurement samples.Then,the measurement samples with false data will be subtracted from the pseudo-measurement data at the current moment generated based on load forecasting and power flow calculation to obtain the measurement error vector.The measurement error vector will be input into the Isolation Forest anomaly detection model for secondary identification,locating the attacked measurement position and replacing it with pseudo-measurement data for correction.Finally,simulation experiments on IEEE-33 node test system verify the effectiveness of the proposed method.