Network Attack Recognition Method Of The Power-CPS Based On Ensemble Learning

With the continuous improvement of power system intelligence,the smart grid has shown the characteristics of the Cyber-Physical-System(CPS).The deep integration of information flow and physical flow enhances the stability control of the information layer to the physical grid.However,the network vulnerabilities in the information space provide the opportunity for network attacks.After the intrusion of a network attack,the power devices of the physical level can’t be controlled stably,and it breaks down or even damages,which causes a large range of power failure in serious cases.In order to improve the power CPS’s ability about how to prevent network attacks,this paper proposed a network attack recognition method of the power CPS based on ensemble learning.The research is carried out from three aspects: data balance processing,data dimension reduction,and ensemble classifier design.The main research contents are as follows:(1)When the attack occurs to the information layer,it’s difficult for the measuring system to obtain sufficient data to represent the state of the power grid,the low number of network attack samples leads to the serious data imbalance problem,which causes the high false-positive rate of the network attack recognition model.Aiming at the above problem,this paper proposed a network attack data balance processing method,central interpolation,and piecewise sampling strategies are introduced into the Kmeans-Smote oversampling algorithm.Pseudo samples that are highly similar to the real attack samples are obtained and added to the original sample set,which makes the number of samples between various attack events and non-attack events tend to be equal,and realizes the network attack sample set balancing processing.The experimental example shows that after data balancing,the recognition accuracy of attack categories with low sample numbers is significantly improved,the false positive rate is significantly decreased.(2)The redundancy attributes in the physical layer measurement data of power CPS reduce the accuracy of the network attack recognition model and makes it more time-consuming.To improve the network attack recognition efficiency and precision,this paper proposed the optimal feature subset selection method of network attack recognition.Several features that are highly relevant to data labels are selected iteratively based on the Joint Mutual Information Maximization(JMIM)algorithm,these features form the optimal feature subset of the network attack recognition algorithm.The optimal feature subset of network attack recognition is used to represent the state of the power grid after the network attack,which solves the problem that the existence of redundant features reduces the training accuracy and training speed.The simulation results show that this method reduces the data dimension obviously,which eliminates the redundant features,improves the recognition accuracy,and shortens the recognition time of the network attack event.(3)After the power CPS network attack,the physical power grid breaks down or even collapses.The characteristics of the physical side measurement data are similar to those of the normal condition when faults occur.Simple statistical analysis or bad data detection algorithm is difficult to find the characteristics of network attacks under such data,and there exists the disadvantages of high false detection and missed detection rate.Aiming at the above problems,this paper designed a network attack recognition model based on ensemble learning,a network attack recognizer based on the Lightgbm ensemble learning algorithm was built,and the focus loss function was introduced to improve the Lightgbm algorithm.In the process of gradient boosting,the misclassified samples are paid more attention by the classifier,and the classification accuracy of the misclassified samples is improved,thus the performance of the network attack recognition model is improved.The simulation results show that this method improves the network attack recognition precision.To sum up,this paper proposed a network attack recognition method of the power-CPS based on ensemble learning.The experimental analysis on Python3.7 platform shows that the average accuracy of this method is 97.35%,and the false positive rate is as low as 2.71%.It obtains great anti-noise performance and strong applicability.