CN113704750A - Network attack detection method and device of distributed power generation system and terminal equipment - Google Patents

Abstract

The present invention is applicable to the technical field of electric power systems, and provides a network attack detection method, device and terminal equipment for a distributed power generation system. The method includes: acquiring the connection relationship and operation parameters of each distributed generator in the distributed power generation system; The undirected graph model of the distributed generation system is established based on the connection relationship; the dispatching optimization model of the distributed generation system is established based on the operating parameters; the micro-increase rate of each distributed generator is determined based on the dispatching optimization model and the undirected graph model; based on the neighborhood The Overwatch mechanism determines the detection results of network attacks on the distributed power generation system according to the micro-increase rate. The network attack detection method of the distributed power generation system provided by the invention can effectively detect the network attack based on the neighborhood watch mechanism, fully protect the information security of the distributed power generation system, and ensure the safe and stable operation of the system.

Description

Network attack detection method, device and terminal equipment for distributed power generation system

technical field

The invention belongs to the technical field of power systems, and in particular relates to a network attack detection method, device and terminal equipment of a distributed power generation system.

Background technique

Distributed power generation system is one of the important development trends of the power system in the future due to its outstanding characteristics of high efficiency, cleanliness and sustainable development. The capacity of a single distributed generator in a distributed power generation system is small, and the geographical locations of each distributed generator are scattered, which requires a distributed control method that is more suitable for distributed scenarios. However, distributed control is highly dependent on communication, which makes it easy to become the target of network attacks.

In the process of local communication between distributed nodes, each node has insufficient grasp of the global information of the system, and the communication and interaction security of each power generation subject is low, making it difficult to detect malicious data and malicious nodes.

SUMMARY OF THE INVENTION

In view of this, the embodiments of the present invention provide a network attack detection method, device and terminal device for a distributed power generation system, which can effectively realize the detection of malicious data and malicious nodes in the distributed power generation system.

A first aspect of the embodiments of the present invention provides a network attack detection method for a distributed power generation system, including:

acquiring the connection relationship of each distributed generator in the distributed power generation system, and establishing an undirected graph model of the distributed power generation system based on the connection relationship;

Obtaining operating parameters of each distributed generator in the distributed power generation system, and establishing a scheduling optimization model of the distributed power generation system based on the operating parameters;

determining the micro-increase rate of each distributed generator in the distributed power generation system based on the scheduling optimization model and the undirected graph model;

A network attack detection result of the distributed power generation system is determined according to the micro-increase rate based on a neighborhood watch mechanism.

A second aspect of the embodiments of the present invention provides a network attack detection device for a distributed power generation system, including:

an undirected graph model establishment module, used for acquiring the connection relationship of each distributed generator in the distributed power generation system, and establishing an undirected graph model of the distributed power generation system based on the connection relationship;

a dispatching optimization model establishment module, used for acquiring the operating parameters of each distributed generator in the distributed power generation system, and establishing a dispatching optimization model of the distributed generator based on the operating parameters;

a micro-increase rate calculation module, configured to determine the micro-increase rate of each distributed generator in the distributed power generation system based on the dispatch optimization model;

A detection result generation module, configured to determine a network attack detection result of the distributed power generation system according to the micro-increase rate based on a neighborhood watch mechanism.

A third aspect of the embodiments of the present invention provides a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, when the processor executes the computer program Implement the steps of the method as described above.

A fourth aspect of the embodiments of the present invention provides a computer-readable storage medium, where the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, implements the steps of the above method.

A fifth aspect of the embodiments of the present invention provides a computer program product, which, when the computer program product runs on a terminal device, causes the electronic device to perform the steps of the method in any one of the foregoing first aspects.

Compared with the prior art, the embodiments of the present invention have the following beneficial effects: the embodiments of the present invention provide a network attack detection method for a distributed power generation system, which includes acquiring the connection relationship of each distributed generator in the distributed power generation system and the Operating parameters; establishing an undirected graph model of the distributed power generation system based on the connection relationship; establishing a dispatching optimization model of the distributed power generation system based on the operating parameters; determining the micro-increase rate of each distributed generator based on the dispatching optimization model and the undirected graph model; Based on the neighborhood watch mechanism, the network attack detection result of the distributed power generation system is determined according to the micro-increase rate. The network attack detection method of the distributed power generation system provided by the embodiment of the present invention can effectively detect the network attack based on the neighborhood watch mechanism, fully protect the information security of the distributed power generation system, and ensure the safe and stable operation of the system.

Description of drawings

In order to explain the technical solutions in the embodiments of the present invention more clearly, the following briefly introduces the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only for the present invention. In some embodiments, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

1 is a schematic diagram of an application scenario of a network attack detection method for a distributed power generation system provided by an embodiment of the present invention;

FIG. 2 is a schematic flowchart of an implementation of a network attack detection method for a distributed power generation system provided by an embodiment of the present invention;

3 is a schematic flowchart of another implementation of a network attack detection method for a distributed power generation system provided by an embodiment of the present invention;

4 is a schematic structural diagram of a network attack detection device for a distributed power generation system provided by an embodiment of the present invention;

FIG. 5 is a schematic structural diagram of a terminal device provided by an embodiment of the present invention.

Detailed ways

In the following description, for the purpose of illustration rather than limitation, specific details such as specific system structures and technologies are set forth in order to provide a thorough understanding of the embodiments of the present invention. However, it will be apparent to those skilled in the art that the present invention may be practiced in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, devices, circuits, and methods are omitted so as not to obscure the description of the present invention with unnecessary detail.

In order to illustrate the technical solutions of the present invention, the following specific embodiments are used for description.

In the local communication process of the distributed power generation system, each node does not have enough grasp of the global information of the system, so the method of Distributed Economic Dispatch (DED) is applied to dispatch. In distributed economic dispatch, each power generation subject is at the same level, and the communication and interaction between subjects are very frequent. However, the main ways of information exchange, such as Zigbee, WLAN, LTE and other communication methods, have lower security performance than private networks under centralized control. Therefore, it is necessary to protect distributed economic scheduling and detect malicious data and malicious nodes. .

In this embodiment, the distributed power generation system may be a virtual power plant (Virtual Power Plant, VPP) aggregated by distributed generators.

FIG. 1 shows a schematic diagram of an application scenario of a network attack detection method for a distributed power generation system provided by an embodiment of the present invention.

In one specific example, the distributed power generation system includes five distributed generators. There are inherent physical connections and communication network connections between individual distributed generators. The connection between the communication generator 1 and the network is in the form of non-full connection, and the data paths therein are all bidirectional.

FIG. 2 shows a schematic flowchart of an implementation of a network attack detection method for a distributed power generation system provided by an embodiment of the present invention. Referring to FIG. 2 , the network attack detection method for the distributed power generation system provided by the embodiment of the present invention may include steps S101 to S104.

S101: Obtain the connection relationship of each distributed generator in the distributed power generation system, and establish an undirected graph model corresponding to the distributed power generation system based on the connection relationship.

In some embodiments, S101 includes:

The node sets and edge sets of the distributed generation system are established according to the connection relationship.

Based on the node set and the edge set, the neighbor set of each node is established.

A weighted adjacency matrix for distributed generation systems is established based on neighbor sets.

Model node sets, edge sets, and weight adjacency matrices as undirected graphs.

In the specific application scenario shown in FIG. 1 , the node set includes 5 distributed generator nodes, namely v1, v2, v3, v4, and v5. The set of edges includes communication connection paths between distributed generators, namely w1, w2, w3, w4, w5, w6.

Specifically, an undirected graph model can be represented as a ternary set:

Among them, G is the undirected graph model; v is the node set, n is the number of nodes; w is the edge set; A is the weight adjacency matrix.

Specifically, the definition of the neighbor set can be:

N _i = {v _j ∈ v: (vi , v _j ) _∈w }

Among them, N _i is the neighbor set of the i-th node, vi is the _i -th node, v _j is the _{j-th node, (vi , v j ) is the edge connecting the node v i and the node v j , and v} is the Node set, w is the edge set.

According to the above definition, in the specific application scenario shown in FIG. 1, the neighbor set of node v1 includes v2, v4, and v5; the neighbor set of node v2 includes v1 and v3; the neighbor set of node v3 includes v2 and v4; the neighbor set of node v4 includes v2 and v4. The neighbor set includes v1, v3, and v5; the neighbor set of node v5 includes v1 and v4.

In some embodiments, the weight adjacency matrix A is a double random matrix, and the elements in the weight adjacency matrix satisfy:

Among them, dij is the element of the ith row and jth column in the weight adjacency matrix, n _i is the number of rows of the weight adjacency matrix, n _j is the number of columns of the weight adjacency matrix, and N _i is the neighbor set of the ith node. The above double random matrix is a non-negative real number square matrix in which the sum of the elements in each row and each column is 1.

S102: Obtain the operation parameters of each distributed generator in the distributed generator system, and establish a scheduling optimization model of the distributed power generation system based on the operation parameters.

In some embodiments, the scheduling optimization model of the distributed power generation system is the scheduling optimization model of the virtual power plant obtained by the aggregation of various distributed generators.

The optimization objective of the above scheduling optimization model is to minimize the total operating cost of the system.

In some embodiments, the operational data includes historical generation costs for each distributed generator.

The specific implementation of S102 includes:

The power generation cost model of each distributed generator is established based on the historical power generation cost of each distributed generator.

Based on the generation cost model, the dispatch optimization model of the distributed generation system is established.

In some embodiments, for any distributed generator body, the power generation cost model is:

为第i个分布式发电机的有功出力，

为第i个分布式发电机的发电成本，a_i、b_i及c_i均为发电成本函数的价格系数。in,

For the active power output of the i-th distributed generator,

is the power generation cost of the i-th distributed generator, a _i , b _i and c _i are the price coefficients of the power generation cost function.

In some embodiments, the scheduling optimization model includes an objective function and constraint equations.

In some embodiments, the objective function of the virtual power plant scheduling optimization model is:

为第i个分布式发电机的发电成本。Among them, C _total is the total power generation cost of the distributed generation system, v is the number of distributed generators,

is the power generation cost of the i-th distributed generator.

In some embodiments, the constraint equation of the virtual power plant scheduling optimization model is:

为第i个分布式发电机的有功输出，P_load为虚拟电厂内的负荷消耗，P_demand为虚拟电厂能量管理系统预设的虚拟电厂有功输出，

为第i个分布式发电机的出力下界，

为第i个分布式发电机的出力上界。Among them, P _out is the total output of the virtual power plant,

is the active power output of the i-th distributed generator, P _load is the load consumption in the virtual power plant, P _demand is the virtual power plant active power output preset by the virtual power plant energy management system,

is the output lower bound of the i-th distributed generator,

is the upper bound for the output of the i-th distributed generator.

When the distributed generation system runs stably, the active power output can meet the energy management system's demand for power generation and economic dispatch of virtual power plants.

S103: Determine the micro-increase rate of the distributed power generation system based on the dispatch optimization model and the undirected graph model.

In some embodiments, S103 includes:

According to the power generation cost model of each distributed generator, the incremental rate (Incremental Rate, ICR) of each distributed generator is defined.

In some embodiments, the calculation formula of the power generation micro-increase rate is:

为第i个分布式发电机的发电成本，

为第i个分布式发电机的有功出力，a_i和b_i均为发电成本函数的价格系数。Among them, λ _i is the micro-increase rate of the i-th distributed generator,

is the power generation cost of the i-th distributed generator,

is the active power output of the i-th distributed generator, a _i and b _i are the price coefficients of the power generation cost function.

In some embodiments, the methods provided by the embodiments of the present invention further include:

Adjust the distributed power generation system based on the consensus algorithm until the distributed power generation system is in a stable state. The above-mentioned consistency algorithm includes performing a synchronous iterative interactive calculation of a slight increase rate between each distributed generator and its corresponding neighbor set.

In some embodiments, the calculation formula of the slight increase rate through the consensus algorithm is:

λ[k+1]=Aλ[k]+εF(P _demand -P _out )

Among them, λ[k+1] is the micro-increase rate after the iterative interaction of the consensus algorithm; A is the weight adjacency matrix; λ[k] is the previous micro-increase rate in the iterative process; Convergence coefficient of feasible solution; F is a column vector whose first element is 1 and other elements are 0, that is, f ₁ =1; f _i≠1 =0; P _demand is the virtual power plant active power preset by the virtual power plant energy management system output; P _out is the total output of the virtual power plant.

Specifically, for the i-th distributed generator, the calculation formula of the micro-increase rate after the consistency algorithm is:

Among them, λ _i (k+1) is the micro-increase rate of the i-th distributed generator after the iterative interaction of the consensus algorithm; Ni is the neighbor set of the _i -th node is the neighbor set of the i-th node; d _ij is the element of the i-th row and j-th column in the weight adjacency matrix; λ _j (k) is the last slight increase rate of the j-th distributed generator in the iterative process; ε is the convergence coefficient that satisfies the iterative convergence of the optimization problem to a feasible solution ; f _i is the ith element in the column vector F.

The basis for judging the convergence of the above iterative interaction process includes:

为迭代收敛过程的稳态微增率，P_demand为虚拟电厂能量管理系统预设的虚拟电厂有功输出；P_out为虚拟电厂的总输出。Among them, λ is the slight increase rate,

is the steady-state micro-increase rate of the iterative convergence process, P _demand is the virtual power plant active power output preset by the virtual power plant energy management system; P _out is the total output of the virtual power plant.

When the micro-increase rate obtained by the consensus algorithm iteratively is equal to the preset steady-state micro-increase rate, and the total output of the virtual power plant is equal to the preset active power output of the virtual power plant, it is determined that the iterative interaction process has converged, and the distributed power generation system has achieved stable performance. state operation.

Specifically, the formula for calculating the steady-state micro-increase rate when the iteration reaches convergence is:

为稳态微增率，λ_stable为一致性算法达到收敛时的平均微增率，

为第i个分布式发电机的出力下界，

为第i个分布式发电机的出力上界，a_i和b_i均为发电成本函数的价格系数。in,

is the steady-state micro-increase rate, λ _stable is the average micro-increase rate when the consensus algorithm reaches convergence,

is the output lower bound of the i-th distributed generator,

is the output upper bound of the i-th distributed generator, a _i and b _i are the price coefficients of the power generation cost function.

When the iteration reaches convergence, each distributed generator generates power under the constraint of the slight increase rate at the time of convergence, and the specific active power output of each generator is:

为第i个分布式发电机的有功出力为，

为第i个分布式发电机的出力下界，

为第i个分布式发电机的出力上界，a_i和b_i均为发电成本函数的价格系数。Among them, is the active power output of the ith distributed generator after the iterative interaction of the consensus algorithm, λ _i (k+1) is the slight increase rate of the ith distributed generator after the iterative interaction of the consensus algorithm,

The active power output for the i-th distributed generator is,

is the output lower bound of the i-th distributed generator,

is the output upper bound of the i-th distributed generator, a _i and b _i are the price coefficients of the power generation cost function.

S104: Determine the network attack detection result of the distributed power generation system according to the micro-increase rate based on the neighborhood watch mechanism.

The Neighborhood Watching mechanism can exchange data with each other through distributed entities, that is, various distributed generators, and check the exchanged data to generate the network attack detection results of the distributed power generation system.

In this embodiment, the data exchanged between the various distributed generators is the slight increase rate in the iterative process.

Specifically, the i-th distributed generator broadcasts its own micro-increase rate to its neighbor set during the k-th broadcast process, then each distributed generator in the neighbor set broadcasts the i-th micro-increase rate according to the k-th micro-increase rate. The normal range of the k+1th micro-increase rate of each distributed generator is estimated. If the actually received k+1th micro-increase rate does not meet the above normal range, it is determined that the communication network of the distributed power generation system is attacked and an abnormality occurs.

In some embodiments, if it is determined that the distributed generator node is back to normal, the distributed generator node is restored.

Specifically, the values in the adjacency matrix are defined by the parameters of distributed confidence, so as to isolate or recover malicious subjects.

Specifically, the normal range of the micro-increase rate is determined by the normal range calculation formula.

The normal range calculation formula includes:

如果j≠1，则for

If j≠1, then

If j=1, then

为第j个分布式发电机的第k+1个微增率的上限值，

为第j个分布式发电机的第k+1个微增率的下限值，η为大于零的系数，

为第j个分布式发电机的邻居集，λ_q(k)为第j个分布式发电机的邻居集中第q个分布式发电机的第k个微增率，

为第j个分布式发电机的邻居集中第k次微增率的最大值，

为第j个分布式发电机的邻居集中第k次微增率的最小值，

为第j个分布式发电机的邻居集中第k次微增率最大的元素，

为第j个分布式发电机的邻居集中第k次微增率最小的元素，ε是满足优化问题迭代收敛到可行解的收敛系数，P_demand为虚拟电厂能量管理系统预设的虚拟电厂有功输出；P_out为虚拟电厂的总输出。in,

is the upper limit of the k+1th micro-increase rate of the jth distributed generator,

is the lower limit of the k+1th micro-increase rate of the jth distributed generator, η is a coefficient greater than zero,

is the neighbor set of the jth distributed generator, λ _q (k) is the kth micro-increase rate of the qth distributed generator in the neighbor set of the jth distributed generator,

is the maximum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the minimum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the largest kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the smallest kth micro-increase rate in the neighbor set of the jth distributed generator, ε is the convergence coefficient that satisfies the iterative convergence of the optimization problem to a feasible solution, and P _demand is the virtual power plant active output preset by the virtual power plant energy management system ; P _out is the total output of the virtual power plant.

specific,

In some embodiments, after S104, the method for detecting a network attack of the distributed power generation system further includes: judging whether the abnormal distributed power generator needs to be disconnected based on the distributed confidence machine and the micro-increase rate.

Specifically, the suspicious node is recorded by the distributed trust degree recording mechanism, and the received data is judged. If the received micro-increase rate is not within the normal range, it proves that the micro-increase rate is suspicious.

Specifically, the model of the distributed confidence machine includes:

为第j个分布式发电机的第k个微增率的上限值，

为第j个分布式发电机的第k个微增率的下限值，λ_j为第j个分布式发电机的微增率。Among them, G _j [k+1] is the k+1 confidence of the j-th distributed generator, G _j [k] is the k-th confidence of the j-th generator, and is,

is the upper limit of the kth micro-increase rate of the jth distributed generator,

is the lower limit of the k-th micro-increase rate of the j-th distributed generator, and λ _j is the micro-increase rate of the j-th distributed generator.

Using the abnormal performance of the distributed confidence machine, it can be judged whether the malicious node under network attack needs to be disconnected or restarted.

The network attack detection method of the distributed power generation system provided by the embodiment of the present invention can effectively detect the network attack based on the neighborhood watch mechanism, fully protect the information security of the distributed power generation system, and ensure the safe and stable operation of the system. In this embodiment, through the iterative calculation method of interconnected power grid power flow synchronization considering privacy protection, using the distributed trust record mechanism to realize the recording of suspicious data, and locating and isolating the attack through the abnormality of the distributed trust mechanism, it is possible to Effectively realize cyber attack detection of Cyber Physical System (CPS) of distributed power generation system.

FIG. 3 shows a flowchart of judging whether the micro-increase rate conforms to the normal range in the network attack detection method of the distributed power generation system provided by the embodiment of the present invention.

Referring to Figure 3, the judging process of the micro-increase rate includes:

The i-th distributed generator broadcasts its k-th delta rate λ _i (k) to the distributed generators in its neighbor set. The distributed generators in the neighbor set receive and record the above data, and calculate the upper and lower bounds of the k+1th micro-increase rate λ _i (k+1) of the i-th distributed generator according to the received data. After receiving the k+1th micro-increase rate of the i-th distributed generator, the neighbor set detects whether the micro-increase rate is between the upper and lower bounds. By looping the above process, the detection of network attacks is realized.

It should be understood that the size of the sequence numbers of the steps in the above embodiments does not mean the sequence of execution, and the execution sequence of each process should be determined by its functions and internal logic, and should not constitute any limitation to the implementation process of the embodiments of the present invention.

FIG. 4 shows a schematic structural diagram of a network attack detection apparatus for a distributed power generation system provided by an embodiment of the present invention. Referring to FIG. 4 , the distributed power generation system network attack detection apparatus 40 provided by the embodiment of the present invention may include an undirected graph model establishment model 410 , an optimization model establishment module 420 , a micro-increase rate calculation module 430 , and a detection result generation module 440 .

The undirected graph model establishment module 410 is used to obtain the connection relationship of each distributed generator in the distributed power generation system, and establish an undirected graph model of the distributed power generation system based on the connection relationship.

The scheduling optimization model establishment module 420 is used for acquiring the operation parameters of each distributed generator in the distributed power generation system, and establishing a scheduling optimization model of the distributed generator based on the operation parameters.

The micro-increase rate calculation module 430 is configured to determine the micro-increase rate of each distributed generator in the distributed power generation system based on the scheduling optimization model and the undirected graph model.

The detection result generation module 440 is configured to determine the network attack detection result of the distributed power generation system according to the micro-increase rate based on the neighborhood watch mechanism.

The network attack detection device of the distributed power generation system provided by the embodiment of the present invention can effectively detect network attacks based on the neighborhood watch mechanism, fully protect the information security of the distributed power generation system, and ensure the safe and stable operation of the system.

In some embodiments, the undirected graph model building module 410 is specifically used to:

The node sets and edge sets of the distributed generation system are established according to the connection relationship. Based on the node set and the edge set, the neighbor set of each node is established. A weighted adjacency matrix for distributed generation systems is established based on neighbor sets. The set of nodes, the set of edges, and the weight-adjacency matrix are modeled as undirected graphs.

In some embodiments, the operation data includes the historical power generation costs of each distributed generator, and the optimization model establishment module 420 is specifically used for:

The power generation cost model of each distributed generator is established based on the historical power generation cost of each distributed generator. Based on the generation cost model, the dispatch optimization model of the distributed generation system is established.

In some embodiments, the detection result generation module 440 may include: a first micro-increase rate acquisition unit, a normal range calculation unit, a second micro-increase rate acquisition unit, and a judgment unit.

The first micro-increase rate acquiring unit is configured to acquire the kth micro-increase rate of the first distributed generator; the first distributed generator is any distributed generator in the distributed power generation system.

The normal range calculation unit is configured to calculate the normal range of the k+1th micro-increase rate of the first distributed generator based on the k-th micro-increase rate.

The second micro-increase rate acquiring unit is configured to acquire the k+1th micro-increase rate of the first distributed generator.

The judging unit is used to judge whether the k+1th micro-increase rate belongs to the normal range; if the k+1th micro-increase rate does not belong to the normal range, it is determined that the network attack detection result of the distributed power generation system is abnormal.

In some embodiments, the normal range calculation unit is specifically used for:

The normal range of the k+1th micro-increase rate of the first distributed generator is calculated based on the k-th micro-increase rate and the normal range calculation formula.

The normal range calculation formula includes:

如果j≠1，则for

If j≠1, then

If j=1, then

为第j个分布式发电机的第k+1个微增率的上限值，

为第j个分布式发电机的第k+1个微增率的下限值，η为大于零的系数，

为第j个分布式发电机的邻居集，λ_q(k)为第j个分布式发电机的邻居集中第q个分布式发电机的第k个微增率，

为第j个分布式发电机的邻居集中第k次微增率的最大值，

为第j个分布式发电机的邻居集中第k次微增率的最小值，

为第j个分布式发电机的邻居集中第k次微增率最大的元素，

为第j个分布式发电机的邻居集中第k次微增率最小的元素，ε是满足优化问题迭代收敛到可行解的收敛系数，P_demand为虚拟电厂能量管理系统预设的虚拟电厂有功输出；P_out为虚拟电厂的总输出。in,

is the upper limit of the k+1th micro-increase rate of the jth distributed generator,

is the lower limit of the k+1th micro-increase rate of the jth distributed generator, η is a coefficient greater than zero,

is the neighbor set of the jth distributed generator, λ _q (k) is the kth micro-increase rate of the qth distributed generator in the neighbor set of the jth distributed generator,

is the maximum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the minimum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the largest kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the smallest kth micro-increase rate in the neighbor set of the jth distributed generator, ε is the convergence coefficient that satisfies the iterative convergence of the optimization problem to a feasible solution, and P _demand is the virtual power plant active output preset by the virtual power plant energy management system ; P _out is the total output of the virtual power plant.

In some embodiments, the network attack detection apparatus 40 of the distributed power generation system further includes an adjustment module for adjusting the distributed power generation system based on the consensus algorithm until the distributed power generation system is in a stable operation state.

In some embodiments, the network attack detection apparatus of the distributed power generation system further includes a protection module, configured to judge whether the abnormal distributed power generator needs to be disconnected based on the distributed confidence machine and the micro-increase rate.

FIG. 5 is a schematic diagram of a terminal device according to an embodiment of the present invention. As shown in FIG. 5 , the terminal device 50 of this embodiment includes: a processor 500, a memory 510, and a computer program 520 stored in the memory 510 and executable on the processor 500, such as a distributed power generation system Network attack detection program. When the processor 50 executes the computer program 520 , the steps in each of the above embodiments of the network attack detection method for the distributed power generation system are implemented, for example, steps S101 to S104 shown in FIG. 2 . Alternatively, when the processor 500 executes the computer program 520, the functions of the modules/units in each of the foregoing apparatus embodiments, such as the functions of the modules 410 to 440 shown in FIG. 4 , are implemented.

Exemplarily, the computer program 520 may be divided into one or more modules/units, and the one or more modules/units are stored in the memory 510 and executed by the processor 500 to complete. this invention. The one or more modules/units may be a series of computer program instruction segments capable of performing specific functions, and the instruction segments are used to describe the execution process of the computer program 520 in the terminal device 50 . For example, the computer program 520 can be divided into an undirected graph model building model, an optimization model building module, a small increment rate calculation module, and a detection result generation module.

The terminal device 50 may be a computing device such as a desktop computer, a notebook, a palmtop computer, and a cloud server. The terminal device may include, but is not limited to, the processor 500 and the memory 510 . Those skilled in the art can understand that FIG. 5 is only an example of the terminal device 50, and does not constitute a limitation to the terminal device 50, and may include more or less components than the one shown, or combine some components, or different components For example, the terminal device may further include an input and output device, a network access device, a bus, and the like.

The so-called processor 500 may be a central processing unit (Central Processing Unit, CPU), and may also be other general-purpose processors, digital signal processors (Digital Signal Processors, DSP), application specific integrated circuits (Application Specific Integrated Circuit, ASIC), Off-the-shelf programmable gate array (Field-Programmable Gate Array, FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, and the like. A general purpose processor may be a microprocessor or the processor may be any conventional processor or the like.

The memory 510 may be an internal storage unit of the terminal device 50 , such as a hard disk or a memory of the terminal device 50 . The memory 510 may also be an external storage device of the terminal device 50, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) equipped on the terminal device 50. card, flash card (Flash Card) and so on. Further, the memory 510 may also include both an internal storage unit of the terminal device 50 and an external storage device. The memory 510 is used to store the computer program and other programs and data required by the terminal device. The memory 510 may also be used to temporarily store data that has been output or will be output.

Those skilled in the art can clearly understand that, for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example. Module completion, that is, dividing the internal structure of the device into different functional units or modules to complete all or part of the functions described above. Each functional unit and module in the embodiment may be integrated in one processing unit, or each unit may exist physically alone, or two or more units may be integrated in one unit, and the above-mentioned integrated units may adopt hardware. It can also be realized in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing from each other, and are not used to limit the protection scope of the present application. For the specific working processes of the units and modules in the above-mentioned system, reference may be made to the corresponding processes in the foregoing method embodiments, which will not be repeated here.

In the foregoing embodiments, the description of each embodiment has its own emphasis. For parts that are not described or described in detail in a certain embodiment, reference may be made to the relevant descriptions of other embodiments.

Those of ordinary skill in the art can realize that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Skilled artisans may implement the described functionality using different methods for each particular application, but such implementations should not be considered beyond the scope of the present invention.

In the embodiments provided by the present invention, it should be understood that the disclosed apparatus/terminal device and method may be implemented in other manners. For example, the apparatus/terminal device embodiments described above are only illustrative. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units. Or components may be combined or may be integrated into another system, or some features may be omitted, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.

The units described as separate components may or may not be physically separated, and components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated modules/units, if implemented in the form of software functional units and sold or used as independent products, may be stored in a computer-readable storage medium. Based on this understanding, the present invention can implement all or part of the processes in the methods of the above embodiments, and can also be completed by instructing relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed by the processor, the steps of the foregoing method embodiments can be implemented. Wherein, the computer program includes computer program code, and the computer program code may be in the form of source code, object code, executable file or some intermediate form, and the like. The computer-readable medium may include: any entity or device capable of carrying the computer program code, a recording medium, a U disk, a removable hard disk, a magnetic disk, an optical disk, a computer memory, a read-only memory (ROM, Read-Only Memory) , Random Access Memory (RAM, Random Access Memory), electric carrier signal, telecommunication signal and software distribution medium, etc. It should be noted that the content contained in the computer-readable media may be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction, for example, in some jurisdictions, according to legislation and patent practice, the computer-readable media Electric carrier signals and telecommunication signals are not included.

The above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: it is still possible to implement the foregoing implementations. The technical solutions described in the examples are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the within the protection scope of the present invention.

Claims (10)

1. A network attack detection method for a distributed power generation system, characterized in that, comprising: acquiring the connection relationship of each distributed generator in the distributed power generation system, and establishing an undirected graph model of the distributed power generation system based on the connection relationship; Obtaining operating parameters of each distributed generator in the distributed power generation system, and establishing a scheduling optimization model of the distributed power generation system based on the operating parameters; based on the scheduling optimization model and the undirected graph model, determining the micro-increase rate of each distributed generator in the distributed power generation system; A network attack detection result of the distributed power generation system is determined according to the micro-increase rate based on a neighborhood watch mechanism. 2 . The network attack detection method for a distributed power generation system according to claim 1 , wherein the establishing an undirected graph model of the distributed power generation system based on the connection relationship comprises: 2 . establishing a node set and an edge set of the distributed power generation system according to the connection relationship; Based on the node set and the edge set, establish a neighbor set of each node; establishing a weighted adjacency matrix of the distributed power generation system based on the neighbor set; The node set, the edge set and the weight adjacency matrix are used as the undirected graph model. 3. The method for detecting a network attack of a distributed power generation system according to claim 1, wherein the operation data comprises the historical power generation cost of each distributed power generator; The establishment of the dispatch optimization model of the distributed power generation system based on the operating parameters includes: establishing a power generation cost model of each distributed generator based on the historical power generation cost of each distributed generator; A dispatch optimization model of the distributed power generation system is established based on the power generation cost model. 4. The network attack detection method of the distributed power generation system according to claim 1, wherein the determination of the network attack detection result of the distributed power generation system based on the neighborhood watch mechanism according to the micro-increase rate comprises: obtaining the kth micro-increase rate of the first distributed generator; the first distributed generator is any distributed generator in the distributed power generation system; calculating the normal range of the k+1th micro-increase rate of the first distributed generator based on the k-th micro-increase rate; Obtain the k+1th micro-increase rate of the first distributed generator; Judging whether the k+1th micro-increase rate belongs to the normal range; If the k+1th micro-increase rate does not belong to the normal range, it is determined that the network attack detection result of the distributed power generation system is abnormal. 5 . The method for detecting network attacks of a distributed power generation system according to claim 4 , wherein the calculation of the k+1th microcomputer of the first distributed generator based on the kth microincrease rate is performed. 6 . The normal range for the rate of increase includes: Calculate the normal range of the k+1th micro-increase rate of the first distributed generator based on the k-th micro-increase rate and the normal range calculation formula; The normal range calculation formula includes: for

If j≠1, then

If j=1, then

in,

is the upper limit of the k+1th micro-increase rate of the jth distributed generator,

is the lower limit of the k+1th micro-increase rate of the jth distributed generator, η is a coefficient greater than zero,

is the neighbor set of the jth distributed generator, λ _q (k) is the kth micro-increase rate of the qth distributed generator in the neighbor set of the jth distributed generator,

is the maximum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the minimum value of the kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the largest kth micro-increase rate in the neighbor set of the jth distributed generator,

is the element with the smallest kth micro-increase rate in the neighbor set of the jth distributed generator, ε is the convergence coefficient that satisfies the iterative convergence of the optimization problem to a feasible solution, and P _demand is the virtual power plant active output preset by the virtual power plant energy management system ; P _out is the total output of the virtual power plant. 6 . The network attack detection method for a distributed power generation system according to any one of claims 1 to 5 , wherein the neighborhood watch-based mechanism determines the network attack detection of the distributed power generation system according to the micro-increase rate. 7 . Before the result, the method further includes: The distributed power generation system is adjusted based on a consensus algorithm until the distributed power generation system is in a stable operating state. 7. The network attack detection method of a distributed power generation system according to any one of claims 1-5, wherein the network attack detection of the distributed power generation system is determined according to the micro-increase rate based on the neighborhood watch mechanism Following the results, the method includes: Based on the distributed confidence machine and the micro-increase rate, it is judged whether it is necessary to disconnect the abnormal distributed generator. 8. A network attack detection device for a distributed power generation system, characterized in that, comprising: an undirected graph model establishment module, used for acquiring the connection relationship of each distributed generator in the distributed power generation system, and establishing an undirected graph model of the distributed power generation system based on the connection relationship; a dispatching optimization model establishment module, used for acquiring the operating parameters of each distributed generator in the distributed power generation system, and establishing a dispatching optimization model of the distributed generator based on the operating parameters; a micro-increase rate calculation module, configured to determine the micro-increase rate of each distributed generator in the distributed power generation system based on the scheduling optimization model and the undirected graph model; A detection result generation module, configured to determine a network attack detection result of the distributed power generation system according to the micro-increase rate based on a neighborhood watch mechanism. 9. A terminal device, comprising a memory, a processor and a computer program stored in the memory and running on the processor, characterized in that, when the processor executes the computer program, the implementation as claimed in the claims The steps of any one of 1 to 7 of the method. 10. A computer-readable storage medium storing a computer program, characterized in that, when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented .

Images