CN-122022854-A - Method and device for detecting network attack and electricity larceny, medium and terminal

CN122022854ACN 122022854 ACN122022854 ACN 122022854ACN-122022854-A

Abstract

The application discloses a detection method and device, a medium and a terminal for network attack electricity larceny, which relate to the technical field of electrician theory and mainly aim to solve the problem that the detection accuracy of the traditional electricity larceny detection method is greatly reduced because of the fact that the network attack electricity larceny has the action of tampering electricity consumption data of a user. The method comprises the steps of obtaining original electricity consumption sequence data of a target user, carrying out reconstruction processing on the original electricity consumption sequence data based on an electricity consumption sequence data reconstruction model to obtain reconstructed electricity consumption sequence data, calculating reconstruction errors between the reconstructed electricity consumption sequence data and the original electricity consumption sequence data, determining the electricity consumption sequence data to be detected according to comparison results of the reconstruction errors and a preset reconstruction error threshold value, and carrying out electricity theft detection operation on the electricity consumption sequence data to be detected based on a network attack electricity theft detection model to obtain network attack electricity theft detection results of the target user.

Inventors

DENG GAOFENG
GUO XUEWEI
HUANG CHENGKUN
LIU SHIPING
GAO JING
YOU XIAOHUI
WU FENGCHENG
TAN ZHENHUI
Ai Yuhao

Assignees

国网江西省电力有限公司供电服务管理中心

Dates

Publication Date: 20260512
Application Date: 20260410

Claims (10)

1. A method for detecting theft of electricity against a network attack, comprising: Acquiring original electricity sequence data of a target user; Based on a power utilization sequence data reconstruction model which is trained by the model, carrying out reconstruction processing on the original power utilization sequence data to obtain reconstructed power utilization sequence data corresponding to the original power utilization sequence data; calculating a reconstruction error between the reconstruction power consumption sequence data and the original power consumption sequence data, and determining power consumption sequence data to be detected according to a comparison result of the reconstruction error and a preset reconstruction error threshold value; and carrying out electricity stealing detection operation on the to-be-detected electricity consumption sequence data based on the network attack electricity stealing detection model trained by the model, and obtaining the network attack electricity stealing detection result of the target user.
2. The method according to claim 1, wherein before the performing a power-theft detection operation on the power sequence data to be detected based on the network attack power-theft detection model that has been trained by the model, the method further comprises: acquiring a preset discarding probability; The power consumption data in the power consumption sequence data to be detected is used as power consumption data before modification, random numbers between 0 and 1 are randomly generated for each power consumption data before modification, the power consumption data before modification is marked as being discarded when the random numbers are smaller than the preset discarding probability, and the power consumption data before modification is marked as being reserved when the random numbers are larger than or equal to the preset discarding probability; for each piece of pre-modification power consumption data marked as discarded, taking 0 as modified power consumption data corresponding to the pre-modification power consumption data; For each pre-modification power consumption data marked as reserved, taking the product of the pre-modification power consumption data and a preset reserved probability as modified power consumption data corresponding to the pre-modification power consumption data, wherein the sum of the preset discarding probability and the preset reserved probability is 1; And integrating all the modified power consumption data to obtain power consumption sequence data to be detected after random discarding processing, so as to perform power consumption detection operation on the power consumption sequence data to be detected after random discarding processing based on a network attack power consumption detection model trained by the completed model.
3. The method according to claim 1, wherein the determining the power sequence data to be detected according to the comparison result of the reconstruction error and a preset reconstruction error threshold value includes: if the reconstruction error is larger than the preset reconstruction error threshold, determining the reconstruction power consumption sequence data as power consumption sequence data to be detected; And if the reconstruction error is smaller than or equal to the preset reconstruction error threshold, determining the original power consumption sequence data as power consumption sequence data to be detected.
4. The method according to claim 1, wherein the reconstructing model is based on the power consumption sequence data that has been trained by the model, and before the reconstructing process is performed on the original power consumption sequence data to obtain the reconstructed power consumption sequence data corresponding to the original power consumption sequence data, the method further includes: constructing an initial power sequence data reconstruction model; Acquiring historical original power consumption sequence data of a plurality of historical users, and adding Gaussian noise to each historical original power consumption sequence data to obtain a plurality of historical power consumption sequence data with noise; Reconstructing the historical noisy non-electricity-theft sequence data based on the initial electricity-use sequence data reconstruction model to obtain historical reconstructed non-electricity-use sequence data corresponding to the historical noisy non-electricity-theft sequence data, and calculating a loss value between the historical reconstructed non-electricity-use sequence data and the historical original non-electricity-use sequence data corresponding to the historical noisy non-electricity-theft sequence data to obtain a loss value of the historical reconstructed non-electricity-use sequence data; And superposing all the historical reconstructed non-stolen power consumption sequence data loss values to obtain a reconstructed total loss value of the initial power consumption sequence data reconstruction model, adjusting model parameters of the initial power consumption sequence data reconstruction model by referring to the reconstructed total loss value to obtain an adjusted power consumption sequence data reconstruction model, and continuing to perform model training and reconstruction total loss value calculation on the adjusted power consumption sequence data reconstruction model until convergence to obtain the power consumption sequence data reconstruction model with completed model training.
5. The method according to claim 1, wherein before the performing a power-theft detection operation on the power sequence data to be detected based on the network attack power-theft detection model that has been trained by the model, the method further comprises: Constructing an initial network attack electricity larceny detection model; Acquiring a plurality of historical original electricity utilization sequence data and corresponding user tags, wherein the historical original electricity utilization sequence data is historical original non-electricity utilization sequence data or historical original electricity utilization sequence data, the user tags corresponding to the historical original non-electricity utilization sequence data are non-electricity utilization users, and the user tags corresponding to the historical original electricity utilization sequence data are electricity utilization users; For each historical original electricity sequence data, carrying out reconstruction processing on the historical original electricity sequence data based on an electricity sequence data reconstruction model trained by the completed model to obtain historical reconstructed electricity sequence data corresponding to the historical original electricity sequence data, and determining a network attack electricity larceny detection model training sample corresponding to the historical original electricity sequence data according to a historical reconstruction error between the historical reconstructed electricity sequence data and the historical original electricity sequence data and the preset reconstruction error threshold value, wherein the network attack electricity larceny detection model training sample carries a corresponding standard user tag which is a user tag corresponding to the historical original electricity sequence data; aiming at each network attack electricity stealing detection model training sample, carrying out electricity stealing detection operation on the network attack electricity stealing detection model training sample based on the initial network attack electricity stealing detection model to obtain a predicted user tag corresponding to the network attack electricity stealing detection model training sample, and calculating a loss value between the predicted user tag and a standard user tag corresponding to the network attack electricity stealing detection model training sample to obtain a loss value of the predicted user tag; And superposing all the predicted loss values of the user labels to obtain a detection total loss value of the initial network attack electricity larceny detection model, adjusting model parameters of the initial network attack electricity larceny detection model by referring to the detection total loss value to obtain an adjusted network attack electricity larceny detection model, and continuing to perform model training and detection total loss value calculation on the adjusted network attack electricity larceny detection model until convergence to obtain the network attack electricity larceny detection model with completed model training.
6. The method of claim 5, wherein the obtaining a plurality of historical raw electricity usage sequence data and corresponding user tags comprises: Acquiring historical original power consumption sequence data of a plurality of historical users; For each historical original power-stealing-free power sequence data, injecting false power consumption data into the historical original power-stealing-free power sequence data based on a preset false data injection attack function set to obtain false data injection attack historical original power-stealing-free power sequence data, wherein the preset false data injection attack function set is that , Indicating historical original power-up sequence data, The 1 st kind of attack function is represented, 、、 Representing the intensity coefficient of the attack, The range of values is represented by the range of values, The attack function of the 2 nd kind is indicated, The 3 rd kind of attack function is indicated, The 4 th kind of attack function is represented, Representing the average value of historical original power sequence data, Representing the sequence data after the historical original power consumption sequence data is arranged in positive sequence from the 1 st to the n th according to time steps, The 5 th kind of attack function is indicated, The 6 th kind of attack function is shown, Representing the sequence data after the historical original power consumption sequence data is arranged in reverse order from the nth to the 1 st according to time steps; Tampering is carried out on the historical original power consumption sequence data based on a preset avoidance detection attack algorithm aiming at each historical original power consumption sequence data to obtain the avoidance detection attack historical original power consumption sequence data, wherein the preset avoidance detection attack algorithm comprises a rapid gradient sign algorithm, a projection gradient descent algorithm and a momentum iteration algorithm; and injecting all the false data into the attack historical original electricity larceny sequence data and integrating all the evading detection attack historical original electricity larceny sequence data to obtain a plurality of historical original electricity larceny sequence data, integrating the plurality of historical original electricity larceny sequence data and the plurality of historical original non-electricity larceny sequence data to obtain a plurality of historical original electricity larceny sequence data, and mapping and storing the plurality of historical original electricity larceny sequence data and the corresponding user labels.
7. The method of claim 1, wherein the body of the power-on sequence data reconstruction model employs a convolutional neural network and adds residual connections between layers of an encoder and a decoder for power-on feature delivery and assigns a attention weight to each power-on feature using an attention mechanism, and wherein the body of the cyber attack power-on detection model employs a convolutional neural network and uses a linear function of limiting rectification as an activation function, wherein the linear function of limiting rectification is , The activation function is represented as a function of the activation, The input value is represented by a value of the input, Representing a cutoff threshold.
8. A device for detecting theft of electricity against a cyber attack, comprising: The original electricity sequence data acquisition module is used for acquiring original electricity sequence data of a target user; The power consumption sequence data reconstruction module is used for carrying out reconstruction processing on the original power consumption sequence data based on a power consumption sequence data reconstruction model which is trained by the model, so as to obtain reconstructed power consumption sequence data corresponding to the original power consumption sequence data; the power consumption sequence data to be detected is used for calculating a reconstruction error between the reconstruction power consumption sequence data and the original power consumption sequence data, and determining the power consumption sequence data to be detected according to a comparison result of the reconstruction error and a preset reconstruction error threshold value; and the electricity stealing detection module is used for carrying out electricity stealing detection operation on the to-be-detected electricity using sequence data based on the network attack electricity stealing detection model which is trained by the model, and obtaining the network attack electricity stealing detection result of the target user.
9. A storage medium having stored therein at least one executable instruction for causing a processor to perform operations corresponding to the method of detecting theft of electricity against a network attack of any one of claims 1 to 7.
10. A terminal comprises a processor, a memory, a communication interface and a communication bus, wherein the processor, the memory and the communication interface complete communication with each other through the communication bus; The memory is configured to store at least one executable instruction, where the executable instruction causes the processor to perform operations corresponding to the method for detecting theft of electricity against a network attack according to any one of claims 1 to 7.

Description

Method and device for detecting network attack and electricity larceny, medium and terminal Technical Field The application relates to the technical field of electrotechnical theory, in particular to a method and a device for detecting network attack electricity larceny, a medium and a terminal. Background With the rapid development of advanced measurement systems (ADVANCED METERING) and the wide deployment of smart meters, the collection precision and frequency of user electricity data by power grid companies are greatly improved, and although powerful tools are provided for the striking of power theft, a communication network between the smart meters and a data management system faces new security threats. Some malicious users implement network attack by utilizing security holes existing in AMI, and the purpose of reducing electric charge payment is achieved by invading a communication network or directly tampering with electric meter readings in a data management system. Compared with the traditional physical attack electricity larceny, the electricity larceny behavior implemented by the network means has more concealed form and more complex and diversified mode, and brings serious challenges to the traditional electricity larceny detection means. Currently, most existing electricity stealing behavior detection methods focus on the identification of physical attacks, for example, by analyzing the mutation of the electricity consumption of a user or comparing with the line loss of a platform to determine whether there is a suspicion of electricity stealing. In recent years, with the development of artificial intelligence technology, part of research is beginning to introduce a machine learning model to analyze user electricity consumption data, and automatic identification of electricity stealing users is realized by extracting user electricity consumption characteristics. However, because network attack electricity larceny can tamper the electricity consumption data of the user, the electricity larceny data deviates from the distribution boundary of two types of samples of the electricity larceny user and the non-electricity larceny user learned during the training of the machine learning model, and the detection accuracy based on the machine learning model is greatly reduced. Disclosure of Invention In view of the above, the present application provides a method and apparatus for detecting fraudulent use of electricity against a network attack, a medium, and a terminal, and aims to solve the problem that the detection accuracy of the existing method for detecting fraudulent use of electricity is greatly reduced due to the fact that the fraudulent use of electricity against a network attack has a behavior of tampering with electricity data of a user. According to one aspect of the present application, there is provided a method for detecting theft of electricity against a network attack, comprising: Acquiring original electricity sequence data of a target user; Based on a power utilization sequence data reconstruction model which is trained by the model, carrying out reconstruction processing on the original power utilization sequence data to obtain reconstructed power utilization sequence data corresponding to the original power utilization sequence data; calculating a reconstruction error between the reconstruction power consumption sequence data and the original power consumption sequence data, and determining power consumption sequence data to be detected according to a comparison result of the reconstruction error and a preset reconstruction error threshold value; and carrying out electricity stealing detection operation on the to-be-detected electricity consumption sequence data based on the network attack electricity stealing detection model trained by the model, and obtaining the network attack electricity stealing detection result of the target user. Preferably, before the network attack electricity larceny detection model trained based on the completed model performs electricity larceny detection operation on the to-be-detected electricity consumption sequence data to obtain the network attack electricity larceny detection result of the target user, the method further includes: acquiring a preset discarding probability; The power consumption data in the power consumption sequence data to be detected is used as power consumption data before modification, random numbers between 0 and 1 are randomly generated for each power consumption data before modification, the power consumption data before modification is marked as being discarded when the random numbers are smaller than the preset discarding probability, and the power consumption data before modification is marked as being reserved when the random numbers are larger than or equal to the preset discarding probability; for each piece of pre-modification power consumption data marked as discarded, taking 0 as modified power consumption data cor