VNN-DM: a vector neural network-based detection model for time synchronization attacks in park-level energy internet

2.1. Principle of system state estimation

In the power system network, µPMUs are strategically distributed across the buses, providing detailed measurements of system dynamics. µPMUs capture both the complex voltage of the bus and the complex currents flowing through all transmission lines connected to it, enabling precise monitoring of power flow dynamics. Considering a local network, suppose there are $$ {{N}_{b}} $$ buses, connected by $$ {N}_{l} $$ transmission lines. The number of transmission lines connected to bus n is $$ {L}_{n} $$. The set of other buses connected to bus $$ n $$ is denoted as $$ {{B}_{n}} $$. The µPMU measurement vector is $$ Z=\left[ {{z}_{1}}, \cdots , {{z}_{{{n}_{b}}}} \right]\in {{R}^{{{N}_{b}}}} $$. The bus voltage vector for all bus-es is denoted as $$ {{V}_{n}}=\left[ {{v}_{nr}}, {{v}_{nj}} \right]\in {{R}^{{{N}_{b}}\times 2}}, n=1, \ldots , {{N}_{b}} $$, where $$ {{v}_{nr}} $$ and $$ {{v}_{nj}} $$ represent the real and imaginary parts of $$ {{V}_{n}} $$, respectively. Similarly, for the branch connected to bus $$ n $$, the complex current vector of the bus transmission line can be expressed as $$ {{I}_{n}}=\left[ {{I}_{{{n}_{k}}}}\left| \left( {{i}_{{{n}_{k}}, r}}, {{i}_{{{n}_{k}}, j}} \right) \right. \right]\in {{R}^{{{N}_{b}}\times {{L}_{n}}\times 2}}, n=1, \ldots , {{L}_{n}} $$, where $$ {{i}_{{{n}_{k}}, r}} $$ and $$ {{i}_{{{n}_{k}}, j}} $$ represent the real and imaginary parts of the complex current $$ {{I}_{{{n}_{k}}}} $$ of the transmission line $$ k $$ and bus $$ n $$. The measurement vector is:

Where $$ {{\theta }_{k}} $$ and $$ {{\theta }_{n}} $$ are the corresponding phase angles of the voltage and current. In the classical state estimation problem, the relationship between the µPMU measurements and the system state vector is established as follows:

where $$ h(X) $$ represents the measurement function of the system state vector $$ X={{\left[ {{x}_{1}}, \ldots , {{x}_{m}} \right]}^{T}}\in {{R}^{m}} $$; $$ e=\left[ {{e}_{1}}, \ldots {{e}_{{{N}_{b}}}} \right] $$ represents the random measurement errors introduced during the measurement process. These errors follow a Gaussian distribution $$ e\sim N\left( 0, {{\sigma }^{2}} \right) $$, and the covariance matrix $$ R $$ is denoted as $$ R=diag\left[ \sigma _{1}^{2}, \ldots , \sigma _{{{N}_{b}}}^{2} \right] $$. During the state estimation process using µPMUs, to improve the accuracy of the estimation, the weighted least squares (WLS) method is commonly employed to adjust the weight of the measurement values. The measurement residual is defined as $$ r=Z-h(X) $$. To quantify the deviation between the measured value and the estimated value, the objective function $$ {{Y}_{WSL}} $$ is expressed as the weighted sum of squared residuals:

To obtain the optimal state estimation, it is necessary to minimize the objective function $$ {{Y}_{WSL}} $$ Therefore, the new objective function can be written as:

Assume the initial state estimate is $$ {{x}^{\left( t \right)}} $$, such that $$ h(X) $$ is linear around the initial estimate. By performing a Taylor series expansion of $$ h(X) $$ at $$ {{x}^{\left( t \right)}} $$ we obtain:

Where $$ J\left( \cdot \right) $$ is the Jacobian matrix of $$ h(\cdot ) $$.

Substituting the higher-order terms and applying the formula and let $$ {{\tilde{r}}_{t}}=Z-h({{x}^{(t)}}) $$:

To obtain the optimal objective function, set $$ \frac{\partial {{Y}_{WSL}}}{\partial \Delta x}=0 $$ and solve for the estimate of $$ \Delta \hat{x} $$:

Thus, the state estimate vector is iteratively updated according to the iterative formula:

When $$ \Delta \hat{x} $$ satisfies the convergence condition $$ \Delta \hat{x}\le \varepsilon $$, the iteration stops. The state estimate $$ \Delta \hat{x} $$ is obtained. The final value of the state estimate is:

In system state estimation, the largest normalized residual (LNR) method is used for anomaly detection. This method normalizes the residuals of each measurement and then compares the maximum normalized residual to a predefined threshold. Specifically, if the LNR is below the threshold $$ \tau $$, it indicates that the measurement does not contain significant bad data and can be accepted for further analysis and processing. Otherwise, the measurement is considered abnormal, potentially containing erroneous data, and requires further inspection and handling. This method effectively improves the reliability of data quality and enhances the overall stability of the system.

2.2. TSA attack model

During a TSA, the attacker sends spoofed GPS signals, introducing incorrect time synchronization in µPMU measurements. This disrupts the phase angles of synchronized data, causing a mismatch between measured and actual phase values^[25]. Assume that the attack occurs on bus $$ k $$. The power system operates at a frequency $$ f $$ of 60 Hz. The attack induces a clock shift $$ \Delta {{t}_{k}} $$^[26], causing the µPMU's phase angle to change, leading to a phase angle deviation $$ \Delta \theta _{k}^{err} $$:

Table 1 presents the phase angle deviation errors caused by TSA. The phase angle deviation of the affected bus $$ z_{{{t}_{k}}}^{err} $$ can be expressed as:

Through analysis, the relationship between the measurement vector under TSA and the normal measurement vector can be derived. The phase angle deviation $$ \Delta \theta _{k}^{err} $$ falls within the interval $$ \left[ 0, 2\pi \right] $$or$$ \left[ -\pi , \pi \right] $$, depending on the specific conditions. To further describe the measurement vector under TSA for all buses, the measurement vector is:

Where $$ {{E}_{n}}\left( n=1, \ldots , {{N}_{b}} \right) $$ is a diagonal matrix. $$ {{E}_{{{k}_{1}}}}, \ldots , {{E}_{{{k}_{n}}}} $$ represent the µPMUs affected by TSA. The measurement vector for each affected bus can be expressed as:

The residual error vector is:

An adversary can exploit the attack matrix $$ {{A}_{attack}} $$, which satisfies condition $$ \left\| {{r}^{err}} \right\|\le \tau $$. This can allow the attack to bypass basic detection mechanisms such as BDD. A TSA attack enables an attacker to inject falsified phase measurement data, causing the system to incorrectly assume that its state estimation is accurate. This erroneous state estimation may lead to failures in power dispatch and control decisions, further triggering a chain reaction that affects the efficiency and safety of power generation and transmission. Experimental studies^[29] have shown that TSA can evade BDD detection by subtly adjusting the PMU timing, thus masking timing discrepancies within acceptable limits of detection mechanisms such as the $$ \chi^2 $$ test. These adjustments, while seemingly minor, allow timing errors to accumulate undetected over time, exacerbating system vulnerabilities. The growing dependency on synchronized measurement data in modern power grids magnifies the risks posed by such attacks. Therefore, effectively detecting TSA attacks is crucial to ensuring the secure operation of the power system.

3.1. Dynamic routing between vector neurons

Dynamic routing establishes a non-linear mapping through an iterative process, enabling more adaptive and hierarchical information flow between network layers. In this process, the data from each lower-level capsule (sub-capsule) is passed to the appropriate higher-level capsule (parent capsule) in the next layer. Dynamic routing adaptively modulates the connection strength between sub-capsules and parent capsules, leveraging the output of the sub-capsules, thereby increasing or decreasing these connections. Let the data in the sub-capsule be denoted as $$ {{z}_{n}} $$. The relationship between sub-capsule $$ n $$ and parent capsule $$ k $$ can be expressed as:

Where each sub-component of the data encapsulated in the capsule is subjected to positional encoding. This ensures that the prediction includes the correlation between the input data's amplitude and positional phase. In other words, the prediction captures the correlation between the amplitude and phase of the actual input data. Using the measured value as an example, the corresponding peak value in the complex wave is simplified, and the positional encoding data is expressed. The predictive measurement after encoding is given by:

Where $$ {{\hat{z}}_{k\left| n \right.}} $$ is the contribution of the child capsule $$ {{z}_{n}} $$ to the father capsule $$ {{v}_{k}} $$. Assuming that a child capsule provides input, based on dynamic routing, the contribution from the latent parent capsule is derived as follows:

Where $$ g({{z}_{k}}) $$ is a non-linear activation function. The iterative update of the selection coefficient $$ {{c}_{nk}} $$ uses the $$ SoftMax $$ function, expressed as:

The parent capsule $$ {{v}_{k}} $$ is the result of a non-linear compression and normalization of the weighted sum of predicted vectors, and the existence probability of the parent capsule is expressed as $$ {{\left\| {{v}_{k}} \right\|}_{2}} $$. The parent capsule's prediction is regularized using dynamic routing with iterative weighted averaging and non-linear compression. The iterative value of $$ {{b}_{k\left| n \right.}} $$ is updated as:

In the initial stage, the prediction weights $$ {{b}_{k\left| n \right.}} $$ are set to 0. The flow chart of complex dynamic routing is shown in Algorithm 1. The dynamic routing mechanism trains parameters by predicting vectors and obtains capsule output.

This dynamic routing process can be likened to a reinforcement learning mechanism. The process ensures each layer's input is recalculated based on the forward propagation strategy. During network training, the optimization strategy relies on a margin loss function, defined as:

Here, $$ {{T}_{c}} $$ is the target output for class $$ c $$ and $$ {{T}_{c}} $$. If the target is the correct class, $$ {{T}_{c}} $$=1; otherwise, $$ {{T}_{c}} $$=0. $$ {{m}^{+}} $$ is the upper margin (typically set to 0.9) and $$ {{m}^{-}} $$ is the lower margin (typically set to 0.1). A regularization weight $$ \lambda $$ is applied to the total loss. $$ {{v}_{k}} $$ is the output vector. The weight update for the layers during back-propagation is given by:

Where $$ {{\nabla }_{{{v}_{k}}}} $$ denotes the gradient of the loss function with respect to $$ {{v}_{k}} $$. $$ {\sigma }'\left( \cdot \right) $$ represents the derivative of the activation function. The error in back-propagation is calculated layer by layer, with the error in back-propagation being:

Where $$ {{\omega }^{l+1}} $$ is the transpose of the weight matrix in layer $$ l+1 $$. After updating the weights and biases layer by layer using the gradient descent method, the model returns the updated weight matrix $$ {{\omega }^{l}} $$. The reset method is defined as:

Where $$ \eta $$ is the learning rate, and the learning rate and $$ m $$ is the sample size.

3.2. TSA detection model

The overall structure of the VNN-DM model consists of two components: an encoder and a decoder. The encoder is primarily responsible for data extraction and representation, while the decoder enhances the model's representational capacity. This section provides a detailed explanation of the detection model's structure.

4.1. The impact of TSA attacks on energy internet systems

To analyze the impact of TSA attacks on park-level energy internet, this paper designs a system state estimation simulation scenario based on the IEEE 14-bus standard network. The system state estimation method follows the approach outlined in Chapter 2. During the state estimation process, this paper simulates an attacker's TSA on the system, with the attack set at Node 4. The WLS calculation values under both attack and non-attack conditions are shown in Figure 3.

Figure 3. State estimation with or without attack.

The experimental results demonstrate that significant deviations in voltage phase angles occurred at multiple nodes before and after the attack, with the attack on Node 4 also causing deviations at other nodes. This is because the power system is a complex network where the state of each node depends not only on its own attributes but also on the states of the nodes it is connected to. When Node 4 is attacked, its voltage phase angle is tampered with or disturbed, altering the power flow and phase angle distribution between this node and its neighboring nodes, which in turn causes changes in the states of other nodes. The TSA attack directly influences the time synchronization of measurement devices, leading to phase angle shifts in state estimation. Distortion in state estimation can result in incorrect power flow control and dispatch, thereby affecting the normal operation and energy distribution of the system. This has significant implications for the reliability and security of the regional energy internet system.

4.2. Model performance evaluation

To evaluate the performance of the proposed model, this paper introduces the Confusion Matrix to quantify the gap between predicted results and actual outcomes. The Confusion Matrix is a method for visualizing computational results, and its structure is shown in Table 3. From this matrix, four key parameters can be derived: true positive (TP), true negative (TN), false positive (FP), and false negative (FN). Using these parameters, several evaluation metrics can be calculated, including accuracy, precision, recall, and F1-score, as well as the receiver operating characteristic (ROC) curve and the area under the curve (AUC), to quantify the model's performance. These metrics are defined as follows:

Accuracy reflects the overall correctness of the model's predictions. Precision evaluates the proportion of correctly predicted positive samples among all samples predicted as positive. Recall measures the model's ability to correctly identify positive samples among all actual positive samples. The F1-score is used to assess the model's performance on imbalanced datasets and is the harmonic mean of Precision and Recall.

To validate the effectiveness of the VNN-DM detection model in TSA detection tasks, two sets of experiments were designed to compare the performance of different models on the same test dataset. The first set of experiments analyzed the detection capability differences between a single-layer convolutional model, the reference model, and the proposed VNN-DM model, aiming to verify the performance improvements in feature extraction and classification achieved by combining a multi-layer convolutional network structure with a capsule network. The second set of experiments compared traditional machine learning models, including support vector machine (SVM), K-nearest neighbor (KNN), and MLP, to further assess the performance improvements of the VNN-DM model over traditional models. The evaluation metrics for all models in both sets of experiments are shown in Table 4.

Additionally, to further highlight the classification performance of the models, ROC curves were plotted for both sets of experiments. The ROC curve illustrates the model's discriminative ability by displaying the relationship between the true positive rate (TPR) and the false positive rate (FPR). To quantify the overall performance of the ROC curve, the AUC was calculated, with values closer to 1 indicating better model performance. Figure 4 presents the ROC curves for the different models, with Figure 4A showing the ROC curve and AUC values for the first experiment, and Figure 4B for the second experiment.

Figure 4. ROC curves and AUC values corresponding to different models. (A) First set of experiment; (B) Second set of experiment. ROC: Receiver operating characteristic; AUC: area under the curve.

An analysis of the ROC curves and the experimental results in Table 4 clearly demonstrates significant performance differences among the models in the TSA detection task. In the first set of experiments, the single-layer convolutional model performed poorly across all metrics, indicating clear deficiencies in feature extraction and classification, making it difficult to handle data with complex temporal features. In contrast, the reference model showed considerable improvement, but still suffered from a certain degree of false positives and false negatives, indicating that the detection performance was not optimal. The proposed VNN-DM model, utilizing a multi-layer convolutional structure, outperformed the other models in terms of accuracy, precision, and recall. As shown by the ROC curve in Figure 4A, the AUC value of the VNN-DM model is 0.96, higher than the 0.57 of the single-layer convolutional model and the 0.94 of the reference model. This demonstrates that the VNN-DM model can more effectively differentiate between normal data and attack data, particularly when dealing with complex multi-node joint attacks and small phase disturbances, exhibiting higher detection accuracy and robustness.

In the second set of experiments, the VNN-DM model achieved an F1-score of 0.8968, significantly higher than the SVM model's 0.7820 and the KNN model's 0.6662, indicating that the VNN-DM model is more effective at extracting data features when handling complex temporal features and multi-node attacks, thus exhibiting greater classification ability and robustness. The MLP model performed well on some metrics, but its F1-score of 0.8204 was still lower than that of the VNN-DM model. The analysis of the ROC curve in Figure 4B shows that the ROC curve of the VNN-DM model is closer to the upper left corner, with an AUC value of 0.96, significantly outperforming other traditional models. This indicates that the VNN-DM model maintains high classification accuracy and low false-positive and false-negative rates when addressing the problem of TSAs in the Park-Level Energy Internet. Therefore, through the combination of a multi-layer convolutional structure and a dynamic routing mechanism, the VNN-DM model further enhances its ability to extract and classify multi-scale temporal features, making it more adaptable to various complex attack types in the Park-Level Energy Internet environment, thus establishing it as a more robust TSA detection model.

Acknowledgements

A part of the experiment results in this paper is simulated by SimuNPS.

Authors' contributions

Implemented the methodologies presented and wrote the paper: Yang J

Developed the idea of the proposed framework: Shi F

Responsible for data collection and technical support: Li Y, Zhao Z

Managed and supervised the research project: Cui Q

All authors have revised the text and agreed to the published version of the manuscript.

Availability of data and materials

Not applicable.

Financial support and sponsorship

The work is supported by the National Natural Science Foundation of China (No. U23A20651)

Conflicts of interest

All authors declared that there are no conflicts of interest.

Ethical approval and consent to participate

Not applicable.

Consent for publication

Not applicable.

Copyright

© The Author(s) 2024.