Power grid risk prediction method and system based on network security data, and medium

Abstract

The invention discloses a power grid risk prediction method and system based on network security data and a medium. Relates to the technical field of network security. Performing embedded coding on the power grid security situation data to obtain a power grid security situation embedded coding vector sequence; performing feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time sequence significant aggregation representation vector; the method comprises the following steps: analyzing power grid security situation data based on an artificial intelligence technology of deep learning, extracting power grid security situation characteristics at each time point, carrying out information dynamic aggregation according to the relative importance of the power grid security situation characteristics at each time point, mining a global change rule and a potential abnormal mode of the power grid security situation data, and carrying out dynamic information aggregation. Therefore, intelligent identification of the abnormal state of the power grid network is realized. The dynamic change of the power grid network environment can be more accurately captured, early warning and quick response to the abnormal state of the power grid network are achieved, and therefore the defense capacity of a power grid system to network attacks is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and medium for predicting power grid risks based on network security data. Background Art

[0002] With the rapid development of information technology and the continuous advancement of smart grid construction, power grid systems are increasingly characterized by high informatization, automation, and interconnection. While this trend improves the efficiency and flexibility of power grid operation, it also greatly increases the risk of power grids being attacked or failing. Therefore, network security has become one of the key factors that cannot be ignored for the stable operation of modern power grids.

[0003] Traditional power grid security monitoring mainly relies on physical protection, static rule matching, and manual experience judgment. These methods are often difficult to achieve timely and accurate warning and response when facing complex and changeable network attack patterns and potential security risks. In particular, with the continuous emergence of new network attack methods such as advanced persistent threats (APT), distributed denial of service attacks (DDoS), and malware intrusions, the effectiveness of traditional defense systems has been severely challenged.

[0004] Therefore, an optimized grid risk prediction method for network security is expected. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. This application provides a power grid risk prediction method, system and medium based on network security data, which uses artificial intelligence technology based on deep learning to analyze power grid security situation data, extract the power grid security situation characteristics at each time point, and dynamically aggregate information based on the relative importance of the power grid security situation characteristics at each time point, so as to mine the global change law and potential abnormal patterns of power grid security situation data, thereby realizing intelligent identification of abnormal states of power grid networks; it can more accurately capture the dynamic changes of the power grid network environment, realize early warning and rapid response to abnormal states of power grid networks, thereby improving the defense capabilities of power grid systems against network attacks.

[0006] The present invention is achieved through the following technical solutions:

[0007] This solution provides a power grid risk prediction method based on network security data, including:

[0008] Obtain power grid security situation data and construct a power grid security situation data sequence;

[0009] Based on the power grid security situation data embedding coding matrix, each power grid security situation data in the power grid security situation data sequence is embedded and coded to obtain a power grid security situation embedded coding vector sequence;

[0010] Performing feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector;

[0011] According to the time series significant aggregation representation vector of power grid security situation, it is predicted whether the network status of the power grid is abnormal.

[0012] A further optimization scheme is that the feature enhancement method includes:

[0013] Calculate the characteristic significance description factor of each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence to construct a power grid security situation characteristic significance description factor sequence: map each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence to a hyperbolic space to obtain a mapping sequence; calculate the square Poincare norm of each mapping vector in the mapping sequence;

[0014] Based on the power grid security situation feature significance description factor sequence, the power grid security situation embedded coding vector sequence is subjected to hierarchical mask modulation to obtain a power grid security situation enhanced embedded coding vector sequence.

[0015] A further optimization scheme is to perform hierarchical mask modulation on the power grid security situation embedded coding vector sequence, including the method:

[0016] Performing hierarchical mask modulation on the power grid security situation feature significance description factor sequence to obtain a power grid security situation feature significance modulation weight sequence;

[0017] According to the significance modulation weight sequence of the power grid security situation characteristics, the power grid security situation embedded coding vector sequence is correspondingly weighted modulated to obtain the power grid security situation enhanced embedded coding vector sequence.

[0018] A further optimization scheme is that the dynamic polymerization method includes:

[0019] Obtaining characteristic energy distribution of the power grid security situation enhancement embedded coding vector sequence;

[0020] Determining an initial center vector of power grid security situation data clustering based on the characteristic energy distribution;

[0021] Based on the spatial span of the power grid security situation enhanced embedded coding vector sequence relative to the initial central vector of the power grid security situation data clustering, each power grid security situation enhanced embedded coding vector in the power grid security situation enhanced embedded coding vector sequence is dynamically aggregated to obtain the power grid security situation time series significant aggregation representation vector.

[0022] A further optimization scheme is that the initial center vector of the power grid security situation data clustering is determined based on the characteristic energy distribution; including the method:

[0023] Based on the characteristic energy distribution, the static energy factor of each power grid security situation enhanced embedded coding vector is calculated to obtain a power grid security situation static energy factor sequence: the kurtosis of each power grid security situation enhanced embedded coding vector is calculated, and the kurtosis is input into the sigmoid activation function to calculate the power grid security situation static energy factor;

[0024] A power grid security situation enhanced embedded coding vector corresponding to the maximum value in the power grid security situation static energy factor sequence is selected as the initial center vector of the power grid security situation data clustering.

[0025] A further optimization scheme is that the method for obtaining the time series significant aggregation representation vector of the power grid security situation includes:

[0026] Based on the spatial span between each power grid security situation enhanced embedded coding vector in the power grid security situation enhanced embedded coding vector sequence and the initial center vector of the power grid security situation data clustering, combined with the power grid security situation static energy factor sequence, the dynamic aggregation energy factor of each power grid security situation enhanced embedded coding vector is calculated to obtain the power grid security situation dynamic aggregation energy factor sequence;

[0027] Inputting the power grid security situation dynamic aggregation energy factor sequence into the gated mask unit to obtain the power grid security situation dynamic aggregation weight factor sequence;

[0028] Based on the power grid security situation dynamic aggregation weight factor sequence, the weighted sum of the power grid security situation enhanced embedded coding vector sequence is calculated to obtain a power grid security situation time series significant aggregation representation vector.

[0029] A further optimization scheme is that the method for obtaining the power grid security situation dynamic aggregation energy factor sequence includes:

[0030] Taking the square value of the number of eigenvectors between the power grid security situation enhanced embedded coding vector and the initial center vector of the power grid security situation data clustering as the spatial span coefficient, the product A of the static energy factor of the power grid security situation enhanced embedded coding vector and the static energy factor of the initial center vector of the power grid security situation data clustering is calculated, and the weighted ratio between the product A and the spatial span coefficient is calculated to obtain the dynamic aggregation energy factor of the power grid security situation.

[0031] A further optimization scheme is that the time series significant aggregation representation vector of the power grid security situation is used to predict whether the network state of the power grid is abnormal, including the following method:

[0032] The grid security situation time series significant aggregation representation vector is input into a grid risk prediction model based on a classifier to predict whether there is an abnormality in the grid network state.

[0033] The present solution also provides a power grid risk prediction system based on network security data, which is used to implement the above-mentioned power grid risk prediction method based on network security data. The system includes:

[0034] The acquisition module is used to obtain power grid security situation data and construct a power grid security situation data sequence;

[0035] A coding module, used for embedding and coding each power grid security situation data in the power grid security situation data sequence based on the power grid security situation data embedding coding matrix to obtain a power grid security situation embedding coding vector sequence;

[0036] An enhanced aggregation module is used to perform feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector;

[0037] The prediction module predicts whether the network status of the power grid is abnormal based on the time series significant aggregation representation vector of the power grid security situation.

[0038] The present solution also provides a computer-readable medium having a computer program stored thereon, and the computer program is executed by a processor to implement the above-mentioned power grid risk prediction method based on network security data.

[0039] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0040] The present invention provides a method, system and medium for predicting power grid risks based on network security data; it uses artificial intelligence technology based on deep learning to analyze power grid security situation data, extracts the power grid security situation characteristics at each time point, and dynamically aggregates information based on the relative importance of the power grid security situation characteristics at each time point, so as to dig out the global change rules and potential abnormal patterns of the power grid security situation data, thereby realizing intelligent identification of abnormal states of the power grid network. In this way, the dynamic changes of the power grid network environment can be captured more accurately, and early warning and rapid response to abnormal states of the power grid network can be realized, thereby improving the defense capability of the power grid system against network attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0042] Figure 1 It is a flowchart of a power grid risk prediction method based on network security data;

[0043] Figure 2 A data flow diagram of a power grid risk prediction method for network security;

[0044] Figure 3 It is a flowchart of the feature enhancement method;

[0045] Figure 4 It is a schematic diagram of the dynamic polymerization method process;

[0046] Figure 5 A flowchart of a method for obtaining a time series significant aggregation representation vector of a power grid security situation;

[0047] Figure 6 Schematic diagram of the structure of the power grid risk prediction system based on network security data. DETAILED DESCRIPTION

[0048] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0049] Traditional power grid security monitoring mainly relies on physical protection, static rule matching, and manual experience judgment. These methods are often difficult to achieve timely and accurate warning and response when facing complex and changeable network attack patterns and potential security risks. In particular, with the continuous emergence of new network attack methods such as advanced persistent threats (APT), distributed denial of service attacks (DDoS), and malware intrusions, the effectiveness of traditional defense systems has been severely challenged.

[0050] In response to the above technical problems, this application proposes a power grid risk prediction method and system based on network security data, which uses artificial intelligence technology based on deep learning to analyze the power grid security situation data, extract the power grid security situation characteristics at each time point, and dynamically aggregate information based on the relative importance of the power grid security situation characteristics at each time point, so as to dig out the global change rules and potential abnormal patterns of the power grid security situation data, thereby realizing intelligent identification of abnormal states of the power grid network. In this way, the dynamic changes of the power grid network environment can be captured more accurately, and early warning and rapid response to abnormal states of the power grid network can be achieved, thereby improving the defense capabilities of the power grid system against network attacks.

[0051] Example 1

[0052] This embodiment provides a power grid risk prediction method based on network security data, such as Figure 1 and Figure 2 As shown, including:

[0053] Step 1, obtain the power grid security situation data and construct the power grid security situation data sequence; in this step, the power grid security situation data sequence can be understood as, in the power grid network environment, the network security status at each time point can be represented by a set of features, these features may be numerical (such as the number of attacks, abnormal login attempts), category (such as normal abnormality) or mixed data, including but not limited to network traffic data, log information, system operation status parameters, etc. Therefore, in the technical solution of the present application, in order to fully obtain the network security status information of the power grid, by collecting and analyzing various security-related data in the network environment to form a series of continuous time points The description of the security status, thereby constructing a power grid security situation data sequence, so as to fully reflect the security status of the network in a specific time period.

[0054] Step 2: embedding and encoding each power grid security situation data in the power grid security situation data sequence based on the power grid security situation data embedding coding matrix to obtain a power grid security situation embedding coding vector sequence;

[0055] In this step, it is considered that the power grid security situation data is multidimensional and complex. Therefore, in order to further convert the data into a unified data format so as to facilitate efficient processing and analysis thereof using a deep learning algorithm, this scheme introduces a power grid security situation data embedding coding matrix to embed and code each power grid security situation data in the power grid security situation data sequence, so as to map the high-dimensional and complex power grid security situation data to a low-dimensional and easy-to-process vector space, and capture the intrinsic characteristics and structure of the data, thereby generating a power grid security situation embedding coding vector sequence. In an embodiment of the present application, the Word2Vec model is used to train and generate the power grid security situation data embedding coding matrix.

[0056] Step 3, performing feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector;

[0057] Considering that there may be some redundant or noisy information in the sequence of the power grid security situation data, which may interfere with the subsequent accurate judgment of the power grid security situation. Therefore, in order to further improve the feature representation ability of the power grid security situation data and reduce the impact of redundant information on the network status analysis results, this scheme further enhances the features of the power grid security situation embedded coding vector sequence to identify and retain the key features, while weakening the interference information, thereby enhancing the expressiveness and discrimination of the features.

[0058] like Figure 3 As shown, the feature enhancement method in step three includes:

[0059] S31, calculating the characteristic significance description factor of each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence, and constructing a power grid security situation characteristic significance description factor sequence: mapping each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence to a hyperbolic space to obtain a mapping sequence; calculating the squared Poincare norm of each mapping vector in the mapping sequence;

[0060] S32, based on the power grid security situation feature significance description factor sequence, hierarchical mask modulation is performed on the power grid security situation embedded coding vector sequence to obtain a power grid security situation enhanced embedded coding vector sequence.

[0061] In this step, hierarchical mask modulation is performed on the power grid security situation embedded coding vector sequence, including the method:

[0062] S321, performing hierarchical mask modulation on the sequence of significance description factors of power grid security situation characteristics to obtain a sequence of significance modulation weights of power grid security situation characteristics; specifically, the sequence of significance description factors of power grid security situation characteristics is input into a normalization process based on a softmax function to obtain a sequence of normalized significance description factors of power grid security situation characteristics; the sequence of normalized significance description factors of power grid security situation characteristics is input into a multi-level mask function to obtain a sequence of significance modulation weights of power grid security situation characteristics. Among them, the normalized power grid security situation characteristic significance description factor sequence is input into a multi-level mask function to obtain the power grid security situation characteristic significance modulation weight sequence, including: setting a first mask threshold and a second mask threshold, wherein the second mask threshold is twice the first mask threshold; comparing each normalized power grid security situation characteristic significance description factor in the normalized power grid security situation characteristic significance description factor sequence with the first mask threshold and the second mask threshold, if the normalized power grid security situation characteristic significance description factor is greater than the second mask threshold, weighted amplification is performed on it; if the normalized power grid security situation characteristic significance description factor is greater than the first mask threshold and is less than or equal to the second mask threshold, it remains unchanged; if the normalized power grid security situation characteristic significance description factor is less than or equal to the first mask threshold, it is weighted suppression is performed on it, so as to obtain the power grid security situation characteristic significance modulation weight sequence.

[0063] S322, according to the power grid security situation feature significance modulation weight sequence, the power grid security situation embedded coding vector sequence is correspondingly weighted modulated to obtain a power grid security situation enhanced embedded coding vector sequence.

[0064] Accordingly, the sequence of the power grid security situation embedded coding vectors is processed by the following feature enhancement formula to obtain the sequence of the power grid security situation enhanced embedded coding vectors, wherein the feature enhancement formula is:

[0065] X={x1,x2,...,x i ,...,x n}

[0066] h i =W1x i W2

[0067]

[0068] w i =mask(o i ′

[0069]

[0070] X′={x1′,x2′,...,x i ′,...,x n ′}

[0071] x i ′=w i ·x i

[0072] Where X represents the sequence of the power grid security situation embedded coding vector, x1, x2, x i and x n represents the first, second, i-th and n-th power grid security situation embedding coding vectors in the sequence of the power grid security situation embedding coding vectors, respectively, n is the number of the power grid security situation embedding coding vectors, W1 and W2 are different weight matrices used to project the power grid security situation embedding coding vector from Euclidean space to hyperbolic space, h i is the embedding coding vector of the power grid security situation after the i-th mapping, ‖·‖ 2 represents the square of the norm of the eigenvector, log represents the logarithmic function with base 2, exp(·) represents the exponential function with base e, o i represents the significant descriptive factor of the i-th power grid security situation feature, o i ′ represents the ith normalized power grid security situation feature significance description factor, θ represents the first mask threshold, λ and η are different weight parameters, and λ>1, η<1, mask(·) is the mask function, w i is the significant modulation weight of the ith power grid security situation feature, X′ is the sequence of the power grid security situation enhanced embedded coding vector, x1′, x2′, x i ′ and x n ′ respectively represent the first, second, i-th and n-th power grid security situation enhancement embedded coding vectors in the sequence of power grid security situation enhancement embedded coding vectors.

[0073] It should be understood that, considering that the hyperbolic space can embed more hierarchical information more effectively than the Euclidean space, it is helpful to better understand the semantic hierarchy of the power grid security situation data. Therefore, in the present application, each power grid security situation embedding coding vector is first mapped from the Euclidean space to the hyperbolic space. In the hyperbolic space, as the distance increases, the spatial volume grows exponentially. Based on this characteristic, the semantic hierarchy of the power grid security situation data can be better maintained. Then, in the hyperbolic space, the square Poincare norm of each power grid security situation embedding coding vector is further calculated to measure the importance or contribution of the feature, so as to obtain a sequence of power grid security situation feature significance description factors. Then, the sequence of power grid security situation feature significance description factors is subjected to three-level hierarchical mask modulation, and the feature significance description factors of different levels are subjected to feature scaling based on different scales, so as to retain different power grid security situation feature components while paying different degrees of feature attention to them, so as to better highlight important features and suppress irrelevant features. Finally, the obtained power grid security situation feature significance modulation weights are used to perform weighted modulation on the original power grid security situation embedded coding vector, thereby obtaining a sequence of more representative and distinctive power grid security situation enhanced embedded coding vectors.

[0074] Since the power grid security situation data has dynamic changing characteristics and there are complex dependencies between the security situation data at different time points, in order to more accurately characterize the overall security situation of the power grid, this scheme proposes an information dynamic aggregation method, which simulates the interaction between the power grid security situation data at each time point, dynamically aggregates the power grid security situation information in the characteristic distribution field, so as to reveal the potential laws and patterns of the power grid security situation and generate a time-series significant aggregation representation vector of the power grid security situation.

[0075] like Figure 4 As shown, the method of dynamic aggregation in step three includes:

[0076] S301, obtaining characteristic energy distribution of the power grid security situation enhancement embedded coding vector sequence;

[0077] S302, determining the initial center vector of the power grid security situation data clustering based on the characteristic energy distribution; this step specifically includes the following method:

[0078] S3021, calculating the static energy factor of each power grid security situation enhanced embedded coding vector based on the characteristic energy distribution, and obtaining a power grid security situation static energy factor sequence: calculating the kurtosis of each power grid security situation enhanced embedded coding vector, and inputting the kurtosis into the sigmoid activation function to calculate the power grid security situation static energy factor;

[0079] S3022, select the grid security situation enhanced embedded coding vector corresponding to the maximum value in the grid security situation static energy factor sequence as the initial center vector of the grid security situation data clustering. This scheme calculates the static energy factor of each grid security situation enhanced embedded coding vector based on a predefined metric function to evaluate its stability and importance in the feature space, and selects the grid security situation enhanced embedded coding vector corresponding to the largest static energy factor as the initial center vector of the grid security situation data clustering to determine the cluster core of the grid security situation data feature distribution, thereby providing a stable reference point for subsequent feature aggregation.

[0080] S303, based on the spatial span of the power grid security situation enhancement embedded coding vector sequence relative to the initial central vector of the power grid security situation data clustering, each power grid security situation enhancement embedded coding vector in the power grid security situation enhancement embedded coding vector sequence is dynamically aggregated to obtain the power grid security situation time series significant aggregation representation vector.

[0081] like Figure 5 As shown, in this step, the method for obtaining the time series significant aggregation representation vector of the power grid security situation includes:

[0082] S3031, based on the spatial span between each grid security situation enhanced embedded coding vector in the grid security situation enhanced embedded coding vector sequence and the initial center vector of the grid security situation data cluster, combined with the grid security situation static energy factor sequence, calculate the dynamic aggregation energy factor of each grid security situation enhanced embedded coding vector, and obtain the grid security situation dynamic aggregation energy factor sequence; specifically including: taking the square value of the number of eigenvectors between the grid security situation enhanced embedded coding vector and the initial center vector of the grid security situation data cluster as the spatial span coefficient, calculate the weighted ratio between the product of the static energy factor of the grid security situation enhanced embedded coding vector and the static energy factor of the initial center vector of the grid security situation data cluster and the spatial span coefficient to obtain the grid security situation dynamic aggregation energy factor. Here, based on the spatial span of each grid security situation enhanced embedded coding vector relative to the initial center vector of the grid security situation data cluster, and combined with the respective static energy factors of the two, the dynamic aggregation energy factor of each grid security situation enhanced embedded coding vector is further derived. That is, by considering the feature space proximity of each power grid security situation enhanced embedded coding vector relative to the core of the power grid security situation data feature distribution cluster and the importance difference of the intrinsic attributes, its contribution to the global time domain characteristics of the power grid security situation can be measured more accurately.

[0083] S3032, inputting the power grid security situation dynamic aggregation energy factor sequence into a gated mask unit to obtain a power grid security situation dynamic aggregation weight factor sequence; the method for obtaining the power grid security situation dynamic aggregation energy factor sequence includes:

[0084] Taking the square value of the number of eigenvectors between the power grid security situation enhanced embedded coding vector and the initial center vector of the power grid security situation data clustering as the spatial span coefficient, the product A of the static energy factor of the power grid security situation enhanced embedded coding vector and the static energy factor of the initial center vector of the power grid security situation data clustering is calculated, and the weighted ratio between the product A and the spatial span coefficient is calculated to obtain the dynamic aggregation energy factor of the power grid security situation.

[0085] Specifically, this step includes: inputting the sequence of the dynamic aggregation energy factor of the power grid security situation into the sigmoid function for normalization processing to obtain the sequence of the normalized dynamic aggregation energy factor of the power grid security situation; based on the preset mask threshold, the sequence of the normalized dynamic aggregation energy factor of the power grid security situation is inactivated to obtain the sequence of the dynamic aggregation weight factor of the power grid security situation. That is, based on the gated mask mechanism, the obtained dynamic aggregation energy factor is nonlinearly transformed and screened to generate corresponding weights, so as to weightedly aggregate the sequence of the power grid security situation enhanced embedded coding vector, thereby enhancing the model's attention to key information and suppressing the influence of redundant information on the aggregation results, so as to obtain a significant aggregation representation vector of the power grid security situation time series. It is worth mentioning that the sigmoid function is a mathematical function widely used in statistics and machine learning, and is suitable for binary classification problems. It maps any real value to the (0,1) interval, making it very suitable for representing probability or as an activation function in a neural network, converting the output of the neural network into a probability value, indicating the probability of existence of a certain category.

[0086] Accordingly, the sequence of the power grid security situation enhanced embedded coding vector is processed by the following feature dynamic aggregation formula to obtain the power grid security situation time series significant aggregation representation vector, wherein the feature dynamic aggregation formula is:

[0087] X′={x1′,x2′,...,x i ′,...,x n ′}

[0088]

[0089] x c =x m '

[0090]

[0091]

[0092] w si =mask(w i ′)

[0093]

[0094] Wherein, X′ represents the sequence of the grid security situation enhanced embedded coding vector, x1′, x2′, x i ′、x m ′ and x n ′ respectively represent the first, second, i-th, m-th and n-th power grid security situation enhancement embedded coding vectors in the sequence of the power grid security situation enhancement embedded coding vectors, and the value of n is the number of the power grid security situation enhancement embedded coding vectors, represents the eigenvalue of the jth position in the i-th grid security situation enhanced embedding coding vector, μ i and σ i 4 denote the feature mean and the square of the feature variance of the i-th power grid security situation enhanced embedded coding vector, E{·} denotes the expected value of the calculation set, sigmoid denotes the sigmoid activation function, represents the static energy factor of the i-th power grid security situation enhanced embedded coding vector, argmax represents the index corresponding to the maximum value, m represents the index of the largest static energy factor in the sequence of the power grid security situation static energy factors, x c represents the initial center vector of the power grid security situation data clustering, represents the static energy factor of the initial center vector of the power grid security situation data clustering, a and b are different weight parameters, Count(x i ′→x m ′) represents the number of feature vectors between the i-th power grid security situation enhanced embedded coding vector and the initial center vector of the power grid security situation data clustering, represents the dynamic aggregation energy factor of the i-th grid security situation enhancement embedded coding vector, w i ′ represents the i-th normalized dynamic aggregation energy factor, mask(·) represents mask processing, θ′ is the preset mask threshold, and w si represents the ith dynamic aggregation weight factor, and V represents the significant aggregation representation vector of the power grid security situation time series.

[0095] S3033, based on the power grid security situation dynamic aggregation weight factor sequence, calculate the weighted sum of the power grid security situation enhanced embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector.

[0096] Step 4: Based on the significant aggregation representation vector of the power grid security situation time series, predict whether the network status of the power grid is abnormal.

[0097] This step specifically includes a method: inputting the power grid security situation time series significant aggregation representation vector into a classifier-based power grid risk prediction model to predict whether there is an abnormality in the power grid network state.

[0098] In a specific example of the present application, the grid security situation time series significant aggregation representation vector is input into a grid risk prediction module based on a classifier to obtain a prediction result, and the prediction result is used to indicate whether there is an abnormality in the grid network state. It is worth mentioning that a classifier is an algorithm or model used in the field of machine learning to classify data into known categories, which adjusts its internal parameters through back propagation and optimization algorithms (such as Adam, SGD, etc.) to improve the accuracy of classification judgment. In the actual application stage, the grid security situation time series significant aggregation representation vector is input into a trained classifier, and the classifier can parse and classify it according to the learned classification rules to determine whether there is an abnormality in the grid network state.

[0099] In the technical solution of the present application, each power grid security situation embedded coding vector in the sequence of power grid security situation embedded coding vectors respectively represents the low-dimensional semantic embedded coding features of each power grid security situation data in the sequence of power grid security situation data. After the sequence of power grid security situation embedded coding vectors is enhanced by the feature sequence based on explicit modeling, the consistency of the feature manifolds between each power grid security situation enhanced embedded coding vector in the sequence of power grid security situation enhanced embedded coding vectors is destroyed, which makes the feature manifold of the obtained power grid security situation time series significant aggregation representation vector have an unbalanced feature space structure distribution in the high-dimensional feature space when the sequence of power grid security situation enhanced embedded coding vectors is dynamically aggregated, thereby affecting the accuracy of the prediction results obtained by the classifier-based power grid risk prediction module.

[0100] Preferably, in an example of the present application, the grid security situation time series significant aggregation representation vector is input into a grid risk prediction module based on a classifier to obtain a prediction result, including: performing L random sampling on the grid security situation time series significant aggregation representation vector to obtain L grid security situation random disturbance eigenvalues; arranging the L grid security situation random disturbance eigenvalues ​​in an ordered manner from large to small to obtain a grid security situation random disturbance ordered vector; calculating the self-inner product of the grid security situation time series significant aggregation representation vector to obtain a grid security situation energy modulation eigenvalue; and arranging the grid security situation random disturbance ordered vector based on the grid security situation energy modulation eigenvalue. The vector is semantically scaled to obtain a semantically enhanced randomly disturbed ordered vector of power grid security situation; the product between the semantically enhanced randomly disturbed ordered vector of power grid security situation and the transposed vector of the power grid security situation time series significant aggregation representation vector is calculated to obtain a power grid security situation best sample prompt orthogonal modulation matrix; the matrix product between the power grid security situation best sample prompt orthogonal modulation matrix and the power grid security situation time series significant aggregation representation vector is calculated to obtain an optimized power grid security situation time series significant aggregation representation vector; the optimized power grid security situation time series significant aggregation representation vector is input into the classifier-based power grid risk prediction module to obtain the prediction result.

[0101] Accordingly, the optimization process of the power grid security situation time series significant aggregation representation vector is expressed by the following optimization formula:

[0102] S i =∈ i ,i=1,2,...,L

[0103]

[0104] u=average(V)

[0105]

[0106] V order =Order{S i}

[0107]

[0108] Among them, V is the significant aggregation representation vector of the power grid security situation time series, represents the normal distribution, ∈ i represents a random variable that follows a normal distribution, L represents the number of random sampling, u and σ 2 They represent the characteristic mean and characteristic variance of the significant aggregation representation vector of the power grid security situation time series, S irepresents the random disturbance eigenvalues ​​of each power grid security situation obtained by L random samplings of the significant aggregation representation vector of the power grid security situation time series, V order is the ordered vector of random disturbance of the power grid security situation, represents the self-inner product of the calculated eigenvector, e is the energy modulation eigenvalue of the power grid security situation, M t is the orthogonal modulation matrix of the best example of power grid security situation, ⊙ represents the point multiplication by position, Represents vector multiplication, V ′ is the optimized time series significant aggregation representation vector of the power grid security situation.

[0109] That is, by performing L random sampling on the grid security situation time series significant aggregation representation vector to obtain a set of new feature values ​​based on the original features but containing slight changes, randomness is introduced to explore different aspects of the feature space, and by simulating the noise or variation in the actual data, the model is better generalized to unseen data. Then, these grid security situation random perturbation feature values ​​are arranged in order from large to small to form a grid security situation random perturbation ordered vector to identify which perturbation directions may be the most important for the current problem. Such an ordering not only helps the algorithm focus on the feature differences that can best distinguish different categories, but also helps to reveal hidden data structures or patterns. Subsequently, the inner product of the grid security situation time series significant aggregation representation vector is calculated to obtain the grid security situation energy modulation eigenvalue, which reflects the overall strength or "energy" of the original feature vector and provides a benchmark for measuring the importance of the feature. Using this grid security situation energy modulation eigenvalue as a reference point, the previously formed grid security situation random perturbation ordered vector is semantically scaled to construct a semantically enhanced grid security situation random perturbation ordered vector. In this way, those disturbances that appear to be more important in the original feature space are amplified, thereby enhancing the model's sensitivity to changes in key features, while also retaining relatively small but potentially useful disturbance information.

[0110] Then, the product of the semantically enhanced random perturbation ordered vector of power grid security situation and the transpose of the power grid security situation time series significant aggregation representation vector is calculated to obtain the best example prompt orthogonal modulation matrix of power grid security situation. The purpose is to find the interaction between the features from two different perspectives. The formed matrix can be regarded as a conversion tool for capturing and representing the complex linear relationship between features. Finally, the best example prompt orthogonal modulation matrix of power grid security situation constructed above is applied to the original power grid security situation time series significant aggregation representation vector to complete the final feature structure modulation, so that the features are more in line with the requirements of the objective function, reduce redundant information, and maximize the retention of useful information, so as to improve learning efficiency and prediction performance.

[0111] Therefore, in a preferred example, a feature manifold optimization process for the time-series significant aggregation representation vector of the power grid security situation is clarified, which extracts the best prompt samples based on fine-grained target retrieval of random perturbations, and then guides adversarial robust learning based on the best prompt samples to complete the structure of the high-dimensional manifold of the feature vector in the feature space, so as to improve the detail and structure of the feature expression.

[0112] In summary, the network security-based power grid risk prediction method of the embodiment of the present application is explained, which uses artificial intelligence technology based on deep learning to analyze the power grid security situation data, extract the power grid security situation characteristics at each time point, and based on the relative importance of the power grid security situation characteristics at each time point, dynamically aggregate the information to dig out the global change rules and potential abnormal patterns of the power grid security situation data, thereby realizing intelligent identification of abnormal states of the power grid network. In this way, the dynamic changes of the power grid network environment can be captured more accurately, and early warning and rapid response to abnormal states of the power grid network can be achieved, thereby improving the defense capability of the power grid system against network attacks.

[0113] Example 2

[0114] This embodiment provides a power grid risk prediction system based on network security data, which is used to implement the power grid risk prediction method based on network security data described in Example 1. Figure 6 As shown, the system comprises:

[0115] The acquisition module is used to obtain power grid security situation data and construct a power grid security situation data sequence;

[0116] A coding module, used for embedding and coding each power grid security situation data in the power grid security situation data sequence based on the power grid security situation data embedding coding matrix to obtain a power grid security situation embedding coding vector sequence;

[0117] An enhanced aggregation module is used to perform feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector;

[0118] The prediction module predicts whether the network status of the power grid is abnormal based on the time series significant aggregation representation vector of the power grid security situation.

[0119] Example 3

[0120] This embodiment provides a computer-readable medium having a computer program stored thereon, and the computer program is executed by a processor to implement the power grid risk prediction method based on network security data as described in Embodiment 1; specifically, the following steps are performed:

[0121] Step 1: Obtain power grid security situation data and construct a power grid security situation data sequence;

[0122] Step 2: embedding and encoding each power grid security situation data in the power grid security situation data sequence based on the power grid security situation data embedding coding matrix to obtain a power grid security situation embedding coding vector sequence;

[0123] Step 3: Perform feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector;

[0124] Step 4: Based on the significant aggregation representation vector of the power grid security situation time series, predict whether the network status of the power grid is abnormal.

[0125] The basic principle of the present invention is described above in conjunction with specific embodiments. However, it should be pointed out that the advantages, strengths, effects, etc. mentioned in the present invention are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. must be possessed by each embodiment of the present invention. In addition, the specific details of the above embodiments are only for the purpose of illustration and facilitation of understanding, rather than limitation, and the above details do not limit the present invention to being implemented by adopting the above specific details.

[0126] In the above embodiments, the description of each embodiment has its own emphasis. For the parts that are not described or recorded in detail in a certain embodiment, please refer to the relevant description of other embodiments. In the several embodiments provided by the present invention, it should be understood that the disclosed system and method can be implemented in other ways. For example, the system embodiment described above is only schematic. For example, the unit division is only a logical function division, and there may be other division methods in actual implementation. The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the scheme of this embodiment.

[0127] It will be apparent to those skilled in the art that the invention is not limited to the details of the exemplary embodiments described above and that the invention can be implemented in other specific forms without departing from the spirit or essential features of the invention. Therefore, the embodiments should be considered exemplary and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description, and it is intended that all variations falling within the meaning and scope of the equivalent elements of the claims be included in the invention. Any reference to a figure in a claim should not be considered as limiting the claim to which it relates.

[0128] In addition, it is obvious that the word "comprising" does not exclude other units or steps, and the singular does not exclude the plural. The multiple units stated in the system claims can also be implemented by one unit through software or hardware.

[0129] Finally, it should be noted that the above description has been given for the purpose of illustration and description. In addition, the specific implementation methods described above further describe the purpose, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A power grid risk prediction method based on network security data, characterized in that: include: Obtain power grid security situation data and construct a power grid security situation data sequence; Based on the power grid security situation data embedding coding matrix, each power grid security situation data in the power grid security situation data sequence is embedded and coded to obtain a power grid security situation embedded coding vector sequence; Performing feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector; According to the time series significant aggregation representation vector of power grid security situation, it is predicted whether the network status of the power grid is abnormal.

2. The method for predicting power grid risks based on network security data according to claim 1, characterized in that: The feature enhancement method comprises: Calculate the characteristic significance description factor of each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence to construct a power grid security situation characteristic significance description factor sequence: map each power grid security situation embedded coding vector in the power grid security situation embedded coding vector sequence to a hyperbolic space to obtain a mapping sequence; calculate the square Poincare norm of each mapping vector in the mapping sequence; Based on the power grid security situation feature significance description factor sequence, the power grid security situation embedded coding vector sequence is subjected to hierarchical mask modulation to obtain a power grid security situation enhanced embedded coding vector sequence.

3. The method for predicting power grid risks based on network security data according to claim 2 is characterized in that: The power grid security situation embedded coding vector sequence is subjected to hierarchical mask modulation, including a method: Performing hierarchical mask modulation on the power grid security situation feature significance description factor sequence to obtain a power grid security situation feature significance modulation weight sequence; According to the significance modulation weight sequence of the power grid security situation characteristics, the power grid security situation embedded coding vector sequence is correspondingly weighted modulated to obtain the power grid security situation enhanced embedded coding vector sequence.

4. The method for predicting power grid risks based on network security data according to claim 2 is characterized in that: The dynamic aggregation method comprises: Obtaining characteristic energy distribution of the power grid security situation enhancement embedded coding vector sequence; Determining an initial center vector of power grid security situation data clustering based on the characteristic energy distribution; Based on the spatial span of the power grid security situation enhanced embedded coding vector sequence relative to the initial central vector of the power grid security situation data clustering, each power grid security situation enhanced embedded coding vector in the power grid security situation enhanced embedded coding vector sequence is dynamically aggregated to obtain the power grid security situation time series significant aggregation representation vector.

5. The method for predicting power grid risks based on network security data according to claim 4 is characterized in that: The method of determining the initial center vector of the power grid security situation data clustering based on the characteristic energy distribution includes: Based on the characteristic energy distribution, the static energy factor of each power grid security situation enhanced embedded coding vector is calculated to obtain a power grid security situation static energy factor sequence: the kurtosis of each power grid security situation enhanced embedded coding vector is calculated, and the kurtosis is input into the sigmoid activation function to calculate the power grid security situation static energy factor; A power grid security situation enhanced embedded coding vector corresponding to the maximum value in the power grid security situation static energy factor sequence is selected as the initial center vector of the power grid security situation data clustering.

6. The method for predicting power grid risks based on network security data according to claim 5 is characterized in that: The method for obtaining the time series significant aggregation representation vector of the power grid security situation includes: Based on the spatial span between each power grid security situation enhanced embedded coding vector in the power grid security situation enhanced embedded coding vector sequence and the initial center vector of the power grid security situation data clustering, combined with the power grid security situation static energy factor sequence, the dynamic aggregation energy factor of each power grid security situation enhanced embedded coding vector is calculated to obtain the power grid security situation dynamic aggregation energy factor sequence; Inputting the power grid security situation dynamic aggregation energy factor sequence into the gated mask unit to obtain the power grid security situation dynamic aggregation weight factor sequence; Based on the power grid security situation dynamic aggregation weight factor sequence, the weighted sum of the power grid security situation enhanced embedded coding vector sequence is calculated to obtain a power grid security situation time series significant aggregation representation vector.

7. The method for predicting power grid risks based on network security data according to claim 6 is characterized in that: The method for acquiring the power grid security situation dynamic aggregation energy factor sequence includes: Taking the square value of the number of eigenvectors between the power grid security situation enhanced embedded coding vector and the initial center vector of the power grid security situation data clustering as the spatial span coefficient, the product A of the static energy factor of the power grid security situation enhanced embedded coding vector and the static energy factor of the initial center vector of the power grid security situation data clustering is calculated, and the weighted ratio between the product A and the spatial span coefficient is calculated to obtain the dynamic aggregation energy factor of the power grid security situation.

8. The method for predicting power grid risks based on network security data according to claim 1, characterized in that: The method of predicting whether the network state of the power grid is abnormal based on the significant aggregation representation vector of the power grid security situation time series includes: The grid security situation time series significant aggregation representation vector is input into a grid risk prediction model based on a classifier to predict whether there is an abnormality in the grid network state.

9. A power grid risk prediction system based on network security data, characterized in that: The system is used to implement the method for predicting power grid risk based on network security data according to any one of claims 1 to 8, and comprises: The acquisition module is used to obtain power grid security situation data and construct a power grid security situation data sequence; A coding module, used for embedding and coding each power grid security situation data in the power grid security situation data sequence based on the power grid security situation data embedding coding matrix to obtain a power grid security situation embedding coding vector sequence; An enhanced aggregation module is used to perform feature enhancement and dynamic aggregation processing on the power grid security situation embedded coding vector sequence to obtain a power grid security situation time series significant aggregation representation vector; The prediction module predicts whether the network status of the power grid is abnormal based on the time series significant aggregation representation vector of the power grid security situation.

10. A computer readable medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the power grid risk prediction method based on network security data as described in any one of claims 1 to 8.

Images